Function at 0x14002d330
Capabilities:
Encode data using xor
Hide graphical window

Disassembly:
push rbp
lea rbp, [rsp - 0x140]
sub rsp, 0x240
mov rax, qword [0x140075040]
xor rax, rsp
mov qword [rbp + 0xf0], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x140078168], 0
je 0x14002e4da
movups xmm0, xmmword [0x140078160]
lea rcx, [rsp + 0x30]
movaps xmmword [rsp + 0x30], xmm0
call fcn.140032d44
test eax, eax
jne 0x14002e4da
mov qword [rsp + 0x250], rbx
lea rdx, str.Iniciando_o_programa...
mov qword [rsp + 0x258], rsi
xorps xmm0, xmm0
mov qword [rsp + 0x260], rdi
mov qword [rsp + 0x228], r14
mov qword [rsp + 0x220], r15
movaps xmmword [rsp + 0x210], xmm6
movaps xmmword [rsp + 0x200], xmm7
movups xmmword [0x140078160], xmm0
call fcn.14002e640
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.14002efe0
movzx edx, al
mov rcx, rbx
call fcn.14002ee30
mov rcx, rbx
call fcn.14002ecd0
lea rdx, str.Verificando_se_CrossFire_ou_DIEmWin_est
call fcn.14002e640
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.14002efe0
movzx edx, al
mov rcx, rbx
call fcn.14002ee30
mov rcx, rbx
call fcn.14002ecd0
xor edx, edx
mov cl, 0x43
call fcn.14002a580
mov edx, 1
mov byte [rsp + 0x50], al
mov cl, 0x72
movzx r14d, al
call fcn.14002a580
mov edx, 2
mov byte [rsp + 0x21], al
mov cl, 0x6f
movzx r8d, al
call fcn.14002a580
mov edx, 3
mov byte [rsp + 0x22], al
mov cl, 0x73
movzx r9d, al
call fcn.14002a580
mov edx, 4
mov byte [rsp + 0x23], al
movzx r10d, al
call fcn.14002a580
mov edx, 5
mov byte [rsp + 0x24], al
mov cl, 0x46
movzx r11d, al
call fcn.14002a580
mov edx, 6
mov byte [rsp + 0x25], al
mov cl, 0x69
movzx ebx, al
call fcn.14002a580
mov edx, 7
mov byte [rsp + 0x26], al
mov cl, 0x72
movzx edi, al
call fcn.14002a580
mov edx, 8
mov byte [rsp + 0x27], al
mov cl, 0x65
movzx esi, al
call fcn.14002a580
mov qword [rsp + 0x238], r12
mov byte [rsp + 0x28], al
mov qword [rsp + 0x230], r13
movzx edx, r8b
movzx ecx, r14b
movzx r8d, r9b
xor cl, 0x13
movzx r9d, r10b
mov byte [rsp + 0x30], cl
movzx r10d, r11b
lea rcx, [rsp + 0x30]
movzx r11d, bl
xor dl, 0x14
movzx ebx, dil
mov byte [rsp + 0x31], dl
movzx edi, sil
xor r8b, 0x15
movzx esi, al
mov byte [rsp + 0x32], r8b
xor eax, eax
xor r9b, 0x16
xor r10b, 0x17
mov byte [rsp + 0x33], r9b
xor r11b, 0x18
mov byte [rsp + 0x34], r10b
xor sil, 0x1b
mov byte [rsp + 0x35], r11b
xor bl, 0x19
mov byte [rsp + 0x38], sil
xor dil, 0x1a
mov byte [rsp + 0x36], bl
xor edx, edx
mov byte [rsp + 0x37], dil
mov byte [rsp + 0x39], al
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14002d710
xor edx, edx
mov cl, 0x44
call fcn.14002a580
mov edx, 1
mov byte [rsp + 0x20], al
mov cl, 0x49
movzx edi, al
call fcn.14002a580
mov edx, 2
mov cl, 0x45
movzx r13d, al
movzx ebx, al
call fcn.14002a580
mov edx, 3
mov cl, 0x6d
movzx r12d, al
movzx r11d, al
call fcn.14002a580
mov edx, 4
mov cl, 0x57
movzx r15d, al
movzx r10d, al
call fcn.14002a580
mov edx, 5
mov cl, 0x69
movzx r14d, al
movzx r9d, al
call fcn.14002a580
mov edx, 6
mov cl, 0x6e
movzx esi, al
movzx r8d, al
call fcn.14002a580
movzx ecx, al
xor edx, edx
xor cl, 0x19
mov byte [rsp + 0x77], dl
mov byte [rsp + 0x76], cl
xor r11b, 0x15
movzx ecx, byte [rsp + 0x20]
xor r10b, 0x16
xor cl, 0x13
mov byte [rsp + 0x67], dl
mov byte [rsp + 0x60], cl
lea rdx, [rsp + 0x70]
xor r9b, 0x17
mov byte [rsp + 0x72], r11b
xor r8b, 0x18
mov byte [rsp + 0x73], r10b
xor al, 0x19
mov byte [rsp + 0x74], r9b
xor dil, 0x13
mov byte [rsp + 0x75], r8b
xor bl, 0x14
mov byte [rsp + 0x70], dil
xor r13b, 0x14
mov byte [rsp + 0x71], bl
xor r12b, 0x15
mov byte [rsp + 0x61], r13b
xor r15b, 0x16
mov byte [rsp + 0x62], r12b
xor r14b, 0x17
mov byte [rsp + 0x63], r15b
xor sil, 0x18
mov byte [rsp + 0x64], r14b
lea rcx, [rsp + 0x60]
mov byte [rsp + 0x65], sil
mov byte [rsp + 0x66], al
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14002d70a
lea rdx, str.Aguardando_por_CrossFire...
call fcn.14002e640
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.14002efe0
movzx edx, al
mov rcx, rbx
call fcn.14002ee30
mov rcx, rbx
call fcn.14002ecd0
mov ecx, 0x7b
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx r8d, byte [rsp + 0x21]
movzx r9d, byte [rsp + 0x22]
movzx r10d, byte [rsp + 0x23]
movzx r11d, byte [rsp + 0x24]
movzx eax, byte [rsp + 0x28]
movzx ebx, byte [rsp + 0x25]
movzx edi, byte [rsp + 0x26]
movzx esi, byte [rsp + 0x27]
movzx r14d, byte [rsp + 0x50]
jmp 0x14002d4f1
movzx r14d, byte [rsp + 0x50]
lea rdx, str.Obtendo_ID_do_processo_de_CrossFire...
call fcn.14002e640
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.14002efe0
movzx edx, al
mov rcx, rbx
call fcn.14002ee30
mov rcx, rbx
call fcn.14002ecd0
movzx ecx, byte [str.crossfire.exe]
xor edx, edx
call fcn.14002a580
movzx ecx, byte [0x14006ba91]
mov edx, 1
mov byte [rsp + 0x30], al
call fcn.14002a580
movzx ecx, byte [0x14006ba92]
mov edx, 2
mov byte [rsp + 0x31], al
call fcn.14002a580
movzx ecx, byte [0x14006ba93]
mov edx, 3
mov byte [rsp + 0x32], al
call fcn.14002a580
movzx ecx, byte [0x14006ba94]
mov edx, 4
mov byte [rsp + 0x33], al
call fcn.14002a580
movzx ecx, byte [0x14006ba95]
mov edx, 5
mov byte [rsp + 0x34], al
call fcn.14002a580
movzx ecx, byte [0x14006ba96]
mov edx, 6
mov byte [rsp + 0x35], al
call fcn.14002a580
movzx ecx, byte [0x14006ba97]
mov edx, 7
mov byte [rsp + 0x36], al
call fcn.14002a580
movzx ecx, byte [0x14006ba98]
mov edx, 8
mov byte [rsp + 0x37], al
call fcn.14002a580
movzx ecx, byte [0x14006ba99]
mov edx, 9
mov byte [rsp + 0x38], al
call fcn.14002a580
movzx ecx, byte [0x14006ba9a]
mov edx, 0xa
mov byte [rsp + 0x39], al
call fcn.14002a580
movzx ecx, byte [0x14006ba9b]
mov edx, 0xb
mov byte [rsp + 0x3a], al
call fcn.14002a580
movzx ecx, byte [0x14006ba9c]
mov edx, 0xc
mov byte [rsp + 0x3b], al
call fcn.14002a580
movdqa xmm0, xmmword [0x14006be70]
movdqa xmm7, xmmword [0x14006be50]
movdqa xmm6, xmmword [0x14006be60]
