Function at 0x140008f20
Capabilities:
Delete file
Execute command
Log keystrokes via polling
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x140013040]
xor rax, rsp
mov qword [rbp + 0xf0], rax
lea rcx, str.Credits_:_eieee
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x14000aa33
mov dword [rsp + 0x48], 0xffe9c967
xor r15d, r15d
nop dword [rax + rax]
lea rcx, [0x14000f844]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x14000f844]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x18], xmm1
mov rdi, r15
mov qword [rsp + 0x68], r15
mov qword [rbp + 0x28], r15
lea rcx, [rsp + 0x30]
call fcn.140002cf0
lea rcx, [rbp + 0x18]
cmp rcx, rax
je 0x140008ffa
mov rsi, qword [rax]
mov qword [rbp + 0x18], rsi
mov r13, qword [rax + 8]
mov qword [rbp + 0x20], r13
mov rdi, qword [rax + 0x10]
mov qword [rsp + 0x68], rdi
mov qword [rbp + 0x28], rdi
mov qword [rax], r15
mov qword [rax + 8], r15
mov qword [rax + 0x10], r15
jmp 0x140009002
mov r13, qword [rbp + 0x20]
mov rsi, qword [rbp + 0x18]
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x48], r13
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140009052
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000904d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000aaeb
call fcn.14000cfbc
cmp rsi, r13
jne 0x1400091f8
call fcn.1400026e0
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9, rax
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x30]
call fcn.140002470
mov rbx, rax
lea rax, [rbp + 0x18]
cmp rax, rbx
je 0x1400090f1
test rsi, rsi
je 0x1400090cf
sub rdi, rsi
sar rdi, 3
lea rdx, [rdi*8]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400090c7
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000aaf2
mov rcx, rsi
call fcn.14000cfbc
mov rax, qword [rbx]
mov qword [rbp + 0x18], rax
mov rax, qword [rbx + 8]
mov qword [rbp + 0x20], rax
mov rax, qword [rbx + 0x10]
mov qword [rbp + 0x28], rax
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140009139
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009134
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000aaf2
call fcn.14000cfbc
lea rcx, [rbp + 0x18]
call fcn.1400029b0
lea rcx, str.attrib_h_s_C:ProgramDatacounter1.json
call fcn.140008be0
lea rdx, str.Found_addresses:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x14000c830]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rsi, qword [rbp + 0x18]
mov qword [rbp - 0x78], rsi
mov rdi, rsi
mov r13, qword [rbp + 0x20]
mov qword [rbp - 0x48], r13
cmp rsi, r13
je 0x1400091ea
nop dword [rax]
mov rbx, qword [rdi]
lea rdx, str.Address:_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x140001c60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x14000f8b4]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x14000c830]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
add rdi, 8
cmp rdi, r13
jne 0x140009190
mov rax, qword [rbp + 0x28]
mov qword [rsp + 0x68], rax
jmp 0x14000927a
lea rdx, str.Found_addresses_from_file:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x14000c830]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdi, rsi
nop
mov rbx, qword [rdi]
lea rdx, str.Address:_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x140001c60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x14000f8b4]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x14000c830]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
add rdi, 8
cmp rdi, r13
jne 0x140009220
mov r14, rsi
mov qword [rbp - 0x18], rsi
cmp rsi, r13
je 0x14000a9da
mov dword [rsp + 0x4c], 0x6f0527b4
mov rdi, qword [r14]
mov dword [rbp + 0xc0], 0
call fcn.1400026e0
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400092da
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp + 0xc0]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp + 0xdc], 0x7fc00000
lea rdx, str.Change_value_successful__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
lea rdx, [0x14000f8b4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp + 0xdc]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa8], xmm1
mov rdi, r15
mov qword [rsp + 0x60], r15
mov qword [rbp + 0xb8], r15
lea rcx, [rsp + 0x30]
call fcn.140003380
lea rcx, [rbp + 0xa8]
cmp rcx, rax
je 0x140009395
mov rsi, qword [rax]
mov qword [rbp + 0xa8], rsi
mov r12, qword [rax + 8]
mov qword [rbp + 0xb0], r12
mov rdi, qword [rax + 0x10]
mov qword [rsp + 0x60], rdi
mov qword [rbp + 0xb8], rdi
mov qword [rax], r15
mov qword [rax + 8], r15
