Function at 0x140047cb0
Capabilities:
Contain obfuscated stackstrings
Create thread
Enumerate process modules
Enumerate processes
Log keystrokes via polling
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xb38]
sub rsp, 0xc10
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x78], xmm10
mov rax, qword [0x140059040]
xor rax, rsp
mov qword [rbp + 0xab0], rax
xor esi, esi
lea rcx, [rbp + 0x570]
mov dword [rsp + 0x60], esi
call fcn.1400477e0
lea rax, [0x140049b60]
mov dword [rbp], 0x50
xor ecx, ecx
mov qword [rbp + 8], rax
mov dword [rbp + 4], 0x40
mov qword [rbp + 0x10], rsi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xorps xmm0, xmm0
mov qword [rbp + 0x48], rsi
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x20], xmm0
lea rbx, str.Discord
movdqa xmmword [rbp + 0x30], xmm1
lea rcx, [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x40], rbx
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov rax, qword [rbp + 0x18]
mov r9d, 0x80000000
mov rdx, qword [rbp + 0x40]
mov r8, rbx
mov qword [rsp + 0x58], rsi
xor ecx, ecx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], 5
mov dword [rsp + 0x30], 5
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_CreateWindowExW]
lea ecx, [rsi + 0x20]
mov qword [0x140059ce0], rax
mov rbx, rax
call qword [sym.imp.d3d9.dll_Direct3DCreate9]
mov qword [0x140059cd8], rax
mov rcx, rax
test rax, rax
je 0x14004961a
lea rdx, [0x140059cd0]
mov qword [0x140059c90], rsi
mov qword [rsp + 0x30], rdx
lea r8d, [rsi + 1]
lea rdx, [0x140059c90]
mov qword [0x140059c9c], rsi
mov qword [rsp + 0x28], rdx
mov r9, rbx
mov dword [0x140059ca4], esi
xor edx, edx
mov qword [0x140059cac], rsi
mov dword [0x140059cb4], esi
mov qword [0x140059cc4], rsi
mov dword [0x140059cb8], 1
mov dword [0x140059ca8], 1
mov dword [0x140059c98], esi
mov dword [0x140059cbc], 1
mov dword [0x140059cc0], 0x50
mov dword [0x140059ccc], 1
mov rax, qword [rax]
mov dword [rsp + 0x20], 0x40
call qword [rax + 0x80]
test eax, eax
js 0x140049613
mov rcx, qword [0x140059ce0]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x140059ce0]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rax, qword [0x140059c80]
test rax, rax
je 0x140047e8b
inc dword [rax + 0x3b0]
mov ecx, 0x40b0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x140047ea7
xor edx, edx
mov rcx, rax
call fcn.140001360
jmp 0x140047eaa
mov rax, rsi
cmp qword [0x140059c80], rsi
jne 0x140047eba
mov qword [0x140059c80], rax
mov rcx, rax
call fcn.140008180
mov r13, qword [0x140059c80]
lea rdx, [0x14004c8ec]
lea rcx, str.Kanit_ExtraLight.ttf
mov qword [rbp - 0x70], r13
or dword [r13 + 8], 0x400
mov qword [r13 + 0x20], rsi
mov dword [r13 + 0x1644], esi
mov dword [r13 + 0x1728], 0x3f800000
mov r12, qword [r13 + 0xa8]
call fcn.140002a10
movss xmm10, dword [0x1400514d8]
mov rbx, rax
test rax, rax
je 0x1400481e0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov edi, eax
cmp eax, 0xffffffff
je 0x1400481d7
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400481d7
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd r15, eax
cmp r15d, 0xffffffff
je 0x1400481d7
xor r8d, r8d
mov edx, edi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400481d7
cmp r15, 0xffffffffffffffff
je 0x1400481d7
mov rax, qword [0x140059c80]
test rax, rax
je 0x140047f8d
inc dword [rax + 0x3b0]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
test rax, rax
je 0x1400481d7
mov r9, rbx
mov r8, r15
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, r15
je 0x140047fe4
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140059c80]
test rax, rax
je 0x140047fd6
dec dword [rax + 0x3b0]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400481e0
