Function at 0x180042110
Capabilities:
Create process on windows
Create thread
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x180178b40]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor esi, esi
movsd xmm0, qword [0x18013ab98]
movsd qword [rbp - 0x19], xmm0
xor edx, edx
lea rcx, [rbp - 0x19]
call fcn.18005b050
mov qword [rbp - 0x21], rsi
mov qword [rbp - 0x29], rsi
lea r8, [rbp - 0x21]
xor edx, edx
lea rcx, [rbp - 0x29]
call fcn.18005b010
movabs rax, 0x520129d0c7e75b13
mov qword [rbp - 0x19], rax
mov rax, qword [rbp - 0x19]
mov qword [rbp - 0x39], rax
movabs rdi, 0x2081edd976c9d014
mov qword [rbp - 0x19], rdi
mov rax, qword [rbp - 0x19]
mov qword [rbp - 0x31], rax
movabs rbx, 0x520129d0c7e75b5f
mov qword [rbp - 0x19], rbx
mov rax, qword [rbp - 0x19]
mov qword [rbp + 0x27], rax
mov qword [rbp - 0x19], rdi
mov rax, qword [rbp - 0x19]
mov qword [rbp + 0x2f], rax
movdqa xmm0, xmmword [rbp - 0x39]
xorps xmm0, xmmword [rbp + 0x27]
movdqa xmmword [rbp - 0x39], xmm0
xor edx, edx
mov r8d, 0x3b
lea rcx, [rbp - 0x39]
call fcn.180047340
mov rcx, qword [0x180179b10]
mov rax, qword [rcx + 0x4000]
mov byte [rax + 0xc0], 1
mov rcx, qword [rcx + 0x4000]
movss xmm0, dword [0x18013ab98]
subss xmm0, dword [0x1800eae84]
movss dword [rbp - 0x39], xmm0
mov dword [rbp - 0x35], 0x40a00000
movabs rax, 0x52016c8388ab187c
mov qword [rbp - 0x19], rax
mov rax, qword [rbp - 0x19]
mov qword [rbp - 9], rax
mov qword [rbp - 0x19], rdi
mov rax, qword [rbp - 0x19]
mov qword [rbp - 1], rax
mov qword [rbp - 0x19], rbx
mov rax, qword [rbp - 0x19]
mov qword [rbp + 0x17], rax
mov qword [rbp - 0x19], rdi
mov rax, qword [rbp - 0x19]
mov qword [rbp + 0x1f], rax
movdqa xmm0, xmmword [rbp - 9]
xorps xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp - 9], xmm0
xor r8d, r8d
lea rdx, [rbp - 9]
call fcn.18004e540
mov ecx, eax
lea rdx, [rbp - 0x39]
call fcn.180075720
test al, al
je 0x18004227f
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movdqa xmm0, xmmword [0x1800ead10]
movups xmmword [rbp + 7], xmm0
movdqa xmm1, xmmword [0x1800ead90]
movups xmmword [rbp + 0x27], xmm1
call fcn.18004f0a0
mov rbx, rax
mov qword [rbp - 0x21], rsi
mov dword [rbp - 0x29], 0x43110000
mov dword [rbp - 0x25], 0x43ad8000
lea rcx, [rbp + 7]
call fcn.18004b280
mov dword [rsp + 0x28], 0x30
movss xmm0, dword [0x1800eba84]
movss dword [rsp + 0x20], xmm0
mov r9d, eax
lea r8, [rbp - 0x29]
lea rdx, [rbp - 0x21]
mov rcx, rbx
call fcn.180063320
lea rcx, [rbp + 0x27]
call fcn.18004b280
movss xmm0, dword [rbp - 0x29]
movss dword [rbp - 0x39], xmm0
movss xmm1, dword [rbp - 0x1d]
movss dword [rbp - 0x35], xmm1
movss xmm0, dword [rbp - 0x21]
movss dword [rbp - 0x19], xmm0
movss dword [rbp - 0x15], xmm1
movss xmm6, dword [0x1800eba80]
movss dword [rsp + 0x20], xmm6
mov r9d, eax
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
mov rcx, rbx
call fcn.180062220
lea rcx, [rbp + 0x27]
call fcn.18004b280
movss xmm1, dword [rbp - 0x29]
movss dword [rbp - 0x19], xmm1
movss xmm0, dword [rbp - 0x25]
movss dword [rbp - 0x15], xmm0
movss dword [rbp - 0x39], xmm1
movss xmm1, dword [rbp - 0x1d]
movss dword [rbp - 0x35], xmm1
movss dword [rsp + 0x20], xmm6
mov r9d, eax
lea r8, [rbp - 0x19]
lea rdx, [rbp - 0x39]
mov rcx, rbx
call fcn.180062220
lea rcx, [rbp + 0x27]
call fcn.18004b280
movss xmm0, dword [rbp - 0x21]
movss dword [rbp - 0x19], xmm0
movss xmm1, dword [rbp - 0x25]
movss dword [rbp - 0x15], xmm1
movss xmm0, dword [rbp - 0x29]
movss dword [rbp - 0x39], xmm0
movss dword [rbp - 0x35], xmm1
movss dword [rsp + 0x20], xmm6
mov r9d, eax
lea r8, [rbp - 0x19]
lea rdx, [rbp - 0x39]
mov rcx, rbx
call fcn.180062220
mov dword [rbp - 0x19], 0x41200000
mov dword [rbp - 0x15], 0x42f80000
lea rcx, [rbp - 0x19]
call fcn.18005a7f0
cmp dword [0x1801799e0], esi
sete dl
lea rcx, str.Combat
call fcn.1800444f0
test al, al
je 0x1800423f0
mov dword [0x1801799e0], esi
mov dword [rbp - 0x19], 0x41200000
mov dword [rbp - 0x15], 0x43230000
lea rcx, [rbp - 0x19]
call fcn.18005a7f0
cmp dword [0x1801799e0], 1
sete dl
lea rcx, str.Visuals
call fcn.1800444f0
test al, al
je 0x18004242b
mov dword [0x1801799e0], 1
mov dword [rbp - 0x19], 0x41200000
mov dword [rbp - 0x15], 0x434a0000
lea rcx, [rbp - 0x19]
call fcn.18005a7f0
cmp dword [0x1801799e0], 2
sete dl
lea rcx, str.Misc
call fcn.1800444f0
test al, al
je 0x180042466
mov dword [0x1801799e0], 2
mov dword [rbp - 0x19], 0x41200000
mov dword [rbp - 0x15], 0x43710000
lea rcx, [rbp - 0x19]
call fcn.18005a7f0
cmp dword [0x1801799e0], 3
sete dl
lea rcx, str.Config
call fcn.1800444f0
test al, al
je 0x1800424a6
mov dword [0x1801799e0], 3
jmp 0x1800429da
mov eax, dword [0x1801799e0]
test eax, eax
jne 0x1800425f9
mov dword [rbp - 0x19], 0x43390000
mov dword [rbp - 0x15], 0x42200000
lea rcx, [rbp - 0x19]
call fcn.18005a7f0
mov dword [rbp - 0x19], 0x43848000
mov dword [rbp - 0x15], 0x438e8000
xor r9d, r9d
mov r8d, 1
lea rdx, [rbp - 0x19]
lea rcx, str.123
call fcn.180049790
mov dword [rbp - 0x19], 0x3f800000
mov dword [rbp - 0x15], 0x3f800000
lea rdx, [rbp - 0x19]
mov ecx, 0xb
call fcn.180057130
lea rdx, [0x1801799d8]
lea rcx, str.Aim_Bot
call fcn.1800439c0
test al, al
je 0x180042599
mov ecx, 8
call fcn.1800e5708
test rax, rax
je 0x180042540
lea rcx, [0x1800431c0]
mov qword [rax], rcx
jmp 0x180042543
mov rax, rsi
mov qword [rbp - 0x19], rax
lea rcx, [rbp - 1]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x18003ed30]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 9], rax
test rax, rax
je 0x180042b69
cmp dword [rbp - 1], 0
je 0x180042b5e
movaps xmm0, xmmword [rbp - 9]
movdqa xmmword [rbp + 0x17], xmm0
lea rcx, [rbp + 0x17]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x180042b5e
lea rdx, [0x1801799dc]
lea rcx, str.Aim_Awm
call fcn.1800439c0
mov byte [0x1801799f2], al
lea rdx, [0x1801799db]
lea rcx, str.Quick_Change
call fcn.1800439c0
mov byte [0x1801799f3], al
lea rdx, [0x1801799da]
lea rcx, str.Precision
call fcn.1800439c0
mov byte [0x1801799f5], al
mov ecx, 1
call fcn.180056b10
call fcn.18004c4f0
mov eax, dword [0x1801799e0]
cmp eax, 1
jne 0x180042812
mov dword [rbp - 0x19], 0x43390000
mov dword [rbp - 0x15], 0x42200000
lea rcx, [rbp - 0x19]
call fcn.18005a7f0
mov dword [rbp - 0x19], 0x43848000
mov dword [rbp - 0x15], 0x438e8000
xor r9d, r9d
mov r8d, 1
lea rdx, [rbp - 0x19]
lea rcx, [0x1800eb09c]
call fcn.180049790
mov dword [rbp - 0x19], 0x3f800000
mov dword [rbp - 0x15], 0x3f800000
lea rdx, [rbp - 0x19]
mov ecx, 0xb
call fcn.180057130
mov dword [rbp - 0x19], 0x42040000
mov dword [rbp - 0x15], 0x42200000
lea rcx, [rbp - 0x19]
call fcn.18005a7f0
mov dword [rbp - 0x19], 0x43200000
