Function at 0x1400046c0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create thread
Execute command
Execute shellcode via indirect call
Inject thread
Query environment variable
Self delete
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1300]
mov eax, 0x1400
call fcn.1400bc030
sub rsp, rax
movaps xmmword [rsp + 0x13f0], xmm6
movaps xmmword [rsp + 0x13e0], xmm7
mov rax, qword [0x1401cad28]
xor rax, rsp
mov qword [rbp + 0x12d0], rax
cmp byte [0x1401cb660], 0
je 0x14000959a
mov qword [rbp - 0x80], 0
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
sub eax, edx
sar eax, 1
movd xmm7, eax
cvtdq2ps xmm7, xmm7
movss xmm0, dword [0x14012201c]
mulss xmm0, dword [0x1400bfe64]
subss xmm7, xmm0
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
sub eax, edx
sar eax, 1
movd xmm1, eax
cvtdq2ps xmm1, xmm1
movss xmm0, dword [0x140122018]
mulss xmm0, dword [0x1400bfe64]
subss xmm1, xmm0
movss dword [rbp - 0x78], xmm1
movss dword [rbp - 0x74], xmm7
lea r8, [rbp - 0x80]
mov r13d, 2
mov edx, r13d
lea rcx, [rbp - 0x78]
call fcn.14002efb0
movss xmm0, dword [0x140122018]
movss dword [rbp - 0x70], xmm0
movss xmm1, dword [0x14012201c]
movss dword [rbp - 0x6c], xmm1
xor edx, edx
lea rcx, [rbp - 0x70]
call fcn.14002f050
lea r8d, [r13 + 0x29]
lea rdx, [0x1401cb660]
mov rcx, qword [str.Jhon_Net___Emulator_Antiblacklist]
call fcn.14000e420
call fcn.140022d20
mov rbx, rax
lea rcx, [rbp + 0xb28]
call fcn.140022d50
lea rcx, [rbp + 0xb30]
call fcn.140022d70
call fcn.1400227f0
movaps xmm0, xmmword [0x1400c1870]
movups xmmword [rbp + 0x608], xmm0
lea rcx, [rbp + 0x608]
call fcn.140014640
movss xmm1, dword [rbp + 0xb2c]
addss xmm1, dword [0x1400c17e8]
movss xmm0, dword [rbp + 0xb30]
addss xmm0, dword [rbp + 0xb28]
movss dword [rbp - 0x68], xmm0
movss dword [rbp - 0x64], xmm1
mov dword [rsp + 0x28], 0xc0
movss xmm0, dword [0x1400bfe14]
movss dword [rsp + 0x20], xmm0
mov r9d, eax
lea r8, [rbp - 0x68]
lea rdx, [rbp + 0xb28]
mov rcx, rbx
call fcn.140038840
mov dword [rbp - 0x60], 0x41c80000
movss xmm1, dword [0x1400c1830]
movss dword [rbp - 0x5c], xmm1
lea rcx, [rbp - 0x60]
call fcn.14002ec70
xorps xmm0, xmm0
movups xmmword [rbp + 0x618], xmm0
movaps xmm1, xmmword [0x1400c18b0]
movups xmmword [rbp + 0x628], xmm1
movss xmm6, dword [0x1400bfdf4]
mov dword [rbp - 0x58], 0x3f800000
mov dword [rbp - 0x54], 0x3f800000
mov qword [rbp - 0x50], 0
mov dword [rbp - 0x48], 0x428c0000
mov dword [rbp - 0x44], 0x428c0000
lea rax, [rbp + 0x618]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x628]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x58]
lea r8, [rbp - 0x50]
lea rdx, [rbp - 0x48]
mov rcx, qword [0x1401cb9d0]
call fcn.14004f730
mov dword [rbp - 0x40], 0x43480000
movss xmm1, dword [0x1400c17d8]
movss dword [rbp - 0x3c], xmm1
lea rcx, [rbp - 0x40]
call fcn.14002ec70
call fcn.140012500
cmp dword [section..data], r13d
sete dl
lea rcx, str.Lite
call fcn.140002120
mov ecx, dword [section..data]
test al, al
cmovne ecx, r13d
mov dword [section..data], ecx
movss xmm7, dword [0x1400bfe20]
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.14002e350
cmp dword [section..data], 4
sete dl
lea rcx, str.Settings
call fcn.140002120
mov ecx, dword [section..data]
mov r12d, 4
test al, al
cmovne ecx, r12d
mov dword [section..data], ecx
call fcn.14001fa90
mov eax, dword [section..data]
test eax, eax
jne 0x140004d85
mov dword [rbp - 0x38], 0x41f00000
mov dword [rbp - 0x34], 0x42960000
lea rcx, [rbp - 0x38]
call fcn.14002ec70
mov dword [rbp - 0x30], 0x432f0000
mov dword [rbp - 0x2c], 0x43160000
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x30]
lea rcx, str.cuzinhu1
call fcn.140011100
mov dword [rbp - 0x28], 0x3f800000
mov dword [rbp - 0x24], 0x41200000
lea rcx, [rbp - 0x28]
call fcn.14002ec70
mov dword [rbp - 0x20], 0x40400000
mov dword [rbp - 0x1c], 0x40400000
lea rdx, [rbp - 0x20]
lea ecx, [r13 + 8]
call fcn.14002b030
mov dword [rbp - 0x18], 0x40a00000
mov dword [rbp - 0x14], 0x40a00000
lea rdx, [rbp - 0x18]
lea ecx, [r13 + 0xc]
call fcn.14002b030
lea rdx, [0x1401cb9e0]
lea rcx, str.Aimbot___Head1
call fcn.1400015d0
mov byte [0x1401cb2f0], al
lea ecx, [r13 - 1]
call fcn.14002a970
lea ecx, [r13 - 1]
call fcn.14002a970
movaps xmm0, xmm6
call fcn.14002ecf0
mov dword [rbp - 0x10], 0x40400000
mov dword [rbp - 0xc], 0x40400000
lea rdx, [rbp - 0x10]
lea ecx, [r13 + 8]
call fcn.14002b030
mov dword [rbp - 8], 0x40a00000
mov dword [rbp - 4], 0x40a00000
lea rdx, [rbp - 8]
lea ecx, [r13 + 0xc]
call fcn.14002b030
lea rdx, [0x1401cb9e1]
lea rcx, str.Aimbot___Neck1
call fcn.1400015d0
mov byte [0x1401cb2f1], al
lea ecx, [r13 - 1]
call fcn.14002a970
lea ecx, [r13 - 1]
call fcn.14002a970
movaps xmm0, xmm6
call fcn.14002ecf0
mov dword [rbp], 0x40400000
mov dword [rbp + 4], 0x40400000
lea rdx, [rbp]
lea ecx, [r13 + 8]
call fcn.14002b030
mov dword [rbp + 8], 0x40a00000
mov dword [rbp + 0xc], 0x40a00000
lea rdx, [rbp + 8]
lea ecx, [r13 + 0xc]
call fcn.14002b030
lea rdx, [0x1401cb9e2]
lea rcx, str.Aimbot___Scope1
call fcn.1400015d0
mov byte [0x1401cb2f2], al
lea ecx, [r13 - 1]
call fcn.14002a970
lea ecx, [r13 - 1]
call fcn.14002a970
movaps xmm0, xmm6
call fcn.14002ecf0
mov dword [rbp + 0x10], 0x40400000
mov dword [rbp + 0x14], 0x40400000
lea rdx, [rbp + 0x10]
lea ecx, [r13 + 8]
call fcn.14002b030
mov dword [rsp + 0x60], 0x40a00000
mov dword [rsp + 0x64], 0x40a00000
lea rdx, [rsp + 0x60]
lea ecx, [r13 + 0xc]
call fcn.14002b030
lea rdx, [0x1401cb9e3]
lea rcx, str.Aimbot___Sniper1
call fcn.1400015d0
mov byte [0x1401cb2f3], al
lea ecx, [r13 - 1]
call fcn.14002a970
lea ecx, [r13 - 1]
call fcn.14002a970
call fcn.14001ed30
mov dword [rbp + 0x20], 0x41f00000
mov dword [rbp + 0x24], 0x43610000
lea rcx, [rbp + 0x20]
call fcn.14002ec70
mov dword [rbp + 0x28], 0x43480000
mov dword [rbp + 0x2c], 0x43160000
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x28]
lea rcx, str.cuzinhu2
call fcn.140011100
mov dword [rbp + 0x30], 0x3f800000
mov dword [rbp + 0x34], 0x41200000
lea rcx, [rbp + 0x30]
call fcn.14002ec70
mov dword [rbp + 0x38], 0x40400000
mov dword [rbp + 0x3c], 0x40400000
lea rdx, [rbp + 0x38]
lea ecx, [r13 + 8]
call fcn.14002b030
mov dword [rbp + 0x40], 0x40a00000
mov dword [rbp + 0x44], 0x40a00000
lea rdx, [rbp + 0x40]
lea ecx, [r13 + 0xc]
call fcn.14002b030
lea rdx, [0x1401cb9e4]
lea rcx, str.Bypass___Emulator1
call fcn.1400015d0
mov byte [0x1401cb2f4], al
lea ecx, [r13 - 1]
call fcn.14002a970
lea ecx, [r13 - 1]
call fcn.14002a970
movaps xmm0, xmm6
call fcn.14002ecf0
mov dword [rbp + 0x48], 0x40400000
mov dword [rbp + 0x4c], 0x40400000
lea rdx, [rbp + 0x48]
lea ecx, [r13 + 8]
call fcn.14002b030
mov dword [rbp + 0x50], 0x40a00000
mov dword [rbp + 0x54], 0x40a00000
lea rdx, [rbp + 0x50]
lea ecx, [r13 + 0xc]
call fcn.14002b030
lea rdx, [0x1401cb9e5]
lea rcx, str.Magic____Bullets1
call fcn.1400015d0
mov byte [0x1401cb2f5], al
lea ecx, [r13 - 1]
call fcn.14002a970
lea ecx, [r13 - 1]
call fcn.14002a970
movaps xmm0, xmm6
call fcn.14002ecf0
mov dword [rbp + 0x58], 0x40400000
mov dword [rbp + 0x5c], 0x40400000
lea rdx, [rbp + 0x58]
lea ecx, [r13 + 8]
call fcn.14002b030
mov dword [rbp + 0x60], 0x40a00000
mov dword [rbp + 0x64], 0x40a00000
lea rdx, [rbp + 0x60]
lea ecx, [r13 + 0xc]
call fcn.14002b030
lea rdx, [0x1401cb9e7]
lea rcx, str.Aimfov___Full1
call fcn.1400015d0
mov byte [0x1401cb2f7], al
lea ecx, [r13 - 1]
call fcn.14002a970
lea ecx, [r13 - 1]
call fcn.14002a970
movaps xmm0, xmm6
call fcn.14002ecf0
mov dword [rbp + 0x68], 0x40400000
mov dword [rbp + 0x6c], 0x40400000
lea rdx, [rbp + 0x68]
lea ecx, [r13 + 8]
call fcn.14002b030
mov dword [rbp + 0x70], 0x40a00000
mov dword [rbp + 0x74], 0x40a00000
lea rdx, [rbp + 0x70]
lea ecx, [r13 + 0xc]
call fcn.14002b030
lea rdx, [0x1401cb9e6]
lea rcx, str.Aimfov___Legit1
call fcn.1400015d0
mov byte [0x1401cb2f6], al
lea ecx, [r13 - 1]
call fcn.14002a970
lea ecx, [r13 - 1]
call fcn.14002a970
call fcn.14001ed30
mov eax, dword [section..data]
cmp eax, 1
jne 0x1400050d1
mov dword [rbp + 0x78], 0x41f00000
mov dword [rbp + 0x7c], 0x42960000
lea rcx, [rbp + 0x78]
call fcn.14002ec70
mov dword [rbp + 0x80], 0x432f0000
mov dword [rbp + 0x84], 0x43160000
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x80]
lea rcx, str.cuzinhu3
call fcn.140011100
mov dword [rbp + 0x88], 0x3f800000
mov dword [rbp + 0x8c], 0x41200000
lea rcx, [rbp + 0x88]
call fcn.14002ec70
mov dword [rbp + 0x90], 0x40400000
mov dword [rbp + 0x94], 0x40400000
lea rdx, [rbp + 0x90]
mov ecx, 0xa
call fcn.14002b030
mov dword [rbp + 0x98], 0x40a00000
mov dword [rbp + 0x9c], 0x40a00000
lea rdx, [rbp + 0x98]
mov ecx, reloc.WS2_32.dll_ntohl
call fcn.14002b030
lea rdx, [0x1401cb9e8]
lea rcx, str.No_Recoil
call fcn.1400015d0
mov byte [0x1401cb2f8], al
mov ecx, 1
call fcn.14002a970
mov ecx, 1
call fcn.14002a970
movaps xmm0, xmm6
call fcn.14002ecf0
mov dword [rbp + 0xa0], 0x40400000
mov dword [rbp + 0xa4], 0x40400000
lea rdx, [rbp + 0xa0]
mov ecx, 0xa
call fcn.14002b030
mov dword [rbp + 0xa8], 0x40a00000
mov dword [rbp + 0xac], 0x40a00000
lea rdx, [rbp + 0xa8]
mov ecx, reloc.WS2_32.dll_ntohl
call fcn.14002b030
lea rdx, [0x1401cb9e9]
lea rcx, str.Fast_Fire
call fcn.1400015d0
mov byte [0x1401cb2f9], al
mov ecx, 1
call fcn.14002a970
mov ecx, 1
call fcn.14002a970
movaps xmm0, xmm6
call fcn.14002ecf0
mov dword [rbp + 0xb0], 0x40400000
mov dword [rbp + 0xb4], 0x40400000
lea rdx, [rbp + 0xb0]
mov ecx, 0xa
call fcn.14002b030
mov dword [rbp + 0xb8], 0x40a00000
mov dword [rbp + 0xbc], 0x40a00000
lea rdx, [rbp + 0xb8]
mov ecx, reloc.WS2_32.dll_ntohl
call fcn.14002b030
lea rdx, [0x1401cb9ea]
lea rcx, str.Aimlock
call fcn.1400015d0
mov byte [0x1401cb2fa], al
mov ecx, 1
call fcn.14002a970
mov ecx, 1
call fcn.14002a970
movaps xmm0, xmm6
call fcn.14002ecf0
mov dword [rbp + 0xc0], 0x40400000
mov dword [rbp + 0xc4], 0x40400000
lea rdx, [rbp + 0xc0]
mov ecx, 0xa
call fcn.14002b030
mov dword [rbp + 0xc8], 0x40a00000
mov dword [rbp + 0xcc], 0x40a00000
lea rdx, [rbp + 0xc8]
mov ecx, reloc.WS2_32.dll_ntohl
call fcn.14002b030
lea rdx, [0x1401cb9eb]
lea rcx, str.GloWall_Skin
call fcn.1400015d0
mov byte [0x1401cb2fb], al
mov ecx, 1
call fcn.14002a970
mov ecx, 1
call fcn.14002a970
call fcn.14001ed30
mov dword [rbp + 0x18], 0x41f00000
mov dword [rbp + 0x1c], 0x43610000
lea rcx, [rbp + 0x18]
call fcn.14002ec70
mov dword [rbp + 0xd0], 0x43480000
mov dword [rbp + 0xd4], 0x43160000
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0xd0]
lea rcx, str.cuzinhu4
call fcn.140011100
mov dword [rbp + 0xd8], 0x3f800000
mov dword [rbp + 0xdc], 0x41200000
lea rcx, [rbp + 0xd8]
call fcn.14002ec70
mov dword [rbp + 0xe0], 0x40400000
mov dword [rbp + 0xe4], 0x40400000
lea rdx, [rbp + 0xe0]
mov ecx, 0xa
call fcn.14002b030
mov dword [rbp + 0xe8], 0x40a00000
mov dword [rbp + 0xec], 0x40a00000
lea rdx, [rbp + 0xe8]
mov ecx, reloc.WS2_32.dll_ntohl
call fcn.14002b030
lea rdx, [0x1401cb9ec]
lea rcx, str.Lock_Head
call fcn.1400015d0
mov byte [0x1401cb2fc], al
mov ecx, 1
call fcn.14002a970
mov ecx, 1
call fcn.14002a970
call fcn.14001ed30
mov eax, dword [section..data]
cmp eax, r13d
jne 0x140005855
movss xmm0, dword [0x1400c181c]
movss dword [rbp + 0xf0], xmm0
mov dword [rbp + 0xf4], 0x42960000
lea rcx, [rbp + 0xf0]
call fcn.14002ec70
mov dword [rbp + 0xf8], 0x432f0000
mov dword [rbp + 0xfc], 0x43160000
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0xf8]
lea rcx, str.cuzinhu4
call fcn.140011100
mov dword [rbp + 0x100], 0x3f800000
mov dword [rbp + 0x104], 0x41200000
lea rcx, [rbp + 0x100]
call fcn.14002ec70
mov dword [rbp + 0x108], 0x40400000
mov dword [rbp + 0x10c], 0x40400000
lea rdx, [rbp + 0x108]
mov ecx, 0xa
call fcn.14002b030
mov dword [rbp + 0x110], 0x40a00000
mov dword [rbp + 0x114], 0x40a00000
lea rdx, [rbp + 0x110]
mov ecx, reloc.WS2_32.dll_ntohl
call fcn.14002b030
lea rdx, [0x1401cb9ed]
lea rcx, str.Bala_Magica
call fcn.1400015d0
mov byte [0x1401cb2fd], al
mov ecx, 1
call fcn.14002a970
mov ecx, 1
call fcn.14002a970
movaps xmm0, xmm6
call fcn.14002ecf0
mov dword [rbp + 0x118], 0x40400000
mov dword [rbp + 0x11c], 0x40400000
lea rdx, [rbp + 0x118]
mov ecx, 0xa
call fcn.14002b030
mov dword [rbp + 0x120], 0x40a00000
mov dword [rbp + 0x124], 0x40a00000
lea rdx, [rbp + 0x120]
mov ecx, reloc.WS2_32.dll_ntohl
call fcn.14002b030
lea rdx, [0x1401cba01]
lea rcx, str.Aimbot_Neck
call fcn.1400015d0
mov byte [0x1401cb312], al
mov ecx, 1
call fcn.14002a970
mov ecx, 1
call fcn.14002a970
movaps xmm0, xmm6
call fcn.14002ecf0
mov dword [rbp + 0x128], 0x40400000
mov dword [rbp + 0x12c], 0x40400000
lea rdx, [rbp + 0x128]
mov ecx, 0xa
call fcn.14002b030
mov dword [rbp + 0x130], 0x40a00000
mov dword [rbp + 0x134], 0x40a00000
lea rdx, [rbp + 0x130]
mov ecx, reloc.WS2_32.dll_ntohl
call fcn.14002b030
lea rdx, [0x1401cb9ef]
lea rcx, str.AimFoV_360
call fcn.1400015d0
mov byte [0x1401cb2ff], al
mov ecx, 1
call fcn.14002a970
mov ecx, 1
call fcn.14002a970
movaps xmm0, xmm6
call fcn.14002ecf0
mov dword [rbp + 0x138], 0x40400000
mov dword [rbp + 0x13c], 0x40400000
lea rdx, [rbp + 0x138]
mov ecx, 0xa
call fcn.14002b030
mov dword [rbp + 0x140], 0x40a00000
mov dword [rbp + 0x144], 0x40a00000
lea rdx, [rbp + 0x140]
mov ecx, reloc.WS2_32.dll_ntohl
call fcn.14002b030
lea rdx, [0x1401cba04]
lea rcx, str.AimLock
call fcn.1400015d0
mov byte [0x1401cb310], al
mov ecx, 1
call fcn.14002a970
mov ecx, 1
call fcn.14002a970
call fcn.14001ed30
mov dword [rbp + 0x148], 0x41f00000
mov dword [rbp + 0x14c], 0x43610000
lea rcx, [rbp + 0x148]
call fcn.14002ec70
mov dword [rbp + 0x150], 0x43480000
mov dword [rbp + 0x154], 0x43160000
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x150]
lea rcx, str.cuzinhu5
call fcn.140011100
mov dword [rbp + 0x158], 0x3f800000
mov dword [rbp + 0x15c], 0x41200000
lea rcx, [rbp + 0x158]
call fcn.14002ec70
mov dword [rbp + 0x160], 0x40400000
mov dword [rbp + 0x164], 0x40400000
lea rdx, [rbp + 0x160]
mov ecx, 0xa
call fcn.14002b030
mov dword [rbp + 0x168], 0x40a00000
mov dword [rbp + 0x16c], 0x40a00000
lea rdx, [rbp + 0x168]
mov ecx, reloc.WS2_32.dll_ntohl
call fcn.14002b030
lea rdx, [0x1401cb9f2]
lea rcx, str.No_Recoil
call fcn.1400015d0
mov byte [0x1401cb302], al
mov ecx, 1
call fcn.14002a970
mov ecx, 1
call fcn.14002a970
movaps xmm0, xmm6
call fcn.14002ecf0
mov dword [rbp + 0x170], 0x40400000
mov dword [rbp + 0x174], 0x40400000
lea rdx, [rbp + 0x170]
mov ecx, 0xa
call fcn.14002b030
mov dword [rbp + 0x178], 0x40a00000
mov dword [rbp + 0x17c], 0x40a00000
lea rdx, [rbp + 0x178]
mov ecx, reloc.WS2_32.dll_ntohl
call fcn.14002b030
lea rdx, [0x1401cb9f3]
lea rcx, str.Modo_Noite
call fcn.1400015d0
mov byte [0x1401cb303], al
mov ecx, 1
call fcn.14002a970
mov ecx, 1
call fcn.14002a970
movaps xmm0, xmm6
call fcn.14002ecf0
mov dword [rbp + 0x180], 0x40400000
mov dword [rbp + 0x184], 0x40400000
lea rdx, [rbp + 0x180]
mov ecx, 0xa
call fcn.14002b030
mov dword [rbp + 0x188], 0x40a00000
mov dword [rbp + 0x18c], 0x40a00000
lea rdx, [rbp + 0x188]
mov ecx, reloc.WS2_32.dll_ntohl
call fcn.14002b030
lea rdx, [0x1401cb9f4]
lea rcx, str.Aimbot_Mira
call fcn.1400015d0
mov byte [0x1401cb304], al
mov ecx, 1
call fcn.14002a970
mov ecx, 1
call fcn.14002a970
call fcn.14001ed30
mov dword [rbp + 0x190], 0x41f00000
mov dword [rbp + 0x194], 0x42960000
lea rcx, [rbp + 0x190]
call fcn.14002ec70
mov dword [rbp + 0x198], 0x43480000
mov dword [rbp + 0x19c], 0x43160000
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x198]
lea rcx, str.cuzinhu6
call fcn.140011100
mov dword [rbp + 0x1a0], 0x3f800000
mov dword [rbp + 0x1a4], 0x41200000
lea rcx, [rbp + 0x1a0]
call fcn.14002ec70
mov dword [rbp + 0x1a8], 0x40400000
mov dword [rbp + 0x1ac], 0x40400000
lea rdx, [rbp + 0x1a8]
mov ecx, 0xa
call fcn.14002b030
mov dword [rbp + 0x1b0], 0x40a00000
mov dword [rbp + 0x1b4], 0x40a00000
lea rdx, [rbp + 0x1b0]
mov ecx, reloc.WS2_32.dll_ntohl
call fcn.14002b030
lea rdx, [0x1401cb9f5]
lea rcx, str.Antena_M___Hand
call fcn.1400015d0
mov byte [0x1401cb305], al
mov ecx, 1
call fcn.14002a970
mov ecx, 1
call fcn.14002a970
movaps xmm0, xmm6
call fcn.14002ecf0
mov dword [rbp + 0x1b8], 0x40400000
mov dword [rbp + 0x1bc], 0x40400000
lea rdx, [rbp + 0x1b8]
mov ecx, 0xa
call fcn.14002b030
mov dword [rbp + 0x1c0], 0x40a00000
mov dword [rbp + 0x1c4], 0x40a00000
lea rdx, [rbp + 0x1c0]
mov ecx, reloc.WS2_32.dll_ntohl
call fcn.14002b030
lea rdx, [0x1401cb9f7]
lea rcx, str.Antena_F___Hand
call fcn.1400015d0
mov byte [0x1401cb307], al
mov ecx, 1
call fcn.14002a970
mov ecx, 1
call fcn.14002a970
movaps xmm0, xmm6
call fcn.14002ecf0
mov dword [rbp + 0x1c8], 0x40400000
mov dword [rbp + 0x1cc], 0x40400000
lea rdx, [rbp + 0x1c8]
mov ecx, 0xa
call fcn.14002b030
mov dword [rbp + 0x1d0], 0x40a00000
mov dword [rbp + 0x1d4], 0x40a00000
lea rdx, [rbp + 0x1d0]
mov ecx, reloc.WS2_32.dll_ntohl
call fcn.14002b030
lea rdx, [0x1401cb9f8]
lea rcx, str.Suspend_and_Resume
call fcn.1400015d0
test al, al
je 0x140005836
lea rcx, [rsp + 0x50]
cmp byte [0x1401cb9f8], 0
je 0x140005784
call fcn.140009ad0
test rax, rax
je 0x140005836
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140009ba0
mov ebx, eax
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1400057b9
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_DebugActiveProcess]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test eax, eax
je 0x14000575f
lea rdx, str.Processo_suspenso.
jmp 0x140005818
lea rdx, str.Falha_ao_suspender_o_processo._C
call fcn.1400028f0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
jmp 0x14000581d
call fcn.140009ad0
test rax, rax
je 0x140005836
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140009ba0
mov ebx, eax
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x1400057f2
lea rdx, str.Falha_ao_abrir_o_processo._C
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400028f0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140003030]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140005836
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test eax, eax
jne 0x140005811
lea rdx, str.Falha_ao_retomar_o_processo._C
jmp 0x140005766
lea rdx, str.Processo_retomado.
call fcn.1400028f0
lea rdx, [0x140003030]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 1
call fcn.14002a970
mov ecx, 1
call fcn.14002a970
call fcn.14001ed30
mov eax, dword [section..data]
cmp eax, 3
jne 0x140005d28
mov dword [rbp + 0x1d8], 0x41f00000
mov dword [rbp + 0x1dc], 0x42960000
lea rcx, [rbp + 0x1d8]
call fcn.14002ec70
mov dword [rbp + 0x1e0], 0x432f0000
mov dword [rbp + 0x1e4], 0x43160000
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x1e0]
lea rcx, str.cuzinhu8
call fcn.140011100
mov dword [rbp + 0x1e8], 0x3f800000
mov dword [rbp + 0x1ec], 0x41200000
lea rcx, [rbp + 0x1e8]
call fcn.14002ec70
mov dword [rbp + 0x1f0], 0x40400000
mov dword [rbp + 0x1f4], 0x40400000
lea rdx, [rbp + 0x1f0]
mov ecx, 0xa
call fcn.14002b030
mov dword [rbp + 0x1f8], 0x40a00000
mov dword [rbp + 0x1fc], 0x40a00000
lea rdx, [rbp + 0x1f8]
mov ecx, reloc.WS2_32.dll_ntohl
call fcn.14002b030
lea rdx, [0x1401cb9fa]
lea rcx, str.Aimbot
call fcn.1400015d0
mov byte [0x1401cb309], al
mov ecx, 1
call fcn.14002a970
mov ecx, 1
call fcn.14002a970
movaps xmm0, xmm6
call fcn.14002ecf0
mov dword [rbp + 0x200], 0x40400000
mov dword [rbp + 0x204], 0x40400000
lea rdx, [rbp + 0x200]
mov ecx, 0xa
call fcn.14002b030
mov dword [rbp + 0x208], 0x40a00000
mov dword [rbp + 0x20c], 0x40a00000
lea rdx, [rbp + 0x208]
mov ecx, reloc.WS2_32.dll_ntohl
call fcn.14002b030
lea rdx, [0x1401cb9fb]
lea rcx, str.Fly_Underground
call fcn.1400015d0
mov byte [0x1401cb30a], al
mov ecx, 1
call fcn.14002a970
mov ecx, 1
call fcn.14002a970
movaps xmm0, xmm6
call fcn.14002ecf0
mov dword [rbp + 0x210], 0x40400000
mov dword [rbp + 0x214], 0x40400000
lea rdx, [rbp + 0x210]
mov ecx, 0xa
call fcn.14002b030
mov dword [rbp + 0x218], 0x40a00000
mov dword [rbp + 0x21c], 0x40a00000
lea rdx, [rbp + 0x218]
mov ecx, reloc.WS2_32.dll_ntohl
call fcn.14002b030
lea rdx, [0x1401cb9fc]
lea rcx, str.Car_Speed
call fcn.1400015d0
mov byte [0x1401cb30b], al
mov ecx, 1
call fcn.14002a970
mov ecx, 1
call fcn.14002a970
movaps xmm0, xmm6
call fcn.14002ecf0
mov dword [rbp + 0x220], 0x40400000
mov dword [rbp + 0x224], 0x40400000
lea rdx, [rbp + 0x220]
mov ecx, 0xa
call fcn.14002b030
mov dword [rbp + 0x228], 0x40a00000
mov dword [rbp + 0x22c], 0x40a00000
lea rdx, [rbp + 0x228]
mov ecx, reloc.WS2_32.dll_ntohl
call fcn.14002b030
lea rdx, [0x1401cb9fd]
lea rcx, str.Alok_Fix
call fcn.1400015d0
mov byte [0x1401cb30c], al
mov ecx, 1
call fcn.14002a970
mov ecx, 1
call fcn.14002a970
call fcn.14001ed30
mov dword [rbp + 0x230], 0x41f00000
mov dword [rbp + 0x234], 0x43610000
lea rcx, [rbp + 0x230]
call fcn.14002ec70
mov dword [rbp + 0x238], 0x43480000
mov dword [rbp + 0x23c], 0x43160000
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x238]
lea rcx, str.cuzinhu9
call fcn.140011100
mov dword [rbp + 0x240], 0x3f800000
mov dword [rbp + 0x244], 0x41200000
lea rcx, [rbp + 0x240]
call fcn.14002ec70
mov dword [rbp + 0x248], 0x40400000
mov dword [rbp + 0x24c], 0x40400000
lea rdx, [rbp + 0x248]
mov ecx, 0xa
call fcn.14002b030
mov dword [rbp + 0x250], 0x40a00000
mov dword [rbp + 0x254], 0x40a00000
lea rdx, [rbp + 0x250]
mov ecx, reloc.WS2_32.dll_ntohl
call fcn.14002b030
lea rdx, [0x1401cb9fe]
lea rcx, str.Running_Medkit
call fcn.1400015d0
mov byte [0x1401cb30d], al
mov ecx, 1
call fcn.14002a970
mov ecx, 1
call fcn.14002a970
movaps xmm0, xmm6
call fcn.14002ecf0
mov dword [rbp + 0x258], 0x40400000
mov dword [rbp + 0x25c], 0x40400000
lea rdx, [rbp + 0x258]
mov ecx, 0xa
call fcn.14002b030
mov dword [rbp + 0x260], 0x40a00000
mov dword [rbp + 0x264], 0x40a00000
lea rdx, [rbp + 0x260]
mov ecx, reloc.WS2_32.dll_ntohl
call fcn.14002b030
lea rdx, [0x1401cb9ff]
lea rcx, str.Fast_Medkit
call fcn.1400015d0
mov byte [0x1401cb30e], al
mov ecx, 1
call fcn.14002a970
mov ecx, 1
call fcn.14002a970
movaps xmm0, xmm6
call fcn.14002ecf0
mov dword [rbp + 0x268], 0x40400000
mov dword [rbp + 0x26c], 0x40400000
lea rdx, [rbp + 0x268]
mov ecx, 0xa
call fcn.14002b030
mov dword [rbp + 0x270], 0x40a00000
mov dword [rbp + 0x274], 0x40a00000
lea rdx, [rbp + 0x270]
mov ecx, reloc.WS2_32.dll_ntohl
call fcn.14002b030
lea rdx, [0x1401cba00]
lea rcx, str.Climb_Wall
call fcn.1400015d0
mov byte [0x1401cb30f], al
mov ecx, 1
call fcn.14002a970
mov ecx, 1
call fcn.14002a970
mov dword [rbp + 0x278], 0x40400000
mov dword [rbp + 0x27c], 0x40400000
lea rdx, [rbp + 0x278]
mov ecx, 0xa
call fcn.14002b030
mov dword [rbp + 0x280], 0x40a00000
mov dword [rbp + 0x284], 0x40a00000
lea rdx, [rbp + 0x280]
mov ecx, reloc.WS2_32.dll_ntohl
call fcn.14002b030
lea rdx, [0x1401cba01]
lea rcx, str.Ze_PeDraO
call fcn.1400015d0
mov byte [0x1401cb312], al
mov ecx, 1
call fcn.14002a970
mov ecx, 1
call fcn.14002a970
call fcn.14001ed30
mov eax, dword [section..data]
xor r15d, r15d
cmp eax, r12d
jne 0x140006639
mov dword [rbp + 0x288], 0x41f00000
mov dword [rbp + 0x28c], 0x42960000
lea rcx, [rbp + 0x288]
call fcn.14002ec70
mov dword [rbp + 0x290], 0x43610000
mov dword [rbp + 0x294], 0x43160000
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x290]
lea rcx, str.cuzinhu112
call fcn.140011100
mov dword [rbp + 0x298], 0x3f800000
mov dword [rbp + 0x29c], 0x41200000
lea rcx, [rbp + 0x298]
call fcn.14002ec70
mov dword [rbp + 0x2a0], 0x40400000
mov dword [rbp + 0x2a4], 0x40400000
lea rdx, [rbp + 0x2a0]
lea ecx, [r15 + 0xa]
call fcn.14002b030
mov dword [rsp + 0x68], 0x40a00000
mov dword [rsp + 0x6c], 0x40a00000
lea rdx, [rsp + 0x68]
lea ecx, [r15 + 0xe]
call fcn.14002b030
lea rdx, [0x1401cba02]
lea rcx, str.Stream_Mode
call fcn.1400015d0
lea ecx, [r15 + 1]
call fcn.14002a970
lea ecx, [r15 + 1]
call fcn.14002a970
mov dword [rsp + 0x70], 0x42f00000
movss xmm0, dword [0x1400c17dc]
