Function at 0x140079110
Capabilities:
Access peb ldr_data
Check for debugger via api
Check for peb beingdebugged flag
Create thread
Encode data using xor
Enumerate gui resources
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push rsi
push r12
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x1401945d8]
xor rax, rsp
mov qword [rbp + 0xc0], rax
lea rcx, [0x140194fa0]
call fcn.140091070
call fcn.140059f60
call fcn.140073380
xor edx, edx
lea rcx, [0x14005a1e0]
call qword [sym.imp.USER32.dll_EnumWindows]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14007916f
mov dword [0], 0xdead
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140079184
mov dword [0], 0xdead
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rbp - 0x50], 0
je 0x1400791a8
mov dword [0], 0xdead
mov rax, qword gs:[0x60]
cmp byte [rax + 2], 0
je 0x1400791c2
mov dword [0], 0xdead
mov rax, qword gs:[0x60]
test byte [rax + 0x68], 0x70
je 0x1400791dc
mov dword [0], 0xdead
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r12d, r12d
lea r8, [rbp - 0x50]
mov rcx, rax
mov qword [rsp + 0x20], r12
lea r9d, [r12 + 8]
lea edx, [r12 + 7]
call sub.ntdll.dll_NtQueryInformationProcess
cmp qword [rbp - 0x50], r12
je 0x140079211
mov dword [0], 0xdead
mov dword [rbp - 0x50], r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 4
mov qword [rsp + 0x20], r12
mov rcx, rax
lea r8, [rbp - 0x50]
lea edx, [r9 + 0x1b]
call sub.ntdll.dll_NtQueryInformationProcess
cmp dword [rbp - 0x50], r12d
jne 0x140079247
mov dword [0], 0xdead
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 8
mov qword [rsp + 0x20], r12
mov rcx, rax
lea r8, [rbp - 0x40]
lea edx, [r9 + 0x16]
call sub.ntdll.dll_NtQueryInformationProcess
cmp qword [rbp - 0x40], r12
je 0x140079279
mov dword [0], 0xdead
call fcn.140059ea0
test eax, eax
je 0x14007928d
mov dword [0], 0xdead
mov rax, qword gs:[0x60]
test byte [rax + 0x68], 0x70
je 0x1400792a7
mov dword [0], 0xdead
mov r8b, 1
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_NtSetDebugFilterState]
test eax, eax
jne 0x1400792c3
mov dword [0], 0xdead
call fcn.140059ec0
test eax, eax
je 0x1400792d7
mov dword [0], 0xdead
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400792ec
mov dword [0], 0xdead
xor edx, edx
lea rcx, [0x14005a1e0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 8
call fcn.1400e882c
lea rsi, [0x140059f40]
test rax, rax
je 0x140079316
mov qword [rax], rsi
jmp 0x140079319
mov rax, r12
lea rcx, [rbp - 0x58]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x1400550b0]
xor ecx, ecx
mov dword [rsp + 0x20], r12d
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x60], rax
test rax, rax
je 0x14007a473
cmp dword [rbp - 0x58], r12d
je 0x14007a468
movaps xmm0, xmmword [rbp - 0x60]
lea rcx, [rbp - 0x40]
movdqa xmmword [rbp - 0x40], xmm0
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x14007a468
lea ecx, [rax + 8]
call fcn.1400e882c
test rax, rax
je 0x140079385
lea rcx, [0x1400581c0]
mov qword [rax], rcx
jmp 0x140079388
mov rax, r12
lea rcx, [rbp - 0x68]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x1400550b0]
xor ecx, ecx
mov dword [rsp + 0x20], r12d
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x70], rax
test rax, rax
je 0x14007a4d1
cmp dword [rbp - 0x68], r12d
je 0x14007a4c6
movaps xmm0, xmmword [rbp - 0x70]
lea rcx, [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm0
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x14007a4c6
lea ecx, [rax + 8]
call fcn.1400e882c
test rax, rax
je 0x1400793f4
lea rcx, [0x140058920]
mov qword [rax], rcx
jmp 0x1400793f7
mov rax, r12
lea rcx, [rbp - 0x78]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x1400550b0]
xor ecx, ecx
mov dword [rsp + 0x20], r12d
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x80], rax
test rax, rax
je 0x14007a4b7
cmp dword [rbp - 0x78], r12d
je 0x14007a4ac
movaps xmm0, xmmword [rbp - 0x80]
lea rcx, [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm0
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x14007a4ac
mov qword [rsp + 0x220], rbx
lea rcx, [0x14005a1e0]
xor edx, edx
mov qword [rsp + 0x228], rdi
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [0x140194e94]
call fcn.14005c2c0
test al, al
je 0x140079690
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140079507
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140079507
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140079502
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1400794e0
cmp r8d, 0xcded1a85
je 0x14007950c
test r9d, r9d
jne 0x1400794c0
mov rax, qword [rax]
jmp 0x140079490
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400795b7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400795b7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400795b2
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140079590
cmp r8d, 0xe80fd3a
je 0x1400795bc
test r9d, r9d
jne 0x140079570
mov rax, qword [rax]
jmp 0x140079540
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140079667
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140079667
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140079662
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140079640
cmp r8d, 0xa52bcaf9
je 0x14007966c
test r9d, r9d
jne 0x140079620
mov rax, qword [rax]
jmp 0x1400795f0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
call rax
mov dword [0], 0xdead
mov ecx, 1
call fcn.1400e882c
lea rcx, [rbp + 0x28]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x1400550e0]
xor ecx, ecx
mov dword [rsp + 0x20], r12d
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x20], rax
test rax, rax
je 0x14007a49d
cmp byte [0x140194d7d], r12b
je 0x1400798f0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140079767
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140079767
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140079762
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140079740
cmp r8d, 0xcded1a85
je 0x14007976c
test r9d, r9d
jne 0x140079720
mov rax, qword [rax]
jmp 0x1400796f0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140079817
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140079817
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140079812
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1400797f0
cmp r8d, 0xe80fd3a
je 0x14007981c
test r9d, r9d
jne 0x1400797d0
mov rax, qword [rax]
jmp 0x1400797a0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400798c7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400798c7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400798c2
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1400798a0
cmp r8d, 0xa52bcaf9
je 0x1400798cc
test r9d, r9d
jne 0x140079880
mov rax, qword [rax]
jmp 0x140079850
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
call rax
mov dword [0], 0xdead
xor edx, edx
lea rcx, [0x14005a1e0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov byte [0x140194e91], r12b
call fcn.14006e6c0
call fcn.14006f8e0
call fcn.14006ee80
call fcn.14006f0d0
call fcn.14006f620
call fcn.14006eb90
call fcn.14006e940
call fcn.14006f8c0
cmp byte [0x140194e91], r12b
je 0x140079b50
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400799c7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400799c7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400799c2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1400799a0
cmp r8d, 0xcded1a85
je 0x1400799cc
test r9d, r9d
jne 0x140079980
mov rax, qword [rax]
jmp 0x140079950
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140079a77
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140079a77
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140079a72
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140079a50
cmp r8d, 0xe80fd3a
je 0x140079a7c
test r9d, r9d
jne 0x140079a30
mov rax, qword [rax]
jmp 0x140079a00
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140079b27
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140079b27
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140079b22
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140079b00
cmp r8d, 0xa52bcaf9
je 0x140079b2c
test r9d, r9d
jne 0x140079ae0
mov rax, qword [rax]
jmp 0x140079ab0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
call rax
mov dword [0], 0xdead
mov ecx, 8
call fcn.1400e882c
test rax, rax
je 0x140079b64
mov qword [rax], rsi
jmp 0x140079b67
mov rax, r12
lea rcx, [rsp + 0x78]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x1400550b0]
xor ecx, ecx
mov dword [rsp + 0x20], r12d
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14007a48d
cmp dword [rsp + 0x78], r12d
je 0x14007a482
movaps xmm0, xmmword [rsp + 0x70]
lea rcx, [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm0
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x14007a482
mov eax, dword [0x140164c64]
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], eax
xor edx, edx
movzx eax, word [0x140164c68]
xor byte [rsp + 0x61], 0x33
xor byte [rsp + 0x62], 0x34
xor byte [rsp + 0x63], 0x35
mov word [rsp + 0x64], ax
xor al, 0x36
xor byte [rsp + 0x65], 0x37
mov byte [rsp + 0x64], al
mov byte [rsp + 0x60], reloc.WLDAP32.dll_Ordinal_46
call fcn.14005c010
test al, al
je 0x140079e21
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140079c97
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140079c97
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140079c92
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140079c70
cmp r8d, 0xcded1a85
je 0x140079c9c
test r9d, r9d
jne 0x140079c50
mov rax, qword [rax]
jmp 0x140079c20
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140079d47
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140079d47
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140079d42
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140079d20
cmp r8d, 0xe80fd3a
je 0x140079d4c
test r9d, r9d
jne 0x140079d00
mov rax, qword [rax]
jmp 0x140079cd0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140079df7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140079df7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140079df2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140079dd0
cmp r8d, 0xa52bcaf9
je 0x140079dfc
test r9d, r9d
jne 0x140079db0
mov rax, qword [rax]
jmp 0x140079d80
mov edx, dword [rdi + 0x24]
add rdx, r10
movzx r8d, word [rdx + r9*2]
mov edx, dword [rdi + 0x1c]
add rdx, r10
mov eax, dword [rdx + r8*4]
add rax, r10
call rax
mov dword [0], 0xdead
xor edx, edx
mov qword [rsp + 0x230], r13
lea rcx, [0x14005a1e0]
call qword [sym.imp.USER32.dll_EnumWindows]
lea rax, [0x14006dca0]
mov dword [rbp - 0x30], 0x50
xor ecx, ecx
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x2c], 0x40
mov qword [rbp - 0x20], r12
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xorps xmm0, xmm0
mov qword [rbp + 0x18], r12
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0x30]
mov rax, qword [str.Impact_Loader]
xorps xmm1, xmm1
mov qword [rbp + 0x10], rax
movdqa xmmword [rbp - 0x10], xmm0
movdqa xmmword [rbp], xmm1
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov rax, qword [rbp - 0x18]
mov r9d, 0x80000000
mov r8, qword [str.Impact_Loader]
xor ecx, ecx
mov rdx, qword [rbp + 0x10]
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], 5
mov dword [rsp + 0x30], 5
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov ecx, reloc.WLDAP32.dll_Ordinal_32
mov qword [0x140194d20], rax
mov rbx, rax
call sub.d3d9.dll_Direct3DCreate9
mov qword [0x140194d70], rax
mov rcx, rax
test rax, rax
je 0x14007a3dc
lea rdx, [0x140194d28]
mov qword [0x140194d30], r12
mov qword [rsp + 0x30], rdx
lea r13, [0x140194d30]
xor edx, edx
mov qword [0x140194d3c], r12
mov dword [0x140194d44], r12d
mov r9, rbx
mov qword [0x140194d4c], r12
mov dword [0x140194d54], r12d
mov qword [0x140194d64], r12
lea r8d, [rdx + 1]
mov dword [0x140194d58], 1
mov dword [0x140194d48], 1
mov dword [0x140194d38], r12d
mov dword [0x140194d5c], 1
mov dword [0x140194d60], 0x50
mov dword [0x140194d6c], 1
mov rax, qword [rax]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0x40
call qword [rax + 0x80]
test eax, eax
js 0x14007a3d5
mov rcx, qword [0x140194d20]
xor edx, edx
mov qword [rsp + 0x1f8], r14
mov qword [rsp + 0x1f0], r15
movaps xmmword [rsp + 0x1e0], xmm6
movaps xmmword [rsp + 0x1d0], xmm7
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x140194d20]
call qword [sym.imp.USER32.dll_UpdateWindow]
xor ecx, ecx
call fcn.14000b3b0
call fcn.140018de0
mov rdi, rax
or dword [rax], 0x400
mov qword [rax + 0x18], r12
call fcn.1400194b0
test dword [rdi], 0x400
je 0x14007a009
mov dword [rax + 0xc], r12d
mov dword [rax + 0xf0], 0x3f800000
mov rcx, qword [0x140194d20]
call fcn.140040e00
mov rcx, qword [0x140194d28]
call fcn.14003f6f0
movss xmm2, dword [0x1400f3e80]
lea rdx, str.C:WindowsFontsUbuntu_Regular.ttf
mov rcx, qword [rdi + 0xa0]
xor r9d, r9d
mov qword [rsp + 0x20], r12
call fcn.14002d630
movss xmm2, dword [0x140164ccc]
lea rdx, str.C:WindowsFontsUbuntu_Regular.ttf
mov rcx, qword [rdi + 0xa0]
xor r9d, r9d
mov rsi, rax
mov qword [rsp + 0x20], r12
call fcn.14002d630
movss xmm2, dword [0x1400f3e7c]
lea rdx, str.C:WindowsFontsUbuntu_Regular.ttf
mov rcx, qword [rdi + 0xa0]
xor r9d, r9d
mov r14, rax
mov qword [rsp + 0x20], r12
call fcn.14002d630
lea rcx, [rbp + 0x30]
mov r15, rax
call fcn.14002c570
movss xmm3, dword [0x1400f3f8c]
lea rax, [rbp + 0x30]
mov byte [rbp + 0x78], 1
lea rbx, [0x140164c6c]
mov byte [rbp + 0x50], 1
lea rdx, [0x1400fb0d0]
mov rcx, qword [rdi + 0xa0]
mov r8d, 0x3934b
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call fcn.14002d970
movss xmm3, dword [0x140164cc8]
lea rdx, [0x1400fb0d0]
mov rcx, qword [rdi + 0xa0]
mov r8d, 0x3934b
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r12
call fcn.14002d970
mov rbx, qword [rdi + 0xa0]
mov rcx, rbx
call fcn.1400307b0
movss xmm3, dword [0x1400f3f90]
lea rdx, [0x140134420]
mov qword [rsp + 0x28], rax
mov r8d, 0x2ce4b
mov rcx, rbx
mov qword [rsp + 0x20], r12
call fcn.14002d970
call fcn.140078890
movss xmm7, dword [0x1400ed0e0]
xorps xmm0, xmm0
movups xmmword [0x140194e50], xmm0
movups xmmword [0x140194e60], xmm0
movups xmmword [0x140194e70], xmm0
xorps xmm6, xmm6
nop dword [rax]
nop word [rax + rax]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [0x140194e50]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x14007a1b0
lea rcx, [0x140194e50]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [0x140194e50]
call qword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x14007a334
call fcn.14003f8d0
call fcn.1400411c0
call fcn.14001fd20
cmp dword [0x140195290], r12d
jne 0x14007a22b
movss xmm0, dword [0x140194218]
ucomiss xmm0, xmm6
mov rax, qword [0x140194d28]
mov qword [0x140195280], rax
jp 0x14007a21f
jne 0x14007a21f
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rbp - 0x60]
call qword [sym.imp.USER32.dll_GetWindowRect]
movd xmm0, dword [rbp - 0x58]
movd xmm1, dword [rbp - 0x54]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [0x140194210], xmm0
movss dword [0x140194214], xmm1
mov dword [0x140195290], 1
jmp 0x14007a239
mov r8, r15
mov rdx, rsi
mov rcx, r14
call fcn.140073880
call fcn.140015be0
mov rcx, qword [0x140194d28]
mov r9d, 3
mov dword [rsp + 0x30], r12d
xor r8d, r8d
movss dword [rsp + 0x28], xmm7
xor edx, edx
mov dword [rsp + 0x20], r12d
mov rax, qword [rcx]
call qword [rax + 0x158]
mov rcx, qword [0x140194d28]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x14007a29f
call fcn.140021c60
call fcn.1400188a0
mov rcx, rax
call fcn.14003f9d0
mov rcx, qword [0x140194d28]
mov rax, qword [rcx]
call qword [rax + 0x150]
test dword [rdi], 0x400
je 0x14007a2b5
call fcn.140028480
xor edx, edx
xor ecx, ecx
call fcn.1400228f0
mov rcx, qword [0x140194d28]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r12
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x14007a32b
mov rcx, qword [0x140194d28]
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
cmp eax, 0x88760869
jne 0x14007a32b
call fcn.14003f790
mov rcx, qword [0x140194d28]
mov rdx, r13
mov rax, qword [rcx]
call qword [rax + 0x80]
cmp eax, 0x8876086c
jne 0x14007a326
mov r8d, gethostname
lea rdx, str.C:UserselyaaDownloadsimpact_v13__1_zchairs_loaderMain.h
lea rcx, [0x1400ed868]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
call fcn.14003f260
cmp byte [reloc.WS2_32.dll_accept], r12b
je 0x14007a343
cmp dword [0x140194e58], 0x12
jne 0x14007a170
jmp 0x14007a34d
mov dword [0x140194e58], 0x12
call fcn.140040670
call fcn.140041920
xor ecx, ecx
call fcn.14000b880
mov rcx, qword [0x140194e08]
movaps xmm7, xmmword [rsp + 0x1d0]
movaps xmm6, xmmword [rsp + 0x1e0]
mov r15, qword [rsp + 0x1f0]
mov r14, qword [rsp + 0x1f8]
test rcx, rcx
je 0x14007a3a0
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [0x140194e08]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [0x140194e00]
test rcx, rcx
je 0x14007a3b2
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [0x140194df0]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [0x140194db8]
mov rcx, qword [0x140194de0]
call qword [sym.imp.USER32.dll_UnregisterClassA]
jmp 0x14007a425
mov rcx, qword [0x140194d70]
mov rdx, qword [0x140194d28]
test rdx, rdx
je 0x14007a3ff
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [0x140194d70]
mov qword [0x140194d28], r12
test rcx, rcx
je 0x14007a411
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x140194d70], r12
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.USER32.dll_UnregisterClassA]
mov r12d, 1
cmp dword [rbp + 0x28], 0
mov r13, qword [rsp + 0x230]
je 0x14007a43a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
mov rbx, qword [rsp + 0x220]
mov eax, r12d
mov rdi, qword [rsp + 0x228]
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.1400e80c0
add rsp, 0x200
pop r12
pop rsi
pop rbp
ret
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, 6
mov dword [rbp - 0x58], r12d
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, 6
mov dword [rsp + 0x78], r12d
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, 6
mov dword [rbp + 0x28], r12d
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, 6
mov dword [rbp - 0x78], r12d
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, 6
mov dword [rbp - 0x68], r12d
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3