Function at 0x140002890
Capabilities:
Encode data using xor
Execute command
Generate random numbers using a mersenne twister
Hide graphical window
Log keystrokes via polling
Self delete

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x1550]
mov eax, 0x1650
call fcn.140007370
sub rsp, rax
mov rax, qword [0x14000d040]
xor rax, rsp
mov qword [rbp + 0x1540], rax
xor edi, edi
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rdi
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea rcx, [0x14000db18]
call qword [sym.imp.gdiplus.dll_GdiplusStartup]
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0xa0]
call sub.VCRUNTIME140.dll_memset
lea r14, [0x140000000]
lea rax, [r14 + 0x8c40]
mov qword [rbp + 0xa0], rax
lea rcx, [rbp + 0x150]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov ebx, 2
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0xa0]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0xa0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0xa0], rax
mov rax, qword [rbp + 0xa0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x9c], edx
lea rcx, [rbp + 0xb0]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rsi, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0xb0], rsi
mov byte [rbp + 0x12c], dil
mov byte [rbp + 0x121], dil
lea rcx, [rbp + 0xb0]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp + 0x130], rdi
mov rax, qword [0x14000dbb0]
mov qword [rbp + 0x124], rax
mov qword [rbp + 0x118], rdi
mov r8d, 1
lea rcx, [rbp + 0xb0]
call fcn.140004c50
test rax, rax
jne 0x140002a0f
mov rax, qword [rbp + 0xa0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0xa0]
add rcx, rax
xor r8d, r8d
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
cmp qword [rbp + 0x130], 0
je 0x140002a9a
mov rax, qword [rbp + 0xa0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0xa0]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0xa0]
call fcn.140005bc0
lea rcx, [rbp + 0xb0]
call fcn.140004b90
test rax, rax
jne 0x140002a9a
mov rax, qword [rbp + 0xa0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0xa0]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rcx, [rsp + 0x70]
call fcn.1400014a0
nop
cmp qword [rbp - 0x80], 0
jne 0x140002bc1
lea rdx, str.Failed_to_get_HWID
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400051d0
mov rcx, rax
lea rdx, [0x1400053b0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [0x14000db18]
call qword [sym.imp.gdiplus.dll_GdiplusShutdown]
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140002b20
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002b1b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006410
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140002b71
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002b6c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006410
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
lea rcx, [rbp + 0xa0]
call fcn.1400032b0
mov eax, 1
mov rcx, qword [rbp + 0x1540]
xor rcx, rsp
call fcn.1400063f0
lea r11, [rsp + 0x1650]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
cmp qword [rsp + 0x60], 0
je 0x140002be0
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.1400017b0
test al, al
jne 0x140002e00
lea rdx, str.Enter_license_key:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400051d0
lea rdx, [rsp + 0x50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400053f0
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.1400017b0
test al, al
jne 0x140002c54
lea rdx, str.License_key_is_invalid._Try_again.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400051d0
mov rcx, rax
lea rdx, [0x1400053b0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140008a34]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x140002be0
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp - 0x70]
call sub.VCRUNTIME140.dll_memset
lea rax, [r14 + 0x8ba8]
mov qword [rbp - 0x70], rax
lea rcx, [rbp + 0x38]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
or ebx, 1
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x70]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rbx, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x70], rbx
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 0x74], edx
lea rcx, [rbp - 0x68]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
mov qword [rbp - 0x68], rsi
mov byte [rbp + 0x14], 0
mov byte [rbp + 9], 0
lea rcx, [rbp - 0x68]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp + 0x18], rdi
mov rax, qword [0x14000dbb0]
mov qword [rbp + 0xc], rax
mov qword [rbp], rdi
mov r8d, 2
lea rcx, [rbp - 0x68]
call fcn.140004c50
test rax, rax
jne 0x140002d22
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x70]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
cmp qword [rbp + 0x18], 0
je 0x140002d73
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
lea rcx, [rbp - 0x70]
call fcn.140005a00
lea rcx, [rbp - 0x68]
call fcn.140004b90
test rax, rax
jne 0x140002d73
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x70]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rcx, [0x140008a34]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx - 0x70], rbx
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 0x74], edx
mov qword [rbp - 0x68], rsi
cmp qword [rbp + 0x18], 0
je 0x140002dd2
lea rcx, [rbp + 8]
mov rax, qword [rbp - 0x50]
cmp qword [rax], rcx
jne 0x140002dd2
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x20]
mov qword [rax], rcx
mov rax, qword [rbp - 0x30]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp - 0x18]
mov dword [rax], edx
cmp byte [rbp + 0x14], 0
je 0x140002de1
lea rcx, [rbp - 0x68]
call fcn.140004b90
lea rcx, [rbp - 0x68]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x38]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rdx, str.Keybind:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400051d0
call fcn.140002450
mov word [0x14000d0c0], ax
lea rcx, [0x140008a34]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x140008c80]
movdqu xmmword [rsp + 0x40], xmm1
mov eax, dword [str.FOV:]
mov dword [rsp + 0x30], eax
movzx eax, byte [0x140008a70]
mov byte [rsp + 0x34], al
mov byte [rsp + 0x35], 0
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.1400027a0
mov dword [0x14000d0bc], eax
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140002eb1
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002eac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002eac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006410
lea rcx, [0x140008a34]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x140008c90]
movdqu xmmword [rsp + 0x40], xmm1
movsd xmm0, qword [str.Delay__ms_:]
movsd qword [rsp + 0x30], xmm0
mov eax, dword [0x140008a80]
mov dword [rsp + 0x38], eax
mov byte [rsp + 0x3c], 0
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400027a0
mov dword [0x14000d0b4], eax
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140002f43
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002f3e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002f3e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006410
lea rcx, [0x140008a34]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Select_target_color:_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400051d0
lea rdx, str.1._Red_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400051d0
lea rdx, str.2._Purple_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400051d0
lea rdx, str.3._Yellow_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400051d0
lea rdx, str.Enter_your_choice:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400051d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x140008c70]
movdqu xmmword [rsp + 0x40], xmm1
mov byte [rsp + 0x30], 0
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.1400027a0
mov ebx, eax
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14000301b
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003016
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003016
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006410
sub ebx, 1
je 0x140003058
sub ebx, 1
je 0x14000302f
sub ebx, 1
je 0x140003047
cmp ebx, 0x3b
je 0x140003040
mov dword [0x14000d0b8], 0xf
mov eax, 0xfe63fe
jmp 0x140003067
mov eax, 0x2478c5
jmp 0x14000305d
mov dword [0x14000d0b8], 0x19
mov eax, 0x2effff
jmp 0x140003067
mov eax, 0x322fff
mov dword [0x14000d0b8], 0x14
mov dword [0x14000d0c4], eax
lea rcx, [0x140008a34]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r14d, 0x80000000
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400030c3
cmp byte [0x14000d0c2], 0
sete al
mov byte [0x14000d0c2], al
neg al
sbb ebx, ebx
and ebx, 5
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x70
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140003219
cmp byte [0x14000db11], 0
jne 0x140003220
mov byte [0x14000db11], 1
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x1534], 0xffffffff
mov dword [rbp + 0x1b4], eax
mov edx, 1
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 + 0x1b4], eax
inc rdx
cmp rdx, 0x270
jb 0x140003110
mov dword [rbp + 0x1b0], 0x270
mov rbx, qword [0x14000db28]
mov rbx, qword [rbx]
mov eax, dword [0x14000db30]
dec eax
xor eax, r14d
lea rcx, [rbp + 0x1b0]
cmp eax, 0x7fffffff
jne 0x140003168
call fcn.1400061b0
mov ecx, eax
jmp 0x1400031aa
lea edi, [rax - 0x7fffffff]
call fcn.1400061b0
mov esi, edi
mov ecx, eax
imul rcx, rsi
cmp ecx, edi
jae 0x1400031a6
mov eax, edi
neg eax
xor edx, edx
div edi
mov edi, edx
cmp ecx, edx
jae 0x1400031a6
nop dword [rax]
lea rcx, [rbp + 0x1b0]
call fcn.1400061b0
mov ecx, eax
imul rcx, rsi
cmp ecx, edi
jb 0x140003190
shr rcx, 0x20
lea eax, [rcx + r14]
xor eax, r14d
jge 0x1400031cc
neg eax
mov ecx, eax
nop word [rax + rax]
mov rbx, qword [rbx + 8]
sub rcx, 1
jne 0x1400031c0
jmp 0x1400031d9
test eax, eax
jle 0x1400031d9
mov rbx, qword [rbx]
dec eax
test eax, eax
jg 0x1400031d0
movzx eax, word [rbx + 0x10]
mov word [0x14000d0c8], ax
lea rdx, str.Button_got_Spoofed
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400051d0
mov rcx, rax
lea rdx, [0x1400053b0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.140002070
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140003220
mov byte [0x14000db11], 0
movzx ecx, word [0x14000d0c0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140003239
call fcn.140002150
jmp 0x140003244
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x71
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140003080
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
cmp byte [0x14000db10], 0
jne 0x140003278
mov byte [0x14000db10], 1
lea rdx, str.Burst_Mode_Enabled
jmp 0x140003286
mov byte [0x14000db10], 0
lea rdx, str.Burst_Mode_Disabled
call fcn.1400051d0
lea rdx, [0x1400053b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140003080