Function at 0x1800138b0
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x7b8
mov rax, qword [0x1803ad080]
xor rax, rsp
mov qword [rsp + 0x7a8], rax
lea rdx, [0x1800133b0]
lea rcx, [rsp + 0x730]
call fcn.180022680
nop
lea rcx, [rsp + 0x730]
call fcn.18000bd10
nop
mov edx, Ordinal_27
lea rcx, [rsp + 0x740]
call fcn.18000c070
lea rcx, [rsp + 0x61]
call fcn.18000dab0
mov qword [rsp + 0x80], rax
lea rdx, [0x1801a6bc3]
lea rcx, [rsp + 0xf0]
call fcn.18001b940
nop
lea rdx, str.OllyDbg.exe
lea rcx, [rsp + 0x110]
call fcn.18001b940
nop
lea rdx, str.x64dbg.exe
lea rcx, [rsp + 0x130]
call fcn.18001b940
nop
lea rdx, str.cheatengine_x86_64.exe
lea rcx, [rsp + 0x150]
call fcn.18001b940
nop
lea rdx, str.dump.exe
lea rcx, [rsp + 0x170]
call fcn.18001b940
nop
lea rdx, str.IDA.exe
lea rcx, [rsp + 0x190]
call fcn.18001b940
nop
lea rdx, str.dnSpy.exe
lea rcx, [rsp + 0x1b0]
call fcn.18001b940
nop
lea rdx, str.WinDbg.exe
lea rcx, [rsp + 0x1d0]
call fcn.18001b940
nop
lea rdx, str.CFF_Explorer.exe
lea rcx, [rsp + 0x1f0]
call fcn.18001b940
nop
lea rdx, str.dbgview.exe
lea rcx, [rsp + 0x210]
call fcn.18001b940
nop
lea rdx, str.WinDbgX.exe
lea rcx, [rsp + 0x230]
call fcn.18001b940
nop
lea rdx, str.ProcMon.exe
lea rcx, [rsp + 0x250]
call fcn.18001b940
nop
lea rdx, str.SysinternalsSuite.exe
lea rcx, [rsp + 0x270]
call fcn.18001b940
nop
lea rdx, str.Fiddler.exe
lea rcx, [rsp + 0x290]
call fcn.18001b940
nop
lea rdx, str.Cheat_Engine.exe
lea rcx, [rsp + 0x2b0]
call fcn.18001b940
nop
lea rdx, str.GameGuardian.exe
lea rcx, [rsp + 0x2d0]
call fcn.18001b940
nop
lea rdx, str.Jadx_gui.exe
lea rcx, [rsp + 0x2f0]
call fcn.18001b940
nop
lea rdx, str.ApkTool.exe
lea rcx, [rsp + 0x310]
call fcn.18001b940
nop
lea rdx, str.Beamer.exe
lea rcx, [rsp + 0x330]
call fcn.18001b940
nop
lea rdx, str.HTTPDEBUGGER.exe
lea rcx, [rsp + 0x350]
call fcn.18001b940
nop
lea rdx, str.http_debugger.exe
lea rcx, [rsp + 0x370]
call fcn.18001b940
nop
lea rdx, str.debugger.exe
lea rcx, [rsp + 0x390]
call fcn.18001b940
nop
lea rdx, str.disassembler.exe
lea rcx, [rsp + 0x3b0]
call fcn.18001b940
nop
lea rdx, str.decompiler.exe
lea rcx, [rsp + 0x3d0]
call fcn.18001b940
nop
lea rdx, str.wireshark.exe
lea rcx, [rsp + 0x3f0]
call fcn.18001b940
nop
lea rdx, str.analysis_tool.exe
lea rcx, [rsp + 0x410]
call fcn.18001b940
nop
lea rdx, str.Network_traffic_dump_tool.exe
lea rcx, [rsp + 0x430]
call fcn.18001b940
nop
lea rdx, str.petool.exe
lea rcx, [rsp + 0x450]
call fcn.18001b940
nop
lea rdx, str.Wireshark_packet_sniffer.exe
lea rcx, [rsp + 0x470]
call fcn.18001b940
nop
lea rdx, str.Part_of_Sysinternals_Suite.exe
lea rcx, [rsp + 0x490]
call fcn.18001b940
nop
lea rdx, str.Network_Analyzer.exe
lea rcx, [rsp + 0x4b0]
call fcn.18001b940
nop
lea rdx, str.Beamer_x64__Elevated_.exe
lea rcx, [rsp + 0x4d0]
call fcn.18001b940
nop
lea rdx, str.DIE.exe
lea rcx, [rsp + 0x4f0]
call fcn.18001b940
nop
lea rdx, str.TeamViewer.exe
lea rcx, [rsp + 0x510]
call fcn.18001b940
nop
lea rdx, str.Everything.exe
lea rcx, [rsp + 0x530]
call fcn.18001b940
nop
lea rdx, str.Registry_Editor.exe
lea rcx, [rsp + 0x550]
call fcn.18001b940
nop
lea rdx, str.JournalTrace.exe
lea rcx, [rsp + 0x570]
call fcn.18001b940
nop
lea rdx, str.Easy_Journal_Viewer.exe
lea rcx, [rsp + 0x590]
call fcn.18001b940
nop
lea rdx, str.Echo_String_Scanner.exe
lea rcx, [rsp + 0x5b0]
call fcn.18001b940
nop
lea rdx, str.Echo_BAM_Log_Viewer.exe
lea rcx, [rsp + 0x5d0]
call fcn.18001b940
nop
lea rdx, str.Echo_User_Assist_Viewer.exe
lea rcx, [rsp + 0x5f0]
call fcn.18001b940
nop
lea rdx, str.Administrator:_DRE_Files.exe
lea rcx, [rsp + 0x610]
call fcn.18001b940
nop
lea rdx, str.ShellBagsView.exe
lea rcx, [rsp + 0x630]
call fcn.18001b940
nop
lea rdx, str.WinPrefetchView.exe
lea rcx, [rsp + 0x650]
call fcn.18001b940
nop
lea rdx, str.Timeline_Explorer.exe
lea rcx, [rsp + 0x670]
call fcn.18001b940
nop
lea rdx, str.HxD.exe
lea rcx, [rsp + 0x690]
call fcn.18001b940
nop
lea rdx, str.SystemInformer.exe
lea rcx, [rsp + 0x6b0]
call fcn.18001b940
nop
lea rax, [rsp + 0x6d0]
mov r8, rax
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0xe0]
call fcn.18000dd50
lea rcx, [rsp + 0xb8]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xd0]
lea rcx, [rsp + 0xb8]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rsp + 0x80]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x740]
call fcn.18001a280
nop
lea r9, [fcn.18001b7c0]
mov r8d, Ordinal_50
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea rcx, [rsp + 0xf0]
call fcn.180156924
nop
lea rcx, [rsp + 0x740]
call fcn.180013290
movzx eax, al
test eax, eax
je 0x180013d9c
call fcn.180013170
nop
mov dword [rsp + 0x6e0], 0x50
mov dword [rsp + 0x6e4], 0x40
lea rax, [0x1800176b0]
mov qword [rsp + 0x6e8], rax
mov dword [rsp + 0x6f0], 0
mov dword [rsp + 0x6f4], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x6f8], rax
mov qword [rsp + 0x700], 0
mov qword [rsp + 0x708], 0
mov qword [rsp + 0x710], 0
mov qword [rsp + 0x718], 0
lea rax, [0x1801c3dcc]
mov qword [rsp + 0x720], rax
mov qword [rsp + 0x728], 0
lea rcx, [rsp + 0x6e0]
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov rax, qword [rsp + 0x7d0]
cvttss2si eax, dword [rax + 0x6c]
mov dword [rsp + 0x6c], eax
mov rax, qword [rsp + 0x7d0]
cvttss2si eax, dword [rax + 0x68]
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x7d0]
movss xmm0, dword [rax + 0x6c]
divss xmm0, dword [0x180396e7c]
movss dword [rsp + 0x64], xmm0
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
sub eax, edx
sar eax, 1
cvtsi2ss xmm0, eax
movss xmm1, dword [rsp + 0x64]
subss xmm0, xmm1
cvttss2si eax, xmm0
mov dword [rsp + 0x74], eax
mov rax, qword [rsp + 0x7d0]
movss xmm0, dword [rax + 0x68]
divss xmm0, dword [0x180396e7c]
movss dword [rsp + 0x68], xmm0
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
sub eax, edx
sar eax, 1
cvtsi2ss xmm0, eax
movss xmm1, dword [rsp + 0x68]
subss xmm0, xmm1
cvttss2si eax, xmm0
mov dword [rsp + 0x78], eax
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x6f8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
mov r9d, 0x80000000
lea r8, [0x1801c3dd0]
mov rdx, qword [rsp + 0x720]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rcx, qword [rsp + 0x7d0]
mov qword [rcx + 0x70], rax
mov rax, qword [rsp + 0x7d0]
mov rdx, qword [rax + 0x70]
mov rcx, qword [rsp + 0x7d0]
call fcn.180013050
mov dword [rsp + 0x758], 0xffffffff
lea rax, [rsp + 0x75c]
mov rdi, rax
xor eax, eax
mov ecx, recv
rep stosb byte [rdi], al
lea rdx, [rsp + 0x758]
mov rax, qword [rsp + 0x7d0]
mov rcx, qword [rax + 0x70]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
nop
mov rax, qword [rsp + 0x7d0]
mov rdx, qword [rax + 0x70]
mov rcx, qword [rsp + 0x7d0]
call fcn.180017840
movzx eax, al
test eax, eax
jne 0x18001400a
mov rcx, qword [rsp + 0x7d0]
call fcn.180017a20
mov rdx, qword [rsp + 0x6f8]
mov rcx, qword [rsp + 0x720]
call qword [sym.imp.USER32.dll_UnregisterClassA]
nop
lea rcx, [rsp + 0x740]
call fcn.18001a260
nop
lea rcx, [rsp + 0x730]
call fcn.18000bcb0
nop
jmp 0x1800142b2
mov edx, 0xa
mov rax, qword [rsp + 0x7d0]
mov rcx, qword [rax + 0x70]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rax, qword [rsp + 0x7d0]
mov rcx, qword [rax + 0x70]
call qword [sym.imp.USER32.dll_UpdateWindow]
nop
xor ecx, ecx
call fcn.180035b30
mov rcx, qword [rsp + 0x7d0]
call fcn.1800142d0
nop
mov rax, qword [rsp + 0x7d0]
mov rcx, qword [rax + 0x70]
call fcn.180075530
mov rax, qword [rsp + 0x7d0]
mov rdx, qword [rax + 0xa8]
mov rax, qword [rsp + 0x7d0]
mov rcx, qword [rax + 0xa0]
call fcn.180074f10
mov byte [rsp + 0x60], 0
movzx eax, byte [rsp + 0x60]
test eax, eax
jne 0x18001424f
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x768]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x1800140df
lea rcx, [rsp + 0x768]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x768]
call qword [sym.imp.USER32.dll_DispatchMessageW]
nop
cmp dword [rsp + 0x770], 0x12
jne 0x1800140dd
mov byte [rsp + 0x60], 1
jmp 0x18001408f
call fcn.180075270
call fcn.180076580
call fcn.1800389e0
nop
mov rcx, qword [rsp + 0x7d0]
call fcn.180014b90
nop
call fcn.18003ac50
xorps xmm0, xmm0
movss dword [rsp + 0x798], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x79c], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x7a0], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x7a4], xmm0
mov rax, qword [rsp + 0x7d0]
mov rax, qword [rax + 0xa8]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x7d0]
mov rax, qword [rax + 0xa8]
mov rax, qword [rax]
mov rax, qword [rax + 0x108]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x7d0]
add rax, 0xb8
xor r9d, r9d
mov r8, rax
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [rsp + 0x90]
mov rax, qword [rsp + 0x7d0]
mov rax, qword [rax + 0xa8]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x7d0]
mov rax, qword [rax + 0xa8]
mov rax, qword [rax]
mov rax, qword [rax + 0x190]
mov qword [rsp + 0xa0], rax
lea r8, [rsp + 0x798]
mov rax, qword [rsp + 0x7d0]
mov rdx, qword [rax + 0xb8]
mov rcx, qword [rsp + 0x98]
call qword [rsp + 0xa0]
call fcn.180037cb0
mov rcx, rax
call fcn.180072f30
mov rax, qword [rsp + 0x7d0]
mov rax, qword [rax + 0xb0]
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0x7d0]
mov rax, qword [rax + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x40]
mov qword [rsp + 0xb0], rax
xor r8d, r8d
mov edx, 1
mov rcx, qword [rsp + 0xa8]
call qword [rsp + 0xb0]
nop
jmp 0x180014082
call fcn.1800751a0
call fcn.180075550
xor ecx, ecx
call fcn.180035be0
mov rcx, qword [rsp + 0x7d0]
call fcn.180017a20
mov rax, qword [rsp + 0x7d0]
mov rcx, qword [rax + 0x70]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rsp + 0x6f8]
mov rcx, qword [rsp + 0x720]
call qword [sym.imp.USER32.dll_UnregisterClassA]
nop
lea rcx, [rsp + 0x740]
call fcn.18001a260
nop
lea rcx, [rsp + 0x730]
call fcn.18000bcb0
nop
mov rcx, qword [rsp + 0x7a8]
xor rcx, rsp
call fcn.1801567a0
add rsp, 0x7b8
pop rdi
pop rsi
ret