Function at 0x140052fd0
Capabilities:
Create process on windows
Create thread
Download url
Get system information on windows
Inject dll
Inject thread
Link many functions at runtime
Log keystrokes via polling
Receive data
Resolve function by parsing pe exports
Terminate process

Disassembly:
push rbp
push rbx
push r12
push r15
lea rbp, [rsp - 0x1178]
mov eax, 0x1278
call fcn.1400bcdd0
sub rsp, rax
call fcn.14004e5f0
mov rdx, rax
call fcn.14004ff70
test eax, eax
je 0x14005301a
mov r8d, eax
mov dword [0x14020a810], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14020a818], rax
call fcn.14004e5f0
mov rdx, rax
call fcn.14004ff70
test eax, eax
je 0x14005304d
mov r8d, eax
mov dword [0x14020a810], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14020a818], rax
test rax, rax
jne 0x140053066
mov r8d, Ordinal_26
lea rdx, str.Status:_No_Process_Found_
lea rcx, [0x1401e86d8]
call fcn.140041da0
lea rdx, [rbp + 0xbd0]
lea rdx, [rdx + 0x80]
lea rbx, [0x140000000]
movups xmm0, xmmword [rbx + 0xdf6c0]
lea rcx, [rbx + 0xdf6c0]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
mov rax, qword [rcx + 0x30]
lea r8, str.C:Windows_temphk4x.dll
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rcx]
movups xmmword [rdx - 0x20], xmm0
movups xmm0, xmmword [rcx - 0x10]
movups xmmword [rdx - 0x10], xmm0
movups xmm0, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm1
movups xmm1, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm0
movups xmmword [rdx + 0x20], xmm1
mov qword [rdx + 0x30], rax
mov eax, dword [rcx + 0x38]
mov dword [rdx + 0x38], eax
movzx eax, word [rcx + 0x3c]
mov word [rdx + 0x3c], ax
movzx eax, byte [rcx + 0x3e]
lea rcx, [rbp + 0xc90]
mov byte [rdx + 0x3e], al
mov edx, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
xor r15d, r15d
lea r8, [rbp + 0xc90]
xor r9d, r9d
mov qword [rsp + 0x20], r15
lea rdx, [rbp + 0xbd0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor r9d, r9d
mov qword [rsp + 0x28], r15
lea r8, [fcn.140001df0]
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], r15
lea r8, [fcn.140001df0]
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.14004e5f0
mov rdx, rax
call fcn.14004ff70
test eax, eax
je 0x1400531a3
mov r8d, eax
mov dword [0x14020a810], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14020a818], rax
call fcn.14004e5f0
mov rdx, rax
call fcn.14004ff70
test eax, eax
je 0x1400531d6
mov r8d, eax
mov dword [0x14020a810], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14020a818], rax
test rax, rax
jne 0x1400531ef
mov r8d, Ordinal_26
lea rdx, str.Status:_No_Process_Found_
lea rcx, [0x1401e86d8]
call fcn.140041da0
movups xmm0, xmmword [rbx + 0xdf780]
lea rcx, [rbx + 0xdf780]
movups xmm1, xmmword [rcx + 0x10]
mov rax, qword [rcx + 0xb0]
lea rdx, [rbp + 0xa50]
movups xmmword [rdx], xmm0
lea r8, str.C:Windows_tempFX_CHAMS.dll
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rax
movzx eax, byte [rcx + 0xb8]
lea rcx, [rbp + 0xda0]
mov byte [rdx + 0x38], al
mov edx, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov r12d, 1
mov qword [rsp + 0x20], r15
mov r9d, r12d
lea r8, [rbp + 0xda0]
lea rdx, [rbp + 0xa50]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor r9d, r9d
mov qword [rsp + 0x28], r15
lea r8, [fcn.140001df0]
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], r15
lea r8, [fcn.140001df0]
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.14004e5f0
mov rdx, rax
call fcn.14004ff70
test eax, eax
je 0x140053322
mov r8d, eax
mov dword [0x14020a810], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14020a818], rax
call fcn.14004e5f0
mov rdx, rax
call fcn.14004ff70
test eax, eax
je 0x140053355
mov r8d, eax
mov dword [0x14020a810], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14020a818], rax
test rax, rax
jne 0x14005336e
mov r8d, Ordinal_26
lea rdx, str.Status:_No_Process_Found_
lea rcx, [0x1401e86d8]
call fcn.140041da0
movups xmm0, xmmword [rbx + 0xdf840]
lea rcx, [rbx + 0xdf840]
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp + 0x990]
movups xmmword [rdx], xmm0
lea r8, str.C:Windows_tempOrange.dll
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + 0x80]
mov eax, dword [rcx + 0x30]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, word [rcx + 0x34]
mov word [rdx + 0x34], ax
movzx eax, byte [rcx + 0x36]
lea rcx, [rbp + 0xeb0]
mov byte [rdx + 0x36], al
mov edx, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov r9d, r12d
mov qword [rsp + 0x20], r15
lea r8, [rbp + 0xeb0]
xor ecx, ecx
lea rdx, [rbp + 0x990]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor r9d, r9d
mov qword [rsp + 0x28], r15
lea r8, [fcn.140001df0]
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], r15
lea r8, [fcn.140001df0]
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.14004e5f0
mov rdx, rax
call fcn.14004ff70
test eax, eax
je 0x140053498
mov r8d, eax
mov dword [0x14020a810], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14020a818], rax
call fcn.14004e5f0
mov rdx, rax
call fcn.14004ff70
test eax, eax
je 0x1400534cb
mov r8d, eax
mov dword [0x14020a810], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14020a818], rax
test rax, rax
jne 0x1400534e4
mov r8d, Ordinal_26
lea rdx, str.Status:_No_Process_Found_
lea rcx, [0x1401e86d8]
call fcn.140041da0
movups xmm0, xmmword [rbx + 0xdf900]
lea rcx, [rbx + 0xdf900]
mov edx, 0x104
movups xmm1, xmmword [rcx + 0x10]
mov rax, qword [rcx + 0xb0]
lea r8, [rbp + 0xb10]
movups xmmword [r8], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [r8 + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [r8 + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [r8 + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [r8 + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [r8 + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [r8 + 0x60], xmm0
lea r8, [r8 + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [r8 - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [r8], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [r8 + 0x10], xmm1
movups xmmword [r8 + 0x20], xmm0
mov qword [r8 + 0x30], rax
mov eax, dword [rcx + 0xb8]
lea rcx, [rbp + 0xfc0]
mov dword [r8 + 0x38], eax
lea r8, str.C:Windows_tempFX_BLUE_BOX.dll
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov r9d, r12d
mov qword [rsp + 0x20], r15
lea r8, [rbp + 0xfc0]
xor ecx, ecx
lea rdx, [rbp + 0xb10]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor r9d, r9d
mov qword [rsp + 0x28], r15
lea r8, [fcn.140001df0]
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], r15
lea r8, [fcn.140001df0]
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], r15
lea r8, [0x140050680]
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], r15
lea r8, [0x140051e10]
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [0x14020a8e0]
call fcn.140065550
cmp byte [0x14020aaf0], r15b
jne 0x140053665
lea rcx, [0x14020aaf8]
call fcn.140041a30
mov rdx, rax
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rax, [0x14004dcf0]
mov qword [rsp + 0x12a0], rsi
mov edx, 0x7f00
mov qword [rbp + 0x2f8], rax
xor ecx, ecx
mov qword [rsp + 0x12a8], rdi
mov dword [rbp + 0x2f0], 0x50
mov dword [rbp + 0x2f4], 0x40
mov qword [rbp + 0x300], r15
mov qword [rbp + 0x308], r15
call qword [sym.imp.USER32.dll_LoadIconA]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rbp + 0x310], rax
call qword [sym.imp.USER32.dll_LoadCursorA]
lea rdi, str.Example
mov qword [rbp + 0x320], r15
mov qword [rbp + 0x318], rax
mov edx, 0x7f00
lea rax, str.ImGui
mov qword [rbp + 0x330], rdi
xor ecx, ecx
mov qword [rbp + 0x328], rax
call qword [sym.imp.USER32.dll_LoadIconA]
lea rcx, [rbp + 0x2f0]
mov qword [rbp + 0x338], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov ecx, r12d
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
xor ecx, ecx
sub eax, edx
sar eax, 1
lea ebx, [rax - 0x121]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov qword [rsp + 0x58], r15
mov r9d, 0x80000000
mov qword [rsp + 0x50], r15
cdq
mov qword [rsp + 0x48], r15
sub eax, edx
mov rdx, qword [rbp + 0x330]
mov r8, rdi
mov qword [rsp + 0x40], r15
xor ecx, ecx
mov dword [rsp + 0x38], 0x242
sar eax, 1
sub eax, 0x18b
mov dword [rsp + 0x30], 0x316
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
lea rcx, str.user32.dll
mov qword [0x1401e95b8], rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x1400537f6
lea rdx, str.SetWindowCompositionAttribute
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400537ed
movdqa xmm0, xmmword [reloc.WS2_32.dll_closesocket]
lea rcx, [rbp + 0x4f8]
mov qword [rbp + 0x3e8], rcx
lea rdx, [rbp + 0x3e0]
mov rcx, rdi
mov dword [rbp + 0x3e0], reloc.WS2_32.dll_send
movdqu xmmword [rbp + 0x4f8], xmm0
mov dword [rbp + 0x3f0], reloc.WS2_32.dll_recv
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
movdqa xmm0, xmmword [0x1400e0220]
lea rdx, [rbp + 0x508]
mov rcx, qword [0x1401e95b8]
movdqu xmmword [rbp + 0x508], xmm0
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rcx, qword [0x1401e95b8]
lea rdx, [0x1401e95c8]
xorps xmm0, xmm0
movups xmmword [rbp + 0x778], xmm0
movups xmmword [0x1401e95c8], xmm0
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rax, qword [0x1401e95b8]
lea rbx, [0x14021f408]
mov qword [rsp + 0x58], rbx
lea rdi, [0x14021f400]
mov qword [rbp + 0x2d0], rax
lea rsi, [0x14021f3b8]
lea rax, [rsp + 0x78]
mov qword [rbp + 0x2b4], r15
mov qword [rsp + 0x50], rax
xor r9d, r9d
mov qword [rsp + 0x48], rdi
lea rax, [rbp + 0x2a0]
mov qword [rsp + 0x40], rsi
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov edx, r12d
mov dword [rsp + 0x30], 7
lea rax, [rbp - 0x78]
mov dword [rsp + 0x28], 2
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x2c8], 2
mov qword [rbp + 0x2e0], 2
mov qword [rbp + 0x2a0], r15
mov dword [rbp + 0x2b0], Ordinal_32
mov dword [rbp + 0x2a8], reloc.WLDAP32.dll_Ordinal_60
mov dword [rbp + 0x2ac], r12d