movaps xmmword [rsp + 0xbe0], xmm8
movaps xmmword [rsp + 0xbd0], xmm9
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xorps xmm1, xmm1
xor eax, eax
mov qword [rbp + 0xd0], rax
xorps xmm5, xmm5
movsd xmm9, qword [rbp + 0xd0]
mov eax, 0xffff
movups xmmword [rbp + 0xa0], xmm1
mov word [rbp + 0xa4], ax
movups xmmword [rbp + 0x60], xmm1
mov dword [rbp + 0xa0], 0x3f800000
movaps xmm2, xmmword [rbp + 0xa0]
xorps xmm7, xmm7
movups xmmword [rbp + 0x50], xmm1
mov byte [rbp + 0x5c], 1
movaps xmm3, xmmword [rbp + 0x50]
movdqa xmm0, xmm2
movups xmmword [rbp + 0x90], xmm1
mov dword [rbp + 0x68], 3
psrldq xmm0, 6
xorps xmm8, xmm8
movd eax, xmm0
mov dword [rbp + 0x6c], 1
movaps xmm4, xmmword [rbp + 0x60]
mov dword [rbp + 0x94], 0x7f7fffff
movaps xmm6, xmmword [rbp + 0x90]
movaps xmmword [rbp + 0x5b0], xmm3
movaps xmmword [rbp + 0x5c0], xmm4
movaps xmmword [rbp + 0x5d0], xmm1
movaps xmmword [rbp + 0x5e0], xmm5
movaps xmmword [rbp + 0x5f0], xmm6
movaps xmmword [rbp + 0x600], xmm2
movaps xmmword [rbp + 0x610], xmm7
movaps xmmword [rbp + 0x620], xmm8
movsd qword [rbp + 0x630], xmm9
test al, al
jne 0x140048161
lea r9, [0x140051284]
lea rdx, str.Kanit_ExtraLight.ttf
nop
movzx eax, byte [r9 - 1]
lea rcx, [r9 - 1]
cmp al, 0x2f
je 0x1400480f9
cmp al, 0x5c
je 0x1400480f9
mov r9, rcx
cmp rcx, rdx
ja 0x1400480e0
movsd xmm0, qword [0x140051510]
lea r8, str._s___.0fpx
mov edx, 0x28
movsd qword [rsp + 0x20], xmm0
lea rcx, [rbp + 0x606]
call fcn.1400028e0
movaps xmm2, xmmword [rbp + 0x600]
movaps xmm5, xmmword [rbp + 0x5e0]
movaps xmm1, xmmword [rbp + 0x5d0]
movaps xmm4, xmmword [rbp + 0x5c0]
movaps xmm3, xmmword [rbp + 0x5b0]
movsd xmm9, qword [rbp + 0x630]
movaps xmm8, xmmword [rbp + 0x620]
movaps xmm7, xmmword [rbp + 0x610]
movaps xmm6, xmmword [rbp + 0x5f0]
movaps xmmword [rbp + 0x50], xmm3
lea rax, [0x140050eb8]
movaps xmmword [rbp + 0x60], xmm4
lea rdx, [rbp + 0x50]
movaps xmmword [rbp + 0x80], xmm5
mov rcx, r12
mov qword [rbp + 0x88], rax
movaps xmmword [rbp + 0x70], xmm1
movaps xmmword [rbp + 0x90], xmm6
movaps xmmword [rbp + 0xa0], xmm2
movaps xmmword [rbp + 0xb0], xmm7
movaps xmmword [rbp + 0xc0], xmm8
movsd qword [rbp + 0xd0], xmm9
mov qword [rbp + 0x50], r14
mov dword [rbp + 0x58], r15d
mov dword [rbp + 0x64], 0x41a00000
call fcn.14002fc80
movaps xmm9, xmmword [rsp + 0xbd0]
movaps xmm8, xmmword [rsp + 0xbe0]
jmp 0x1400481e3
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, rsi
mov qword [r13 + 0xb8], rax
call fcn.140035d80
mov rcx, qword [0x140059cd0]
lea rax, str.imgui_impl_dx9
mov rbx, qword [0x140059c80]
mov qword [0x140059d18], rcx
or dword [rbx + 0xc], 0x1008
mov qword [rbx + 0xe8], rax
mov rax, qword [rcx]
call qword [rax + 8]
test dword [rbx + 8], 0x400
je 0x140048275
mov rax, qword [0x140059c80]
lea rcx, [fcn.140035a50]
mov qword [rax + 0x15f0], rcx
lea rcx, [fcn.140035b20]
mov qword [rax + 0x15f8], rcx
lea rcx, [0x140035ba0]
mov qword [rax + 0x1600], rcx
lea rcx, [0x140035c00]
mov qword [rax + 0x1608], rcx
lea rcx, [0x140035d50]
mov qword [rax + 0x1610], rcx
xorps xmm0, xmm0
movups xmmword [rbp + 0x540], xmm0
movups xmmword [rbp + 0x550], xmm0
movups xmmword [rbp + 0x560], xmm0
movups xmmword [rbp + 0x520], xmm0
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rbp + 0x520]
call qword [sym.imp.USER32.dll_GetWindowRect]
cmp byte [0x140059290], sil
movd xmm2, dword [rbp + 0x52c]
movd xmm1, dword [rbp + 0x528]
cvtdq2ps xmm2, xmm2
cvtdq2ps xmm1, xmm1
subss xmm2, dword [0x1400595a4]
subss xmm1, dword [0x1400595a0]
mulss xmm2, dword [0x140051494]
mulss xmm1, dword [0x140051494]
movss dword [0x14005959c], xmm2
movss dword [0x140059598], xmm1
je 0x14004836e
