Function at 0x4335f0
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x7738
call fcn.00477f60
mov eax, dword [0x498080]
xor eax, esp
mov dword [esp + 0x7734], eax
mov eax, dword [0x4b454c]
push esi
push edi
cmp eax, dword [0x4b4550]
je 0x4362fa
movss xmm0, dword [0x48a2f4]
xor eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movss dword [esp + 0x3c], xmm0
mov dword [0x4b40c4], 0
mov dword [esp + 0x4c], eax
nop dword [eax + eax]
shl eax, 4
add eax, dword [0x4b454c]
movups xmm0, xmmword [eax]
movd eax, xmm0
movaps xmmword [esp + 0x50], xmm0
mov dword [esp + 0x20], eax
cmp eax, dword [0x4b40dc]
jne 0x43367c
cmp dword [esp + 0x54], 0
je 0x4362ba
cmp byte [0x4b405a], 0
je 0x4336af
push 0
push 4
lea eax, [esp + 0x2ec]
mov dword [esp + 0x2ec], 0x42960000
push eax
mov eax, dword [0x4b40dc]
add eax, 0xdfd8
push eax
push dword [0x4b4050]
call edi
cmp byte [0x4b40ba], 0
push 0
push 4
je 0x4336d6
movss xmm0, dword [0x498314]
lea eax, [esp + 0x2f0]
movss dword [esp + 0x2f0], xmm0
jmp 0x4336e8
mov dword [esp + 0x2f4], 0x3fe66666
lea eax, [esp + 0x2f4]
push eax
mov eax, dword [0x4b40dc]
add eax, 0xdfd4
push eax
push dword [0x4b4050]
call edi
cmp byte [0x4b407e], 0
je 0x43373c
push 0x20
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x43373c
push 0
push 4
lea eax, [esp + 0x2f8]
mov dword [esp + 0x2f8], 0x41880000
push eax
mov eax, dword [0x4b40dc]
add eax, 0xe980
push eax
push dword [0x4b4050]
call edi
push 0
push 4
lea eax, [esp + 0x2fc]
push eax
mov eax, dword [0x4b40e8]
add eax, 0xc32034
push eax
push dword [0x4b4050]
call esi
push 0
push 4
lea eax, [esp + 0x37c]
push eax
mov eax, dword [esp + 0x300]
add eax, 0x14
push eax
push dword [0x4b4050]
call esi
push 0
push 4
lea eax, [esp + 0x378]
push eax
mov eax, dword [esp + 0x380]
add eax, 0x3c
push eax
push dword [0x4b4050]
call esi
push 0
push 4
lea eax, [esp + 0x374]
push eax
push dword [esp + 0x37c]
push dword [0x4b4050]
call esi
mov esi, dword [esp + 0x36c]
lea ecx, [esp + 0x420]
push 0
push 8
push ecx
lea eax, [esi + 0x1a8]
push eax
push dword [0x4b4050]
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 8
lea ecx, [esp + 0x430]
lea eax, [esi + 0x1b0]
push ecx
push eax
push dword [0x4b4050]
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 8
lea eax, [esi + 0x1b8]
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea ecx, [esp + 0x438]
mov dword [esp + 0x10], eax
push ecx
push eax
push dword [0x4b4050]
call esi
push 0x46
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x433f27
mov eax, dword [0x4b40c8]
cmp eax, 1
jne 0x4338c5
movsd xmm0, qword [0x48a240]
lea eax, [esp + 0x2a0]
push 0
push 8
push eax
push dword [esp + 0x18]
movsd qword [esp + 0x2b0], xmm0
push dword [0x4b4050]
call edi
movsd xmm0, qword [0x48a180]
lea eax, [esp + 0x298]
push 0
push 8
push eax
push dword [esp + 0x1c]
movsd qword [esp + 0x2a8], xmm0
push dword [0x4b4050]
call edi
movsd xmm0, qword [0x48a278]
lea eax, [esp + 0x3c8]
push 0
push 8
push eax
push dword [esp + 0x14]
movsd qword [esp + 0x3d8], xmm0
push dword [0x4b4050]
call edi
mov eax, dword [0x4b40c8]
cmp eax, 2
jne 0x43394e
movsd xmm0, qword [0x48a238]
lea eax, [esp + 0x2a0]
push 0
push 8
push eax
push dword [esp + 0x18]
movsd qword [esp + 0x2b0], xmm0
push dword [0x4b4050]
call edi
movsd xmm0, qword [0x48a168]
lea eax, [esp + 0x298]
push 0
push 8
push eax
push dword [esp + 0x1c]
movsd qword [esp + 0x2a8], xmm0
push dword [0x4b4050]
call edi
movsd xmm0, qword [0x48a1e0]
lea eax, [esp + 0x3e0]
push 0
push 8
push eax
push dword [esp + 0x14]
movsd qword [esp + 0x3f0], xmm0
push dword [0x4b4050]
call edi
mov eax, dword [0x4b40c8]
cmp eax, 3
jne 0x4339d7
movsd xmm0, qword [0x48a1c8]
lea eax, [esp + 0x2a0]
push 0
push 8
push eax
push dword [esp + 0x18]
movsd qword [esp + 0x2b0], xmm0
push dword [0x4b4050]
call edi
movsd xmm0, qword [0x48a178]
lea eax, [esp + 0x298]
push 0
push 8
push eax
push dword [esp + 0x1c]
movsd qword [esp + 0x2a8], xmm0
push dword [0x4b4050]
call edi
movsd xmm0, qword [0x48a228]
lea eax, [esp + 0x3e8]
push 0
push 8
push eax
push dword [esp + 0x14]
movsd qword [esp + 0x3f8], xmm0
push dword [0x4b4050]
call edi
mov eax, dword [0x4b40c8]
cmp eax, 4
jne 0x433a60
movsd xmm0, qword [0x48a280]
lea eax, [esp + 0x2a0]
push 0
push 8
push eax
push dword [esp + 0x18]
movsd qword [esp + 0x2b0], xmm0
push dword [0x4b4050]
call edi
movsd xmm0, qword [0x48a150]
lea eax, [esp + 0x298]
push 0
push 8
push eax
push dword [esp + 0x1c]
movsd qword [esp + 0x2a8], xmm0
push dword [0x4b4050]
call edi
movsd xmm0, qword [0x48a218]
lea eax, [esp + 0x3f0]
push 0
push 8
push eax
push dword [esp + 0x14]
movsd qword [esp + 0x400], xmm0
push dword [0x4b4050]
call edi
mov eax, dword [0x4b40c8]
cmp eax, 5
jne 0x433ae9
movsd xmm0, qword [0x48a268]
lea eax, [esp + 0x2a0]
push 0
push 8
push eax
push dword [esp + 0x18]
movsd qword [esp + 0x2b0], xmm0
push dword [0x4b4050]
call edi
movsd xmm0, qword [0x48a148]
lea eax, [esp + 0x298]
push 0
push 8
push eax
push dword [esp + 0x1c]
movsd qword [esp + 0x2a8], xmm0
push dword [0x4b4050]
call edi
movsd xmm0, qword [0x48a220]
lea eax, [esp + 0x3f8]
push 0
push 8
push eax
push dword [esp + 0x14]
movsd qword [esp + 0x408], xmm0
push dword [0x4b4050]
call edi
mov eax, dword [0x4b40c8]
cmp eax, 6
jne 0x433b72
movsd xmm0, qword [0x48a260]
lea eax, [esp + 0x2a0]
push 0
push 8
push eax
push dword [esp + 0x18]
movsd qword [esp + 0x2b0], xmm0
push dword [0x4b4050]
call edi
movsd xmm0, qword [0x48a158]
lea eax, [esp + 0x298]
push 0
push 8
push eax
push dword [esp + 0x1c]
movsd qword [esp + 0x2a8], xmm0
push dword [0x4b4050]
call edi
movsd xmm0, qword [0x48a288]
lea eax, [esp + 0x400]
push 0
push 8
push eax
push dword [esp + 0x14]
movsd qword [esp + 0x410], xmm0
push dword [0x4b4050]
call edi
mov eax, dword [0x4b40c8]
cmp eax, 7
jne 0x433bfb
movsd xmm0, qword [0x48a1e8]
lea eax, [esp + 0x2a0]
push 0
push 8
push eax