mov qword [rax + 0x10], r15
jmp 0x1400093a3
mov r12, qword [rbp + 0xb0]
mov rsi, qword [rbp + 0xa8]
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x40], r12
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400093f3
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400093ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000aaf9
call fcn.14000cfbc
cmp rsi, r12
jne 0x1400095ab
call fcn.1400026e0
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9, rax
lea rdx, [rsp + 0x4c]
lea rcx, [rsp + 0x30]
call fcn.140002470
mov rbx, rax
lea rax, [rbp + 0xa8]
cmp rax, rbx
je 0x14000949e
test rsi, rsi
je 0x140009473
sub rdi, rsi
sar rdi, 3
lea rdx, [rdi*8]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14000946b
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ab00
mov rcx, rsi
call fcn.14000cfbc
mov rax, qword [rbx]
mov qword [rbp + 0xa8], rax
mov rax, qword [rbx + 8]
mov qword [rbp + 0xb0], rax
mov rax, qword [rbx + 0x10]
mov qword [rbp + 0xb8], rax
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400094e6
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400094e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ab00
call fcn.14000cfbc
lea rcx, [rbp + 0xa8]
call fcn.140003100
lea rcx, str.attrib_h_s_C:ProgramDatacounter2.json
call fcn.140008be0
lea rdx, str.Found_addresses:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x14000c830]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rsi, qword [rbp + 0xa8]
mov qword [rbp - 0x70], rsi
mov rdi, rsi
mov r12, qword [rbp + 0xb0]
mov qword [rbp - 0x40], r12
cmp rsi, r12
je 0x14000959a
nop
mov rbx, qword [rdi]
lea rdx, str.Address:_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x140001c60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x14000f8b4]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x14000c830]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
add rdi, 8
cmp rdi, r12
jne 0x140009540
mov rax, qword [rbp + 0xb8]
mov qword [rsp + 0x60], rax
jmp 0x14000962b
lea rdx, str.Found_addresses_from_file:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x14000c830]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdi, rsi
mov rbx, qword [rdi]
lea rdx, str.Address:_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x140001c60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x14000f8b4]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x14000c830]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
add rdi, 8
cmp rdi, r12
jne 0x1400095d1
mov r15, rsi
mov qword [rbp - 0x20], rsi
cmp rsi, r12
je 0x14000a979
mov dword [rsp + 0x50], 0x3f5e13d8
mov rdi, qword [r15]
mov dword [rbp + 0xd4], 0
call fcn.1400026e0
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
xor r14d, r14d
test rax, rax
je 0x14000968c
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 4]
lea r8, [rbp + 0xd4]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp + 0xd0], 0x6f0527b4
lea rdx, str.Change_value_successful_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], r14
mov r9d, 4
lea r8, [rbp + 0xd0]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x30], xmm1
mov rdi, r14
mov qword [rbp - 0x80], r14
mov qword [rbp + 0x40], r14
lea rcx, [rsp + 0x30]
call fcn.140003950
lea rcx, [rbp + 0x30]
cmp rcx, rax
je 0x140009720
mov rsi, qword [rax]
mov qword [rbp + 0x30], rsi
mov r13, qword [rax + 8]
mov qword [rbp + 0x38], r13
mov rdi, qword [rax + 0x10]
mov qword [rbp - 0x80], rdi
mov qword [rbp + 0x40], rdi
mov qword [rax], r14
mov qword [rax + 8], r14
mov qword [rax + 0x10], r14
jmp 0x140009728
mov r13, qword [rbp + 0x38]
mov rsi, qword [rbp + 0x30]
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x38], r13
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140009778
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009773
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ab07
call fcn.14000cfbc
cmp rsi, r13
jne 0x140009917
call fcn.1400026e0
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9, rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140002470
mov rbx, rax
lea rax, [rbp + 0x30]
cmp rax, rbx
je 0x140009817
test rsi, rsi
je 0x1400097f5
sub rdi, rsi
sar rdi, 3
lea rdx, [rdi*8]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400097ed
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ab0e
mov rcx, rsi
call fcn.14000cfbc
mov rax, qword [rbx]
mov qword [rbp + 0x30], rax
mov rax, qword [rbx + 8]
mov qword [rbp + 0x38], rax
mov rax, qword [rbx + 0x10]
mov qword [rbp + 0x40], rax
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000985f
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000985a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ab0e
call fcn.14000cfbc
lea rcx, [rbp + 0x30]
call fcn.1400036d0
lea rcx, str.attrib_h_s_C:ProgramData_front.json
call fcn.140008be0
lea rdx, str.Found_addresses:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x14000c830]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rsi, qword [rbp + 0x30]
mov qword [rbp - 0x68], rsi
mov rdi, rsi
mov r13, qword [rbp + 0x38]
mov qword [rbp - 0x38], r13
cmp rsi, r13
je 0x14000990a
nop
mov rbx, qword [rdi]
lea rdx, str.Address:_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x140001c60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x14000f8b4]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x14000c830]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
add rdi, 8
cmp rdi, r13
jne 0x1400098b0
mov rax, qword [rbp + 0x40]
mov qword [rbp - 0x80], rax
jmp 0x14000999a
lea rdx, str.Found_addresses_from_file:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x14000c830]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdi, rsi
nop dword [rax]
mov rbx, qword [rdi]
lea rdx, str.Address:_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x140001c60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x14000f8b4]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x14000c830]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
add rdi, 8
cmp rdi, r13
jne 0x140009940
mov r14, rsi
mov qword [rbp + 8], rsi
cmp rsi, r13
je 0x14000a917
mov dword [rsp + 0x54], 0xb3385791
mov rdi, qword [r14]
mov dword [rbp + 0xcc], 0
call fcn.1400026e0
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
xor r15d, r15d
test rax, rax
je 0x1400099fb
mov qword [rsp + 0x20], r15
lea r9d, [r15 + 4]
lea r8, [rbp + 0xcc]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp + 0xc8], 0x3f5e13d8
lea rdx, str.Change_value_successful_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp + 0xc8]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x48], xmm1
mov rdi, r15
mov qword [rsp + 0x78], r15
mov qword [rbp + 0x58], r15
lea rcx, [rsp + 0x30]
call fcn.140003f20
lea rcx, [rbp + 0x48]
cmp rcx, rax
je 0x140009a91
mov rsi, qword [rax]
mov qword [rbp + 0x48], rsi
mov r12, qword [rax + 8]
mov qword [rbp + 0x50], r12
mov rdi, qword [rax + 0x10]
mov qword [rsp + 0x78], rdi
mov qword [rbp + 0x58], rdi
mov qword [rax], r15
mov qword [rax + 8], r15
mov qword [rax + 0x10], r15
jmp 0x140009a99
mov r12, qword [rbp + 0x50]
mov rsi, qword [rbp + 0x48]
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x30], r12
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140009ae9
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009ae4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ab15
call fcn.14000cfbc
cmp rsi, r12
jne 0x140009c88
call fcn.1400026e0
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9, rax
lea rdx, [rsp + 0x54]
lea rcx, [rsp + 0x30]
call fcn.140002470
mov rbx, rax
lea rax, [rbp + 0x48]
cmp rax, rbx
je 0x140009b88
test rsi, rsi
je 0x140009b66
sub rdi, rsi
sar rdi, 3
lea rdx, [rdi*8]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140009b5e
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ab1c
mov rcx, rsi
call fcn.14000cfbc
mov rax, qword [rbx]
mov qword [rbp + 0x48], rax
mov rax, qword [rbx + 8]
mov qword [rbp + 0x50], rax
mov rax, qword [rbx + 0x10]
mov qword [rbp + 0x58], rax
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140009bd0
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009bcb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ab1c
call fcn.14000cfbc
lea rcx, [rbp + 0x48]
call fcn.140003ca0
lea rcx, str.attrib_h_s_C:ProgramData_back.json
call fcn.140008be0
lea rdx, str.Found_addresses:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x14000c830]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rsi, qword [rbp + 0x48]
mov qword [rbp - 0x60], rsi
mov rdi, rsi
mov r12, qword [rbp + 0x50]
mov qword [rbp - 0x30], r12
cmp rsi, r12
je 0x140009c7a
mov rbx, qword [rdi]
lea rdx, str.Address:_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x140001c60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x14000f8b4]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x14000c830]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
add rdi, 8
cmp rdi, r12
jne 0x140009c20
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x78], rax
jmp 0x140009d0a
lea rdx, str.Found_addresses_from_file:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x14000c830]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdi, rsi
nop
mov rbx, qword [rdi]
lea rdx, str.Address:_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x140001c60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x14000f8b4]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x14000c830]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
add rdi, 8
cmp rdi, r12
jne 0x140009cb0
mov r15, rsi
mov qword [rbp], rsi
cmp rsi, r12
je 0x14000a8b4
mov dword [rsp + 0x58], 0x56e6cdf8
mov rdi, qword [r15]
mov dword [rbp + 0xec], 0
call fcn.1400026e0
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
xor r13d, r13d
test rax, rax
je 0x140009d6b
mov qword [rsp + 0x20], r13
lea r9d, [r13 + 4]
lea r8, [rbp + 0xec]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp + 0xe8], 0xb3385791
lea rdx, str.Change_value_successful_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0xe8]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x60], xmm1
mov rdi, r13
mov qword [rsp + 0x70], r13
mov qword [rbp + 0x70], r13
lea rcx, [rsp + 0x30]
call fcn.1400044f0
lea rcx, [rbp + 0x60]
cmp rcx, rax
je 0x140009e01
mov rsi, qword [rax]
mov qword [rbp + 0x60], rsi
mov r14, qword [rax + 8]
mov qword [rbp + 0x68], r14
mov rdi, qword [rax + 0x10]
mov qword [rsp + 0x70], rdi
mov qword [rbp + 0x70], rdi
mov qword [rax], r13
mov qword [rax + 8], r13
mov qword [rax + 0x10], r13
jmp 0x140009e09
mov r14, qword [rbp + 0x68]
mov rsi, qword [rbp + 0x60]
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], r14
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140009e59
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009e54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ab23
call fcn.14000cfbc
cmp rsi, r14
jne 0x140009ff8
call fcn.1400026e0
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9, rax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x30]
call fcn.140002470
mov rbx, rax
lea rax, [rbp + 0x60]
cmp rax, rbx
je 0x140009ef8
test rsi, rsi
je 0x140009ed6
sub rdi, rsi
sar rdi, 3
lea rdx, [rdi*8]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140009ece
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ab2a
mov rcx, rsi
call fcn.14000cfbc
mov rax, qword [rbx]
mov qword [rbp + 0x60], rax
mov rax, qword [rbx + 8]
mov qword [rbp + 0x68], rax
mov rax, qword [rbx + 0x10]
mov qword [rbp + 0x70], rax
mov qword [rbx], r13
mov qword [rbx + 8], r13
mov qword [rbx + 0x10], r13
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140009f40
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009f3b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ab2a
call fcn.14000cfbc
lea rcx, [rbp + 0x60]
call fcn.140004270
lea rcx, str.attrib_h_s_C:ProgramData_right.json
call fcn.140008be0
lea rdx, str.Found_addresses:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x14000c830]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rsi, qword [rbp + 0x60]
mov qword [rbp - 0x58], rsi
mov rdi, rsi
mov r14, qword [rbp + 0x68]
mov qword [rbp - 0x50], r14
cmp rsi, r14
je 0x140009fea
mov rbx, qword [rdi]
lea rdx, str.Address:_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x140001c60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x14000f8b4]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x14000c830]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
add rdi, 8
cmp rdi, r14
jne 0x140009f90
mov rax, qword [rbp + 0x70]
mov qword [rsp + 0x70], rax
jmp 0x14000a07a
lea rdx, str.Found_addresses_from_file:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x14000c830]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdi, rsi
nop
mov rbx, qword [rdi]
lea rdx, str.Address:_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x140001c60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x14000f8b4]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x14000c830]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
add rdi, 8
cmp rdi, r14
jne 0x14000a020
mov rax, rsi
mov qword [rbp - 0x10], rax
cmp rsi, r14
je 0x14000a851
mov dword [rbp + 0x10], 0x38e71fc7
jmp 0x14000a0a3
xor r13d, r13d
mov rdi, qword [rax]
mov dword [rbp + 0xe4], 0
call fcn.1400026e0
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14000a0eb
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0xe4]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp + 0xe0], 0x56e6cdf8
lea rdx, str.Change_value_successful_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0xe0]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x78], xmm1
mov qword [rbp + 0x88], r13
lea rcx, [rsp + 0x30]
call fcn.140004ac0
lea rcx, [rbp + 0x78]
xor edi, edi
cmp rcx, rax
je 0x14000a17f
mov r15, qword [rax]
mov qword [rbp + 0x78], r15
mov rsi, qword [rax + 8]
mov qword [rbp + 0x80], rsi
mov r13, qword [rax + 0x10]
mov qword [rbp + 0x88], r13
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
jmp 0x14000a18a
mov rsi, qword [rbp + 0x80]
mov r15, qword [rbp + 0x78]
mov qword [rbp - 0x28], rsi
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000a1d6
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a1d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ab31
call fcn.14000cfbc
cmp r15, rsi
jne 0x14000a377
call fcn.1400026e0
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9, rax
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x30]
call fcn.140002470
mov rbx, rax
lea rax, [rbp + 0x78]
cmp rax, rbx
je 0x14000a27a
test r15, r15
je 0x14000a252
sub r13, r15
sar r13, 3
lea rdx, [r13*8]
mov rax, r15
cmp rdx, 0x1000
jb 0x14000a24a
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ab38
mov rcx, r15
call fcn.14000cfbc
mov rax, qword [rbx]
mov qword [rbp + 0x78], rax
mov rax, qword [rbx + 8]
mov qword [rbp + 0x80], rax
mov rax, qword [rbx + 0x10]
mov qword [rbp + 0x88], rax
mov qword [rbx], rdi
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rdi
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000a2c2
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a2bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ab38
call fcn.14000cfbc
lea rcx, [rbp + 0x78]
call fcn.140004840
lea rcx, str.attrib_h_s_C:ProgramDataleft.json
call fcn.140008be0
lea rdx, str.Found_addresses:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x14000c830]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r15, qword [rbp + 0x78]
mov rdi, r15
mov rsi, qword [rbp + 0x80]
mov qword [rbp - 0x28], rsi
cmp r15, rsi
je 0x14000a36b
mov rbx, qword [rdi]
lea rdx, str.Address:_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x140001c60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x14000f8b4]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x14000c830]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
add rdi, 8
cmp rdi, rsi
jne 0x14000a311
mov r13, qword [rbp + 0x88]
jmp 0x14000a3fa
lea rdx, str.Found_addresses_from_file:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x14000c830]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdi, r15
nop dword [rax]
mov rbx, qword [rdi]
lea rdx, str.Address:_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x140001c60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x14000f8b4]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x14000c830]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
add rdi, 8
cmp rdi, rsi
jne 0x14000a3a0
mov r12, r15
mov qword [rbp - 8], r15
cmp r15, rsi
je 0x14000a7ef
mov dword [rbp + 0x14], 0xdf91ab39
mov rdi, qword [r12]
mov dword [rbp + 0xd8], 0
call fcn.1400026e0
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14000a45e
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0xd8]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp + 0xc4], 0x38e71fc7
lea rdx, str.Change_value_successful_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0xc4]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x90], xmm1
xor ebx, ebx
mov esi, ebx
mov qword [rbp + 0xa0], rbx
lea rcx, [rsp + 0x30]
call fcn.140005090
lea rcx, [rbp + 0x90]
cmp rcx, rax
je 0x14000a501
mov rdi, qword [rax]
mov qword [rbp + 0x90], rdi
mov r14, qword [rax + 8]
mov qword [rbp + 0x98], r14
mov rsi, qword [rax + 0x10]
mov qword [rbp + 0xa0], rsi
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
jmp 0x14000a50f
mov r14, qword [rbp + 0x98]
mov rdi, qword [rbp + 0x90]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000a557
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a552
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ab3f
call fcn.14000cfbc
cmp rdi, r14
jne 0x14000a706
call fcn.1400026e0
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9, rax
lea rdx, [rbp + 0x14]
lea rcx, [rsp + 0x30]
call fcn.140002470
mov rbx, rax
lea rax, [rbp + 0x90]
cmp rax, rbx
je 0x14000a603
test rdi, rdi
je 0x14000a5d6
sub rsi, rdi
sar rsi, 3
lea rdx, [rsi*8]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14000a5ce
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ab46
mov rcx, rdi
call fcn.14000cfbc
mov rax, qword [rbx]
mov qword [rbp + 0x90], rax
mov rax, qword [rbx + 8]
mov qword [rbp + 0x98], rax
mov rax, qword [rbx + 0x10]
mov qword [rbp + 0xa0], rax
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000a64b
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a646
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ab46
call fcn.14000cfbc
lea rcx, [rbp + 0x90]
call fcn.140004e10
lea rcx, str.attrib_h_s_C:ProgramData_frontvar.json
call fcn.140008be0
lea rdx, str.Found_addresses:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x14000c830]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdi, qword [rbp + 0x90]
mov rsi, rdi
mov r14, qword [rbp + 0x98]
cmp rdi, r14
je 0x14000a6fa
nop dword [rax]
mov rbx, qword [rsi]
lea rdx, str.Address:_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x140001c60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x14000f8b4]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x14000c830]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
add rsi, 8
cmp rsi, r14
jne 0x14000a6a0
mov rsi, qword [rbp + 0xa0]
jmp 0x14000a78f
lea rdx, str.Found_addresses_from_file:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x14000c830]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r12, rdi
nop dword [rax]
mov rbx, qword [r12]
lea rdx, str.Address:_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x140001c60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x14000f8b4]
call fcn.14000c660
mov rcx, rax
lea rdx, [0x14000c830]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
add r12, 8
cmp r12, r14
jne 0x14000a730
mov r12, qword [rbp - 8]
cmp rdi, r14
jne 0x14000ab54
test rdi, rdi
je 0x14000a7d9
sub rsi, rdi
sar rsi, 3
lea rdx, [rsi*8]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14000a7d1
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ab4d
mov rcx, rdi
call fcn.14000cfbc
add r12, 8
mov qword [rbp - 8], r12
cmp r12, qword [rbp - 0x28]
jne 0x14000a411
mov r14, qword [rbp - 0x50]
test r15, r15
je 0x14000a830
sub r13, r15
sar r13, 3
lea rdx, [r13*8]
mov rax, r15
cmp rdx, 0x1000
jb 0x14000a828
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000aee7
mov rcx, r15
call fcn.14000cfbc
mov rax, qword [rbp - 0x10]
add rax, 8
mov qword [rbp - 0x10], rax
cmp rax, r14
jne 0x14000a0a0
mov rsi, qword [rbp - 0x58]
mov r15, qword [rbp]
mov r12, qword [rbp - 0x30]
test rsi, rsi
je 0x14000a897
mov rax, qword [rsp + 0x70]
sub rax, rsi
sar rax, 3
lea rdx, [rax*8]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14000a88f
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000aeee
mov rcx, rsi
call fcn.14000cfbc
add r15, 8
mov qword [rbp], r15
cmp r15, r12
jne 0x140009d22
mov rsi, qword [rbp - 0x60]
mov r14, qword [rbp + 8]
mov r13, qword [rbp - 0x38]
test rsi, rsi
je 0x14000a8fa
mov rax, qword [rsp + 0x78]
sub rax, rsi
sar rax, 3
lea rdx, [rax*8]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14000a8f2
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000aef5
mov rcx, rsi
call fcn.14000cfbc
add r14, 8
mov qword [rbp + 8], r14
cmp r14, r13
jne 0x1400099b2
mov rsi, qword [rbp - 0x68]
mov r15, qword [rbp - 0x20]
mov r12, qword [rbp - 0x40]
test rsi, rsi
je 0x14000a95c
mov rax, qword [rbp - 0x80]
sub rax, rsi
sar rax, 3
lea rdx, [rax*8]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14000a954
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000aefc
mov rcx, rsi
call fcn.14000cfbc
add r15, 8
mov qword [rbp - 0x20], r15
cmp r15, r12
jne 0x140009643
mov rsi, qword [rbp - 0x70]
mov r14, qword [rbp - 0x18]
mov r13, qword [rbp - 0x48]
test rsi, rsi
je 0x14000a9bf
mov rax, qword [rsp + 0x60]
sub rax, rsi
sar rax, 3
lea rdx, [rax*8]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14000a9b7
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000af03
mov rcx, rsi
call fcn.14000cfbc
add r14, 8
mov qword [rbp - 0x18], r14
cmp r14, r13
mov r15d, 0
jne 0x140009292
mov rsi, qword [rbp - 0x78]
test rsi, rsi
je 0x14000aa1b
mov rcx, qword [rsp + 0x68]
sub rcx, rsi
and rcx, 0xfffffffffffffff8
mov rax, rsi
cmp rcx, 0x1000
jb 0x14000aa10
add rcx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000af0a
mov rdx, rcx
mov rcx, rsi
call fcn.14000cfbc
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x140008f90
