Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Check internet connectivity via wininet
Download url
Execute shellcode via indirect call
Log keystrokes via polling
Receive data

Disassembly:
sub rsp, 0x28
mov r8, 0xc88
xor rdx, rdx
movabs rcx, 0x1400c5ea8
call sub.msvcrt.dll_memset
xor rcx, rcx
call sub.KERNEL32.dll_GetModuleHandleA
mov qword [0x1400c5eb0], rax
xor r8, r8
mov rdx, 0x1000
xor rcx, rcx
call sub.KERNEL32.dll_HeapCreate
mov qword [0x1400c5ea8], rax
movabs rax, 0x1400b35b3
mov qword [0x1400c5ec0], rax
call fcn.14001f420
call fcn.14001e760
call fcn.14001e578
call fcn.14001cf60
call fcn.14001bf80
call fcn.14001bc4c
call fcn.14001b97c
call fcn.14001aa00
call fcn.14001a47c
call fcn.14001a1c8
call fcn.140018078
call fcn.140016270
call fcn.140014544
call fcn.140013960
call fcn.1400136a4
call fcn.140011ca8
call fcn.1400161c0
call fcn.140012490
mov rax, qword [0x1400c7100]
push rax
sub rsp, 8
push rax
pop rcx
sub rsp, 0x20
call fcn.14001a624
add rsp, 0x28
lea rcx, [0x1400c5ec8]
pop rdx
call fcn.14001f4b0
push qword [0x1400c7100]
sub rsp, 8
mov rcx, qword [0x1400c5ec8]
push qword [0x1400c7100]
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
movabs rcx, str.0.ogg
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
inc qword [0x1400c7100]
push 0
mov rdx, qword [0x1400c7110]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001ad60
add rsp, 0x28
pop qword [0x1400c7100]
movabs rbp, 0x1400763b6
mov r15, rbp
movabs rbp, 0x140073820
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x140073820
mov rax, rbp
push rax
push 0
pop rcx
pop rdx
pop r8
call fcn.14001b070
push 0
pop rcx
call fcn.14001a960
push qword [0x1400c7100]
sub rsp, 8
mov rcx, qword [0x1400c5ec8]
push qword [0x1400c7100]
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
movabs rcx, str.1.ogg
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
inc qword [0x1400c7100]
push 0
mov rdx, qword [0x1400c7110]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001ad60
add rsp, 0x28
pop qword [0x1400c7100]
movabs rbp, 0x140079327
mov r15, rbp
movabs rbp, 0x1400763b6
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x1400763b6
mov rax, rbp
push rax
push 0
pop rcx
pop rdx
pop r8
call fcn.14001b070
push 0
pop rcx
call fcn.14001a960
push qword [0x1400c7100]
sub rsp, 8
mov rcx, qword [0x1400c5ec8]
push qword [0x1400c7100]
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
movabs rcx, str.3.ogg
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
inc qword [0x1400c7100]
push 0
mov rdx, qword [0x1400c7110]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001ad60
add rsp, 0x28
pop qword [0x1400c7100]
movabs rbp, 0x14007c95c
mov r15, rbp
movabs rbp, 0x140079327
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x140079327
mov rax, rbp
push rax
push 0
pop rcx
pop rdx
pop r8
call fcn.14001b070
push 0
pop rcx
call fcn.14001a960
push qword [0x1400c7100]
sub rsp, 8
mov rcx, qword [0x1400c5ec8]
push qword [0x1400c7100]
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
movabs rcx, str.4.ogg
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
inc qword [0x1400c7100]
push 0
mov rdx, qword [0x1400c7110]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001ad60
add rsp, 0x28
pop qword [0x1400c7100]
movabs rbp, 0x14008132d
mov r15, rbp
movabs rbp, 0x14007c95c
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x14007c95c
mov rax, rbp
push rax
push 0
pop rcx
pop rdx
pop r8
call fcn.14001b070
push qword [0x1400c7100]
sub rsp, 8
mov rcx, qword [0x1400c5ec8]
push qword [0x1400c7100]
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
movabs rcx, str.5.ogg
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
inc qword [0x1400c7100]
push 0
mov rdx, qword [0x1400c7110]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001ad60
add rsp, 0x28
pop qword [0x1400c7100]
movabs rbp, 0x140083f3a
mov r15, rbp
movabs rbp, 0x14008132d
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x14008132d
mov rax, rbp
push rax
push 0
pop rcx
pop rdx
pop r8
call fcn.14001b070
push qword [0x1400c7100]
sub rsp, 8
mov rcx, qword [0x1400c5ec8]
push qword [0x1400c7100]
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
movabs rcx, str.6.ogg
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
inc qword [0x1400c7100]
push 0
mov rdx, qword [0x1400c7110]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001ad60
add rsp, 0x28
pop qword [0x1400c7100]
movabs rbp, 0x140085de1
mov r15, rbp
movabs rbp, 0x140083f3a
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x140083f3a
mov rax, rbp
push rax
push 0
pop rcx
pop rdx
pop r8
call fcn.14001b070
push qword [0x1400c7100]
sub rsp, 8
mov rcx, qword [0x1400c5ec8]
push qword [0x1400c7100]
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
movabs rcx, str.7.ogg
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
inc qword [0x1400c7100]
push 0
mov rdx, qword [0x1400c7110]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001ad60
add rsp, 0x28
pop qword [0x1400c7100]
movabs rbp, 0x140088349
mov r15, rbp
movabs rbp, 0x140085de1
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x140085de1
mov rax, rbp
push rax
push 0
pop rcx
pop rdx
pop r8
call fcn.14001b070
push 0
pop rcx
call fcn.14001a960
call fcn.140012558
push qword [0x1400c7100]
sub rsp, 8
mov rcx, qword [0x1400c5ec8]
push qword [0x1400c7100]
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
movabs rcx, str.0.ogg
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
inc qword [0x1400c7100]
push 0
mov rdx, qword [0x1400c7110]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140012808
add rsp, 0x28
pop qword [0x1400c7100]
mov qword [0x1400c5ed0], rax
push qword [0x1400c7100]
sub rsp, 8
mov rcx, qword [0x1400c5ec8]
push qword [0x1400c7100]
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
movabs rcx, str.1.ogg
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
inc qword [0x1400c7100]
push 1
mov rdx, qword [0x1400c7110]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140012808
add rsp, 0x28
pop qword [0x1400c7100]
mov qword [0x1400c5ed0], rax
push qword [0x1400c7100]
sub rsp, 8
mov rcx, qword [0x1400c5ec8]
push qword [0x1400c7100]
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
movabs rcx, str.3.ogg
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
inc qword [0x1400c7100]
push 3
mov rdx, qword [0x1400c7110]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140012808
add rsp, 0x28
pop qword [0x1400c7100]
mov qword [0x1400c5ed0], rax
push qword [0x1400c7100]
sub rsp, 8
mov rcx, qword [0x1400c5ec8]
push qword [0x1400c7100]
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
movabs rcx, str.4.ogg
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
inc qword [0x1400c7100]
push 4
mov rdx, qword [0x1400c7110]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140012808
add rsp, 0x28
pop qword [0x1400c7100]
mov qword [0x1400c5ed0], rax
push qword [0x1400c7100]
sub rsp, 8
mov rcx, qword [0x1400c5ec8]
push qword [0x1400c7100]
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
movabs rcx, str.5.ogg
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
inc qword [0x1400c7100]
push 5
mov rdx, qword [0x1400c7110]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140012808
add rsp, 0x28
pop qword [0x1400c7100]
mov qword [0x1400c5ed0], rax
push qword [0x1400c7100]
sub rsp, 8
mov rcx, qword [0x1400c5ec8]
push qword [0x1400c7100]
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
movabs rcx, str.6.ogg
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
inc qword [0x1400c7100]
push 6
mov rdx, qword [0x1400c7110]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140012808
add rsp, 0x28
pop qword [0x1400c7100]
mov qword [0x1400c5ed0], rax
push qword [0x1400c7100]
sub rsp, 8
mov rcx, qword [0x1400c5ec8]
push qword [0x1400c7100]
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
movabs rcx, str.7.ogg
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
inc qword [0x1400c7100]
push 7
mov rdx, qword [0x1400c7110]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140012808
add rsp, 0x28
pop qword [0x1400c7100]
mov qword [0x1400c5ed0], rax
call fcn.1400161c0
mov rdx, qword [0x1400c7100]
push rdx
push rdx
push 0
push 0x40
mov rax, qword [0x1400c7100]
push rax
sub rsp, 8
push rax
pop rcx
sub rsp, 0x20
call fcn.1400139a8
add rsp, 0x28
mov rdx, qword [0x1400c7110]
add qword [rsp], rdx
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14000e3fe
add rsp, 0x28
lea rcx, [0x1400c5ed8]
pop rdx
call fcn.14001f4b0
movabs rbp, 0x140088349
mov rax, rbp
push rax
push 0
pop rcx
pop rdx
call fcn.14001c258
and rax, rax
je 0x140002a6d
movabs rbp, 0x140099b00
mov rax, rbp
push rax
push 2
pop rcx
pop rdx
call fcn.14001c258
push 0
pop rcx
call fcn.14001c31c
mov rax, rax
push rax
pop rcx
call fcn.14001bc98
push 0x41
push 0x133
push 2
pop rcx
sub rsp, 0x20
call fcn.14001c4b0
add rsp, 0x20
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
call fcn.14001bd04
call fcn.14001bd50
push 0x100
push 0x18
movabs rax, 0x14007323a
push rax
push 1
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001a4a0
and rax, rax
je 0x140001987
push 0x100
push 0x30
movabs rax, 0x14007323a
push rax
push 2
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001a4a0
and rax, rax
je 0x1400019b1
push 0x120
push 0xfa
push 0x1f4
push 1
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001c4d0
and rax, rax
je 0x140001aeb
push 1
pop rcx
call fcn.14001c31c
mov rax, rax
push rax
pop rcx
call fcn.14001bc98
push 1
pop rcx
call fcn.14001a604
mov rax, rax
push rax
pop rcx
call fcn.14001bdb0
push 0x11
pop rcx
call fcn.14001bdc4
push 0xff
push 0xa
push 0xa
push 0xa
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001401c
mov rax, rax
push rax
movabs rax, str.bradynichols1
push rax
push 0
push 0
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001bdd4
call fcn.14001bd50
push 0
push 0x64
push 0xc8
push 1
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001c638
push 0
pop rcx
call fcn.14001c31c
mov rax, rax
push rax
pop rcx
call fcn.14001bc98
push 0x11
pop rcx
call fcn.14001bdc4
sub rsp, 8
push 0x64
push 0xc8
push 0x12
push 0x133
sub rsp, 8
push 1
pop rcx
sub rsp, 0x20
call fcn.14001c4b0
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001be54
add rsp, 0x30
call fcn.14001bd50
push 1
pop rcx
call fcn.14001bf00
mov rdx, 0x65
sub rsp, 8
movabs rax, 0x1400c6a60
push rax
sub rsp, 0x20
movabs r9, 0x140073810
mov r8, 8
mov rcx, 8
call fcn.14001b7f8
add rsp, 0x30
mov qword [0x1400c6a60], rax
mov rax, qword [0x1400c7100]
push rax
sub rsp, 8
push rax
pop rcx
sub rsp, 0x20
call fcn.14001a624
add rsp, 0x28
lea rcx, [0x1400c5ee0]
pop rdx
call fcn.14001f4b0
push qword [0x1400c7100]
sub rsp, 8
mov rcx, qword [0x1400c5ee0]
push qword [0x1400c7100]
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
movabs rcx, str.Options
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
inc qword [0x1400c7100]
push 0xa
mov rdx, qword [0x1400c7110]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001ad60
add rsp, 0x28
pop qword [0x1400c7100]
and rax, rax
je 0x140001c09
movabs rbp, 0x1400b1074
mov r15, rbp
movabs rbp, str.MEGA_TRAINER_r_n_r_n_r_nNumpad_1:_God_Mode_r_nNumpad_2:_Ghost_Mode_r_nNumpad_3:_Reset_Health_r_nNumpad_4:_Add_Money_r_nNumpad_5:_99_Medical_Vials_r_nNumpad_6:_99_Bombs_r_nNumpad_7:_99_Pistol_Ammo_r_nNumpad_8:_Mega_Creed_Points_r_nNumpad_9:_99_LockPicks_r_nNumpad_0:_500_Sync_Points_r_nNumpad_:_Reset_Creed_Synch_Money_r_nNumpad__:_Super_Eagle_Vision
sub r15, rbp
mov rax, r15
push rax
movabs rbp, str.MEGA_TRAINER_r_n_r_n_r_nNumpad_1:_God_Mode_r_nNumpad_2:_Ghost_Mode_r_nNumpad_3:_Reset_Health_r_nNumpad_4:_Add_Money_r_nNumpad_5:_99_Medical_Vials_r_nNumpad_6:_99_Bombs_r_nNumpad_7:_99_Pistol_Ammo_r_nNumpad_8:_Mega_Creed_Points_r_nNumpad_9:_99_LockPicks_r_nNumpad_0:_500_Sync_Points_r_nNumpad_:_Reset_Creed_Synch_Money_r_nNumpad__:_Super_Eagle_Vision
mov rax, rbp
push rax
push 0xa
pop rcx
pop rdx
pop r8
call fcn.14001b070
push 0xa
pop rcx
call fcn.14001a960
jmp 0x140001c2b
movabs rax, str.Could_not_install_the_file___Installtion_failed
push rax
movabs rax, str.Error
push rax
pop rcx
pop rdx
call fcn.140013738
jmp 0x14000ce54
push qword [0x1400c7100]
sub rsp, 8
mov rcx, qword [0x1400c5ee0]
push qword [0x1400c7100]
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
movabs rcx, str.help.txt
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
inc qword [0x1400c7100]
push 0
mov rdx, qword [0x1400c7110]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001ad60
add rsp, 0x28
pop qword [0x1400c7100]
and rax, rax
je 0x140001cdf
movabs rbp, 0x1400b29f0
mov r15, rbp
movabs rbp, 0x1400b1074
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x1400b1074
mov rax, rbp
push rax
push 0
pop rcx
pop rdx
pop r8
call fcn.14001b070
push 0
pop rcx
call fcn.14001a960
jmp 0x140001cfc
movabs rax, str.Could_not_create_HELP.TXT_file.