mov byte [rsp + 0x3c], al
xor eax, eax
xor r15d, r15d
movdqa xmmword [rsp + 0x60], xmm0
mov ecx, dword [rsp + 0x60]
mov edx, r15d
mov byte [rsp + 0x3d], al
movdqa xmmword [rsp + 0x70], xmm0
nop word [rax + rax]
movsxd rax, edx
movd xmm1, edx
add edx, 4
pshufd xmm1, xmm1, 0
movd xmm0, ecx
paddd xmm1, xmm7
andps xmm1, xmm6
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, dword [rsp + rax + 0x30]
xorps xmm1, xmm0
movd dword [rsp + rax + 0x30], xmm1
cmp edx, 0xc
jb 0x14002d890
cmp edx, 0xd
jae 0x14002d8e7
nop
movsxd rax, edx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rdx + 0x13]
inc edx
xor byte [rcx], al
cmp edx, 0xd
jb 0x14002d8d0
mov byte [rsp + 0x3d], r15b
lea rax, [rsp + 0x30]
mov rsi, 0xffffffffffffffff
nop dword [rax + rax]
inc rsi
cmp byte [rax + rsi], r15b
jne 0x14002d900
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x14002d99a
lea rdx, [rbp - 0x40]
mov dword [rbp - 0x40], 0x238
call qword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
jne 0x14002d992
nop dword [rax + rax]
lea rax, [rbp - 0x14]
mov rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], r15b
jne 0x14002d950
cmp rdi, rsi
lea rdx, [rbp - 0x14]
mov r8, rsi
lea rcx, [rsp + 0x30]
cmovb r8, rdi
call fcn.14005aa30
test eax, eax
jne 0x14002d980
cmp rsi, rdi
jb 0x14002d980
jbe 0x14002e4a1
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
je 0x14002d940
test rbx, rbx
je 0x14002d9a0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, r15d
movzx ecx, byte [str.crossfire.exe]
xor edx, edx
mov dword [0x140078088], esi
call fcn.14002a580
movzx ecx, byte [0x14006ba91]
mov edx, 1
mov byte [rsp + 0x30], al
call fcn.14002a580
movzx ecx, byte [0x14006ba92]
mov edx, 2
mov byte [rsp + 0x31], al
call fcn.14002a580
movzx ecx, byte [0x14006ba93]
mov edx, 3
mov byte [rsp + 0x32], al
call fcn.14002a580
movzx ecx, byte [0x14006ba94]
mov edx, 4
mov byte [rsp + 0x33], al
call fcn.14002a580
movzx ecx, byte [0x14006ba95]
mov edx, 5
mov byte [rsp + 0x34], al
call fcn.14002a580
movzx ecx, byte [0x14006ba96]
mov edx, 6
mov byte [rsp + 0x35], al
call fcn.14002a580
movzx ecx, byte [0x14006ba97]
mov edx, 7
mov byte [rsp + 0x36], al
call fcn.14002a580
movzx ecx, byte [0x14006ba98]
mov edx, 8
mov byte [rsp + 0x37], al
call fcn.14002a580
movzx ecx, byte [0x14006ba99]
mov edx, 9
mov byte [rsp + 0x38], al
call fcn.14002a580
movzx ecx, byte [0x14006ba9a]
mov edx, 0xa
mov byte [rsp + 0x39], al
call fcn.14002a580
movzx ecx, byte [0x14006ba9b]
mov edx, 0xb
mov byte [rsp + 0x3a], al
call fcn.14002a580
movzx ecx, byte [0x14006ba9c]
mov edx, 0xc
mov byte [rsp + 0x3b], al
call fcn.14002a580
mov edi, dword [rsp + 0x70]
mov edx, r15d
mov byte [rsp + 0x3c], al
xor eax, eax
mov byte [rsp + 0x3d], al
nop dword [rax]
nop dword [rax + rax]
movsxd rax, edx
movd xmm1, edx
add edx, 4
pshufd xmm1, xmm1, 0
movd xmm0, edi
paddd xmm1, xmm7
andps xmm1, xmm6
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, dword [rsp + rax + 0x30]