call qword [sym.imp.KERNEL32.dll_AllocConsole]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rax
lea r8, [0x140051288]
lea rdx, str.CONIN_
lea rcx, [rbp - 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rax
lea r8, [0x140051294]
lea rdx, str.CONOUT_
lea rcx, [rbp - 0x28]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rax
lea r8, [0x140051294]
lea rdx, str.CONOUT_
lea rcx, [rbp - 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
call fcn.1400479a0
xor edx, edx
mov dword [rsp + 0x64], eax
mov r12d, eax
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14004839a
lea rdi, str.Unknown
jmp 0x14004843d
lea rdx, [rbp + 0x50]
mov dword [rbp + 0x50], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x1400483c4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdi, [0x1400590c0]
jmp 0x14004843d
lea rdi, [0x140059d90]
xor edx, edx
mov rcx, rdi
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
nop dword [rax + rax]
cmp dword [rbp + 0x58], r12d
je 0x140048409
lea rdx, [rbp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400483e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdi, [0x1400590b8]
jmp 0x14004843d
mov qword [rsp + 0x38], rsi
lea r8, [rbp + 0x7c]
mov qword [rsp + 0x30], rsi
mov r9d, 0xffffffff
mov dword [rsp + 0x28], 0x104
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, rdi
lea rcx, [rbp + 0x7b0]
mov edx, 0xff
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea rax, [rbp + 0x8b0]
mov dword [rsp + 0x28], 0xff
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x7b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edx, r12d
mov ecx, 0x18
mov rdi, rsi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400484df
lea rdx, [rbp + 0x50]
mov dword [rbp + 0x50], 0x438
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x1400484df
nop
lea rdx, str.conhost_v2.dll
lea rcx, [rbp + 0x80]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400484db
lea rdx, [rbp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x1400484b0
jmp 0x1400484df
mov rdi, qword [rbp + 0x68]
mov edx, r12d
mov ecx, 0x18
mov r14, rsi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140048540
lea rdx, [rbp + 0x50]
mov dword [rbp + 0x50], 0x438
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x140048540
lea rdx, str.net.dll
lea rcx, [rbp + 0x80]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14004853c
lea rdx, [rbp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140048511
jmp 0x140048540
mov r14, qword [rbp + 0x68]
mov edx, r12d
mov qword [rbp - 0x18], r14
mov ecx, 0x18
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400485a9
lea rdx, [rbp + 0x50]
mov dword [rbp + 0x50], 0x438
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x1400485a9
nop dword [rax]
nop word [rax + rax]
lea rdx, [rbp + 0x8b0]
lea rcx, [rbp + 0x80]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400485a9
lea rdx, [rbp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140048580
lea rax, [rdi + 0x6e900]
mov r8d, r12d
mov qword [rbp + 0x508], rax
xor edx, edx
lea rax, [rdi + 0x6e8ec]
mov ecx, 0x1fffff
mov qword [rbp + 0x500], rax
lea rax, [rdi + 0x6e8f0]
mov qword [rbp + 0x510], rax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov byte [rbp + 0x6b0], sil
mov r8d, 0xfe
mov qword [rbp - 0x10], rax
lea rcx, [rbp + 0x6b1]
mov rbx, rax
call sub.VCRUNTIME140.dll_memset
mov rdx, qword [rbp - 0x18]
lea r8, [rbp + 0x6b0]
add rdx, 0xc0078
mov dword [rbp + 0x5a0], 0x61727564
mov r9d, 0xff
mov qword [rbp + 0x5a4], 0x6e6f6974
mov rcx, rbx
mov dword [rbp + 0x5ac], esi
mov dword [rbp + 0x590], 0x61727564
mov qword [rbp + 0x594], 0x666f6974
mov dword [rbp + 0x59c], esi
mov qword [rbp + 0x518], 0x10
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rax, [rbp - 0x10]
mov ecx, 0x30
mov qword [rbp + 0x4b0], rax
lea rax, [rbp - 0x18]
mov qword [rbp + 0x4b8], rax
lea rax, [rbp + 0x6b0]
mov qword [rbp + 0x4c0], rax
lea rax, [rbp + 0x500]
mov qword [rbp + 0x4c8], rax
lea rax, [rbp + 0x508]
mov qword [rbp + 0x4d0], rax
lea rax, [rbp + 0x510]
mov qword [rbp + 0x4d8], rax
call fcn.14004ad78
movups xmm0, xmmword [rbp + 0x4b0]
lea rcx, [rbp + 0x538]
mov r9, rax
movups xmm1, xmmword [rbp + 0x4c0]
mov qword [rsp + 0x28], rcx
lea r8, [0x14004a700]
movups xmmword [rax], xmm0
xor edx, edx
xor ecx, ecx
movups xmm0, xmmword [rbp + 0x4d0]
mov dword [rsp + 0x20], esi
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax + 0x20], xmm0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x530], rax
test rax, rax
je 0x140049601
cmp dword [rbp + 0x548], 0x12
je 0x1400494cf
movss xmm7, dword [0x140051568]
lea rdi, [0x140059397]
movss xmm6, dword [0x14005159c]
lea r14, str.B3sty
lea r15, [0x14004c776]
nop word [rax + rax]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rbp + 0x540]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140048790
lea rcx, [rbp + 0x540]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x540]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x14004948a
cmp qword [0x140059d08], rsi
jne 0x14004879e
call fcn.1400358e0
mov rcx, qword [0x140059d48]
lea rdx, [rbp - 0x50]
mov rbx, qword [0x140059c80]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x50], xmm0
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rbp - 0x44]
sub eax, dword [rbp - 0x4c]
movd xmm1, eax
mov eax, dword [rbp - 0x48]
sub eax, dword [rbp - 0x50]
cmp byte [0x140059281], sil
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x14], xmm1
movss dword [rbx + 0x10], xmm0
je 0x140048840
mov rdi, qword [0x140059c80]
mov ecx, dword [rdi + 0x161c]
test ecx, ecx
jns 0x140048818
mov eax, ecx
cdq
sub eax, edx
mov edx, esi
sar eax, 1
add eax, ecx
lea rcx, [rdi + 0x1618]
test eax, eax
cmovg edx, eax
call fcn.140022f20
xor r9d, r9d
mov dword [rdi + 0x1618], esi
lea r8, [0x1400367d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplayMonitors]
mov byte [0x140059281], sil
lea rdi, [0x140059397]
lea rcx, [rbp + 0x490]
mov qword [rbp + 0x490], rsi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rbp + 0x490]
xorps xmm1, xmm1
mov rax, rcx
xorps xmm0, xmm0
sub rax, qword [0x140059d50]
cvtsi2ss xmm0, qword [0x140059d58]
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rbx + 0x18], xmm1
mov qword [0x140059d50], rcx
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x10
and al, 1
mov byte [rbx + 0x13c], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, 1
mov byte [rbx + 0x13d], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rbx + 0x13f], sil
mov byte [rbx + 0x13e], al
call fcn.1400362f0
cmp byte [rbx + 0xcf], sil
je 0x1400488e7
mov eax, 0xffffffff
jmp 0x1400488f4
mov rax, qword [0x140059c80]
mov eax, dword [rax + 0x20d0]
cmp dword [0x140059284], eax
je 0x140048907
mov dword [0x140059284], eax
call fcn.140036170
call fcn.140036500
mov eax, dword [0x140059294]
cmp eax, 1
jne 0x140048b2a
lea r8, str.B3sty_Fivem_Tools
lea rdx, str._s__Login
lea rcx, [rbp + 0x50]
call fcn.14004a200
call fcn.140006e30
mov rcx, qword [0x140059c80]
lea rdx, [0x140059291]
mov eax, dword [rcx + 0x1dc0]
or eax, 1
mov dword [rcx + 0x1dc0], eax
or eax, 2
movsd xmm0, qword [0x140059598]
movsd qword [rcx + 0x1dd4], xmm0
mov dword [rcx + 0x1dc0], eax
mov qword [rcx + 0x1ddc], rsi
mov dword [rcx + 0x1dc4], 2
mov byte [rcx + 0x1dfc], 1
mov dword [rcx + 0x1de4], 0x435c0000
mov dword [rcx + 0x1de8], 0x435c0000
mov dword [rcx + 0x1dc8], 4
lea rcx, [rbp + 0x50]
mov r8d, dword [0x1400595a8]
call fcn.14000d640
lea rcx, str.UserName_Is_B3sty
call fcn.140039760
lea rcx, str.UserName
call fcn.140039760
movaps xmm0, xmm7
call fcn.140011710
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x78]
mov qword [rsp + 0x30], rsi
lea rcx, [0x140051324]
mov dword [rsp + 0x28], esi
mov r9d, 0xff
mov r8, rdi
mov qword [rsp + 0x20], rax
xor edx, edx
mov qword [rbp - 0x78], rsi
call fcn.14003f430
mov rcx, qword [0x140059c80]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov r8, qword [rcx + 0x1d18]
movsxd rdx, dword [r8 + 0x210]
mov rax, qword [r8 + 0x218]
mov ecx, dword [rax + rdx*4 - 4]
lea eax, [rdx - 1]
mov dword [r8 + 0x204], ecx
lea rcx, str.Password
mov dword [r8 + 0x210], eax
call fcn.140039760
movaps xmm0, xmm7
call fcn.140011710
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x30]
mov qword [rsp + 0x30], rsi
lea r8, [0x140059496]
mov dword [rsp + 0x28], 0x8000
lea rcx, [0x140050e7c]
mov r9d, 0xff
mov qword [rsp + 0x20], rax
xor edx, edx
mov qword [rbp - 0x30], rsi
call fcn.14003f430
mov rcx, qword [0x140059c80]
mov dword [rbp - 0x28], 0x43480000
mov dword [rbp - 0x24], 0x41f00000
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov r8, qword [rcx + 0x1d18]
movsxd rdx, dword [r8 + 0x210]
mov rax, qword [r8 + 0x218]
mov ecx, dword [rax + rdx*4 - 4]
lea eax, [rdx - 1]
mov dword [r8 + 0x204], ecx
lea rdx, [rbp - 0x28]
mov dword [r8 + 0x210], eax
lea rcx, str.Login
xor r8d, r8d
call fcn.14003a230
test al, al
je 0x140048b20
cmp byte [0x140059290], sil
jne 0x140048b16
mov rcx, rsi
movzx eax, byte [rdi + rcx]
inc rcx
cmp al, byte [r14 + rcx - 1]
jne 0x140048b20
cmp rcx, 6
jne 0x140048b02
mov dword [0x140059294], 2
call fcn.140010770
jmp 0x1400492c7
cmp eax, 2
jne 0x1400492c7
cmp byte [0x140059397], sil
lea rcx, [rbp + 0x4b0]
mov rdx, rdi
cmove rdx, r15
call fcn.140049ce0
mov rdi, qword [rbp + 0x4c0]
mov r13, qword [rbp + 0x4c8]
mov r15, qword [rbp + 0x4b0]
mov ebx, dword [rsp + 0x60]
test rdi, rdi
jne 0x140048bb3
movzx eax, byte [0x140051350]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
or ebx, 1
mov byte [rsp + 0x70], al
movsd xmm0, qword [str.Anonymous]
lea rax, [rsp + 0x68]
movsd qword [rsp + 0x68], xmm0
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x78], 9
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x71], sil
jmp 0x140048c99
or ebx, 2
mov qword [rbp - 0x48], rsi
cmp r13, 0xf
mov dword [rsp + 0x60], ebx
lea r14, [rbp + 0x4b0]
movabs rax, 0x7fffffffffffffff
cmova r14, r15
cmp rdi, rax
ja 0x1400496e7
cmp rdi, 0xf
ja 0x140048bff
movups xmm0, xmmword [r14]
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], 0xf
movups xmmword [rbp - 0x50], xmm0
jmp 0x140048c95
mov rbx, rdi
or rbx, 0xf
cmp rbx, rax
jbe 0x140048c1e
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140048c45
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140048c67
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400496ed
mov rcx, rax
call fcn.14004ad78
mov rcx, rax
test rax, rax
je 0x1400494be
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140048c76
test rcx, rcx
je 0x140048c73
call fcn.14004ad78
jmp 0x140048c76
mov rax, rsi
lea r8, [rdi + 1]
mov qword [rbp - 0x50], rax
mov rdx, r14
mov qword [rbp - 0x40], rdi
mov rcx, rax
mov qword [rbp - 0x38], rbx
call sub.VCRUNTIME140.dll_memcpy
mov ebx, dword [rsp + 0x60]
lea rax, [rbp - 0x50]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], sil
movups xmmword [rbp + 0x4e0], xmm0
movups xmmword [rbp + 0x4f0], xmm1
test bl, 2
je 0x140048d04
mov rdx, qword [rbp - 0x38]
and ebx, 0xfffffffd
mov dword [rsp + 0x60], ebx
cmp rdx, 0xf
jbe 0x140048d04
mov rcx, qword [rbp - 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048cff
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400494be
call fcn.14004ab84
test bl, 1
je 0x140048d4c
mov rdx, qword [rbp - 0x80]
and ebx, 0xfffffffe
mov dword [rsp + 0x60], ebx
cmp rdx, 0xf
jbe 0x140048d4c
mov rcx, qword [rsp + 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048d47
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400494be
call fcn.14004ab84
cmp qword [rbp + 0x4f8], 0xf
lea r9, [rbp + 0x4e0]
lea r8, str.B3sty_Fivem_Tools
cmova r9, qword [rbp + 0x4e0]
lea rdx, str._s___s
lea rcx, [rbp + 0x50]
call fcn.14004a200
call fcn.140006e30
mov rcx, qword [0x140059c80]
lea rdx, [0x140059291]
mov eax, dword [rcx + 0x1dc0]
or eax, 1
mov dword [rcx + 0x1dc0], eax
or eax, 2
movsd xmm0, qword [0x140059598]
movsd qword [rcx + 0x1dd4], xmm0
mov dword [rcx + 0x1dc0], eax
mov qword [rcx + 0x1ddc], rsi
mov dword [rcx + 0x1dc4], 2
mov byte [rcx + 0x1dfc], 1
mov dword [rcx + 0x1de4], 0x44160000
mov dword [rcx + 0x1de8], 0x43c80000
mov dword [rcx + 0x1dc8], 4
lea rcx, [rbp + 0x50]
mov r8d, dword [0x1400595a8]
call fcn.14000d640
call fcn.140043770
test al, al
je 0x14004922d
lea rcx, str.Main
call fcn.1400454d0
test al, al
je 0x1400491ae
mov edx, r12d
lea rcx, [rbp + 0x4b0]
call fcn.140049e70
lea r8, [rbp + 0x7b0]
lea rdx, str.FIVEM_:__s
lea rcx, [rbp + 0x5b0]
call fcn.14004a200
lea rcx, [rbp + 0x5b0]
call fcn.140039760
xor r8d, r8d
mov qword [rbp - 0x20], rsi
lea rdx, [rbp - 0x20]
lea rcx, str.Progress_Skip
call fcn.14003a230
test al, al
je 0x140048f2a
lea rax, [rbp + 0x5a0]
mov dword [0x1400595b0], 1
mov qword [rsp + 0x68], rax
mov ecx, 0x20
lea rax, [rbp + 0x518]
mov qword [rsp + 0x70], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x78], rax
lea rax, [rbp + 0x590]
mov qword [rbp - 0x80], rax
call fcn.14004ad78
movups xmm0, xmmword [rsp + 0x68]
lea rcx, [rbp + 0x4a8]
mov r9, rax
movups xmm1, xmmword [rsp + 0x78]
mov qword [rsp + 0x28], rcx
lea r8, [0x14004a730]
movups xmmword [rax], xmm0
xor edx, edx
mov dword [rsp + 0x20], esi
xor ecx, ecx
movups xmmword [rax + 0x10], xmm1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x4a0], rax
test rax, rax
je 0x1400494a5
cmp dword [rbp + 0x4a8], esi
je 0x140049499
movaps xmm0, xmmword [rbp + 0x4a0]
lea rcx, [rbp - 0x50]
movdqa xmmword [rbp - 0x50], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140049499
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x4a0], xmm0
cmp dword [0x1400595b0], esi
je 0x140048f5b
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.140011660
cmp dword [0x1400595b0], 1
lea rax, str.Waitting_For_Skip
lea rcx, str.Success
cmove rcx, rax
call fcn.140039760
lea rdx, [0x1400595ac]
lea rcx, str.FAKE_FPS
call fcn.14003b7e0
lea rcx, str.FPS_:
call fcn.140039760
movaps xmm0, xmm7
call fcn.140011710
lea rax, [rbp - 0x68]
mov dword [rbp - 0x68], 0x64
lea rbx, [0x14004cd04]
mov dword [rbp - 0x60], 1
mov qword [rsp + 0x28], rbx
lea r9, [rbp - 0x60]
lea r8, [0x1400595b4]
mov qword [rsp + 0x20], rax
lea rcx, str.FPS
call fcn.14003d080
mov rcx, qword [0x140059c80]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov r8, qword [rcx + 0x1d18]
movsxd rdx, dword [r8 + 0x210]
mov rax, qword [r8 + 0x218]
mov ecx, dword [rax + rdx*4 - 4]
lea eax, [rdx - 1]
mov dword [r8 + 0x204], ecx
lea rdx, [0x1400595ad]
lea rcx, str.FAKE_PING
mov dword [r8 + 0x210], eax
call fcn.14003b7e0
lea rcx, str.PING_:
call fcn.140039760
movaps xmm0, xmm7
call fcn.140011710
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], rbx
lea r9, [rbp - 0x68]
mov qword [rsp + 0x20], rax
lea r8, [0x1400595b8]
mov dword [rbp - 0x60], 0x64
lea rcx, str.PING
mov dword [rbp - 0x68], 1
call fcn.14003d080
mov rcx, qword [0x140059c80]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov r8, qword [rcx + 0x1d18]
movsxd rdx, dword [r8 + 0x210]
mov rax, qword [r8 + 0x218]
mov ecx, dword [rax + rdx*4 - 4]
lea eax, [rdx - 1]
mov dword [r8 + 0x204], ecx
lea rdx, [0x1400595ae]
lea rcx, str.FAKE_Pocket_Lost
mov dword [r8 + 0x210], eax
call fcn.14003b7e0
lea rcx, str.Pocket_Lost_:
call fcn.140039760
movaps xmm0, xmm7
call fcn.140011710
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], rbx
lea r9, [rbp - 0x68]
mov qword [rsp + 0x20], rax
lea r8, [0x1400595bc]
mov dword [rbp - 0x60], 0x64
lea rcx, str.Pocket_Lost
mov dword [rbp - 0x68], 1
call fcn.14003d080
mov r9, qword [0x140059c80]
mov rax, qword [r9 + 0x1d18]
mov byte [rax + 0xd1], 1
mov r8, qword [r9 + 0x1d18]
mov rax, qword [r8 + 0x218]
movsxd rdx, dword [r8 + 0x210]
mov ecx, dword [rax + rdx*4 - 4]
lea eax, [rdx - 1]
mov dword [r8 + 0x210], eax
mov dword [r8 + 0x204], ecx
mov rax, qword [r9 + 0x1d18]
cmp byte [rax + 0xd4], sil
jne 0x14004916d
mov rdx, qword [r9 + 0x21d8]
test rdx, rdx
je 0x14004916d
movsx rax, word [rdx + 0x70]
lea rcx, [rax + rax*2]
mov rax, qword [rdx + 8]
add rcx, rcx
test byte [rax + rcx*8 + 4], 8
jne 0x14004916d
mov rax, qword [r9 + 0x1d18]
dec dword [rax + 0x108]
mov rdx, qword [rbp + 0x4c8]
cmp rdx, 0xf
jbe 0x1400491ae
mov rcx, qword [rbp + 0x4b0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400491a9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400494b7
call fcn.14004ab84
lea rcx, str.Self
call fcn.1400454d0
test al, al
je 0x140049228
lea rcx, str.PlayerName_:
call fcn.140039760
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.140011660
lea rcx, [rbp + 0x6b0]
call fcn.140039760
mov r8, qword [0x140059c80]
mov rax, qword [r8 + 0x1d18]
cmp byte [rax + 0xd4], sil
jne 0x140049228
mov rdx, qword [r8 + 0x21d8]
test rdx, rdx
je 0x140049228
movsx rax, word [rdx + 0x70]
lea rcx, [rax + rax*2]
mov rax, qword [rdx + 8]
add rcx, rcx
test byte [rax + rcx*8 + 4], 8
jne 0x140049228
mov rax, qword [r8 + 0x1d18]
dec dword [rax + 0x108]
call fcn.140043be0
call fcn.140010770
mov rdx, qword [rbp + 0x4f8]
cmp rdx, 0xf
jbe 0x140049273
mov rcx, qword [rbp + 0x4e0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004926e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400494be
call fcn.14004ab84
mov qword [rbp + 0x4f0], rsi
mov qword [rbp + 0x4f8], 0xf
mov byte [rbp + 0x4e0], sil
cmp r13, 0xf
jbe 0x1400492c3
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x1400492bb
mov r15, qword [r15 - 8]
add rdx, 0x27
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400494be
mov rcx, r15
call fcn.14004ab84
mov r13, qword [rbp - 0x70]
call fcn.1400095b0
mov rcx, qword [0x140059cd0]
mov r9d, 3
mov dword [rsp + 0x30], esi
xor r8d, r8d
movss dword [rsp + 0x28], xmm10
xor edx, edx
mov dword [rsp + 0x20], esi
mov rax, qword [rcx]
call qword [rax + 0x158]
mov rcx, qword [0x140059cd0]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x140049345
call fcn.140009a70
mov rax, qword [0x140059c80]
mov rcx, qword [rax + 0x1ef8]
mov rax, qword [rcx]
mov rcx, rsi
add rax, 0xa8
cmp byte [rax], sil
cmovne rcx, rax
call fcn.1400350c0
mov rcx, qword [0x140059cd0]
mov rax, qword [rcx]
call qword [rax + 0x150]
test dword [r13 + 8], 0x400
je 0x14004942f
call fcn.1400197b0
mov rbx, qword [0x140059c80]
mov r15d, 1
mov eax, dword [rbx + 0x1628]
cmp eax, r15d
jle 0x1400493cc
mov r14d, 8
nop word [rax + rax]
mov rax, qword [rbx + 0x1630]
mov rdi, qword [r14 + rax]
test dword [rdi + 4], 0x400
jne 0x1400493ba
mov rax, qword [rbx + 0x15c0]
test rax, rax
je 0x1400493a7
xor edx, edx
mov rcx, rdi
call rax
mov rax, qword [rbx + 0x1608]
test rax, rax
je 0x1400493ba
xor edx, edx
mov rcx, rdi
call rax
mov eax, dword [rbx + 0x1628]
inc r15d
add r14, 8
cmp r15d, eax
jl 0x140049380
mov r15d, 1
cmp eax, r15d
jle 0x14004942a
mov r14d, 8
nop dword [rax]
mov rax, qword [rbx + 0x1630]
mov rdi, qword [r14 + rax]
test dword [rdi + 4], 0x400
jne 0x14004941a
mov rax, qword [rbx + 0x15c8]
test rax, rax
je 0x140049407
xor edx, edx
mov rcx, rdi
call rax
mov rax, qword [rbx + 0x1610]
test rax, rax
je 0x14004941a
xor edx, edx
mov rcx, rdi
call rax
inc r15d
add r14, 8
cmp r15d, dword [rbx + 0x1628]
jl 0x1400493e0
mov r12d, dword [rsp + 0x64]
mov rcx, qword [0x140059cd0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x14004946c
mov rcx, qword [0x140059cd0]
mov rax, qword [rcx]
call qword [rax + 0x18]
cmp eax, 0x88760869
jne 0x14004946c
call fcn.140047740
cmp byte [0x140059291], sil
je 0x1400494c5
lea rdi, [0x140059397]
lea r14, str.B3sty
lea r15, [0x14004c776]
cmp dword [rbp + 0x548], 0x12
jne 0x140048750
jmp 0x1400494cf
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rbp + 0x4a8], esi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov dword [rbp + 0x548], 0x12
call fcn.140019d90
call fcn.140035970
mov rcx, qword [0x140059d18]
test rcx, rcx
je 0x1400494f2
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x140059d18], rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdx, rax
lea rcx, str.ImGui_Platform
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov rcx, qword [0x140059d30]
test rcx, rcx
je 0x14004951c
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [0x140059c80]
mov rcx, rbx
mov qword [0x140059d30], rsi
mov qword [0x140059d38], rsi
mov qword [0x140059d40], rsi
mov qword [0x140059d48], rsi
mov qword [0x140059d50], rsi
mov qword [0x140059d58], rsi
mov dword [0x140059284], 9
mov byte [0x140059d28], sil
mov byte [0x140059280], 1
call fcn.1400084e0
cmp qword [0x140059c80], rbx
jne 0x14004957d
mov qword [0x140059c80], rsi
test rbx, rbx
je 0x1400495a5
mov rcx, rbx
call fcn.140023860
mov rax, qword [0x140059c80]
test rax, rax
je 0x14004959c
dec dword [rax + 0x3b0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x140059cd0]
test rcx, rcx
je 0x1400495be
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x140059cd0], rsi
mov rcx, qword [0x140059cd8]
test rcx, rcx
je 0x1400495d7
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x140059cd8], rsi
mov rcx, qword [0x140059ce0]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0x18]
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.USER32.dll_UnregisterClassW]
cmp dword [rbp + 0x538], esi
je 0x140049662
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
mov ecx, 6
mov dword [rbp + 0x538], esi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov rcx, qword [0x140059cd8]
mov rdx, qword [0x140059cd0]
test rdx, rdx
je 0x14004963d
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x10]
mov rcx, qword [0x140059cd8]
mov qword [0x140059cd0], rsi
test rcx, rcx
je 0x14004964f
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x140059cd8], rsi
mov rdx, qword [rbp + 0x18]
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov esi, 1
mov rdx, qword [rbp + 0x588]
cmp rdx, 0xf
jbe 0x1400496a6
mov rcx, qword [rbp + 0x570]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400496a1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400496a1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004ab84
mov eax, esi
mov rcx, qword [rbp + 0xab0]
xor rcx, rsp
call fcn.14004a770
lea r11, [rsp + 0xc10]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm10, xmmword [r11 - 0x50]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140047720
int3
call fcn.140047680
int3