push rax
movabs rax, str.Error
push rax
pop rcx
pop rdx
call fcn.140013738
mov rdx, 0x65
sub rsp, 8
movabs rax, 0x1400c6a60
push rax
sub rsp, 0x20
movabs r9, 0x140073810
mov r8, 8
mov rcx, 8
call fcn.14001b7f8
add rsp, 0x30
mov qword [0x1400c6a60], rax
push qword [0x1400c7100]
sub rsp, 8
mov rcx, qword [0x1400c5ee0]
push qword [0x1400c7100]
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
movabs rcx, str.Options
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
inc qword [0x1400c7100]
push 0xa
mov rdx, qword [0x1400c7110]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001ae80
add rsp, 0x28
pop qword [0x1400c7100]
mov rax, qword [0x1400c7100]
push rax
sub rsp, 8
push rax
push 0xa
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001b100
add rsp, 0x28
movabs rcx, 0x14007309e
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
lea rcx, [0x1400c5ee8]
pop rdx
call fcn.14001f4b0
mov rax, qword [0x1400c7100]
push rax
sub rsp, 8
push rax
push 0xa
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001b100
add rsp, 0x28
lea rcx, [0x1400c5ef0]
pop rdx
call fcn.14001f4b0
mov rax, qword [0x1400c7100]
push rax
sub rsp, 8
push rax
push 0xa
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001b100
add rsp, 0x28
mov r15, qword [0x1400c5ef8]
inc r15
mov rbp, qword [0x1400c6a60]
shl r15, 3
lea rcx, [r15 + rbp]
pop rdx
call fcn.14001f4b0
inc qword [0x1400c5ef8]
push 0xa
pop rcx
call fcn.14001b270
mov r15, rax
cmp r15, 1
jne 0x140001e19
push 0xa
pop rcx
call fcn.14001a960
fild qword [0x1400c5ef8]
fmul dword [0x1400737e4]
fstp dword [0x1400c6704]
fld dword [0x1400c6704]
fmul dword [0x1400737e8]
fstp dword [0x1400c6708]
fld dword [0x1400c6704]
fild qword [0x1400c5ef8]
fdiv dword [0x1400737ec]
fdivp st(1)
fstp dword [0x1400c670c]
fld dword [0x1400c6708]
fild qword [0x1400c5ef8]
fdiv dword [0x1400737ec]
fdivp st(1)
fstp dword [0x1400c6710]
fld dword [0x1400c6704]
fcomp dword [0x1400737f0]
fnstsw ax
test ah, 1
jne 0x140001ef9
mov r15, qword [0x1400c5ef8]
cmp r15, 0x15
jl 0x140001ef9
jmp 0x140001f02
mov rax, 1
jmp 0x140001f05
xor rax, rax
and rax, rax
je 0x140001f42
mov dword [0x1400c6704], 0x44480000
mov dword [0x1400c6708], 0x44c80000
fld dword [0x1400c6704]
fdiv dword [0x1400737e8]
fstp dword [0x1400c670c]
fld dword [0x1400c6708]
fdiv dword [0x1400737e8]
fstp dword [0x1400c6710]
push 0x120
fld dword [0x1400c6708]
fistp qword [rsp - 8]
mov rax, qword [rsp - 8]
mov rax, rax
push rax
fld dword [0x1400c6704]
fistp qword [rsp - 8]
mov rax, qword [rsp - 8]
mov rax, rax
push rax
push 1
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001c4d0
and rax, rax
je 0x14000218d
push 1
pop rcx
call fcn.14001c31c
mov rax, rax
push rax
pop rcx
call fcn.14001bc98
push 1
pop rcx
call fcn.14001a604
mov rax, rax
push rax
pop rcx
call fcn.14001bdb0
push 0x11
pop rcx
call fcn.14001bdc4
mov qword [0x1400c5f00], 1
mov rax, qword [0x1400c5ef8]
cmp rax, qword [0x1400c5f00]
jl 0x14000203b
push 0xff
push 0
push 0
push 0
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001401c
mov rax, rax
push rax
mov r15, qword [0x1400c5f00]
mov rbp, qword [0x1400c6a60]
shl r15, 3
push qword [r15 + rbp]
mov r15, qword [0x1400c5f00]
imul r15, r15, 0x1a
add r15, 0xffffffffffffffe8
mov rax, r15
push rax
push 2
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001bdd4
inc qword [0x1400c5f00]
jno 0x140001fc6
mov qword [0x1400c5f00], 1
mov rax, qword [0x1400c5ef8]
cmp rax, qword [0x1400c5f00]
jl 0x1400020bb
push 0xff
push 0xff
push 0xff
push 0xff
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001401c
mov rax, rax
push rax
mov r15, qword [0x1400c5f00]
mov rbp, qword [0x1400c6a60]
shl r15, 3
push qword [r15 + rbp]
mov r15, qword [0x1400c5f00]
imul r15, r15, 0x1a
add r15, 0xffffffffffffffe6
mov rax, r15
push rax
push 0
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001bdd4
inc qword [0x1400c5f00]
jno 0x140002046
call fcn.14001bd50
push 0
fld dword [0x1400c6710]
fistp qword [rsp - 8]
mov rax, qword [rsp - 8]
mov rax, rax
push rax
fld dword [0x1400c670c]
fistp qword [rsp - 8]
mov rax, qword [rsp - 8]
mov rax, rax
push rax
push 1
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001c638
push 0
pop rcx
call fcn.14001c31c
mov rax, rax
push rax
pop rcx
call fcn.14001bc98
push 0x11
pop rcx
call fcn.14001bdc4
sub rsp, 8
fld dword [0x1400c6710]
fistp qword [rsp - 8]
mov rax, qword [rsp - 8]
mov rax, rax
push rax
fld dword [0x1400c670c]
fistp qword [rsp - 8]
mov rax, qword [rsp - 8]
mov rax, rax
push rax
push 0x43
push 7
sub rsp, 8
push 1
pop rcx
sub rsp, 0x20
call fcn.14001c4b0
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001be54
add rsp, 0x30
call fcn.14001bd50
push 1
pop rcx
call fcn.14001bf00
push 0x120
push 0x190
push 0x640
push 1
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001c4d0
and rax, rax
je 0x14000231d
push 1
pop rcx
call fcn.14001c31c
mov rax, rax
push rax
pop rcx
call fcn.14001bc98
push 2
pop rcx
call fcn.14001a604
mov rax, rax
push rax
pop rcx
call fcn.14001bdb0
push 0x11
pop rcx
call fcn.14001bdc4
push qword [0x1400c7100]
sub rsp, 8
push 0xff
push 0xa
push 0xa
push 0xa
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001401c
add rsp, 0x20
mov rax, rax
push rax
mov rcx, qword [0x1400c5ee8]
push qword [0x1400c7100]
sub rsp, 0x20
call fcn.14001f570
add rsp, 0x20
mov rcx, qword [0x1400c5ef0]
sub rsp, 0x20
call fcn.14001f570
add rsp, 0x20
inc qword [0x1400c7100]
push 0
push 0
mov rdx, qword [0x1400c7110]
add qword [rsp + 0x10], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001bdd4
add rsp, 0x28
pop qword [0x1400c7100]
call fcn.14001bd50
push 0
push 0x64
push 0x190
push 1
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001c638
push 0
pop rcx
call fcn.14001c31c
mov rax, rax
push rax
pop rcx
call fcn.14001bc98
push 0x11
pop rcx
call fcn.14001bdc4
sub rsp, 8
push 0x64
push 0x190
push 0x28
push 5
sub rsp, 8
push 1
pop rcx
sub rsp, 0x20
call fcn.14001c4b0
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001be54
add rsp, 0x30
call fcn.14001bd50
push 1
pop rcx
call fcn.14001bf00
sub rsp, 8
movabs rax, 0x90000001
push rax
movabs rax, 0x14007302a
push rax
sub rsp, 8
push 0
pop rcx
sub rsp, 0x20
call fcn.14001c820
add rsp, 0x28
mov rax, rax
push rax
push 0
pop rcx
sub rsp, 0x20
call fcn.14001c844
add rsp, 0x20
mov rax, rax
push rax
push 0
push 0
push 0
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400184ec
add rsp, 0x40
and rax, rax
je 0x140002a6d
movabs rax, str.CLOSEBUTTON
push rax
push 0x13
push 0x13
push 6
push 0x1e4
push 1
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400164a8
add rsp, 0x30
mov qword [0x1400c5ed0], rax
movabs rax, str.READMEBUTTON
push rax
push 0x20
push 0x11e
push 0x17e
push 0xa
push 3
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400164a8
add rsp, 0x30
mov qword [0x1400c5ed0], rax
movabs rax, str.TROUBLEBUTTON
push rax
push 0x20
push 0x11e
push 0x19c
push 0xa
push 4
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400164a8
add rsp, 0x30
mov qword [0x1400c5ed0], rax
movabs rax, str.CHBUTTON
push rax
push 0x23
push 0xf5
push 1
push 0x23
push 5
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400164a8
add rsp, 0x30
mov qword [0x1400c5ed0], rax
movabs rax, str.BOXARTBUTTON
push rax
push 0x118
push 0xc8
push 0x2d
push 0x132
push 6
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400164a8
add rsp, 0x30
mov qword [0x1400c5ed0], rax
movabs rax, 0x1400731fc
push rax
push 0x10e
push 0x122
push 0x41
push 0
push 7
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400164a8
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push 0
pop rcx
call fcn.140018550
mov rax, rax
push rax
movabs rax, 0x80000000
push rax
movabs rax, str.Test
push rax
push 0x6b
push 0xc8
push 0
push 0xfffffffffffffc18
push 1
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400180f8
add rsp, 0x40
push 0
pop rcx
call fcn.140018550
mov rax, rax
push rax
pop rcx
call fcn.14000f0cd
push 0xff
sub rsp, 8
push 0
pop rcx
sub rsp, 0x20
call fcn.14001c4b0
add rsp, 0x28
mov rax, rax
push rax
push 0
pop rcx
sub rsp, 0x20
call fcn.140018550
add rsp, 0x20
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
call fcn.14000cfd8
push 0
push 0
pop rcx
pop rdx
call fcn.140018628
mov rax, qword [0x1400c7100]
push rax
sub rsp, 8
push rax
movabs rcx, str.http:__www.cheathappens.com_trnflash.asp_id
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
mov rcx, qword [0x1400c5ed8]
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
inc qword [0x1400c7100]
push 0xc8
push 0x12c
push 0
push 0
push 2
mov rdx, qword [0x1400c7110]
add qword [rsp + 0x28], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140017a28
add rsp, 0x38
pop qword [0x1400c7100]
mov qword [0x1400c5ed0], rax
push 0
push 0
pop rcx
pop rdx
call sub.WININET.DLL_InternetGetConnectedState
mov r15, rax
and r15, r15
jne 0x14000266d
push 1
push 1
pop rcx
pop rdx
call fcn.140018628
mov qword [0x1400c5f00], 1
mov rax, 4
cmp rax, qword [0x1400c5f00]
jl 0x140002a6d
push 0x120
push 0xfa
push 0x1f4
push 1
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001c4d0
and rax, rax
je 0x14000286b
push 1
pop rcx
call fcn.14001c31c
mov rax, rax
push rax
pop rcx
call fcn.14001bc98
push 1
pop rcx
call fcn.14001a604
mov rax, rax
push rax
pop rcx
call fcn.14001bdb0
push 0x11
pop rcx
call fcn.14001bdc4
push 0xff
push 0xa
push 0xa
push 0xa
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001401c
mov rax, rax
push rax
movabs rax, str.bradynichols1
push rax
push 0
push 0
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001bdd4
call fcn.14001bd50
push 0
push 0x64
push 0xc8
push 1
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001c638
push 0
pop rcx
call fcn.14001c31c
mov rax, rax
push rax
pop rcx
call fcn.14001bc98
push 0
pop rcx
call fcn.14001bdc4
sub rsp, 8
sub rsp, 8
push 0xff
push 0x44
push 0x44
push 0x44
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001401c
add rsp, 0x28
mov rax, rax
push rax
push 0xe
push 0xaf
push 0x12
push 0x133
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001be8c
add rsp, 0x30
push 0x21
pop rcx
call fcn.14001bdc4
sub rsp, 8
push 0x64
push 0xc8
push 0x12
push 0x133
sub rsp, 8
push 1
pop rcx
sub rsp, 0x20
call fcn.14001c4b0
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001be54
add rsp, 0x30
call fcn.14001bd50
push 1
pop rcx
call fcn.14001bf00
push 0xff
sub rsp, 8
push 0
pop rcx
sub rsp, 0x20
call fcn.14001c4b0
add rsp, 0x28
mov rax, rax
push rax
push 0
pop rcx
sub rsp, 0x20
call fcn.140018550
add rsp, 0x20
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
call fcn.14000cfd8
push 0x32
pop rcx
call fcn.140014038
push 0x120
push 0xfa
push 0x1f4
push 1
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001c4d0
and rax, rax
je 0x140002a55
push 1
pop rcx
call fcn.14001c31c
mov rax, rax
push rax
pop rcx
call fcn.14001bc98
push 1
pop rcx
call fcn.14001a604
mov rax, rax
push rax
pop rcx
call fcn.14001bdb0
push 0x11
pop rcx
call fcn.14001bdc4
push 0xff
push 0xff
push 0xff
push 0xff
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001401c
mov rax, rax
push rax
movabs rax, str.bradynichols1
push rax
push 0
push 0
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001bdd4
call fcn.14001bd50
push 0
push 0x64
push 0xc8
push 1
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001c638
push 0
pop rcx
call fcn.14001c31c
mov rax, rax
push rax
pop rcx
call fcn.14001bc98
push 0
pop rcx
call fcn.14001bdc4
sub rsp, 8
sub rsp, 8
push 0xff
push 0x44
push 0x44
push 0x44
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001401c
add rsp, 0x28
mov rax, rax
push rax
push 0xe
push 0xaf
push 0x12
push 0x133
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001be8c
add rsp, 0x30
push 0x21
pop rcx
call fcn.14001bdc4
sub rsp, 8
push 0x64
push 0xc8
push 0x12
push 0x133
sub rsp, 8
push 1
pop rcx
sub rsp, 0x20
call fcn.14001c4b0
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001be54
add rsp, 0x30
call fcn.14001bd50
push 1
pop rcx
call fcn.14001bf00
push 0xff
sub rsp, 8
push 0
pop rcx
sub rsp, 0x20
call fcn.14001c4b0
add rsp, 0x28
mov rax, rax
push rax
push 0
pop rcx
sub rsp, 0x20
call fcn.140018550
add rsp, 0x20
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
call fcn.14000cfd8
push 0x32
pop rcx
call fcn.140014038
inc qword [0x1400c5f00]
jno 0x140002678
mov rdx, 0x100
sub rsp, 8
movabs rax, 0x1400c6a70
push rax
sub rsp, 0x20
movabs r9, 0x140073810
mov r8, 8
mov rcx, 8
call fcn.14001b7f8
add rsp, 0x30
mov qword [0x1400c6a70], rax
movabs rax, 0x1400b29f0
mov qword [0x1400c5ec0], rax
lea rcx, [0x1400c5f08]
mov rdx, qword [0x1400c5ec0]
call fcn.14001f5e0
add qword [0x1400c5ec0], rax
mov qword [0x1400c5f00], 1
mov rax, 0xfe
cmp rax, qword [0x1400c5f00]
jl 0x140002ba6
mov rax, qword [0x1400c7100]
push rax
sub rsp, 8
push rax
movabs rax, 0x14007303e
push rax
push qword [0x1400c5f00]
push qword [0x1400c5f08]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140010110
add rsp, 0x28
lea rcx, [0x1400c5f10]
pop rdx
call fcn.14001f4b0
mov rax, qword [0x1400c7100]
push rax
sub rsp, 8
push rax
sub rsp, 8
push qword [0x1400c5f10]
pop rcx
sub rsp, 0x20
call fcn.140010270
add rsp, 0x28
dec rax
push rax
push qword [0x1400c5f10]
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.1400102a0
add rsp, 0x28
mov r15, qword [0x1400c5f00]
mov rbp, qword [0x1400c6a70]
shl r15, 3
lea rcx, [r15 + rbp]
pop rdx
call fcn.14001f4b0
inc qword [0x1400c5f00]
jno 0x140002ae5
call sub.KERNEL32.dll_IsDebuggerPresent
and rax, rax
je 0x140002bb8
push 0x75009553
inc ecx
ret
push 0x12c
pop rcx
call fcn.140014038
push 0x120
push 0xdc
push 0x44c
push 1
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001c4d0
and rax, rax
je 0x140002da2
push 1
pop rcx
call fcn.14001c31c
mov rax, rax
push rax
pop rcx
call fcn.14001bc98
push 1
pop rcx
call fcn.14001a604
mov rax, rax
push rax
pop rcx
call fcn.14001bdb0
push 0x11
pop rcx
call fcn.14001bdc4
push 0xff
push 0xa
push 0xa
push 0xa
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001401c
mov rax, rax
push rax
movabs rax, str.Authenticating_Trainer......
