Function at 0x1400701b0
Capabilities:
Contain obfuscated stackstrings
Log keystrokes via polling
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400970c0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
xor edi, edi
nop word [rax + rax]
mov rcx, qword [rbx]
lea r8, [rbp - 0xf]
mov r9d, 1
mov qword [rsp + 0x20], rdi
mov edx, 0xa3d4d7
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [rbp - 0xf], 0x2c
jne 0x1400704b8
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov r9d, 1
mov byte [rbp - 0x10], reloc.WS2_32.dll_WSACleanup
mov edx, 0x525745
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov r9d, 1
mov byte [rbp - 0x10], reloc.WS2_32.dll_WSACleanup
mov edx, 0x525737
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov r9d, 1
mov byte [rbp - 0x10], 0x75
mov edx, 0x50d4aa
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov r9d, 1
mov byte [rbp - 0x10], 0x84
mov edx, 0x4e9a60
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov r9d, 1
mov byte [rbp - 0x10], 0x84
mov edx, 0x4e9a69
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov r9d, 1
mov byte [rbp - 0x10], 0x76
mov edx, 0x4d6196
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov r9d, 1
mov byte [rbp - 0x10], 0x76
mov edx, 0x4d61a7
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov r9d, 1
mov byte [rbp - 0x10], 0x75
mov edx, 0x51f1b7
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [0x140097110]
mov r9d, 2
mov qword [rsp + 0x20], rdi
mov edx, 0x4d831c
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [0x140097104]
mov r9d, 2
mov qword [rsp + 0x20], rdi
mov edx, 0x4d832b
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [0x140097148]
mov r9d, 2
mov qword [rsp + 0x20], rdi
mov edx, 0x4d838a
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, 1
mov byte [rbp - 0x10], 0x75
mov qword [rsp + 0x20], rdi
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov edx, 0x51f0bd
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov r9d, 1
mov byte [rbp - 0x10], 0x60
mov edx, 0x51f282
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov r9d, 1
mov byte [rbp - 0x10], dil
mov edx, 0x4db1a2
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov r9d, 1
mov byte [rbp - 0x10], dil
mov edx, 0x4db98d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov r9d, 1
mov byte [rbp - 0x10], reloc.WS2_32.dll_WSACleanup
mov edx, 0x4e9494
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov r9d, 1
mov byte [rbp - 0x10], 0x75
mov edx, 0x4e9609
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [0x140097100]
mov r9d, 2
mov qword [rsp + 0x20], rdi
mov edx, 0x5a3f1c
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov r9d, 1
mov byte [rbp - 0x10], 0x84
mov edx, 0x56d9ad
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov r9d, 1
mov byte [rbp - 0x10], reloc.WS2_32.dll_WSACleanup
mov edx, 0x56d9d7
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call fcn.140070e70
mov rcx, rbx
call fcn.14006f770
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, reloc.WLDAP32.dll_Ordinal_45
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140070503
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1400704ef
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
jmp 0x1400704fa
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov edx, 5
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, reloc.WS2_32.dll_WSASetLastError
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400705c8
lea r8, [rbp - 0x10]
mov rcx, qword [rbx]
mov r9d, 1
mov qword [rsp + 0x20], rdi
mov edx, 0x525745
cmp byte [rbx + 8], dil
jne 0x14007056b
mov byte [rbp - 0x10], 0xeb
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov r9d, 1
mov byte [rbp - 0x10], 0xeb
mov edx, 0x525737
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, str._UBT____Cheat_Enabled
mov byte [rbx + 8], 1
jmp 0x1400705a1
mov byte [rbp - 0x10], reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov r9d, 1
mov byte [rbp - 0x10], reloc.WS2_32.dll_WSACleanup
mov edx, 0x525737
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, str._UBT____Cheat_Disabled
mov byte [rbx + 8], dil
mov rcx, qword [0x1400785e8]
call fcn.140003030
lea rdx, [0x140003200]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, WSAStartup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140070647