mov dword [rbp - 0x15], 0x41c00000
xor r8d, r8d
lea rdx, [rbp - 0x19]
lea rcx, str.Load_Chams
call fcn.1800435a0
mov ecx, 1
call fcn.1800e5708
mov qword [rbp - 0x19], rax
lea rcx, [rbp - 1]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x1800409c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 9], rax
test rax, rax
je 0x180042bb4
cmp dword [rbp - 1], 0
je 0x180042ba9
movaps xmm0, xmmword [rbp - 9]
movdqa xmmword [rbp + 0x17], xmm0
lea rcx, [rbp + 0x17]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x180042ba9
lea rdx, [0x1801799d9]
lea rcx, str.Enable_Chams
call fcn.1800439c0
test al, al
je 0x18004276b
mov ecx, 1
call fcn.1800e5708
mov qword [rbp - 0x19], rax
lea rcx, [rbp - 1]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x1800409f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 9], rax
test rax, rax
je 0x180042b82
cmp dword [rbp - 1], 0
je 0x180042b77
movaps xmm0, xmmword [rbp - 9]
movdqa xmmword [rbp + 0x17], xmm0
lea rcx, [rbp + 0x17]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x180042b77
movss xmm0, dword [0x1800eba88]
call fcn.18005a850
mov dword [rbp - 0x19], 0x43200000
mov dword [rbp - 0x15], 0x41c80000
xor r8d, r8d
lea rdx, [rbp - 0x19]
lea rcx, str.Unload_Chams
call fcn.1800435a0
test al, al
je 0x1800427fd
mov ecx, 1
call fcn.1800e5708
mov qword [rbp - 0x19], rax
lea rcx, [rbp - 1]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x180040a90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 9], rax
test rax, rax
je 0x180042b9b
cmp dword [rbp - 1], 0
je 0x180042b90
movaps xmm0, xmmword [rbp - 9]
movdqa xmmword [rbp + 0x17], xmm0
lea rcx, [rbp + 0x17]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x180042b90
mov ecx, 1
call fcn.180056b10
call fcn.18004c4f0
mov eax, dword [0x1801799e0]
cmp eax, 2
jne 0x1800429d1
mov dword [rbp - 0x19], 0x43390000
mov dword [rbp - 0x15], 0x42200000
lea rcx, [rbp - 0x19]
call fcn.18005a7f0
mov dword [rbp - 0x19], 0x43848000
mov dword [rbp - 0x15], 0x438e8000
xor r9d, r9d
mov r8d, 1
lea rdx, [rbp - 0x19]
lea rcx, str.123
call fcn.180049790
mov dword [rbp - 0x19], 0x3f800000
mov dword [rbp - 0x15], 0x3f800000
lea rdx, [rbp - 0x19]
mov ecx, 0xb
call fcn.180057130
lea rdx, [0x1801799de]
lea rcx, str.Block_Internet
call fcn.1800439c0
test al, al
je 0x1800429a3
xor edx, edx
cmp byte [0x1801799de], 1
jne 0x18004294b
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In1__dirin_actionblock_program__ProgramFiles_BlueStacks_nxtHD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In1__dirout_actionblock_program__ProgramFiles_Bluestacks_nxtHD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In2__dirin_actionblock_program__ProgramFiles_BlueStacksHD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In2__dirout_actionblock_program__ProgramFiles_BluestacksHD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In3__dirin_actionblock_program__ProgramFiles_BlueStacks_msi2HD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In3__dirout_actionblock_program__ProgramFiles_Bluestacks_msi2HD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In6__dirin_actionblock_program__ProgramFiles_BlueStacks_msi5HD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In6__dirout_actionblock_program__ProgramFiles_BlueStacks_msi5HD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In4__dirin_actionblock_program__ProgramData_BlueStacks_msi5HD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In4__dirout_actionblock_program__ProgramData_Bluestacks_msi5HD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In5__dirin_actionblock_program__ProgramFiles_x86__SmartGaGaProjectTitanEngineProjectTitan.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In5__dirout_actionblock_program__ProgramFiles_x86__SmartGaGaProjectTitanEngineProjectTitan.exe_