push rax
push 0
push 0
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001bdd4
call fcn.14001bd50
push 0
push 0x64
push 0x1f4
push 1
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001c638
push 0
pop rcx
call fcn.14001c31c
mov rax, rax
push rax
pop rcx
call fcn.14001bc98
push 0
pop rcx
call fcn.14001bdc4
sub rsp, 8
sub rsp, 8
push 0xff
push 0x2f
push 0xa2
push 0xf2
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001401c
add rsp, 0x28
mov rax, rax
push rax
push 0x18
push 0x202
push 0x1c2
push 1
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001be8c
add rsp, 0x30
push 0x11
pop rcx
call fcn.14001bdc4
sub rsp, 8
push 0x64
push 0x1f4
push 0x1c5
push 5
sub rsp, 8
push 1
pop rcx
sub rsp, 0x20
call fcn.14001c4b0
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001be54
add rsp, 0x30
call fcn.14001bd50
push 1
pop rcx
call fcn.14001bf00
push 0xff
sub rsp, 8
push 0
pop rcx
sub rsp, 0x20
call fcn.14001c4b0
add rsp, 0x28
mov rax, rax
push rax
push 0
pop rcx
sub rsp, 0x20
call fcn.140018550
add rsp, 0x20
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
call fcn.14000cfd8
mov rax, qword [0x1400c7100]
push rax
sub rsp, 8
push rax
mov rdx, qword [0x1400c7100]
push rdx
push rdx
pop rcx
sub rsp, 0x20
call fcn.1400139a8
add rsp, 0x20
mov rdx, qword [0x1400c7110]
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001a6bc
add rsp, 0x28
lea rcx, [0x1400c5f18]
pop rdx
call fcn.14001f4b0
mov rcx, qword [0x1400c5f18]
push qword [0x1400c7100]
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
lea rcx, [0x1400c5f20]
pop rdx
call fcn.14001f4b0
call sub.USER32.DLL_GetForegroundWindow
mov qword [0x1400c5f28], rax
lea rax, [0x1400c5f30]
mov rax, rax
push rax
push qword [0x1400c5f28]
pop rcx
pop rdx
call sub.USER32.DLL_GetWindowThreadProcessId
push qword [0x1400c5f30]
push qword [0x1400c5f40]
push 0x1f0fff
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_OpenProcess
mov qword [0x1400c5f38], rax
mov rax, qword [0x1400c5f30]
mov qword [0x1400c5f28], rax
push 0x3e8
pop rcx
call fcn.14001e790
mov qword [0x1400c5f48], rax
mov rcx, qword [0x1400c5f20]
push qword [0x1400c7100]
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
lea rcx, [0x1400c5f50]
pop rdx
call fcn.14001f4b0
mov rax, qword [0x1400c5f60]
mov qword [0x1400c5f58], rax
movabs rbp, 0x1400b35b3
mov qword [0x1400c5f00], rbp
push qword [0x1400c5f00]
pop rcx
call fcn.14001e7b0
mov rax, rax
mov byte [0x1400c6720], al
movabs rbp, 0x1400b35b6
mov qword [0x1400c5f00], rbp
movabs rbp, 0x1400b35b6
mov r15, rbp
add r15, 0xbb8
cmp r15, qword [0x1400c5f00]
jl 0x140002f7e
push qword [0x1400c5f00]
pop rcx
call fcn.14001e7b0
mov rax, rax
mov byte [0x1400c6721], al
movsx r15, byte [0x1400c6721]
movsx rax, byte [0x1400c6720]
xor r15, rax
mov rax, r15
mov byte [0x1400c6722], al
movsx r15, byte [0x1400c6720]
add r15, 0x37
mov rax, r15
mov byte [0x1400c6720], al
movsx r15, byte [0x1400c6720]
cmp r15, 0xff
jle 0x140002f71
movsx r15, byte [0x1400c6720]
add r15, 0xffffffffffffff01
mov rax, r15
mov byte [0x1400c6720], al
inc qword [0x1400c5f00]
jno 0x140002ee5
mov rdx, 1
sub rsp, 8
movabs rax, 0x1400c6a80
push rax
sub rsp, 0x20
xor r9, r9
mov r8, 7
mov rcx, 0x10
call fcn.14001b7f8
add rsp, 0x30
mov qword [0x1400c6a80], rax
call sub.KERNEL32.dll_GetTickCount
mov qword [0x1400c5f78], rax
mov rax, qword [0x1400c7100]
push rax
sub rsp, 8
push rax
pop rcx
sub rsp, 0x20
call fcn.1400139a8
add rsp, 0x28
lea rcx, [0x1400c5f80]
pop rdx
call fcn.14001f4b0
mov rax, qword [0x1400c7100]
push rax
sub rsp, 8
push rax
push qword [0x1400c5f80]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001a6bc
add rsp, 0x28
lea rcx, [0x1400c5f80]
pop rdx
call fcn.14001f4b0
movabs rdx, 0x14007302a
lea rcx, [0x1400c5f08]
call fcn.14001f5e0
movabs rdx, 0x14007302a
lea rcx, [0x1400c5f88]
call fcn.14001f5e0
movabs rdx, 0x14007302a
lea rcx, [0x1400c5f90]
call fcn.14001f5e0
mov qword [0x1400c5f98], 0
mov dword [0x1400c6714], 0
push qword [0x1400c7100]
sub rsp, 8
push 3
mov rdx, qword [0x1400c7100]
push rdx
push rdx
pop rcx
sub rsp, 0x20
call fcn.1400139a8
add rsp, 0x20
inc qword [0x1400c7100]
push 0
mov rdx, qword [0x1400c7110]
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14001af70
add rsp, 0x28
pop qword [0x1400c7100]
push 0
pop rcx
call fcn.14001b340
mov qword [0x1400c5fa0], rax
mov qword [0x1400c5f00], 1
mov r15, qword [0x1400c5fa0]
add r15, 0xfffffffffffffff8
cmp r15, qword [0x1400c5f00]
jl 0x140003131
push 0
pop rcx
call fcn.14001b3a0
mov rax, rax
mov byte [0x1400c6723], al
movsxd r15, dword [0x1400c6714]
movzx rax, byte [0x1400c6723]
add r15, rax
mov rax, r15
mov dword [0x1400c6714], eax
inc qword [0x1400c5f00]
jno 0x1400030e5
push 0
pop rcx
call fcn.14001b410
mov qword [0x1400c5fa8], rax
push 0
pop rcx
call fcn.14001b410
mov qword [0x1400c5fb0], rax
push 0
pop rcx
call fcn.14001a960
movsxd rax, dword [0x1400c6714]
push rax
pop qword [0x1400c5fb8]
push qword [0x1400c7100]
sub rsp, 8
push 3
mov rdx, qword [0x1400c7100]
push rdx
push rdx
pop rcx
sub rsp, 0x20
call fcn.1400139a8
add rsp, 0x20
inc qword [0x1400c7100]
push 0
mov rdx, qword [0x1400c7110]
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14001af70
add rsp, 0x28
pop qword [0x1400c7100]
mov r15, rax
and r15, r15
jle 0x140003679
mov qword [0x1400c5f00], 1
mov rax, 0x3b8
cmp rax, qword [0x1400c5f00]
jl 0x140003205
push 0
pop rcx
call fcn.14001b480
mov qword [0x1400c5fc0], rax
inc qword [0x1400c5f00]
jno 0x1400031da
mov qword [0x1400c5f00], 0x3b9
mov rax, 0x3c0
cmp rax, qword [0x1400c5f00]
jl 0x1400032e2
push 0
pop rcx
call fcn.14001b480
mov qword [0x1400c5fc0], rax
mov rax, qword [0x1400c7100]
push rax
sub rsp, 8
push rax
sub rsp, 8
push qword [0x1400c7100]
push 1
push qword [0x1400c5fc0]
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.1400103c0
add rsp, 0x28
mov rdx, qword [0x1400c7110]
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140010580
add rsp, 0x28
pop qword [0x1400c7100]
mov qword [0x1400c5fc0], rax
mov rcx, qword [0x1400c5f08]
push qword [0x1400c7100]
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
mov rdx, qword [0x1400c7100]
push rdx
push rdx
push qword [0x1400c5fc0]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140010670
add rsp, 0x20
pop rax
lea rcx, [0x1400c5f08]
pop rdx
call fcn.14001f4b0
inc qword [0x1400c5f00]
jno 0x140003210
push qword [0x1400c5f08]
pop rcx
call fcn.14000ec8b
mov qword [0x1400c5fc0], rax
mov r15, qword [0x1400c5fc0]
movabs rax, 0x98989898
xor r15, rax
mov qword [0x1400c5fc0], r15
mov rax, qword [0x1400c5fc0]
mov qword [0x1400c5fc8], rax
mov rax, qword [0x1400c7100]
push rax
sub rsp, 8
push rax
push 0xa
push qword [0x1400c7100]
movabs rcx, str.0000000000
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
mov rdx, qword [0x1400c7100]
push rdx
push rdx
push qword [0x1400c5fc0]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400107a0
add rsp, 0x20
pop rax
mov rdx, qword [0x1400c7110]
add qword [rsp], rdx
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.140010800
add rsp, 0x28
lea rcx, [0x1400c5f08]
pop rdx
call fcn.14001f4b0
mov qword [0x1400c5f00], 0x3c1
mov rax, 0x3c8
cmp rax, qword [0x1400c5f00]
jl 0x140003472
push 0
pop rcx
call fcn.14001b480
mov qword [0x1400c5fc0], rax
mov rax, qword [0x1400c7100]
push rax
sub rsp, 8
push rax
sub rsp, 8
push qword [0x1400c7100]
push 1
push qword [0x1400c5fc0]
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.1400103c0
add rsp, 0x28
mov rdx, qword [0x1400c7110]
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140010580
add rsp, 0x28
pop qword [0x1400c7100]
mov qword [0x1400c5fc0], rax
mov rcx, qword [0x1400c5f88]
push qword [0x1400c7100]
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
mov rdx, qword [0x1400c7100]
push rdx
push rdx
push qword [0x1400c5fc0]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140010670
add rsp, 0x20
pop rax
lea rcx, [0x1400c5f88]
pop rdx
call fcn.14001f4b0
inc qword [0x1400c5f00]
jno 0x1400033a0
push qword [0x1400c5f88]
pop rcx
call fcn.14000ec8b
mov qword [0x1400c5fd0], rax
mov qword [0x1400c5f00], 0x3c9
mov rax, 0x3d0
cmp rax, qword [0x1400c5f00]
jl 0x140003562
push 0
pop rcx
call fcn.14001b480
mov qword [0x1400c5fc0], rax
mov rax, qword [0x1400c7100]
push rax
sub rsp, 8
push rax
sub rsp, 8
push qword [0x1400c7100]
push 1
push qword [0x1400c5fc0]
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.1400103c0
add rsp, 0x28
mov rdx, qword [0x1400c7110]
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140010580
add rsp, 0x28
pop qword [0x1400c7100]
mov qword [0x1400c5fc0], rax
mov rcx, qword [0x1400c5f90]
push qword [0x1400c7100]
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
mov rdx, qword [0x1400c7100]
push rdx
push rdx
push qword [0x1400c5fc0]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140010670
add rsp, 0x20
pop rax
lea rcx, [0x1400c5f90]
pop rdx
call fcn.14001f4b0
inc qword [0x1400c5f00]
jno 0x140003490
push qword [0x1400c5f90]
pop rcx
call fcn.14000ec8b
mov qword [0x1400c5fc0], rax
mov rax, qword [0x1400c5fc0]
mov qword [0x1400c5fd8], rax
mov qword [0x1400c5f00], 0x3d1
mov rax, qword [0x1400c5fd8]
cmp rax, qword [0x1400c5f00]
jl 0x1400035b9
push 0
pop rcx
call fcn.14001b480
mov qword [0x1400c5fc0], rax
inc qword [0x1400c5f00]
jno 0x14000358e
mov rax, qword [0x1400c5fd8]
mov qword [0x1400c5f00], rax
mov r15, qword [0x1400c5fd8]
add r15, 0x12
cmp r15, qword [0x1400c5f00]
jl 0x14000360b
push 0
pop rcx
call fcn.14001b480
mov qword [0x1400c5fc0], rax
mov r15, qword [0x1400c5f98]
add r15, qword [0x1400c5fc0]
mov qword [0x1400c5f98], r15
inc qword [0x1400c5f00]
jno 0x1400035c7
mov r15, qword [0x1400c5fd0]
xor r15, qword [0x1400c5f98]
mov qword [0x1400c5fe0], r15
mov r15, qword [0x1400c5fe0]
and r15, r15
jne 0x140003637
mov qword [0x1400c5fe0], 0x63
mov r15, qword [0x1400c5fe0]
movabs rax, 0x98989898
xor r15, rax
mov qword [0x1400c5fe0], r15
mov rax, qword [0x1400c5fc8]
mov qword [0x1400c5fe8], rax
mov r15, qword [0x1400c5fc8]
cmp r15, qword [0x1400c5fe0]
jne 0x140003672
jmp 0x140003677
call fcn.14000b516
jmp 0x14000367e
call fcn.14000b516
mov r15, qword [0x1400c5fb0]
cmp r15, qword [0x1400c5fa0]
jne 0x140003690
jmp 0x140003695
call fcn.14000b516
call sub.KERNEL32.dll_GetTickCount
mov qword [0x1400c5ff0], rax
mov r15, qword [0x1400c5ff0]
sub r15, qword [0x1400c5f78]
cmp r15, 0x3e8
jle 0x1400036c0
push 0x9099542
inc eax
ret
mov qword [0x1400c5ff8], 0x45a2a5
movabs rdx, 0x14007302a
lea rcx, [0x1400c6000]
call fcn.14001f5e0
mov rdx, 0x15
sub rsp, 8
movabs rax, 0x1400c6a90
push rax
sub rsp, 0x20
xor r9, r9
mov r8, 0x15
mov rcx, 8
call fcn.14001b7f8
add rsp, 0x30
mov qword [0x1400c6a90], rax
mov rdx, 0x15
sub rsp, 8
movabs rax, 0x1400c6aa0
push rax
sub rsp, 0x20
xor r9, r9
mov r8, 0x15
mov rcx, 8
call fcn.14001b7f8
add rsp, 0x30
mov qword [0x1400c6aa0], rax
mov rdx, 0x15
sub rsp, 8
movabs rax, 0x1400c6ab0
push rax
sub rsp, 0x20
xor r9, r9
mov r8, 0x15
mov rcx, 8
call fcn.14001b7f8
add rsp, 0x30
mov qword [0x1400c6ab0], rax
mov rdx, 0x15
sub rsp, 8
movabs rax, 0x1400c6ac0
push rax
sub rsp, 0x20
xor r9, r9
mov r8, 0x15
mov rcx, 8
call fcn.14001b7f8
add rsp, 0x30
mov qword [0x1400c6ac0], rax
mov rdx, 0x15
sub rsp, 8
movabs rax, 0x1400c6ad0
push rax
sub rsp, 0x20
xor r9, r9
mov r8, 0x15
mov rcx, 8
call fcn.14001b7f8
add rsp, 0x30
mov qword [0x1400c6ad0], rax
mov rdx, 0x15
sub rsp, 8
movabs rax, 0x1400c6ae0
push rax
sub rsp, 0x20
xor r9, r9
mov r8, 0x15
mov rcx, 8
call fcn.14001b7f8
add rsp, 0x30
mov qword [0x1400c6ae0], rax
mov rdx, 0xa
sub rsp, 8
movabs rax, 0x1400c6af0
push rax
sub rsp, 0x20
xor r9, r9
mov r8, 0x15
mov rcx, 8
call fcn.14001b7f8
add rsp, 0x30
mov qword [0x1400c6af0], rax
push 0x3e8
pop rcx
call fcn.14001e790
mov qword [0x1400c5f48], rax
push 0x3e8
pop rcx
call fcn.14001e790
mov qword [0x1400c6008], rax
push 0x4000
pop rcx
call fcn.14001e790
mov qword [0x1400c6010], rax
push 0x4000
pop rcx
call fcn.14001e790
mov qword [0x1400c6018], rax
push 0x14
pop rcx
call fcn.14001e790
mov qword [0x1400c6020], rax
mov qword [0x1400c5f00], 1
mov rax, 0x14
cmp rax, qword [0x1400c5f00]
jl 0x14000394a
mov r15, qword [0x1400c5f00]
mov rbp, qword [0x1400c6aa0]
shl r15, 3
mov qword [r15 + rbp], 1
mov r15, qword [0x1400c5f00]
mov rbp, qword [0x1400c6ab0]
shl r15, 3
mov qword [r15 + rbp], 1
mov r15, qword [0x1400c5f00]
mov rbp, qword [0x1400c6ac0]
shl r15, 3
mov qword [r15 + rbp], 1
inc qword [0x1400c5f00]
jno 0x1400038e3
mov rbp, qword [0x1400c6af0]
mov qword [rbp], 0xcc
mov qword [rbp + 8], 0xffffff
mov qword [rbp + 0x10], 0xcc0000
mov qword [rbp + 0x18], 0xaa00
mov qword [rbp + 0x20], 0x55ee
mov qword [rbp + 0x28], 0xccff
mov qword [rbp + 0x30], 0x2255
mov qword [rbp + 0x38], 0x770044
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0x6633ff
mov rax, qword [0x1400c7100]
push rax
sub rsp, 8
push rax
sub rsp, 8
push qword [0x1400c7100]
push 1
push 1
mov rdx, qword [0x1400c7100]
push rdx
push rdx
push qword [0x1400c5fe0]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400107a0
add rsp, 0x20
mov rdx, qword [0x1400c7110]
add qword [rsp], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400108a0
add rsp, 0x28
mov rdx, qword [0x1400c7110]
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140010580
add rsp, 0x28
pop qword [0x1400c7100]
mov qword [0x1400c6028], rax
mov rax, qword [0x1400c7100]
push rax
sub rsp, 8
push rax
sub rsp, 8
push qword [0x1400c7100]
push 1
push 2
mov rdx, qword [0x1400c7100]
push rdx
push rdx
push qword [0x1400c5fe0]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400107a0
add rsp, 0x20
mov rdx, qword [0x1400c7110]
add qword [rsp], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400108a0
add rsp, 0x28
mov rdx, qword [0x1400c7110]
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140010580
add rsp, 0x28
pop qword [0x1400c7100]
mov qword [0x1400c6030], rax
mov rax, qword [0x1400c7100]
push rax
sub rsp, 8
push rax
sub rsp, 8
push qword [0x1400c7100]
push 1
push 3
mov rdx, qword [0x1400c7100]
push rdx
push rdx
push qword [0x1400c5fe0]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400107a0
add rsp, 0x20
mov rdx, qword [0x1400c7110]
add qword [rsp], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400108a0
add rsp, 0x28
mov rdx, qword [0x1400c7110]
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140010580
add rsp, 0x28
pop qword [0x1400c7100]
mov qword [0x1400c6038], rax
mov rax, qword [0x1400c7100]
push rax
sub rsp, 8
push rax
sub rsp, 8
push qword [0x1400c7100]
push 1
push 4
mov rdx, qword [0x1400c7100]
push rdx
push rdx
push qword [0x1400c5fe0]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400107a0
add rsp, 0x20
mov rdx, qword [0x1400c7110]
add qword [rsp], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400108a0
add rsp, 0x28
mov rdx, qword [0x1400c7110]
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140010580
add rsp, 0x28
pop qword [0x1400c7100]
mov qword [0x1400c6040], rax
mov rax, qword [0x1400c7100]
push rax
sub rsp, 8
push rax
sub rsp, 8
push qword [0x1400c7100]
push 1
push 5
mov rdx, qword [0x1400c7100]
push rdx
push rdx
push qword [0x1400c5fe0]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400107a0
add rsp, 0x20
mov rdx, qword [0x1400c7110]
add qword [rsp], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400108a0
add rsp, 0x28
mov rdx, qword [0x1400c7110]
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140010580
add rsp, 0x28
pop qword [0x1400c7100]
mov qword [0x1400c6048], rax
push 0
pop rcx
call fcn.14001c31c
mov rax, rax
push rax
pop rcx
call fcn.14001bc98
push 0
pop rcx
call fcn.14001bdc4
sub rsp, 8
mov r15, qword [0x1400c6028]
shl r15, 3
push qword [r15 + rbp]
push 2
push 2
push 0x144
push 0x1ea
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001be8c
add rsp, 0x30
sub rsp, 8
mov r15, qword [0x1400c6030]
shl r15, 3
push qword [r15 + rbp]
push 2
push 2
push 0x144
push 0x1ed
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001be8c
add rsp, 0x30
sub rsp, 8
mov r15, qword [0x1400c6038]
shl r15, 3
push qword [r15 + rbp]
push 2
push 2
push 0x144
push 0x1f0
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001be8c
add rsp, 0x30
sub rsp, 8
mov r15, qword [0x1400c6040]
shl r15, 3
push qword [r15 + rbp]
push 2
push 2
push 0x144
push 0x1f3
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001be8c
add rsp, 0x30
sub rsp, 8
mov r15, qword [0x1400c6048]
shl r15, 3
push qword [r15 + rbp]
push 2
push 2
push 0x144
push 0x1f6
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001be8c
add rsp, 0x30
call fcn.14001bd50
movabs rdx, str.Template
lea rcx, [0x1400c6080]
call fcn.14001f5e0
mov rax, qword [0x1400c7100]
push rax
sub rsp, 8
push rax
pop rcx
sub rsp, 0x20
call fcn.14001a624
add rsp, 0x28
lea rcx, [0x1400c6050]
pop rdx
call fcn.14001f4b0
call fcn.14000ceb1
call fcn.14000a288
push qword [0x1400c7100]
sub rsp, 8
mov rcx, qword [0x1400c6050]
push qword [0x1400c7100]
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
movabs rcx, str.CH.dll
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
inc qword [0x1400c7100]
push 0
mov rdx, qword [0x1400c7110]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001ad60
add rsp, 0x28
pop qword [0x1400c7100]
and rax, rax
je 0x140003e73
movabs rbp, 0x1400b51b6
mov r15, rbp
movabs rbp, 0x1400b35b6
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x1400b35b6
mov rax, rbp
push rax
push 0
pop rcx
pop rdx
pop r8
call fcn.14001b070
push 0
pop rcx
call fcn.14001a960
jmp 0x140003e73
push qword [0x1400c7100]
sub rsp, 8
mov rcx, qword [0x1400c6050]
push qword [0x1400c7100]
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
movabs rcx, str.help.txt
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
inc qword [0x1400c7100]
push 0
mov rdx, qword [0x1400c7110]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001ad60
add rsp, 0x28
pop qword [0x1400c7100]
and rax, rax
je 0x140003f27
movabs rbp, 0x1400b29f0
mov r15, rbp
movabs rbp, 0x1400b1074
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x1400b1074
mov rax, rbp
push rax
push 0
pop rcx
pop rdx
pop r8
call fcn.14001b070
push 0
pop rcx
call fcn.14001a960
jmp 0x140003f44
movabs rax, str.Could_not_create_HELP.TXT_file.
push rax
movabs rax, str.Error
push rax
pop rcx
pop rdx
call fcn.140013738
movabs rax, str.CH_Trainer_Keys.dat
push rax
push 0
pop rcx
pop rdx
call fcn.14001af80
mov qword [0x1400c5ed0], rax
mov r15, qword [0x1400c5ed0]
and r15, r15
jle 0x140003f84
mov qword [0x1400c60b0], 1
push 0
pop rcx
call fcn.14001a960
push 0
push 0
pop rcx
pop rdx
call sub.WININET.DLL_InternetGetConnectedState
and rax, rax
je 0x140003f9c
jmp 0x140003fe3
mov rax, qword [0x1400c5fe8]
mov rax, rax
push rax
pop rcx
call fcn.14000d4cb
mov r15, rax
and r15, r15
jne 0x140003fe3
push 0
movabs rax, str.This_trainer_must_be_authenticated_before_it_can_be_used._Please_connect_this_computer_to_the_Internet_or_obtain_an_offline_key_from_cheathappens.com_then_re_run_the_trainer.
push rax
movabs rax, str.No_Internet_Connection_
push rax
pop rcx
pop rdx
pop r8
call fcn.1400136e0
jmp 0x14000ce54
mov rax, qword [0x1400c7100]
push rax
sub rsp, 8
push rax
pop rcx
sub rsp, 0x20
call fcn.14001a624
add rsp, 0x28
movabs rcx, str.black.txt
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
lea rcx, [0x1400c60b8]
pop rdx
call fcn.14001f4b0
mov r15, qword [0x1400c60c0]
and r15, r15
jle 0x140004145
push qword [0x1400c7100]
movabs rcx, str.http:__www.cheathappens.com_unauthorized_
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
mov rdx, qword [0x1400c7100]
push rdx
push rdx
mov r15, qword [0x1400c5fe8]
xor r15, 0x7b3d89b
mov rax, r15
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400107a0
add rsp, 0x20
pop rax
movabs rcx, str..zip
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
lea rcx, [0x1400c60c8]
pop rdx
call fcn.14001f4b0
movabs rdx, str.http:__www.cheathappens.com_unauthorized_0.zip
lea rcx, [0x1400c60d0]
call fcn.14001f5e0
mov rcx, qword [0x1400c60c8]
push qword [0x1400c7100]
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
lea rcx, [0x1400c60d8]
pop rdx
call fcn.14001f4b0
mov rcx, qword [0x1400c60d0]
push qword [0x1400c7100]
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
lea rcx, [0x1400c60e0]
pop rdx
call fcn.14001f4b0
sub rsp, 8
push 0
push 0
mov rax, qword [0x1400c60b8]
mov rax, rax
push rax
mov rax, qword [0x1400c60e0]
mov rax, rax
push rax
push 0
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.URLMON.DLL_URLDownloadToFileA
add rsp, 0x30
mov qword [0x1400c60e8], rax
push qword [0x1400c7100]
movabs rcx, str.http:__www.cheathappens.com_unauthorized_
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
mov rdx, qword [0x1400c7100]
push rdx
push rdx
mov r15, qword [0x1400c5fe8]
xor r15, 0x7b3d89b
mov rax, r15
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400107a0
add rsp, 0x20
pop rax
movabs rcx, str..zip
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
lea rcx, [0x1400c60c8]
pop rdx
call fcn.14001f4b0
movabs rdx, str.http:__www.cheathappens.com_unauthorized_0.zip
lea rcx, [0x1400c60d0]
call fcn.14001f5e0
mov rcx, qword [0x1400c60c8]
push qword [0x1400c7100]
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
lea rcx, [0x1400c60d8]
pop rdx
call fcn.14001f4b0
mov rcx, qword [0x1400c60d0]
push qword [0x1400c7100]
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
lea rcx, [0x1400c60e0]
pop rdx
call fcn.14001f4b0
sub rsp, 8
push 0
push 0
mov rax, qword [0x1400c60b8]
mov rax, rax
push rax
mov rax, qword [0x1400c60e0]
mov rax, rax
push rax
push 0
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.URLMON.DLL_URLDownloadToFileA
add rsp, 0x30
mov qword [0x1400c60e8], rax
mov r15, qword [0x1400c60e8]
and r15, r15
jne 0x140004266
jmp 0x1400042ad
mov rax, qword [0x1400c5fe8]
mov rax, rax
push rax
pop rcx
call fcn.14000d4cb
mov r15, rax
and r15, r15
jne 0x1400042ad
push 0
movabs rax, str.This_trainer_must_be_authenticated_before_it_can_be_used._Please_connect_this_computer_to_the_Internet_or_obtain_an_offline_key_from_cheathappens.com_then_re_run_the_trainer.