lea r8, [rbp - 0x10]
mov rcx, qword [rbx]
mov r9d, 1
mov qword [rsp + 0x20], rdi
mov edx, 0x50d4aa
cmp byte [rbx + 9], dil
jne 0x14007060b
mov byte [rbp - 0x10], reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, str._Rapid____Cheat_Enabled
mov byte [rbx + 9], 1
jmp 0x140070620
mov byte [rbp - 0x10], 0x75
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, str._Rapid____Cheat_Disabled
mov byte [rbx + 9], dil
mov rcx, qword [0x1400785e8]
call fcn.140003030
lea rdx, [0x140003200]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, WSAStartup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14007070c
lea r8, [rbp - 0x10]
mov rcx, qword [rbx]
mov r9d, 1
mov qword [rsp + 0x20], rdi
mov edx, 0x4e9a60
cmp byte [rbx + 0xa], dil
jne 0x1400706af
mov byte [rbp - 0x10], 0x85
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov r9d, 1
mov byte [rbp - 0x10], 0x82
mov edx, 0x4e9a69
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, str._Distance____Cheat_Enabled
mov byte [rbx + 0xa], 1
jmp 0x1400706e5
mov byte [rbp - 0x10], 0x84
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov r9d, 1
mov byte [rbp - 0x10], 0x84
mov edx, 0x4e9a69
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, str._Distance____Cheat_Disabled
mov byte [rbx + 0xa], dil
mov rcx, qword [0x1400785e8]
call fcn.140003030
lea rdx, [0x140003200]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400707d1
lea r8, [rbp - 0x10]
mov rcx, qword [rbx]
mov r9d, 1
mov qword [rsp + 0x20], rdi
mov edx, 0x4d6196
cmp byte [rbx + 0xb], dil
jne 0x140070774
mov byte [rbp - 0x10], 0x77
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov r9d, 1
mov byte [rbp - 0x10], 0x77
mov edx, 0x4d61a7
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, str._NoRecoil____Cheat_Enabled
mov byte [rbx + 0xb], 1
jmp 0x1400707aa
mov byte [rbp - 0x10], 0x76
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov r9d, 1
mov byte [rbp - 0x10], 0x76
mov edx, 0x4d61a7
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, str._NoRecoil____Cheat_Disabled
mov byte [rbx + 0xb], dil
mov rcx, qword [0x1400785e8]
call fcn.140003030
lea rdx, [0x140003200]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14007098c
mov rcx, qword [rbx]
mov qword [rsp + 0x20], rdi
cmp byte [rbx + 0xc], dil
jne 0x1400708c0
mov r9d, 2
lea r8, [0x14009713c]
mov edx, 0x5a3f1c
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov r9d, 1
mov byte [rbp - 0x10], reloc.WS2_32.dll_WSACleanup
mov edx, 0x51f1b7
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov r9d, 1
mov byte [rbp - 0x10], reloc.WS2_32.dll_WSACleanup
mov edx, 0x50d4aa
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [0x140097114]
mov r9d, 2
mov qword [rsp + 0x20], rdi
mov edx, 0x4d831c
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [0x140097114]
mov r9d, 2
mov qword [rsp + 0x20], rdi
mov edx, 0x4d832b
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [0x140097114]
mov r9d, 2
mov qword [rsp + 0x20], rdi
mov edx, 0x4d838a
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, str._Speed_Rapid_x2____Cheat_Enabled
mov byte [rbx + 0xc], 1
jmp 0x140070965
mov r9d, 1
mov byte [rbp - 0x10], 0x75
lea r8, [rbp - 0x10]
mov edx, 0x51f1b7
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov r9d, 1
mov byte [rbp - 0x10], 0x75
mov edx, 0x50d4aa
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [0x140097110]
mov r9d, 2
mov qword [rsp + 0x20], rdi
mov edx, 0x4d831c
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [0x140097104]
mov r9d, 2
mov qword [rsp + 0x20], rdi
mov edx, 0x4d832b
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [0x140097148]
mov r9d, 2
mov qword [rsp + 0x20], rdi
mov edx, 0x4d838a
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, str._Speed_Rapid_x2____Cheat_Disabled
mov byte [rbx + 0xc], dil
mov rcx, qword [0x1400785e8]
call fcn.140003030
lea rdx, [0x140003200]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x75
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140070b47
mov rcx, qword [rbx]
mov qword [rsp + 0x20], rdi
cmp byte [rbx + 0xd], dil
jne 0x140070a7b
mov r9d, 2
lea r8, [0x14009713c]
mov edx, 0x5a3f1c
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov r9d, 1
mov byte [rbp - 0x10], reloc.WS2_32.dll_WSACleanup
mov edx, 0x51f0bd
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov r9d, 1
mov byte [rbp - 0x10], 0x57
mov edx, 0x51f282
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [0x140097114]
mov r9d, 2
mov qword [rsp + 0x20], rdi
mov edx, 0x4d831c
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [0x140097114]
mov r9d, 2
mov qword [rsp + 0x20], rdi
mov edx, 0x4d832b
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [0x140097114]
mov r9d, 2
mov qword [rsp + 0x20], rdi
mov edx, 0x4d838a
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, str._Speed_Rapid_x10____Cheat_Enabled
mov byte [rbx + 0xd], 1
jmp 0x140070b20
mov r9d, 1
mov byte [rbp - 0x10], 0x75
lea r8, [rbp - 0x10]
mov edx, 0x51f0bd
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov r9d, 1
mov byte [rbp - 0x10], 0x60
mov edx, 0x51f282
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [0x140097110]
mov r9d, 2
mov qword [rsp + 0x20], rdi
mov edx, 0x4d831c
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [0x140097104]
mov r9d, 2
mov qword [rsp + 0x20], rdi
mov edx, 0x4d832b
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [0x140097148]
mov r9d, 2
mov qword [rsp + 0x20], rdi
mov edx, 0x4d838a
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, str._Speed_Rapid_x10____Cheat_Disabled
mov byte [rbx + 0xd], dil
mov rcx, qword [0x1400785e8]
call fcn.140003030
lea rdx, [0x140003200]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x76
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140070c0c
lea r8, [rbp - 0x10]
mov rcx, qword [rbx]
mov r9d, 1
mov qword [rsp + 0x20], rdi
mov edx, 0x4db1a2
cmp byte [rbx + 0xe], dil
jne 0x140070baf
mov byte [rbp - 0x10], 3
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov r9d, 1
mov byte [rbp - 0x10], 3
mov edx, 0x4db98d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, str._Fly____Cheat_Enabled
mov byte [rbx + 0xe], 1
jmp 0x140070be5
mov byte [rbp - 0x10], dil
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov r9d, 1
mov byte [rbp - 0x10], dil
mov edx, 0x4db98d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, str._Fly____Cheat_Disabled
mov byte [rbx + 0xe], dil
mov rcx, qword [0x1400785e8]
call fcn.140003030
lea rdx, [0x140003200]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x77
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140070d00
mov rcx, qword [rbx]
mov qword [rsp + 0x20], rdi
cmp byte [rbx + 0xf], dil
jne 0x140070c94
mov r9d, 2
lea r8, [0x14009713c]
mov edx, 0x5a3f1c
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov r9d, 1
mov byte [rbp - 0x10], 0x75
mov edx, 0x4e9494
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov r9d, 1
mov byte [rbp - 0x10], reloc.WS2_32.dll_WSACleanup
mov edx, 0x4e9609
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, str._TeamESP____Cheat_Enabled
mov byte [rbx + 0xf], 1
jmp 0x140070cd9
mov r9d, 1
mov byte [rbp - 0x10], reloc.WS2_32.dll_WSACleanup
lea r8, [rbp - 0x10]
mov edx, 0x4e9494
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov r9d, 1
mov byte [rbp - 0x10], 0x75
mov edx, 0x4e9609
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, str._TeamESP____Cheat_Disabled
mov byte [rbx + 0xf], dil
mov rcx, qword [0x1400785e8]
call fcn.140003030
lea rdx, [0x140003200]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x78
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140070dc5
lea r8, [rbp - 0x10]
mov rcx, qword [rbx]
mov r9d, 1
mov qword [rsp + 0x20], rdi
mov edx, 0x56d9ad
cmp byte [rbx + 0x10], dil
jne 0x140070d68
mov byte [rbp - 0x10], 0x85
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov r9d, 1
mov byte [rbp - 0x10], 0x75
mov edx, 0x56d9d7
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, str._Anti_Kick____Cheat_Enabled
mov byte [rbx + 0x10], 1
jmp 0x140070d9e
mov byte [rbp - 0x10], 0x84
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [rbp - 0x10]
mov r9d, 1
mov byte [rbp - 0x10], reloc.WS2_32.dll_WSACleanup
mov edx, 0x56d9d7
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, str._Anti_Kick____Cheat_Disabled
mov byte [rbx + 0x10], dil
mov rcx, qword [0x1400785e8]
call fcn.140003030
lea rdx, [0x140003200]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea rcx, str.Gamebryo_Application
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x1400701e0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3