Function at 0x140002ea0
Capabilities:
Check for debugger via api
Check for time delay via gettickcount
Check for time delay via queryperformancecounter
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Enumerate processes
Hide thread from debugger
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x8f0
mov rax, qword [0x140076178]
xor rax, rsp
mov qword [rsp + 0x8e8], rax
mov rsi, rdx
xor r14d, r14d
call fcn.140001830
cmp al, 1
je 0x140003ca0
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140002eff
lea rdx, str.debug_by_IsDebuggerPresent_
call fcn.1400013a0
mov ecx, 0x1002
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140004e40
test eax, eax
je 0x140002f20
lea rdx, str.debug_by_BeingDebugged_PEB_check_
call fcn.1400013a0
mov ecx, 0x1000
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140004e57
test eax, eax
je 0x140002f41
lea rdx, str.debug_by_NtGlobalFlag_PEB_check_
call fcn.1400013a0
mov ecx, 0x1003
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rsp + 0x98], r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x98]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rsp + 0x98], r14d
je 0x140002f82
lea rdx, str.debug_by_CheckRemoteDebuggerPresent_
call fcn.1400013a0
mov ecx, 0x1001
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rsp + 0x88], xmm0
mov dword [rsp + 0x98], r14d
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14000301f
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14000301f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rsp + 0x98]
mov qword [rsp + 0x20], rcx
mov r9d, 0x30
lea r8, [rsp + 0x68]
xor edx, edx
mov rcx, rax
call rbx
test eax, eax
js 0x14000301f
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x14000301f
cmp byte [rax + 2], r14b
je 0x14000301f
lea rdx, str.debug_by_NtQueryInformationProcess__ProcessDebugPort__
call fcn.1400013a0
mov ecx, 0x1004
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor edx, edx
lea rcx, str.OLLYDBG
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
xor edx, edx
lea rcx, [0x1400623f8]
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x140003c88
test rbx, rbx
jne 0x140003c88
lea rdx, str.OllyDbg____CPU_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
lea rdx, str.Immunity_Debugger____CPU_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x140003c70
test rbx, rbx
jne 0x140003c70
lea rax, str.cheatengine_x86_64.exe
mov qword [rsp + 0x670], rax
lea rax, str.ollydbg.exe
mov qword [rsp + 0x678], rax
lea rax, str.ida.exe
mov qword [rsp + 0x680], rax
lea rax, str.ida64.exe
mov qword [rsp + 0x688], rax
lea rax, str.radare2.exe
mov qword [rsp + 0x690], rax
lea rax, str.x64dbg.exe
mov qword [rsp + 0x698], rax
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x1a4]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea ecx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov dword [rsp + 0x6a0], 0x238
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x6a4]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x1a0]
lea rax, [rsp + 0x6a0]
lea edx, [rbx + 4]
nop word [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x140003140
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
lea rdx, [rsp + 0x1a0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x1400031e0
lea rcx, str._Warning__It_is_impossible_to_check_process_list.
