Function at 0x140037510
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2ce0]
mov eax, 0x2de0
call fcn.140039fc0
sub rsp, rax
movaps xmmword [rsp + 0x2dd0], xmm6
movaps xmmword [rsp + 0x2dc0], xmm7
movaps xmmword [rsp + 0x2db0], xmm8
movaps xmmword [rsp + 0x2da0], xmm9
movaps xmmword [rsp + 0x2d90], xmm10
movaps xmmword [rsp + 0x2d80], xmm11
movaps xmmword [rsp + 0x2d70], xmm12
movaps xmmword [rsp + 0x2d60], xmm13
movaps xmmword [rsp + 0x2d50], xmm14
movaps xmmword [rsp + 0x2d40], xmm15
mov rax, qword [0x140049010]
xor rax, rsp
mov qword [rbp + 0x2c38], rax
xor r14d, r14d
mov rsi, qword [0x1400497d8]
test rsi, rsi
jne 0x1400375fc
lea ecx, [rsi + 0x38]
call fcn.14003956c
mov rsi, rax
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov qword [rax], r14
mov qword [rax + 8], r14
mov dword [rax + 0x10], 0xffffffff
mov qword [rax + 0x18], 0xffffffffffffffff
mov qword [rax + 0x20], r14
mov qword [rax + 0x28], r14
mov qword [rax + 0x30], r14
mov qword [0x1400497d8], rax
lea rdi, str.DayZ_x64.exe
mov qword [rbp + 0x29d0], rdi
mov qword [rbp + 0x29d8], 0xc
xor edx, edx
mov r8d, 0x12c
lea rcx, [rbp + 0x2a34]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x2a30], 0x130
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140037660
lea rdx, [rbp + 0x2a30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400376b6
nop dword [rax + rax]
lea rcx, [rbp + 0x2a5c]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], r14b
jne 0x140037670
cmp rax, 0xc
jne 0x140037699
mov r8, rax
lea rdx, [rbp + 0x2a5c]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140037a07
lea rdx, [rbp + 0x2a30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140037660
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x29d0], rdi
mov qword [rbp + 0x29d8], 0xc
movaps xmm0, xmmword [rbp + 0x29d0]
movdqa xmmword [rbp + 0x2a20], xmm0
lea rdx, [rbp + 0x2a20]
mov rcx, rsi
call fcn.140038f70
mov r13, rax
mov byte [0x140049828], 1
mov byte [0x140049818], r14b
mov dword [0x140049760], 0x50
mov dword [0x140049764], 0x40
lea rax, [0x1400361b0]
mov qword [0x140049768], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [0x140049778], rax
lea rax, str.carlgwastaken
mov qword [0x1400497a0], rax
lea rcx, [0x140049760]
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov rdi, qword [0x140049778]
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov r9d, 0x80000000
lea r8, str.cheat
mov rdx, qword [0x1400497a0]
mov ecx, 0x800a8
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x1400497c8], rax
test rax, rax
jne 0x1400377c3
lea rcx, str.Failed_to_create_Overlay_n
call fcn.1400010f0
mov rax, qword [0x1400497c8]
mov r9d, 2
mov r8b, 0xff
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
xorps xmm0, xmm0
movups xmmword [rbp + 0x2a00], xmm0
xorps xmm1, xmm1
movups xmmword [rbp + 0x2a20], xmm1
lea rdx, [rbp + 0x2a00]
mov rcx, qword [0x1400497c8]
call qword [sym.imp.USER32.dll_GetClientRect]
lea rdx, [rbp + 0x2a20]
mov rcx, qword [0x1400497c8]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov qword [rbp + 0x29b8], r14
lea rdx, [rbp + 0x29b8]
mov rcx, qword [0x1400497c8]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [rbp + 0x29b8]
mov dword [rbp + 0x29d0], eax
mov eax, dword [rbp + 0x29bc]
mov dword [rbp + 0x29d4], eax
mov eax, dword [rbp + 0x2a08]
mov dword [rbp + 0x29d8], eax
mov eax, dword [rbp + 0x2a0c]
mov dword [rbp + 0x29dc], eax
lea rdx, [rbp + 0x29d0]
mov rcx, qword [0x1400497c8]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov edx, 5
mov rcx, qword [0x1400497c8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1400497c8]
