Function at 0x14002a2a0
Capabilities:
Check for foreground window switch
Create process on windows
Encode data using xor
Execute command
Set console window title

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xb8]
sub rsp, 0x190
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140118180]
xor rax, rsp
mov qword [rbp + 0x78], rax
xor r14d, r14d
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
movups xmm0, xmmword [str.VSBMoXH]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [0x1401004b0]
movups xmmword [rbp + 0x20], xmm1
psrldq xmm1, 0xf
movd eax, xmm1
test al, al
je 0x14002a490
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x14002a44f
movdqa xmm5, xmmword [0x1401037a0]
mov edx, r14d
movdqa xmm4, xmmword [0x140103b10]
movdqa xmm6, xmmword [0x140103810]
movdqa xmm0, xmmword [0x140103a20]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rbp + 0x10]
mov r8d, dword [rsp + 0x40]
nop dword [rax]
movd xmm2, edx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140103a00]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [rdx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140103a00]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm2, xmm0
movd dword [rcx + 4], xmm2
add edx, 8
lea rcx, [rcx + 8]
cmp edx, 0x20
jl 0x14002a350
jmp 0x14002a490
lea r9, [rbp + 0x10]
mov r8d, r14d
nop word [rax + rax]
mov eax, 0x4ec4ec4f
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x34
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x20
jl 0x14002a460
lea rax, [rbp + 0x10]
mov rsi, 0xffffffffffffffff
mov rcx, rsi
nop
inc rcx
cmp byte [rax + rcx], r14b
jne 0x14002a4a0
movabs rdi, 0x7fffffffffffffff
mov rax, rdi
mov rdx, qword [0x1401ae790]
sub rax, rdx
cmp rax, rcx
jb 0x14002b606
lea rax, [0x1401ae780]
cmp qword [0x1401ae798], 0xf
cmova rax, qword [0x1401ae780]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x10]
lea r8, [0x1401ae780]
movzx edx, byte [rbp - 0x70]
lea rcx, [rbp + 0x58]
call fcn.1400049b0
nop
lea rcx, [rbp + 0x58]
cmp qword [rbp + 0x70], 0xf
cmova rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov r15d, 0x9a
mov dword [rsp + 0x60], 0x32009a
movdqa xmm0, xmmword [0x140103c20]
movdqu xmmword [rsp + 0x64], xmm0
movdqa xmm1, xmmword [0x140103bc0]
movdqu xmmword [rsp + 0x74], xmm1
mov word [rbp - 0x7c], 0xaf
lea rcx, [rsp + 0x60]
call fcn.14002cc10
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
je 0x14002af8d
mov dword [rsp + 0x60], 0x32009a
movdqa xmm0, xmmword [0x140103c20]
movdqu xmmword [rsp + 0x64], xmm0
movdqa xmm1, xmmword [0x1401039f0]
movdqu xmmword [rsp + 0x74], xmm1
lea rcx, [rsp + 0x60]
call fcn.14002d130
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
je 0x14002b596
call fcn.1400273f0
test al, al
je 0x14002ac4a
mov ecx, reloc.WS2_32.dll_recv
call fcn.1400e25b8
mov dword [rax], 0x6e75614c
mov dword [rax + 4], 0x6e696863
mov dword [rax + 8], 0x74532067
mov dword [rax + 0xc], 0x6d6165
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x48], r14
mov qword [rbp + 0x50], r14
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14002a5f0
mov rdx, rax
lea rcx, [rbp + 0x38]
call fcn.140004b50
mov dword [rsp + 0x20], 8
xor r9d, r9d
lea edx, [r9 + 9]
lea rcx, [rbp + 0x38]
call fcn.140005f90