call fcn.1400012e0
jmp 0x14000322f
lea rbx, [rsp + 0x670]
nop dword [rax + rax]
lea rdx, [rsp + 0x1cc]
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140003c58
add rbx, 8
lea rax, [rsp + 0x6a0]
cmp rbx, rax
jne 0x1400031f0
lea rdx, [rsp + 0x1a0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400031e0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14000327c
lea rdx, str.NtSetInformationThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14000327c
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x11]
call rbx
mov rbx, qword [rsi + 8]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x134], xmm0
movups xmmword [rsp + 0x144], xmm0
movups xmmword [rsp + 0x154], xmm0
movups xmmword [rsp + 0x164], xmm0
movups xmmword [rsp + 0x174], xmm0
movups xmmword [rsp + 0x184], xmm0
mov dword [rsp + 0x194], eax
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0x130], WSAGetLastError
mov dword [rsp + 0x98], r14d
lea r8, str.antidbg
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14000331f
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_DebugActiveProcess]
test eax, eax
jne 0x140003424
mov ecx, 0x22b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
mov r8d, 0x104
lea rdx, [rsp + 0x1a0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [rsp + 0x20], ebx
lea r9, [rsp + 0x1a0]
lea r8, str._ws__d
mov edx, 0x109
lea rcx, [rsp + 0x6a0]
call fcn.140001340
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x130]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x6a0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x98]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0xa0]
cmp dword [rsp + 0x98], 0x22b
jne 0x140003410
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.debug_by_DebugActiveProcess_
call fcn.1400013a0
mov ecx, 0x1008
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x4d0
lea rcx, [rsp + 0x1a0]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [rsp + 0x1d0], 0x100010
lea rdx, [rsp + 0x1a0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1400034b3
cmp qword [rsp + 0x1e8], r14
jne 0x14000349b
cmp qword [rsp + 0x1f0], r14
jne 0x14000349b
cmp qword [rsp + 0x1f8], r14
jne 0x14000349b
cmp qword [rsp + 0x200], r14
jne 0x14000349b
cmp qword [rsp + 0x208], r14
jne 0x14000349b
cmp qword [rsp + 0x210], r14
je 0x1400034b3
lea rdx, str.debug_by_a_Hardware_Debug_Register_Check_
call fcn.1400013a0
mov ecx, 0x2000
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
lea rcx, [rsp + 0xa0]
call fcn.140004e8d
mov rcx, qword [rsp + 0xa0]
shl rcx, 0x20
or rcx, qword [rsp + 0xa8]
mov rax, qword [rsp + 0xb0]
shl rax, 0x20
or rax, qword [rsp + 0xb8]
sub rax, rcx
cmp rax, 0x100000
jbe 0x14000351e
lea rdx, str.debug_by_RDTSC_
call fcn.1400013a0
mov ecx, 0x3000
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call fcn.140004e6f
lea rcx, [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x98]
sub rax, qword [rsp + 0x100]
cmp rax, 0x1e
jle 0x14000356d
lea rdx, str.debug_by_QueryPerformanceCounter_
call fcn.1400013a0
mov ecx, 0x3001
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call fcn.140004e7e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x1e
jbe 0x14000359f
lea rdx, str.debug_by_GetTickCount_
call fcn.1400013a0
mov ecx, 0x3002
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.1400013c0
call fcn.140001400
call fcn.140001440
call fcn.1400014a0
call fcn.140001480
call fcn.1400014e0
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov ecx, 0x38c
mov eax, dword [rcx + rdi]
mov ebx, 0x378
add rbx, rdi
test al, 1
jne 0x140003600
or eax, 1
mov dword [rcx + rdi], eax
mov word [rbx + 5], 0x17d
mov dword [rbx], 0x2acd99cd
mov byte [rbx + 4], 0xd2
lea rcx, [0x140057db0]
call fcn.140053ce0
nop
cmp byte [rbx + 6], 0
je 0x140003621
xor byte [rbx], 0xe3
xor byte [rbx + 1], 0xfb
xor byte [rbx + 2], 0xa1
xor byte [rbx + 3], 0x5f
xor byte [rbx + 4], 0xb7
xor byte [rbx + 5], 0x7d
mov byte [rbx + 6], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rcx, str.MODE_CON_COLS55_LINES12
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov r9d, 2
mov r8b, 0xc3
xor edx, edx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], r14
mov qword [rsp + 0xb8], reloc.WS2_32.dll_ntohs
mov ecx, 0x20
call fcn.140053bc8
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xb0], 0x19
mov qword [rsp + 0xb8], 0x1f
movups xmm0, xmmword [str.clltpekmv0009pe01174wonvd]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140062868]
movsd qword [rax + 0x10], xmm0
movzx ecx, byte [0x140062870]
mov byte [rax + 0x18], cl
mov byte [rax + 0x19], 0
lea rcx, [rsp + 0xa0]
call fcn.14002fa68
nop
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0x10
jb 0x140003713
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000370e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000370e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140053c04
xorps xmm0, xmm0
movups xmmword [rsp + 0x108], xmm0
movdqa xmm1, xmmword [0x1400628a0]
movdqu xmmword [rsp + 0x118], xmm1
mov byte [rsp + 0x108], 0
movdqa xmm0, xmmword [0x1400628f0]
mov dword [rsp + 0xf0], 0xd430341b
mov dword [rsp + 0xf4], 0xf75f00f
mov word [rsp + 0xf8], 0x5d57
mov ecx, 0x380
mov eax, dword [rcx + rdi]
mov edx, 0x1b8
test al, 1
jne 0x1400037e7
or eax, 1
mov dword [rcx + rdi], eax
lea rbx, [rdi + rdx]
mov byte [rbx + 0x1a], 1
lea rax, [rbx + 0x19]
lea rcx, [rsp + 0xf9]
cmp rbx, rcx
ja 0x1400037bb
lea rcx, [rsp + 0xe0]
cmp rax, rcx
jb 0x1400037bb
movups xmmword [rbx], xmm0
movsd xmm0, qword [rsp + 0xf0]
movsd qword [rbx + 0x10], xmm0
movzx eax, word [rsp + 0xf8]
mov word [rbx + 0x18], ax
jmp 0x1400037d8
movups xmmword [rbx], xmm0
movsd xmm0, qword [rsp + 0xf0]
movsd qword [rbx + 0x10], xmm0
movzx eax, word [rsp + 0xf8]
mov word [rbx + 0x18], ax
lea rcx, [0x140057d80]
call fcn.140053ce0
nop
jmp 0x1400037eb
lea rbx, [rdx + rdi]
cmp byte [rbx + 0x1a], 0
je 0x14000385c
xor byte [rbx], 0x77
xor byte [rbx + 1], 0x5d
xor byte [rbx + 2], 0x53
xor byte [rbx + 3], 0xb1
xor byte [rbx + 4], 0x61
xor byte [rbx + 5], 0x83
xor byte [rbx + 6], 0x55
xor byte [rbx + 7], 0x35
xor byte [rbx + 8], 0x77
xor byte [rbx + 9], 0x5d
xor byte [rbx + 0xa], 0x53
xor byte [rbx + 0xb], 0xb1
xor byte [rbx + 0xc], 0x61
xor byte [rbx + 0xd], 0x83
xor byte [rbx + 0xe], 0x55
xor byte [rbx + 0xf], 0x35
xor byte [rbx + 0x10], 0x77
xor byte [rbx + 0x11], 0x5d
xor byte [rbx + 0x12], 0x53
xor byte [rbx + 0x13], 0xb1
xor byte [rbx + 0x14], 0x61
xor byte [rbx + 0x15], 0x83
xor byte [rbx + 0x16], 0x55
xor byte [rbx + 0x17], 0x35
xor byte [rbx + 0x18], 0x77
xor byte [rbx + 0x19], 0x5d
mov byte [rbx + 0x1a], 0
mov edx, recv
mov rcx, rbx
call fcn.140004d70
lea rdx, [rsp + 0x108]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140004450
nop
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x98]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140062800]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x140003cc2
mov edx, dword [rsp + 0x98]
lea rcx, [rsp + 0x68]
call fcn.1400042b0
nop
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x108]
call fcn.1400247b0
nop
mov rdx, qword [rsp + 0x80]
cmp rdx, 0x10
jb 0x14000391c
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003917
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003917
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140053c04
movdqa xmm0, xmmword [0x140062a50]
mov dword [rsp + 0xd0], 0xac9224f4
mov dword [rsp + 0xd4], 0x8da2d9e0
mov dword [rsp + 0xd8], 0xdffd3efb
mov ecx, 0x4e0
mov eax, dword [rcx + rdi]
mov edx, 0x3d8
test al, 1
jne 0x1400039c9
or eax, 1
mov dword [rcx + rdi], eax
lea rbx, [rdx + rdi]
mov byte [rbx + 0x1c], 1
lea rax, [rbx + 0x1b]
lea rcx, [rsp + 0xdb]
cmp rbx, rcx
ja 0x14000399f
lea rcx, [rsp + 0xc0]
cmp rax, rcx
jb 0x14000399f
movups xmmword [rbx], xmm0
movsd xmm0, qword [rsp + 0xd0]
movsd qword [rbx + 0x10], xmm0
mov eax, dword [rsp + 0xd8]
mov dword [rbx + 0x18], eax
jmp 0x1400039ba
movups xmmword [rbx], xmm0
movsd xmm0, qword [rsp + 0xd0]
movsd qword [rbx + 0x10], xmm0
mov eax, dword [rsp + 0xd8]
mov dword [rbx + 0x18], eax
lea rcx, [0x140057d50]
call fcn.140053ce0
nop
jmp 0x1400039cd
lea rbx, [rdx + rdi]
cmp byte [rbx + 0x1c], 0
je 0x140003a46
xor byte [rbx], 0x97
xor byte [rbx + 1], 0x47
xor byte [rbx + 2], 0xf7
xor byte [rbx + 3], 0xdf
xor byte [rbx + 4], 0x93
xor byte [rbx + 5], 0xbf
xor byte [rbx + 6], 0xd7
xor byte [rbx + 7], 0xe1
xor byte [rbx + 8], 0x97
xor byte [rbx + 9], 0x47
xor byte [rbx + 0xa], 0xf7
xor byte [rbx + 0xb], 0xdf
xor byte [rbx + 0xc], 0x93
xor byte [rbx + 0xd], 0xbf
xor byte [rbx + 0xe], 0xd7
xor byte [rbx + 0xf], 0xe1
xor byte [rbx + 0x10], 0x97
xor byte [rbx + 0x11], 0x47
xor byte [rbx + 0x12], 0xf7
xor byte [rbx + 0x13], 0xdf
xor byte [rbx + 0x14], 0x93
xor byte [rbx + 0x15], 0xbf
xor byte [rbx + 0x16], 0xd7
xor byte [rbx + 0x17], 0xe1
xor byte [rbx + 0x18], 0x97
xor byte [rbx + 0x19], 0x47
xor byte [rbx + 0x1a], 0xf7
xor byte [rbx + 0x1b], 0xdf
mov byte [rbx + 0x1c], 0
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.140004d70
call fcn.140001d90
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], 6
mov qword [rsp + 0xb8], reloc.WS2_32.dll_ntohs
mov eax, dword [str.secret]
mov dword [rsp + 0xa0], eax
movzx eax, word [0x140062878]
mov word [rsp + 0xa4], ax
mov byte [rsp + 0xa6], 0
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x68]
call fcn.14000dccc
nop
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x140003ac0
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004a70
mov rcx, rax
lea rdx, [0x140004640]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0x80]
cmp rdx, 0x10
jb 0x140003b24
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b1f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003b1f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140053c04
movdqa xmm0, xmmword [0x1400628a0]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0x10
jb 0x140003b7d
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b78
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003b78
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140053c04
mov ecx, 0x27c
mov eax, dword [rcx + rdi]
mov edx, 0x3b8
test al, 1
jne 0x140003bb7
or eax, 1
mov dword [rcx + rdi], eax
lea rbx, [rdi + rdx]
mov word [rbx + 5], 0x171
mov dword [rbx], 0x74b62abd
mov byte [rbx + 4], 0xdc
lea rcx, [0x140057d00]
call fcn.140053ce0
nop
jmp 0x140003bbb
lea rbx, [rdx + rdi]
cmp byte [rbx + 6], 0
je 0x140003bdc
xor byte [rbx], 0xcd
xor byte [rbx + 1], 0x4b
xor byte [rbx + 2], 0xc3
xor byte [rbx + 3], 7
xor byte [rbx + 4], 0xb9
xor byte [rbx + 5], 0x71
mov byte [rbx + 6], 0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rdx, qword [rsp + 0x120]
cmp rdx, 0x10
jb 0x140003c2c
inc rdx
mov rcx, qword [rsp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c27
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003c27
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140053c04
xor eax, eax
mov rcx, qword [rsp + 0x8e8]
xor rcx, rsp
call fcn.140053b40
lea r11, [rsp + 0x8f0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
lea rdx, str.debug_by_ProcessFileName_
call fcn.1400013a0
mov ecx, 0x1009
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.debug_by_FindWindow__WindowName__
call fcn.1400013a0
mov ecx, 0x1005
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.debug_by_FindWindow__ClassName__
call fcn.1400013a0
mov ecx, 0x1005
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor r9d, r9d
lea r8, [0x14006281c]
lea rdx, [0x140062828]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rdx, str.failed_to_get_hwid
lea rcx, [rsp + 0x50]
call fcn.1400016c0
lea rdx, [0x140072db0]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll__CxxThrowException
int3