jmp 0x18004299b
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameall_program__ProgramFiles_BlueStacks_nxtHD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameall_program__ProgramFiles_BlueStacksHD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameall_program__ProgramFiles_BlueStacks_msi2HD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameall_program__ProgramFiles_BlueStacks_msi5HD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameall_program__ProgramData_BlueStacks_msi5HD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameall_program__ProgramFiles_x86__SmartGaGaProjectTitanEngineProjectTitan.exe_
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, [0x1801799df]
lea rcx, str.Reset_Guest
call fcn.1800439c0
mov byte [0x1801799f4], al
mov ecx, 1
call fcn.180056b10
call fcn.18004c4f0
mov eax, dword [0x1801799e0]
cmp eax, 3
jne 0x180042a75
mov dword [rbp - 0x19], 0x43390000
mov dword [rbp - 0x15], 0x42200000
lea rcx, [rbp - 0x19]
call fcn.18005a7f0
mov dword [rbp - 0x19], 0x43848000
mov dword [rbp - 0x15], 0x438e8000
xor r9d, r9d
mov r8d, 1
lea rdx, [rbp - 0x19]
lea rcx, str.123
call fcn.180049790
mov dword [rbp - 0x19], 0x3f800000
mov dword [rbp - 0x15], 0x3f800000
lea rdx, [rbp - 0x19]
mov ecx, 0xb
call fcn.180057130
lea rdx, [0x18017976a]
lea rcx, str.Stream_Mode
call fcn.1800439c0
mov byte [0x180179769], al
lea rdx, [0x18017976b]
lea rcx, str.Hide_Task_Bar
call fcn.1800439c0
mov byte [0x180179768], al
mov ecx, 1
call fcn.180056b10
call fcn.18004c4f0
cmp byte [0x1801799f6], 0
jne 0x180042aa2
cmp byte [0x1801799f2], 0
jne 0x180042aa2
cmp byte [0x1801799f3], 0
jne 0x180042aa2
cmp byte [0x1801799f4], 0
jne 0x180042aa2
cmp byte [0x1801799f5], 0
je 0x180042b0a
mov ecx, 8
call fcn.1800e5708
test rax, rax
je 0x180042abd
lea rcx, [0x1800431d0]
mov qword [rax], rcx
jmp 0x180042ac0
mov rax, rsi
mov qword [rbp - 0x19], rax
lea rcx, [rbp - 1]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x18003ed30]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 9], rax
test rax, rax
je 0x180042b50
cmp dword [rbp - 1], 0
je 0x180042b45
movaps xmm0, xmmword [rbp - 9]
movdqa xmmword [rbp + 7], xmm0
lea rcx, [rbp + 7]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x180042b45
lea rcx, [0x18013ab80]
call fcn.18003fab0
call fcn.18004c170
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1800e5bd0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rbp
ret
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rbp - 1], esi
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rbp - 1], esi
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rbp - 1], esi
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rbp - 1], esi
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rbp - 1], esi
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3