Function at 0x1400013b0
Capabilities:
Create thread
Execute command
Inject thread
Set console window title
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x890
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x140008010]
xor rax, rsp
mov qword [rbp + 0x820], rax
movabs rbx, 0x66d4f010cfc189ba
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x358f3b36ce465650
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs r14, 0x2ff4c23f8086daf9
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x5e0], rax
movabs rsi, 0x35dd74628d031c1e
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x5e8], rax
movdqa xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [rbp + 0x5e0]
movdqa xmmword [rbp + 0x20], xmm0
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
xor r13d, r13d
mov dword [rbp + 0x400], r13d
mov dword [rbp + 0x404], r13d
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x5d0], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x5d8], rax
movdqa xmm0, xmmword [rbp + 0x40]
xorps xmm0, xmmword [rbp + 0x5d0]
movdqa xmmword [rbp + 0x40], xmm0
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x428]
call fcn.140002a80
nop
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x5c0], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x5c8], rax
movdqa xmm0, xmmword [rbp + 0x50]
xorps xmm0, xmmword [rbp + 0x5c0]
movdqa xmmword [rbp + 0x50], xmm0
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x408]
call fcn.140002a80
nop
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x5b0], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x5b8], rax
movdqa xmm0, xmmword [rbp + 0x60]
xorps xmm0, xmmword [rbp + 0x5b0]
movdqa xmmword [rbp + 0x60], xmm0
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x448]
call fcn.140002a80
nop
movabs rdi, 0x2ff4c23f80f5b69a
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x5a0], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x5a8], rax
movdqa xmm0, xmmword [rbp + 0x70]
xorps xmm0, xmmword [rbp + 0x5a0]
movdqa xmmword [rbp + 0x70], xmm0
lea rcx, [rbp + 0x70]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movabs rax, 0x2fb0e24defeab59a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x590], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x598], rax
movdqa xmm0, xmmword [rbp + 0x30]
xorps xmm0, xmmword [rbp + 0x590]
movdqa xmmword [rbp + 0x30], xmm0
lea rcx, [rbp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
movabs rax, 0x158f3b36ce465650
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
movabs rax, 0xb2b6cf5197352441
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x130], rax
movabs r15, 0x99fbbb2cd432b9b0
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x138], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x680], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x688], rax
movabs r12, 0xb2b6cf519735244b
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x690], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x698], rax
vmovdqu ymm0, ymmword [rbp + 0x120]
vpxor ymm1, ymm0, ymmword [rbp + 0x680]
vmovdqa ymmword [rbp + 0x120], ymm1
lea rdx, [rbp + 0x120]
vzeroupper
call fcn.140002cb0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0x2ff4c23f8086daf3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x580], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x588], rax
movdqa xmm0, xmmword [rbp + 0x80]
xorps xmm0, xmmword [rbp + 0x580]
movdqa xmmword [rbp + 0x80], xmm0
lea rdx, [rbp + 0x80]
call fcn.140002cb0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0x4a9eac76a0dbeba2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
movabs rax, 0x70fd2950d609687d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x188], rax
movabs rax, 0x92ebfc0a9d414d33
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x190], rax
movabs rax, 0xed98ce5ea041d7f9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x198], rax
movabs rax, 0xe3e5fb99af347e54
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
movabs rax, 0x8bbcc44ccbd5a106
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x640], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x648], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x650], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x658], rax
movabs rbx, 0x93aadb93dc5a113d
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x660], rax
movabs rax, 0x8bbce476a5bac872
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x668], rax
vmovdqu ymm0, ymmword [rbp + 0x180]
vpxor ymm1, ymm0, ymmword [rbp + 0x640]
vmovdqa ymmword [rbp + 0x180], ymm1
vmovdqa xmm0, xmmword [rbp + 0x1a0]
vxorps xmm0, xmm0, xmmword [rbp + 0x660]
vmovdqa xmmword [rbp + 0x1a0], xmm0
lea rdx, [rbp + 0x180]
vzeroupper
call fcn.140002cb0
lea rdx, [rbp + 0x404]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x540], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x548], rax
movdqa xmm0, xmmword [rbp + 0x90]
xorps xmm0, xmmword [rbp + 0x540]
movdqa xmmword [rbp + 0x90], xmm0
lea rcx, [rbp + 0x90]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, dword [rbp + 0x404]
sub ecx, 1
je 0x140001a3d
sub ecx, 1
je 0x1400024dd
cmp ecx, 1
je 0x140001a0f
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0xf9ab550eeedb4ac
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x480], rax
movabs rax, 0x50a91703ff62745d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x488], rax
movabs rax, 0xb2b6cf51971b5739
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x490], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x498], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x4e0], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x4e8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x4f0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x4f8], rax
vmovdqu ymm0, ymmword [rbp + 0x480]
vpxor ymm1, ymm0, ymmword [rbp + 0x4e0]
vmovdqa ymmword [rbp + 0x480], ymm1
lea rdx, [rbp + 0x480]
jmp 0x1400028f5
xor r9d, r9d
lea r8, str.help
lea rdx, str.1._Ensure_that_the_injector_and_the_dll_you_wish_to_use_are_located_in_the_same_folder._n2._Select_1_n3._Select_Desired_Game_nInjector_made_by_sixifyyyyyy
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400013b0
jmp 0x1400028fd
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0x60b3f86cc3a6f3c8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0x3fef3236ad2a2e14
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movabs rax, 0xd6d8ae3cfa5a476b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
movabs rax, 0x99fbbb2cd432998a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x6a0], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x6a8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x6b0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x6b8], rax
vmovdqu ymm0, ymmword [rbp + 0x100]
vpxor ymm1, ymm0, ymmword [rbp + 0x6a0]
vmovdqa ymmword [rbp + 0x100], ymm1
lea rdx, [rbp + 0x100]
vzeroupper
call fcn.140002cb0
lea rdx, [rbp + 0x400]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0x4a99a351a0ca96bd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x35dd74628d233c24
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x550], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x558], rax
movdqa xmm0, xmmword [rbp + 0xa0]
xorps xmm0, xmmword [rbp + 0x550]
movdqa xmmword [rbp + 0xa0], xmm0
lea rdx, [rbp + 0xa0]
call fcn.140002cb0
lea rdx, [rbp + 0x448]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140002e80
mov eax, dword [rbp + 0x400]
cmp eax, 1
jne 0x140001df5
movabs rax, 0x286a74beef3b5ba
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0x7fd1109e471684d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x6c0], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x6c8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x6d0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x6d8], rax
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x6c0]
vmovdqa ymmword [rbp + 0xe0], ymm1
lea rax, [rbp + 0xe0]
mov rdi, 0xffffffffffffffff
vzeroupper
inc rdi
cmp byte [rax + rdi], 0
jne 0x140001c70
mov rax, qword [rbp + 0x440]
cmp rdi, rax
ja 0x140001cb7
lea rbx, [rbp + 0x428]
cmp rax, 0x10
cmovae rbx, qword [rbp + 0x428]
mov qword [rbp + 0x438], rdi
mov r8, rdi
lea rdx, [rbp + 0xe0]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], 0
jmp 0x140001ccd
lea r9, [rbp + 0xe0]
mov rdx, rdi
lea rcx, [rbp + 0x428]
call fcn.140003210
movabs rax, 0x5fabb651e5efb69a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0x1bbc1903ff6c727f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0xb2b6cf519759482f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x6e0], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x6e8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x6f0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x6f8], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x6e0]
vmovdqa ymmword [rbp + 0xc0], ymm1
lea rax, [rbp + 0xc0]
mov rdi, 0xffffffffffffffff
vzeroupper
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140001d90
mov rax, qword [rbp + 0x420]
cmp rdi, rax
ja 0x140001dda
lea rbx, [rbp + 0x408]
cmp rax, 0x10
cmovae rbx, qword [rbp + 0x408]
mov qword [rbp + 0x418], rdi
mov r8, rdi
lea rdx, [rbp + 0xc0]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], 0
jmp 0x1400020c2
lea r9, [rbp + 0xc0]
mov rdx, rdi
lea rcx, [rbp + 0x408]
call fcn.140003210
jmp 0x1400020c2
cmp eax, 2
jne 0x14000205c
movabs rax, 0x286a74beef3b5ba
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
movabs rax, 0x15e71109e471684d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
movabs rax, 0xfd96a330f55a480c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
movabs rax, 0xfc8dd25fba57dfd6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
movabs rax, 0xf0cfa9fa987a3c1d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
movabs rax, 0x8bbce44f85fefb06
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x600], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x608], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x610], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x618], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x620], rax
movabs rax, 0x8bbce476a5bac872
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x628], rax
vmovdqu ymm0, ymmword [rbp + 0x140]
vpxor ymm1, ymm0, ymmword [rbp + 0x600]
vmovdqa ymmword [rbp + 0x140], ymm1
vmovdqa xmm0, xmmword [rbp + 0x160]
vxorps xmm0, xmm0, xmmword [rbp + 0x620]
vmovdqa xmmword [rbp + 0x160], xmm0
lea rax, [rbp + 0x140]
mov rdi, 0xffffffffffffffff
vzeroupper
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140001f40
mov rax, qword [rbp + 0x440]
cmp rdi, rax
ja 0x140001f87
lea rbx, [rbp + 0x428]
cmp rax, 0x10
cmovae rbx, qword [rbp + 0x428]
mov qword [rbp + 0x438], rdi
mov r8, rdi
lea rdx, [rbp + 0x140]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], 0
jmp 0x140001f9d
lea r9, [rbp + 0x140]
mov rdx, rdi
lea rcx, [rbp + 0x428]
call fcn.140003210
movabs rax, 0x4bdab651e5efb69a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
movabs rax, 0x35dd74628d037072
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x560], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x568], rax
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp + 0x560]
movdqa xmmword [rbp + 0x10], xmm0
lea rax, [rbp + 0x10]
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rax + rdi], 0
jne 0x140002003
mov rax, qword [rbp + 0x420]
cmp rdi, rax
ja 0x140002047
lea rbx, [rbp + 0x408]
cmp rax, 0x10
cmovae rbx, qword [rbp + 0x408]
mov qword [rbp + 0x418], rdi
mov r8, rdi
lea rdx, [rbp + 0x10]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
jmp 0x1400020c2
lea r9, [rbp + 0x10]
mov rdx, rdi
lea rcx, [rbp + 0x408]
call fcn.140003210
jmp 0x1400020c2
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x570], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x578], rax
movdqa xmm0, xmmword [rbp + 0xb0]
xorps xmm0, xmmword [rbp + 0x570]
movdqa xmmword [rbp + 0xb0], xmm0
lea rdx, [rbp + 0xb0]
call fcn.140002cb0
lea rdx, [rbp + 0x428]
cmp qword [rbp + 0x440], 0x10
cmovae rdx, qword [rbp + 0x428]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x140008718], rax
lea rdx, [0x140008708]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [0x140008708]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140008710], rax
lea rbx, [rbp + 0x408]
cmp qword [rbp + 0x420], 0x10
cmovae rbx, qword [rbp + 0x408]
mov edx, dword [0x140008708]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov dword [rbp + 0x1c0], 0x238
nop dword [rax + rax]
lea rcx, [rbp + 0x1f0]
mov r9, rbx
sub r9, rcx
nop dword [rax]
movzx r8d, byte [rcx]
movzx edx, byte [rcx + r9]
sub r8d, edx
jne 0x140002175
inc rcx
test edx, edx
jne 0x140002160
mov rcx, rdi
test r8d, r8d
je 0x140002196
lea rdx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x140002150
mov eax, dword [rbp + 0x400]
jmp 0x1400021a2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x1d8]
mov dword [0x140008720], eax
lea rcx, [rbp + 0x448]
cmp qword [rbp + 0x460], 0x10
cmovae rcx, qword [rbp + 0x448]
lea rdx, [0x1400054e4]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
test rax, rax
je 0x1400026dd
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdx, qword [0x140008728]
test rdx, rdx
je 0x140002602
mov eax, dword [rdx]
mov dword [rbp + 0x700], eax
movzx eax, byte [rdx + 4]
mov byte [rbp + 0x704], al
mov qword [rsp + 0x20], r13
mov r9d, 5
lea r8, [rbp + 0x700]
mov rcx, qword [0x140008710]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, [rbp + 0x448]
cmp qword [rbp + 0x460], 0x10
cmovae rcx, qword [rbp + 0x448]
mov ebx, dword [0x140008708]
test ebx, ebx
jne 0x1400023ad
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0x4b91ae56e1c0faf3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4e0], rax
movabs rax, 0x50b71a2bad6c483e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4e8], rax
movabs rax, 0xd3d3a301b7195028
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4f0], rax
movabs rax, 0xb99fda498612dcc3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4f8], rax
movabs rax, 0xe7c9aee1a8297f74
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x500], rax
movabs rax, 0x8bbcca58d6d4a71b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x508], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x480], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x488], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x490], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x498], rax
movabs rax, 0x93aadb93dc5a113d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4a0], rax
movabs rax, 0x8bbce476a5bac872
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4a8], rax
vmovdqu ymm0, ymmword [rbp + 0x4e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x480]
vmovdqa ymmword [rbp + 0x4e0], ymm1
vmovdqa xmm0, xmmword [rbp + 0x500]
vxorps xmm0, xmm0, xmmword [rbp + 0x4a0]
vmovdqa xmmword [rbp + 0x500], xmm0
lea rdx, [rbp + 0x4e0]
vzeroupper
call fcn.140002cb0
lea rdx, [0x140003060]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.1400012c0
mov ecx, 0x7d0
jmp 0x1400024d6
xor r9d, r9d
lea r8, [rbp + 0x710]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov r8d, ebx
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
mov qword [rsp + 0x20], r13
mov r9d, 0x104
lea r8, [rbp + 0x710]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rbx
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0x4a80a15aeae893f3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4e0], rax
movabs rax, 0x35dd742ec1473c7a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4e8], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x480], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x488], rax
movdqa xmm0, xmmword [rbp + 0x4e0]
xorps xmm0, xmmword [rbp + 0x480]
movdqa xmmword [rbp + 0x4e0], xmm0
lea rdx, [rbp + 0x4e0]
call fcn.140002cb0
lea rdx, [0x140003060]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.1400012c0
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rdx, qword [rbp + 0x460]
cmp rdx, 0x10
jb 0x14000251e
inc rdx
mov rcx, qword [rbp + 0x448]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002519
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002946
call fcn.1400034c4
movdqa xmm0, xmmword [0x1400055a0]
movdqu xmmword [rbp + 0x458], xmm0
mov byte [rbp + 0x448], 0
mov rdx, qword [rbp + 0x420]
cmp rdx, 0x10
jb 0x140002576
inc rdx
mov rcx, qword [rbp + 0x408]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002571
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400029a1
call fcn.1400034c4
mov qword [rbp + 0x418], r13
mov qword [rbp + 0x420], 0xf
mov byte [rbp + 0x408], 0
mov rdx, qword [rbp + 0x440]
cmp rdx, 0x10
jb 0x1400025d0
inc rdx
mov rcx, qword [rbp + 0x428]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400025cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002a0a
call fcn.1400034c4
xor eax, eax
mov rcx, qword [rbp + 0x820]
xor rcx, rsp
call fcn.140003460
lea r11, [rsp + 0x890]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0x5cb5e24deff4a8bc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x480], rax
movabs rax, 0x5a895414e8473c75
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x488], rax
movabs rax, 0xb2b6cf5bef5c626b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x490], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x498], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x4e0], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x4e8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x4f0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x4f8], rax
vmovdqu ymm0, ymmword [rbp + 0x4e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x480]
vmovdqa ymmword [rbp + 0x480], ymm1
lea rdx, [rbp + 0x480]
vzeroupper
call fcn.140002cb0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0xf90ae4aefc5faf3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4e0], rax
movabs rax, 0x51b31d24ad777350
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4e8], rax
movabs rax, 0xd7d2a627f847746b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4f0], rax
movabs rax, 0xd4d39b60987699d4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4f8], rax
movabs rax, 0xf6d8aec0fc3f7a5c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x500], rax
movabs rax, 0xfdddac56d0d59152
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x508], rax
movabs rax, 0x4b2dcf353f43bfda
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x510], rax
movabs rax, 0xfd99ef7f141ebc4d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x518], rax
movabs rax, 0xb8ec31193e83aac2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x520], rax
movabs rdx, 0x502647fa9e524a86
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x528], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x480], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x488], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x490], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x498], rax
movabs rax, 0x93aadb93dc5a113d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4a0], rax
movabs rax, 0x8bbce476a5bac872
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4a8], rax
movabs rax, 0x6b49aa4546179fbf
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4b0], rax
movabs rax, 0x98eb9d10573ec804
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4b8], rax
movabs rax, 0xb8ec313747efdea1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4c0], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x4c8], rax
vmovdqu ymm0, ymmword [rbp + 0x4e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x480]
vmovdqa ymmword [rbp + 0x4e0], ymm1
vmovdqu ymm0, ymmword [rbp + 0x500]
vpxor ymm1, ymm0, ymmword [rbp + 0x4a0]
vmovdqa ymmword [rbp + 0x500], ymm1
vmovdqa xmm0, xmmword [rbp + 0x520]
vxorps xmm0, xmm0, xmmword [rbp + 0x4c0]
vmovdqa xmmword [rbp + 0x520], xmm0
lea rdx, [rbp + 0x4e0]
vzeroupper
call fcn.140002cb0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400013b0
nop
mov rdx, qword [rbp + 0x460]
cmp rdx, 0x10
jb 0x140002952
inc rdx
mov rcx, qword [rbp + 0x448]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000294d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000294d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400034c4
movdqa xmm0, xmmword [0x1400055a0]
movdqu xmmword [rbp + 0x458], xmm0
mov byte [rbp + 0x448], 0
mov rdx, qword [rbp + 0x420]
cmp rdx, 0x10
jb 0x1400029ad
inc rdx
mov rcx, qword [rbp + 0x408]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400029a8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400029a8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400034c4
mov qword [rbp + 0x418], r13
mov qword [rbp + 0x420], 0xf
mov byte [rbp + 0x408], 0
mov rdx, qword [rbp + 0x440]
cmp rdx, 0x10
jb 0x1400025d0
inc rdx
mov rcx, qword [rbp + 0x428]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400025cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400025cb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3