call qword [sym.imp.USER32.dll_UpdateWindow]
lea rcx, str._____Overlay_Created_n
call fcn.1400010f0
mov qword [rbp + 0x2974], r14
mov qword [rbp + 0x2988], 2
mov qword [rbp + 0x29a0], 2
mov qword [rbp + 0x2960], r14
mov dword [rbp + 0x2970], 0x1c
mov dword [rbp + 0x2968], 0x3c
mov dword [rbp + 0x296c], 1
mov dword [rbp + 0x2984], 0x20
mov rax, qword [0x1400497c8]
mov qword [rbp + 0x2990], rax
mov qword [rbp + 0x297c], 1
mov qword [rbp + 0x2998], 1
mov dword [rbp + 0x2c30], 0xb000
mov dword [rbp + 0x2c34], 0xa000
lea rdi, [0x1400497c0]
mov qword [rsp + 0x58], rdi
lea rax, [rbp + 0x29b8]
mov qword [rsp + 0x50], rax
lea r15, [0x1400497b0]
mov qword [rsp + 0x48], r15
lea r12, [0x1400497b8]
mov qword [rsp + 0x40], r12
lea rax, [rbp + 0x2960]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 2
lea rax, [rbp + 0x2c30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.d3d11.dll_D3D11CreateDeviceAndSwapChain]
mov ebx, eax
cmp eax, 0x887a0004
jne 0x1400379f7
mov qword [rsp + 0x58], rdi
lea rax, [rbp + 0x29b8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r12
lea rax, [rbp + 0x2960]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 2
lea rax, [rbp + 0x2c30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 5]
xor ecx, ecx
call qword [sym.imp.d3d11.dll_D3D11CreateDeviceAndSwapChain]
mov ebx, eax
lea rcx, str._____DXGI_ERROR__Created_with_D3D_DRIVER_TYPE_WARP_n
call fcn.1400010f0
test ebx, ebx
je 0x140037a54
lea rcx, str.Device_Not_Okay_n
jmp 0x140037ab8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp + 0x2a38]
cmp ebx, 0xffffffff
je 0x1400376b6
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x140037a2e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movups xmm0, xmmword [rbp + 0x29d0]
movups xmmword [rsi], xmm0
mov dword [rsi + 0x10], ebx
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsi + 0x18], rax
jmp 0x1400376b6
mov qword [rbp + 0x2950], r14
mov rcx, qword [0x1400497b8]
mov rax, qword [rcx]
lea r9, [rbp + 0x2950]
lea r8, [0x140041da0]
xor edx, edx
call qword [rax + 0x48]
mov rdx, qword [rbp + 0x2950]
test rdx, rdx
je 0x140037ab1
mov rcx, qword [0x1400497b0]
mov rax, qword [rcx]
lea r9, [0x1400497d0]
xor r8d, r8d
call qword [rax + 0x48]
mov rcx, qword [rbp + 0x2950]
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rcx, str._____Created_Device_n
jmp 0x140037ab8
lea rcx, str._____Failed_to_create_Device_n
call fcn.1400010f0
mov rbx, qword [0x140049750]
mov rdx, qword [0x140049740]
mov ecx, 0x6280
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov r9, rax
mov r8, qword [0x140049750]
test r8, r8
je 0x140037b44
mov r10d, dword [r8 + 0x3f58]
movsx rax, word [r8 + 0x60f0]
lea rdx, [r8 + 0x60f4]
lea rdx, [rdx + rax*8]
cmp dword [rdx], r10d
je 0x140037b39
lea ecx, [rax + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x60f0], cx
movsx rax, cx
lea rdx, [r8 + 0x60f4]
lea rdx, [rdx + rax*8]
mov dword [rdx], r10d
mov dword [rdx + 4], r14d
inc word [rdx + 4]
inc dword [r8 + 0x60e8]
mov qword [rsp + 0x68], r9
lea rax, [rsp + 0x60]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x70], r9
test r9, r9
je 0x140037b69
xor edx, edx
mov rcx, r9
call fcn.140001240
jmp 0x140037b6c
mov rax, r14
mov qword [0x140049750], rax
call fcn.140004950
mov rax, qword [0x140049750]
test rbx, rbx
cmovne rax, rbx
mov qword [0x140049750], rax
xor ecx, ecx
call fcn.1400215a0
mov rcx, qword [0x1400497c8]
call fcn.14002aa50
test al, al
jne 0x140037bad
lea rcx, str.Failed_ImGui_ImplWin32_Init_n
jmp 0x140037bc6
call fcn.14002a880
lea rcx, str.Failed_ImGui_ImplDX11_Init_n
lea rdx, str._____ImGui_Initialized_n
test al, al
cmovne rcx, rdx
call fcn.1400010f0
lea rcx, str._____Hit_NUM0_to_show_the_menu_in_this_overlay__n
call fcn.1400010f0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, rbx
je 0x140037bf4
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
cmp byte [0x140049828], 0
je 0x140038e85
movabs r15, 0x311cdad160000
xorps xmm15, xmm15
movss xmm11, dword [0x140041e5c]
movss xmm14, dword [0x140041e34]
movss xmm10, dword [0x140041e94]
movss xmm12, dword [0x140041ebc]
movss xmm13, dword [0x140041e58]
movsd xmm9, qword [0x140041eb0]
movsd xmm6, qword [0x140041f18]
movabs r12, 0x112e0be826d694b3
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140037c75
imul rdi, rax, 0x64
jmp 0x140037c90
cqo
idiv rbx
imul rdi, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rdi, rax
movabs rax, 0x7ffffffffff0bdbf
cmp rdi, rax
jge 0x140037ca8
add rdi, 0xf4240
jmp 0x140037cb2
movabs rdi, 0x7fffffffffffffff
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140037cd0
imul rax, rax, 0x64
jmp 0x140037ceb
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rdi, rax
je 0x140037d53
jl 0x140037d53
mov rbx, rdi
sub rbx, rax
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
imul rcx, rax, 0x64
xorps xmm0, xmm0
cvtsi2sd xmm0, rbx
comisd xmm0, xmm6
jbe 0x140037d15
add rcx, r15
jmp 0x140037d18
add rcx, rbx
mov rax, r12
imul rcx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rbp + 0x2b60], rdx
imul eax, edx, 0x3b9aca00
sub ecx, eax
mov dword [rbp + 0x2b68], ecx
lea rcx, [rbp + 0x2b60]
call qword [sym.imp.MSVCP140.dll__Thrd_sleep]
jmp 0x140037cb2
call fcn.140036420
cmp byte [0x140049818], 0
je 0x140037d6b
call fcn.1400366b0
jmp 0x140037e18
mov rax, qword [0x140049750]
mov rax, qword [rax + 0x4b10]
lea r8, str.Background
xor edx, edx
mov rcx, qword [rax]
call fcn.140006180
mov r8, rax
movaps xmm0, xmmword [0x140042270]
movups xmmword [rbp + 0x2c20], xmm0
lea rcx, [rbp + 0x2c20]
call fcn.140003250
mov qword [rbp + 0x2950], 0
test eax, 0xff000000
je 0x140037e18
mov rdx, qword [r8 + 0x38]
mov rcx, qword [rdx + 8]
movups xmm0, xmmword [r8 + 0x88]
movups xmmword [rbp + 0x2c20], xmm0
mov byte [rsp + 0x48], 0
movss dword [rsp + 0x40], xmm15
lea r9, [0x140041e0b]
mov qword [rsp + 0x38], r9
lea r9, str.Z3N1TH_R3L04D3D___Press_NUM0_to_use
mov qword [rsp + 0x30], r9
lea r9, [rbp + 0x2c20]
mov qword [rsp + 0x28], r9
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x2950]
movss xmm2, dword [rdx + 0x10]
mov rdx, r8
call fcn.1400281c0
cmp byte [0x14004974e], 1
jne 0x140037fae
mov rax, qword [0x140049750]
movss xmm9, dword [rax + 0x10]
movss xmm8, dword [rax + 0x14]
mulss xmm9, xmm11
mulss xmm8, xmm11
mov rax, qword [rax + 0x4b10]
lea r8, str.Foreground
mov edx, 1
mov rcx, qword [rax]
call fcn.140006180
mov rdi, rax
movaps xmm7, xmm9
addss xmm7, dword [0x140041ef0]
movaps xmm0, xmm9
subss xmm0, dword [0x140041ef0]
movaps xmm6, xmm8
addss xmm6, xmm11
addss xmm0, xmm11
movss dword [rbp + 0x2c30], xmm0
movss dword [rbp + 0x2c34], xmm6
lea rdx, [rbp + 0x2c30]
lea rcx, [rax + 0x78]
call fcn.140019d90
addss xmm7, xmm11
movss dword [rbp + 0x29b8], xmm7
movss dword [rbp + 0x29bc], xmm6
lea rdx, [rbp + 0x29b8]
lea rcx, [rdi + 0x78]
call fcn.140019d90
movss xmm0, dword [0x140041e40]
movss dword [rsp + 0x28], xmm0
mov dword [rsp + 0x20], r14d
mov r9d, 0xdc14ff39
mov r8d, dword [rdi + 0x78]
mov rdx, qword [rdi + 0x80]
mov rcx, rdi
call fcn.1400223f0
mov dword [rdi + 0x78], r14d
mov rax, qword [0x140049750]
mov rax, qword [rax + 0x4b10]
lea r8, str.Foreground
mov edx, 1
mov rcx, qword [rax]
call fcn.140006180
mov rdi, rax
movaps xmm6, xmm8
addss xmm6, dword [0x140041ef0]
subss xmm8, dword [0x140041ef0]
addss xmm8, xmm11
addss xmm9, xmm11
movss dword [rbp - 0x80], xmm9
movss dword [rbp - 0x7c], xmm8
lea rdx, [rbp - 0x80]
lea rcx, [rax + 0x78]
call fcn.140019d90
addss xmm6, xmm11
movss dword [rbp - 0x78], xmm9
movss dword [rbp - 0x74], xmm6
lea rdx, [rbp - 0x78]
lea rcx, [rdi + 0x78]
call fcn.140019d90
movss xmm0, dword [0x140041e40]
movss dword [rsp + 0x28], xmm0
mov dword [rsp + 0x20], r14d
mov r9d, 0xdc14ff39
mov r8d, dword [rdi + 0x78]
mov rdx, qword [rdi + 0x80]
mov rcx, rdi
call fcn.1400223f0
mov dword [rdi + 0x78], r14d
movsd xmm9, qword [0x140041eb0]
xor ebx, ebx
cmp byte [0x14004974a], bl
je 0x140038aa0
mov qword [rbp + 0x29c0], rbx
lea rdx, [r13 + 0x414cf70]
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 8]
lea r8, [rbp + 0x29c0]
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r8, qword [rbp + 0x29c0]
lea rdx, [rbp - 0x30]
mov rcx, rsi
call fcn.140037480
xor eax, eax
mov qword [rbp + 0x2a30], rax
mov qword [rbp + 0x2a38], rax
xorps xmm0, xmm0
movaps xmmword [rbp + 0x2a40], xmm0
xorps xmm1, xmm1
movaps xmmword [rbp + 0x2a50], xmm1
mov qword [rbp + 0x2a60], rax
movups xmmword [rbp + 0x2a68], xmm0
movups xmmword [rbp + 0x2a78], xmm0
mov qword [rbp + 0x2a88], rax
mov dword [rbp + 0x2a90], eax
movups xmmword [rbp + 0x2a94], xmm0
movups xmmword [rbp + 0x2aa4], xmm0
movups xmmword [rbp + 0x2ab4], xmm0
movups xmmword [rbp + 0x2ac4], xmm0
movups xmmword [rbp + 0x2ad4], xmm0
movups xmmword [rbp + 0x2ae4], xmm0
mov qword [rbp + 0x2af4], rax
mov dword [rbp + 0x2afc], eax
movaps xmmword [rbp + 0x2b00], xmm0
mov qword [rbp + 0x2b10], rax
mov qword [rsp + 0x20], rbx
mov r9d, 0xe8
lea r8, [rbp + 0x2a30]
mov rdx, qword [rbp + 0x188]
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edi, ebx
mov r15d, dword [rbp + 0xf20]
test r15d, r15d
je 0x140038588
mov r14d, ebx
mov r12, qword [rbp + 0xf18]
movsxd rdx, r14d
add rdx, r12
mov qword [rbp + 0x29c0], rbx
mov qword [rsp + 0x20], rbx
mov r9d, 8
lea r8, [rbp + 0x29c0]
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp + 0x29c0]
xor eax, eax
mov qword [rbp + 0x2c20], rax
mov qword [rsp + 0x20], rax
lea r9d, [rax + 8]
lea r8, [rbp + 0x2c20]
mov rdx, rbx
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [rbp + 0x29b0], 0
lea rdx, [rbx + 0x1d0]
xor ebx, ebx
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 8]
lea r8, [rbp + 0x29b0]
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [rbp + 0x2a10], rbx
mov dword [rbp + 0x2a18], ebx
mov rdx, qword [rbp + 0x29b0]
add rdx, 0x2c
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 0xc]
lea r8, [rbp + 0x2a10]
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [rbp + 0x29b0], rbx
mov rdx, qword [rbp + 0x2c20]
add rdx, 0xfffffffffffffff8
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 8]
lea r8, [rbp + 0x29b0]
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xorps xmm0, xmm0
movups xmmword [rbp + 0x2b70], xmm0
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 0x10]
lea r8, [rbp + 0x2b70]
mov rdx, qword [rbp + 0x29b0]
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [rbp + 0x2b7c]
add rdx, r13
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x2b80], xmm0
movups xmmword [rbp + 0x2b90], xmm0
movups xmmword [rbp + 0x2ba0], xmm0
movups xmmword [rbp + 0x2bb0], xmm0
movups xmmword [rbp + 0x2bc0], xmm0
movups xmmword [rbp + 0x2bd0], xmm0
movups xmmword [rbp + 0x2be0], xmm0
movups xmmword [rbp + 0x2bf0], xmm0
movups xmmword [rbp + 0x2c00], xmm0
mov dword [rbp + 0x2c10], eax
mov qword [rsp + 0x20], rbx
mov r9d, 0x94
lea r8, [rbp + 0x2b80]
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rax, [rbp + 0x2b94]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], bl
jne 0x140038250
mov qword [rbp + 0x29e0], rbx
mov qword [rbp + 0x29f0], rbx
mov qword [rbp + 0x29f8], 0xf
mov byte [rbp + 0x29e0], 0
add r8, 0xfffffffffffffffe
lea rdx, [rbp + 0x2b94]
lea rcx, [rbp + 0x29e0]
call fcn.140037320
nop
movss xmm4, dword [rbp + 0x2a18]
subss xmm4, dword [rbp + 0x2a64]
movss xmm3, dword [rbp + 0x2a14]
subss xmm3, dword [rbp + 0x2a60]
movss xmm2, dword [rbp + 0x2a10]
subss xmm2, dword [rbp + 0x2a5c]
movss xmm6, dword [rbp + 0x2a3c]
mulss xmm6, xmm3
movaps xmm0, xmm2
mulss xmm0, dword [rbp + 0x2a38]
addss xmm6, xmm0
movss xmm1, dword [rbp + 0x2a40]
mulss xmm1, xmm4
addss xmm6, xmm1
movss xmm5, dword [rbp + 0x2a48]
mulss xmm5, xmm3
movss xmm0, dword [rbp + 0x2a44]
mulss xmm0, xmm2
addss xmm5, xmm0
movss xmm1, dword [rbp + 0x2a4c]
mulss xmm1, xmm4
addss xmm5, xmm1
movss xmm7, dword [rbp + 0x2a54]
mulss xmm7, xmm3
movss xmm0, dword [rbp + 0x2a50]
mulss xmm0, xmm2
addss xmm7, xmm0
movss xmm1, dword [rbp + 0x2a58]
mulss xmm1, xmm4
addss xmm7, xmm1
comiss xmm14, xmm7
jae 0x140038900
divss xmm5, dword [rbp + 0x2b10]
divss xmm5, xmm7
movaps xmm8, xmm10
subss xmm8, xmm5
mulss xmm8, dword [rbp + 0x2a8c]
divss xmm6, dword [rbp + 0x2b00]
divss xmm6, xmm7
addss xmm6, xmm10
mulss xmm6, dword [rbp + 0x2a88]
mov rax, qword [0x140049750]
mov rax, qword [rax + 0x4b10]
lea r8, str.Foreground
mov edx, 1
mov rcx, qword [rax]
call fcn.140006180
mov rbx, rax
movaps xmm1, xmm8
addss xmm1, xmm12
movaps xmm0, xmm6
addss xmm0, xmm12
subss xmm8, xmm12
movaps xmm3, xmm8
addss xmm3, xmm11
movaps xmm2, xmm6
subss xmm2, xmm12
addss xmm2, xmm11
mov dword [rsp + 0x20], 1
mov rcx, rax
test byte [rax + 0x30], 1
je 0x14003840f
subss xmm1, xmm11
subss xmm0, xmm11
movss dword [rbp - 0x70], xmm0
movss dword [rbp - 0x6c], xmm1
movss dword [rbp - 0x68], xmm2
movss dword [rbp - 0x64], xmm3
lea r8, [rbp - 0x70]
lea rdx, [rbp - 0x68]
jmp 0x140038435
subss xmm1, xmm13
subss xmm0, xmm13
movss dword [rbp - 0x60], xmm0
movss dword [rbp - 0x5c], xmm1
movss dword [rbp - 0x58], xmm2
movss dword [rbp - 0x54], xmm3
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x58]
movaps xmm3, xmm10
call fcn.1400241b0
movss dword [rsp + 0x28], xmm10
mov dword [rsp + 0x20], 1
mov r9d, 0xffffffff
mov r8d, dword [rbx + 0x78]
mov rdx, qword [rbx + 0x80]
mov rcx, rbx
call fcn.1400223f0
mov dword [rbx + 0x78], 0
mov rax, qword [0x140049750]
mov rax, qword [rax + 0x4b10]
lea r8, str.Foreground
mov edx, 1
mov rcx, qword [rax]
call fcn.140006180
mov r10, rax
lea rdx, [rbp + 0x29e0]
mov rcx, qword [rbp + 0x29e0]
mov r8, qword [rbp + 0x29f8]
cmp r8, 0x10
cmovae rdx, rcx
cvtps2pd xmm0, xmm6
addsd xmm0, xmm9
cvtpd2ps xmm0, xmm0
movss dword [rbp - 0x50], xmm0
movss dword [rbp - 0x4c], xmm8
test rdx, rdx
je 0x140038543
cmp byte [rdx], 0
je 0x140038543
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rdx + rcx], 0
jne 0x1400384d7
add rcx, rdx
mov rax, qword [rax + 0x38]
movups xmm0, xmmword [r10 + 0x88]
movups xmmword [rbp + 0x2c20], xmm0
mov byte [rsp + 0x48], 0
movss dword [rsp + 0x40], xmm15
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rdx
lea rcx, [rbp + 0x2c20]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0xffff6466
lea r9, [rbp - 0x50]
movss xmm2, dword [rax + 0x10]
mov rdx, r10
mov rcx, qword [rax + 8]
call fcn.1400281c0
mov r8, qword [rbp + 0x29f8]
mov rcx, qword [rbp + 0x29e0]
xor ebx, ebx
cmp r8, 0x10
jb 0x140038579
lea rdx, [r8 + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038574
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038e77
call fcn.14003921c
inc edi
add r14d, 8
cmp edi, r15d
jb 0x1400380c1
mov edi, ebx
mov r15d, dword [rbp + 0x1068]
test r15d, r15d
je 0x140038a96
mov r14d, ebx
mov r12, qword [rbp + 0x1060]
nop dword [rax]
nop dword [rax + rax]
movsxd rdx, r14d
add rdx, r12
mov qword [rbp + 0x2c20], rbx
mov qword [rsp + 0x20], rbx
mov r9d, 8
lea r8, [rbp + 0x2c20]
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp + 0x2c20]
xor eax, eax
mov qword [rbp + 0x29b0], rax
lea rdx, [rbx + 0x1d0]
mov qword [rsp + 0x20], rax
lea r9d, [rax + 8]
lea r8, [rbp + 0x29b0]
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor eax, eax
mov qword [rbp + 0x29c0], rax
mov qword [rsp + 0x20], rax
lea r9d, [rax + 8]
lea r8, [rbp + 0x29c0]
mov rdx, rbx
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [rbp + 0x2a00], 0
mov dword [rbp + 0x2a08], 0
mov rdx, qword [rbp + 0x29b0]
add rdx, 0x2c
xor ebx, ebx
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 0xc]
lea r8, [rbp + 0x2a00]
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [rbp + 0x2c20], rbx
mov rdx, qword [rbp + 0x29c0]
add rdx, 0xfffffffffffffff8
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 8]
lea r8, [rbp + 0x2c20]
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xorps xmm0, xmm0
movups xmmword [rbp + 0x2a20], xmm0
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 0x10]
lea r8, [rbp + 0x2a20]
mov rdx, qword [rbp + 0x2c20]
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [rbp + 0x2a2c]
add rdx, r13
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x2b80], xmm0
movups xmmword [rbp + 0x2b90], xmm0
movups xmmword [rbp + 0x2ba0], xmm0
movups xmmword [rbp + 0x2bb0], xmm0
movups xmmword [rbp + 0x2bc0], xmm0
movups xmmword [rbp + 0x2bd0], xmm0
movups xmmword [rbp + 0x2be0], xmm0
movups xmmword [rbp + 0x2bf0], xmm0
movups xmmword [rbp + 0x2c00], xmm0
mov dword [rbp + 0x2c10], eax
mov qword [rsp + 0x20], rbx
mov r9d, 0x94
lea r8, [rbp + 0x2b80]
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rax, [rbp + 0x2b94]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], bl
jne 0x140038740
mov qword [rbp + 0x29e0], rbx
mov qword [rbp + 0x29f0], rbx
mov qword [rbp + 0x29f8], 0xf
mov byte [rbp + 0x29e0], 0
add r8, 0xfffffffffffffffe
lea rdx, [rbp + 0x2b94]
lea rcx, [rbp + 0x29e0]
call fcn.140037320
nop
movss xmm4, dword [rbp + 0x2a08]
subss xmm4, dword [rbp + 0x2a64]
movss xmm3, dword [rbp + 0x2a04]
subss xmm3, dword [rbp + 0x2a60]
movss xmm2, dword [rbp + 0x2a00]
subss xmm2, dword [rbp + 0x2a5c]
movss xmm6, dword [rbp + 0x2a3c]
mulss xmm6, xmm3
movss xmm0, dword [rbp + 0x2a38]
mulss xmm0, xmm2
addss xmm6, xmm0
movss xmm1, dword [rbp + 0x2a40]
mulss xmm1, xmm4
addss xmm6, xmm1
movss xmm5, dword [rbp + 0x2a48]
mulss xmm5, xmm3
movss xmm0, dword [rbp + 0x2a44]
mulss xmm0, xmm2
addss xmm5, xmm0
movss xmm1, dword [rbp + 0x2a4c]
mulss xmm1, xmm4
addss xmm5, xmm1
movss xmm7, dword [rbp + 0x2a54]
mulss xmm7, xmm3
movss xmm0, dword [rbp + 0x2a50]
mulss xmm0, xmm2
addss xmm7, xmm0
movss xmm1, dword [rbp + 0x2a58]
mulss xmm1, xmm4
addss xmm7, xmm1
comiss xmm14, xmm7
jae 0x140038e64
divss xmm5, dword [rbp + 0x2b10]
divss xmm5, xmm7
movaps xmm8, xmm10
subss xmm8, xmm5
mulss xmm8, dword [rbp + 0x2a8c]
divss xmm6, dword [rbp + 0x2b00]
divss xmm6, xmm7
addss xmm6, xmm10
mulss xmm6, dword [rbp + 0x2a88]
mov rax, qword [0x140049750]
mov rax, qword [rax + 0x4b10]
lea r8, str.Foreground
mov edx, 1
mov rcx, qword [rax]
call fcn.140006180
mov rbx, rax
movaps xmm1, xmm8
addss xmm1, xmm12
movaps xmm0, xmm6
addss xmm0, xmm12
subss xmm8, xmm12
movaps xmm3, xmm8
addss xmm3, xmm11
movaps xmm2, xmm6
subss xmm2, xmm12
addss xmm2, xmm11
mov dword [rsp + 0x20], 1
mov rcx, rax
test byte [rax + 0x30], 1
je 0x140038913
subss xmm1, xmm11
subss xmm0, xmm11
movss dword [rbp - 0x48], xmm0
movss dword [rbp - 0x44], xmm1
movss dword [rbp - 0x40], xmm2
movss dword [rbp - 0x3c], xmm3
lea r8, [rbp - 0x48]
lea rdx, [rbp - 0x40]
jmp 0x14003893c
mov r8, qword [rbp + 0x29f8]
mov rcx, qword [rbp + 0x29e0]
jmp 0x140038545
subss xmm1, xmm13
subss xmm0, xmm13
movss dword [rbp - 0x38], xmm0
movss dword [rbp - 0x34], xmm1
movss dword [rsp + 0x70], xmm2
movss dword [rsp + 0x74], xmm3
lea r8, [rbp - 0x38]
lea rdx, [rsp + 0x70]
movaps xmm3, xmm10
call fcn.1400241b0
movss dword [rsp + 0x28], xmm10
mov dword [rsp + 0x20], 1
mov r9d, 0xffffffff
mov r8d, dword [rbx + 0x78]
mov rdx, qword [rbx + 0x80]
mov rcx, rbx
call fcn.1400223f0
mov dword [rbx + 0x78], 0
mov rax, qword [0x140049750]
mov rax, qword [rax + 0x4b10]
lea r8, str.Foreground
mov edx, 1
mov rcx, qword [rax]
call fcn.140006180
mov r10, rax
lea rdx, [rbp + 0x29e0]
mov rcx, qword [rbp + 0x29e0]
mov r8, qword [rbp + 0x29f8]
cmp r8, 0x10
cmovae rdx, rcx
cvtps2pd xmm0, xmm6
addsd xmm0, xmm9
cvtpd2ps xmm0, xmm0
movss dword [rsp + 0x78], xmm0
movss dword [rsp + 0x7c], xmm8
test rdx, rdx
je 0x140038a51
cmp byte [rdx], 0
je 0x140038a51
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rdx + rcx], 0
jne 0x1400389e4
add rcx, rdx
mov rax, qword [rax + 0x38]
movups xmm0, xmmword [r10 + 0x88]
movups xmmword [rbp + 0x2c20], xmm0
mov byte [rsp + 0x48], 0
movss dword [rsp + 0x40], xmm15
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rdx
lea rcx, [rbp + 0x2c20]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0xffff6466
lea r9, [rsp + 0x78]
movss xmm2, dword [rax + 0x10]
mov rdx, r10
mov rcx, qword [rax + 8]
call fcn.1400281c0
mov r8, qword [rbp + 0x29f8]
mov rcx, qword [rbp + 0x29e0]
xor ebx, ebx
cmp r8, 0x10
jb 0x140038a87
lea rdx, [r8 + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038a82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038e7e
call fcn.14003921c
inc edi
add r14d, 8
cmp edi, r15d
jb 0x1400385b0
movabs r15, 0x311cdad160000
cmp byte [0x14004974c], 0
je 0x140038dd0
mov qword [rbp + 0x2c20], rbx
lea rdx, [r13 + 0x414cf70]
mov qword [rsp + 0x20], rbx
mov r9d, 8
lea r8, [rbp + 0x2c20]
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r8, qword [rbp + 0x2c20]
lea rdx, [rbp - 0x30]
mov rcx, rsi
call fcn.140037480
xor eax, eax
mov qword [rbp + 0x2a30], rax
mov qword [rbp + 0x2a38], rax
xorps xmm0, xmm0
movaps xmmword [rbp + 0x2a40], xmm0
xorps xmm1, xmm1
movaps xmmword [rbp + 0x2a50], xmm1
mov qword [rbp + 0x2a60], rax
movups xmmword [rbp + 0x2a68], xmm0
movups xmmword [rbp + 0x2a78], xmm0
mov qword [rbp + 0x2a88], rax
mov dword [rbp + 0x2a90], eax
movups xmmword [rbp + 0x2a94], xmm0
movups xmmword [rbp + 0x2aa4], xmm0
movups xmmword [rbp + 0x2ab4], xmm0
movups xmmword [rbp + 0x2ac4], xmm0
movups xmmword [rbp + 0x2ad4], xmm0
movups xmmword [rbp + 0x2ae4], xmm0
mov qword [rbp + 0x2af4], rax
mov dword [rbp + 0x2afc], eax
movaps xmmword [rbp + 0x2b00], xmm0
mov qword [rbp + 0x2b10], rax
mov qword [rsp + 0x20], rbx
mov r9d, 0xe8
lea r8, [rbp + 0x2a30]
mov rdx, qword [rbp + 0x188]
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0xdd8]
test eax, eax
je 0x140038dd0
mov rdi, qword [rbp + 0xdd0]
mov r14d, eax
mov qword [rbp + 0x2c20], rbx
mov qword [rsp + 0x20], rbx
mov r9d, 8
lea r8, [rbp + 0x2c20]
mov rdx, rdi
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [rbp + 0x29b0], rbx
mov rdx, qword [rbp + 0x2c20]
add rdx, 0x1d0
mov qword [rsp + 0x20], rbx
mov r9d, 8
lea r8, [rbp + 0x29b0]
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [rbp + 0x29d0], 0
mov dword [rbp + 0x29d8], 0
mov rdx, qword [rbp + 0x29b0]
add rdx, 0x2c
mov qword [rsp + 0x20], rbx
mov r9d, 0xc
lea r8, [rbp + 0x29d0]
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm3, dword [rbp + 0x29d0]
subss xmm3, dword [rbp + 0x2a5c]
movss xmm2, dword [rbp + 0x29d4]
subss xmm2, dword [rbp + 0x2a60]
movss xmm4, dword [rbp + 0x29d8]
subss xmm4, dword [rbp + 0x2a64]
movss xmm7, dword [rbp + 0x2a38]
mulss xmm7, xmm3
movss xmm0, dword [rbp + 0x2a3c]
mulss xmm0, xmm2
addss xmm7, xmm0
movss xmm1, dword [rbp + 0x2a40]
mulss xmm1, xmm4
addss xmm7, xmm1
movss xmm5, dword [rbp + 0x2a44]
mulss xmm5, xmm3
movss xmm0, dword [rbp + 0x2a48]
mulss xmm0, xmm2
addss xmm5, xmm0
movss xmm1, dword [rbp + 0x2a4c]
mulss xmm1, xmm4
addss xmm5, xmm1
movss xmm6, dword [rbp + 0x2a50]
mulss xmm6, xmm3
movss xmm0, dword [rbp + 0x2a54]
mulss xmm0, xmm2
addss xmm6, xmm0
movss xmm1, dword [rbp + 0x2a58]
mulss xmm1, xmm4
addss xmm6, xmm1
comiss xmm14, xmm6
jae 0x140038dbb
divss xmm7, dword [rbp + 0x2b00]
divss xmm7, xmm6
addss xmm7, xmm10
mulss xmm7, dword [rbp + 0x2a88]
divss xmm5, dword [rbp + 0x2b10]
divss xmm5, xmm6
movaps xmm6, xmm10
subss xmm6, xmm5
mulss xmm6, dword [rbp + 0x2a8c]
mov rax, qword [0x140049750]
mov rcx, qword [rax + 0x4b10]
lea r8, str.Foreground
mov edx, 1
mov rcx, qword [rcx]
call fcn.140006180
mov rbx, rax
movss dword [rsp + 0x68], xmm7
movss dword [rsp + 0x6c], xmm6
mov dword [rsp + 0x20], 0x30
xor r9d, r9d
movss xmm2, dword [0x140041edc]
lea rdx, [rsp + 0x68]
mov rcx, rax
call fcn.140023890
dec dword [rbx + 0x78]
movss dword [rsp + 0x28], xmm10
mov dword [rsp + 0x20], 1
mov r9d, 0xdcff1639
mov r8d, dword [rbx + 0x78]
mov rdx, qword [rbx + 0x80]
mov rcx, rbx
call fcn.1400223f0
mov dword [rbx + 0x78], 0
xor ebx, ebx
add rdi, 8
sub r14, 1
jne 0x140038bb0
nop dword [rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0x2c20], xmm0
mov rcx, qword [0x1400497c0]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [0x1400497d0]
lea edx, [r9 + 1]
call qword [rax + 0x108]
mov rcx, qword [0x1400497c0]
mov rax, qword [rcx]
lea r8, [rbp + 0x2c20]
mov rdx, qword [0x1400497d0]
call qword [rax + 0x190]
call fcn.140008ba0
mov rax, qword [0x140049750]
mov rcx, qword [rax + 0x4b10]
mov rax, qword [rcx]
add rax, 0x48
mov rcx, rbx
cmp byte [rax], 0
cmovne rcx, rax
call fcn.140029710
mov rcx, qword [0x1400497b8]
mov rax, qword [rcx]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [rax + 0x40]
cmp byte [0x140049828], 0
je 0x140038e85
xor r14d, r14d
jmp 0x140037c45
mov r8, qword [rbp + 0x29f8]
mov rcx, qword [rbp + 0x29e0]
jmp 0x140038a53
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140036330
mov rcx, qword [0x1400497b0]
test rcx, rcx
je 0x140038ecc
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x1400497c0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x1400497b8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x1400497d0]
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rcx, str._____Released_Device_n
jmp 0x140038ed3
lea rcx, str._____Device_Not_Found_when_Exiting._n
call fcn.1400010f0
mov rcx, qword [0x1400497c8]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [0x140049778]
mov rcx, qword [0x1400497a0]
call qword [sym.imp.USER32.dll_UnregisterClassA]
xor eax, eax
mov rcx, qword [rbp + 0x2c38]
xor rcx, rsp
call fcn.140039080
lea r11, [rsp + 0x2de0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
movaps xmm14, xmmword [r11 - 0x90]
movaps xmm15, xmmword [r11 - 0xa0]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret