Function at 0x1400627c0
Capabilities:
Contain obfuscated stackstrings
Create thread
Enumerate processes
Execute command
Terminate process

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x448]
sub rsp, 0x508
movaps xmmword [rax - 0x58], xmm6
movaps xmmword [rax - 0x68], xmm7
xor edi, edi
mov dword [rbp + 0x450], edi
mov dword [rbp + 0x460], edi
mov ecx, 8
call fcn.1400d7608
lea rcx, [0x1400625b0]
mov qword [rax], rcx
mov qword [rbp + 0x450], rax
mov esi, 0x80
lea rcx, [rbp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140067c60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x28], rax
test rax, rax
je 0x140063a40
lea rdx, str.Choose_overlay_mode:_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140065050
lea rdx, str.1._Normal_overlay_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140065050
lea rdx, str.2._Hijacked_Notepad_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140065050
lea rdx, [0x140102ce8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140065050
lea rdx, str.Mode:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140065050
lea rdx, [rbp + 0x458]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov eax, dword [rbp + 0x458]
cmp eax, 1
jne 0x140062968
lea rcx, [0x140103bb0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Version:_Normal_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140065050
mov ecx, 8
call fcn.1400d7608
lea rcx, [0x1400726b0]
mov qword [rax], rcx
mov qword [rbp + 0x450], rax
mov esi, 0x280
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140067c60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140062eb3
cmp dword [rsp + 0x48], edi
je 0x140062ea7
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp - 0x50], xmm0
lea rcx, [rbp - 0x50]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140062ea7
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov eax, dword [rbp + 0x458]
cmp eax, 2
jne 0x140062a10
lea rcx, [0x140103bb0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Version:_Hijacked_Notepad.exe_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140065050
mov ecx, 8
call fcn.1400d7608
lea rcx, [rbp + 0x460]
mov qword [rax], rcx
mov qword [rbp + 0x450], rax
bts esi, 8
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140067c90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140062ecf
cmp dword [rsp + 0x48], 0
je 0x140062ec3
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp - 0x50], xmm0
lea rcx, [rbp - 0x50]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140062ec3
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
lea rax, [0x140103e78]
mov qword [rbp + 0xa0], rax
lea rax, [0x140103d58]
mov qword [rbp + 0xb0], rax
lea rcx, [rbp + 0x138]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
or esi, 0x40
mov dword [rbp + 0x468], esi
mov dword [rbp + 0x450], esi
xor r8d, r8d
lea rdx, [rbp + 0xb8]
lea rcx, [rbp + 0xa0]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
nop
mov rax, qword [rbp + 0xa0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0xa0], rax
mov rax, qword [rbp + 0xa0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x9c], edx
lea rcx, [rbp + 0xb8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + 0xb8], rax
mov qword [rbp + 0x120], rdi
mov dword [rbp + 0x128], edi
movdqa xmm0, xmmword [0x1401052e0]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x78652e61
mov word [rsp + 0x54], 0x65
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rbp + 0x1a0], 0x130
lea rdx, [rbp + 0x1a0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140062b3e
nop word [rax + rax]
lea rdx, [rsp + 0x41]
lea rcx, [rbp + 0x1cc]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x140062edf
lea rdx, [rbp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140062b10
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov dword [0x14011c380], eax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
mov r8d, 3
lea rcx, str..Silence
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x14011c378], rax
call fcn.14005eb80
mov rbx, rax
mov qword [rbp + 0x450], rdi
mov dword [rbp - 0x1f], edi
mov word [rbp - 0x1b], di
mov byte [rbp - 0x19], 0
mov dword [rbp - 0x40], 0x85b3e12
lea rcx, [rax + 0x118]
mov qword [rbp - 0x38], rcx
lea rax, [rbp + 0x450]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 8
mov ecx, dword [0x14011c380]
mov dword [rbp - 0x3c], ecx
mov byte [rbp - 0x20], 0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, 0x28
lea r8, [rbp - 0x40]
mov edx, 0x2201c4
mov rcx, qword [0x14011c378]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov r13, qword [rbp + 0x450]
mov qword [rbp - 0x60], r13
mov qword [rsp + 0x60], rdi
mov dword [rbp + 9], edi
mov word [rbp + 0xd], di
mov byte [rbp + 0xf], 0
mov dword [rbp - 0x18], 0x85b3e12
lea rax, [r13 + 0x198]
mov qword [rbp - 0x10], rax
lea rax, [rsp + 0x60]
mov qword [rbp - 8], rax
mov qword [rbp], 8
mov eax, dword [0x14011c380]
mov dword [rbp - 0x14], eax
mov byte [rbp + 8], 0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, 0x28
lea r8, [rbp - 0x18]
mov edx, 0x2201c4
mov rcx, qword [0x14011c378]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rax, qword [rsp + 0x60]
mov qword [0x14011c3a8], rax
mov qword [rbp + 0x450], rdi
mov dword [rbp - 0x1f], edi
mov word [rbp - 0x1b], di
mov byte [rbp - 0x19], 0
mov dword [rbp - 0x40], 0x85b3e12
lea rax, [rbx + 0x10]
mov qword [rbp - 0x38], rax
lea rax, [rbp + 0x450]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 8
mov eax, dword [0x14011c380]
mov dword [rbp - 0x3c], eax
mov byte [rbp - 0x20], 0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, 0x28
lea r8, [rbp - 0x40]
mov edx, 0x2201c4
mov rcx, qword [0x14011c378]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rax, qword [rbp + 0x450]
mov qword [0x14011c3b8], rax
mov dword [rsp + 0x40], 0x726f570b
mov dword [rsp + 0x44], 0x6170736b
mov word [rsp + 0x48], 0x6563
mov byte [rsp + 0x4a], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], rdi
lea rax, [rsp + 0x41]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140062d40
lea rdx, [rsp + 0x41]
lea rcx, [rbp - 0x80]
call fcn.140005790
mov r9b, 1
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x450]
lea rcx, [0x14011c3a8]
call fcn.1400600d0
mov rcx, qword [rax]
mov qword [0x14011c3c8], rcx
mov dword [rsp + 0x40], 0x756f4d72
mov dword [rsp + 0x44], 0x65536573
mov dword [rsp + 0x48], 0x63697672
mov word [rsp + 0x4c], 0x65
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], rdi
lea rax, [rsp + 0x41]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140062db6
lea rdx, [rsp + 0x41]
lea rcx, [rbp - 0x80]
call fcn.140005790
xor r9d, r9d
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x450]
lea rcx, [0x14011c3a8]
call fcn.1400600d0
mov dword [rsp + 0x60], 0x616c5010
mov dword [rsp + 0x64], 0x73726579
mov byte [rsp + 0x68], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], rdi
lea rax, [rsp + 0x61]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140062e20
lea rdx, [rsp + 0x61]
lea rcx, [rbp - 0x80]
call fcn.140005790
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x450]
lea rcx, [0x14011c3a8]
call fcn.140060300
mov r15, qword [rax]
mov qword [0x14011c398], r15
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rdi
mov r14d, 0x1e
movabs r12, 0x7ffffffffaa2b57f
mov rbx, qword [rbp + 0x18]
mov esi, 0xff
movabs r13, 0x7fffffffffffffff
mov rcx, r15
call fcn.140024ff0
mov dword [rbp + 0x450], eax
cmp rbx, rdi
je 0x140062ef0
mov dword [rbx], eax
add rbx, 4
mov qword [rbp + 0x18], rbx
jmp 0x140062f0b
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x48], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x48], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x1a8]
jmp 0x140062b49
lea r8, [rbp + 0x450]
mov rdx, rbx
lea rcx, [rbp + 0x10]
call fcn.140066540
mov rdi, qword [rbp + 0x20]
mov rbx, qword [rbp + 0x18]
lea rcx, [rsp + 0x60]
call fcn.140001ba0
