Function at 0x1400015d0
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor r13d, r13d
lea rcx, [rbp - 0x71]
call fcn.140001380
mov rdi, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0xa
jb 0x140001658
lea rax, [rcx + 0xa]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0xf
jbe 0x140001639
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8d, 0xa
lea rdx, str.infhk.dll
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xa], 0
jmp 0x140001671
mov qword [rsp + 0x20], 0xa
mov edx, 0xa
mov rcx, rdi
call fcn.1400021c0
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], r13
mov qword [rbp - 1], r13
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x19], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp - 9], xmm1
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rdx, qword [rbp - 0x59]
cmp rdx, 0xf
jbe 0x1400016dc
inc rdx
mov rcx, qword [rbp - 0x71]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400016d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400016d7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002584
movdqa xmm0, xmmword [0x1400046d0]
movdqu xmmword [rbp - 0x61], xmm0
mov byte [rbp - 0x71], 0
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x17], xmm1
mov r8d, 0x19
lea rdx, str.IFUCKINGHATENIGGERSSOMUCH
lea rcx, [rbp + 7]
call fcn.1400020c0
nop
call fcn.1400012a0
mov ebx, eax
test eax, eax
jne 0x140001882
movabs rsi, 0xb2f4fc0794908cf3
movabs r12, 0x7fffffffc46535ff
movabs r13, 0x7fffffffffffffff
movabs r14, 0x4e94914effff
movabs r15, 0x431bde82d7b634db
nop dword [rax]
nop dword [rax + rax]
mov ebx, 0xff
lea rcx, [rbp - 0x79]
call fcn.1400011c0
mov rax, qword [rbp - 0x79]
cmp rax, r12
je 0x14000178a
mov ecx, 1
cmovl ecx, ebx
test cl, cl
lea rdi, [rax + 0x3b9aca00]
js 0x140001790
mov rdi, r13
nop dword [rax]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov rcx, rax
cmp rbx, 0x989680
jne 0x1400017b1
imul rax, rcx, 0x64
jmp 0x140001820
cmp rbx, 0x16e3600
jne 0x140001805
mov rax, rsi
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul r9, rdx, 0x3b9aca00
imul rax, rdx, 0x16e3600
sub rcx, rax
imul r8, rcx, 0x3b9aca00
mov rax, rsi
imul r8
add rdx, r8
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rax, rdx
add rax, r9
jmp 0x140001820
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rdi, rax
je 0x140001870
jl 0x140001870
mov rcx, rdi
sub rcx, rax
cmp rcx, r14
jg 0x140001861
mov rax, r15
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140001855
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x140001790
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x140001790
call fcn.1400012a0
mov ebx, eax
test eax, eax
je 0x140001760
xor r13d, r13d
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x1400018d2
lea rdx, str.____Failed_to_open_process.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001eb0
lea rdx, [0x140002080]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
lea ebx, [rdi - 1]
jmp 0x140001cc3
lea rdx, str.___Opened_process:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001eb0
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140002080]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.C:WindowsSystem32Wintrust.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x14000191b
lea rdx, str.____Failed_to_load_Wintrust.dll.
jmp 0x14000193a
lea rdx, str.WinVerifyTrust
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
jne 0x140001976
lea rdx, str.____Failed_to_find_WinVerifyTrust.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001eb0
lea rdx, [0x140002080]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0xffffffff
jmp 0x140001cc3
lea rdx, str.___WinVerifyTrust_address:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001eb0
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
lea rdx, [0x140002080]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x51], xmm1
mov qword [rbp - 0x41], r13
mov ecx, 6
call fcn.140002540
mov qword [rbp - 0x51], rax
lea rcx, [rax + 6]
mov qword [rbp - 0x41], rcx
xor edx, edx
mov dword [rax], edx
mov word [rax + 4], dx
mov qword [rbp - 0x49], rcx
xorps xmm0, xmm0
mov dword [rbp - 0x79], 0xb8
mov word [rbp - 0x75], 0xc300
movdqu xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], r13
lea ecx, [rdx + 6]
call fcn.140002540
mov qword [rbp - 0x39], rax
mov qword [rbp - 0x31], rax
lea rbx, [rax + 6]
mov qword [rbp - 0x29], rbx
mov r8d, 6
lea rdx, [rbp - 0x79]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x31], rbx
mov r9, qword [rbp - 0x49]
mov r8, qword [rbp - 0x51]
sub r9, r8
mov qword [rsp + 0x20], r13
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r9, qword [rbp - 0x31]
mov r8, qword [rbp - 0x39]
sub r9, r8
lea rax, [rbp - 0x21]
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, str.___Hooked_function_at:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001eb0
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
lea rdx, [0x140002080]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Roblox
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r14d, eax
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova rcx, qword [rbp - 0x19]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rbx, rax
test rax, rax
jne 0x140001af3
lea rdx, str.____Failed_to_load
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001eb0
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova rdx, qword [rbp - 0x19]
mov r8, qword [rbp - 9]
mov rcx, rax
call fcn.140002350
jmp 0x140001b48
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 0xf
cmova rdx, qword [rbp + 7]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001b18
lea rdx, str.____Invalid_DLL_or_callback_not_found.
jmp 0x140001b3c
mov r9d, r14d
mov r8, rbx
mov rdx, rax
mov ecx, 3
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
test rax, rax
jne 0x140001bc4
lea rdx, str.____Failed_to_set_Windows_hook.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001eb0
lea rdx, [0x140002080]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
lea rax, [rbp - 0x21]
mov r8, qword [rbp - 0x51]
mov r9, qword [rbp - 0x49]
mov qword [rsp + 0x20], rax
sub r9, r8
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, str.___Restored_function_at:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001eb0
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
lea rdx, [0x140002080]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0xffffffff
jmp 0x140001c31
lea rdx, str.___Windows_hook_set_successfully.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001eb0
lea rdx, [0x140002080]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, r14d
call qword [sym.imp.USER32.dll_PostThreadMessageA]
lea rdx, str.___Done.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001eb0
lea rdx, [0x140002080]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov ebx, r13d
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x140001c7a
mov rdx, qword [rbp - 0x29]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001c69
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002584
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], r13
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x140001cc3
mov rdx, qword [rbp - 0x41]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001cb2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001cb2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002584
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x51], xmm0
mov qword [rbp - 0x41], r13
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x140001d01
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001cfc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001cfc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002584
movdqa xmm0, xmmword [0x1400046d0]
movdqu xmmword [rbp + 0x17], xmm0
mov byte [rbp + 7], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x140001d50
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d4b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001d4b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002584
mov eax, ebx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140002520
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret