Function at 0x140051530
Capabilities:
Create thread
Encode data using xor
Set console window title

Disassembly:
mov rax, rsp
push rsi
sub rsp, 0x230
vmovaps xmmword [rax - 0x18], xmm6
vmovaps xmmword [rax - 0x28], xmm7
vmovaps xmmword [rax - 0x38], xmm8
mov rax, qword [0x1401c3040]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
mov r10, rdx
cmp ecx, 2
jne 0x140051c4a
vmovups ymm0, ymmword [0x1401b98e0]
movzx eax, word [0x1401b9910]
lea rcx, [rsp + 0x54]
vmovups xmm1, xmmword [0x1401b9900]
vmovdqu xmm7, xmmword [0x1401b9cb0]
vmovdqu xmm6, xmmword [0x1401b9f30]
vmovdqu xmm8, xmmword [0x1401b9ce0]
vmovups ymmword [rsp + 0x50], ymm0
vmovdqu xmm0, xmmword [0x1401b9cf0]
mov word [rsp + 0x80], ax
xor esi, esi
movzx eax, byte [0x1401b9912]
mov r8d, esi
vmovdqu xmmword [rsp + 0x40], xmm0
mov edx, dword [rsp + 0x40]
vmovups xmmword [rsp + 0x70], xmm1
mov byte [rsp + 0x82], al
nop word [rax + rax]
vmovd xmm0, r8d
vpshufd xmm0, xmm0, 0
vpaddd xmm5, xmm0, xmm7
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm6
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm6
vshufps xmm0, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm0, 4
vpsrld xmm0, xmm4, 0x1f
vpaddd xmm1, xmm0, xmm4
vmovd xmm0, dword [rcx - 4]
vpmulld xmm2, xmm1, xmm8
vpsubd xmm3, xmm5, xmm2
vpshufb xmm4, xmm3, xmmword [0x1401b9c70]
vmovd xmm1, edx
vpaddb xmm2, xmm4, xmm1
vpxor xmm1, xmm2, xmm0
vmovd dword [rcx - 4], xmm1
lea eax, [r8 + 4]
add r8d, 8
lea rcx, [rcx + 8]
vmovd xmm0, eax
vpshufd xmm0, xmm0, 0
vpaddd xmm5, xmm0, xmm7
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm6
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm6
vshufps xmm0, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm0, 4
vpsrld xmm1, xmm4, 0x1f
vpaddd xmm0, xmm1, xmm4
vpmulld xmm2, xmm0, xmm8
vmovd xmm0, edx
vpsubd xmm3, xmm5, xmm2
vpshufb xmm4, xmm3, xmmword [0x1401b9c70]
vpaddb xmm1, xmm4, xmm0
vmovd xmm0, dword [rcx - 8]
vpxor xmm1, xmm1, xmm0
vmovd dword [rcx - 8], xmm1
cmp r8d, 0x30
jl 0x1400515e0
cmp r8d, 0x33
jge 0x1400516f1
movsxd rax, r8d
lea r9, [rsp + 0x50]
add r9, rax
nop dword [rax]
mov eax, 0x51eb851f
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x32
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9 - 1], al
cmp r8d, 0x33
jl 0x1400516c0
mov rax, qword [r10 + 8]
lea r8, [rsp + 0x50]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140051713
inc rax
test ecx, ecx
jne 0x140051700
test edx, edx
jne 0x140051c4a
lea rcx, [rsp + 0x88]
vzeroupper
call fcn.140047120
cmp qword [rax + 0x18], 0xf
jbe 0x140051735
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov rdx, qword [rsp + 0xa0]
cmp rdx, 0xf
jbe 0x140051784
mov rcx, qword [rsp + 0x88]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005177f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005177f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400550e0
cmp qword [0x1401d8168], rsi
vmovdqu xmm0, xmmword [0x1401b9c60]
vmovdqu xmmword [rsp + 0x98], xmm0
mov qword [rsp + 0x250], r14
mov byte [rsp + 0x88], sil
jne 0x1400517ed
nop
lea rdx, str.Apex_Legends
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov ecx, 0x3e8
mov qword [0x1401d8168], rax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n__Finding_apex...
