Function at 0x140001870
Capabilities:
Encode data using xor
Enumerate process modules
Enumerate processes
Execute command
Get disk information

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x9e0
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
movaps xmmword [rax - 0x58], xmm9
movaps xmmword [rax - 0x68], xmm10
movaps xmmword [rax - 0x78], xmm11
movaps xmmword [rax - 0x88], xmm12
movaps xmmword [rax - 0x98], xmm13
movaps xmmword [rax - 0xa8], xmm14
movaps xmmword [rax - 0xb8], xmm15
mov rax, qword [0x140076180]
xor rax, rsp
mov qword [rsp + 0x938], rax
xor esi, esi
mov dword [rsp + 0x55c], esi
lea rcx, str.chcp_65001
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140062314]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDC]
mov r15, rax
mov r14d, esi
xorps xmm7, xmm7
movdqa xmm8, xmmword [0x140062aa0]
movsd xmm10, qword [0x1400629d0]
movsd xmm11, qword [0x1400629b0]
movsd xmm9, qword [0x1400629e8]
movsd xmm12, qword [0x1400629c8]
movsd xmm13, qword [0x1400629b8]
movsd xmm14, qword [0x1400629d8]
movsd xmm15, qword [0x1400629c0]
nop dword [rax]
nop word [rax + rax]
cvtps2pd xmm6, xmm7
movaps xmm0, xmm6
mulsd xmm0, xmm10
subsd xmm0, xmm11
call sub.api_ms_win_crt_math_l1_1_0.dll_sin
andps xmm0, xmm8
mulsd xmm0, xmm9
cvttsd2si edi, xmm0
movaps xmm0, xmm6
mulsd xmm0, xmm12
subsd xmm0, xmm13
call sub.api_ms_win_crt_math_l1_1_0.dll_sin
andps xmm0, xmm8
mulsd xmm0, xmm9
cvttsd2si ebx, xmm0
movaps xmm0, xmm6
mulsd xmm0, xmm14
subsd xmm0, xmm15
call sub.api_ms_win_crt_math_l1_1_0.dll_sin
andps xmm0, xmm8
mulsd xmm0, xmm9
cvttsd2si eax, xmm0
movzx r8d, bl
shl r8d, 8
movzx ecx, al
shl ecx, 0x10
or r8d, ecx
movzx eax, dil
or r8d, eax
mov edx, 5
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreatePen]
mov rbx, rax
mov rdx, rax
mov rcx, r15
call qword [sym.imp.GDI32.dll_SelectObject]
movaps xmm0, xmm7
call sub.api_ms_win_crt_math_l1_1_0.dll_sinf
mulss xmm0, dword [0x1400629f0]
movss xmm1, dword [0x1400629f4]
subss xmm1, xmm0
cvttss2si r8d, xmm1
mov edx, r14d
mov rcx, r15
call qword [sym.imp.GDI32.dll_LineTo]
inc r14d
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
addsd xmm6, qword [0x1400629a8]
cvtpd2ps xmm7, xmm6
cvtps2pd xmm0, xmm7
movsd xmm1, qword [0x1400629e0]
comisd xmm1, xmm0
ja 0x140001970
lea rdx, str.Program_for_Fake_Online__v1.1__by:_n_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004f10
lea rdx, str._t_________________________________________________n__________________________________________________________n_________________________________________________________n___________________________________________________________n___________________________________________________________n___________________________________________________________n___________________________________________________________n___________________________________________________________n_________________________________________________________n_________________________________________________________n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004f10
lea rdx, str.Discord_for_buy:_dplexx_:__n_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004f10
lea rdx, str.Telegram_for_buy:_dplexx2_:__n_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004f10
xorps xmm0, xmm0
movups xmmword [rsp + 0x910], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x920], xmm1
mov ecx, 0x20
call fcn.140054d40
mov qword [rsp + 0x910], rax
movdqa xmm0, xmmword [0x140062a20]
movdqu xmmword [rsp + 0x920], xmm0
movups xmm0, xmmword [str.cm1hat5450025ns010b4pksv8]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1400625d0]
movsd qword [rax + 0x10], xmm0
movzx ecx, byte [0x1400625d8]
mov byte [rax + 0x18], cl
mov byte [rax + 0x19], sil
lea rcx, [rsp + 0x910]
call fcn.1400307c0
nop
mov rdx, qword [rsp + 0x928]
cmp rdx, 0xf
jbe 0x140001b5d
inc rdx
mov rcx, qword [rsp + 0x910]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001b58
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001b58
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140054d7c
xorps xmm0, xmm0
movups xmmword [rsp + 0x588], xmm0
movdqa xmm6, xmmword [0x140062a00]
movdqu xmmword [rsp + 0x598], xmm6
mov byte [rsp + 0x588], 0
lea rdx, str.Enter_your_key:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004f10
lea rdx, [rsp + 0x588]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400050f0
nop
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0xf8]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1400622e8]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x1400039d8
lea r10, [rsp + 0x925]
mov r8d, dword [rsp + 0xf8]
nop
dec r10
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x140001bf0
lea r9, [rsp + 0x558]
lea r8, [rsp + 0x925]
mov rdx, r10
lea rcx, [rsp + 0x40]
call fcn.1400056e0
mov ebx, 0xe00
mov dword [rsp + 0x55c], ebx
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x588]
call fcn.140025424
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140001c96
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c91
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001c91
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140054d7c
lea rdx, str.Valid_key
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004f10
lea rdx, [0x1400052e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
jmp 0x140001ccd
xorps xmm0, xmm0
movups xmmword [rsp + 0x910], xmm0
movdqa xmm1, xmmword [reloc.WS2_32.dll_getsockname]
movdqu xmmword [rsp + 0x920], xmm1
mov eax, dword [str.secret]
mov dword [rsp + 0x910], eax
movzx eax, word [0x140062674]
mov word [rsp + 0x914], ax
mov byte [rsp + 0x916], 0
lea rdx, [rsp + 0x910]
lea rcx, [rsp + 0x40]
call fcn.14000e824
nop
mov rdx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x140001d2d
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005810
lea rdx, [0x1400052e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140001d8e
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d89
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001d89
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140054d7c
movdqu xmmword [rsp + 0x50], xmm6
mov byte [rsp + 0x40], 0
mov rdx, qword [rsp + 0x928]
cmp rdx, 0xf
jbe 0x140001ddf
inc rdx
mov rcx, qword [rsp + 0x910]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001dda
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001dda
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140054d7c
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
xor edx, edx
mov r8d, 0x118
lea rcx, [rsp + 0x5b0]
call sub.VCRUNTIME140.dll_memset
lea rax, [0x140062974]
mov qword [rsp + 0x5b0], rax
lea rax, [0x1400628d8]
mov qword [rsp + 0x5c0], rax
lea rcx, [rsp + 0x668]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
bts ebx, 8
mov dword [rsp + 0x55c], ebx
xor r8d, r8d
lea rdx, [rsp + 0x5c8]
lea rcx, [rsp + 0x5b0]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
nop
mov rax, qword [rsp + 0x5b0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_fstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x5b0], rax
mov rax, qword [rsp + 0x5b0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb8]
mov dword [rsp + rcx + 0x5ac], edx
lea rcx, [rsp + 0x5c8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rsp + 0x5c8], rax
mov byte [rsp + 0x644], 0
mov byte [rsp + 0x639], 0
lea rcx, [rsp + 0x5c8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rsp + 0x648], rsi
mov rax, qword [0x14007d6a8]
mov qword [rsp + 0x63c], rax
mov qword [rsp + 0x630], rsi
lea rcx, [rsp + 0x5b0]
call fcn.1400046c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x568], xmm0
movdqu xmmword [rsp + 0x578], xmm6
mov byte [rsp + 0x568], 0
mov rax, qword [rsp + 0x5b0]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x5b0]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rsp + 0x568]
lea rcx, [rsp + 0x5b0]
call fcn.1400059d0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rdi, rax
lea rbx, [rsp + 0x568]
cmp qword [rsp + 0x580], 0xf
cmova rbx, qword [rsp + 0x568]
mov dword [rax], esi
mov r8d, 0xa
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
mov r15d, eax
cmp rbx, qword [rsp + 0xf0]
jne 0x140001f9c
lea rcx, str.invalid_stoi_argument
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const____ptr64_]
int3
cmp dword [rdi], 0x22
jne 0x140001faf
lea rcx, str.stoi_argument_out_of_range
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
int3
mov rax, qword [rsp + 0x5b0]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x5b0]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rsp + 0x568]
lea rcx, [rsp + 0x5b0]
call fcn.1400059d0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rdi, rax
lea rbx, [rsp + 0x568]
cmp qword [rsp + 0x580], 0xf
cmova rbx, qword [rsp + 0x568]
mov dword [rax], esi
mov r8d, 0xa
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
mov r12d, eax
cmp rbx, qword [rsp + 0xf0]
jne 0x14000203e
lea rcx, str.invalid_stoi_argument
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const____ptr64_]
int3
cmp dword [rdi], 0x22
jne 0x140002051
lea rcx, str.stoi_argument_out_of_range
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
int3
mov rax, qword [rsp + 0x5b0]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x5b0]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rsp + 0x568]
lea rcx, [rsp + 0x5b0]
call fcn.1400059d0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rdi, rax
lea rbx, [rsp + 0x568]
cmp qword [rsp + 0x580], 0xf
cmova rbx, qword [rsp + 0x568]
mov dword [rax], esi
mov r8d, 0xa
lea rdx, [rsp + 0x100]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
mov r13d, eax
mov dword [rsp + 0x78], eax
cmp rbx, qword [rsp + 0x100]
jne 0x1400020e4
lea rcx, str.invalid_stoi_argument
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const____ptr64_]
int3
cmp dword [rdi], 0x22
jne 0x1400020f7
lea rcx, str.stoi_argument_out_of_range
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
int3
mov rax, qword [rsp + 0x5b0]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x5b0]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rsp + 0x568]
lea rcx, [rsp + 0x5b0]
call fcn.1400059d0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rdi, rax
lea rbx, [rsp + 0x568]
cmp qword [rsp + 0x580], 0xf
cmova rbx, qword [rsp + 0x568]
mov dword [rax], esi
mov r8d, 0xa
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
mov dword [rsp + 0xf8], eax
cmp rbx, qword [rsp + 0xf0]
jne 0x14000218a
lea rcx, str.invalid_stoi_argument
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const____ptr64_]
int3
cmp dword [rdi], 0x22
jne 0x14000219d
lea rcx, str.stoi_argument_out_of_range
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
int3
lea rcx, [rsp + 0x5c8]
call fcn.140004be0
test rax, rax
jne 0x1400021d4
mov rax, qword [rsp + 0x5b0]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x5b0]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov eax, 1
mov dword [rsp + 0x560], eax
lea rdx, str._nServer_Number:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004f10
lea rdx, [rsp + 0x560]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov edi, reloc.WS2_32.dll_select
mov r14d, reloc.WS2_32.dll_socket
movdqa xmm8, xmmword [0x140062a60]
movdqa xmm9, xmmword [0x140062a50]
movdqa xmm10, xmmword [0x140062a40]
movdqa xmm11, xmmword [0x140062a30]
movdqa xmm12, xmmword [0x140062a80]
movdqa xmm13, xmmword [str.1111]
movdqa xmm7, xmmword [0x140062a90]
xorps xmm0, xmm0
movups xmmword [rsp + 0x88], xmm0
nop dword [rax]
mov ecx, 0x30
call fcn.140054d40
mov rbx, rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0xa0], r14
movups xmm0, xmmword [str.DayZServer_x64.exe]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400626b0]
movups xmmword [rax + 0x10], xmm1
mov eax, dword [0x1400626c0]
mov dword [rbx + 0x20], eax
mov word [rbx + 0x24], si
mov edi, dword [rsp + 0x560]
mov dword [rsp + 0x6d0], 0x238
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140002409
lea rdx, [rsp + 0x6d0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
lea rax, [rsp + 0x6fc]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x1400022f3
mov r9, rbx
mov r10d, reloc.WS2_32.dll_select
mov r8d, r10d
cmp rdx, r10
cmovb r8, rdx
lea rcx, [rsp + 0x6fc]
test r8, r8
je 0x140002344
lea rax, [rsp + 0x6fc]
sub r9, rax
nop dword [rax + rax]
movzx eax, word [rcx]
cmp word [rcx + r9], ax
jne 0x140002361
add rcx, 2
sub r8, 1
jne 0x140002330
cmp r10, rdx
jb 0x140002361
ja 0x140002361
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14d, dword [rsp + 0x6d8]
jmp 0x14000240c
lea rdx, [rsp + 0x6d0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x140002400
nop word [rax + rax]
lea rax, [rsp + 0x6fc]
mov rdx, 0xffffffffffffffff
nop
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140002390
mov r9, rbx
mov r10d, reloc.WS2_32.dll_select
mov r8d, r10d
cmp rdx, r10
cmovb r8, rdx
lea rcx, [rsp + 0x6fc]
test r8, r8
je 0x1400023d9
lea rax, [rsp + 0x6fc]
sub r9, rax
movzx eax, word [rcx]
cmp word [rcx + r9], ax
jne 0x1400023eb
add rcx, 2
sub r8, 1
jne 0x1400023c5
cmp r10, rdx
jb 0x1400023eb
ja 0x1400023eb
cmp edi, 1
jle 0x14000234b
dec edi
lea rdx, [rsp + 0x6d0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140002380
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14d, esi
mov eax, reloc.WS2_32.dll_socket
lea rdx, [rax*2 + 2]
mov rcx, rbx
call fcn.140054d7c
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xa0], 7
mov word [rsp + 0x88], si
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test r14d, r14d
je 0x140003857
lea rdx, str.ID:
call fcn.140004f10
mov rcx, rax
mov edx, r14d
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x1400626f8]
call fcn.140004f10
mov r8d, r14d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14007d6a0], rax
movups xmm3, xmmword [str.GASVUZVRYSJ_tto__E]
movups xmmword [rsp + 0x40], xmm3
movups xmm0, xmmword [0x140062990]
movups xmmword [rsp + 0x50], xmm0
mov eax, dword [0x1400629a0]
mov dword [rsp + 0x60], eax
mov r8d, esi
cmp dword [0x1400761d8], 2
jl 0x140002659
movdqa xmm2, xmm11
punpckldq xmm2, xmm11
pmuldq xmm2, xmm7
movdqa xmm0, xmm11
punpckhdq xmm0, xmm11
pmuldq xmm0, xmm7
shufps xmm2, xmm0, 0xdd
psrad xmm2, 4
movdqa xmm1, xmm2
psrld xmm1, 0x1f
paddd xmm1, xmm2
pmulld xmm1, xmm13
movdqa xmm0, xmm11
psubd xmm0, xmm1
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
paddw xmm2, xmm12
movq xmm1, xmm3
xorps xmm2, xmm1
movq qword [rsp + 0x40], xmm2
movdqa xmm2, xmm10
punpckldq xmm2, xmm10
pmuldq xmm2, xmm7
movdqa xmm0, xmm10
punpckhdq xmm0, xmm10
pmuldq xmm0, xmm7
shufps xmm2, xmm0, 0xdd
psrad xmm2, 4
movdqa xmm1, xmm2
psrld xmm1, 0x1f
paddd xmm1, xmm2
pmulld xmm1, xmm13
movdqa xmm0, xmm10
psubd xmm0, xmm1
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
paddw xmm2, xmm12
movq xmm0, qword [rsp + 0x48]
xorps xmm2, xmm0
movq qword [rsp + 0x48], xmm2
movdqa xmm2, xmm9
punpckldq xmm2, xmm9
pmuldq xmm2, xmm7
movdqa xmm0, xmm9
punpckhdq xmm0, xmm9
pmuldq xmm0, xmm7
shufps xmm2, xmm0, 0xdd
psrad xmm2, 4
movdqa xmm1, xmm2
psrld xmm1, 0x1f
paddd xmm1, xmm2
pmulld xmm1, xmm13
movdqa xmm0, xmm9
psubd xmm0, xmm1
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
paddw xmm2, xmm12
movq xmm0, qword [rsp + 0x50]
xorps xmm2, xmm0
movq qword [rsp + 0x50], xmm2
movdqa xmm2, xmm8
punpckldq xmm2, xmm8
pmuldq xmm2, xmm7
movdqa xmm0, xmm8
punpckhdq xmm0, xmm8
pmuldq xmm0, xmm7
shufps xmm2, xmm0, 0xdd
psrad xmm2, 4
movdqa xmm1, xmm2
psrld xmm1, 0x1f
paddd xmm1, xmm2
pmulld xmm1, xmm13
movdqa xmm0, xmm8
psubd xmm0, xmm1
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
paddw xmm2, xmm12
movq xmm0, qword [rsp + 0x58]
xorps xmm2, xmm0
movq qword [rsp + 0x58], xmm2
mov r8d, reloc.WS2_32.dll_recv
mov eax, r8d
lea r9, [rsp + 0x40]
lea r9, [r9 + rax*2]
nop word [rax + rax]
mov eax, 0x5397829d
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x31
movzx eax, r8w
sub ax, cx
add ax, 0x34
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x12
jl 0x140002670
mov rdi, rsi
mov edx, r14d
mov ecx, 0x18
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140002716
mov dword [rsp + 0x110], 0x438
lea rdx, [rsp + 0x110]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x140002716
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x140]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14000270e
lea rdx, [rsp + 0x110]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x1400026e0
jmp 0x140002716
mov rdi, qword [rsp + 0x128]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x140001600]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
lea rdx, str.Base:
call fcn.140004f10
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x1400015e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test rdi, rdi
je 0x14000373e
mov dword [rsp + 0x68], 0xffff9302
mov dword [rsp + 0x6c], 0
mov dword [rsp + 0x70], 0x90ffc280
mov dword [rsp + 0x74], 0x9090
lea rdx, [0x1400626f8]
call fcn.140004f10
mov ebx, esi
movsxd r13, r13d
lea r14, [rsp + 0x68]
nop dword [rax]
nop dword [rax + rax]
mov byte [rsp + 0x558], 0
movsxd rdx, ebx
add rdx, r13
add rdx, rdi
mov qword [rsp + 0x20], rsi
mov r9d, 1
lea r8, [rsp + 0x558]
mov rcx, qword [0x14007d6a0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movzx ecx, byte [r14]
cmp cl, 0xff
je 0x1400027f3
cmp cl, byte [rsp + 0x558]
jne 0x140002802
inc ebx
inc r14
cmp ebx, 6
jl 0x1400027b0
jmp 0x140002897
xor bl, bl
mov r14d, esi
lea rax, [rsp + 0x70]
mov qword [rsp + 0xf0], rax
mov eax, 1
nop dword [rax]
mov byte [rsp + 0x559], 0
movsxd rdx, r14d
add rdx, rdi
add rdx, r13
mov qword [rsp + 0x20], rsi
mov r9, rax
lea r8, [rsp + 0x559]
mov rcx, qword [0x14007d6a0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [rsp + 0xf0]
movzx edx, byte [rcx]
movzx eax, byte [rsp + 0x559]
cmp dl, 0xff
je 0x14000286e
cmp dl, al
jne 0x140002ca5
movzx ebx, bl
cmp al, 0x90
mov eax, 1
cmove ebx, eax
inc r14d
inc rcx
mov qword [rsp + 0xf0], rcx
cmp r14d, 6
jl 0x140002820
test bl, bl
je 0x140002cb8
cmp r15d, r12d
je 0x1400034f9
lea rdx, str.____Online_set_to_range:__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004f10
mov rcx, rax
mov edx, r15d
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x1400627d0]
call fcn.140004f10
mov rcx, rax
mov edx, r12d
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, str.__with_change_every__
call fcn.140004f10
mov rcx, rax
mov edx, dword [rsp + 0xf8]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, str.__seconds_n
call fcn.140004f10
mov rcx, rax
lea rdx, str.____CTRLC_to_stop_n
call fcn.140004f10
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ecx, r12d
sub ecx, r15d
cdq
idiv ecx
lea ebx, [r15 + rdx]
lea rax, [r13 + 1]
add rax, rdi
mov qword [rsp + 0xb0], rax
lea rax, [r13 + 2]
add rax, rdi
mov qword [rsp + 0xb8], rax
lea rax, [r13 + 3]
add rax, rdi
mov qword [rsp + 0xc0], rax
lea rax, [r13 + 4]
add rax, rdi
mov qword [rsp + 0xc8], rax
lea rax, [r13 + 5]
add rax, rdi
mov qword [rsp + 0x80], rax
imul eax, dword [rsp + 0xf8], 0x3e8
mov dword [rsp + 0xf0], eax
add rdi, r13
mov r14, qword [rsp + 0xb0]
mov r13, qword [rsp + 0xb8]
nop word [rax + rax]
mov byte [rsp + 0x550], 0x80
mov qword [rsp + 0x20], rsi
mov r9d, 1
lea r8, [rsp + 0x550]
mov rdx, rdi
mov rcx, qword [0x14007d6a0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [rsp + 0x550], 0xc2
mov qword [rsp + 0x20], rsi
mov r9d, 1
lea r8, [rsp + 0x550]
mov rdx, r14
mov rcx, qword [0x14007d6a0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [rsp + 0x550], bl
mov qword [rsp + 0x20], rsi
mov r9d, 1
lea r8, [rsp + 0x550]
mov rdx, r13
mov rcx, qword [0x14007d6a0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [rsp + 0x550], 0x90
mov qword [rsp + 0x20], rsi
mov r9d, 1
lea r8, [rsp + 0x550]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [0x14007d6a0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [rsp + 0x550], 0x90
mov qword [rsp + 0x20], rsi
mov r9d, 1
lea r8, [rsp + 0x550]
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [0x14007d6a0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [rsp + 0x550], 0x90
mov qword [rsp + 0x20], rsi
mov r9d, 1
lea r8, [rsp + 0x550]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [0x14007d6a0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp ebx, r15d
jg 0x140002ac6
inc ebx
jmp 0x140002acd
cmp ebx, r12d
jl 0x140002acd
dec ebx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x55555556
imul r8d
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
sub r8d, ecx
mov eax, 1
sub eax, r8d
add ebx, eax
mov dword [rsp + 0x55c], 0xf1
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rsp + 0x55c]
mov rdx, rdi
mov rcx, qword [0x14007d6a0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [rsp + 0x55c], 0xf1
jne 0x1400029a0
lea rdx, [0x1400626f8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004f10
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edi, reloc.WS2_32.dll_select
mov r14d, reloc.WS2_32.dll_socket
nop dword [rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x910], xmm0
mov ecx, 0x30
call fcn.140054d40
mov qword [rsp + 0x910], rax
mov qword [rsp + 0x920], rdi
mov qword [rsp + 0x928], r14
movups xmm0, xmmword [str.DayZServer_x64.exe]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400626b0]
movups xmmword [rax + 0x10], xmm1
mov ecx, dword [0x1400626c0]
mov dword [rax + 0x20], ecx
mov word [rax + 0x24], si
mov edx, dword [rsp + 0x560]
lea rcx, [rsp + 0x910]
call fcn.1400016c0
mov ebx, eax
mov rdx, qword [rsp + 0x928]
cmp rdx, 7
jbe 0x140002c0d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x910]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400034f2
call fcn.140054d7c
mov qword [rsp + 0x920], rsi
mov qword [rsp + 0x928], 7
mov word [rsp + 0x910], si
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test ebx, ebx
jne 0x140002c50
lea rdx, str.____Server_stopped_waiting_30_seconds..._n
call fcn.140004f10
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002b60
lea rdx, str.____Waiting_extra_30_seconds_for_server_to_load..._n
call fcn.140004f10
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
mov dword [rsp + 0x560], eax
lea rdx, str._nServer_Number:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004f10
lea rdx, [rsp + 0x560]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov r13d, dword [rsp + 0x78]
jmp 0x140002251
lea rdx, str._n____Wrong_offset_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004f10
lea rdx, str.____Updating_in_0x800000_bytes_range_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004f10
mov r14d, 0xffc00000
mov rbx, rsi
nop dword [rax]
nop dword [rax + rax]
mov byte [rsp + 0x558], 0
movsxd rdx, r14d
add rdx, rdi
add rdx, r13
mov qword [rsp + 0x20], rsi
mov r9d, 1
lea r8, [rsp + 0x558]
mov rcx, qword [0x14007d6a0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movzx eax, byte [rsp + rbx + 0x68]
cmp byte [rsp + 0x558], al
je 0x140002d28
cmp al, 0xff
je 0x140002d28
mov rbx, rsi
jmp 0x140002d35
cmp rbx, 5
je 0x140002f28
inc rbx
inc r14d
cmp r14d, 0x400000
jl 0x140002ce0
lea rdx, str.____Could_not_update_offset_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004f10
nop
mov rdx, qword [rsp + 0x580]
cmp rdx, 0xf
jbe 0x140002d98
inc rdx
mov rcx, qword [rsp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d93
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000389e
call fcn.140054d7c
movdqu xmmword [rsp + 0x578], xmm6
mov byte [rsp + 0x568], 0
mov rax, qword [rsp + 0x5b0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_fstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x5b0], rax
mov rax, qword [rsp + 0x5b0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb8]
mov dword [rsp + rcx + 0x5ac], edx
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rsp + 0x5c8], rax
cmp qword [rsp + 0x648], 0
je 0x140002e36
lea rcx, [rsp + 0x638]
mov rax, qword [rsp + 0x5e0]
cmp qword [rax], rcx
jne 0x140002e36
mov rdx, qword [rsp + 0x658]
mov rcx, qword [rsp + 0x650]
mov qword [rax], rcx
mov rax, qword [rsp + 0x600]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rsp + 0x618]
mov dword [rax], edx
cmp byte [rsp + 0x644], 0
je 0x140002e4d
lea rcx, [rsp + 0x5c8]
call fcn.140004be0
lea rcx, [rsp + 0x5c8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x5d0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rsp + 0x668]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rsp + 0x5a0]
cmp rdx, 0xf
jbe 0x140002ebc
inc rdx
mov rcx, qword [rsp + 0x588]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002eb7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400039d1
call fcn.140054d7c
xor eax, eax
mov rcx, qword [rsp + 0x938]
xor rcx, rsp
call fcn.140054d20
lea r11, [rsp + 0x9e0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
movaps xmm14, xmmword [r11 - 0x90]
movaps xmm15, xmmword [r11 - 0xa0]
mov rsp, r11
pop r15
pop r14
pop r13
ret
mov ebx, dword [rsp + 0x78]
add ebx, 0xfffffffb
add ebx, r14d
lea rdx, str.____New_offset_found:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004f10
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x1400626f8]
call fcn.140004f10
lea rcx, [rsp + 0x5b0]
call fcn.1400046c0
lea r10, [rsp + 0x925]
test r15d, r15d
jns 0x140002fc0
neg r15d
nop dword [rax]
dec r10
mov eax, 0xcccccccd
mul r15d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r15b, cl
add r15b, 0x30
mov byte [r10], r15b
mov r15d, edx
test edx, edx
jne 0x140002f80
dec r10
mov byte [r10], 0x2d
jmp 0x140002fea
dec r10
mov eax, 0xcccccccd
mul r15d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r15b, cl
add r15b, 0x30
mov byte [r10], r15b
mov r15d, edx
test edx, edx
jne 0x140002fc0
lea r9, [rsp + 0x558]
lea r8, [rsp + 0x925]
mov rdx, r10
lea rcx, [rsp + 0x40]
call fcn.1400056e0
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
lea rcx, [rsp + 0x5c0]
call fcn.140005810
lea rdx, [0x1400626f8]
mov rcx, rax
call fcn.140004f10
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x14000307b
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003076
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003076
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140054d7c
lea r10, [rsp + 0x925]
test r12d, r12d
jns 0x1400030d0
neg r12d
nop dword [rax + rax]
dec r10
mov eax, 0xcccccccd
mul r12d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r12b, cl
add r12b, 0x30
mov byte [r10], r12b
mov r12d, edx
test edx, edx
jne 0x140003090
dec r10
mov byte [r10], 0x2d
jmp 0x1400030fa
dec r10
mov eax, 0xcccccccd
mul r12d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r12b, cl
add r12b, 0x30
mov byte [r10], r12b
mov r12d, edx
test edx, edx
jne 0x1400030d0
lea r9, [rsp + 0x558]
lea r8, [rsp + 0x925]
mov rdx, r10
lea rcx, [rsp + 0x40]
call fcn.1400056e0
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
lea rcx, [rsp + 0x5c0]
call fcn.140005810
lea rdx, [0x1400626f8]
mov rcx, rax
call fcn.140004f10
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x14000318b
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003186
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003186
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140054d7c
lea r10, [rsp + 0x925]
test ebx, ebx
jns 0x1400031d0
neg ebx
nop dword [rax]
dec r10
mov eax, 0xcccccccd
mul ebx
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub bl, cl
add bl, 0x30
mov byte [r10], bl
mov ebx, edx
test edx, edx
jne 0x1400031a0
dec r10
mov byte [r10], 0x2d
jmp 0x1400031f6
dec r10
mov eax, 0xcccccccd
mul ebx
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub bl, cl
add bl, 0x30
mov byte [r10], bl
mov ebx, edx
test edx, edx
jne 0x1400031d0
lea r9, [rsp + 0x558]
lea r8, [rsp + 0x925]
mov rdx, r10
lea rcx, [rsp + 0x40]
call fcn.1400056e0
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
lea rcx, [rsp + 0x5c0]
call fcn.140005810
lea rdx, [0x1400626f8]
mov rcx, rax
call fcn.140004f10
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140003287
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003282
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003282
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140054d7c
mov r8d, dword [rsp + 0xf8]
lea r10, [rsp + 0x925]
test r8d, r8d
jns 0x1400032e0
neg r8d
nop
dec r10
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x1400032a0
dec r10
mov byte [r10], 0x2d
jmp 0x14000330a
dec r10
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x1400032e0
lea r9, [rsp + 0x558]
lea r8, [rsp + 0x925]
mov rdx, r10
lea rcx, [rsp + 0x40]
call fcn.1400056e0
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
lea rcx, [rsp + 0x5c0]
call fcn.140005810
lea rdx, [0x1400626f8]
mov rcx, rax
call fcn.140004f10
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x14000339b
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003396
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003396
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140054d7c
lea rcx, [rsp + 0x5c8]
call fcn.140004be0
test rax, rax
jne 0x1400033d2
mov rax, qword [rsp + 0x5b0]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x5b0]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rdx, str.____Offset_saved__restart_the_program_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004f10
nop
mov rdx, qword [rsp + 0x580]
cmp rdx, 0xf
jbe 0x140003429
inc rdx
mov rcx, qword [rsp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003424
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000389e
call fcn.140054d7c
movdqu xmmword [rsp + 0x578], xmm6
mov byte [rsp + 0x568], 0
mov rax, qword [rsp + 0x5b0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_fstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x5b0], rax
mov rax, qword [rsp + 0x5b0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb8]
mov dword [rsp + rcx + 0x5ac], edx
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rsp + 0x5c8], rax
cmp qword [rsp + 0x648], 0
je 0x1400034c7
lea rcx, [rsp + 0x638]
mov rax, qword [rsp + 0x5e0]
cmp qword [rax], rcx
jne 0x1400034c7
mov rdx, qword [rsp + 0x658]
mov rcx, qword [rsp + 0x650]
mov qword [rax], rcx
mov rax, qword [rsp + 0x600]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rsp + 0x618]
mov dword [rax], edx
cmp byte [rsp + 0x644], 0
je 0x1400034de
lea rcx, [rsp + 0x5c8]
call fcn.140004be0
lea rcx, [rsp + 0x5c8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
jmp 0x140002e5c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov byte [rsp + 0x550], 0x80
lea rdx, [rdi + r13]
mov qword [rsp + 0x20], rsi
mov ebx, 1
mov r9d, ebx
lea r8, [rsp + 0x550]
mov rcx, qword [0x14007d6a0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [rsp + 0x550], 0xc2
lea rdx, [r13 + 1]
add rdx, rdi
mov qword [rsp + 0x20], rsi
mov r9d, ebx
lea r8, [rsp + 0x550]
mov rcx, qword [0x14007d6a0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [rsp + 0x550], r15b
lea rdx, [r13 + 2]
add rdx, rdi
mov qword [rsp + 0x20], rsi
mov r9d, ebx
lea r8, [rsp + 0x550]
mov rcx, qword [0x14007d6a0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [rsp + 0x550], 0x90
lea rdx, [r13 + 3]
add rdx, rdi
mov qword [rsp + 0x20], rsi
mov r9d, ebx
lea r8, [rsp + 0x550]
mov rcx, qword [0x14007d6a0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [rsp + 0x550], 0x90
lea rdx, [r13 + 4]
add rdx, rdi
mov qword [rsp + 0x20], rsi
mov r9d, ebx
lea r8, [rsp + 0x550]
mov rcx, qword [0x14007d6a0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [rsp + 0x550], 0x90
lea rdx, [r13 + 5]
add rdx, rdi
mov qword [rsp + 0x20], rsi
mov r9d, ebx
lea r8, [rsp + 0x550]
mov rcx, qword [0x14007d6a0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, str.____Online_set_to:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004f10
mov rcx, rax
mov edx, r15d
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x1400626f8]
call fcn.140004f10
nop
mov rdx, qword [rsp + 0x580]
cmp rdx, 0xf
jbe 0x140003675
inc rdx
mov rcx, qword [rsp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003670
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000389e
call fcn.140054d7c
movdqu xmmword [rsp + 0x578], xmm6
mov byte [rsp + 0x568], 0
mov rax, qword [rsp + 0x5b0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_fstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x5b0], rax
mov rax, qword [rsp + 0x5b0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb8]
mov dword [rsp + rcx + 0x5ac], edx
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rsp + 0x5c8], rax
cmp qword [rsp + 0x648], 0
je 0x140003713
lea rcx, [rsp + 0x638]
mov rax, qword [rsp + 0x5e0]
cmp qword [rax], rcx
jne 0x140003713
mov rdx, qword [rsp + 0x658]
mov rcx, qword [rsp + 0x650]
mov qword [rax], rcx
mov rax, qword [rsp + 0x600]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rsp + 0x618]
mov dword [rax], edx
cmp byte [rsp + 0x644], 0
je 0x14000372a
lea rcx, [rsp + 0x5c8]
call fcn.140004be0
lea rcx, [rsp + 0x5c8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
jmp 0x140002e5c
lea rdx, str._n____Could_not_find_steamclient64.dll_n
call fcn.140004f10
nop
mov rdx, qword [rsp + 0x580]
cmp rdx, 0xf
jbe 0x14000378e
inc rdx
mov rcx, qword [rsp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003789
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000389e
call fcn.140054d7c
movdqu xmmword [rsp + 0x578], xmm6
mov byte [rsp + 0x568], 0
mov rax, qword [rsp + 0x5b0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_fstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x5b0], rax
mov rax, qword [rsp + 0x5b0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb8]
mov dword [rsp + rcx + 0x5ac], edx
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rsp + 0x5c8], rax
cmp qword [rsp + 0x648], 0
je 0x14000382c
lea rcx, [rsp + 0x638]
mov rax, qword [rsp + 0x5e0]
cmp qword [rax], rcx
jne 0x14000382c
mov rdx, qword [rsp + 0x658]
mov rcx, qword [rsp + 0x650]
mov qword [rax], rcx
mov rax, qword [rsp + 0x600]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rsp + 0x618]
mov dword [rax], edx
cmp byte [rsp + 0x644], 0
je 0x140003843
lea rcx, [rsp + 0x5c8]
call fcn.140004be0
lea rcx, [rsp + 0x5c8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
jmp 0x140002e5c
lea rdx, str._n____Could_not_find_running_server_executable_n
call fcn.140004f10
nop
mov rdx, qword [rsp + 0x580]
cmp rdx, 0xf
jbe 0x1400038aa
inc rdx
mov rcx, qword [rsp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400038a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400038a5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140054d7c
movdqu xmmword [rsp + 0x578], xmm6
mov byte [rsp + 0x568], 0
mov rax, qword [rsp + 0x5b0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_fstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x5b0], rax
mov rax, qword [rsp + 0x5b0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb8]
mov dword [rsp + rcx + 0x5ac], edx
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rsp + 0x5c8], rax
cmp qword [rsp + 0x648], 0
je 0x140003948
lea rcx, [rsp + 0x638]
mov rax, qword [rsp + 0x5e0]
cmp qword [rax], rcx
jne 0x140003948
mov rdx, qword [rsp + 0x658]
mov rcx, qword [rsp + 0x650]
mov qword [rax], rcx
mov rax, qword [rsp + 0x600]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rsp + 0x618]
mov dword [rax], edx
cmp byte [rsp + 0x644], 0
je 0x14000395f
lea rcx, [rsp + 0x5c8]
call fcn.140004be0
lea rcx, [rsp + 0x5c8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x5d0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rsp + 0x668]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rsp + 0x5a0]
cmp rdx, 0xf
jbe 0x140002ebc
inc rdx
mov rcx, qword [rsp + 0x588]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002eb7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002eb7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, str.failed_to_get_hwid
lea rcx, [rsp + 0xd8]
call fcn.140001470
lea rdx, [0x140072880]
lea rcx, [rsp + 0xd8]
call sub.VCRUNTIME140.dll__CxxThrowException
int3