lea rcx, [0x14000f844]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:ProgramDatacounter1.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:ProgramDatacounter2.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:ProgramData_front.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:ProgramData_back.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:ProgramData_right.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:ProgramDataleft.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:ProgramData_frontvar.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rdx, str.fail_to_find_fivem
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.14000cd20
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r14, qword [rdi]
mov dword [rbp + 0x14], 0
call fcn.1400026e0
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14000ab9a
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x14]
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp + 0x10], 0xdf91ab39
lea rdx, str.Change_value_successful_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c660
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x10]
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, 0x40
lea r8, str.No_Stun
lea rdx, str.Playying._External
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x14000ac8a
nop
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14000ac43
call fcn.1400057e0
call fcn.140005be0
call fcn.1400063e0
call fcn.140006be0
call fcn.1400073e0
call fcn.140007be0
call fcn.1400083e0
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14000ac76
call fcn.1400053e0
call fcn.140005fe0
call fcn.1400067e0
call fcn.140006fe0
call fcn.1400077e0
call fcn.140007fe0
call fcn.1400087e0
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x14000ac10
lea rcx, str.C:ProgramDatacounter1.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:ProgramDatacounter2.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:ProgramData_front.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:ProgramData_back.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:ProgramData_right.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:ProgramDataleft.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:ProgramData_frontvar.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
sub rsi, rdi
sar rsi, 3
lea rdx, [rsi*8]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14000ad1d
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ad1d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.14000cfbc
nop
test r15, r15
je 0x14000ad6b
sub r13, r15
sar r13, 3
lea rdx, [r13*8]
mov rax, r15
cmp rdx, 0x1000
jb 0x14000ad62
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ad62
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.14000cfbc
nop
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x14000adb6
mov rdx, qword [rsp + 0x70]
sub rdx, rcx
sar rdx, 3
lea rdx, [rdx*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000adb0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000adb0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000cfbc
nop
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x14000ae01
mov rdx, qword [rsp + 0x78]
sub rdx, rcx
sar rdx, 3
lea rdx, [rdx*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000adfb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000adfb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000cfbc
nop
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x14000ae4b
mov rdx, qword [rbp - 0x80]
sub rdx, rcx
sar rdx, 3
lea rdx, [rdx*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ae45
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ae45
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000cfbc
nop
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x14000ae96
mov rdx, qword [rsp + 0x60]
sub rdx, rcx
sar rdx, 3
lea rdx, [rdx*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ae90
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ae90
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000cfbc
nop
mov r8, qword [rbp - 0x78]
test r8, r8
je 0x14000aab9
mov rcx, qword [rsp + 0x68]
sub rcx, r8
and rcx, 0xfffffffffffffff8
mov rax, r8
cmp rcx, 0x1000
jb 0x14000aed7
add rcx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000aed7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rcx
mov rcx, r8
call fcn.14000cfbc
jmp 0x14000aab9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3