push dword [esp + 0x18]
movsd qword [esp + 0x2b0], xmm0
push dword [0x4b4050]
call edi
movsd xmm0, qword [0x48a170]
lea eax, [esp + 0x298]
push 0
push 8
push eax
push dword [esp + 0x1c]
movsd qword [esp + 0x2a8], xmm0
push dword [0x4b4050]
call edi
movsd xmm0, qword [0x48a1f8]
lea eax, [esp + 0x408]
push 0
push 8
push eax
push dword [esp + 0x14]
movsd qword [esp + 0x418], xmm0
push dword [0x4b4050]
call edi
mov eax, dword [0x4b40c8]
cmp eax, 8
jne 0x433c83
movsd xmm0, qword [0x48a208]
push 0
push eax
lea eax, [esp + 0x2a8]
movsd qword [esp + 0x2a8], xmm0
push eax
push dword [esp + 0x18]
push dword [0x4b4050]
call edi
movsd xmm0, qword [0x48a188]
lea eax, [esp + 0x298]
push 0
push 8
push eax
push dword [esp + 0x1c]
movsd qword [esp + 0x2a8], xmm0
push dword [0x4b4050]
call edi
movsd xmm0, qword [0x48a250]
lea eax, [esp + 0x410]
push 0
push 8
push eax
push dword [esp + 0x14]
movsd qword [esp + 0x420], xmm0
push dword [0x4b4050]
call edi
mov eax, dword [0x4b40c8]
cmp eax, 9
jne 0x433d0c
movsd xmm0, qword [0x48a1d8]
lea eax, [esp + 0x2a0]
push 0
push 8
push eax
push dword [esp + 0x18]
movsd qword [esp + 0x2b0], xmm0
push dword [0x4b4050]
call edi
movsd xmm0, qword [0x48a198]
lea eax, [esp + 0x298]
push 0
push 8
push eax
push dword [esp + 0x1c]
movsd qword [esp + 0x2a8], xmm0
push dword [0x4b4050]
call edi
movsd xmm0, qword [0x48a1b0]
lea eax, [esp + 0x418]
push 0
push 8
push eax
push dword [esp + 0x14]
movsd qword [esp + 0x428], xmm0
push dword [0x4b4050]
call edi
mov eax, dword [0x4b40c8]
cmp eax, 0xa
jne 0x433d95
movsd xmm0, qword [0x48a1d0]
lea eax, [esp + 0x2a0]
push 0
push 8
push eax
push dword [esp + 0x18]
movsd qword [esp + 0x2b0], xmm0
push dword [0x4b4050]
call edi
movsd xmm0, qword [0x48a190]
lea eax, [esp + 0x298]
push 0
push 8
push eax
push dword [esp + 0x1c]
movsd qword [esp + 0x2a8], xmm0
push dword [0x4b4050]
call edi
movsd xmm0, qword [0x48a1b8]
lea eax, [esp + 0x3a8]
push 0
push 8
push eax
push dword [esp + 0x14]
movsd qword [esp + 0x3b8], xmm0
push dword [0x4b4050]
call edi
mov eax, dword [0x4b40c8]
cmp eax, 0xb
jne 0x433e1e
movsd xmm0, qword [0x48a200]
lea eax, [esp + 0x2a0]
push 0
push 8
push eax
push dword [esp + 0x18]
movsd qword [esp + 0x2b0], xmm0
push dword [0x4b4050]
call edi
movsd xmm0, qword [0x48a128]
lea eax, [esp + 0x298]
push 0
push 8
push eax
push dword [esp + 0x1c]
movsd qword [esp + 0x2a8], xmm0
push dword [0x4b4050]
call edi
movsd xmm0, qword [0x48a210]
lea eax, [esp + 0x3b0]
push 0
push 8
push eax
push dword [esp + 0x14]
movsd qword [esp + 0x3c0], xmm0
push dword [0x4b4050]
call edi
mov eax, dword [0x4b40c8]
cmp eax, 0xc
jne 0x433ea7
movsd xmm0, qword [0x48a258]
lea eax, [esp + 0x2a0]
push 0
push 8
push eax
push dword [esp + 0x18]
movsd qword [esp + 0x2b0], xmm0
push dword [0x4b4050]
call edi
movsd xmm0, qword [0x48a130]
lea eax, [esp + 0x298]
push 0
push 8
push eax
push dword [esp + 0x1c]
movsd qword [esp + 0x2a8], xmm0
push dword [0x4b4050]
call edi
movsd xmm0, qword [0x48a248]
lea eax, [esp + 0x3b8]
push 0
push 8
push eax
push dword [esp + 0x14]
movsd qword [esp + 0x3c8], xmm0
push dword [0x4b4050]
call edi
mov eax, dword [0x4b40c8]
cmp eax, 0xd
jne 0x433f27
movsd xmm0, qword [0x48a230]
lea eax, [esp + 0x2a0]
push 0
push 8
push eax
push dword [esp + 0x18]
movsd qword [esp + 0x2b0], xmm0
push dword [0x4b4050]
call edi
movsd xmm0, qword [0x48a140]
lea eax, [esp + 0x298]
push 0
push 8
push eax
push dword [esp + 0x1c]
movsd qword [esp + 0x2a8], xmm0
push dword [0x4b4050]
call edi
movsd xmm0, qword [0x48a1f0]
lea eax, [esp + 0x3c0]
push 0
push 8
push eax
push dword [esp + 0x14]
movsd qword [esp + 0x3d0], xmm0
push dword [0x4b4050]
call edi
cmp byte [0x4b40b8], 0
push 0
push 1
je 0x433f45
mov byte [esp + 0x2c7], 1
lea eax, [esp + 0x2c7]
jmp 0x433f54
mov byte [esp + 0x2c6], 0
lea eax, [esp + 0x2c6]
push eax
mov eax, dword [0x4b40e8]
add eax, 0x4401b2
push eax
push dword [0x4b4050]
call edi
cmp byte [0x4b407f], 0
push 0
push 4
je 0x433f89
mov dword [esp + 0x370], 0xc22a0000
lea eax, [esp + 0x370]
jmp 0x433f9b
mov dword [esp + 0x36c], 0
lea eax, [esp + 0x36c]
push eax
mov eax, dword [0x4b40dc]
add eax, 0xdcd0
push eax
push dword [0x4b4050]
call edi
push 0
push 4
lea eax, [esp + 0x368]
push eax
mov eax, dword [0x4b40e8]
add eax, 0x1223db8
push eax
push dword [0x4b4050]
call esi
cmp byte [0x4b405e], 0
mov esi, dword [esp + 0x360]
push 0
push 4
lea eax, [esi + 0x58]
je 0x433fff
movss xmm0, dword [0x498108]
lea ecx, [esp + 0x364]
movss dword [esp + 0x364], xmm0
jmp 0x434011
mov dword [esp + 0x360], 0x3b23d70a
lea ecx, [esp + 0x360]
push ecx
push eax
push dword [0x4b4050]
call edi
cmp byte [0x4b40cd], 0
push 0
push 4
je 0x43403c
mov dword [esp + 0x344], 2
lea eax, [esp + 0x344]
jmp 0x43404e
mov dword [esp + 0x348], 3
lea eax, [esp + 0x348]
push eax
mov eax, dword [0x4b40e8]
add eax, 0x4849cf
push eax
push dword [0x4b4050]
call edi
cmp byte [0x4b40ce], 0
lea eax, [esi + 0x4c]
push 0
push 4
je 0x434086
mov dword [esp + 0x34c], 0x34a10fb0
lea ecx, [esp + 0x34c]
jmp 0x434098
mov dword [esp + 0x318], 0x42700000
lea ecx, [esp + 0x318]
push ecx
push eax
push dword [0x4b4050]
call edi
cmp byte [0x4b4067], 0
lea eax, [esi + 0xc]
push 0
push 4
je 0x4340c6
mov dword [esp + 0x340], 0
lea ecx, [esp + 0x340]
jmp 0x4340d8
mov dword [esp + 0x33c], 0x3f8ccccd
lea ecx, [esp + 0x33c]
push ecx
push eax
push dword [0x4b4050]
call edi
cmp byte [0x4b4058], 0
lea eax, [esi + 0x1c]
push 0
push 4
je 0x434106
mov dword [esp + 0x338], 0
lea ecx, [esp + 0x338]
jmp 0x434118
mov dword [esp + 0x334], 0x3f99999a
lea ecx, [esp + 0x334]
push ecx
push eax
push dword [0x4b4050]
call edi
add esi, 0x5c
cmp byte [0x4b407d], 0
push 0
push 4
je 0x434146
mov dword [esp + 0x330], 0
lea eax, [esp + 0x330]
jmp 0x434158
mov dword [esp + 0x32c], 0xc11cf5c3
lea eax, [esp + 0x32c]
push eax
push esi
push dword [0x4b4050]
call edi
cmp byte [0x4b40bb], 0