xorps xmm1, xmm0
movd dword [rsp + rax + 0x30], xmm1
cmp edx, 0xc
jb 0x14002dad0
cmp edx, 0xd
jae 0x14002db27
nop
movsxd rax, edx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rdx + 0x13]
inc edx
xor byte [rcx], al
cmp edx, 0xd
jb 0x14002db10
xorps xmm0, xmm0
mov byte [rsp + 0x3d], r15b
lea rax, [rsp + 0x30]
mov qword [rbp - 0x80], r15
lea rcx, str.win32u.dll
mov qword [rbp - 0x58], rax
movdqu xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x61], r15
mov byte [rbp - 0x59], r15b
mov qword [rbp - 0x50], r15
mov dword [rbp - 0x68], esi
mov word [rbp - 0x63], 0x100
mov byte [rbp - 0x64], r15b
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtSetCompositionSurfaceIndependentFlipInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x80]
call rax
mov rax, qword [rbp - 0x50]
mov qword [0x140078090], rax
test rax, rax
je 0x14002e4bb
lea rdx, [0x14006bb78]
call fcn.14002e640
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.14002efe0
movzx edx, al
mov rcx, rbx
call fcn.14002ee30
mov rcx, rbx
call fcn.14002ecd0
cmp qword [0x140078070], r15
jne 0x14002e009
mov edx, 1
mov cl, 0x53
call fcn.14002a580
mov edx, 2
mov cl, 0x68
movzx esi, al
call fcn.14002a580
mov edx, 3
mov cl, 0x65
movzx r15d, al
call fcn.14002a580
mov edx, 4
mov cl, 0x6c
movzx r12d, al
call fcn.14002a580
mov edx, 5
movzx r13d, al
call fcn.14002a580
mov edx, 6
mov byte [rsp + 0x25], al
mov cl, 0x5f
movzx r8d, al
call fcn.14002a580
mov edx, 7
mov byte [rsp + 0x24], al
mov cl, 0x78
movzx r9d, al
call fcn.14002a580
mov edx, 8
mov byte [rsp + 0x23], al
mov cl, 0x36
movzx r10d, al
call fcn.14002a580
mov edx, 9
mov byte [rsp + 0x22], al
mov cl, 0x34
movzx r11d, al
call fcn.14002a580
mov edx, 0xa
mov byte [rsp + 0x21], al
mov cl, 0x2e
movzx ebx, al
call fcn.14002a580
mov edx, 0xb
mov byte [rsp + 0x28], al
mov cl, 0x64
call fcn.14002a580
mov edx, 0xc
mov byte [rsp + 0x27], al
mov cl, 0x6c
call fcn.14002a580
mov edx, 0xd
mov byte [rsp + 0x26], al
call fcn.14002a580
movzx ecx, al
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x28]
mov byte [rsp + 0x6a], al
movzx eax, byte [rsp + 0x27]
mov byte [rsp + 0x6b], al
movzx eax, byte [rsp + 0x26]
mov byte [rsp + 0x6c], al
xor eax, eax
mov byte [rsp + 0x69], bl
xor ebx, ebx
mov byte [rsp + 0x6e], al
mov byte [rsp + 0x60], r14b
mov byte [rsp + 0x61], sil
mov byte [rsp + 0x62], r15b
mov byte [rsp + 0x63], r12b
mov byte [rsp + 0x64], r13b
mov byte [rsp + 0x65], r8b
mov byte [rsp + 0x66], r9b
mov byte [rsp + 0x67], r10b
mov byte [rsp + 0x68], r11b
mov byte [rsp + 0x6d], cl
nop word [rax + rax]
movsxd rcx, eax
movd xmm1, eax
add eax, 4
pshufd xmm1, xmm1, 0
movd xmm0, edi
paddd xmm1, xmm7
andps xmm1, xmm6
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, dword [rsp + rcx + 0x60]
xorps xmm1, xmm0
movd dword [rsp + rcx + 0x60], xmm1
cmp eax, 0xc
jb 0x14002dd10
cmp eax, 0xe
jae 0x14002dd67
nop
movsxd rcx, eax
lea rdx, [rsp + 0x60]
add rdx, rcx
lea ecx, [rax + 0x13]
inc eax
xor byte [rdx], cl
cmp eax, 0xe
jb 0x14002dd50
mov eax, dword [0x140078088]
lea rcx, str.win32u.dll
mov dword [rbp - 0x68], eax
xorps xmm0, xmm0
lea rax, [rsp + 0x60]
mov byte [rsp + 0x6e], bl
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x80], rbx
movdqu xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x61], rbx
mov byte [rbp - 0x59], bl
mov qword [rbp - 0x50], rbx
mov word [rbp - 0x63], 0x100
mov byte [rbp - 0x64], bl
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtSetCompositionSurfaceIndependentFlipInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x80]
call rax
mov rax, qword [rbp - 0x50]
xor edx, edx
movzx ecx, byte [str.crossfire.exe]
mov qword [0x140078070], rax
call fcn.14002a580
movzx ecx, byte [0x14006ba91]
mov edx, 1
mov byte [rsp + 0x30], al
call fcn.14002a580
movzx ecx, byte [0x14006ba92]
mov edx, 2
mov byte [rsp + 0x31], al
call fcn.14002a580
movzx ecx, byte [0x14006ba93]
mov edx, 3
mov byte [rsp + 0x32], al
call fcn.14002a580
movzx ecx, byte [0x14006ba94]
mov edx, 4
mov byte [rsp + 0x33], al
call fcn.14002a580
movzx ecx, byte [0x14006ba95]
mov edx, 5
mov byte [rsp + 0x34], al
call fcn.14002a580
movzx ecx, byte [0x14006ba96]
mov edx, 6
mov byte [rsp + 0x35], al
call fcn.14002a580
movzx ecx, byte [0x14006ba97]
mov edx, 7
mov byte [rsp + 0x36], al
call fcn.14002a580
movzx ecx, byte [0x14006ba98]
mov edx, 8
mov byte [rsp + 0x37], al
call fcn.14002a580
movzx ecx, byte [0x14006ba99]
mov edx, 9
mov byte [rsp + 0x38], al
call fcn.14002a580
movzx ecx, byte [0x14006ba9a]
mov edx, 0xa
mov byte [rsp + 0x39], al
call fcn.14002a580
movzx ecx, byte [0x14006ba9b]
mov edx, 0xb
mov byte [rsp + 0x3a], al
call fcn.14002a580
movzx ecx, byte [0x14006ba9c]
mov edx, 0xc
mov byte [rsp + 0x3b], al
call fcn.14002a580
mov byte [rsp + 0x3c], al
mov edx, ebx
xor eax, eax
mov byte [rsp + 0x3d], al
movsxd rax, edx
movd xmm1, edx
add edx, 4
pshufd xmm1, xmm1, 0
movd xmm0, edi
paddd xmm1, xmm7
andps xmm1, xmm6
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, dword [rsp + rax + 0x30]
xorps xmm1, xmm0
movd dword [rsp + rax + 0x30], xmm1
cmp edx, 0xc
jb 0x14002dee1
cmp edx, 0xd
jae 0x14002df37
movsxd rax, edx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rdx + 0x13]
inc edx
xor byte [rcx], al
cmp edx, 0xd
jb 0x14002df20
mov eax, dword [0x140078088]
lea rcx, str.win32u.dll
mov dword [rbp - 0x68], eax
xorps xmm0, xmm0
lea rax, [rsp + 0x30]
mov byte [rsp + 0x3d], bl
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x80], rbx
movdqu xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x61], rbx
mov byte [rbp - 0x59], bl
mov qword [rbp - 0x50], rbx
mov word [rbp - 0x63], 0x100
mov byte [rbp - 0x64], bl
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtSetCompositionSurfaceIndependentFlipInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x80]
call rax
mov rax, qword [rbp - 0x50]
lea rdx, str.Aguardando_por_CShell_x64.dll...
mov qword [0x140078090], rax
call fcn.14002e640
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.14002efe0
movzx edx, al
mov rcx, rbx
call fcn.14002ee30
mov rcx, rbx
call fcn.14002ecd0
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x140078070], 0
movzx r8d, byte [rsp + 0x25]
movzx r9d, byte [rsp + 0x24]
movzx r10d, byte [rsp + 0x23]
movzx r11d, byte [rsp + 0x22]
movzx ebx, byte [rsp + 0x21]
movzx ecx, byte [rsp + 0x20]
je 0x14002dcb2
lea rdx, str.Verificando_endere
call fcn.14002e640
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.14002efe0
movzx edx, al
mov rcx, rbx
call fcn.14002ee30
mov rcx, rbx
call fcn.14002ecd0
cmp qword [0x140078078], 0
jne 0x14002e3d4
mov edx, 1
mov cl, 0x6c
call fcn.14002a580
mov edx, 2
mov cl, 0x69
movzx esi, al
call fcn.14002a580
mov edx, 3
mov cl, 0x65
movzx r14d, al
call fcn.14002a580
mov edx, 4
mov cl, 0x6e
movzx r15d, al
call fcn.14002a580
mov edx, 5
mov cl, 0x74
movzx r12d, al
call fcn.14002a580
mov edx, 6
mov cl, 0x46
movzx r13d, al
call fcn.14002a580
mov edx, 7
mov byte [rsp + 0x24], al
mov cl, 0x78
movzx r8d, al
call fcn.14002a580
mov edx, 8
mov byte [rsp + 0x23], al
mov cl, 0x5f
movzx r9d, al
call fcn.14002a580
mov edx, 9
mov byte [rsp + 0x22], al
mov cl, 0x78
movzx r10d, al
call fcn.14002a580
mov edx, 0xa
mov byte [rsp + 0x21], al
mov cl, 0x36
movzx r11d, al
call fcn.14002a580
mov edx, 0xb
mov byte [rsp + 0x20], al
mov cl, 0x34
movzx ebx, al
call fcn.14002a580
mov edx, 0xc
mov byte [rsp + 0x28], al
mov cl, 0x2e
call fcn.14002a580
mov edx, 0xd
mov byte [rsp + 0x27], al
mov cl, 0x66
call fcn.14002a580
mov edx, 0xe
mov byte [rsp + 0x26], al
mov cl, 0x78
call fcn.14002a580
mov edx, 0xf
mov byte [rsp + 0x25], al
mov cl, 0x64
call fcn.14002a580
movzx ecx, al
mov byte [rsp + 0x51], al
nop
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x30], al
movzx eax, byte [rsp + 0x28]
mov byte [rsp + 0x3b], al
movzx eax, byte [rsp + 0x27]
mov byte [rsp + 0x3c], al
movzx eax, byte [rsp + 0x26]
mov byte [rsp + 0x3d], al
movzx eax, byte [rsp + 0x25]
mov byte [rsp + 0x3e], al
xor eax, eax
mov byte [rsp + 0x39], r11b
xor r11d, r11d
mov byte [rsp + 0x37], r9b
mov r9d, r11d
mov byte [rsp + 0x38], r10b
lea r10, [rsp + 0x34]
mov byte [rsp + 0x31], sil
mov byte [rsp + 0x32], r14b
mov byte [rsp + 0x33], r15b
mov byte [rsp + 0x34], r12b
mov byte [rsp + 0x35], r13b
mov byte [rsp + 0x36], r8b
mov byte [rsp + 0x3a], bl
mov byte [rsp + 0x3f], cl
mov byte [rsp + 0x40], al
nop dword [rax]
nop word [rax + rax]
lea eax, [r9 + 7]
movd xmm1, r9d
pshufd xmm1, xmm1, 0
lea ecx, [r9 + 6]
paddd xmm1, xmm7
movd xmm2, ecx
andps xmm1, xmm6
movd xmm0, edi
packuswb xmm1, xmm1
lea edx, [r9 + 5]
packuswb xmm1, xmm1
lea r8d, [r9 + 4]
paddb xmm1, xmm0
movd xmm3, r8d
movd xmm0, dword [r10 - 4]
lea ecx, [r9 + 0xa]
xorps xmm1, xmm0
lea r8d, [r9 + 8]
movd dword [r10 - 4], xmm1
lea r10, [r10 + 0x10]
movd xmm1, eax
lea eax, [r9 + 0xb]
punpckldq xmm2, xmm1
movd xmm0, edx
lea edx, [r9 + 9]
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
andps xmm3, xmm6
movd xmm1, eax
packuswb xmm3, xmm3
lea eax, [r9 + 0xf]
packuswb xmm3, xmm3
movd xmm0, edi
paddb xmm3, xmm0
movd xmm2, ecx
movd xmm0, dword [r10 - 0x10]
lea ecx, [r9 + 0xe]
xorps xmm3, xmm0
punpckldq xmm2, xmm1
movd dword [r10 - 0x10], xmm3
movd xmm0, edx
lea edx, [r9 + 0xd]
movd xmm3, r8d
lea r8d, [r9 + 0xc]
punpckldq xmm3, xmm0
add r9d, 0x10
punpcklqdq xmm3, xmm2
movd xmm0, edi
andps xmm3, xmm6
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm1, eax
paddb xmm3, xmm0
movd xmm0, dword [r10 - 0xc]
movd xmm2, ecx
xorps xmm3, xmm0
movd dword [r10 - 0xc], xmm3
movd xmm0, edx
movd xmm3, r8d
punpckldq xmm3, xmm0
movd xmm0, edi
punpckldq xmm2, xmm1
punpcklqdq xmm3, xmm2
andps xmm3, xmm6
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmm0
movd xmm0, dword [r10 - 8]
xorps xmm3, xmm0
movd dword [r10 - 8], xmm3
cmp r9d, 0x10
jb 0x14002e1d0
mov eax, dword [0x140078088]
lea rcx, str.win32u.dll
mov dword [rbp - 0x68], eax
xorps xmm0, xmm0
lea rax, [rsp + 0x30]
mov byte [rsp + 0x40], r11b
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x80], r11
movdqu xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x61], r11
mov byte [rbp - 0x59], r11b
mov qword [rbp - 0x50], r11
mov word [rbp - 0x63], 0x100
mov byte [rbp - 0x64], r11b
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtSetCompositionSurfaceIndependentFlipInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x80]
call rax
mov rax, qword [rbp - 0x50]
lea rdx, str.Aguardando_por_ClientFx_x64.fxd...
mov qword [0x140078078], rax
call fcn.14002e640
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.14002efe0
movzx edx, al
mov rcx, rbx
call fcn.14002ee30
mov rcx, rbx
call fcn.14002ecd0
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x140078078], 0
movzx r8d, byte [rsp + 0x24]
movzx r9d, byte [rsp + 0x23]
movzx r10d, byte [rsp + 0x22]
movzx r11d, byte [rsp + 0x21]
movzx ebx, byte [rsp + 0x20]
movzx ecx, byte [rsp + 0x51]
je 0x14002e150
lea rdx, str.Inicializando_menu...
call fcn.14002e640
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.14002efe0
movzx edx, al
mov rcx, rbx
call fcn.14002ee30
mov rcx, rbx
call fcn.14002ecd0
call fcn.14002c810
lea rdx, str.Programa_iniciado_com_sucesso_
call fcn.14002e640
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.14002efe0
movzx edx, al
mov rcx, rbx
call fcn.14002ee30
mov rcx, rbx
call fcn.14002ecd0
mov r13, qword [rsp + 0x230]
xor eax, eax
mov r12, qword [rsp + 0x238]
mov r14, qword [rsp + 0x228]
mov r15, qword [rsp + 0x220]
movaps xmm6, xmmword [rsp + 0x210]
mov rdi, qword [rsp + 0x260]
mov rsi, qword [rsp + 0x258]
mov rbx, qword [rsp + 0x250]
movaps xmm7, xmmword [rsp + 0x200]
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.14002f670
add rsp, 0x240
pop rbp
ret
mov esi, dword [rbp - 0x38]
test rbx, rbx
je 0x14002d9a3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002d9a3
lea rdx, str.Falha_ao_encontrar_o_m
call fcn.14002e640
mov rcx, rax
call fcn.14002e4f0
mov ecx, 0xffffffff
call fcn.140041a98
int3
mov ecx, 1
call fcn.140030860
int3