push rax
movabs rax, str.No_Internet_Connection_
push rax
pop rcx
pop rdx
pop r8
call fcn.1400136e0
jmp 0x14000ce54
sub rsp, 8
push 0
push 0
mov rax, qword [0x1400c60b8]
mov rax, rax
push rax
mov rax, qword [0x1400c60d8]
mov rax, rax
push rax
push 0
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.URLMON.DLL_URLDownloadToFileA
add rsp, 0x30
mov qword [0x1400c60f0], rax
mov rax, qword [0x1400c7100]
push rax
sub rsp, 8
push rax
movabs rax, 0x1400730b3
push rax
movabs rax, str.IZnvZalZidZ_ZTraiZnerZ_UsZerZ
push rax
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.140010c30
add rsp, 0x28
lea rcx, [0x1400c60f8]
pop rdx
call fcn.14001f4b0
mov r15, qword [0x1400c60f0]
and r15, r15
jne 0x140004342
call fcn.14000b516
mov rax, qword [0x1400c7100]
push rax
sub rsp, 8
push rax
movabs rax, str.ZTSA.l
push rax
push qword [0x1400c60f8]
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.140010c30
add rsp, 0x28
lea rcx, [0x1400c60f8]
pop rdx
call fcn.14001f4b0
mov r15, qword [0x1400c60f0]
and r15, r15
jne 0x140004572
push 0x120
push 0xdc
push 0x44c
push 1
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001c4d0
and rax, rax
je 0x140004568
push 1
pop rcx
call fcn.14001c31c
mov rax, rax
push rax
pop rcx
call fcn.14001bc98
push 1
pop rcx
call fcn.14001a604
mov rax, rax
push rax
pop rcx
call fcn.14001bdb0
push 0x11
pop rcx
call fcn.14001bdc4
push 0xff
push 0xff
push 0xff
push 0xff
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001401c
mov rax, rax
push rax
push qword [0x1400c60f8]
push 0
push 0
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001bdd4
call fcn.14001bd50
push 0
push 0x64
push 0x1f4
push 1
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001c638
push 0
pop rcx
call fcn.14001c31c
mov rax, rax
push rax
pop rcx
call fcn.14001bc98
push 0
pop rcx
call fcn.14001bdc4
sub rsp, 8
sub rsp, 8
push 0xff
push 0x28
push 0x28
push 0xff
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001401c
add rsp, 0x28
mov rax, rax
push rax
push 0x24
push 0x1df
push 1
push 0
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001be8c
add rsp, 0x30
push 0x11
pop rcx
call fcn.14001bdc4
sub rsp, 8
push 0x64
push 0x1f4
push 0xa
push 0xc8
sub rsp, 8
push 1
pop rcx
sub rsp, 0x20
call fcn.14001c4b0
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001be54
add rsp, 0x30
call fcn.14001bd50
push 1
pop rcx
call fcn.14001bf00
push 0xff
sub rsp, 8
push 0
pop rcx
sub rsp, 0x20
call fcn.14001c4b0
add rsp, 0x28
mov rax, rax
push rax
push 0
pop rcx
sub rsp, 0x20
call fcn.140018550
add rsp, 0x20
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
call fcn.14000cfd8
call fcn.14000a288
jmp 0x14000437e
mov r15, qword [0x1400c60e8]
and r15, r15
je 0x1400045a0
mov rax, qword [0x1400c5fe8]
mov rax, rax
push rax
pop rcx
call fcn.14000d4cb
mov r15, rax
and r15, r15
jne 0x1400045a0
mov rax, 1
jmp 0x1400045a3
xor rax, rax
and rax, rax
je 0x1400045b3
mov qword [0x1400c5ff8], 0
mov qword [0x1400c6100], 3
lea rbp, [0x1400c6728]
lea rax, [rbp]
mov rax, rax
push rax
pop rcx
call sub.USER32.DLL_GetKeyboardState
movsx rax, byte [rbp + 0x90]
push rax
pop qword [0x1400c6108]
mov r15, qword [0x1400c6108]
cmp r15, 1
jne 0x140004607
movabs rdx, str.Run_game_and_press_F1_at_main_menu.__Numlock_is_ON.
lea rcx, [0x1400c6110]
call fcn.14001f5e0
jmp 0x14000461d
movabs rdx, 0x140073240
lea rcx, [0x1400c6110]
call fcn.14001f5e0
mov r15, qword [0x1400c6100]
cmp r15, qword [0x1400c6108]
je 0x140004819
mov rax, qword [0x1400c6108]
mov qword [0x1400c6100], rax
push 0x120
push 0xdc
push 0x44c
push 1
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001c4d0
and rax, rax
je 0x140004819
push 1
pop rcx
call fcn.14001c31c
mov rax, rax
push rax
pop rcx
call fcn.14001bc98
push 1
pop rcx
call fcn.14001a604
mov rax, rax
push rax
pop rcx
call fcn.14001bdb0
push 0x11
pop rcx
call fcn.14001bdc4
push 0xff
push 0xa
push 0xa
push 0xa
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001401c
mov rax, rax
push rax
push qword [0x1400c6110]
push 0
push 0
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001bdd4
call fcn.14001bd50
push 0
push 0x64
push 0x1f4
push 1
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001c638
push 0
pop rcx
call fcn.14001c31c
mov rax, rax
push rax
pop rcx
call fcn.14001bc98
push 0
pop rcx
call fcn.14001bdc4
sub rsp, 8
sub rsp, 8
push 0xff
push 0x2f
push 0xa2
push 0xf2
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001401c
add rsp, 0x28
mov rax, rax
push rax
push 0x18
push 0x202
push 0x1c2
push 1
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001be8c
add rsp, 0x30
push 0x11
pop rcx
call fcn.14001bdc4
sub rsp, 8
push 0x64
push 0x1f4
push 0x1c5
push 5
sub rsp, 8
push 1
pop rcx
sub rsp, 0x20
call fcn.14001c4b0
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001be54
add rsp, 0x30
call fcn.14001bd50
push 1
pop rcx
call fcn.14001bf00
push 0xff
sub rsp, 8
push 0
pop rcx
sub rsp, 0x20
call fcn.14001c4b0
add rsp, 0x28
mov rax, rax
push rax
push 0
pop rcx
sub rsp, 0x20
call fcn.140018550
add rsp, 0x20
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
call fcn.14000cfd8
call fcn.14000a288
push 0xa
pop rcx
call fcn.140014038
push 0x70
pop rcx
call sub.USER32.DLL_GetAsyncKeyState
mov r15, rax
and r15, 0x8000
and r15, r15
je 0x1400045be
movabs rdx, str.ACU.exe
lea rcx, [0x1400c5f20]
call fcn.14001f5e0
call fcn.14000906a
mov r15, qword [0x1400c5f28]
and r15, r15
jne 0x140004a82
push 4
pop rcx
call fcn.140012ba0
push 0x12c
pop rcx
call fcn.140014038
push 0x12c
pop rcx
call fcn.140014038
push 0x120
push 0xdc
push 0x44c
push 1
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001c4d0
and rax, rax
je 0x140004a72
push 1
pop rcx
call fcn.14001c31c
mov rax, rax
push rax
pop rcx
call fcn.14001bc98
push 1
pop rcx
call fcn.14001a604
mov rax, rax
push rax
pop rcx
call fcn.14001bdb0
push 0x11
pop rcx
call fcn.14001bdc4
push 0xff
push 0xa
push 0xa
push 0xa
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001401c
mov rax, rax
push rax
movabs rax, str.Game_not_Found__Run_Game_and_then_press_F1_at_Main_Menu.
push rax
push 0
push 0
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001bdd4
call fcn.14001bd50
push 0
push 0x64
push 0x1f4
push 1
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001c638
push 0
pop rcx
call fcn.14001c31c
mov rax, rax
push rax
pop rcx
call fcn.14001bc98
push 0
pop rcx
call fcn.14001bdc4
sub rsp, 8
sub rsp, 8
push 0xff
push 0x2f
push 0xa2
push 0xf2
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001401c
add rsp, 0x28
mov rax, rax
push rax
push 0x18
push 0x202
push 0x1c2
push 1
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001be8c
add rsp, 0x30
push 0x11
pop rcx
call fcn.14001bdc4
sub rsp, 8
push 0x64
push 0x1f4
push 0x1c5
push 5
sub rsp, 8
push 1
pop rcx
sub rsp, 0x20
call fcn.14001c4b0
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001be54
add rsp, 0x30
call fcn.14001bd50
push 1
pop rcx
call fcn.14001bf00
push 0xff
sub rsp, 8
push 0
pop rcx
sub rsp, 0x20
call fcn.14001c4b0
add rsp, 0x28
mov rax, rax
push rax
push 0
pop rcx
sub rsp, 0x20
call fcn.140018550
add rsp, 0x20
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
call fcn.14000cfd8
push 0x7d0
pop rcx
call fcn.140014038
jmp 0x140004572
movabs rdx, str.CH.dll
lea rcx, [0x1400c6118]
call fcn.14001f5e0
mov rcx, qword [0x1400c6050]
push qword [0x1400c7100]
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
mov rcx, qword [0x1400c6118]
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
lea rcx, [0x1400c5f50]
pop rdx
call fcn.14001f4b0
call fcn.1400090c3
movabs rdx, str.xlive.dll
lea rcx, [0x1400c6120]
call fcn.14001f5e0
call fcn.14000906a
call fcn.14000a103
call fcn.14000a288
mov r15, qword [0x1400c6098]
and r15, r15
jne 0x140004d01
mov r15, qword [0x1400c6128]
and r15, r15
jne 0x140004d01
push 0x120
push 0xdc
push 0x44c
push 1
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001c4d0
and rax, rax
je 0x140004cfc
push 1
pop rcx
call fcn.14001c31c
mov rax, rax
push rax
pop rcx
call fcn.14001bc98
push 1
pop rcx
call fcn.14001a604
mov rax, rax
push rax
pop rcx
call fcn.14001bdb0
push 0x11
pop rcx
call fcn.14001bdc4
push 0xff
push 0xa
push 0xa
push 0xa
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001401c
mov rax, rax
push rax
movabs rax, str.Game_not_Found__Run_Game_and_then_press_F1_at_Main_Menu.
push rax
push 0
push 0
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001bdd4
call fcn.14001bd50
push 0
push 0x64
push 0x1f4
push 1
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001c638
push 0
pop rcx
call fcn.14001c31c
mov rax, rax
push rax
pop rcx
call fcn.14001bc98
push 0
pop rcx
call fcn.14001bdc4
sub rsp, 8
sub rsp, 8
push 0xff
push 0x2f
push 0xa2
push 0xf2
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001401c
add rsp, 0x28
mov rax, rax
push rax
push 0x18
push 0x202
push 0x1c2
push 1
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001be8c
add rsp, 0x30
push 0x11
pop rcx
call fcn.14001bdc4
sub rsp, 8
push 0x64
push 0x1f4
push 0x1c5
push 5
sub rsp, 8
push 1
pop rcx
sub rsp, 0x20
call fcn.14001c4b0
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001be54
add rsp, 0x30
call fcn.14001bd50
push 1
pop rcx
call fcn.14001bf00
push 0xff
sub rsp, 8
push 0
pop rcx
sub rsp, 0x20
call fcn.14001c4b0
add rsp, 0x28
mov rax, rax
push rax
push 0
pop rcx
sub rsp, 0x20
call fcn.140018550
add rsp, 0x20
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
call fcn.14000cfd8
jmp 0x140004572
mov r15, qword [0x1400c5fa8]
cmp r15, qword [0x1400c5fb8]
jne 0x140004d2b
mov r15, qword [0x1400c5fa8]
and r15, r15
je 0x140004d2b
mov r15, qword [0x1400c5fb8]
and r15, r15
je 0x140004d2b
jmp 0x140004d34
mov rax, 1
jmp 0x140004d37
xor rax, rax
and rax, rax
je 0x140004d9d
push 0xa
pop rcx
call fcn.140014100
mov r15, rax
add r15, 0xa
mov qword [0x1400c6130], r15
push 0x28
pop rcx
call fcn.140014100
mov r15, rax
add r15, 0x28
mov qword [0x1400c6138], r15
mov r15, qword [0x1400c6098]
add r15, qword [0x1400c6130]
mov qword [0x1400c6098], r15
mov r15, qword [0x1400c6128]
add r15, qword [0x1400c6138]
mov qword [0x1400c6128], r15
call fcn.14000b516
push 3
pop rcx
call fcn.140012ba0
push 0x12c
pop rcx
call fcn.140014038
push 0x120
push 0xdc
push 0x44c
push 1
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001c4d0
and rax, rax
je 0x140004f92
push 1
pop rcx
call fcn.14001c31c
mov rax, rax
push rax
pop rcx
call fcn.14001bc98
push 1
pop rcx
call fcn.14001a604
mov rax, rax
push rax
pop rcx
call fcn.14001bdb0
push 0x11
pop rcx
call fcn.14001bdc4
push 0xff
push 0xa
push 0xa
push 0xa
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001401c
mov rax, rax
push rax
movabs rax, str.Game_found__Trainer_Activated_
push rax
push 0
push 0
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001bdd4
call fcn.14001bd50
push 0
push 0x64
push 0x1f4
push 1
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001c638
push 0
pop rcx
call fcn.14001c31c
mov rax, rax
push rax
pop rcx
call fcn.14001bc98
push 0
pop rcx
call fcn.14001bdc4
sub rsp, 8
sub rsp, 8
push 0xff
push 0x2f
push 0xa2
push 0xf2
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001401c
add rsp, 0x28
mov rax, rax
push rax
push 0x18
push 0x202
push 0x1c2
push 1
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001be8c
add rsp, 0x30
push 0x11
pop rcx
call fcn.14001bdc4
sub rsp, 8
push 0x64
push 0x1f4
push 0x1c5
push 5
sub rsp, 8
push 1
pop rcx
sub rsp, 0x20
call fcn.14001c4b0
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001be54
add rsp, 0x30
call fcn.14001bd50
push 1
pop rcx
call fcn.14001bf00
push 0xff
sub rsp, 8
push 0
pop rcx
sub rsp, 0x20
call fcn.14001c4b0
add rsp, 0x28
mov rax, rax
push rax
push 0
pop rcx
sub rsp, 0x20
call fcn.140018550
add rsp, 0x20
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
call fcn.14000cfd8
mov r15, qword [0x1400c6140]
and r15, r15
je 0x140005399
push 0x8b
mov r15, qword [0x1400c5f48]
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0xff
mov r15, qword [0x1400c5f48]
inc r15
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x55
mov r15, qword [0x1400c5f48]
add r15, 2
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x8b
mov r15, qword [0x1400c5f48]
add r15, 3
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0xec
mov r15, qword [0x1400c5f48]
add r15, 4
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x83
mov r15, qword [0x1400c5f48]
add r15, 5
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0xec
mov r15, qword [0x1400c5f48]
add r15, 6
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x20
mov r15, qword [0x1400c5f48]
add r15, 7
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x53
mov r15, qword [0x1400c5f48]
add r15, 8
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x56
mov r15, qword [0x1400c5f48]
add r15, 9
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x57
mov r15, qword [0x1400c5f48]
add r15, 0xa
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x8d
mov r15, qword [0x1400c5f48]
add r15, 0xb
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x45
mov r15, qword [0x1400c5f48]
add r15, 0xc
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0xe0
mov r15, qword [0x1400c5f48]
add r15, 0xd
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x33
mov r15, qword [0x1400c5f48]
add r15, 0xe
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0xf6
mov r15, qword [0x1400c5f48]
add r15, 0xf
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x50
mov r15, qword [0x1400c5f48]
add r15, 0x10
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0xff
mov r15, qword [0x1400c5f48]
add r15, 0x11
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x75
mov r15, qword [0x1400c5f48]
add r15, 0x12
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0xc
mov r15, qword [0x1400c5f48]
add r15, 0x13
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
mov r15, qword [0x1400c6140]
add r15, 0x1000
mov qword [0x1400c5f00], r15
mov r15, qword [0x1400c6140]
add r15, 0x200000
cmp r15, qword [0x1400c5f00]
jl 0x140005399
sub rsp, 8
push qword [0x1400c5f40]
push 0x14
push qword [0x1400c6008]
push qword [0x1400c5f00]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push 0x14
push qword [0x1400c6008]
push qword [0x1400c5f48]
pop rcx
pop rdx
pop r8
call fcn.14001e7d0
mov qword [0x1400c5ed0], rax
mov r15, qword [0x1400c5ed0]
cmp r15, 1
jne 0x14000538c
mov rax, qword [0x1400c5f00]
mov qword [0x1400c6150], rax
push 0xc2
mov r15, qword [0x1400c5f48]
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0xc
mov r15, qword [0x1400c5f48]
inc r15
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0
mov r15, qword [0x1400c5f48]
add r15, 2
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
sub rsp, 8
push qword [0x1400c5f40]
push 3
push qword [0x1400c5f48]
push qword [0x1400c6150]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
inc qword [0x1400c5f00]
jno 0x14000525a
mov r15, qword [0x1400c60c0]
and r15, r15
jle 0x1400053aa
jmp 0x140006558
mov r15, qword [0x1400c5ff8]
cmp r15, 0x45a2a5
jne 0x1400054c4
mov rbp, qword [0x1400c6a90]
mov qword [rbp + 8], 0x61
mov qword [rbp + 0x10], 0x62
mov qword [rbp + 0x18], 0x63
mov qword [rbp + 0x20], 0x64
mov qword [rbp + 0x28], 0x65
mov qword [rbp + 0x30], 0x66
mov qword [rbp + 0x38], 0x67
mov qword [rbp + 0x40], 0x68
mov qword [rbp + 0x48], 0x69
mov qword [rbp + 0x50], 0x60
mov qword [rbp + 0x58], 0x6a
mov qword [rbp + 0x60], 0x6f
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0xa0], 0
mov qword [0x1400c5f00], 1
mov rax, 0x14
cmp rax, qword [0x1400c5f00]
jl 0x1400054c4
mov r15, qword [0x1400c5f00]
mov rbp, qword [0x1400c6a90]
shl r15, 3
push qword [r15 + rbp]
mov r15, qword [0x1400c5f00]
mov rbp, qword [0x1400c6ad0]
shl r15, 3
pop qword [r15 + rbp]
inc qword [0x1400c5f00]
jno 0x14000547f
movabs rax, str.CH_Trainer_Keys.dat
push rax
push 0
pop rcx
pop rdx
call fcn.14001af80
mov qword [0x1400c5ed0], rax
mov r15, qword [0x1400c5ed0]
and r15, r15
jle 0x1400056a6
mov qword [0x1400c60b0], 1
push 0
pop rcx
call fcn.14001b480
mov qword [0x1400c6158], rax
mov qword [0x1400c5f00], 1
mov rax, qword [0x1400c6158]
cmp rax, qword [0x1400c5f00]
jl 0x14000569b
mov rax, qword [0x1400c7100]
push rax
sub rsp, 8
push rax
push 0
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001b100
add rsp, 0x28
lea rcx, [0x1400c6160]
pop rdx
call fcn.14001f4b0
push qword [0x1400c6160]
movabs rcx, 0x1400731f6
pop rdx
call fcn.14001f6d0
or rax, rax
je 0x140005591
mov r15, qword [0x1400c5f00]
mov rbp, qword [0x1400c6aa0]
shl r15, 3
mov qword [r15 + rbp], 0
push qword [0x1400c6160]
movabs rcx, str.CTRL
pop rdx
call fcn.14001f6d0
or rax, rax
je 0x1400055c6
mov r15, qword [0x1400c5f00]
mov rbp, qword [0x1400c6ab0]
shl r15, 3
mov qword [r15 + rbp], 0
push qword [0x1400c6160]
movabs rcx, 0x140073362
pop rdx
call fcn.14001f6d0
or rax, rax
je 0x1400055fb
mov r15, qword [0x1400c5f00]
mov rbp, qword [0x1400c6ac0]
shl r15, 3
mov qword [r15 + rbp], 0
push 0
pop rcx
call fcn.14001b480
mov rax, rax
push rax
mov r15, qword [0x1400c5f00]
mov rbp, qword [0x1400c6a90]
shl r15, 3
pop qword [r15 + rbp]
mov rax, qword [0x1400c7100]
push rax
sub rsp, 8
push rax
sub rsp, 8
push qword [0x1400c7100]
push 1
mov r15, qword [0x1400c5f00]
shl r15, 3
push qword [r15 + rbp]
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.1400103c0
add rsp, 0x28
mov rdx, qword [0x1400c7110]
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140010580
add rsp, 0x28
pop qword [0x1400c7100]
mov rax, rax
push rax
mov r15, qword [0x1400c5f00]
shl r15, 3
pop qword [r15 + rbp]
inc qword [0x1400c5f00]
jno 0x14000551a
push 0
pop rcx
call fcn.14001a960
mov qword [0x1400c6168], 0x491
mov qword [0x1400c6170], 1
mov qword [0x1400c6178], 0x40
sub rsp, 8
lea rax, [0x1400c6170]
mov rax, rax
push rax
push qword [0x1400c6178]
push 0x999
push qword [0x1400c6180]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_VirtualProtectEx
add rsp, 0x30
mov qword [0x1400c5ed0], rax
mov qword [0x1400c6170], 1
mov qword [0x1400c6178], 0x40
sub rsp, 8
lea rax, [0x1400c6170]
mov rax, rax
push rax
push qword [0x1400c6178]
push 0x999
push qword [0x1400c6098]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_VirtualProtectEx
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push qword [0x1400c6180]
push qword [0x1400c5f48]
pop rcx
pop rdx
call fcn.14001e840
mov qword [0x1400c5ed0], rax
sub rsp, 8
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
mov r15, qword [0x1400c6128]
add r15, 0x3f00
mov rax, r15
push rax
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push qword [0x1400c6098]
push qword [0x1400c5f48]
pop rcx
pop rdx
call fcn.14001e840
mov qword [0x1400c5ed0], rax
sub rsp, 8
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
mov r15, qword [0x1400c6128]
add r15, 0x3f08
mov rax, r15
push rax
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push 0xfa47000
pop rcx
call fcn.14001e790
mov qword [0x1400c6188], rax
sub rsp, 8
push qword [0x1400c5f40]
push 0x540a000
push qword [0x1400c6188]
mov r15, qword [0x1400c6098]
add r15, 0x1000
mov rax, r15
push rax
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
sub rsp, 8
push qword [0x1400c5f40]
push 0x540a000
push qword [0x1400c6188]
mov r15, qword [0x1400c6180]
add r15, 0x1000
mov rax, r15
push rax
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push qword [0x1400c6188]
pop rcx
call fcn.14001e850
movabs rax, 0x140000000
mov qword [0x1400c6190], rax
movabs rax, 0x140000000
mov qword [0x1400c6198], rax
mov r15, qword [0x1400c6098]
sub r15, qword [0x1400c6190]
movabs rax, 0x140ea1910
add r15, rax
mov qword [0x1400c61a0], r15
mov r15, qword [0x1400c6098]
sub r15, qword [0x1400c6190]
movabs rax, 0x143eb5478
add r15, rax
mov qword [0x1400c61a8], r15
mov r15, qword [0x1400c6180]
sub r15, qword [0x1400c6198]
movabs rax, 0x140ea1910
add r15, rax
mov qword [0x1400c61b0], r15
mov r15, qword [0x1400c6098]
sub r15, qword [0x1400c6190]
movabs rax, 0x140eecc60
add r15, rax
mov qword [0x1400c61b8], r15
mov r15, qword [0x1400c6098]
sub r15, qword [0x1400c6190]
movabs rax, 0x140fcd496
add r15, rax
mov qword [0x1400c61c0], r15
mov r15, qword [0x1400c6098]
sub r15, qword [0x1400c6190]
movabs rax, 0x143eb2590
add r15, rax
mov qword [0x1400c61c8], r15
mov r15, qword [0x1400c6180]
sub r15, qword [0x1400c6198]
movabs rax, 0x140e9cb70
add r15, rax
mov qword [0x1400c61d0], r15
mov r15, qword [0x1400c6180]
sub r15, qword [0x1400c6198]
movabs rax, 0x140fcd496
add r15, rax
mov qword [0x1400c61d8], r15
mov r15, qword [0x1400c6098]
sub r15, qword [0x1400c6190]
movabs rax, 0x1451b3c58
add r15, rax
mov qword [0x1400c61e0], r15
mov r15, qword [0x1400c6098]
sub r15, qword [0x1400c6190]
movabs rax, 0x14523a3c0
add r15, rax
mov qword [0x1400c61e8], r15
push 0x48
mov r15, qword [0x1400c5f48]
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x8b
mov r15, qword [0x1400c5f48]
inc r15
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x49
mov r15, qword [0x1400c5f48]
add r15, 2
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x18
mov r15, qword [0x1400c5f48]
add r15, 3
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x48
mov r15, qword [0x1400c5f48]
add r15, 4
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0xbb
mov r15, qword [0x1400c5f48]
add r15, 5
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0
mov r15, qword [0x1400c5f48]
add r15, 6
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x3f
mov r15, qword [0x1400c5f48]
add r15, 7
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0xee
mov r15, qword [0x1400c5f48]
add r15, 8
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x61
mov r15, qword [0x1400c5f48]
add r15, 9
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0
mov r15, qword [0x1400c5f48]
add r15, 0xa
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0
mov r15, qword [0x1400c5f48]
add r15, 0xb
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0
mov r15, qword [0x1400c5f48]
add r15, 0xc
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0
mov r15, qword [0x1400c5f48]
add r15, 0xd
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x48
mov r15, qword [0x1400c5f48]
add r15, 0xe
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x89
mov r15, qword [0x1400c5f48]
add r15, 0xf
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0xb
mov r15, qword [0x1400c5f48]
add r15, 0x10
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x48
mov r15, qword [0x1400c5f48]
add r15, 0x11
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0xbb
mov r15, qword [0x1400c5f48]
add r15, 0x12
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x30
mov r15, qword [0x1400c5f48]
add r15, 0x13
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0xc7
mov r15, qword [0x1400c5f48]
add r15, 0x14
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x2b
mov r15, qword [0x1400c5f48]
add r15, 0x15
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x41
mov r15, qword [0x1400c5f48]
add r15, 0x16
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 1
mov r15, qword [0x1400c5f48]
add r15, 0x17
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0
mov r15, qword [0x1400c5f48]
add r15, 0x18
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0
mov r15, qword [0x1400c5f48]
add r15, 0x19
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0
mov r15, qword [0x1400c5f48]
add r15, 0x1a
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0xff
mov r15, qword [0x1400c5f48]
add r15, 0x1b
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0xe3
mov r15, qword [0x1400c5f48]
add r15, 0x1c
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x90
mov r15, qword [0x1400c5f48]
add r15, 0x1d
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0
mov r15, qword [0x1400c5f48]
add r15, 0x1e
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0
mov r15, qword [0x1400c5f48]
add r15, 0x1f
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x49
mov r15, qword [0x1400c5f48]
add r15, 0x20
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0xb8
mov r15, qword [0x1400c5f48]
add r15, 0x21
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 8
mov r15, qword [0x1400c5f48]
add r15, 0x22
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x3f
mov r15, qword [0x1400c5f48]
add r15, 0x23
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0xee
mov r15, qword [0x1400c5f48]
add r15, 0x24
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x61
mov r15, qword [0x1400c5f48]
add r15, 0x25
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0
mov r15, qword [0x1400c5f48]
add r15, 0x26
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0
mov r15, qword [0x1400c5f48]
add r15, 0x27
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0
mov r15, qword [0x1400c5f48]
add r15, 0x28
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0
mov r15, qword [0x1400c5f48]
add r15, 0x29
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x49
mov r15, qword [0x1400c5f48]
add r15, 0x2a
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x89
mov r15, qword [0x1400c5f48]
add r15, 0x2b
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0
mov r15, qword [0x1400c5f48]
add r15, 0x2c
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x45
mov r15, qword [0x1400c5f48]
add r15, 0x2d
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x8b
mov r15, qword [0x1400c5f48]
add r15, 0x2e
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x41
mov r15, qword [0x1400c5f48]
add r15, 0x2f
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x18
mov r15, qword [0x1400c5f48]
add r15, 0x30
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0xc1
mov r15, qword [0x1400c5f48]
add r15, 0x31
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0xe2
mov r15, qword [0x1400c5f48]
add r15, 0x32
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 3
mov r15, qword [0x1400c5f48]
add r15, 0x33
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0xc3
mov r15, qword [0x1400c5f48]
add r15, 0x34
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x90
mov r15, qword [0x1400c5f48]
add r15, 0x35
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
sub rsp, 8
push qword [0x1400c5f40]
push 0x1f4
push qword [0x1400c5f48]
mov r15, qword [0x1400c6180]
add r15, qword [0x1400c6168]
mov rax, r15
push rax
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
mov r15, qword [0x1400c6128]
add r15, 0x3f00
mov rax, r15
push rax
push qword [0x1400c5f48]
pop rcx
pop rdx
call fcn.14001e840
mov qword [0x1400c5ed0], rax
sub rsp, 8
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
mov r15, qword [0x1400c6180]
add r15, qword [0x1400c6168]
add r15, 6
mov rax, r15
push rax
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
mov r15, qword [0x1400c6128]
add r15, 0x3f08
mov rax, r15
push rax
push qword [0x1400c5f48]
pop rcx
pop rdx
call fcn.14001e840
mov qword [0x1400c5ed0], rax
sub rsp, 8
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
mov r15, qword [0x1400c6180]
add r15, qword [0x1400c6168]
add r15, 0x22
mov rax, r15
push rax
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push qword [0x1400c61b8]
push qword [0x1400c5f48]
pop rcx
pop rdx
call fcn.14001e840
mov qword [0x1400c5ed0], rax
sub rsp, 8
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
mov r15, qword [0x1400c6180]
add r15, qword [0x1400c6168]
add r15, 0x13
mov rax, r15
push rax
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
mov qword [0x1400c6170], 1
mov qword [0x1400c6178], 0x40
sub rsp, 8
lea rax, [0x1400c6170]
mov rax, rax
push rax
push qword [0x1400c6178]
push 8
push qword [0x1400c61a8]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_VirtualProtectEx
add rsp, 0x30
mov qword [0x1400c5ed0], rax
mov qword [0x1400c6170], 1
mov qword [0x1400c6178], 0x40
sub rsp, 8
lea rax, [0x1400c6170]
mov rax, rax
push rax
push qword [0x1400c6178]
push 8
push qword [0x1400c61c8]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_VirtualProtectEx
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push qword [0x1400c61d0]
push qword [0x1400c5f48]
pop rcx
pop rdx
call fcn.14001e840
mov qword [0x1400c5ed0], rax
sub rsp, 8
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
push qword [0x1400c61c8]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push 0xe8
mov r15, qword [0x1400c5f48]
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x90
mov r15, qword [0x1400c5f48]
inc r15
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x90
mov r15, qword [0x1400c5f48]
add r15, 2
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x90
mov r15, qword [0x1400c5f48]
add r15, 3
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x90
mov r15, qword [0x1400c5f48]
add r15, 4
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x90
mov r15, qword [0x1400c5f48]
add r15, 5
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
push 0x90
mov r15, qword [0x1400c5f48]
add r15, 6
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
mov r15, qword [0x1400c6180]
add r15, qword [0x1400c6168]
add r15, 0x20
sub r15, qword [0x1400c61d8]
add r15, 0xfffffffffffffffb
mov rax, r15
push rax
mov r15, qword [0x1400c5f48]
inc r15
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14001e870
mov qword [0x1400c5ed0], rax
sub rsp, 8
push qword [0x1400c5f40]
push 7
push qword [0x1400c5f48]
push qword [0x1400c61d8]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
mov qword [0x1400c61f0], 0
mov rax, 0xff
cmp rax, qword [0x1400c61f0]
jl 0x140006588
push qword [0x1400c61f0]
pop rcx
call sub.USER32.DLL_GetAsyncKeyState
inc qword [0x1400c61f0]
jno 0x140006563
call sub.KERNEL32.dll_IsDebuggerPresent
and rax, rax
je 0x140006598
push 0x55009553
ret
push 0x32
pop rcx
call fcn.140014100
mov qword [0x1400c61f8], rax
mov r15, qword [0x1400c61f8]
cmp r15, 0x19
jne 0x14000668b
mov r15, qword [0x1400c5fa8]
cmp r15, qword [0x1400c5fb8]
jne 0x1400065e5
mov r15, qword [0x1400c5fa8]
and r15, r15
je 0x1400065e5
mov r15, qword [0x1400c5fb8]
and r15, r15
je 0x1400065e5
jmp 0x1400065ee
mov rax, 1
jmp 0x1400065f1
xor rax, rax
and rax, rax
je 0x14000668b
push 0xff
pop rcx
call fcn.140014100
mov qword [0x1400c6130], rax
push 0x190
pop rcx
call fcn.140014100
mov qword [0x1400c6138], rax
push qword [0x1400c6130]
push qword [0x1400c5f48]
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
sub rsp, 8
push qword [0x1400c5f40]
push 1
push qword [0x1400c5f48]
mov r15, qword [0x1400c6128]
add r15, qword [0x1400c6138]
add r15, 0x1091
mov rax, r15
push rax
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
call fcn.14000b516
sub rsp, 8
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
mov r15, qword [0x1400c6128]
add r15, 0x3f08
mov rax, r15
push rax
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push qword [0x1400c5f48]
pop rcx
call fcn.14001e880
mov qword [0x1400c6200], rax
mov r15, qword [0x1400c6200]
mov qword [0x1400c6208], r15
mov r15, qword [0x1400c6200]
add r15, 0x88
mov qword [0x1400c6210], r15
mov r15, qword [0x1400c6200]
add r15, 0x28
mov qword [0x1400c6218], r15
mov r15, qword [0x1400c6200]
add r15, 0x38
mov qword [0x1400c6220], r15
mov r15, qword [0x1400c6200]
add r15, 0x20
mov qword [0x1400c6228], r15
mov r15, qword [0x1400c6200]
add r15, 0x80
mov qword [0x1400c6230], r15
mov r15, qword [0x1400c6200]
add r15, 0xa8
mov qword [0x1400c6238], r15
sub rsp, 8
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
push qword [0x1400c6208]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push qword [0x1400c5f48]
pop rcx
call fcn.14001e880
mov r15, rax
add r15, 0x28
mov qword [0x1400c6208], r15
sub rsp, 8
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
push qword [0x1400c6210]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push qword [0x1400c5f48]
pop rcx
call fcn.14001e880
mov r15, rax
add r15, 0x28
mov qword [0x1400c6210], r15
sub rsp, 8
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
push qword [0x1400c6218]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push qword [0x1400c5f48]
pop rcx
call fcn.14001e880
mov r15, rax
add r15, 0x28
mov qword [0x1400c6218], r15
sub rsp, 8
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
push qword [0x1400c6220]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push qword [0x1400c5f48]
pop rcx
call fcn.14001e880
mov r15, rax
add r15, 0x28
mov qword [0x1400c6220], r15
sub rsp, 8
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
push qword [0x1400c6228]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push qword [0x1400c5f48]
pop rcx
call fcn.14001e880
mov r15, rax
add r15, 0x28
mov qword [0x1400c6228], r15
sub rsp, 8
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
push qword [0x1400c6230]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push qword [0x1400c5f48]
pop rcx
call fcn.14001e880
mov r15, rax
add r15, 0x28
mov qword [0x1400c6230], r15
sub rsp, 8
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
push qword [0x1400c6238]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push qword [0x1400c5f48]
pop rcx
call fcn.14001e880
mov r15, rax
add r15, 0x28
mov qword [0x1400c6238], r15
sub rsp, 8
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
push qword [0x1400c61e0]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push qword [0x1400c5f48]
pop rcx
call fcn.14001e880
mov r15, rax
add r15, 0x110
mov qword [0x1400c6200], r15
sub rsp, 8
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
push qword [0x1400c6200]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push qword [0x1400c5f48]
pop rcx
call fcn.14001e880
mov qword [0x1400c6200], rax
mov r15, qword [0x1400c6200]
add r15, 0x40
mov qword [0x1400c6240], r15
sub rsp, 8
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
push qword [0x1400c61e8]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push qword [0x1400c5f48]
pop rcx
call fcn.14001e880
mov r15, rax
add r15, 8
mov qword [0x1400c6200], r15
sub rsp, 8
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
push qword [0x1400c6200]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push qword [0x1400c5f48]
pop rcx
call fcn.14001e880
mov r15, rax
add r15, 0x318
mov qword [0x1400c6200], r15
sub rsp, 8
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
push qword [0x1400c6200]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push qword [0x1400c5f48]
pop rcx
call fcn.14001e880
mov r15, rax
add r15, 0x38
mov qword [0x1400c6200], r15
sub rsp, 8
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
push qword [0x1400c6200]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push qword [0x1400c5f48]
pop rcx
call fcn.14001e880
mov qword [0x1400c6200], rax
push qword [0x1400c5f48]
pop rcx
call fcn.14001e880
mov r15, rax
add r15, 0xc0
mov qword [0x1400c6248], r15
mov qword [0x1400c6250], 1
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ac0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ab0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6aa0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6a90]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.14000da68
mov qword [0x1400c6258], rax
mov r15, qword [0x1400c6258]
and r15, r15
je 0x1400071a5
push qword [0x1400c6260]
xor r15, r15
cmp r15, qword [rsp]
jne 0x140006f10
mov qword [0x1400c6260], 1
sub rsp, 8
push qword [0x1400c5f28]
pop rcx
sub rsp, 0x20
call fcn.14000ee39
add rsp, 0x28
sub rsp, 8
mov r15, qword [0x1400c6180]
add r15, qword [0x1400c6168]
mov rax, r15
push rax
push qword [0x1400c5f48]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001e840
add rsp, 0x28
mov qword [0x1400c5ed0], rax
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
push qword [0x1400c61a8]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x28
mov qword [0x1400c5ed0], rax
sub rsp, 8
push 0xa
pop rcx
sub rsp, 0x20
call fcn.140014038
add rsp, 0x28
sub rsp, 8
push qword [0x1400c5f28]
pop rcx
sub rsp, 0x20
call fcn.14000eda9
add rsp, 0x28
sub rsp, 8
push 0
pop rcx
sub rsp, 0x20
call fcn.140012ba0
add rsp, 0x28
sub rsp, 8
push 0x12c
pop rcx
sub rsp, 0x20
call fcn.140014038
add rsp, 0x28
sub rsp, 8
push qword [0x1400c5f28]
pop rcx
sub rsp, 0x20
call fcn.14000ee39
add rsp, 0x28
sub rsp, 8
push qword [0x1400c61a0]
push qword [0x1400c5f48]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001e840
add rsp, 0x28
mov qword [0x1400c5ed0], rax
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
push qword [0x1400c61a8]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x28
mov qword [0x1400c5ed0], rax
sub rsp, 8
push 0xa
pop rcx
sub rsp, 0x20
call fcn.140014038
add rsp, 0x28
sub rsp, 8
push qword [0x1400c5f28]
pop rcx
sub rsp, 0x20
call fcn.14000eda9
add rsp, 0x28
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
mov r15, qword [0x1400c6128]
add r15, 0x3f00
mov rax, r15
push rax
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadProcessMemory
add rsp, 0x28
mov qword [0x1400c5ed0], rax
sub rsp, 8
push qword [0x1400c5f48]
pop rcx
sub rsp, 0x20
call fcn.14001e880
add rsp, 0x28
mov qword [0x1400c6200], rax
mov rax, qword [0x1400c6200]
mov qword [0x1400c6268], rax
mov r15, qword [0x1400c6200]
add r15, 0xee
mov qword [0x1400c6270], r15
mov r15, qword [0x1400c6200]
add r15, 0xef
mov qword [0x1400c6278], r15
sub rsp, 8
push 1
push qword [0x1400c5f48]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001e7c0
add rsp, 0x28
mov qword [0x1400c5ed0], rax
push qword [0x1400c5f40]
push 1
push qword [0x1400c5f48]
push qword [0x1400c6270]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x28
mov qword [0x1400c5ed0], rax
jmp 0x1400071a4
mov r15, 1
cmp r15, qword [rsp]
jne 0x1400071a4
mov qword [0x1400c6260], 0
sub rsp, 8
push qword [0x1400c5f28]
pop rcx
sub rsp, 0x20
call fcn.14000ee39
add rsp, 0x28
sub rsp, 8
mov r15, qword [0x1400c6180]
add r15, qword [0x1400c6168]
mov rax, r15
push rax
push qword [0x1400c5f48]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001e840
add rsp, 0x28
mov qword [0x1400c5ed0], rax
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
push qword [0x1400c61a8]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x28
mov qword [0x1400c5ed0], rax
sub rsp, 8
push 0xa
pop rcx
sub rsp, 0x20
call fcn.140014038
add rsp, 0x28
sub rsp, 8
push qword [0x1400c5f28]
pop rcx
sub rsp, 0x20
call fcn.14000eda9
add rsp, 0x28
sub rsp, 8
push 1
pop rcx
sub rsp, 0x20
call fcn.140012ba0
add rsp, 0x28
sub rsp, 8
push 0x12c
pop rcx
sub rsp, 0x20
call fcn.140014038
add rsp, 0x28
sub rsp, 8
push qword [0x1400c5f28]
pop rcx
sub rsp, 0x20
call fcn.14000ee39
add rsp, 0x28
sub rsp, 8
push qword [0x1400c61a0]
push qword [0x1400c5f48]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001e840
add rsp, 0x28
mov qword [0x1400c5ed0], rax
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
push qword [0x1400c61a8]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x28
mov qword [0x1400c5ed0], rax
sub rsp, 8
push 0xa
pop rcx
sub rsp, 0x20
call fcn.140014038
add rsp, 0x28
sub rsp, 8
push qword [0x1400c5f28]
pop rcx
sub rsp, 0x20
call fcn.14000eda9
add rsp, 0x28
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
mov r15, qword [0x1400c6128]
add r15, 0x3f00
mov rax, r15
push rax
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadProcessMemory
add rsp, 0x28
mov qword [0x1400c5ed0], rax
sub rsp, 8
push qword [0x1400c5f48]
pop rcx
sub rsp, 0x20
call fcn.14001e880
add rsp, 0x28
mov qword [0x1400c6200], rax
mov rax, qword [0x1400c6200]
mov qword [0x1400c6268], rax
mov r15, qword [0x1400c6200]
add r15, 0xee
mov qword [0x1400c6270], r15
mov r15, qword [0x1400c6200]
add r15, 0xef
mov qword [0x1400c6278], r15
sub rsp, 8
push 0
push qword [0x1400c5f48]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001e7c0
add rsp, 0x28
mov qword [0x1400c5ed0], rax
push qword [0x1400c5f40]
push 1
push qword [0x1400c5f48]
push qword [0x1400c6270]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x28
mov qword [0x1400c5ed0], rax
pop rax
mov qword [0x1400c6250], 2
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ac0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ab0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6aa0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6a90]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.14000da68
mov qword [0x1400c6280], rax
mov r15, qword [0x1400c6280]
and r15, r15
je 0x14000776a
push qword [0x1400c6288]
xor r15, r15
cmp r15, qword [rsp]
jne 0x1400074d5
mov qword [0x1400c6288], 1
sub rsp, 8
push qword [0x1400c5f28]
pop rcx
sub rsp, 0x20
call fcn.14000ee39
add rsp, 0x28
sub rsp, 8
mov r15, qword [0x1400c6180]
add r15, qword [0x1400c6168]
mov rax, r15
push rax
push qword [0x1400c5f48]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001e840
add rsp, 0x28
mov qword [0x1400c5ed0], rax
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
push qword [0x1400c61a8]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x28
mov qword [0x1400c5ed0], rax
sub rsp, 8
push 0xa
pop rcx
sub rsp, 0x20
call fcn.140014038
add rsp, 0x28
sub rsp, 8
push qword [0x1400c5f28]
pop rcx
sub rsp, 0x20
call fcn.14000eda9
add rsp, 0x28
sub rsp, 8
push 0
pop rcx
sub rsp, 0x20
call fcn.140012ba0
add rsp, 0x28
sub rsp, 8
push 0x12c
pop rcx
sub rsp, 0x20
call fcn.140014038
add rsp, 0x28
sub rsp, 8
push qword [0x1400c5f28]
pop rcx
sub rsp, 0x20
call fcn.14000ee39
add rsp, 0x28
sub rsp, 8
push qword [0x1400c61a0]
push qword [0x1400c5f48]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001e840
add rsp, 0x28
mov qword [0x1400c5ed0], rax
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
push qword [0x1400c61a8]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x28
mov qword [0x1400c5ed0], rax
sub rsp, 8
push 0xa
pop rcx
sub rsp, 0x20
call fcn.140014038
add rsp, 0x28
sub rsp, 8
push qword [0x1400c5f28]
pop rcx
sub rsp, 0x20
call fcn.14000eda9
add rsp, 0x28
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
mov r15, qword [0x1400c6128]
add r15, 0x3f00
mov rax, r15
push rax
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadProcessMemory
add rsp, 0x28
mov qword [0x1400c5ed0], rax
sub rsp, 8
push qword [0x1400c5f48]
pop rcx
sub rsp, 0x20
call fcn.14001e880
add rsp, 0x28
mov qword [0x1400c6200], rax
mov rax, qword [0x1400c6200]
mov qword [0x1400c6268], rax
mov r15, qword [0x1400c6200]
add r15, 0xee
mov qword [0x1400c6270], r15
mov r15, qword [0x1400c6200]
add r15, 0xef
mov qword [0x1400c6278], r15
sub rsp, 8
push 1
push qword [0x1400c5f48]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001e7c0
add rsp, 0x28
mov qword [0x1400c5ed0], rax
push qword [0x1400c5f40]
push 1
push qword [0x1400c5f48]
push qword [0x1400c6278]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x28
mov qword [0x1400c5ed0], rax
jmp 0x140007769
mov r15, 1
cmp r15, qword [rsp]
jne 0x140007769
mov qword [0x1400c6288], 0
sub rsp, 8
push qword [0x1400c5f28]
pop rcx
sub rsp, 0x20
call fcn.14000ee39
add rsp, 0x28
sub rsp, 8
mov r15, qword [0x1400c6180]
add r15, qword [0x1400c6168]
mov rax, r15
push rax
push qword [0x1400c5f48]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001e840
add rsp, 0x28
mov qword [0x1400c5ed0], rax
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
push qword [0x1400c61a8]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x28
mov qword [0x1400c5ed0], rax
sub rsp, 8
push 0xa
pop rcx
sub rsp, 0x20
call fcn.140014038
add rsp, 0x28
sub rsp, 8
push qword [0x1400c5f28]
pop rcx
sub rsp, 0x20
call fcn.14000eda9
add rsp, 0x28
sub rsp, 8
push 1
pop rcx
sub rsp, 0x20
call fcn.140012ba0
add rsp, 0x28
sub rsp, 8
push 0x12c
pop rcx
sub rsp, 0x20
call fcn.140014038
add rsp, 0x28
sub rsp, 8
push qword [0x1400c5f28]
pop rcx
sub rsp, 0x20
call fcn.14000ee39
add rsp, 0x28
sub rsp, 8
push qword [0x1400c61a0]
push qword [0x1400c5f48]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001e840
add rsp, 0x28
mov qword [0x1400c5ed0], rax
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
push qword [0x1400c61a8]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x28
mov qword [0x1400c5ed0], rax
sub rsp, 8
push 0xa
pop rcx
sub rsp, 0x20
call fcn.140014038
add rsp, 0x28
sub rsp, 8
push qword [0x1400c5f28]
pop rcx
sub rsp, 0x20
call fcn.14000eda9
add rsp, 0x28
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
mov r15, qword [0x1400c6128]
add r15, 0x3f00
mov rax, r15
push rax
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadProcessMemory
add rsp, 0x28
mov qword [0x1400c5ed0], rax
sub rsp, 8
push qword [0x1400c5f48]
pop rcx
sub rsp, 0x20
call fcn.14001e880
add rsp, 0x28
mov qword [0x1400c6200], rax
mov rax, qword [0x1400c6200]
mov qword [0x1400c6268], rax
mov r15, qword [0x1400c6200]
add r15, 0xee
mov qword [0x1400c6270], r15
mov r15, qword [0x1400c6200]
add r15, 0xef
mov qword [0x1400c6278], r15
sub rsp, 8
push 0
push qword [0x1400c5f48]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001e7c0
add rsp, 0x28
mov qword [0x1400c5ed0], rax
push qword [0x1400c5f40]
push 1
push qword [0x1400c5f48]
push qword [0x1400c6278]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x28
mov qword [0x1400c5ed0], rax
pop rax
mov qword [0x1400c6250], 3
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ac0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ab0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6aa0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6a90]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.14000da68
mov qword [0x1400c6290], rax
mov r15, qword [0x1400c6290]
and r15, r15
je 0x140007b25
push qword [0x1400c5f28]
pop rcx
call fcn.14000ee39
mov r15, qword [0x1400c6180]
add r15, qword [0x1400c6168]
mov rax, r15
push rax
push qword [0x1400c5f48]
pop rcx
pop rdx
call fcn.14001e840
mov qword [0x1400c5ed0], rax
sub rsp, 8
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
push qword [0x1400c61a8]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push 0xa
pop rcx
call fcn.140014038
push qword [0x1400c5f28]
pop rcx
call fcn.14000eda9
push 0
pop rcx
call fcn.140012ba0
push 0x12c
pop rcx
call fcn.140014038
push qword [0x1400c5f28]
pop rcx
call fcn.14000ee39
push qword [0x1400c61a0]
push qword [0x1400c5f48]
pop rcx
pop rdx
call fcn.14001e840
mov qword [0x1400c5ed0], rax
sub rsp, 8
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
push qword [0x1400c61a8]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push 0xa
pop rcx
call fcn.140014038
push qword [0x1400c5f28]
pop rcx
call fcn.14000eda9
sub rsp, 8
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
mov r15, qword [0x1400c6128]
add r15, 0x3f00
mov rax, r15
push rax
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push qword [0x1400c5f48]
pop rcx
call fcn.14001e880
mov qword [0x1400c6200], rax
mov rax, qword [0x1400c6200]
mov qword [0x1400c6268], rax
mov r15, qword [0x1400c6200]
add r15, 0xf0
mov qword [0x1400c6298], r15
sub rsp, 8
push qword [0x1400c5f40]
push 8
push qword [0x1400c5f48]
push qword [0x1400c6298]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push qword [0x1400c5f48]
pop rcx
call fcn.14001e880
mov r15, rax
add r15, 0x18
mov qword [0x1400c6298], r15
mov r15, qword [0x1400c6200]
add r15, 0xee
mov qword [0x1400c6270], r15
mov r15, qword [0x1400c6200]
add r15, qword [0x1400c62a0]
mov qword [0x1400c6278], r15
sub rsp, 8
push qword [0x1400c5f40]
push 4
push qword [0x1400c5f48]
mov r15, qword [0x1400c6268]
add r15, 0x228
mov rax, r15
push rax
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push qword [0x1400c5f48]
pop rcx
call fcn.14001e890
mov qword [0x1400c62a8], rax
mov r15, qword [0x1400c62a8]
dec r15
mov rax, r15
push rax
push qword [0x1400c5f48]
pop rcx
pop rdx
call fcn.14001e870
mov qword [0x1400c5ed0], rax
sub rsp, 8
push qword [0x1400c5f40]
push 4
push qword [0x1400c5f48]
mov r15, qword [0x1400c6268]
add r15, 0x224
mov rax, r15
push rax
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push qword [0x1400c62a8]
push qword [0x1400c5f48]
pop rcx
pop rdx
call fcn.14001e8a0
mov qword [0x1400c5ed0], rax
sub rsp, 8
push qword [0x1400c5f40]
push 2
push qword [0x1400c5f48]
push qword [0x1400c6298]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
mov qword [0x1400c6250], 4
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ac0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ab0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6aa0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6a90]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.14000da68
mov qword [0x1400c62b0], rax
mov r15, qword [0x1400c62b0]
and r15, r15
je 0x140007c7e
sub rsp, 8
push qword [0x1400c5f40]
push 4
push qword [0x1400c5f48]
push qword [0x1400c6208]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push qword [0x1400c5f48]
pop rcx
call fcn.14001e890
mov qword [0x1400c62a8], rax
add qword [0x1400c62a8], 0x186a0
push qword [0x1400c62a8]
push qword [0x1400c5f48]
pop rcx
pop rdx
call fcn.14001e870
mov qword [0x1400c5ed0], rax
sub rsp, 8
push qword [0x1400c5f40]
push 4
push qword [0x1400c5f48]
push qword [0x1400c6208]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push 0
pop rcx
call fcn.140012ba0
push 0x12c
pop rcx
call fcn.140014038
mov qword [0x1400c6250], 5
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ac0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ab0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6aa0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6a90]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.14000da68
mov qword [0x1400c62b8], rax
mov r15, qword [0x1400c62b8]
and r15, r15
je 0x140007d79
push 0x63
push qword [0x1400c5f48]
pop rcx
pop rdx
call fcn.14001e870
mov qword [0x1400c5ed0], rax
sub rsp, 8
push qword [0x1400c5f40]
push 4
push qword [0x1400c5f48]
push qword [0x1400c6210]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push 0
pop rcx
call fcn.140012ba0
push 0x12c
pop rcx
call fcn.140014038
mov qword [0x1400c6250], 6
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ac0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ab0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6aa0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6a90]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.14000da68
mov qword [0x1400c62c0], rax
mov r15, qword [0x1400c62c0]
and r15, r15
je 0x140007eb3
push 0x63
push qword [0x1400c5f48]
pop rcx
pop rdx
call fcn.14001e870
mov qword [0x1400c5ed0], rax
sub rsp, 8
push qword [0x1400c5f40]
push 4
push qword [0x1400c5f48]
push qword [0x1400c6218]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
sub rsp, 8
push qword [0x1400c5f40]
push 4
push qword [0x1400c5f48]
push qword [0x1400c6220]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push 0
pop rcx
call fcn.140012ba0
push 0x12c
pop rcx
call fcn.140014038
mov qword [0x1400c6250], 7
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ac0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ab0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6aa0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6a90]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.14000da68
mov qword [0x1400c62c8], rax
mov r15, qword [0x1400c62c8]
and r15, r15
je 0x140007fae
push 0x63
push qword [0x1400c5f48]
pop rcx
pop rdx
call fcn.14001e870
mov qword [0x1400c5ed0], rax
sub rsp, 8
push qword [0x1400c5f40]
push 4
push qword [0x1400c5f48]
push qword [0x1400c6228]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push 0
pop rcx
call fcn.140012ba0
push 0x12c
pop rcx
call fcn.140014038
mov qword [0x1400c6250], 8
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ac0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ab0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6aa0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6a90]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.14000da68
mov qword [0x1400c62d0], rax
mov r15, qword [0x1400c62d0]
and r15, r15
je 0x1400080a9
push 0xf4240
push qword [0x1400c5f48]
pop rcx
pop rdx
call fcn.14001e870
mov qword [0x1400c5ed0], rax
sub rsp, 8
push qword [0x1400c5f40]
push 4
push qword [0x1400c5f48]
push qword [0x1400c6238]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push 0
pop rcx
call fcn.140012ba0
push 0x12c
pop rcx
call fcn.140014038
mov qword [0x1400c6250], 9
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ac0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ab0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6aa0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6a90]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.14000da68
mov qword [0x1400c62d8], rax
mov r15, qword [0x1400c62d8]
and r15, r15
je 0x1400081a4
push 0x63
push qword [0x1400c5f48]
pop rcx
pop rdx
call fcn.14001e870
mov qword [0x1400c5ed0], rax
sub rsp, 8
push qword [0x1400c5f40]
push 4
push qword [0x1400c5f48]
push qword [0x1400c6230]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push 0
pop rcx
call fcn.140012ba0
push 0x12c
pop rcx
call fcn.140014038
mov qword [0x1400c6250], 0xa
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ac0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ab0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6aa0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6a90]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.14000da68
mov qword [0x1400c62e0], rax
mov r15, qword [0x1400c62e0]
and r15, r15
je 0x14000829f
push 0x1f4
push qword [0x1400c5f48]
pop rcx
pop rdx
call fcn.14001e870
mov qword [0x1400c5ed0], rax
sub rsp, 8
push qword [0x1400c5f40]
push 4
push qword [0x1400c5f48]
push qword [0x1400c6240]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push 0
pop rcx
call fcn.140012ba0
push 0x12c
pop rcx
call fcn.140014038
mov qword [0x1400c6250], 0xb
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ac0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ab0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6aa0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6a90]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.14000da68
mov qword [0x1400c62e8], rax
mov r15, qword [0x1400c62e8]
and r15, r15
je 0x140008414
push 0
push qword [0x1400c5f48]
pop rcx
pop rdx
call fcn.14001e870
mov qword [0x1400c5ed0], rax
sub rsp, 8
push qword [0x1400c5f40]
push 4
push qword [0x1400c5f48]
push qword [0x1400c6238]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
sub rsp, 8
push qword [0x1400c5f40]
push 4
push qword [0x1400c5f48]
push qword [0x1400c6240]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
sub rsp, 8
push qword [0x1400c5f40]
push 4
push qword [0x1400c5f48]
push qword [0x1400c6208]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push 0
pop rcx
call fcn.140012ba0
push 0x12c
pop rcx
call fcn.140014038
mov qword [0x1400c6250], 0xc
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ac0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ab0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6aa0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6a90]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.14000da68
mov qword [0x1400c62f0], rax
mov r15, qword [0x1400c62f0]
and r15, r15
je 0x14000850f
push 0
push qword [0x1400c5f48]
pop rcx
pop rdx
call fcn.14001e7c0
mov qword [0x1400c5ed0], rax
sub rsp, 8
push qword [0x1400c5f40]
push 1
push qword [0x1400c5f48]
push qword [0x1400c6248]
push qword [0x1400c6148]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x30
mov qword [0x1400c5ed0], rax
push 0
pop rcx
call fcn.140012ba0
push 0x12c
pop rcx
call fcn.140014038
mov qword [0x1400c6250], 0xd
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ac0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ab0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6aa0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6a90]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.14000da68
mov qword [0x1400c62f8], rax
mov r15, qword [0x1400c62f8]
and r15, r15
je 0x1400085a0
mov qword [0x1400c6250], 0xe
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ac0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ab0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6aa0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6a90]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.14000da68
mov qword [0x1400c6300], rax
mov r15, qword [0x1400c6300]
and r15, r15
je 0x140008631
mov qword [0x1400c6250], 0xf
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ac0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ab0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6aa0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6a90]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.14000da68
mov qword [0x1400c6308], rax
mov r15, qword [0x1400c6308]
and r15, r15
je 0x1400086c2
mov qword [0x1400c6250], 0x10
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ac0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ab0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6aa0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6a90]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.14000da68
mov qword [0x1400c6310], rax
mov r15, qword [0x1400c6310]
and r15, r15
je 0x140008753
mov qword [0x1400c6250], 0x11
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ac0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ab0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6aa0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6a90]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.14000da68
mov qword [0x1400c6318], rax
mov r15, qword [0x1400c6318]
and r15, r15
je 0x1400087e4
mov qword [0x1400c6250], 0x12
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ac0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ab0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6aa0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6a90]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.14000da68
mov qword [0x1400c6320], rax
mov r15, qword [0x1400c6320]
and r15, r15
je 0x140008875
mov qword [0x1400c6250], 0x13
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ac0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ab0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6aa0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6a90]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.14000da68
mov qword [0x1400c6328], rax
mov r15, qword [0x1400c6328]
and r15, r15
je 0x140008906
mov qword [0x1400c6250], 0x14
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ac0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6ab0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6aa0]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
mov r15, qword [0x1400c6250]
mov rbp, qword [0x1400c6a90]
shl r15, 3
mov rax, qword [r15 + rbp]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.14000da68
mov qword [0x1400c6330], rax
mov r15, qword [0x1400c6330]
and r15, r15
je 0x140008997
mov qword [0x1400c6258], 0
mov qword [0x1400c6280], 0
mov qword [0x1400c6290], 0
mov qword [0x1400c62b0], 0
mov qword [0x1400c62b8], 0
mov qword [0x1400c62c0], 0
mov qword [0x1400c62c8], 0
mov qword [0x1400c62d0], 0
mov qword [0x1400c62d8], 0
mov qword [0x1400c62e0], 0
mov qword [0x1400c62e8], 0
mov qword [0x1400c62f0], 0
mov qword [0x1400c62f8], 0
mov qword [0x1400c6300], 0
mov qword [0x1400c6308], 0
mov qword [0x1400c6310], 0
mov qword [0x1400c6318], 0
mov qword [0x1400c6320], 0
mov qword [0x1400c6328], 0
mov qword [0x1400c6330], 0
mov r15, qword [0x1400c5ff8]
cmp r15, 0x45a2a5
je 0x140008a94
push 0
push 3
pop rcx
pop rdx
call fcn.140017a50
call fcn.14000a288
push 1
pop rcx
call fcn.140014038
mov r15, qword [0x1400c5fa8]
cmp r15, qword [0x1400c5fb8]
jne 0x140008ace
mov r15, qword [0x1400c5fa8]
and r15, r15
je 0x140008ace
mov r15, qword [0x1400c5fb8]
and r15, r15
je 0x140008ace
jmp 0x140008ad7
mov rax, 1
jmp 0x140008ada
xor rax, rax
and rax, rax
je 0x140008b45
push 0xa
pop rcx
call fcn.140014100
mov r15, rax
add r15, 0xa
mov qword [0x1400c6130], r15
push 0x28
pop rcx
call fcn.140014100
mov r15, rax
add r15, 0x28
mov qword [0x1400c6138], r15
mov r15, qword [0x1400c6098]
add r15, qword [0x1400c6130]
mov qword [0x1400c6098], r15
mov r15, qword [0x1400c6128]
add r15, qword [0x1400c6138]
mov qword [0x1400c6128], r15
call fcn.14000b516
jmp 0x1400056a6
jmp 0x140006558
call 0x14000ce76
call fcn.14001f480
mov rcx, qword [0x1400c5ea8]
call sub.KERNEL32.dll_HeapDestroy
mov rcx, qword [0x1400c5eb8]
call sub.KERNEL32.dll_ExitProcess
sub rsp, 0x28
call fcn.140012d0c
call fcn.1400144c0
call fcn.140016300
call fcn.140017fc8
call fcn.14001a470
call fcn.14001a7a4
call fcn.14001a9f0
call fcn.14001bf74
call fcn.14001cfb8
call fcn.14001e780
add rsp, 0x28
ret