mov dword [rsp + 0x60], 0x32009a
movdqa xmm0, xmmword [0x140103b80]
movdqu xmmword [rsp + 0x64], xmm0
movdqa xmm1, xmmword [0x140103c00]
movdqu xmmword [rsp + 0x74], xmm1
mov dword [rbp - 0x7c], 0xb0d5fb96
mov word [rbp - 0x78], 0xadc8
mov byte [rbp - 0x76], 0
lea rcx, [rsp + 0x60]
call fcn.14002ca40
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], r14
mov r8, rsi
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14002a670
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140004b50
nop
mov rcx, qword [rbp + 0x20]
inc rcx
mov eax, 2
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400e25b8
mov rbx, rax
lea rcx, [rbp + 0x10]
mov rdx, qword [rbp + 0x20]
cmp qword [rbp + 0x28], 0xf
jbe 0x14002a6bd
mov rax, qword [rbp + 0x10]
add rdx, rax
jmp 0x14002a6c4
add rdx, rcx
lea rax, [rbp + 0x10]
mov r8, rbx
mov rcx, rax
call fcn.140031c30
mov rax, qword [rbp + 0x20]
mov word [rbx + rax*2], r14w
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x3a98
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x60], 0x32009a
movdqa xmm0, xmmword [0x140103c20]
movdqu xmmword [rsp + 0x64], xmm0
movdqa xmm1, xmmword [0x140103bc0]
movdqu xmmword [rsp + 0x74], xmm1
mov word [rbp - 0x7c], 0xaf
lea rcx, [rsp + 0x60]
call fcn.14002cc10
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
je 0x14002a745
mov ecx, 0x1388
jmp 0x14002a6f7
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call fcn.1400e2394
mov dword [rsp + 0x40], 0x32009a
mov dword [rsp + 0x44], 0x9ef085e4
mov dword [rsp + 0x48], 0x94f095fd
mov dword [rsp + 0x4c], 0xf693e7b4
mov word [rsp + 0x50], 0xfa97
mov byte [rsp + 0x52], 0
lea rcx, [rsp + 0x40]
call fcn.14002c980
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x48], r14
mov qword [rbp + 0x50], r14
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x14002a7a0
mov rdx, rax
lea rcx, [rbp + 0x38]
call fcn.140004b50
mov dword [rsp + 0x20], 8
mov edx, 0xa
lea r9d, [rdx - 9]
lea rcx, [rbp + 0x38]
call fcn.140005f90
mov dword [rsp + 0x60], 0x32009a
movdqa xmm0, xmmword [0x140103c20]
movdqu xmmword [rsp + 0x64], xmm0
movdqa xmm1, xmmword [0x1401039f0]
movdqu xmmword [rsp + 0x74], xmm1
lea rcx, [rsp + 0x60]
call fcn.14002d130
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
je 0x14002aa60
mov dword [rsp + 0x40], 0x32009a
mov dword [rsp + 0x44], 0x9ef085e4
mov dword [rsp + 0x48], 0x92fc95fd
mov dword [rsp + 0x4c], 0xc596d5f5
mov word [rsp + 0x50], 0xf7
lea rcx, [rsp + 0x40]
call fcn.14002dd50
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x14002a855
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140004b50
mov dword [rsp + 0x20], 8
xor r9d, r9d
lea edx, [r9 + 9]
lea rcx, [rsp + 0x60]
call fcn.140005f90
mov dword [rsp + 0x40], 0x32009a
mov dword [rsp + 0x44], 0x80e58fe1
mov dword [rsp + 0x48], 0x90fe97e3
mov word [rsp + 0x4c], 0xf7
lea rcx, [rsp + 0x40]
call fcn.14002c900
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x14002a8c3
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140004b50
mov dword [rsp + 0x20], 8
xor r9d, r9d
lea edx, [r9 + 9]
lea rcx, [rsp + 0x60]
call fcn.140005f90
mov dword [rsp + 0x40], 0x32009a
movdqa xmm0, xmmword [0x140103be0]
movdqu xmmword [rsp + 0x44], xmm0
mov dword [rsp + 0x54], 0xbd8eb996
mov word [rsp + 0x58], Ordinal_143
lea rcx, [rsp + 0x40]
call fcn.14002c800
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x48], r14
mov qword [rbp + 0x50], r14
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x14002a934
mov rdx, rax
lea rcx, [rbp + 0x38]
call fcn.140004b50
nop
mov rcx, qword [rbp + 0x48]
inc rcx
mov eax, 2
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400e25b8
mov rbx, rax
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x48]
cmp qword [rbp + 0x50], 0xf
jbe 0x14002a981
mov r9, qword [rbp + 0x38]
add rdx, r9
jmp 0x14002a988
add rdx, rcx
lea r9, [rbp + 0x38]
mov r8, rbx
mov rcx, r9
call fcn.140031c30
mov rax, qword [rbp + 0x48]
mov word [rbx + rax*2], r14w
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x60], 0x32009a
movdqa xmm0, xmmword [0x140103c20]
movdqu xmmword [rsp + 0x64], xmm0
movdqa xmm1, xmmword [0x1401039f0]
movdqu xmmword [rsp + 0x74], xmm1
lea rcx, [rsp + 0x60]
call fcn.14002d130
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
je 0x14002aa03
mov ecx, 0x1388
jmp 0x14002a9bb
mov qword [rsp + 0x40], 0xa
lea rcx, [rsp + 0x40]
call fcn.140020990
nop
mov rdx, qword [rbp + 0x50]
cmp rdx, 0xf
jbe 0x14002aa60
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002aa50
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002aa50
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e2394
nop word [rax + rax]
mov dword [rsp + 0x60], 0x32009a
movdqa xmm0, xmmword [0x140103c20]
movdqu xmmword [rsp + 0x64], xmm0
movdqa xmm1, xmmword [0x1401039f0]
movdqu xmmword [rsp + 0x74], xmm1
lea rcx, [rsp + 0x60]
call fcn.14002d130
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
je 0x14002aaa8
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14002aa60
mov qword [rsp + 0x40], 0xa
lea rcx, [rsp + 0x40]
call fcn.140020990
mov dword [rsp + 0x40], 0x32009a
mov dword [rsp + 0x44], 0x9ef085e4
mov dword [rsp + 0x48], 0x94f095fd
mov dword [rsp + 0x4c], 0x96a4f7b4
mov byte [rsp + 0x50], 0
lea rcx, [rsp + 0x40]
call fcn.14002c750
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov r8, rsi
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14002ab00
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140004b50
mov dword [rsp + 0x20], 8
xor r9d, r9d
lea edx, [r9 + 0xa]
lea rcx, [rsp + 0x60]
call fcn.140005f90
mov dword [rsp + 0x40], 0x32009a
movdqa xmm0, xmmword [0x140103bf0]
movdqu xmmword [rsp + 0x44], xmm0
mov dword [rsp + 0x54], 0xe68ae693
mov word [rsp + 0x58], 0x9f
lea rcx, [rsp + 0x40]
call fcn.14002c800
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x14002ab74
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140004b50
mov dword [rsp + 0x20], 8
xor r9d, r9d
lea edx, [r9 + 0xa]
lea rcx, [rsp + 0x60]
call fcn.140005f90
mov dword [rbp - 0x60], 0x32009a
lea rcx, [rbp - 0x60]
call fcn.140030350
lea rcx, [rbp - 0x60]
call fcn.14002c540
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
nop
inc rsi
cmp byte [rax + rsi], 0
jne 0x14002abd0
mov r8, rsi
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140004b50
mov dword [rsp + 0x20], 8
xor r9d, r9d
lea edx, [r9 + 0xa]
lea rcx, [rsp + 0x60]
call fcn.140005f90
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x14002b596
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002ac40
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002ac40
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e2394
jmp 0x14002b596
mov dword [rsp + 0x40], 0x32009a
mov dword [rsp + 0x44], 0x8a00e1
mov dword [rsp + 0x48], 0x8500eb
mov dword [rsp + 0x4c], 0x8d00e4
mov dword [rsp + 0x50], 0x8c00e9
mov dword [rsp + 0x54], 0x9600cf
mov dword [rsp + 0x58], 0x9c00dd
mov dword [rsp + 0x5c], Ordinal_200
lea rcx, [rsp + 0x40]
call fcn.14002e5a0
mov rbx, rax
mov dword [rbp - 0x60], 0x32009a
lea rcx, [rbp - 0x60]
call fcn.1400301c0
lea rcx, [rbp - 0x60]
call fcn.14002c2a0
mov r9d, 0x40040
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ebx, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x14002acf4
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowPos]
cmp ebx, 1
jne 0x14002b596
mov dword [rbp + 0x10], 0x32009a
movdqa xmm0, xmmword [0x140103b90]
movdqu xmmword [rbp + 0x14], xmm0
movdqa xmm1, xmmword [0x140103c10]
movdqu xmmword [rbp + 0x24], xmm1
mov dword [rbp + 0x34], 0x99f192
lea rcx, [rbp + 0x10]
call fcn.14002c0f0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x14002ad43
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140004b50
mov dword [rsp + 0x20], 9
xor r9d, r9d
lea edx, [r9 + 0xa]
lea rcx, [rsp + 0x60]
call fcn.140005f90
nop dword [rax]
nop word [rax + rax]
mov dword [rsp + 0x60], 0x32009a
movdqa xmm0, xmmword [0x140103c20]
movdqu xmmword [rsp + 0x64], xmm0
movdqa xmm1, xmmword [0x1401039f0]
movdqu xmmword [rsp + 0x74], xmm1
lea rcx, [rsp + 0x60]
call fcn.14002d130
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
je 0x14002adc8
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14002ad80
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, reloc.WS2_32.dll_socket
call fcn.1400e25b8
mov dword [rax], 0x6e75614c
mov dword [rax + 4], 0x64656863
mov dword [rax + 8], 0x65745320
mov dword [rax + 0xc], 0x61206d61
mov dword [rax + 0x10], 0x4320646e
mov word [rax + 0x14], 0x3253
mov byte [rax + 0x16], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov r8, rsi
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14002ae20
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140004b50
mov dword [rsp + 0x20], 0xa
xor r9d, r9d
lea edx, [r9 + 0xa]
lea rcx, [rsp + 0x60]
call fcn.140005f90
mov dword [rsp + 0x40], 0x32009a
movdqa xmm0, xmmword [0x140103b60]
movdqu xmmword [rsp + 0x44], xmm0
mov dword [rsp + 0x54], 0x81ee87f3
mov dword [rsp + 0x58], 0xc1efc1ef
mov byte [rsp + 0x5c], 0
lea rcx, [rsp + 0x40]
call fcn.14002d5b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
inc rsi
cmp byte [rax + rsi], 0
jne 0x14002ae97
mov r8, rsi
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140004b50
mov dword [rsp + 0x20], 9
xor r9d, r9d
lea edx, [r9 + 0xa]
lea rcx, [rsp + 0x60]
call fcn.140005f90
mov dword [rsp + 0x40], 0x32009a
mov dword [rsp + 0x44], 0x8a00e1
mov dword [rsp + 0x48], 0x8500eb
mov dword [rsp + 0x4c], 0x8d00e4
mov dword [rsp + 0x50], 0x8c00e9
mov dword [rsp + 0x54], 0x9600cf
mov dword [rsp + 0x58], 0x9c00dd
mov dword [rsp + 0x5c], Ordinal_200
lea rcx, [rsp + 0x40]
call fcn.14002e5a0
mov rbx, rax
mov dword [rbp - 0x60], 0x32009a
lea rdx, str.Press_OK_to_inject_cheat_and_wait_for_beep_sound.
lea rcx, [rbp - 0x60]
call fcn.140030b80
lea rcx, [rbp - 0x60]
call fcn.14002de60
mov r9d, 0x40040
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x14002af78
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, 0x1770
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140028c20
jmp 0x14002b596
mov dword [rsp + 0x40], 0x32009a
mov dword [rsp + 0x44], 0x9ef085e4
mov dword [rsp + 0x48], 0x94f095fd
mov dword [rsp + 0x4c], 0xf693e7b4
mov word [rsp + 0x50], 0xfa97
mov byte [rsp + 0x52], 0
lea rcx, [rsp + 0x40]
call fcn.14002c980
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14002afe0
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140004b50
mov dword [rsp + 0x20], 8
mov edx, 0xa
lea r9d, [rdx - 9]
lea rcx, [rsp + 0x60]
call fcn.140005f90
mov dword [rsp + 0x60], 0x32009a
movdqa xmm0, xmmword [0x140103c20]
movdqu xmmword [rsp + 0x64], xmm0
movdqa xmm1, xmmword [0x1401039f0]
movdqu xmmword [rsp + 0x74], xmm1
lea rcx, [rsp + 0x60]
call fcn.14002d130
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movabs rbx, 0x4e94914effff
mov r13d, 0xff
test eax, eax
je 0x14002b360
mov dword [rsp + 0x40], 0x32009a
mov dword [rsp + 0x44], 0x9ef085e4
mov dword [rsp + 0x48], 0x92fc95fd
mov dword [rsp + 0x4c], 0xc596d5f5
mov word [rsp + 0x50], 0xf7
lea rcx, [rsp + 0x40]
call fcn.14002dd50
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14002b0b0
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140004b50
mov dword [rsp + 0x20], 8
xor r9d, r9d
lea edx, [r9 + 9]
lea rcx, [rsp + 0x60]
call fcn.140005f90
mov dword [rsp + 0x40], 0x32009a
mov dword [rsp + 0x44], 0x80e58fe1
mov dword [rsp + 0x48], 0x90fe97e3
mov word [rsp + 0x4c], 0xf7
lea rcx, [rsp + 0x40]
call fcn.14002c900
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov r8, rsi
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14002b120
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140004b50
mov dword [rsp + 0x20], 8
xor r9d, r9d
lea edx, [r9 + 9]
lea rcx, [rsp + 0x60]
call fcn.140005f90
mov dword [rsp + 0x40], 0x32009a
movdqa xmm0, xmmword [0x140103be0]
movdqu xmmword [rsp + 0x44], xmm0
mov dword [rsp + 0x54], 0xbd8eb996
mov word [rsp + 0x58], Ordinal_143
lea rcx, [rsp + 0x40]
call fcn.14002c800
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], r14
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x14002b191
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140004b50
nop
mov rcx, qword [rbp + 0x20]
inc rcx
mov eax, 2
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400e25b8
mov rbx, rax
lea rcx, [rbp + 0x10]
mov rdx, qword [rbp + 0x20]
cmp qword [rbp + 0x28], 0xf
jbe 0x14002b1de
mov r9, qword [rbp + 0x10]
add rdx, r9
jmp 0x14002b1e5
add rdx, rcx
lea r9, [rbp + 0x10]
mov r8, rbx
mov rcx, r9
call fcn.140031c30
mov rax, qword [rbp + 0x20]
mov word [rbx + rax*2], r14w
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x60], 0x32009a
movdqa xmm0, xmmword [0x140103c20]
movdqu xmmword [rsp + 0x64], xmm0
movdqa xmm1, xmmword [0x1401039f0]
movdqu xmmword [rsp + 0x74], xmm1
lea rcx, [rsp + 0x60]
call fcn.14002d130
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
je 0x14002b260
mov ecx, 0x1388
jmp 0x14002b218
lea rcx, [rsp + 0x40]
call fcn.140006910
mov rbx, qword [rsp + 0x40]
movabs rax, 0x7fffffffff67697f
cmp rbx, rax
je 0x14002b28e
setl al
test al, al
je 0x14002b28e
add rbx, 0x989680
jmp 0x14002b291
mov rbx, rdi
movabs r14, 0x4e94914effff
movabs r15, 0x431bde82d7b634db
lea rcx, [rsp + 0x40]
call fcn.140006910
mov rax, qword [rsp + 0x40]
cmp rbx, rax
je 0x14002b309
mov ecx, 1
cmovl ecx, r13d
test cl, cl
jle 0x14002b309
mov rcx, rbx
sub rcx, rax
cmp rcx, r14
jg 0x14002b2fd
mov rax, r15
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x14002b2f4
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x14002b2a5
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x14002b2a5
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
mov r15d, 0x9a
jbe 0x14002b34d
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b348
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002b348
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e2394
movabs rbx, 0x4e94914effff
nop word [rax + rax]
mov dword [rsp + 0x60], 0x32009a
movdqa xmm0, xmmword [0x140103c20]
movdqu xmmword [rsp + 0x64], xmm0
movdqa xmm1, xmmword [0x1401039f0]
movdqu xmmword [rsp + 0x74], xmm1
lea rcx, [rsp + 0x60]
call fcn.14002d130
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
je 0x14002b3a8
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14002b360
lea rcx, [rsp + 0x40]
call fcn.140006910
mov rax, qword [rsp + 0x40]
movabs rcx, 0x7fffffffff67697f
cmp rax, rcx
je 0x14002b3d4
setl cl
test cl, cl
je 0x14002b3d4
lea rdi, [rax + 0x989680]
movabs r14, 0x431bde82d7b634db
nop
lea rcx, [rsp + 0x40]
call fcn.140006910
mov rax, qword [rsp + 0x40]
cmp rdi, rax
je 0x14002b444
mov ecx, 1
cmovl ecx, r13d
test cl, cl
jle 0x14002b444
mov rcx, rdi
sub rcx, rax
cmp rcx, rbx
jg 0x14002b438
mov rax, r14
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x14002b42f
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x14002b3e0
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x14002b3e0
mov dword [rsp + 0x40], 0x32009a
mov dword [rsp + 0x44], 0x9ef085e4
mov dword [rsp + 0x48], 0x94f095fd
mov dword [rsp + 0x4c], 0x96a4f7b4
mov byte [rsp + 0x50], 0
lea rcx, [rsp + 0x40]
call fcn.14002c750
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xor r14d, r14d
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r14b
jne 0x14002b490
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140004b50
mov dword [rsp + 0x20], 8
mov edx, 0xa
lea r9d, [rdx - 9]
lea rcx, [rsp + 0x60]
call fcn.140005f90
mov dword [rsp + 0x40], 0x32009a
movdqa xmm0, xmmword [0x140103bf0]
movdqu xmmword [rsp + 0x44], xmm0
mov dword [rsp + 0x54], 0xe68ae693
mov word [rsp + 0x58], 0x9f
lea rcx, [rsp + 0x40]
call fcn.14002c800
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov r8, rsi
inc r8
cmp byte [rax + r8], r14b
jne 0x14002b505
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140004b50
mov dword [rsp + 0x20], 8
mov edx, 0xa
lea r9d, [rdx - 9]
lea rcx, [rsp + 0x60]
call fcn.140005f90
mov dword [rbp - 0x60], 0x32009a
lea rcx, [rbp - 0x60]
call fcn.140030350
lea rcx, [rbp - 0x60]
call fcn.14002c540
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
inc rsi
cmp byte [rax + rsi], r14b
jne 0x14002b561
mov r8, rsi
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140004b50
mov dword [rsp + 0x20], send
mov edx, 0xa
lea r9d, [rdx - 9]
lea rcx, [rsp + 0x60]
call fcn.140005f90
nop
mov rdx, qword [rbp + 0x70]
cmp rdx, 0xf
jbe 0x14002b5d4
inc rdx
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b5cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002b5cf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e2394
mov rcx, qword [rbp + 0x78]
xor rcx, rsp
call fcn.1400e20f0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400048b0
int3