Function at 0x14002d5b0
Capabilities:
Create thread
Encode data using xor
Enumerate processes
Log keystrokes via polling
Query environment variable
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x228]
sub rsp, 0x310
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov rax, qword [0x1400b7040]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
xor ebx, ebx
lea rcx, [rbp + 0x50]
call fcn.1400030f0
nop
mov edx, 0x55
mov r8d, 0xf
lea rcx, [rbp + 0x50]
call fcn.140028ca0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rsi, rax
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
add eax, 0xffffff10
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
lea eax, [rdi - 0x2a8]
cdq
sub eax, edx
sar eax, 1
mov edx, eax
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0xf0
mov r9d, 0x2a8
mov rcx, rsi
call qword [sym.imp.USER32.dll_MoveWindow]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdi, rax
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov edx, dword [rsp + 0x48]
or edx, 4
mov dword [rsp + 0x48], edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
call fcn.140001520
lea rcx, str.USERNAME
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14002d6d0
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.1400017e0
nop
mov r8, qword [rbp + 0x20]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
sub rax, r8
mov r15d, 8
lea r14, str.welcome
cmp rax, r15
jb 0x14002d77f
lea rax, [r8 + 8]
mov qword [rbp + 0x20], rax
lea rdi, [rbp + 0x10]
cmp rcx, 0xf
cmova rdi, qword [rbp + 0x10]
lea rax, [0x1400988b0]
cmp rax, rdi
jbe 0x14002d743
lea rax, [rdi + r8]
cmp r14, rax
ja 0x14002d743
cmp rdi, r14
ja 0x14002d73b
mov rsi, rbx
jmp 0x14002d746
mov rsi, rdi
sub rsi, r14
jmp 0x14002d746
mov rsi, r15
inc r8
lea rcx, [rdi + 8]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
sub r15, rsi
lea rdx, [r14 + 8]
add rdx, rsi
lea rcx, [rdi + rsi]
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x10]
jmp 0x14002d79e
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
xor r9d, r9d
movzx r8d, byte [rsp + 0x40]
mov rdx, r15
lea rcx, [rbp + 0x10]
call fcn.140002380
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rbp]
mov rdx, qword [rbp + 8]
mov rax, rdx
sub rax, rcx
cmp rax, 3
jb 0x14002d816
lea rax, [rcx + 3]
mov qword [rbp], rax
lea rdi, [rbp - 0x10]
cmp rdx, 0xf
cmova rdi, qword [rbp - 0x10]
add rdi, rcx
mov r8d, 3
lea rdx, [0x1400988a4]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + 3], 0
lea rax, [rbp - 0x10]
jmp 0x14002d83a
mov qword [rsp + 0x20], 3
lea r9, [0x1400988a4]
movzx r8d, byte [rsp + 0x40]
mov edx, 3
lea rcx, [rbp - 0x10]
call fcn.1400021f0
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0xb
jb 0x14002d8b2
lea rax, [rcx + 0xb]
mov qword [rbp - 0x20], rax
lea rdi, [rbp - 0x30]
cmp rdx, 0xf
cmova rdi, qword [rbp - 0x30]
add rdi, rcx
mov r8d, 0xb
lea rdx, str.Oct_19_2024
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + 0xb], 0
lea rax, [rbp - 0x30]
jmp 0x14002d8d6
mov qword [rsp + 0x20], 0xb
lea r9, str.Oct_19_2024
movzx r8d, byte [rsp + 0x40]
mov edx, 0xb
lea rcx, [rbp - 0x30]
call fcn.1400021f0
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x38]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x14002d938
lea rax, [rcx + 1]
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x50]
cmp rdx, 0xf
cmova rax, qword [rbp - 0x50]
mov word [rax + rcx], 0xa
lea rax, [rbp - 0x50]
jmp 0x14002d95c
mov qword [rsp + 0x20], 1
lea r9, [0x140098894]
movzx r8d, byte [rsp + 0x40]
mov edx, 1
lea rcx, [rbp - 0x50]
call fcn.1400021f0
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x14002d9c7
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002d9c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002d9c2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140075ab4
movdqa xmm6, xmmword [0x140098b50]
movdqu xmmword [rbp - 0x40], xmm6
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x14002da16
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002da11
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002da11
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140075ab4
movdqu xmmword [rbp - 0x20], xmm6
mov byte [rbp - 0x30], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x14002da5d
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002da58
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002da58
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140075ab4
movdqu xmmword [rbp], xmm6
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x14002daa4
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002da9f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002da9f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140075ab4
movdqu xmmword [rbp + 0x20], xmm6
mov byte [rbp + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x140098b90]
movdqu xmmword [rbp - 0x70], xmm1
mov eax, dword [str.GREEN]
mov dword [rbp - 0x80], eax
movzx eax, byte [0x1400988b8]
mov byte [rbp - 0x7c], al
mov byte [rbp - 0x7b], 0
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x50]
call fcn.1400286e0
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x14002db30
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002db2b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002db2b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140075ab4
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x140098b80]
movdqu xmmword [rbp - 0x70], xmm1
mov dword [rbp - 0x80], 0x4b4e4950
mov byte [rbp - 0x7c], 0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
mov ecx, 0x20
call fcn.140075a78
mov qword [rsp + 0x60], rax
movdqa xmm0, xmmword [0x140098be0]
movdqu xmmword [rsp + 0x70], xmm0
movups xmm0, xmmword [str.waiting_for_fortnite..._n]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1400988d0]
movsd qword [rax + 0x10], xmm0
mov byte [rax + 0x18], 0
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x50]
call fcn.1400286e0
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14002dbf0
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002dbeb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002dbeb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140075ab4
movdqu xmmword [rsp + 0x70], xmm6
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x14002dc39
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002dc34
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002dc34
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140075ab4
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
mov r8d, 3
lea rcx, str..IoAuraCc
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1400b7358], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
mov r8d, 3
lea rcx, str..IoAuraCc
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1400b7358], rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14002e58e
movups xmm0, xmmword [str._VA_CSE]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [0x140098830]
movups xmmword [rbp - 0x70], xmm1
movdqa xmm7, xmmword [0x140098d00]
mov esi, dword [0x1400b7008]
psrldq xmm1, 0xf
movd eax, xmm1
test al, al
je 0x14002de39
mov r8d, ebx
cmp esi, 2
jl 0x14002de09
movdqa xmm4, xmmword [0x140098c00]
mov edx, ebx
movdqa xmm3, xmmword [0x140098f70]
movdqa xmm5, xmmword [str.::::HKRC_NGO]
movdqa xmm0, xmmword [0x140098d10]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rbp - 0x7c]
mov r8d, dword [rsp + 0x60]
nop
movd xmm2, edx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [rdx + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add edx, 8
lea rcx, [rcx + 8]
cmp edx, 0x20
jl 0x14002dd20
jmp 0x14002de39
lea r9, [rbp - 0x80]
nop dword [rax]
mov eax, 0x8d3dcb09
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x20
jl 0x14002de10
lea rdx, [rbp - 0x80]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001580
lea rdx, [0x140002530]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop dword [rax]
lea rdx, str.Fortnite
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14002de60
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x140098b90]
movdqu xmmword [rsp + 0x70], xmm1
mov eax, dword [str.GREEN]
mov dword [rsp + 0x60], eax
movzx eax, byte [0x1400988b8]
mov byte [rsp + 0x64], al
mov byte [rsp + 0x65], 0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
mov r8d, 0x11
lea rdx, str.found_fortnite___n
lea rcx, [rbp - 0x80]
call fcn.1400017e0
nop
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x50]
call fcn.1400286e0
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x14002df20
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002df1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002df1b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140075ab4
movdqu xmmword [rbp - 0x70], xmm6
mov byte [rbp - 0x80], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14002df69
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002df64
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002df64
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140075ab4
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x140098ba0]
movdqu xmmword [rbp - 0x70], xmm1
mov eax, dword [str.PURPLE]
mov dword [rbp - 0x80], eax
movzx eax, word [0x1400988f8]
mov word [rbp - 0x7c], ax
mov byte [rbp - 0x7a], 0
movups xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x140098bc0]
movdqu xmmword [rsp + 0x70], xmm1
movsd xmm0, qword [str.loading...]
movsd qword [rsp + 0x60], xmm0
movzx eax, word [0x140098908]
mov word [rsp + 0x68], ax
mov byte [rsp + 0x6a], 0
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x50]
call fcn.1400286e0
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14002e02d
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002e028
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002e028
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140075ab4
movdqu xmmword [rsp + 0x70], xmm6
mov byte [rsp + 0x60], 0
mov r8, qword [rbp - 0x68]
cmp r8, 0xf
jbe 0x14002e04f
mov rdx, qword [rbp - 0x80]
lea rcx, [rbp - 0x80]
call fcn.14002a160
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
mov dword [rbp + 0xb0], 0x130
lea rdx, [rbp + 0xb0]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14002e0bf
nop word [rax + rax]
lea rdx, str.FortniteClient_Win64_Shipping.exe
lea rcx, [rbp + 0xdc]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rdi
test eax, eax
je 0x14002e538
lea rdx, [rbp + 0xb0]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14002e090
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov dword [0x1400b7360], eax
mov ecx, 1
call fcn.140075a78
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x1400021c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14002e57f
cmp dword [rsp + 0x58], 0
je 0x14002e574
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x14002e574
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x60], 0x85b2b70
mov eax, dword [0x1400b7360]
mov dword [rsp + 0x64], eax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov r9d, 0x10
lea r8, [rsp + 0x60]
mov edx, 0x2244dc
mov rcx, qword [0x1400b7358]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rax, qword [rsp + 0x48]
mov qword [0x1400b7348], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x1400b7364], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x1400b7368], eax
movups xmm6, xmmword [0x140098870]
movups xmmword [rsp + 0x60], xmm6
mov edx, dword [0x140098880]
mov dword [rsp + 0x70], edx
movzx eax, word [0x140098884]
mov word [rsp + 0x74], ax
movzx eax, byte [0x140098886]
mov byte [rsp + 0x76], al
mov ecx, ebx
cmp esi, 2
jl 0x14002e412
movdqa xmm4, xmmword [0x140098f70]
movdqa xmm5, xmmword [str.::::HKRC_NGO]
movdqa xmm3, xmmword [0x140098c00]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
mov ecx, dword [0x140098d10]
movd xmm0, ecx
paddb xmm3, xmm0
movd eax, xmm6
movd xmm0, eax
xorps xmm3, xmm0
movd dword [rsp + 0x60], xmm3
movdqa xmm2, xmmword [0x140098c40]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, ecx
paddb xmm2, xmm0
movd xmm1, dword [rsp + 0x64]
xorps xmm2, xmm1
movd dword [rsp + 0x64], xmm2
movdqa xmm3, xmmword [0x140098c70]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, ecx
paddb xmm3, xmm0
movd xmm1, dword [rsp + 0x68]
xorps xmm3, xmm1
movd dword [rsp + 0x68], xmm3
movdqa xmm2, xmmword [0x140098cb0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, ecx
paddb xmm2, xmm0
movd xmm1, dword [rsp + 0x6c]
xorps xmm2, xmm1
movd dword [rsp + 0x6c], xmm2
movdqa xmm3, xmmword [0x140098cc0]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, ecx
paddb xmm3, xmm0
movd xmm1, edx
xorps xmm3, xmm1
movd dword [rsp + 0x70], xmm3
mov ecx, 0x14
mov eax, ecx
lea r8, [rsp + 0x60]
add r8, rax
nop dword [rax]
mov eax, 0x8d3dcb09
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x3a
movzx eax, cl
sub al, dl
add al, 0x31
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x17
jl 0x14002e420
lea rdx, [rsp + 0x60]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001580
mov rdx, qword [0x1400b7348]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [0x140002530]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov esi, ebx
movsxd rcx, esi
add rcx, qword [0x1400b7348]
mov qword [0x1400b73c8], rcx
add rcx, 0x12300e58
call fcn.140002820
mov rdi, rax
lea rcx, [rax + 0x30]
call fcn.140002820
test rdi, rdi
je 0x14002e4c5
test rax, rax
je 0x14002e4c5
lea rcx, [rax + 0xc0]
call fcn.140002820
cmp rax, rdi
je 0x14002e4d5
inc ebx
add esi, 0x1000
cmp ebx, 0x7fffffff
jl 0x14002e481
lea rdx, str._n__text_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001580
mov rdx, qword [0x1400b73c8]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_long___int64_____ptr64]
lea rdx, [0x140002530]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rbx, qword [0x1400b7960]
mov rcx, rbx
call fcn.14002aa40
mov rcx, rbx
call fcn.140029620
mov rcx, qword [0x1400b74e0]
call fcn.140029030
cmp al, 1
je 0x14002e550
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0xb8]
jmp 0x14002e0ca
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rcx, qword [0x1400b7960]
call fcn.140028a30
mov ecx, 0x10
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14002e550
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rsp + 0x58], ebx
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov r10, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x40]
call fcn.140004380
mov r9, rax
cmp byte [rax + 0x2f], 0
je 0x14002e705
cmp dword [0x1400b7008], 2
jl 0x14002e6d9
movdqa xmm5, xmmword [0x140098c00]
movdqa xmm4, xmmword [0x140098f70]
movdqa xmm6, xmmword [str.::::HKRC_NGO]
movdqa xmm0, xmmword [0x140098d10]
movdqa xmmword [rsp + 0x60], xmm0
mov rcx, rax
mov edx, dword [rsp + 0x60]
movdqa xmm7, xmmword [0x140098d00]
movd xmm2, ebx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [rbx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, edx
paddb xmm3, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm3, xmm0
movd dword [rcx + 4], xmm3
add ebx, 8
lea rcx, [rcx + 8]
cmp ebx, 0x30
jl 0x14002e5f2
jmp 0x14002e705
mov r8, r9
nop dword [rax]
mov eax, 0x8d3dcb09
mul ebx
shr edx, 5
movsx eax, dl
imul edx, eax, 0x3a
movzx eax, bl
sub al, dl
add al, 0x31
xor byte [r8], al
inc ebx
lea r8, [r8 + 1]
cmp ebx, 0x30
jl 0x14002e6e0
mov rdx, r9
mov rcx, r10
call fcn.140001580
lea rdx, [0x140002530]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xc350
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3