call fcn.1400524f0
cmp qword [0x1401d8168], rsi
je 0x1400517b0
vmovups xmm0, xmmword [0x1401b98a0]
movzx eax, byte [0x1401b98b0]
lea rcx, [rsp + 0x24]
mov r10, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov r8d, esi
vmovdqu xmm7, xmmword [0x1401b9cb0]
vmovdqu xmm6, xmmword [0x1401b9f30]
vmovdqu xmm8, xmmword [0x1401b9ce0]
vmovups xmmword [rsp + 0x20], xmm0
vmovdqu xmm0, xmmword [0x1401b9cf0]
vmovdqu xmmword [rsp + 0x40], xmm0
mov edx, dword [rsp + 0x40]
mov byte [rsp + 0x30], al
nop
vmovd xmm0, r8d
vpshufd xmm0, xmm0, 0
vpaddd xmm5, xmm0, xmm7
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm6
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm6
vshufps xmm0, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm0, 4
vpsrld xmm0, xmm4, 0x1f
vpaddd xmm1, xmm0, xmm4
vmovd xmm0, dword [rcx - 4]
vpmulld xmm2, xmm1, xmm8
vpsubd xmm3, xmm5, xmm2
vpshufb xmm4, xmm3, xmmword [0x1401b9c70]
vmovd xmm1, edx
vpaddb xmm2, xmm4, xmm1
vpxor xmm1, xmm2, xmm0
vmovd dword [rcx - 4], xmm1
lea eax, [r8 + 4]
add r8d, 8
lea rcx, [rcx + 8]
vmovd xmm0, eax
vpshufd xmm0, xmm0, 0
vpaddd xmm5, xmm0, xmm7
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm6
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm6
vshufps xmm0, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm0, 4
vpsrld xmm1, xmm4, 0x1f
vpaddd xmm0, xmm1, xmm4
vpmulld xmm2, xmm0, xmm8
vmovd xmm0, edx
vpsubd xmm3, xmm5, xmm2
vpshufb xmm4, xmm3, xmmword [0x1401b9c70]
vpaddb xmm1, xmm4, xmm0
vmovd xmm0, dword [rcx - 8]
vpxor xmm1, xmm1, xmm0
vmovd dword [rcx - 8], xmm1
cmp r8d, 0x10
jl 0x140051840
cmp r8d, 0x11
jge 0x140051951
movsxd rax, r8d
lea r9, [rsp + 0x20]
add r9, rax
nop dword [rax]
mov eax, 0x51eb851f
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x32
movzx eax, r8b
inc r8d
sub al, dl
add al, 0x31
xor byte [r9 - 1], al
cmp r8d, 0x11
jl 0x140051920
lea rdx, [rsp + 0x20]
mov rcx, r10
call fcn.1400524f0
call fcn.140050fe0
mov rcx, qword [0x1401d8168]
lea rdx, [0x1401d8158]
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [0x1401d8168]
lea rdx, [0x1401d8550]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [0x1401d8550]
lea r14, str.r5apex.exe
mov dword [0x1401d8158], eax
mov eax, dword [0x1401d8554]
mov dword [0x1401d815c], eax
mov eax, dword [0x1401d8160]
mov dword [0x1401c30d4], eax
mov eax, dword [0x1401d8164]
mov dword [0x1401c30d0], eax
mov eax, dword [0x1401d8150]
test eax, eax
jne 0x140051ac5
mov qword [rsp + 0x240], rbx
mov qword [rsp + 0x248], rdi
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400519fc
mov rcx, rax
jmp 0x140051a82
lea rdx, [rsp + 0xc0]
mov dword [rsp + 0xc0], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
jne 0x140051a7a
nop dword [rax]
lea rax, [rsp + 0xec]
mov rdi, 0xffffffffffffffff
nop
inc rdi
cmp byte [rax + rdi], sil
jne 0x140051a30
mov r8d, 0xa
lea rdx, [rsp + 0xec]
cmp rdi, r8
mov rcx, r14
cmovb r8, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140051a64
cmp rdi, 0xa
je 0x140051b88
lea rdx, [rsp + 0xc0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
je 0x140051a20
test rbx, rbx
je 0x140051a88
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, esi
lea rcx, str._n___Status_Apex:Found
mov dword [0x1401d8150], edi
call fcn.140042910
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x1401d8150]
test eax, eax
je 0x1400519e0
mov rdi, qword [rsp + 0x248]
mov rbx, qword [rsp + 0x240]
cmp qword [0x1401d8170], rsi
jne 0x140051ba6
vpxor xmm0, xmm0, xmm0
lea rcx, str.win32u.dll
mov qword [rsp + 0x88], rsi
vmovdqu xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa7], rsi
mov byte [rsp + 0xaf], sil
mov qword [rsp + 0xb8], rsi
mov dword [rsp + 0xa0], eax
mov word [rsp + 0xa5], 0x100
mov byte [rsp + 0xa4], sil
mov qword [rsp + 0xb0], r14
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtGdiDdDDINetDispGetNextChunkInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x88]
call rax
mov rax, qword [rsp + 0xb8]
lea rdx, str._nDriver_May_Failed...Still_Checking...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [0x1401d8170], rax
call fcn.1400524f0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x1401d8170], rsi
jne 0x140051ba6
mov eax, dword [0x1401d8150]
jmp 0x140051ad2
mov edi, dword [rsp + 0xc8]
test rbx, rbx
je 0x140051a8a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140051a8a
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n__Driver_Loaded_n__Cheats_Launched
call fcn.1400524f0
xor r8d, r8d
lea rcx, [0x140049620]
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r8d, r8d
lea rcx, [0x140048720]
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
xor r8d, r8d
lea rcx, [0x14004c810]
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r8d, r8d
lea rcx, [0x140048260]
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov r14, qword [rsp + 0x250]
xor eax, eax
jmp 0x140051c4f
mov eax, 1
vzeroupper
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.140054ff0
lea r11, [rsp + 0x230]
vmovaps xmm6, xmmword [r11 - 0x10]
vmovaps xmm7, xmmword [r11 - 0x20]
vmovaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop rsi
ret