je 0x434195
push 0
push 4
lea eax, [esp + 0x328]
mov dword [esp + 0x328], 0x3f99999a
push eax
mov eax, dword [0x4b40dc]
add eax, 0xdf00
push eax
push dword [0x4b4050]
call edi
mov esi, dword [esp + 0x20]
lea eax, [esp + 0x354]
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 4
push eax
lea eax, [esi + 0x2df4]
push eax
push dword [0x4b4050]
call edi
movss xmm0, dword [esp + 0x354]
mov eax, esi
or eax, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
movss dword [esp + 0x2a0], xmm0
je 0x4350c4
cmp edx, 0x20
je 0x4341ea
cmp edx, 0x21
jne 0x4350c4
comiss xmm0, dword [0x48a0dc]
jb 0x4350c4
movss xmm1, dword [0x48a2c4]
comiss xmm1, xmm0
jb 0x4350c4
push 0
push 4
lea eax, [esp + 0x358]
push eax
mov eax, dword [0x4b40e8]
add eax, 0xf45f14
xor eax, dword [0x4b40c0]
push eax
push dword [0x4b4050]
call edi
push 0
push 4
lea eax, [esp + 0x354]
push eax
mov eax, dword [esp + 0x35c]
add eax, 0xfe8
xor eax, dword [0x4b40d8]
push eax
push dword [0x4b4050]
call edi
push 0
push 0xc
lea eax, [esp + 0x398]
push eax
mov eax, dword [esp + 0x358]
add eax, 0xe38
push eax
push dword [0x4b4050]
call edi
push 0
push 0xc
lea eax, [esp + 0xa4]
push eax
lea eax, [esi + 0xe38]
push eax
push dword [0x4b4050]
call edi
movss xmm1, dword [esp + 0x9c]
movss xmm2, dword [esp + 0xa0]
subss xmm2, dword [esp + 0x394]
subss xmm1, dword [esp + 0x390]
movq xmm0, qword [esp + 0x9c]
mov eax, dword [esp + 0xa4]
movq qword [0x4b4530], xmm0
movss xmm0, dword [esp + 0xa4]
subss xmm0, dword [esp + 0x398]
mulss xmm2, xmm2
mov dword [0x4b4538], eax
mulss xmm1, xmm1
mulss xmm0, xmm0
addss xmm2, xmm1
xorps xmm1, xmm1
addss xmm2, xmm0
cvtps2pd xmm0, xmm2
ucomisd xmm1, xmm0
ja 0x434309
sqrtsd xmm0, xmm0
jmp 0x43430e
call sub.api_ms_win_crt_math_l1_1_0.dll__libm_sse2_sqrt_precise
cvtsd2ss xmm0, xmm0
push 6
mov edx, esi
lea ecx, [esp + 0x254]
movss dword [esp + 0x44], xmm0
call fcn.004326d0
mov eax, dword [0x4b4078]
add esp, 4
sub eax, 0
je 0x434345
sub eax, 1
jne 0x434350
mov eax, 3
mov dword [esp + 0x6c], eax
jmp 0x434354
mov eax, 6
mov dword [esp + 0x6c], eax
jmp 0x434354
mov eax, dword [esp + 0x6c]
push eax
mov edx, esi
lea ecx, [esp + 0x23c]
call fcn.004326d0
movq xmm0, qword [esp + 0x23c]
sub esp, 8
mov eax, dword [esp + 0x24c]
mov ecx, esp
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
mov ecx, 0x4b4540
call fcn.004328b0
movq xmm0, qword [0x4b4530]
mov ecx, esp
mov eax, dword [0x4b4538]
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
lea ecx, [esp + 0x2cc]
call fcn.004328b0
movq xmm0, qword [esp + 0x25c]
mov ecx, esp
mov eax, dword [esp + 0x264]
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
mov ecx, 0x4b4558
call fcn.004328b0
add esp, 0xc
test al, al
je 0x4350c0
push 0xff
lea eax, [esp + 0x43c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movss xmm0, dword [0x498310]
add esp, 0xc
movss xmm1, dword [esp + 0x40]
comiss xmm0, xmm1
jb 0x434c72
movss xmm3, dword [0x4b455c]
movss xmm0, dword [esp + 0x2c4]
subss xmm0, xmm3
movss dword [esp + 8], xmm3
cvttss2si eax, xmm0
mov dword [esp + 0x14], eax
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
cmp byte [0x4b4025], 0
mov dword [esp + 0x298], ecx
je 0x434519
mov dword [esp + 0x1f0], 0x44f1b1fe
lea eax, [esp + 0x70]
mov dword [esp + 0x1f4], 0x3bbd655d
sub esp, 8
mov dword [esp + 0x200], 0x7775c5dc
mov dword [esp + 0x204], 0x1e44bc09
movaps xmm1, xmmword [esp + 0x1f8]
movaps xmmword [esp + 0x78], xmm1
mov dword [esp + 0x228], 0x22df81db
mov dword [esp + 0x22c], 0x3bbd6530
mov dword [esp + 0x230], 0x7775c5dc
mov dword [esp + 0x234], 0x1e44bc09
movaps xmm0, xmmword [esp + 0x228]
xorps xmm0, xmm1
movaps xmmword [esp + 0x78], xmm0
movss xmm0, dword [esp + 0x48]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push eax
lea eax, [esp + 0x444]
push eax
call fcn.00413750
cvttss2si edx, dword [esp + 0x2d4]
lea eax, [esp + 0x448]
push eax
push 0x4ad228
cvttss2si ecx, dword [esp + 0x2d8]
call fcn.0042e860
movss xmm3, dword [0x4b455c]
add esp, 0x18
mov ecx, dword [esp + 0x298]
movss dword [esp + 8], xmm3
cmp byte [0x4b40b9], 0
je 0x434c09
mov eax, 0x55555556
movss xmm2, dword [esp + 0x2c0]
imul ecx
movss dword [esp + 0x140], xmm3
mov eax, 0x55555556
mov esi, edx
shr esi, 0x1f
add esi, edx
imul dword [esp + 0x14]
mov eax, ecx
mov edi, edx
shr edi, 0x1f
add edi, edx
cdq
sub eax, edx
sar eax, 1
movd xmm1, edi
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [esp + 0x134]
cvtdq2ps xmm0, xmm0
subss xmm2, xmm0
movd xmm0, ecx
mov ecx, dword [0x4b3f10]
cvtdq2ps xmm0, xmm0
add ecx, 0x1be4
push ecx
mov dword [esp], 0x40400000
push 0xff010202
push eax
movss dword [esp + 0x1c], xmm0
lea eax, [esp + 0x148]
movd xmm0, dword [esp + 0x20]
cvtdq2ps xmm0, xmm0
push eax
movss dword [esp + 0x2c], xmm2
movss dword [esp + 0x1c], xmm0
movaps xmm0, xmm3
addss xmm0, xmm1
movss dword [esp + 0x144], xmm2
movss dword [esp + 0x14c], xmm2
movss dword [esp + 0x54], xmm0
movss dword [esp + 0x148], xmm0
call fcn.0041d5d0
mov ecx, dword [0x4b3f10]
lea eax, [esp + 0x144]
movss xmm2, dword [esp + 0x1c]
add ecx, 0x1be4
movd xmm0, esi
movaps xmm1, xmm2
cvtdq2ps xmm0, xmm0
push ecx
mov dword [esp], 0x40400000
push 0xff010202
push eax
lea eax, [esp + 0x158]
movss dword [esp + 0x158], xmm2
addss xmm1, xmm0
movss xmm0, dword [esp + 0x14]
push eax
movss dword [esp + 0x158], xmm0
movss dword [esp + 0x160], xmm0
movss dword [esp + 0x58], xmm1
movss dword [esp + 0x154], xmm1
call fcn.0041d5d0
movss xmm1, dword [esp + 0x10]
addss xmm1, dword [esp + 0x1c]
mov ecx, dword [0x4b3f10]
movss xmm2, dword [esp + 8]
add ecx, 0x1be4
movd xmm0, esi
cvtdq2ps xmm0, xmm0
push ecx
mov dword [esp], 0x40400000
movss dword [esp + 0x14], xmm1
movss dword [esp + 0x158], xmm1
subss xmm1, xmm0
movss dword [esp + 0x15c], xmm2
movss dword [esp + 0x164], xmm2
movss dword [esp + 0x3c], xmm1
movss dword [esp + 0x160], xmm1
push 0xff010202
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x168]
push eax
call fcn.0041d5d0
mov ecx, dword [0x4b3f10]
lea eax, [esp + 0x164]
movss xmm0, dword [esp + 0x44]
add ecx, 0x1be4
movss xmm1, dword [esp + 0x10]
push ecx
mov dword [esp], 0x40400000
push 0xff010202
push eax
movss dword [esp + 0x174], xmm0
lea eax, [esp + 0x178]
movss xmm0, dword [esp + 0x14]
push eax
movss dword [esp + 0x174], xmm1
movss dword [esp + 0x17c], xmm1
movss dword [esp + 0x180], xmm0
call fcn.0041d5d0
movss xmm0, dword [esp + 0x1c]
lea eax, [esp + 0x174]
movss xmm1, dword [esp + 0xc]
addss xmm1, dword [esp + 8]
mov ecx, dword [0x4b3f10]
movss dword [esp + 0x174], xmm0
add ecx, 0x1be4
movss dword [esp + 0x17c], xmm0
movd xmm0, edi
cvtdq2ps xmm0, xmm0
push ecx
mov dword [esp], 0x40400000
push 0xff010202
push eax
movss dword [esp + 0x18], xmm1
lea eax, [esp + 0x188]
movss dword [esp + 0x184], xmm1
subss xmm1, xmm0
push eax
movss dword [esp + 0x28], xmm1
movss dword [esp + 0x190], xmm1
call fcn.0041d5d0
mov ecx, dword [0x4b3f10]
lea eax, [esp + 0xb4]
movss xmm0, dword [esp + 0x48]
add ecx, 0x1be4
movss xmm1, dword [esp + 0xc]
push ecx
mov dword [esp], 0x40400000
push 0xff010202
push eax
movss dword [esp + 0xc0], xmm0
lea eax, [esp + 0x190]
movss xmm0, dword [esp + 0x28]
push eax
movss dword [esp + 0xc8], xmm1
movss dword [esp + 0x194], xmm0
movss dword [esp + 0x198], xmm1
call fcn.0041d5d0
mov ecx, dword [0x4b3f10]
lea eax, [esp + 0x18c]
movss xmm0, dword [esp + 0x10]
add ecx, 0x1be4
movss xmm1, dword [esp + 0xc]
push ecx
mov dword [esp], 0x40400000
push 0xff010202
push eax
movss dword [esp + 0x198], xmm0
lea eax, [esp + 0x1a0]
movss xmm0, dword [esp + 0x44]
push eax
movss dword [esp + 0x1a0], xmm1
movss dword [esp + 0x1a4], xmm0
movss dword [esp + 0x1a8], xmm1
call fcn.0041d5d0
mov ecx, dword [0x4b3f10]
add ecx, 0x1be4
movss xmm0, dword [esp + 0xc]
lea eax, [esp + 0x19c]
movss xmm1, dword [esp + 0x10]
push ecx
mov dword [esp], 0x40400000
push 0xff010202
push eax
movss dword [esp + 0x1ac], xmm0
lea eax, [esp + 0x1b0]
movss xmm0, dword [esp + 0x24]
push eax
movss dword [esp + 0x1ac], xmm1
movss dword [esp + 0x1b4], xmm1
movss dword [esp + 0x1b8], xmm0
call fcn.0041d5d0
movss xmm0, dword [esp + 0x44]
lea eax, [esp + 0x1ac]
movss xmm1, dword [esp + 0x1c]
push ecx
mov ecx, dword [0x4b3f10]
mov dword [esp], 0x3f800000
add ecx, 0x1be4
push 0xff00ff00
push eax
movss dword [esp + 0x1bc], xmm0
lea eax, [esp + 0x1c0]
movss xmm0, dword [esp + 0x14]
push eax
movss dword [esp + 0x1bc], xmm1
movss dword [esp + 0x1c4], xmm1
movss dword [esp + 0x1c8], xmm0
call fcn.0041d5d0
movss xmm0, dword [esp + 0x48]
lea eax, [esp + 0x1bc]
movss xmm1, dword [esp + 8]
push ecx
mov ecx, dword [0x4b3f10]
mov dword [esp], 0x3f800000
add ecx, 0x1be4
push 0xff00ff00
push eax
movss dword [esp + 0x1c8], xmm0
lea eax, [esp + 0x108]
movss xmm0, dword [esp + 0x28]
push eax
movss dword [esp + 0x1d0], xmm1
movss dword [esp + 0x10c], xmm0
movss dword [esp + 0x110], xmm1
call fcn.0041d5d0
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0xbc]
movss xmm1, dword [esp + 8]
push ecx
mov ecx, dword [0x4b3f10]
mov dword [esp], 0x3f800000
add ecx, 0x1be4
push 0xff00ff00
push eax
movss dword [esp + 0xc8], xmm0
lea eax, [esp + 0xd0]
movss xmm0, dword [esp + 0x44]
push eax
movss dword [esp + 0xd0], xmm1
movss dword [esp + 0xd4], xmm0
movss dword [esp + 0xd8], xmm1
call fcn.0041d5d0
movss xmm0, dword [esp + 0x44]
lea eax, [esp + 0xd4]
movss xmm1, dword [esp + 0x10]
push ecx
mov ecx, dword [0x4b3f10]
mov dword [esp], 0x3f800000
push 0xff00ff00
push eax
movss dword [esp + 0xe4], xmm0
lea eax, [esp + 0xe8]
movss xmm0, dword [esp + 0x14]
movss dword [esp + 0xe0], xmm1
movss dword [esp + 0xe8], xmm1
movss dword [esp + 0xec], xmm0
push eax
add ecx, 0x1be4
call fcn.0041d5d0
movss xmm0, dword [esp + 0x1c]
lea eax, [esp + 0xe4]
movss xmm1, dword [esp + 0xc]
push ecx
mov ecx, dword [0x4b3f10]
mov dword [esp], 0x3f800000
add ecx, 0x1be4
push 0xff00ff00
push eax
movss dword [esp + 0xf0], xmm0
lea eax, [esp + 0xf8]
movss dword [esp + 0xf8], xmm0
movss xmm0, dword [esp + 0x24]
push eax
movss dword [esp + 0xf8], xmm1
movss dword [esp + 0x100], xmm0
call fcn.0041d5d0
movss xmm0, dword [esp + 0x48]
lea eax, [esp + 0xf4]
movss xmm1, dword [esp + 0xc]
push ecx
mov ecx, dword [0x4b3f10]
mov dword [esp], 0x3f800000
add ecx, 0x1be4
push 0xff00ff00
push eax
movss dword [esp + 0x100], xmm0
lea eax, [esp + 0xd8]
movss xmm0, dword [esp + 0x28]
push eax
movss dword [esp + 0x108], xmm1
movss dword [esp + 0xdc], xmm0
movss dword [esp + 0xe0], xmm1
call fcn.0041d5d0
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0x12c]
movss xmm1, dword [esp + 0xc]
push ecx
mov ecx, dword [0x4b3f10]
mov dword [esp], 0x3f800000
add ecx, 0x1be4
push 0xff00ff00
push eax
movss dword [esp + 0x138], xmm0
lea eax, [esp + 0x130]
movss xmm0, dword [esp + 0x44]
push eax
movss dword [esp + 0x140], xmm1
movss dword [esp + 0x134], xmm0
movss dword [esp + 0x138], xmm1
call fcn.0041d5d0
movss xmm0, dword [esp + 0xc]
lea eax, [esp + 0x11c]
movss xmm1, dword [esp + 0x10]
push ecx
mov ecx, dword [0x4b3f10]
mov dword [esp], 0x3f800000
push 0xff00ff00
push eax
movss dword [esp + 0x12c], xmm0
lea eax, [esp + 0x120]
movss xmm0, dword [esp + 0x24]
lea ecx, [ecx + 0x1be4]
push eax
movss dword [esp + 0x12c], xmm1
movss dword [esp + 0x124], xmm1
movss dword [esp + 0x128], xmm0
call fcn.0041d5d0
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov esi, dword [esp + 0x20]
cmp byte [0x4b4062], 0
je 0x434c1e
mov edx, 0x4ad228
mov ecx, esi
call fcn.004332f0
cmp byte [0x4b4064], 0
je 0x434c6c
movd xmm1, dword [esp + 0x298]
cvtdq2ps xmm1, xmm1
movss xmm0, dword [esp + 0x2c0]
divss xmm1, dword [0x48a0f8]
movd xmm3, dword [esp + 0x14]
cvttss2si edx, dword [esp + 0x2c4]
movss xmm2, dword [esp + 0x2a0]
subss xmm0, xmm1
cvtdq2ps xmm3, xmm3
cvttss2si ecx, xmm0
call fcn.00432eb0
movss xmm1, dword [esp + 0x40]
movss xmm0, dword [0x498300]
comiss xmm0, xmm1
jb 0x4350c0
mov eax, dword [0x4b453c]
movss xmm2, dword [0x4b4540]
movss xmm1, dword [0x4b4544]
cdq
sub eax, edx
sar eax, 1
movd xmm0, eax
mov eax, dword [0x4b40ec]
cvtdq2ps xmm0, xmm0
cdq
sub eax, edx
sar eax, 1
cmp byte [0x4b407c], 0
subss xmm2, xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm2, xmm2
subss xmm1, xmm0
mulss xmm1, xmm1
addss xmm1, xmm2
cvtps2pd xmm0, xmm1
xorps xmm1, xmm1
je 0x434d13
ucomisd xmm1, xmm0
ja 0x434ce4
sqrtsd xmm0, xmm0
jmp 0x434ce9
call sub.api_ms_win_crt_math_l1_1_0.dll__libm_sse2_sqrt_precise
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movd xmm0, dword [0x4ad4d8]
cvtdq2ps xmm0, xmm0
comiss xmm0, xmm1
jbe 0x434d3f
movss xmm0, dword [esp + 0x3c]
comiss xmm0, xmm1
jbe 0x434d3f
movss dword [esp + 0x3c], xmm1
jmp 0x434d39
ucomisd xmm1, xmm0
ja 0x434d1f
sqrtsd xmm0, xmm0
jmp 0x434d24
call sub.api_ms_win_crt_math_l1_1_0.dll__libm_sse2_sqrt_precise
movss xmm1, dword [esp + 0x3c]
cvtsd2ss xmm0, xmm0
comiss xmm1, xmm0
jbe 0x434d3f
movss dword [esp + 0x3c], xmm0
mov dword [0x4b40c4], esi
cmp byte [0x4b405b], 0
je 0x434e6a
push 0
push 4
lea eax, [esp + 0x2d4]
push eax
lea eax, [esi + 0x2f88]
push eax
push dword [0x4b4050]
call edi
cmp dword [esp + 0x2cc], 0
je 0x434e6a
push 0x400
lea eax, [esp + 0x73c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0xb38]
push 0x400
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov edx, dword [esp + 0x2d8]
lea ecx, [esp + 0x298]
add esp, 0xc
mov dword [esp + 0x294], 0
xorps xmm0, xmm0
movq qword [esp + 0x28c], xmm0
call fcn.0042f060
push dword [esp + 0x28c]
lea eax, [esp + 0x73c]
push 0x484cf8
push eax
call fcn.0043f160
add esp, 0xc
lea eax, [esp + 0xb38]
push str.WEAPON:
push eax
call fcn.0043f160
movss xmm0, dword [esp + 0x2cc]
lea eax, [esp + 0x740]
addss xmm0, dword [0x48a294]
cvttss2si ecx, dword [esp + 0x2c8]
push eax
push 0x4ad228
cvttss2si edx, xmm0
call fcn.0042e860
movss xmm0, dword [esp + 0x2d4]
lea eax, [esp + 0xb48]
addss xmm0, dword [0x48a294]
push eax
push 0x4ad058
cvttss2si edx, xmm0
movss xmm0, dword [esp + 0x2d8]
subss xmm0, dword [0x48a2b4]
cvttss2si ecx, xmm0
call fcn.0042e860
add esp, 0x18
cmp byte [0x4b3f0e], 0
je 0x434f95
push 0
push 4
lea eax, [esp + 0x2d8]
push eax
lea eax, [esi + 0x3110]
push eax
push dword [0x4b4050]
call edi
cmp dword [esp + 0x2d0], 0
je 0x434f95
push 0x400
lea eax, [esp + 0xf3c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x1338]
push 0x400
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov edx, dword [esp + 0x2dc]
lea ecx, [esp + 0x28c]
add esp, 0xc
mov dword [esp + 0x288], 0
xorps xmm0, xmm0
movq qword [esp + 0x280], xmm0
call fcn.0042f060
push dword [esp + 0x280]
lea eax, [esp + 0xf3c]
push 0x484cf8
push eax
call fcn.0043f160
add esp, 0xc
lea eax, [esp + 0x1338]
push str.HELMET:
push eax
call fcn.0043f160
movss xmm0, dword [esp + 0x2cc]
lea eax, [esp + 0xf40]
addss xmm0, dword [0x48a2a4]
cvttss2si ecx, dword [esp + 0x2c8]
push eax
push 0x4ad228
cvttss2si edx, xmm0
call fcn.0042e860
movss xmm0, dword [esp + 0x2d4]
lea eax, [esp + 0x1348]
addss xmm0, dword [0x48a2a4]
push eax
push 0x4ad058
cvttss2si edx, xmm0
movss xmm0, dword [esp + 0x2d8]
subss xmm0, dword [0x48a2b4]
cvttss2si ecx, xmm0
call fcn.0042e860
add esp, 0x18
cmp byte [0x4b40cc], 0
je 0x4350c0
push 0
push 4
lea eax, [esp + 0x2dc]
push eax
lea eax, [esi + 0x30d8]
push eax
push dword [0x4b4050]
call edi
cmp dword [esp + 0x2d4], 0
je 0x4350c0
push 0x400
lea eax, [esp + 0x173c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x1b38]
push 0x400
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov edx, dword [esp + 0x2e0]
lea ecx, [esp + 0x280]
add esp, 0xc
mov dword [esp + 0x27c], 0
xorps xmm0, xmm0
movq qword [esp + 0x274], xmm0
call fcn.0042f060
push dword [esp + 0x274]
lea eax, [esp + 0x173c]
push 0x484cf8
push eax
call fcn.0043f160
add esp, 0xc
lea eax, [esp + 0x1b38]
push str.ARMOR:
push eax
call fcn.0043f160
movss xmm0, dword [esp + 0x2cc]
lea eax, [esp + 0x1740]
addss xmm0, dword [0x48a2ac]
cvttss2si ecx, dword [esp + 0x2c8]
push eax
push 0x4ad228
cvttss2si edx, xmm0
call fcn.0042e860
movss xmm0, dword [esp + 0x2d4]
lea eax, [esp + 0x1b48]
addss xmm0, dword [0x48a2ac]
push eax
push 0x4ad058
cvttss2si edx, xmm0
movss xmm0, dword [esp + 0x2d8]
subss xmm0, dword [0x48a2b4]
cvttss2si ecx, xmm0
call fcn.0042e860
add esp, 0x18
mov edx, dword [esp + 0x58]
cmp edx, 0x240005
jne 0x435aef
push 0
push 0xc
lea eax, [esp + 0x31c]
push eax
lea eax, [esi + 0xe38]
push eax
push dword [0x4b4050]
call edi
push 0
push 4
lea eax, [esp + 0x350]
push eax
lea eax, [esi + 0xfc8]
push eax
push dword [0x4b4050]
call edi
mov esi, dword [esp + 0x348]
lea eax, [esp + 0x30c]
push 0
push 4
push eax
mov eax, dword [0x4b40e8]
add eax, 0xf45f14
xor eax, dword [0x4b40c0]
push eax
push dword [0x4b4050]
call edi
push 0
push 4
lea eax, [esp + 0x310]
push eax
mov eax, dword [esp + 0x318]
add eax, 0xfe8
xor eax, dword [0x4b40d8]
push eax
push dword [0x4b4050]
call edi
push 0
push 0xc
lea eax, [esp + 0x1cc]
push eax
mov eax, dword [esp + 0x314]
add eax, 0xe38
push eax
push dword [0x4b4050]
call edi
movss xmm0, dword [esp + 0x1c4]
lea ecx, [esp + 0x268]
subss xmm0, dword [esp + 0x314]
mov edx, esi
mov dword [esp + 0x270], 0
movss dword [esp + 0x298], xmm0
movss xmm0, dword [esp + 0x1c8]
subss xmm0, dword [esp + 0x318]
movss dword [esp + 0x2a0], xmm0
movss xmm0, dword [esp + 0x1cc]
subss xmm0, dword [esp + 0x31c]
movss dword [esp + 0x14], xmm0
xorps xmm0, xmm0
movq qword [esp + 0x268], xmm0
call fcn.0042f060
movss xmm1, dword [esp + 0x2a0]
movss xmm0, dword [esp + 0x298]
mulss xmm0, xmm0
mulss xmm1, xmm1
addss xmm1, xmm0
movss xmm0, dword [esp + 0x14]
mulss xmm0, xmm0
addss xmm1, xmm0
cvtps2pd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm1, xmm0
ja 0x43522b
sqrtsd xmm0, xmm0
jmp 0x435230
call sub.api_ms_win_crt_math_l1_1_0.dll__libm_sse2_sqrt_precise
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
comiss xmm1, dword [0x498310]
movss dword [esp + 8], xmm1
ja 0x4362b4
movss xmm0, dword [0x48a2b8]
comiss xmm0, xmm1
jb 0x435aeb
movq xmm0, qword [esp + 0x314]
sub esp, 0xc
mov eax, dword [esp + 0x328]
mov ecx, esp
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
lea ecx, [esp + 0x2bc]
call fcn.004328b0
add esp, 0xc
test al, al
je 0x435aeb
cmp byte [0x4b405c], 0
je 0x435356
push 0x400
lea eax, [esp + 0x4b3c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x1f38]
push 0x400
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movss xmm0, dword [esp + 0x14]
lea eax, [esp + 0x1f44]
cvtps2pd xmm0, xmm0
add esp, 4
movsd qword [esp], xmm0
push dword [esp + 0x270]
push str._s____0.fm_
push eax
call fcn.0043f160
cvttss2si edx, dword [esp + 0x2c8]
add esp, 0x14
lea eax, [esp + 0x1f38]
push eax
push 0x4ad228
cvttss2si ecx, dword [esp + 0x2b8]
call fcn.0042e860
movss xmm0, dword [esp + 0x2cc]
lea eax, [esp + 0x4b40]
addss xmm0, dword [0x48a2a4]
push eax
push 0x4ad058
cvttss2si edx, xmm0
movss xmm0, dword [esp + 0x2d0]
subss xmm0, dword [0x48a2b4]
cvttss2si ecx, xmm0
call fcn.0042e860
add esp, 0x10
cmp byte [0x4b40e2], 0
je 0x435420
cmp dword [esp + 0x270], 7
jne 0x435420
push 0x400
lea eax, [esp + 0x4f3c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x2338]
push 0x400
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movss xmm0, dword [esp + 0x14]
lea eax, [esp + 0x2344]
cvtps2pd xmm0, xmm0
add esp, 4
movsd qword [esp], xmm0
push dword [esp + 0x270]
push str._s____0.fm_
push eax
call fcn.0043f160
movss xmm0, dword [esp + 0x2c4]
lea eax, [esp + 0x4f4c]
subss xmm0, dword [0x48a2b8]
cvttss2si edx, dword [esp + 0x2c8]
add esp, 0x14
push eax
push 0x4ad058
cvttss2si ecx, xmm0
call fcn.0042e860
cvttss2si edx, dword [esp + 0x2bc]
lea eax, [esp + 0x2340]
push eax
push 0x4ad098
cvttss2si ecx, dword [esp + 0x2c0]
call fcn.0042e860
add esp, 0x10
cmp byte [0x4b40cf], 0
je 0x4354ea
cmp dword [esp + 0x270], 8
jne 0x4354ea
push 0x400
lea eax, [esp + 0x533c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x2738]
push 0x400
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movss xmm0, dword [esp + 0x14]
lea eax, [esp + 0x2744]
cvtps2pd xmm0, xmm0
add esp, 4
movsd qword [esp], xmm0
push dword [esp + 0x270]
push str._s____0.fm_
push eax
call fcn.0043f160
movss xmm0, dword [esp + 0x2c4]
lea eax, [esp + 0x534c]
subss xmm0, dword [0x48a2b8]
cvttss2si edx, dword [esp + 0x2c8]
add esp, 0x14
push eax
push 0x4ad158
cvttss2si ecx, xmm0
call fcn.0042e860
cvttss2si edx, dword [esp + 0x2bc]
lea eax, [esp + 0x2740]
push eax
push 0x4ad0d8
cvttss2si ecx, dword [esp + 0x2c0]
call fcn.0042e860
add esp, 0x10
cmp byte [0x4b4027], 0
je 0x4355b4
cmp dword [esp + 0x270], 9
jne 0x4355b4
push 0x400
lea eax, [esp + 0x573c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x2b38]
push 0x400
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movss xmm0, dword [esp + 0x2bc]
lea eax, [esp + 0x5744]
subss xmm0, dword [0x48a2c0]
cvttss2si edx, dword [esp + 0x2c0]
add esp, 0xc
push eax
push 0x4ad1a8
cvttss2si ecx, xmm0
call fcn.0042e860
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0x2b40]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push dword [esp + 0x270]
push str._s____0.fm_
push eax
call fcn.0043f160
cvttss2si edx, dword [esp + 0x2c8]
add esp, 0x14
lea eax, [esp + 0x2b38]
push eax
push 0x4ad148
cvttss2si ecx, dword [esp + 0x2b8]
call fcn.0042e860
add esp, 8
cmp byte [0x4b4065], 0
je 0x43567e
cmp dword [esp + 0x270], 0xa
jne 0x43567e
push 0x400
lea eax, [esp + 0x5b3c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x2f38]
push 0x400
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movss xmm0, dword [esp + 0x2bc]
lea eax, [esp + 0x5b44]
subss xmm0, dword [0x48a2b8]
cvttss2si edx, dword [esp + 0x2c0]
add esp, 0xc
push eax
push 0x4ad108
cvttss2si ecx, xmm0
call fcn.0042e860
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0x2f40]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push dword [esp + 0x270]
push str._s____0.fm_
push eax
call fcn.0043f160
cvttss2si edx, dword [esp + 0x2c8]
add esp, 0x14
lea eax, [esp + 0x2f38]
push eax
push 0x4ad078
cvttss2si ecx, dword [esp + 0x2b8]
call fcn.0042e860
add esp, 8
cmp byte [0x4b3f0d], 0
je 0x435748
cmp dword [esp + 0x270], 2
jne 0x435748
push 0x400
lea eax, [esp + 0x5f3c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x3338]
push 0x400
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movss xmm0, dword [esp + 0x2bc]
lea eax, [esp + 0x5f44]
subss xmm0, dword [0x48a2b8]
cvttss2si edx, dword [esp + 0x2c0]
add esp, 0xc
push eax
push 0x4ad0d8
cvttss2si ecx, xmm0
call fcn.0042e860
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0x3340]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push dword [esp + 0x270]
push str._s____0.fm_
push eax
call fcn.0043f160
cvttss2si edx, dword [esp + 0x2c8]
add esp, 0x14
lea eax, [esp + 0x3338]
push eax
push 0x4ad208
cvttss2si ecx, dword [esp + 0x2b8]
call fcn.0042e860
add esp, 8
cmp byte [0x4b4024], 0
je 0x435812
cmp dword [esp + 0x270], 0
jne 0x435812
push 0x400
lea eax, [esp + 0x633c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x3738]
push 0x400
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movss xmm0, dword [esp + 0x2bc]
lea eax, [esp + 0x6344]
subss xmm0, dword [0x48a2b8]
cvttss2si edx, dword [esp + 0x2c0]
add esp, 0xc
push eax
push 0x4ad098
cvttss2si ecx, xmm0
call fcn.0042e860
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0x3740]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push dword [esp + 0x270]
push str._s____0.fm_
push eax
call fcn.0043f160
cvttss2si edx, dword [esp + 0x2c8]
add esp, 0x14
lea eax, [esp + 0x3738]
push eax
push 0x4ad0c8
cvttss2si ecx, dword [esp + 0x2b8]
call fcn.0042e860
add esp, 8
cmp byte [0x4b4063], 0
je 0x4358dc
cmp dword [esp + 0x270], 4
jne 0x4358dc
push 0x400
lea eax, [esp + 0x673c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x3b38]
push 0x400
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movss xmm0, dword [esp + 0x2bc]
lea eax, [esp + 0x6744]
subss xmm0, dword [0x48a2c0]
cvttss2si edx, dword [esp + 0x2c0]
add esp, 0xc
push eax
push 0x4ad128
cvttss2si ecx, xmm0
call fcn.0042e860
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0x3b40]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push dword [esp + 0x270]
push str._s____0.fm_
push eax
call fcn.0043f160
cvttss2si edx, dword [esp + 0x2c8]
add esp, 0x14
lea eax, [esp + 0x3b38]
push eax
push 0x4ad108
cvttss2si ecx, dword [esp + 0x2b8]
call fcn.0042e860
add esp, 8
cmp byte [0x4b3f0f], 0
je 0x435957
cmp dword [esp + 0x270], 5
jne 0x435957
push 0x400
lea eax, [esp + 0x3f3c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movss xmm0, dword [esp + 0x14]
lea eax, [esp + 0x3f44]
cvtps2pd xmm0, xmm0
add esp, 4
movsd qword [esp], xmm0
push dword [esp + 0x270]
push str._s____0.fm_
push eax
call fcn.0043f160
cvttss2si edx, dword [esp + 0x2c8]
add esp, 0x14
lea eax, [esp + 0x3f38]
push eax
push 0x4ad1d8
cvttss2si ecx, dword [esp + 0x2b8]
call fcn.0042e860
add esp, 8
cmp byte [0x4b405d], 0
je 0x435a21
cmp dword [esp + 0x270], 0xb
jne 0x435a21
push 0x400
lea eax, [esp + 0x6b3c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x4338]
push 0x400
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movss xmm0, dword [esp + 0x2bc]
lea eax, [esp + 0x6b44]
subss xmm0, dword [0x48a2b8]
cvttss2si edx, dword [esp + 0x2c0]
add esp, 0xc
push eax
push 0x4ad0d8
cvttss2si ecx, xmm0
call fcn.0042e860
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0x4340]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push dword [esp + 0x270]
push str._s____0.fm_
push eax
call fcn.0043f160
cvttss2si edx, dword [esp + 0x2c8]
add esp, 0x14
lea eax, [esp + 0x4338]
push eax
push 0x4ad358
cvttss2si ecx, dword [esp + 0x2b8]
call fcn.0042e860
add esp, 8
cmp byte [0x4b4066], 0
je 0x435aeb
cmp dword [esp + 0x270], 0xe
jne 0x435aeb
push 0x400
lea eax, [esp + 0x6f3c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x4738]
push 0x400
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movss xmm0, dword [esp + 0x2bc]
lea eax, [esp + 0x6f44]
subss xmm0, dword [0x48a2b8]
cvttss2si edx, dword [esp + 0x2c0]
add esp, 0xc
push eax
push 0x4ad148
cvttss2si ecx, xmm0
call fcn.0042e860
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0x4740]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push dword [esp + 0x270]
push str._s____0.fm_
push eax
call fcn.0043f160
cvttss2si edx, dword [esp + 0x2c8]
add esp, 0x14
lea eax, [esp + 0x4738]
push eax
push 0x4ad3d8
cvttss2si ecx, dword [esp + 0x2b8]
call fcn.0042e860
add esp, 8
mov edx, dword [esp + 0x58]
cmp byte [0x4b40e1], 0
jne 0x435b05
cmp byte [0x4b40e0], 0
je 0x4360ea
mov ecx, dword [esp + 0x20]
mov eax, ecx
or eax, dword [esp + 0x54]
je 0x4360ea
cmp edx, 0x20001
je 0x435b29
cmp edx, 0x20000
jne 0x4360ea
push 0
push 0xc
lea eax, [esp + 0x24c]
push eax
lea esi, [ecx + 0xe38]
push esi
push dword [0x4b4050]
call edi
movq xmm0, qword [esp + 0x244]
lea eax, [esp + 0x304]
mov edi, dword [esp + 0x24c]
push 0
push 4
push eax
mov eax, dword [0x4b40e8]
add eax, 0xf45f14
movq qword [esp + 0x2a4], xmm0
xor eax, dword [0x4b40c0]
push eax
push dword [0x4b4050]
movq qword [esp + 0xbc], xmm0
mov dword [esp + 0xc4], edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 4
lea eax, [esp + 0x308]
push eax
mov eax, dword [esp + 0x310]
add eax, 0xfe8
xor eax, dword [0x4b40d8]
push eax
push dword [0x4b4050]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 0xc
lea eax, [esp + 0x3a4]
push eax
mov eax, dword [esp + 0x30c]
add eax, 0xe38
push eax
push dword [0x4b4050]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 0xc
lea eax, [esp + 0x8c]
push eax
push esi
push dword [0x4b4050]
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call esi
movq xmm0, qword [esp + 0x84]
xorps xmm3, xmm3
movq qword [0x4b4530], xmm0
sub esp, 0xc
movss xmm0, dword [esp + 0x90]
mov ecx, esp
subss xmm0, dword [esp + 0x3a8]
movss xmm2, dword [esp + 0xb4]
movss xmm1, dword [esp + 0xb8]
addss xmm2, xmm3
addss xmm1, dword [0x48a0e4]
mov eax, dword [esp + 0x98]
movss dword [esp + 0x2ac], xmm0
movss xmm0, dword [esp + 0x94]
subss xmm0, dword [esp + 0x3ac]
unpcklps xmm2, xmm1
mov dword [0x4b4538], eax
movq qword [ecx], xmm2
movss dword [esp + 0x24], xmm0
movss xmm0, dword [esp + 0x98]
subss xmm0, dword [esp + 0x3b0]
movss dword [esp + 0x44], xmm0
movss xmm0, dword [esp + 0xbc]
addss xmm0, xmm3
movss dword [esp + 0x270], xmm0
mov eax, dword [esp + 0x270]
mov dword [ecx + 8], eax
lea ecx, [esp + 0x384]
call fcn.004328b0
mov byte [esp + 0x43], al
mov ecx, esp
movq xmm0, qword [esp + 0x2a4]
movq qword [ecx], xmm0
mov dword [ecx + 8], edi
lea ecx, [esp + 0x2e4]
call fcn.004328b0
mov cl, byte [esp + 0x43]
add esp, 0xc
or cl, al
mov edi, dword [esp + 0x20]
je 0x4360f4
push 0
push 1
lea eax, [esp + 0x2b7]
push eax
lea eax, [edi + 0xf40]
push eax
push dword [0x4b4050]
call esi
movss xmm0, dword [esp + 0x2dc]
subss xmm0, dword [esp + 0x37c]
movss xmm1, dword [esp + 0x18]
mulss xmm1, xmm1
cvttss2si eax, xmm0
movss xmm0, dword [esp + 0x2a0]
mulss xmm0, xmm0
mov dword [esp + 0x298], eax
cdq
sub eax, edx
addss xmm0, xmm1
sar eax, 1
movss xmm1, dword [esp + 0x38]
mulss xmm1, xmm1
mov dword [esp + 0x14], eax
addss xmm0, xmm1
xorps xmm1, xmm1
cvtps2pd xmm0, xmm0
ucomisd xmm1, xmm0
ja 0x435d73
sqrtsd xmm0, xmm0
jmp 0x435d78
call sub.api_ms_win_crt_math_l1_1_0.dll__libm_sse2_sqrt_precise
xorps xmm2, xmm2
cvtsd2ss xmm2, xmm0
movss xmm0, dword [0x49830c]
comiss xmm0, xmm2
movss dword [esp + 0x38], xmm2
jb 0x4360f4
cmp byte [0x4b40e1], 0
mov al, byte [esp + 0x2af]
je 0x435f49
test al, al
jne 0x435f49
mov dword [esp + 0x1e0], 0x40b2ee81
lea eax, [esp + 0x70]
mov dword [esp + 0x1e4], 0x1e9d0059
sub esp, 8
mov dword [esp + 0x1f0], 0x1a13ebec
mov dword [esp + 0x1f4], 0x1e44bc09
movaps xmm1, xmmword [esp + 0x1e8]
movaps xmmword [esp + 0x78], xmm1
mov dword [esp + 0x208], 0x22df81db
mov dword [esp + 0x20c], 0x3bbd6530
mov dword [esp + 0x210], 0x7775c5dc
mov dword [esp + 0x214], 0x1e44bc09
movaps xmm0, xmmword [esp + 0x208]
xorps xmm0, xmm1
movaps xmmword [esp + 0x78], xmm0
cvtps2pd xmm0, xmm2
movsd qword [esp], xmm0
push eax
lea eax, [esp + 0x544]
push eax
call fcn.00413750
cvttss2si edx, dword [esp + 0x2ec]
lea eax, [esp + 0x548]
push eax
push 0x4ad058
cvttss2si ecx, dword [esp + 0x2f0]
call fcn.0042e860
mov eax, dword [0x4b3f10]
lea ecx, [esp + 0x550]
movss xmm3, dword [0x48a2f4]
add esp, 0x14
movss xmm0, dword [eax + 0x18bc]
mov eax, dword [eax + 0x18b8]
movaps xmm2, xmm0
push 0
push ecx
push ecx
lea ecx, [esp + 0x114]
mov dword [esp], 0xbf800000
push ecx
mov ecx, eax
movss dword [esp + 0x2b4], xmm0
mov dword [esp + 0x2c], eax
call fcn.0041fe90
movss xmm0, dword [esp + 0x104]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x435edd
mov eax, dword [esp + 0x18]
movss xmm1, dword [esp + 0x2a0]
divss xmm1, dword [eax]
subss xmm0, xmm1
addss xmm0, dword [0x48a0d8]
movd xmm3, dword [esp + 0x298]
mov ecx, 0x4ad148
cvtdq2ps xmm3, xmm3
cvttss2si eax, xmm0
movd xmm0, eax
mov eax, dword [esp + 0x14]
cvtdq2ps xmm0, xmm0
movd xmm2, eax
cdq
sub eax, edx
movss dword [esp + 0x104], xmm0
movss xmm0, dword [esp + 0x2d8]
sar eax, 1
cvtdq2ps xmm2, xmm2
movd xmm1, eax
cvtdq2ps xmm1, xmm1
subss xmm0, xmm1
movss xmm1, dword [esp + 0x37c]
call fcn.0042ec60
movss xmm2, dword [esp + 0x38]
mov al, byte [esp + 0x2af]
cmp byte [0x4b40e0], 0
je 0x4360f4
cmp al, 1
jne 0x4360f4
mov dword [esp + 0x210], 0x718cce99
lea eax, [esp + 0x70]
mov dword [esp + 0x214], 0x158d4010
sub esp, 8
mov dword [esp + 0x220], 0x7775a8ba
mov dword [esp + 0x224], 0x1e44bc09
movaps xmm1, xmmword [esp + 0x218]
movaps xmmword [esp + 0x78], xmm1
mov dword [esp + 0x1d8], 0x22df81db
mov dword [esp + 0x1dc], 0x3bbd6530
mov dword [esp + 0x1e0], 0x7775c5dc
mov dword [esp + 0x1e4], 0x1e44bc09
movaps xmm0, xmmword [esp + 0x1d8]
xorps xmm0, xmm1
movaps xmmword [esp + 0x78], xmm0
cvtps2pd xmm0, xmm2
movsd qword [esp], xmm0
push eax
lea eax, [esp + 0x644]
push eax
call fcn.00413750
cvttss2si edx, dword [esp + 0x2ec]
lea eax, [esp + 0x648]
push eax
push 0x4ad098
cvttss2si ecx, dword [esp + 0x2f0]
call fcn.0042e860
mov eax, dword [0x4b3f10]
lea ecx, [esp + 0x650]
movss xmm3, dword [0x48a2f4]
add esp, 0x14
movss xmm0, dword [eax + 0x18bc]
mov eax, dword [eax + 0x18b8]
movaps xmm2, xmm0
push 0
push ecx
push ecx
lea ecx, [esp + 0x11c]
mov dword [esp], 0xbf800000
push ecx
mov ecx, eax
movss dword [esp + 0x2b4], xmm0
mov dword [esp + 0x2c], eax
call fcn.0041fe90
movss xmm0, dword [esp + 0x10c]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x436089
mov eax, dword [esp + 0x18]
movss xmm1, dword [esp + 0x2a0]
divss xmm1, dword [eax]
subss xmm0, xmm1
addss xmm0, dword [0x48a0d8]
mov eax, dword [esp + 0x14]
movd xmm3, dword [esp + 0x298]
cvtdq2ps xmm3, xmm3
cvttss2si ecx, xmm0
movd xmm2, eax
cdq
sub eax, edx
sar eax, 1
movd xmm0, ecx
mov ecx, 0x4ad0d8
cvtdq2ps xmm0, xmm0
movd xmm1, eax
cvtdq2ps xmm1, xmm1
movss dword [esp + 0x10c], xmm0
movss xmm0, dword [esp + 0x2d8]
cvtdq2ps xmm2, xmm2
subss xmm0, xmm1
movss xmm1, dword [esp + 0x37c]
call fcn.0042ec60
jmp 0x4360f4
mov edi, dword [esp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [esp + 0x58], 0x250005
jne 0x4362ba
push 0
push 4
lea eax, [esp + 0x304]
push eax
mov eax, dword [0x4b40e8]
add eax, 0xf45f14
xor eax, dword [0x4b40c0]
push eax
push dword [0x4b4050]
call esi
push 0
push 4
lea eax, [esp + 0x300]
push eax
mov eax, dword [esp + 0x308]
add eax, 0xfe8
xor eax, dword [0x4b40d8]
push eax
push dword [0x4b4050]
call esi
push 0
push 0xc
lea eax, [esp + 0x38c]
push eax
mov eax, dword [esp + 0x304]
add eax, 0xe38
push eax
push dword [0x4b4050]
call esi
push 0
push 0xc
lea eax, [esp + 0x98]
push eax
lea eax, [edi + 0xe38]
push eax
push dword [0x4b4050]
call esi
movss xmm1, dword [esp + 0x90]
sub esp, 0xc
subss xmm1, dword [esp + 0x390]
movq xmm0, qword [esp + 0x9c]
mov eax, esp
mov ecx, dword [esp + 0xa4]
mov dword [0x4b4538], ecx
movq qword [0x4b4530], xmm0
movss dword [esp + 0x2ac], xmm1
movss xmm1, dword [esp + 0xa0]
subss xmm1, dword [esp + 0x394]
movq qword [eax], xmm0
mov dword [eax + 8], ecx
lea ecx, [esp + 0x3e0]
movss dword [esp + 0x2a4], xmm1
movss xmm1, dword [esp + 0xa4]
subss xmm1, dword [esp + 0x398]
movss dword [esp + 0x20], xmm1
call fcn.004328b0
add esp, 0xc
test al, al
je 0x4362ba
cmp byte [0x4b4059], 0
je 0x4362ba
movss xmm0, dword [esp + 0x2a0]
movss xmm1, dword [esp + 0x298]
mulss xmm1, xmm1
mulss xmm0, xmm0
addss xmm0, xmm1
movss xmm1, dword [esp + 0x14]
mulss xmm1, xmm1
addss xmm0, xmm1
xorps xmm1, xmm1
cvtps2pd xmm0, xmm0
ucomisd xmm1, xmm0
ja 0x436264
sqrtsd xmm0, xmm0
jmp 0x436269
call sub.api_ms_win_crt_math_l1_1_0.dll__libm_sse2_sqrt_precise
cvtsd2ss xmm0, xmm0
sub esp, 8
lea eax, [esp + 0x7340]
cvtss2sd xmm0, xmm0
movsd qword [esp], xmm0
push str.Vehicle___0.1f_
push eax
call fcn.0043f160
cvttss2si edx, dword [esp + 0x3e8]
lea eax, [esp + 0x7348]
push eax
push 0x4ad148
cvttss2si ecx, dword [esp + 0x3ec]
call fcn.0042e860
add esp, 0x18
jmp 0x4362ba
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edi, dword [esp + 0x4c]
mov eax, dword [0x4b4550]
inc edi
sub eax, dword [0x4b454c]
sar eax, 4
mov dword [esp + 0x4c], edi
cmp edi, eax
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [esp + 0x4c]
jbe 0x433650
cmp dword [0x4b40c4], 0
je 0x4362fa
cmp byte [0x4b4061], 0
je 0x4362fa
call fcn.00433060
mov ecx, dword [esp + 0x773c]
pop edi
pop esi
xor ecx, esp
call fcn.0047725a
mov esp, ebp
pop ebp
ret