mov dword [rbp + 0x2c4], reloc.WLDAP32.dll_Ordinal_32
mov qword [rbp + 0x2bc], r12
mov qword [rbp + 0x2d8], r12
mov dword [rbp - 0x78], 0xb000
mov dword [rbp - 0x74], 0xa000
call qword [sym.imp.d3d11.dll_D3D11CreateDeviceAndSwapChain]
cmp eax, 0x887a0004
jne 0x14005396d
mov qword [rsp + 0x58], rbx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
xor r9d, r9d
mov qword [rsp + 0x48], rdi
lea rax, [rbp + 0x2a0]
mov qword [rsp + 0x40], rsi
xor r8d, r8d
mov qword [rsp + 0x38], rax
xor ecx, ecx
mov dword [rsp + 0x30], 7
lea rax, [rbp - 0x78]
mov dword [rsp + 0x28], 2
lea edx, [r9 + 5]
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3d11.dll_D3D11CreateDeviceAndSwapChain]
test eax, eax
je 0x140053992
call fcn.14004dc70
mov rdx, qword [rbp + 0x308]
mov rcx, qword [rbp + 0x330]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov eax, r12d
jmp 0x140057836
mov rcx, qword [0x14021f3b8]
lea r9, [rbp - 0x60]
mov qword [rsp + 0x12b0], r13
lea r8, [0x1400dffb8]
mov qword [rsp + 0x1270], r14
xor edx, edx
movaps xmmword [rsp + 0x1260], xmm6
mov rax, qword [rcx]
movaps xmmword [rsp + 0x1250], xmm7
movaps xmmword [rsp + 0x11f0], xmm13
movaps xmmword [rsp + 0x11e0], xmm14
movaps xmmword [rsp + 0x11d0], xmm15
call qword [rax + 0x48]
mov rcx, qword [0x14021f400]
lea r9, [0x14020f148]
mov rdx, qword [rbp - 0x60]
xor r8d, r8d
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [rbp - 0x60]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [0x1401e95b8]
mov edx, 0xa
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1401e95b8]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rbx, qword [0x1401e9510]
test rbx, rbx
je 0x140053a3d
inc dword [rbx + 0xf4]
mov rdx, qword [0x1401e9500]
mov ecx, 0x5dd0
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test rax, rax
je 0x140053a5f
xor edx, edx
mov rcx, rax
call fcn.1400020a0
jmp 0x140053a62
mov rax, r15
mov qword [0x1401e9510], rax
call fcn.140006340
test rbx, rbx
je 0x140053a7c
mov qword [0x1401e9510], rbx
jmp 0x140053a83
mov rbx, qword [0x1401e9510]
test rbx, rbx
jne 0x140053aa9
mov r8d, 0xfdc
lea rdx, str.C:UsersAdministratorDesktopMax11Max11Maximgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x1401e9510]
movss xmm7, dword [0x1400e00d0]
lea rdi, [0x1400dad38]
mov rcx, qword [rbx + 0x58]
lea rdx, [0x1400f0100]
mov qword [rsp + 0x28], rdi
movaps xmm3, xmm7
mov r8d, 0x41f54
mov qword [rsp + 0x20], r15
mov qword [rbx + 0x20], r15
call fcn.14002de20
movss xmm3, dword [0x1400e00e0]
lea rdx, [0x14017b310]
mov rcx, qword [rbx + 0x58]
mov r8d, 0xe5c
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r15
call fcn.14002de20
movss xmm3, dword [0x1400e00f4]
lea rdx, [0x14017b310]
mov rcx, qword [rbx + 0x58]
mov r8d, 0xe5c
mov qword [rsp + 0x28], rdi
mov qword [0x1401e9528], rax
mov qword [rsp + 0x20], r15
call fcn.14002de20
movss xmm3, dword [0x1400e00d8]
lea rdx, [0x1401a1930]
mov rcx, qword [rbx + 0x58]
mov r8d, 0x459d0
mov qword [rsp + 0x28], rdi
mov qword [0x1401e9538], rax
mov qword [rsp + 0x20], r15
call fcn.14002de20
movss xmm6, dword [0x1400e00ec]
lea rdx, [0x1401a1930]
mov rcx, qword [rbx + 0x58]
movaps xmm3, xmm6
mov qword [rsp + 0x28], rdi
mov r8d, 0x459d0
mov qword [rsp + 0x20], r15
call fcn.14002de20
mov rcx, qword [rbx + 0x58]
lea rdx, [0x140132060]
movaps xmm3, xmm6
mov qword [rsp + 0x28], rdi
mov r8d, 0x492a4
mov qword [0x1401e9530], rax
mov qword [rsp + 0x20], r15
call fcn.14002de20
mov rcx, qword [rbx + 0x58]
lea rdx, [0x1400f0100]
movaps xmm3, xmm7
mov qword [rsp + 0x28], rdi
mov r8d, 0x41f54
mov qword [0x1401e9520], rax
mov qword [rsp + 0x20], r15
call fcn.14002de20
xor ecx, ecx
mov qword [0x1401e9518], rax
call fcn.140028180
mov rbx, qword [0x1401e9510]
mov rsi, qword [0x1401e95b8]
test rbx, rbx
jne 0x140053c26
mov r8d, 0xfdc
lea rdx, str.C:UsersAdministratorDesktopMax11Max11Maximgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x1401e9510]
cmp qword [rbx + 0x98], r15
je 0x140053c49
mov r8d, reloc.WS2_32.dll_WSACleanup
lea rdx, str.C:UsersAdministratorDesktopMax11Max11Max_backendsimgui_impl_win32.cpp
lea rcx, str.io.BackendPlatformUserData__nullptr___Already_initialized_a_platform_backend__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
lea rcx, [rbp + 0x200]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x140053dcd
lea rcx, [rbp + 0x208]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140053dcd
mov rax, qword [0x1401e9510]
test rax, rax
je 0x140053c85
inc dword [rax + 0xf4]
mov rdx, qword [0x1401e9500]
mov ecx, 0x48
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rdi, rax
test rax, rax
je 0x140053cb8
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
mov qword [rdi + 0x40], rax
jmp 0x140053cbb
mov rdi, r15
or dword [rbx + 0xc], 6
lea rax, str.imgui_impl_win32
mov qword [rbx + 0x88], rax
mov qword [rbx + 0x98], rdi
mov rbx, qword [0x1401e9510]
mov qword [rdi], rsi
mov rax, qword [rbp + 0x200]
mov qword [rdi + 0x20], rax
mov rax, qword [rbp + 0x208]
mov qword [rdi + 0x18], rax
mov dword [rdi + 0x28], 9
cmp dword [rbx + 0x4870], r15d
jg 0x140053d1e
mov r8d, 0x72d
lea rdx, str.C:UsersAdministratorDesktopMax11Max11Maximgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbx + 0x4878]
mov rbx, r15
mov rcx, qword [rax]
lea rax, str.xinput1_4.dll
mov qword [rbp + 0x3f8], rax
lea rax, str.xinput1_3.dll
mov qword [rbp + 0x400], rax
lea rax, str.xinput9_1_0.dll
mov qword [rbp + 0x408], rax
lea rax, str.xinput1_2.dll
mov qword [rbp + 0x410], rax
lea rax, str.xinput1_1.dll
mov qword [rcx + 0x28], rsi
mov qword [rbp + 0x418], rax
mov byte [rdi + 0x2d], r12b
nop dword [rax]
mov rcx, qword [rbp + rbx*8 + 0x3f8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x140053da1
inc rbx
cmp rbx, 5
jl 0x140053d80
jmp 0x140053dcd
lea rdx, str.XInputGetCapabilities
mov qword [rdi + 0x30], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.XInputGetState
mov rcx, rsi
mov qword [rdi + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x40], rax
mov rax, qword [0x1401e9510]
mov r14, qword [0x14021f408]
mov rsi, qword [0x14021f400]
test rax, rax
jne 0x140053e08
mov r8d, 0xfdc
lea rdx, str.C:UsersAdministratorDesktopMax11Max11Maximgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [0x1401e9510]
lea rdi, [rax + 8]
cmp qword [rdi + 0x98], r15
je 0x140053e36
mov r8d, 0x221
lea rdx, str.C:UsersAdministratorDesktopMax11Max11Max_backendsimgui_impl_dx11.cpp
lea rcx, str.io.BackendRendererUserData__nullptr___Already_initialized_a_renderer_backend__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [0x1401e9510]
test rax, rax
je 0x140053e41
inc dword [rax + 0xf4]
mov rdx, qword [0x1401e9500]
mov ecx, 0x78
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rbx, rax
test rax, rax
je 0x140053e88
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
mov dword [rax + 0x70], 0x1388
mov dword [rax + 0x74], 0x2710
jmp 0x140053e8b
mov rbx, r15
or dword [rdi + 4], 8
lea rax, str.imgui_impl_dx11
mov qword [rdi + 0x88], rax
lea r8, [rbp - 0x70]
mov qword [rdi + 0x98], rbx
lea rdx, [0x1400dc440]
mov rax, qword [rsi]
mov rcx, rsi
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x58], r15
call qword [rax]
test eax, eax
jne 0x140053f08
mov rcx, qword [rbp - 0x70]
lea r8, [rbp - 0x68]
lea rdx, [0x1400dc450]
mov rax, qword [rcx]
call qword [rax + Ordinal_50]
test eax, eax
jne 0x140053f08
mov rcx, qword [rbp - 0x68]
lea r8, [rbp - 0x58]
lea rdx, [0x1400dc460]
mov rax, qword [rcx]
call qword [rax + Ordinal_50]
test eax, eax
jne 0x140053f08
mov qword [rbx], rsi
mov qword [rbx + 8], r14
mov rax, qword [rbp - 0x58]
mov qword [rbx + 0x10], rax
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140053f17
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x140053f26
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rcx, qword [rbx + 8]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov ecx, r12d
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
xor ecx, ecx
sub eax, edx
sar eax, 1
sub eax, 0x121
movd xmm6, eax
cvtdq2ps xmm6, xmm6
call qword [sym.imp.USER32.dll_GetSystemMetrics]
movss xmm15, dword [0x1400e00c0]
xor esi, esi
movss xmm14, dword [0x1400e0068]
cdq
sub eax, edx
movaps xmmword [rsp + 0x1240], xmm8
sar eax, 1
xorps xmm13, xmm13
sub eax, 0x18b
movaps xmmword [rsp + 0x1230], xmm9
movaps xmmword [rsp + 0x1220], xmm10
movaps xmmword [rsp + 0x1210], xmm11
movaps xmmword [rsp + 0x1200], xmm12
movd xmm0, eax
mov rax, qword [0x1401e9510]
cvtdq2ps xmm0, xmm0
or dword [rax + 0x4778], r12d
xor bl, bl
mov qword [rax + 0x4790], rsi
movss dword [rax + 0x478c], xmm6
movss xmm6, dword [0x1400e0174]
mov dword [rsp + 0x60], ebx
mov r13d, dword [rsp + 0x60]
movss dword [rax + 0x4788], xmm0
mov dword [rax + 0x477c], r12d
xor r9d, r9d
mov dword [rsp + 0x20], r12d
xor r8d, r8d
lea rcx, [rbp + 0x670]
xor edx, edx
lea r15, [0x14020a7e0]
lea rdi, [0x14020a7b0]
movabs r14, 0x7fffffffffff
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140054082
nop word [rax + rax]
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [rbp + 0x678], 0x12
lea rcx, [rbp + 0x670]
movzx ebx, bl
cmove ebx, r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x140054030
mov dword [rsp + 0x60], ebx
test bl, bl
jne 0x1400575f4
mov ecx, reloc.WLDAP32.dll_Ordinal_46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x14005789d
mov ecx, dword [0x1401e95c0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14005412b
lea rdx, [0x1400df454]
lea rcx, [rbp + 0x848]
call fcn.140041b30
lea rdx, [0x1400cfcfa]
mov rsi, rax
lea rcx, [rbp + 0x868]
call fcn.140041b30
lea rdx, [0x1400cfcfa]
mov rdi, rax
lea rcx, [rbp + 0x888]
call fcn.140041b30
lea rdx, [0x1400df454]
mov rbx, rax
lea rcx, [rbp + 0x8a8]
call fcn.140041b30
mov qword [rsp + 0x30], rsi
lea rcx, [0x1401e86f8]
mov qword [rsp + 0x28], rdi
mov r9, r14
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rdx, rax
call fcn.140050aa0
xor esi, esi
lea rdi, [0x14020a7b0]
mov ecx, dword [0x1401e9694]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1400542d9
call fcn.14004e5f0
mov rdx, rax
call fcn.14004ff70
test eax, eax
je 0x140054173
mov r8d, eax
mov dword [0x14020a810], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14020a818], rax
test rax, rax
jne 0x14005417f
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140058180
lea rcx, [rbp + 0x928]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
mov rax, qword [0x14020a7c0]
sub rax, qword [0x14020a7b0]
sar rax, 3
mov qword [rbp + 0x210], 0x64
cmp rax, 0x64
jae 0x1400541cb
lea rdx, [rbp + 0x210]
mov rcx, rdi
call fcn.140058830
mov r9, qword [0x14020a7c8]
mov r8, r14
xor edx, edx
mov qword [rsp + 0x20], rdi
call fcn.140050250
mov rax, qword [0x14020a7b0]
mov rdx, qword [0x14020a7b8]
cmp rax, rdx
je 0x1400542c0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
sub rdx, rax
sar rdx, 3
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x140058330]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, qword [0x14020a7b8]
mov rdx, qword [0x14020a7b0]
sub rax, rdx
sar rax, 3
test rax, rax
je 0x1400542b3
xor r14d, r14d
mov edi, r14d
mov rbx, qword [rdx + rdi]
lea r8, [rsp + 0x7c]
mov rcx, qword [0x14020a818]
mov r9d, 4
mov qword [rsp + 0x20], r14
lea rdx, [rbx + 0x2c]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14020a818]
lea rdx, [rbx + 0x28]
mov r9d, 4
mov qword [rsp + 0x20], r14
lea r8, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14020a7b8]
lea rdi, [rdi + 8]
mov rdx, qword [0x14020a7b0]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140054240
movabs r14, 0x7fffffffffff
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
mov r8d, reloc.WLDAP32.dll_Ordinal_35
lea rdx, str.Aimbot_Head_:_Successfully_applied_
lea rcx, [0x1401e86d8]
call fcn.140041da0
mov ecx, dword [0x1401e9554]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14005447d
call fcn.14004e5f0
mov rdx, rax
call fcn.14004ff70
test eax, eax
je 0x140054321
mov r8d, eax
mov dword [0x14020a810], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14020a818], rax
test rax, rax
jne 0x14005432d
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140058180
lea rcx, [rbp + 0x958]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
mov rax, qword [0x14020a7f0]
sub rax, qword [0x14020a7e0]
sar rax, 3
mov qword [rbp + 0x218], 0x64
cmp rax, 0x64
jae 0x140054379
lea rdx, [rbp + 0x218]
mov rcx, r15
call fcn.140058830
mov r9, qword [0x14020a7f8]
mov r8, r14
xor edx, edx
mov qword [rsp + 0x20], r15
call fcn.140050250
mov rax, qword [0x14020a7e0]
mov rdx, qword [0x14020a7e8]
cmp rax, rdx
je 0x140054464
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
sub rdx, rax
sar rdx, 3
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x140058330]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, qword [0x14020a7e8]
xor r14d, r14d
mov rdx, qword [0x14020a7e0]
mov esi, r14d
sub rax, rdx
sar rax, 3
test rax, rax
je 0x140054457
mov edi, r14d
nop dword [rax]
mov rbx, qword [rdx + rdi]
lea r8, [rbp - 0x80]
mov rcx, qword [0x14020a818]
mov r9d, 4
mov qword [rsp + 0x20], r14
lea rdx, [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14020a818]
lea rdx, [rbx + 0x28]
mov r9d, 4
mov qword [rsp + 0x20], r14
lea r8, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14020a7e8]
lea rdi, [rdi + 8]
mov rdx, qword [0x14020a7e0]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x1400543f0
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
mov r8d, reloc.WLDAP32.dll_Ordinal_35
lea rdx, str.Aimbot_Head_:_Successfully_applied_
lea rcx, [0x1401e86d8]
call fcn.140041da0
mov rbx, qword [0x1401e9510]
test rbx, rbx
je 0x140054495
mov rbx, qword [rbx + 0xa0]
test rbx, rbx
jne 0x1400544af
mov r8d, 0x250
lea rdx, str.C:UsersAdministratorDesktopMax11Max11Max_backendsimgui_impl_dx11.cpp
lea rcx, str.bd___nullptr___Did_you_call_ImGui_ImplDX11_Init____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
cmp qword [rbx + 0x48], 0
jne 0x1400544bb
call fcn.1400436a0
call fcn.140044850
call fcn.140008b60
mov rax, qword [0x1401e9510]
lea rcx, [rbp + 0x248]
movaps xmm0, xmmword [0x1400e0380]
xor esi, esi
movaps xmm1, xmm0
movups xmmword [rbp + 0x788], xmm0
or dword [rax + 0x4778], 3
mov dword [rax + 0x4798], 0x44458000
mov dword [rax + 0x479c], 0x44108000
mov dword [rax + 0x4780], r12d
mov qword [rax + 0x4788], rsi
mov qword [rax + 0x4790], rsi
mov dword [rax + 0x477c], r12d
movups xmmword [rax + 0x38c8], xmm0
mov qword [rax + 0x37f0], 0x41000000
movups xmmword [rax + 0x38d8], xmm0
mov qword [rax + 0x37e8], rsi
movups xmmword [rax + 0x38e8], xmm0
mov dword [rax + 0x380c], 0x40e00000
movups xmmword [rax + 0x38b8], xmm0
mov qword [rax + 0x3814], 0x40a00000
movups xmmword [rax + 0x3b98], xmm1
mov qword [rax + 0x3824], 0x40800000
mov dword [rax + 0x3854], 0x40000000
mov dword [rax + 0x381c], 0x40c00000
mov dword [rax + 0x3820], 0x40400000
mov qword [rax + 0x3834], 0x41200000
mov dword [rax + 0x382c], esi
mov dword [rax + 0x3830], 0x41200000
movups xmmword [rbp + 0x798], xmm0
movups xmmword [rbp + 0x7a8], xmm0
movups xmmword [rbp + 0x7b8], xmm0
movaps xmm0, xmmword [0x1400e0280]
movups xmmword [rax + 0x38f8], xmm0
mov qword [rbp + 0x268], 0xffffffffffffffff
mov qword [rbp + 0x270], 0xffffffffffffffff
mov qword [rbp + 0x278], 0xffffffffffffffff
mov qword [rbp + 0x280], 0xffffffffffffffff
mov dword [rbp + 0x288], 0xffffffff
mov qword [rbp + 0x28c], 0xfffffffffffffffd
mov dword [rbp + 0x294], 0xffffffff
mov qword [rbp + 0x298], rsi
movups xmmword [rbp + 0x7c8], xmm0
movups xmmword [rbp + 0x7d8], xmm1
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
cmp byte [0x1401e950c], sil
movzx r12d, word [rbp + 0x248]
movzx r15d, word [rbp + 0x24a]
movzx r14d, word [rbp + 0x24e]
jne 0x140054f8e
mov r8d, 0x20ab
lea rdx, reloc.WS2_32.dll_accept
lea rcx, str.Hello__world_
call fcn.14000fab0
call fcn.14004de20
mov rcx, qword [0x1401e95b8]
lea rdx, [0x1401e95c8]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r8, qword [0x1401e9510]
mov rax, qword [r8 + 0x3ea0]
movss xmm2, dword [rax + 0x18]
ucomiss xmm2, xmm13
movss xmm1, dword [rax + 0x1c]
jp 0x1400546b3
jne 0x1400546b3
ucomiss xmm1, xmm13
jp 0x1400546b3
je 0x140054722
movd xmm0, dword [0x1401e95cc]
mov r9d, 0x316
mov rcx, qword [0x1401e95b8]
cvtdq2ps xmm0, xmm0
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x242
addss xmm0, xmm1
movd xmm1, dword [0x1401e95c8]
cvtdq2ps xmm1, xmm1
cvttss2si r8d, xmm0
addss xmm1, xmm2
cvttss2si edx, xmm1
call qword [sym.imp.USER32.dll_MoveWindow]
mov rcx, qword [0x1401e9510]
lea rdx, [rbp - 0x50]
xor r8d, r8d
mov qword [rbp - 0x50], rsi
mov rcx, qword [rcx + 0x3ea0]
call fcn.140013200
mov r8, qword [0x1401e9510]
mov rax, qword [r8 + 0x3ea0]
lea rcx, [rbp + 0x130]
mov byte [rax + 0xb0], 1
movss xmm1, dword [0x14021f74c]
movss xmm0, dword [0x14021f748]
mov rax, qword [r8 + 0x3ea0]
movss dword [rbp + 0x134], xmm1
movss xmm1, dword [0x14021f754]
mulss xmm1, dword [r8 + 0x37e0]
mov rbx, qword [rax + 0x290]
movss dword [rbp + 0x130], xmm0
movss xmm0, dword [0x14021f750]
movss dword [rbp + 0x13c], xmm1
movss dword [rbp + 0x138], xmm0
call fcn.140004350
movss xmm8, dword [0x1400e01d4]
lea rdx, [rbp - 0x48]
movss xmm3, dword [0x1400e01b4]
mov esi, eax
movss xmm2, dword [r8 + 0x3c00]
lea rax, str.RMICHA_X
mov rcx, qword [r8 + 0x3bf8]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
movss dword [rsp + 0x20], xmm8
call fcn.140031c50
movss xmm0, dword [rbp - 0x48]
mov rdi, qword [0x1401e9510]
mov dword [rbp - 0x3c], 0x41400000
addss xmm0, dword [0x1400e0060]
mov rax, qword [rdi + 0x3ea0]
cvttss2si ecx, xmm0
movss xmm0, dword [rax + 0x20]
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
movss dword [rbp - 0x48], xmm1
subss xmm0, xmm1
mulss xmm0, dword [0x1400e0030]
movss dword [rbp - 0x40], xmm0
test esi, 0xff000000
je 0x1400548ca
mov rax, qword [rbx + 0x38]
mov rdi, qword [rax + 8]
movss xmm6, dword [rax + 0x10]
mov rax, qword [rbx + 0x98]
mov rcx, qword [rdi + 0x40]
cmp qword [rcx + 8], rax
je 0x140054867
mov r8d, 0x663
lea rdx, str.C:UsersAdministratorDesktopMax11Max11Maximgui_draw.cpp
lea rcx, str.font__ContainerAtlas__TexID___CmdHeader.TextureId
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movups xmm0, xmmword [rbx + 0x88]
mov byte [rsp + 0x48], 0
lea rax, [0x1400dfa20]
movss dword [rsp + 0x40], xmm13
lea r9, [rbp - 0x40]
mov qword [rsp + 0x38], rax
movaps xmm2, xmm6
lea rax, [0x1400dfa18]
mov rdx, rbx
mov qword [rsp + 0x30], rax
mov rcx, rdi
lea rax, [rbp + 0x518]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
movups xmmword [rbp + 0x518], xmm0
call fcn.140031e70
mov rdi, qword [0x1401e9510]
movss xmm6, dword [0x1400e0174]
cmp dword [rdi + 0x4870], 0
jg 0x1400548ed
mov r8d, 0x72d
lea rdx, str.C:UsersAdministratorDesktopMax11Max11Maximgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rdi + 0x4878]
lea r8, str.Background
xor edx, edx
mov rcx, qword [rax]
call fcn.1400081d0
movss xmm1, dword [0x14021f76c]
mov r10, rax
movss xmm0, dword [0x14021f768]
mov rcx, qword [0x1401e9510]
movss dword [rbp + 0x144], xmm1
movss xmm1, dword [0x14021f774]
movss dword [rbp + 0x140], xmm0
mulss xmm1, dword [rcx + 0x37e0]
lea rcx, [rbp + 0x140]
mov dword [rbp - 0x38], 0x44458000
movss xmm0, dword [0x14021f770]
movss dword [rbp + 0x148], xmm0
movss dword [rbp + 0x14c], xmm1
mov dword [rbp - 0x34], 0x42340000
mov qword [rbp - 0x30], 0
call fcn.140004350
mov r9d, eax
mov dword [rsp + 0x28], Ordinal_50
lea rdx, [rbp - 0x30]
movss dword [rsp + 0x20], xmm15
lea r8, [rbp - 0x38]
mov rcx, r10
call fcn.14002bbb0
mov rbx, qword [0x1401e9510]
cmp dword [rbx + 0x4870], 0
jg 0x1400549c5
mov r8d, 0x72d
lea rdx, str.C:UsersAdministratorDesktopMax11Max11Maximgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbx + 0x4878]
lea r8, str.Background
xor edx, edx
mov rcx, qword [rax]
call fcn.1400081d0
movss xmm1, dword [0x14021f73c]
mov r10, rax
movss xmm0, dword [0x14021f738]
mov rcx, qword [0x1401e9510]
movss dword [rbp + 0x154], xmm1
movss xmm1, dword [0x14021f744]
movss dword [rbp + 0x150], xmm0
mulss xmm1, dword [rcx + 0x37e0]
lea rcx, [rbp + 0x150]
mov dword [rbp - 0x28], 0x44458000
movss xmm0, dword [0x14021f740]
movss dword [rbp + 0x158], xmm0
movss dword [rbp + 0x15c], xmm1
mov dword [rbp - 0x24], 0x44108000
mov dword [rbp - 0x20], 0
mov dword [rbp - 0x1c], 0x42340000
call fcn.140004350
mov r9d, eax
mov dword [rsp + 0x28], 0xc0
lea rdx, [rbp - 0x20]
movss dword [rsp + 0x20], xmm15
lea r8, [rbp - 0x28]
mov rcx, r10
call fcn.14002bbb0
mov rcx, qword [0x1401e9510]
mov dword [rbp - 0x18], 0x443e0000
mov dword [rbp - 0x14], 0x41200000
mov rax, qword [rcx + 0x3ea0]
mov byte [rax + 0xb0], 1
mov rbx, qword [rcx + 0x3ea0]
cmp dword [rbx + 0xe8], 0
jg 0x140054ac6
mov r8d, 0x736
lea rdx, str.C:UsersAdministratorDesktopMax11Max11Maximgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rax, dword [rbx + 0xe8]
lea rcx, str.CLOSE
mov r8, qword [rbx + 0xf0]
xor edx, edx
mov r8d, dword [r8 + rax*4 - 4]
call fcn.140003d20
mov rcx, qword [0x1401e9510]
mov edi, eax
cmp dword [rcx + 0x3ee8], eax
jne 0x140054b0b
lea r8, str.CLOSE
mov edx, listen
mov ecx, eax
call fcn.14001eb10
lea rdx, [rbp - 0x18]
mov ecx, edi
call fcn.140038660
test al, al
jne 0x140057854
cmp dword [rbx + 0xe8], 0
mov dword [rbp - 0x10], 0x44340000
mov dword [rbp - 0xc], 0x41200000
jg 0x140054b4f
mov r8d, 0x736
lea rdx, str.C:UsersAdministratorDesktopMax11Max11Maximgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rax, dword [rbx + 0xe8]
lea rcx, str.MIN
mov r8, qword [rbx + 0xf0]
xor edx, edx
mov r8d, dword [r8 + rax*4 - 4]
call fcn.140003d20
mov rcx, qword [0x1401e9510]
mov ebx, eax
cmp dword [rcx + 0x3ee8], eax
jne 0x140054b94
lea r8, str.MIN
mov edx, listen
mov ecx, eax
call fcn.14001eb10
lea rdx, [rbp - 0x10]
mov ecx, ebx
call fcn.1400383c0
test al, al
je 0x140054bb7
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rax
mov edx, 6
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1401e9510]
test rcx, rcx
jne 0x140054be4
mov r8d, 0xb55
lea rdx, str.C:UsersAdministratorDesktopMax11Max11Maximgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rcx, qword [0x1401e9510]
mov rax, qword [rcx + 0x3ea0]
lea rdx, [rbp - 8]
mov dword [rbp - 8], 0x43fa0000
mov dword [rbp - 4], 0x43fa0000
mov byte [rax + 0xb0], 1
mov rax, qword [rcx + 0x3ea0]
lea rcx, [0x1400dfa3c]
movss xmm1, dword [rax + 0x18]
movss xmm0, dword [rax + 0x1c]
subss xmm1, dword [rax + 0x7c]
subss xmm0, dword [rax + 0x80]
mov byte [rax + 0x139], 1
addss xmm1, dword [0x1400e0158]
addss xmm0, dword [0x1400e0148]
movss dword [rax + 0xf8], xmm1
movss dword [rax + 0xfc], xmm0
call fcn.14000bd90
mov rcx, qword [0x1401e9510]
mov rax, qword [rcx + 0x3ea0]
mov byte [rax + 0xb0], 1
mov rax, qword [rcx + 0x3ea0]
movss xmm1, dword [rax + 0x18]
movss xmm0, dword [rax + 0x1c]
subss xmm1, dword [rax + 0x7c]
subss xmm0, dword [rax + 0x80]
mov byte [rax + 0x139], 1
addss xmm1, xmm13
addss xmm0, xmm15
movss dword [rax + 0xf8], xmm1
movss dword [rax + 0xfc], xmm0
call fcn.140016cf0
xor esi, esi
mov qword [rbp], 0
mov qword [rsp + 0x38], rsi
lea rax, [rbp]
mov qword [rsp + 0x30], rsi
lea r8, [0x1401e9650]
mov dword [rsp + 0x28], esi
lea rdx, [0x1400cfcfa]
lea r9d, [rsi + 0x41]
mov qword [rsp + 0x20], rax
lea rcx, str.Username
call fcn.14003cc90
mov qword [rsp + 0x38], rsi
lea rax, [rbp + 8]
mov qword [rsp + 0x30], rsi
lea r9d, [rsi + 0x41]
mov dword [rsp + 0x28], 0x8000
lea r8, [0x1401e9560]
lea rdx, [0x1400cfcfa]
mov qword [rsp + 0x20], rax
lea rcx, str.Password
mov qword [rbp + 8], rsi
call fcn.14003cc90
mov qword [rsp + 0x38], rsi
lea rax, [rbp + 0x10]
mov qword [rsp + 0x30], rsi
lea r9d, [rsi + 0x41]
mov dword [rsp + 0x28], esi
lea r8, [0x1401e95e0]
lea rdx, [0x1400cfcfa]
mov qword [rsp + 0x20], rax
lea rcx, str.Key_License
mov qword [rbp + 0x10], rsi
call fcn.14003cc90
mov rcx, qword [0x1401e9510]
lea rdx, [rbp + 0x18]
mov dword [rbp + 0x18], 0x43020000
mov dword [rbp + 0x1c], 0x42200000
mov rax, qword [rcx + 0x3ea0]
mov byte [rax + 0xb0], 1
mov rax, qword [rcx + 0x3ea0]
movss xmm1, dword [rax + 0x18]
movss xmm0, dword [rax + 0x1c]
subss xmm1, dword [rax + 0x7c]
subss xmm0, dword [rax + 0x80]
mov byte [rax + 0x139], 1
addss xmm1, xmm7
addss xmm0, xmm6
movss dword [rax + 0xf8], xmm1
movss dword [rax + 0xfc], xmm0
lea rcx, str.Login
call fcn.140036ed0
test al, al
je 0x140054e49
lea rdx, [0x1401e9560]
lea rcx, [rbp + 0x8c8]
call fcn.140041b30
lea rdx, [0x1401e9650]
mov rbx, rax
lea rcx, [rbp + 0x8e8]
call fcn.140041b30
mov r8, rbx
lea rcx, [0x14020a8e0]
mov rdx, rax
call fcn.1400673b0
cmp byte [0x14020aaf0], sil
jmp 0x140054e42
mov byte [0x1401e950c], 1
mov rcx, qword [0x1401e9510]
lea rdx, [rbp + 0x20]
mov dword [rbp + 0x20], 0x43020000
mov dword [rbp + 0x24], 0x42200000
mov rax, qword [rcx + 0x3ea0]
mov byte [rax + 0xb0], 1
mov rax, qword [rcx + 0x3ea0]
lea rcx, str.Register
movss xmm1, dword [rax + 0x18]
movss xmm0, dword [rax + 0x1c]
subss xmm1, dword [rax + 0x7c]
subss xmm0, dword [rax + 0x80]
mov byte [rax + 0x139], 1
addss xmm1, dword [0x1400e0168]
addss xmm0, xmm6
movss dword [rax + 0xf8], xmm1
movss dword [rax + 0xfc], xmm0
call fcn.140036ed0
test al, al
je 0x140054f6d
lea rdx, [0x1400cfcfa]
lea rcx, [rbp + 0x908]
call fcn.140041b30
lea rdx, [0x1401e95e0]
mov rsi, rax
lea rcx, [rbp + 0x7e8]
call fcn.140041b30
lea rdx, [0x1401e9560]
mov rdi, rax
lea rcx, [rbp + 0x808]
call fcn.140041b30
lea rdx, [0x1401e9650]
mov rbx, rax
lea rcx, [rbp + 0x828]
call fcn.140041b30
mov r9, rdi
mov qword [rsp + 0x20], rsi
mov r8, rbx
lea rcx, [0x14020a8e0]
mov rdx, rax
call fcn.140069b70
cmp byte [0x14020aaf0], 0
jmp 0x140054f64
mov byte [0x1401e950c], 1
xor esi, esi
call fcn.140016e40
call fcn.14000bed0
call fcn.140051ce0
call fcn.140012470
cmp byte [0x1401e950c], 0
je 0x14005753e
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea r10, [rbp + 0x435]
mov rbx, rax
mov r8d, r13d
test r13d, r13d
jns 0x140054ff0
neg r8d
nop dword [rax + rax]
dec r10
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x140054fb0
dec r10
mov byte [r10], reloc.WLDAP32.dll_Ordinal_45
jmp 0x14005501a
dec r10
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x140054ff0
lea r9, [rsp + 0x64]
mov rdx, r10
lea r8, [rbp + 0x435]
lea rcx, [rbp + 0x360]
call fcn.140042520
cmp qword [rbp + 0x378], 0xf
lea rdx, [rbp + 0x360]
lea rcx, [rbp + 0x340]
cmova rdx, qword [rbp + 0x360]
call fcn.140041b30
mov rdx, qword [rbp + 0x378]
cmp rdx, 0xf
jbe 0x140055099
mov rcx, qword [rbp + 0x360]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055094
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005785d
call fcn.1400bc8d4
mov rcx, qword [rbp + 0x350]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 0xc
jb 0x1400578a6
cmp qword [rbp + 0x358], 0xf
lea rax, [rbp + 0x340]
mov qword [rsp + 0x30], rcx
lea r9, str.Dias_:_99999
cmova rax, qword [rbp + 0x340]
lea rcx, [rbp + 0x1e0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], recvfrom
call fcn.1400422d0
xorps xmm0, xmm0
lea rdx, [rbp + 0x748]
movups xmmword [rbp + 0x748], xmm0
movups xmmword [rbp + 0x758], xmm0
movups xmmword [rbp + 0x768], xmm0
call fcn.1400472d0
cmp qword [rbp + 0x1f8], 0xf
lea rax, [rbp + 0x1e0]
xorps xmm0, xmm0
lea rcx, [0x1401ea700]
cmova rax, qword [rbp + 0x1e0]
movups xmmword [rbp + 0x620], xmm0
movups xmmword [rbp + 0x630], xmm0
movups xmmword [rbp + 0x600], xmm0
mov qword [rbp + 0x600], rax
lea rax, str.https:__i.postimg.cc_ZqxdHWn7_623792c78456812d83613c5ddc6cadbf.png
mov qword [rbp + 0x620], rax
lea rax, str.EmoRtion_Cheats_1
mov qword [rbp + 0x628], rax
lea rax, str.https:__media.giphy.com_media_v1.Y2lkPTc5MGI3NjExdXBmczk0anN0dWtod2plc2d4dDBiZjVxMG1reHR2ZDNvenZqMG5hbyZlcD12MV9pbnRlcm5hbF9naWZfYnlfaWQmY3Q9Zw_rK6KIhBmD4h9AVxvqm_giphy.gif
mov qword [rbp + 0x630], rax
lea rax, str.____GHOSTxD
movups xmmword [rbp + 0x610], xmm0
mov qword [rbp + 0x638], rax
movups xmmword [rbp + 0x640], xmm0
mov qword [rbp + 0x610], rbx
movups xmmword [rbp + 0x650], xmm0
movups xmmword [rbp + 0x660], xmm0
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
jne 0x140057891
cmp dword [0x1401ea74c], 0x7fffffff
je 0x14005787b
mov r8d, dword [reloc.WS2_32.dll_accept]
lea rcx, [0x14020b038]
lea eax, [r8 + 1]
mov dword [reloc.WS2_32.dll_accept], eax
lea rax, [rbp + 0x600]
mov qword [rsp + 0x20], rax
call fcn.14004bab0
mov qword [0x14020b030], rax
lea rcx, [0x1401ea700]
mov eax, 1
xchg byte [0x1401e969a], al
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rcx, qword [0x14020aef0]
test rcx, rcx
je 0x14005522c
add rcx, 0x58
call qword [sym.imp.MSVCP140.dll__Cnd_broadcast]
cmp qword [0x1401e95d8], 0
jne 0x14005526d
mov rcx, qword [0x14021f400]
lea rax, [0x1401e95d8]
mov qword [rsp + 0x30], rsi
lea r9, [rbp + 0x268]
mov qword [rsp + 0x28], rax
lea rdx, [0x14017c170]
mov r8d, 0x257b2
mov qword [rsp + 0x20], rsi
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
mov r8d, 0x20ab
lea rdx, reloc.WS2_32.dll_accept
lea rcx, str.Hello__world_
call fcn.14000fab0
mov rcx, qword [0x1401e9510]
mov dword [rbp + 0x28], 0x443e0000
mov dword [rbp + 0x2c], 0x41200000
mov rax, qword [rcx + 0x3ea0]
mov byte [rax + 0xb0], 1
mov rbx, qword [rcx + 0x3ea0]
cmp dword [rbx + 0xe8], 0
jg 0x1400552d3
mov r8d, 0x736
lea rdx, str.C:UsersAdministratorDesktopMax11Max11Maximgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rax, dword [rbx + 0xe8]
lea rcx, str.CLOSE
mov r8, qword [rbx + 0xf0]
xor edx, edx
mov r8d, dword [r8 + rax*4 - 4]
call fcn.140003d20
mov rcx, qword [0x1401e9510]
mov edi, eax
cmp dword [rcx + 0x3ee8], eax
jne 0x140055318
lea r8, str.CLOSE
mov edx, listen
mov ecx, eax
call fcn.14001eb10
lea rdx, [rbp + 0x28]
mov ecx, edi
call fcn.140038660
test al, al
jne 0x140057872
cmp dword [rbx + 0xe8], 0
mov dword [rbp + 0x30], 0x44340000
mov dword [rbp + 0x34], 0x41200000
jg 0x14005535c
mov r8d, 0x736
lea rdx, str.C:UsersAdministratorDesktopMax11Max11Maximgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rax, dword [rbx + 0xe8]
lea rcx, str.MIN
mov r8, qword [rbx + 0xf0]
xor edx, edx
mov r8d, dword [r8 + rax*4 - 4]
call fcn.140003d20
mov rcx, qword [0x1401e9510]
mov ebx, eax
cmp dword [rcx + 0x3ee8], eax
jne 0x1400553a1
lea r8, str.MIN
mov edx, listen
mov ecx, eax
call fcn.14001eb10
lea rdx, [rbp + 0x30]
mov ecx, ebx
call fcn.1400383c0
test al, al
je 0x1400553c4
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rax
mov edx, 6
call qword [sym.imp.USER32.dll_ShowWindow]
mov r13, qword [0x1401e9510]
movaps xmm0, xmmword [0x1400e03a0]
movups xmmword [rbp + 0x528], xmm0
mov rax, qword [r13 + 0x3ea0]
movss xmm11, dword [rax + 0x18]
movss xmm12, dword [rax + 0x1c]
movaps xmm10, xmm11
addss xmm10, dword [0x1400e0198]
mov byte [rax + 0xb0], 1
movaps xmm8, xmm12
mov rcx, qword [r13 + 0x3ea0]
movaps xmm9, xmm11
addss xmm8, dword [0x1400e0184]
addss xmm9, dword [0x1400e0150]
movaps xmm7, xmm12
movss dword [rbp + 0x38], xmm10
mov rax, qword [rcx + 0x290]
addss xmm7, xmm13
movss dword [rbp + 0x3c], xmm8
movss dword [rbp + 0x40], xmm9
mov ebx, dword [rax + 0x20]
mov byte [rcx + 0xb0], 1
lea rcx, [rbp + 0x528]
movss dword [rbp + 0x44], xmm7
call fcn.140004350
mov rcx, qword [r13 + 0x3ea0]
lea r8, [rbp + 0x38]
movss xmm0, dword [r13 + 0x37f0]
lea rdx, [rbp + 0x40]
mov r9d, eax
mov dword [rsp + 0x28], 0xa0
movss dword [rsp + 0x20], xmm0
mov rcx, qword [rcx + 0x290]
call fcn.14002bbb0
mov r10, qword [0x1401e9510]
movaps xmm6, xmm11
movaps xmm0, xmmword [0x1400e03f0]
movaps xmm1, xmmword [0x1400e0450]
addss xmm6, dword [0x1400e014c]
mov rax, qword [r10 + 0x3ea0]
movups xmmword [rbp + 0x538], xmm0
movups xmmword [rbp + 0x548], xmm1
mov byte [rax + 0xb0], 1
mov rcx, qword [r10 + 0x3ea0]
mov rax, qword [rcx + 0x290]
mov r8d, dword [rax + 0x20]
mov byte [rcx + 0xb0], 1
lea rcx, [rbp + 0x538]
call fcn.140004350
lea rcx, [rbp + 0x548]
mov r9d, eax
call fcn.140004350
mov rcx, qword [r10 + 0x3ea0]
movaps xmm0, xmm10
mov dword [rsp + 0x30], r9d
mov edx, ebx
unpcklps xmm6, xmm7
unpcklps xmm0, xmm8
movq r9, xmm6
mov rcx, qword [rcx + 0x290]
mov dword [rsp + 0x28], eax
movsd qword [rsp + 0x20], xmm0
call fcn.14002cf00
mov r8, qword [0x1401e9510]
lea rcx, [rbp + 0x558]
movaps xmm0, xmmword [0x1400e0350]
movaps xmm6, xmm11
addss xmm6, xmm13
movss dword [rbp + 0x48], xmm9
movss dword [rbp + 0x4c], xmm8
mov rax, qword [r8 + 0x3ea0]
movss dword [rbp + 0x54], xmm7
movups xmmword [rbp + 0x558], xmm0
mov byte [rax + 0xb0], 1
movss dword [rbp + 0x50], xmm6
call fcn.140004350
movss xmm0, dword [r13 + 0x37f0]
mov r9d, eax
mov rcx, qword [r8 + 0x3ea0]
mov dword [rsp + 0x28], 0x50
movss dword [rsp + 0x20], xmm0
mov rcx, qword [rcx + 0x290]
lea r8, [rbp + 0x48]
lea rdx, [rbp + 0x50]
call fcn.14002bbb0
mov r8, qword [0x1401e9510]
lea rcx, [rbp + 0x568]
movaps xmm0, xmmword [0x1400e0480]
movss dword [rbp + 0x58], xmm10
movss dword [rbp + 0x5c], xmm8
mov rax, qword [r8 + 0x3ea0]
movss dword [rbp + 0x60], xmm6
movss dword [rbp + 0x64], xmm7
movups xmmword [rbp + 0x568], xmm0
mov byte [rax + 0xb0], 1
call fcn.140004350
mov rcx, qword [r8 + 0x3ea0]
lea rdx, [rbp + 0x60]
movss xmm0, dword [0x1400e007c]
lea r8, [rbp + 0x58]
movss dword [rsp + 0x30], xmm0
mov r9d, eax
movss xmm0, dword [r13 + 0x37f0]
mov rcx, qword [rcx + 0x290]
movss dword [rsp + 0x20], xmm0
call fcn.14002baa0
mov r8, qword [0x1401e9510]
lea rcx, [rbp + 0x578]
movaps xmm0, xmmword [0x1400e0480]
movaps xmm1, xmm11
addss xmm1, dword [0x1400e0154]
movss dword [rbp + 0x6c], xmm8
mov rax, qword [r8 + 0x3ea0]
movss dword [rbp + 0x70], xmm9
movss dword [rbp + 0x74], xmm7
movss dword [rbp + 0x68], xmm1
mov byte [rax + 0xb0], 1
movups xmmword [rbp + 0x578], xmm0
call fcn.140004350
mov rcx, qword [r8 + 0x3ea0]
lea rdx, [rbp + 0x70]
mov r9d, eax
mov dword [rsp + 0x28], esi
lea r8, [rbp + 0x68]
movss dword [rsp + 0x20], xmm13
mov rcx, qword [rcx + 0x290]
call fcn.14002bbb0
mov r8, qword [0x1401e9510]
lea rcx, [rbp + 0x588]
movaps xmm0, xmmword [0x1400e04a0]
movaps xmm1, xmm12
addss xmm1, dword [0x1400e011c]
movaps xmm6, xmm11
movss dword [rbp + 0x78], xmm9
mov rax, qword [r8 + 0x3ea0]
addss xmm6, dword [0x1400e010c]
movups xmmword [rbp + 0x588], xmm0
mov byte [rax + 0xb0], 1
movss dword [rbp + 0x7c], xmm1
movss dword [rbp + 0x80], xmm6
movss dword [rbp + 0x84], xmm1
call fcn.140004350
mov rcx, qword [r8 + 0x3ea0]
lea rdx, [rbp + 0x80]
mov r9d, eax
movss dword [rsp + 0x20], xmm13
lea r8, [rbp + 0x78]
mov rcx, qword [rcx + 0x290]
call fcn.14002b940
mov r8, qword [0x1401e9510]
lea rcx, [rbp + 0x598]
movaps xmm0, xmmword [0x1400e0470]
movaps xmm1, xmm12
addss xmm1, dword [0x1400e012c]
movss dword [rbp + 0x88], xmm10
mov rax, qword [r8 + 0x3ea0]
movss dword [rbp + 0x90], xmm9
movups xmmword [rbp + 0x598], xmm0
mov byte [rax + 0xb0], 1
movss dword [rbp + 0x8c], xmm1
movss dword [rbp + 0x94], xmm1
call fcn.140004350
mov rcx, qword [r8 + 0x3ea0]
lea rdx, [rbp + 0x90]
mov r9d, eax
movss dword [rsp + 0x20], xmm13
lea r8, [rbp + 0x88]
mov rcx, qword [rcx + 0x290]
call fcn.14002b940
movaps xmm0, xmmword [0x1400e0590]
lea rcx, [rbp + 0x5a8]
mov r8, qword [0x1401e9510]
movaps xmm1, xmm12
addss xmm1, dword [0x1400e0120]
movups xmmword [rbp + 0x5a8], xmm0
mov dword [rbp + 0x98], 0x3f800000
mov rax, qword [r8 + 0x3ea0]
movaps xmm0, xmm11
addss xmm0, dword [0x1400e0194]
addss xmm11, dword [0x1400e0190]
movss dword [rbp + 0xac], xmm1
mov byte [rax + 0xb0], 1
mov dword [rbp + 0x9c], 0x3f800000
movss dword [rbp + 0xa8], xmm0
movaps xmm0, xmm12
addss xmm0, dword [0x1400e00e0]
movss dword [rbp + 0xb0], xmm11
mov qword [rbp + 0xa0], 0
movss dword [rbp + 0xb4], xmm0
call fcn.140004350
mov rcx, qword [r8 + 0x3ea0]
lea r9, [rbp + 0xa8]
mov rdx, qword [0x1401e9638]
lea r8, [rbp + 0xb0]
mov dword [rsp + 0x30], eax
lea rax, [rbp + 0x98]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xa0]
mov rcx, qword [rcx + 0x290]
mov qword [rsp + 0x20], rax
call fcn.14002c680
mov rcx, qword [0x1401e9510]
movaps xmm0, xmmword [0x1400e0590]
movups xmmword [rbp + 0x5b8], xmm0
mov rax, qword [rcx + 0x3ea0]
mov byte [rax + 0xb0], 1
mov rax, qword [rcx + 0x3ea0]
lea rcx, [rbp + 0x5b8]
mov rdi, qword [rax + 0x290]
call fcn.140004350
movss xmm7, dword [0x1400e00dc]
mov esi, eax
mov rbx, qword [0x1401e9530]
addss xmm12, xmm7
movss dword [rbp + 0xb8], xmm6
movss dword [rbp + 0xbc], xmm12
test eax, 0xff000000
je 0x1400559aa
test rbx, rbx
jne 0x140055923
mov rcx, qword [rdi + 0x38]
mov rbx, qword [rcx + 8]
mov rcx, qword [rbx + 0x40]
mov rax, qword [rdi + 0x98]
cmp qword [rcx + 8], rax
je 0x14005594e
mov r8d, 0x663
lea rdx, str.C:UsersAdministratorDesktopMax11Max11Maximgui_draw.cpp
lea rcx, str.font__ContainerAtlas__TexID___CmdHeader.TextureId
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movups xmm0, xmmword [rdi + 0x88]
lea rax, [0x1400dfa31]
mov byte [rsp + 0x48], 0
movss xmm2, dword [0x1400e00ec]
lea r9, [rbp + 0xb8]
movss dword [rsp + 0x40], xmm13
mov rdx, rdi
mov qword [rsp + 0x38], rax
mov rcx, rbx
lea rax, str.RMICHA_X
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x5c8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
movups xmmword [rbp + 0x5c8], xmm0
call fcn.140031e70
mov rcx, qword [0x1401e9510]
mov rax, qword [rcx + 0x3ea0]
mov byte [rax + 0xb0], 1
mov rax, qword [rcx + 0x3ea0]
movss xmm0, dword [rax + 0x1c]
subss xmm0, dword [rax + 0x80]
mov byte [rax + 0x139], 1
addss xmm0, dword [0x1400e0128]
movss dword [rax + 0xfc], xmm0
call fcn.14004de20
call fcn.140016cf0
movaps xmm0, xmmword [0x1400e0500]
lea rdx, str._t__EXTERNAL
lea rcx, [rbp + 0x5d8]
movups xmmword [rbp + 0x5d8], xmm0
call fcn.140035fd0
cmp dword [0x1401e9544], 0
lea r9, [rbp + 0xc0]
lea rdx, str.Hacks
mov dword [rbp + 0xc0], 0x43480000
sete r8b
mov dword [rbp + 0xc4], 0x41c80000
xor esi, esi
lea rcx, [0x1400d15cc]
mov dword [rsp + 0x28], esi
mov byte [rsp + 0x20], 1
call fcn.1400376b0
test al, al
je 0x140055a63
mov dword [0x1401e9544], esi
movaps xmm0, xmmword [0x1400e0500]
lea rdx, str._t__VISUALS
lea rcx, [rbp + 0x5e8]
movups xmmword [rbp + 0x5e8], xmm0
call fcn.140035fd0
cmp dword [0x1401e9544], 1
lea r9, [rbp + 0xc8]
mov dword [rsp + 0x28], esi
lea rdx, str.Locations
sete r8b
mov dword [rbp + 0xc8], 0x43480000
lea rcx, [0x1400d15c4]
mov dword [rbp + 0xcc], 0x41c80000
mov byte [rsp + 0x20], 1
call fcn.1400376b0
test al, al
je 0x140055ad4
mov dword [0x1401e9544], 1
movaps xmm0, xmmword [0x1400e0500]
lea rdx, str._t__OTHER
lea rcx, [rbp + 0x438]
movups xmmword [rbp + 0x438], xmm0
call fcn.140035fd0
cmp dword [0x1401e9544], 4
lea r9, [rbp + 0xd0]
mov dword [rsp + 0x28], esi
lea rdx, str.Settings
sete r8b
mov dword [rbp + 0xd0], 0x43480000
lea rcx, [0x1400d15dc]
mov dword [rbp + 0xd4], 0x41c80000
mov byte [rsp + 0x20], 1
call fcn.1400376b0
test al, al
je 0x140055b45
mov dword [0x1401e9544], 4
call fcn.140016e40
mov eax, dword [0x1401e9544]
cmp eax, dword [0x1401e9540]
movss xmm8, dword [0x1400e01d4]
jne 0x140055b67
movaps xmm6, xmm14
jmp 0x140055b6b
movaps xmm6, xmm8
mov rbx, qword [0x1401e9510]
test rbx, rbx
jne 0x140055b9e
mov r8d, 0xfdc
lea rdx, str.C:UsersAdministratorDesktopMax11Max11Maximgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov eax, dword [0x1401e9544]
mov rbx, qword [0x1401e9510]
movss xmm0, dword [rbx + 0x18]
movss xmm9, dword [0x1400e009c]
mulss xmm0, xmm9
mulss xmm0, xmm6
addss xmm0, dword [0x1401e95a4]
comiss xmm13, xmm0
jbe 0x140055bc9
movaps xmm6, xmm13
jmp 0x140055bd1
movaps xmm6, xmm14
minss xmm6, xmm0
ucomiss xmm6, xmm13
movss dword [0x1401e95a4], xmm6
jp 0x140055bf7
jne 0x140055bf7
movss xmm0, dword [0x1401e95b0]
ucomiss xmm0, xmm13
jp 0x140055bf7
jne 0x140055bf7
mov dword [0x1401e9540], eax
movss xmm0, dword [rbx + 0x37e0]
lea rcx, [rbx + 0x47f8]
mulss xmm6, dword [r13 + 0x37e0]
lea rdx, [rbp + 0x220]
mov dword [rbp + 0x220], esi
movss dword [rbp + 0x224], xmm0
call fcn.14001f3c0
mov rcx, qword [0x1401e9510]
movss dword [rbx + 0x37e0], xmm6
mov rax, qword [rcx + 0x3ea0]
mov byte [rax + 0xb0], 1
mov rax, qword [rcx + 0x3ea0]
movss xmm1, dword [rax + 0x18]
movss xmm0, dword [rax + 0x1c]
subss xmm1, dword [rax + 0x7c]
subss xmm0, dword [rax + 0x80]
mov byte [rax + 0x139], 1
addss xmm1, dword [0x1400e0160]
addss xmm0, dword [0x1400e0124]
movss dword [rax + 0xf8], xmm1
movss dword [rax + 0xfc], xmm0
call fcn.140016cf0
cmp dword [0x1401e9540], esi
jne 0x140055ce3
cmp dword [0x1401e9548], esi
lea r9, [rbp + 0xd8]
mov dword [rsp + 0x28], esi
lea rdx, str.Functions_Hacks
sete r8b
mov dword [rbp + 0xd8], 0x43020000
lea rcx, [0x1400cfcfa]
mov dword [rbp + 0xdc], 0x41c80000
mov byte [rsp + 0x20], sil
call fcn.1400376b0
test al, al
je 0x140055ce3
mov dword [0x1401e9548], esi
cmp dword [0x1401e9540], 1
jne 0x140055d37
cmp dword [0x1401e9548], esi
lea r9, [rbp + 0xe0]
mov dword [rsp + 0x28], esi
lea rdx, str.Function_Location
sete r8b
mov dword [rbp + 0xe0], 0x43020000
lea rcx, [0x1400cfcfa]
mov dword [rbp + 0xe4], 0x41c80000
mov byte [rsp + 0x20], sil
call fcn.1400376b0
test al, al
je 0x140055d37
mov dword [0x1401e9548], esi
cmp dword [0x1401e9540], 4
jne 0x140055d8b
cmp dword [0x1401e9548], esi
lea r9, [rbp + 0xe8]
mov dword [rsp + 0x28], esi
lea rdx, str.Settings
sete r8b
mov dword [rbp + 0xe8], 0x43020000
lea rcx, [0x1400cfcfa]
mov dword [rbp + 0xec], 0x41c80000
mov byte [rsp + 0x20], sil
call fcn.1400376b0
test al, al
je 0x140055d8b
mov dword [0x1401e9548], esi
call fcn.140016e40
mov eax, dword [0x1401e9548]
cmp eax, dword [0x1401e95ac]
jne 0x140055da4
movaps xmm6, xmm14
jmp 0x140055da8
movaps xmm6, xmm8
mov rbx, qword [0x1401e9510]
test rbx, rbx
jne 0x140055ddb
mov r8d, 0xfdc
lea rdx, str.C:UsersAdministratorDesktopMax11Max11Maximgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov eax, dword [0x1401e9548]
mov rbx, qword [0x1401e9510]
movss xmm0, dword [rbx + 0x18]
mulss xmm0, xmm9
mulss xmm0, xmm6
addss xmm0, dword [0x1401e9640]
comiss xmm13, xmm0
jbe 0x140055dfd
movaps xmm6, xmm13
jmp 0x140055e05
movaps xmm6, xmm14
minss xmm6, xmm0
ucomiss xmm6, xmm13
movss dword [0x1401e9640], xmm6
jp 0x140055e2b
jne 0x140055e2b
movss xmm0, dword [0x1401e95a8]
ucomiss xmm0, xmm13
jp 0x140055e2b
jne 0x140055e2b
mov dword [0x1401e95ac], eax
movss xmm0, dword [rbx + 0x37e0]
lea rcx, [rbx + 0x47f8]
mulss xmm6, dword [r13 + 0x37e0]
lea rdx, [rbp + 0x258]
mov dword [rbp + 0x258], esi
movss dword [rbp + 0x25c], xmm0
call fcn.14001f3c0
mov rcx, qword [0x1401e9510]
lea rdx, [rbp + 0xf0]
movss dword [rbx + 0x37e0], xmm6
mov dword [rbp + 0xf0], 0x440d8000
mov dword [rbp + 0xf4], 0x43de8000
mov rax, qword [rcx + 0x3ea0]
mov byte [rax + 0xb0], 1
mov rax, qword [rcx + 0x3ea0]
lea rcx, str.General_CHILD
movss xmm1, dword [rax + 0x18]
movss xmm0, dword [rax + 0x1c]
subss xmm1, dword [rax + 0x7c]
subss xmm0, dword [rax + 0x80]
mov byte [rax + 0x139], 1
addss xmm1, dword [0x1400e0164]
addss xmm0, dword [0x1400e0134]
movss dword [rax + 0xf8], xmm1
movss dword [rax + 0xfc], xmm0
call fcn.14000bd90
mov eax, dword [0x1401e9540]
test eax, eax
jne 0x1400560f3
cmp dword [0x1401e95ac], esi
jne 0x140056d04
call fcn.140016cf0
lea rdx, [rbp + 0xf8]
mov dword [rbp + 0xf8], 0x43858000
lea rcx, str.KeyBinds
mov dword [rbp + 0xfc], 0x43480000
call fcn.14000cd10
mov r8b, 1
lea rdx, [0x1401e9694]
lea rcx, str.Aimbot_Head
call fcn.1400347c0
mov ecx, 0x200
call fcn.140007de0
mov r8b, 1
lea rdx, [0x1401e9554]
lea rcx, str.Aimbot_Drag
call fcn.1400347c0
mov ecx, 0x200
call fcn.140007de0
mov r8b, 1
lea rdx, [0x1401e95c0]
lea rcx, str.Wall_Hack
call fcn.1400347c0
mov ecx, 0x200
call fcn.140007de0
call fcn.14000ce10
call fcn.140016e40
movaps xmm1, xmm7
movaps xmm0, xmm13
call fcn.140016a90
call fcn.140016cf0
lea rdx, [rbp + 0x100]
mov dword [rbp + 0x100], 0x43858000
lea rcx, str.Sniper_Functions
mov dword [rbp + 0x104], 0x43480000
call fcn.14000cd10
lea rdx, [0x1401e95c4]
lea rcx, str.Aim_Sniper
call fcn.140039650
mov ecx, 0x200
mov byte [0x1401e950b], al
call fcn.140007de0
lea rdx, [0x1401e9636]
lea rcx, str.Quick_Switch
call fcn.140039650
mov ecx, 0x200
mov byte [0x1401e9649], al
call fcn.140007de0
lea rdx, [0x1401e9624]
lea rcx, str.Sniper_Scope
call fcn.140039650
mov ecx, 0x200
mov byte [0x1401e9553], al
call fcn.140007de0
call fcn.14000ce10
call fcn.140016e40
call fcn.140016cf0
lea rdx, [rbp + 0x108]
mov dword [rbp + 0x108], 0x43858000
lea rcx, str.Functions_Hack
mov dword [rbp + 0x10c], 0x43480000
call fcn.14000cd10
lea rdx, [0x1401e9622]
lea rcx, str.Aimbot_Body_V2
call fcn.140039650
mov ecx, 0x200
mov byte [0x1401e9550], al
call fcn.140007de0
lea rdx, [0x1401e9630]
lea rcx, str.Aimbot_Scope
call fcn.140039650
mov ecx, 0x200
mov byte [0x1401e95b5], al
call fcn.140007de0
lea rdx, [0x1401e962c]
lea rcx, str.No_Recoil
call fcn.140039650
mov ecx, 0x200
mov byte [0x1401e95a1], al
call fcn.140007de0
call fcn.14000ce10
call fcn.140016e40
movaps xmm1, xmm15
movaps xmm0, xmm13
call fcn.140016a90
mov eax, dword [0x1401e9540]
cmp eax, 1
jne 0x140056534
cmp dword [0x1401e95ac], esi
jne 0x140056d04
call fcn.140016cf0
lea rdx, [rbp + 0x110]
mov dword [rbp + 0x110], 0x43858000
lea rcx, str.Locations
mov dword [rbp + 0x114], 0x43720000
call fcn.14000cd10
lea rdx, [0x1401e954f]
lea rcx, str.Chams_Menu
call fcn.140039650
test al, al
je 0x14005622d
cmp byte [0x1401e954f], sil
je 0x14005622d
call fcn.140052f30
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov rcx, rax
mov rdi, rax
lea r8d, [rdx + 0x19]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, Ordinal_26
mov qword [rsp + 0x20], rsi
mov rdx, rax
lea r8, str.C:Windows_temphk4x.dll
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x1400df5c0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov r9, rax
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r9d, 0x8000
mov r8d, Ordinal_26
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.Chams_Menu_Activated
lea rcx, [0x1401e86d8]
call fcn.140041da0
lea rdx, [0x1401e9637]
lea rcx, str.Chams_3D
call fcn.140039650
test al, al
je 0x140056326
cmp byte [0x1401e9637], sil
je 0x140056326
call fcn.140052f30
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov rcx, rax
mov rdi, rax
lea r8d, [rdx + 0x1d]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, Ordinal_32
mov qword [rsp + 0x20], rsi
mov rdx, rax
lea r8, str.C:Windows_tempFX_CHAMS.dll
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x1400df5c0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov r9, rax
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r9d, 0x8000
mov r8d, Ordinal_32
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r8d, reloc.WS2_32.dll_select
lea rdx, str.Chams_3D_Activated
lea rcx, [0x1401e86d8]
call fcn.140041da0
lea rdx, [0x1401e9551]
lea rcx, str.Chams_Color__Orange_
call fcn.140039650
test al, al
je 0x14005641f
cmp byte [0x1401e9551], sil
je 0x14005641f
call fcn.140052f30
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov rcx, rax
mov rdi, rax
lea r8d, [rdx + 0x1b]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, reloc.WLDAP32.dll_Ordinal_27
mov qword [rsp + 0x20], rsi
mov rdx, rax
lea r8, str.C:Windows_tempOrange.dll
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x1400df5c0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov r9, rax
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r9d, 0x8000
mov r8d, reloc.WLDAP32.dll_Ordinal_27
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str.Chams_Color_Activated
lea rcx, [0x1401e86d8]
call fcn.140041da0
lea rdx, [0x1401e954d]
lea rcx, str.Esp_Box__Blue_
call fcn.140039650
test al, al
je 0x140056518
cmp byte [0x1401e954d], sil
je 0x140056518
call fcn.140052f30
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov rcx, rax
mov rdi, rax
lea r8d, [rdx + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, reloc.WLDAP32.dll_Ordinal_32
mov qword [rsp + 0x20], rsi
mov rdx, rax
lea r8, str.C:Windows_tempFX_BLUE_BOX.dll
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x1400df5c0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov r9, rax
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r9d, 0x8000
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.Esp_Box_Activated
lea rcx, [0x1401e86d8]
call fcn.140041da0
call fcn.14000ce10
call fcn.140016e40
movaps xmm1, xmm7
movaps xmm0, xmm13
call fcn.140016a90
mov eax, dword [0x1401e9540]
cmp eax, 3
jne 0x140056651
cmp dword [0x1401e95ac], esi
jne 0x140056d04
call fcn.140016cf0
lea rdx, [rbp + 0x118]
mov dword [rbp + 0x118], 0x43870000
lea rcx, str.Security_Options
mov dword [rbp + 0x11c], 0x43700000
call fcn.14000cd10
lea rdx, [0x1401e9625]
lea rcx, str.Bypass_Emulator
call fcn.140039650
mov ecx, 0x200
mov byte [0x1401e9559], al
call fcn.140007de0
test al, al
je 0x1400565a8
lea rcx, str.Applies_in_Login
call fcn.140017d30
lea rdx, [0x1401e9632]
lea rcx, str.Reduce_Risk_Logo
call fcn.140039650
mov ecx, 0x200
mov byte [0x1401e9645], al
call fcn.140007de0
test al, al
je 0x1400565db
lea rcx, str.Applies_in_Logo
call fcn.140017d30
lea rdx, [0x1401e95b7]
lea rcx, str.Reduce_Risk_Login
call fcn.140039650
mov ecx, 0x200
mov byte [0x1401e950a], al
call fcn.140007de0
test al, al
je 0x14005660e
lea rcx, str.Applies_in_Login
call fcn.140017d30
lea rdx, [0x1401e95c6]
lea rcx, str.Reduce_Risk_Login_2
call fcn.140039650
mov ecx, 0x200
mov byte [0x1401e950e], al
call fcn.140007de0
test al, al
je 0x140056641
lea rcx, str.Applies_in_Login
call fcn.140017d30
call fcn.14000ce10
call fcn.140016e40
mov eax, dword [0x1401e9540]
cmp eax, 4
jne 0x140056d04
cmp dword [0x1401e95ac], esi
jne 0x140056d04
call fcn.140016cf0
lea rdx, [rbp + 0x120]
mov dword [rbp + 0x120], 0x43858000
lea rcx, str.Login_Information
mov dword [rbp + 0x124], 0x43720000
call fcn.14000cd10
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea r10, [rbp + 0x6b5]
dec r10
mov eax, 0xcccccccd
mul r14d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r14b, cl
add r14b, 0x30
mov byte [r10], r14b
mov r14d, edx
test edx, edx
jne 0x1400566a1
lea r9, [rsp + 0x65]
mov rdx, r10
lea r8, [rbp + 0x6b5]
lea rcx, [rbp + 0x380]
call fcn.140042520
cmp qword [rbp + 0x398], 0xf
lea rdx, [rbp + 0x380]
lea rcx, [rbp + 0x728]
cmova rdx, qword [rbp + 0x380]
call fcn.140041b30
mov rdx, qword [rbp + 0x398]
cmp rdx, 0xf
jbe 0x14005674a
mov rcx, qword [rbp + 0x380]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056745
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140057864
call fcn.1400bc8d4
lea r10, [rbp + 0x6cd]
dec r10
mov eax, 0xcccccccd
mul r15d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r15b, cl
add r15b, 0x30
mov byte [r10], r15b
mov r15d, edx
test edx, edx
jne 0x140056751
lea r9, [rsp + 0x66]
mov rdx, r10
lea r8, [rbp + 0x6cd]
lea rcx, [rbp + 0x3a0]
call fcn.140042520
cmp qword [rbp + 0x3b8], 0xf
lea rdx, [rbp + 0x3a0]
lea rcx, [rbp + 0x708]
cmova rdx, qword [rbp + 0x3a0]
call fcn.140041b30
mov rdx, qword [rbp + 0x3b8]
cmp rdx, 0xf
jbe 0x1400567fa
mov rcx, qword [rbp + 0x3a0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400567f5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140057864
call fcn.1400bc8d4
lea r10, [rbp + 0x6e5]
dec r10
mov eax, 0xcccccccd
mul r12d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r12b, cl
add r12b, 0x30
mov byte [r10], r12b
mov r12d, edx
test edx, edx
jne 0x140056801
lea r9, [rsp + 0x67]
mov rdx, r10
lea r8, [rbp + 0x6e5]
lea rcx, [rbp + 0x3c0]
call fcn.140042520
cmp qword [rbp + 0x3d8], 0xf
lea rdx, [rbp + 0x3c0]
lea rcx, [rbp + 0x6e8]
cmova rdx, qword [rbp + 0x3c0]
call fcn.140041b30
mov rdx, qword [rbp + 0x3d8]
cmp rdx, 0xf
jbe 0x1400568aa
mov rcx, qword [rbp + 0x3c0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400568a5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140057864
call fcn.1400bc8d4
mov rcx, qword [0x14020aa30]
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
sub rax, rcx
cmp rax, 0xa
jb 0x1400578ac
cmp qword [0x14020aa38], 0xf
lea rax, [0x14020aa20]
mov qword [rsp + 0x30], rcx
lea r9, str.Username:
cmova rax, qword [0x14020aa20]
lea rcx, [rbp + 0x1c0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0xa
call fcn.1400422d0
mov rcx, qword [0x14020aab0]
mov rax, rbx
sub rax, rcx
cmp rax, 6
jb 0x1400578ac
cmp qword [0x14020aab8], 0xf
lea rax, [0x14020aaa0]
mov qword [rsp + 0x30], rcx
lea r9, str.Days:
cmova rax, qword [0x14020aaa0]
lea rcx, [rbp + 0x160]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 6
call fcn.1400422d0
mov rcx, qword [0x14020aa50]
mov rax, rbx
sub rax, rcx
cmp rax, 4
jb 0x1400578ac
cmp qword [0x14020aa58], 0xf
lea rax, [0x14020aa40]
mov qword [rsp + 0x30], rcx
lea r9, str.Ip:
cmova rax, qword [0x14020aa40]
lea rcx, [rbp + 0x1a0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 4
call fcn.1400422d0
mov rcx, qword [0x14020aa70]
mov rax, rbx
sub rax, rcx
cmp rax, 6
jb 0x1400578ac
cmp qword [0x14020aa78], 0xf
lea rax, [0x14020aa60]
mov qword [rsp + 0x30], rcx
lea r9, str.HWID:
cmova rax, qword [0x14020aa60]
lea rcx, [rbp + 0x180]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 6
call fcn.1400422d0
cmp qword [rbp + 0x1d8], 0xf
lea rcx, [rbp + 0x1c0]
cmova rcx, qword [rbp + 0x1c0]
call fcn.140035ed0
cmp qword [rbp + 0x178], 0xf
lea rcx, [rbp + 0x160]
cmova rcx, qword [rbp + 0x160]
call fcn.140035ed0
cmp qword [rbp + 0x1b8], 0xf
lea rcx, [rbp + 0x1a0]
cmova rcx, qword [rbp + 0x1a0]
call fcn.140035ed0
cmp qword [rbp + 0x198], 0xf
lea rcx, [rbp + 0x180]
cmova rcx, qword [rbp + 0x180]
call fcn.140035ed0
mov rdx, qword [rbp + 0x198]
cmp rdx, 0xf
jbe 0x140056ab5
mov rcx, qword [rbp + 0x180]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056ab0
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140057864
call fcn.1400bc8d4
mov rdx, qword [rbp + 0x1b8]
mov qword [rbp + 0x190], rsi
mov qword [rbp + 0x198], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x180], sil
cmp rdx, 0xf
jbe 0x140056b0f
mov rcx, qword [rbp + 0x1a0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056b0a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140057864
call fcn.1400bc8d4
mov rdx, qword [rbp + 0x178]
mov qword [rbp + 0x1b0], rsi
mov qword [rbp + 0x1b8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1a0], sil
cmp rdx, 0xf
jbe 0x140056b69
mov rcx, qword [rbp + 0x160]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056b64
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140057864
call fcn.1400bc8d4
mov rdx, qword [rbp + 0x1d8]
mov qword [rbp + 0x170], rsi
mov qword [rbp + 0x178], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x160], sil
cmp rdx, 0xf
jbe 0x140056bc3
mov rcx, qword [rbp + 0x1c0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056bbe
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140057864
call fcn.1400bc8d4
mov rdx, qword [rbp + 0x700]
mov qword [rbp + 0x1d0], rsi
mov qword [rbp + 0x1d8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1c0], sil
cmp rdx, 0xf
jbe 0x140056c1d
mov rcx, qword [rbp + 0x6e8]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056c18
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140057864
call fcn.1400bc8d4
mov rdx, qword [rbp + 0x720]
cmp rdx, 0xf
jbe 0x140056c5e
mov rcx, qword [rbp + 0x708]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056c59
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140057864
call fcn.1400bc8d4
mov rdx, qword [rbp + 0x740]
cmp rdx, 0xf
jbe 0x140056c9f
mov rcx, qword [rbp + 0x728]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056c9a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140057864
call fcn.1400bc8d4
call fcn.14000ce10
call fcn.140016e40
movaps xmm1, xmm7
movaps xmm0, xmm13
call fcn.140016a90
call fcn.140016cf0
lea rdx, [rbp + 0x128]
mov dword [rbp + 0x128], 0x43858000
lea rcx, str.Tools_Options
mov dword [rbp + 0x12c], 0x43720000
call fcn.14000cd10
lea rdx, [0x1401e95c7]
lea rcx, str.Stream_Mode
call fcn.140039650
mov byte [0x1401e954c], al
call fcn.14000ce10
call fcn.140016e40
call fcn.14000bed0
mov ecx, 2
call fcn.140004970
mov rcx, qword [0x1401e9510]
mov rax, qword [rcx + 0x3ea0]
mov byte [rax + 0xb0], 1
mov rax, qword [rcx + 0x3ea0]
movss xmm1, dword [rax + 0x18]
movss xmm0, dword [rax + 0x1c]
subss xmm1, dword [rax + 0x7c]
subss xmm0, dword [rax + 0x80]
mov byte [rax + 0x139], 1
addss xmm1, dword [0x1400e016c]
addss xmm0, dword [0x1400e00e4]
movss dword [rax + 0xf8], xmm1
movss dword [rax + 0xfc], xmm0
call fcn.140016cf0
mov rbx, qword [0x1401e9510]
lea rdx, [rbp + 0x22c]
movss xmm6, dword [0x1401e95a4]
mulss xmm6, dword [r13 + 0x37e0]
mov dword [rbp + 0x22c], esi
movss xmm0, dword [rbx + 0x37e0]
lea rcx, [rbx + 0x47f8]
movss dword [rbp + 0x230], xmm0
call fcn.14001f3c0
mov eax, dword [0x1401e9540]
movss dword [rbx + 0x37e0], xmm6
test eax, eax
jne 0x140056df3
movups xmm0, xmmword [0x14021f5c0]
lea r8, str.Hacks___
lea rdx, [0x1400d15c4]
lea rcx, [rbp + 0x448]
movups xmmword [rbp + 0x448], xmm0
call fcn.140036000
mov eax, dword [0x1401e9540]
cmp eax, 1
jne 0x140056e26
movups xmm0, xmmword [0x14021f5c0]
lea r8, str.Locations__
lea rdx, [0x1400d15d8]
lea rcx, [rbp + 0x458]
movups xmmword [rbp + 0x458], xmm0
call fcn.140036000
mov eax, dword [0x1401e9540]
cmp eax, 2
jne 0x140056e59
movups xmm0, xmmword [0x14021f5c0]
lea r8, str.Misc___
lea rdx, [0x1400d15d4]
lea rcx, [rbp + 0x468]
movups xmmword [rbp + 0x468], xmm0
call fcn.140036000
mov eax, dword [0x1401e9540]
cmp eax, 3
jne 0x140056e8c
movups xmm0, xmmword [0x14021f5c0]
lea r8, str.Security___
lea rdx, [0x1400d15e4]
lea rcx, [rbp + 0x478]
movups xmmword [rbp + 0x478], xmm0
call fcn.140036000
mov eax, dword [0x1401e9540]
cmp eax, 4
jne 0x140056eb9
movups xmm0, xmmword [0x14021f5c0]
lea r8, str.Settings___
lea rdx, [0x1400d15dc]
lea rcx, [rbp + 0x488]
movups xmmword [rbp + 0x488], xmm0
call fcn.140036000
mov rbx, qword [0x1401e9510]
lea rdx, [rbp + 0x238]
movss xmm6, dword [0x1401e9640]
mulss xmm6, dword [r13 + 0x37e0]
mov dword [rbp + 0x238], esi
movss xmm0, dword [rbx + 0x37e0]
lea rcx, [rbx + 0x47f8]
movss dword [rbp + 0x23c], xmm0
call fcn.14001f3c0
mov eax, dword [0x1401e9540]
movss dword [rbx + 0x37e0], xmm6
test eax, eax
jne 0x140056f3f
cmp dword [0x1401e95ac], esi
jne 0x140057011
movups xmm0, xmmword [0x14021f690]
lea rdx, str.Enemy
lea rcx, [rbp + 0x498]
movups xmmword [rbp + 0x498], xmm0
call fcn.140036220
mov eax, dword [0x1401e9540]
cmp eax, 1
jne 0x140056f77
cmp dword [0x1401e95ac], esi
jne 0x140057011
movups xmm0, xmmword [0x14021f690]
lea rdx, str.Players
lea rcx, [rbp + 0x4a8]
movups xmmword [rbp + 0x4a8], xmm0
call fcn.140036220
mov eax, dword [0x1401e9540]
cmp eax, 2
jne 0x140056faf
cmp dword [0x1401e95ac], esi
jne 0x140057011
movups xmm0, xmmword [0x14021f690]
lea rdx, str.Extra
lea rcx, [rbp + 0x4b8]
movups xmmword [rbp + 0x4b8], xmm0
call fcn.140036220
mov eax, dword [0x1401e9540]
cmp eax, 3
jne 0x140056fe3
cmp dword [0x1401e95ac], esi
jne 0x140057011
movups xmm0, xmmword [0x14021f690]
lea rdx, str.Account
lea rcx, [rbp + 0x4c8]
movups xmmword [rbp + 0x4c8], xmm0
call fcn.140036220
mov eax, dword [0x1401e9540]
cmp eax, 4
jne 0x140057011
cmp dword [0x1401e95ac], esi
jne 0x140057011
movups xmm0, xmmword [0x14021f690]
lea rdx, str.Settings
lea rcx, [rbp + 0x4d8]
movups xmmword [rbp + 0x4d8], xmm0
call fcn.140036220
mov ecx, 2
call fcn.140004970
call fcn.140016e40
call fcn.140051ce0
mov rcx, qword [0x1401e9510]
mov rax, qword [rcx + 0x3ea0]
mov byte [rax + 0xb0], 1
mov rax, qword [rcx + 0x3ea0]
lea rcx, [0x1401e86d8]
movss xmm1, dword [rax + 0x18]
movss xmm0, dword [rax + 0x1c]
subss xmm1, dword [rax + 0x7c]
subss xmm0, dword [rax + 0x80]
mov byte [rax + 0x139], 1
addss xmm1, dword [0x1400e015c]
addss xmm0, dword [0x1400e0180]
movss dword [rax + 0xf8], xmm1
movss dword [rax + 0xfc], xmm0
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rcx, qword [0x1401e86d8]
call fcn.140035ed0
call fcn.140012470
cmp byte [0x1401e955f], sil
je 0x1400570b9
cmp byte [0x1401e962b], sil
je 0x1400570b9
mov byte [0x1401ea758], 1
cmp byte [0x1401e9550], sil
je 0x1400570d2
cmp byte [0x1401e9622], sil
je 0x1400570d2
mov byte [0x1401ea6fd], 1
cmp byte [0x1401e950d], sil
je 0x1400570eb
cmp byte [0x1401e95c5], sil
je 0x1400570eb
mov byte [0x1401ea75e], 1
cmp byte [0x1401e9646], sil
je 0x140057104
cmp byte [0x1401e9633], sil
je 0x140057104
mov byte [0x1401ea75f], 1
cmp byte [0x1401e95a3], sil
je 0x14005711d
cmp byte [0x1401e962e], sil
je 0x14005711d
mov byte [0x14020ab9c], 1
cmp byte [0x1401e950b], sil
je 0x140057136
cmp byte [0x1401e95c4], sil
je 0x140057136
mov byte [0x1401ea75d], 1
cmp byte [0x1401e9552], sil
je 0x14005714f
cmp byte [0x1401e9623], sil
je 0x14005714f
mov byte [0x14020aef9], 1
cmp byte [0x1401e9649], sil
je 0x140057168
cmp byte [0x1401e9636], sil
je 0x140057168
mov byte [0x14020aef8], 1
cmp byte [0x1401e9553], sil
je 0x140057181
cmp byte [0x1401e9624], sil
je 0x140057181
mov byte [0x1401e969e], 1
cmp byte [0x1401e955a], sil
je 0x14005719a
cmp byte [0x1401e9626], sil
je 0x14005719a
mov byte [0x14020aefd], 1
cmp byte [0x1401e95b5], sil
je 0x1400571b3
cmp byte [0x1401e9630], sil
je 0x1400571b3
mov byte [0x14020aefc], 1
cmp byte [0x1401e95a1], sil
je 0x1400571cc
cmp byte [0x1401e962c], sil
je 0x1400571cc
mov byte [0x14020aefa], 1
cmp byte [0x1401e955d], sil
je 0x1400571e5
cmp byte [0x1401e9629], sil
je 0x1400571e5
mov byte [0x14020ab9f], 1
cmp byte [0x1401e9644], sil
je 0x1400571fe
cmp byte [0x1401e9631], sil
je 0x1400571fe
mov byte [0x1401ea75a], 1
cmp byte [0x1401e9648], sil
je 0x140057217
cmp byte [0x1401e9635], sil
je 0x140057217
mov byte [0x14020ab9d], 1
cmp byte [0x1401e9647], sil
je 0x140057230
cmp byte [0x1401e9634], sil
je 0x140057230
mov byte [0x14020aefb], 1
cmp byte [0x1401e955b], sil
je 0x140057249
cmp byte [0x1401e9627], sil
je 0x140057249
mov byte [0x1401e969f], 1
cmp byte [0x1401e955c], sil
je 0x140057262
cmp byte [0x1401e9628], sil
je 0x140057262
mov byte [0x1401ea75b], 1
cmp byte [0x1401e9509], sil
je 0x14005727b
cmp byte [0x1401e95b6], sil
je 0x14005727b
mov byte [0x1401ea759], 1
cmp byte [0x1401e95a2], sil
je 0x140057294
cmp byte [0x1401e962d], sil
je 0x140057294
mov byte [0x14020ab9e], 1
cmp byte [0x1401e9645], sil
je 0x1400572ad
cmp byte [0x1401e9632], sil
je 0x1400572ad
mov byte [0x1401ea6fc], 1
cmp byte [0x1401e950a], sil
je 0x1400572c6
cmp byte [0x1401e95b7], sil
je 0x1400572c6
mov byte [0x1401ea6ff], 1
cmp byte [0x1401e950e], sil
je 0x1400572df
cmp byte [0x1401e95c6], sil
je 0x1400572df
mov byte [0x1401ea6fe], 1
cmp byte [0x1401e95b4], sil
je 0x1400572f8
cmp byte [0x1401e962f], sil
je 0x1400572f8
mov byte [0x1401ea75c], 1
cmp byte [0x1401e954c], sil
je 0x1400573f1
cmp byte [0x1401e95c7], sil
je 0x14005737e
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rax
mov edx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
xor ecx, ecx
mov qword [rsp + 0x68], rsi
call qword [sym.imp.ole32.dll_CoInitialize]
xor edx, edx
lea rax, [rsp + 0x68]
lea r9, [0x1400c1000]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400c1010]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x1400573eb
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x28]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, qword [rsp + 0x68]
mov rdx, rax
call rbx
mov rcx, qword [rsp + 0x68]
jmp 0x1400573e5
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
xor ecx, ecx
mov qword [rsp + 0x70], rsi
call qword [sym.imp.ole32.dll_CoInitialize]
xor edx, edx
lea rax, [rsp + 0x70]
lea r9, [0x1400c1000]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400c1010]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x1400573eb
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x20]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, qword [rsp + 0x70]
mov rdx, rax
call rbx
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp byte [0x1401e954e], sil
je 0x140057430
xor r9d, r9d
mov dword [rsp + 0x28], 5
xor ecx, ecx
mov qword [rsp + 0x20], rsi
cmp byte [0x1401e9621], sil
lea rdx, str.open
lea r8, str.C:WindowsTemp_start.vbs
jne 0x14005742a
lea r8, str.C:WindowsTemp_stop.vbs
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp byte [0x1401e955e], sil
je 0x14005748e
mov r8d, dword [0x14020ab98]
xor edx, edx
mov ecx, 0xc00
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14005748e
cmp byte [0x1401e950f], sil
mov rcx, rax
jne 0x140057474
call qword [sym.imp.ntdll.dll_NtSuspendProcess]
test eax, eax
jne 0x140057485
mov byte [0x1401e950f], 1
jmp 0x140057485
call qword [sym.imp.ntdll.dll_NtResumeProcess]
test eax, eax
jne 0x140057485
mov byte [0x1401e950f], sil
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0x1f8]
cmp rdx, 0xf
jbe 0x1400574cf
mov rcx, qword [rbp + 0x1e0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400574ca
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005786b
call fcn.1400bc8d4
mov rdx, qword [rbp + 0x358]
mov qword [rbp + 0x1f0], rsi
mov qword [rbp + 0x1f8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1e0], sil
cmp rdx, 0xf
jbe 0x140057529
mov rcx, qword [rbp + 0x340]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140057524
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005786b
call fcn.1400bc8d4
mov r13d, dword [rsp + 0x60]
movss xmm7, dword [0x1400e00d0]
movss xmm6, dword [0x1400e0174]
call fcn.14000b1e0
mov rcx, qword [0x14021f408]
lea r8, [0x14020f148]
xorps xmm0, xmm0
mov r12d, 1
movups xmmword [rbp + 0x4e8], xmm0
xor r9d, r9d
mov edx, r12d
mov rax, qword [rcx]
call qword [rax + 0x108]
mov rcx, qword [0x14021f408]
lea r8, [rbp + 0x4e8]
mov rdx, qword [0x14020f148]
mov rax, qword [rcx]
call qword [rax + 0x190]
mov rbx, qword [0x1401e9510]
cmp dword [rbx + 0x4870], 0
jg 0x1400575b8
mov r8d, 0x72d
lea rdx, str.C:UsersAdministratorDesktopMax11Max11Maximgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbx + 0x4878]
mov rcx, qword [rax]
mov rax, rsi
add rcx, 0x48
cmp byte [rcx], 0
cmovne rax, rcx
mov rcx, rax
call fcn.140042c40
mov rcx, qword [0x14021f3b8]
xor r8d, r8d
mov edx, r12d
mov rax, qword [rcx]
call qword [rax + 0x40]
mov ebx, dword [rsp + 0x60]
jmp 0x140053ff0
mov rbx, qword [0x1401e9510]
test rbx, rbx
je 0x14005760e
mov rdi, qword [rbx + 0xa0]
test rdi, rdi
jne 0x140057632
jmp 0x140057611
mov rdi, rsi
mov r8d, 0x241
lea rdx, str.C:UsersAdministratorDesktopMax11Max11Max_backendsimgui_impl_dx11.cpp
lea rcx, str.bd___nullptr___No_renderer_backend_to_shutdown__or_already_shutdown__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x1401e9510]
test rbx, rbx
jne 0x140057658
mov r8d, 0xfdc
lea rdx, str.C:UsersAdministratorDesktopMax11Max11Maximgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x1401e9510]
call fcn.140043bd0
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14005766c
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi]
test rcx, rcx
je 0x14005767a
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140057689
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rax, qword [0x1401e9510]
mov qword [rbx + 0x90], rsi
mov qword [rbx + 0xa0], rsi
test rax, rax
je 0x1400576a9
dec dword [rax + 0xf4]
mov rdx, qword [0x1401e9500]
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rax, qword [0x1401e9510]
test rax, rax
je 0x1400576d2
mov rbx, qword [rax + 0x98]
test rbx, rbx
jne 0x1400576f6
jmp 0x1400576d5
mov rbx, rsi
mov r8d, 0xa6
lea rdx, str.C:UsersAdministratorDesktopMax11Max11Max_backendsimgui_impl_win32.cpp
lea rcx, str.bd___nullptr___No_platform_backend_to_shutdown__or_already_shutdown__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [0x1401e9510]
test rax, rax
jne 0x14005771c
mov r8d, 0xfdc
lea rdx, str.C:UsersAdministratorDesktopMax11Max11Maximgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [0x1401e9510]
mov rcx, qword [rbx + 0x30]
lea rdi, [rax + 8]
test rcx, rcx
je 0x140057736
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [0x1401e9510]
mov qword [rdi + 0x80], rsi
mov qword [rdi + 0x90], rsi
test rax, rax
je 0x14005774f
dec dword [rax + 0xf4]
mov rdx, qword [0x1401e9500]
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rbx, qword [0x1401e9510]
mov qword [0x1401e9510], rbx
call fcn.140006710
mov qword [0x1401e9510], rsi
test rbx, rbx
je 0x1400577a6
mov rcx, rbx
call fcn.14001ffb0
mov rax, qword [0x1401e9510]
test rax, rax
je 0x140057797
dec dword [rax + 0xf4]
mov rdx, qword [0x1401e9500]
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
call fcn.14004dc70
mov rcx, qword [0x1401e95b8]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0x308]
mov rcx, qword [rbp + 0x330]
call qword [sym.imp.USER32.dll_UnregisterClassW]
movaps xmm9, xmmword [rsp + 0x1230]
xor eax, eax
movaps xmm10, xmmword [rsp + 0x1220]
movaps xmm12, xmmword [rsp + 0x1200]
movaps xmm11, xmmword [rsp + 0x1210]
movaps xmm8, xmmword [rsp + 0x1240]
movaps xmm13, xmmword [rsp + 0x11f0]
movaps xmm14, xmmword [rsp + 0x11e0]
movaps xmm7, xmmword [rsp + 0x1250]
movaps xmm6, xmmword [rsp + 0x1260]
mov r14, qword [rsp + 0x1270]
mov r13, qword [rsp + 0x12b0]
movaps xmm15, xmmword [rsp + 0x11d0]
mov rsi, qword [rsp + 0x12a0]
mov rdi, qword [rsp + 0x12a8]
add rsp, 0x1278
pop r15
pop r12
pop rbx
pop rbp
ret
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 6
mov dword [0x1401ea74c], 0x7ffffffe
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.1400347a0
int3
call fcn.1400347a0
int3