mov rax, qword [rsp + 0x60]
cmp rax, r12
je 0x140062f3a
mov ecx, 1
cmovl ecx, esi
test cl, cl
jns 0x140062f3a
add rax, 0x55d4a80
mov qword [rbp + 0x450], rax
jmp 0x140062f41
mov qword [rbp + 0x450], r13
lea rcx, [rbp + 0x450]
call fcn.1400059c0
sub r14, 1
jne 0x140062e88
mov rdi, qword [rbp + 0x10]
cmp rdi, rbx
mov esi, dword [rbp + 0x468]
mov r13, qword [rbp - 0x60]
jne 0x140062fa9
lea rdx, str.No_players_found._n
lea rcx, [rbp + 0xb0]
call fcn.140065050
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0xa0]
call fcn.140064050
nop
mov rcx, rax
call fcn.1400623c0
nop
lea rcx, [rbp - 0x40]
call fcn.140005390
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rbp + 0x60], 0
xor r15d, r15d
mov qword [rbp + 0x68], r15
mov qword [rbp + 0x70], r15
mov ecx, 0x18
call fcn.1400d7608
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x78], r15
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], 7
mov qword [rbp + 0x98], 8
mov dword [rbp + 0x60], 0x3f800000
mov r8, rax
mov edx, 0x10
lea rcx, [rbp + 0x78]
call fcn.1400649a0
nop
mov r14d, r15d
mov eax, dword [rdi]
mov dword [rbp + 0x450], eax
lea r8, [rbp + 0x450]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x60]
call fcn.140065270
mov rcx, qword [rax]
inc dword [rcx + 0x14]
cmp dword [rcx + 0x14], r14d
jle 0x140063061
lea r8, [rbp + 0x450]
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x60]
call fcn.140065270
mov rcx, qword [rax]
mov r14d, dword [rcx + 0x14]
mov eax, dword [rbp + 0x450]
mov dword [0x14011c394], eax
add rdi, 4
cmp rdi, rbx
jne 0x140063011
mov dword [rbp + 0x450], 0x6d61430d
mov dword [rbp + 0x454], 0x617265
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], r15
lea rax, [rbp + 0x451]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400630a0
lea rdx, [rbp + 0x451]
lea rcx, [rbp - 0x80]
call fcn.140005790
xor r9d, r9d
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x468]
lea rcx, [0x14011c3c8]
call fcn.1400600d0
mov rcx, qword [rax]
add rcx, 0x134
call fcn.140064f30
mulss xmm0, dword [0x14011c498]
movss dword [0x14011c3d8], xmm0
test r13, r13
je 0x1400639f4
cmp qword [0x14011c3a8], 0
je 0x1400639f4
cmp qword [0x14011c3c8], 0
je 0x1400639f4
mov ecx, 8
call fcn.1400d7608
lea rcx, [0x1400049d0]
mov qword [rax], rcx
mov qword [rbp + 0x450], rax
or esi, 0x10
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x140067c60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400639e3
cmp dword [rsp + 0x48], 0
je 0x1400639d7
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp - 0x50], xmm0
lea rcx, [rbp - 0x50]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400639d7
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov ecx, 8
call fcn.1400d7608
lea rcx, [0x1400606f0]
mov qword [rax], rcx
mov qword [rbp + 0x450], rax
or esi, 0x20
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x140067c60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400639c6
cmp dword [rsp + 0x48], 0
je 0x1400639ba
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp - 0x50], xmm0
lea rcx, [rbp - 0x50]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400639ba
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov rcx, qword [0x14011c398]
add rcx, 0x100
call fcn.140064da0
lea rcx, [rax + 0x298]
call fcn.140064da0
mov qword [rbp + 0x450], rax
mov dword [rsp + 0x70], 0x6d754841
mov dword [rsp + 0x74], 0x696f6e61
mov word [rsp + 0x78], 0x64
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], r15
lea rax, [rsp + 0x71]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140063270
lea rdx, [rsp + 0x71]
lea rcx, [rbp - 0x80]
call fcn.140005790
mov r9b, 1
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x468]
lea rcx, [rbp + 0x450]
call fcn.1400600d0
mov rbx, qword [rbp + 0x468]
lea rcx, [rbx + 0x1c0]
call fcn.140064f30
movss dword [0x14011a124], xmm0
lea r13, [rbx + 0x1a4]
mov rcx, r13
call fcn.140064f30
movss dword [0x14011a108], xmm0
lea rcx, [rbx + 0x194]
call fcn.140064f30
movss dword [0x14011a10c], xmm0
mov dword [rbp - 0x60], 0x616c501b
mov dword [rbp - 0x5c], 0x73726579
mov byte [rbp - 0x58], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], r15
lea rax, [rbp - 0x5f]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140063314
lea rdx, [rbp - 0x5f]
lea rcx, [rbp - 0x80]
call fcn.140005790
mov r9b, 1
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x450]
lea rcx, [0x14011c3a8]
call fcn.1400600d0
mov rcx, qword [rax]
add rcx, 0x100
call fcn.140064da0
lea rcx, [rax + 0x298]
call fcn.140064da0
mov qword [rbp + 0x450], rax
lea rcx, [rax + 0x298]
call fcn.140064da0
movdqa xmm0, xmmword [0x1401052d0]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x50], 0x74
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], r15
lea rax, [rsp + 0x41]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1400633a3
lea rdx, [rsp + 0x41]
lea rcx, [rbp - 0x80]
call fcn.140005790
xor r9d, r9d
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x468]
lea rcx, [rbp + 0x450]
call fcn.1400600d0
mov dword [rsp + 0x40], 0x776f4c74
mov dword [rsp + 0x44], 0x6f547265
mov dword [rsp + 0x48], 0x6f7372
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], r15
lea rax, [rsp + 0x41]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140063410
lea rdx, [rsp + 0x41]
lea rcx, [rbp - 0x80]
call fcn.140005790
xor r9d, r9d
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x468]
lea rcx, [rbp + 0x450]
call fcn.1400600d0
mov dword [rsp + 0x40], 0x7070551b
mov dword [rsp + 0x44], 0x6f547265
mov dword [rsp + 0x48], 0x6f7372
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], r15
lea rax, [rsp + 0x41]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140063475
lea rdx, [rsp + 0x41]
lea rcx, [rbp - 0x80]
call fcn.140005790
xor r9d, r9d
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x468]
lea rcx, [rbp + 0x450]
call fcn.1400600d0
lea rdx, [0x14011a1c0]
lea rcx, [rbp + 0x2d0]
call fcn.1400032a0
nop
mov rdi, qword [rbp + 0x348]
mov r8b, 1
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x450]
call fcn.14005fc50
nop
mov r12, qword [rbp - 0x78]
movss xmm6, dword [0x140104d28]
movss xmm7, dword [0x140104d24]
nop word [rax + rax]
mov r15, qword [rbp - 0x80]
cmp r15, r12
je 0x140063763
mov dword [rbp - 0x50], 0x73654d5c
mov dword [rbp - 0x4c], 0x72615068
mov word [rbp - 0x48], 0x74
mov rbx, qword [r15]
mov qword [rsp + 0x60], rbx
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x60]
call fcn.14005fb30
mov rcx, rax
or esi, 1
mov dword [rbp + 0x450], esi
lea rdx, [rbp - 0x4f]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rdx + rax], 0
jne 0x140063540
mov r8, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0xf
jbe 0x140063557
mov rcx, qword [rcx]
cmp r8, rax
jne 0x14006356d
lea rdx, [rbp - 0x4f]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14006363d
mov dword [rbp + 0x468], 0x72615052
mov word [rbp + 0x46c], 0x74
lea rdx, [rbp - 0x18]
lea rcx, [rsp + 0x60]
call fcn.14005fb30
mov rcx, rax
or esi, 2
mov dword [rbp + 0x450], esi
lea rdx, [rbp + 0x469]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x1400635b0
mov r8, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0xf
jbe 0x1400635c7
mov rcx, qword [rcx]
cmp r8, rax
jne 0x1400635dc
lea rdx, [rbp + 0x469]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14006363d
mov dword [rsp + 0x40], 0x73614272
mov dword [rsp + 0x44], 0x72615065
mov word [rsp + 0x48], 0x74
lea rdx, [rbp + 0x38]
lea rcx, [rsp + 0x60]
call fcn.14005fb30
mov rcx, rax
or esi, 4
lea rdx, [rsp + 0x41]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x140063613
mov r8, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0xf
jbe 0x14006362a
mov rcx, qword [rcx]
cmp r8, rax
jne 0x140063642
lea rdx, [rsp + 0x41]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140063642
mov r14b, 1
jmp 0x140063645
xor r14b, r14b
test sil, 4
je 0x14006369d
and esi, 0xfffffffb
mov rdx, qword [rbp + 0x50]
cmp rdx, 0xf
jbe 0x140063689
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140063684
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400638ca
call fcn.1400d795c
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x50], 0xf
mov byte [rbp + 0x38], 0
test sil, 2
je 0x1400636f5
and esi, 0xfffffffd
mov rdx, qword [rbp]
cmp rdx, 0xf
jbe 0x1400636e1
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400636dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400638d1
call fcn.1400d795c
mov qword [rbp - 8], 0
mov qword [rbp], 0xf
mov byte [rbp - 0x18], 0
test sil, 1
je 0x140063739
and esi, 0xfffffffe
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140063739
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140063734
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400638d8
call fcn.1400d795c
test r14b, r14b
je 0x140063756
lea rcx, [rbx + 0x158]
call fcn.140064da0
lea rcx, [rax + 0x30b]
call fcn.140064fc0
add r15, 8
cmp r15, r12
jne 0x140063511
cmp byte [0x14011a11c], 0
je 0x14006383e
cmp byte [0x14011c3e2], 0
jne 0x14006383e
mov dword [rsp + 0x70], 0x6e4b5b64
mov dword [rsp + 0x74], 0x5d656669
mov byte [rsp + 0x78], 0
lea rcx, [rdi + 0x48]
call fcn.140064da0
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.14005f930
or esi, 8
lea rcx, [rsp + 0x71]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x1400637b6
lea rcx, [rbp - 0x18]
mov rbx, qword [rbp - 0x18]
mov r14, qword [rbp]
cmp r14, 0xf
cmova rcx, rbx
mov r8, qword [rbp - 8]
cmp r8, rax
jne 0x1400637ef
lea rdx, [rsp + 0x71]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400637ef
mov r15b, 1
jmp 0x1400637f2
xor r15b, r15b
cmp r14, 0xf
jbe 0x140063829
lea rdx, [r14 + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140063821
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400638df
mov rcx, rbx
call fcn.1400d795c
mov rcx, r13
test r15b, r15b
je 0x140063836
movaps xmm1, xmm6
jmp 0x140063839
movaps xmm1, xmm7
call fcn.140064ea0
lea rdx, str.Roblox
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400638e6
lea rcx, [rbp - 0x60]
call fcn.140001ba0
mov rax, qword [rbp - 0x60]
mov qword [rbp + 0x450], rax
movabs rbx, 0x7ffffffffa0a1eff
cmp rax, rbx
je 0x1400638a8
mov ecx, 1
mov edx, 0xff
cmovl ecx, edx
test cl, cl
jns 0x1400638a8
add rax, 0x5f5e100
mov qword [rbp + 0x450], rax
lea rcx, [rbp + 0x450]
call fcn.1400059c0
jmp 0x1400634f0
movabs rax, 0x7fffffffffffffff
mov qword [rbp + 0x450], rax
lea rcx, [rbp + 0x450]
call fcn.1400059c0
jmp 0x1400634f0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005eb50
lea rdx, [0x1400fa251]
lea rcx, [rbp - 0x40]
call fcn.1400053f0
nop
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0xa0]
call fcn.140063f30
nop
lea rcx, [rbp - 0x40]
call fcn.140005390
lea rdx, str.Roblox_has_been_closed._n
lea rcx, [rbp + 0xb0]
call fcn.140065050
lea rcx, str.taskkill__f__im_mapper.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0xa0]
call fcn.140064050
nop
mov rcx, rax
call fcn.1400623c0
nop
lea rcx, [rbp - 0x40]
call fcn.140005390
mov r8d, dword [rbp + 0x460]
test r8d, r8d
je 0x1400639b1
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14006399e
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Notepad_has_been_terminated._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
jmp 0x1400639ac
lea rdx, str.Failed_to_open_Notepad_process_for_termination._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140065050
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x48], r15d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x48], r15d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
lea rdx, str.Please_restart_your_PC._n
lea rcx, [rbp + 0xb0]
call fcn.140065050
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0xa0]
call fcn.140064050
nop
mov rcx, rax
call fcn.1400623c0
nop
lea rcx, [rbp - 0x40]
call fcn.140005390
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov dword [rbp + 0x30], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3