movss dword [rsp + 0x74], xmm0
lea rdx, [rsp + 0x70]
lea rcx, str.Destruct
call fcn.14004e130
test al, al
je 0x14000659a
lea rcx, str.del__s__f__q__temp_.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__S__Q_C:WINDOWSPrefetch
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RD__S__Q_C:WINDOWSPrefetch
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__f__q_C:Users_username_AppDataLocalCrashDumps_.dmp
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.deltree__y_c:windows_tempor1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.deltree__y_c:windows_temp
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.deltree__y_c:windows_tmp
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.deltree__y_c:windows_ff.tmp
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.deltree__y_c:windowshistory
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.deltree__y_c:windowscookies
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_Dusmsvc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_pcasvc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_dps
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_sysmain
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_bam
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:Users_username_AppDataRoamingMicrosoftWindowsRecentAutomaticDestinations
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rd__s__q_C:Users_username_AppDataRoamingMicrosoftWindowsRecentAutomaticDestinations
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:Users_username_AppDataRoamingMicrosoftWindowsRecentCustomDestinations
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rd__s__q_C:Users_username_AppDataRoamingMicrosoftWindowsRecentCustomDestinations
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_start_pcasvc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_start_dps
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_start_sysmain
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_start_bam
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.fsutil_usn_deletejournal__n_c:
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.fsutil_usn_deletejournal__n_d:
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.fsutil_usn_deletejournal__n_e:
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.fsutil_usn_deletejournal__n_f:
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.fsutil_usn_deletejournal__d_c:
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.fsutil_usn_createJournal_m__2147483648_a__1_C:
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.fsutil_usn_createJournal_m__2147483648_a__1_D:
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.fsutil_usn_createJournal_m__2147483648_a__1_E:
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.fsutil_usn_createJournal_m__2147483648_a__1_F:
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:WindowsSystem32RenamedFiles.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:WindowsSystem32DeletedFiles.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSoftwareGuna___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedPidlMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSaveMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFileExts___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREWinRARArcHistory___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageAppSwitched___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerRecentDocs___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedPidlMRULegacy___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32FirstFolder___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32CIDSizeMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerRunMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsShellBagMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsShellBags___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellBags___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellBagMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession_ManagerAppCompatCache___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001ControlSession_ManagerAppCompatCache___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageAppSwitched___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageShowJumpView___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftDirectInput___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerTypedPaths___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionAppletsRegedit___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_LOCAL_MACHINESYSTEMMountedDevices___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001Services_bamStateUserSettings___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xcb0], xmm0
movups xmmword [rbp + 0xcc0], xmm0
movups xmmword [rbp + 0xcd0], xmm0
movups xmmword [rbp + 0xce0], xmm0
movups xmmword [rbp + 0xcf0], xmm0
movups xmmword [rbp + 0xd00], xmm0
mov qword [rbp + 0xd10], rax
movups xmmword [rbp + 0xb38], xmm0
mov qword [rbp + 0xb48], rax
mov r8d, 0x104
lea rdx, [rbp + 0xfb0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r9, [rbp + 0xfb0]
lea r8, str.cmd.exe__C_ping_1.1.1.1__n_1__w_3000___Nul__Del__f__q___s_
mov edx, 0x208
lea rcx, [rbp + 0x10c0]
call fcn.14000a920
lea rax, [rbp + 0xb38]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xcb0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x10c0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rbp + 0xb40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xb38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0xd20], WSAGetLastError
xorps xmm0, xmm0
movups xmmword [rbp + 0xd28], xmm0
movups xmmword [rbp + 0xd38], xmm0
movups xmmword [rbp + 0xd48], xmm0
movups xmmword [rbp + 0xd58], xmm0
movups xmmword [rbp + 0xd68], xmm0
movups xmmword [rbp + 0xd78], xmm0
lea rax, [rbp + 0xb50]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xd20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x8000044
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.explorer.exe
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400064e3
mov rcx, qword [rbp + 0xb58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rbp + 0xb50]
test rsi, rsi
je 0x1400064e3
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x1b0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
test rax, rax
jne 0x1400063b8
mov rcx, rsi
jmp 0x1400064dd
lea rdi, [rax + 0x80]
lea rcx, [0x1400c01c8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
lea rdx, str.WaitForSingleObject
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xb70], rax
lea rdx, [0x1400c01f0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xb78], rax
lea rdx, str.ExitProcess
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xb88], rax
lea rdx, str.DeleteFileA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xb80], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
lea r9, [rbp + 0xb90]
mov r8, rsi
mov rdx, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov r8d, 0x104
lea rdx, [rbp + 0xb98]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov qword [rsp + 0x20], r15
mov r9d, 0x80
lea r8, [0x14000a790]
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r15
mov r9d, pe_nt_image_headers64
lea r8, [rbp + 0xb70]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rbp + 0xca0], r15d
lea rax, [rbp + 0xca0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rdi
mov r9, r14
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x1400064e3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 0x104
lea rdx, [rbp + 0xd90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14000659a
mov r8d, 0x104
lea rdx, [rbp + 0xd90]
lea rcx, [rbp + 0xd90]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x14000659a
lea rdx, str._c_del
lea rcx, [rbp + 0xea0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [rbp + 0xd90]
lea rcx, [rbp + 0xea0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.____NUL
lea rcx, [rbp + 0xea0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov r8d, 0x104
lea rdx, [rbp + 0xd90]
lea rcx, str.ComSpec
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x14000659a
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0xea0]
lea r8, [rbp + 0xd90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movaps xmm0, xmm6
call fcn.14002ecf0
lea rcx, str.Hide_Process_Key:
call fcn.140057db0
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.14002e350
movss xmm0, dword [0x1400c17f8]
call fcn.14002ecf0
movaps xmm2, xmmword [0x1400c18a0]
movups xmmword [rbp + 0x638], xmm2
lea rdx, str.INSERT
lea rcx, [rbp + 0x638]
call fcn.140057de0
movaps xmm0, xmm6
call fcn.14002ecf0
lea rcx, str.Close_Process:
call fcn.140057db0
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.14002e350
movss xmm0, dword [0x1400c17f4]
call fcn.14002ecf0
movaps xmm0, xmmword [0x1400c18a0]
movups xmmword [rbp + 0x648], xmm0
lea rdx, [0x1400c16a8]
lea rcx, [rbp + 0x648]
call fcn.140057de0
call fcn.14001ed30
movabs rsi, 0x140737488355327
cmp byte [0x1401cb2f0], r15b
je 0x14000686b
mov ecx, reloc.WS2_32.dll_recvfrom
cmp byte [0x1401cb9e0], r15b
je 0x140006769
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140006690
mov dword [rax], 0x6f0062
mov dword [rax + 4], 0x65006e
mov dword [rax + 8], 0x48005f
mov dword [rax + 0xc], 0x610065
mov byte [rax + 0x10], 0x64
jmp 0x140006693
mov rdi, r15
mov ecx, reloc.WS2_32.dll_gethostname
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x14000670c
mov dword [rax], 0x6f0062
mov dword [rax + 4], 0x65006e
mov dword [rax + 8], 0x48005f
mov dword [rax + 0xc], 0x700069
mov dword [rax + 0x10], 0x3f3f3f73
mov dword [rax + 0x14], 0x3f3f3f3f
mov dword [rax + 0x18], 0x3f3f3f3f
mov dword [rax + 0x1c], 0x3f3f3f3f
mov dword [rax + 0x20], 0x3f3f3f3f
mov dword [rax + 0x24], 9
mov dword [rax + 0x28], 0x6f0062
mov dword [rax + 0x2c], 0x65006e
mov dword [rax + 0x30], 0x48005f
mov dword [rax + 0x34], 0x610065
mov byte [rax + 0x38], 0x64
jmp 0x14000670f
mov rbx, r15
mov qword [rbp + 0x3c8], r15
mov qword [rbp + 0x3d8], r15
mov qword [rbp + 0x3e0], reloc.WS2_32.dll_ntohs
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Aimbot___Head
lea rcx, [rbp + 0x3c8]
call fcn.14000aa40
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
lea rdx, [rbp + 0x3c8]
lea rcx, [0x1401cb318]
call fcn.14000a0b0
jmp 0x14000686b
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140006797
mov dword [rax], 0x6f0062
mov dword [rax + 4], 0x65006e
mov dword [rax + 8], 0x48005f
mov dword [rax + 0xc], 0x700069
mov byte [rax + 0x10], reloc.WS2_32.dll_WSAStartup
jmp 0x14000679a
mov rdi, r15
mov ecx, reloc.WS2_32.dll_gethostname
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140006813
mov dword [rax], 0x6f0062
mov dword [rax + 4], 0x65006e
mov dword [rax + 8], 0x48005f
mov dword [rax + 0xc], 0x610065
mov dword [rax + 0x10], 0x3f3f3f64
mov dword [rax + 0x14], 0x3f3f3f3f
mov dword [rax + 0x18], 0x3f3f3f3f
mov dword [rax + 0x1c], 0x3f3f3f3f
mov dword [rax + 0x20], 0x3f3f3f3f
mov dword [rax + 0x24], 9
mov dword [rax + 0x28], 0x6f0062
mov dword [rax + 0x2c], 0x65006e
mov dword [rax + 0x30], 0x48005f
mov dword [rax + 0x34], 0x610065
mov byte [rax + 0x38], 0x64
jmp 0x140006816
mov rbx, r15
mov qword [rbp + 0x3e8], r15
mov qword [rbp + 0x3f8], r15
mov qword [rbp + 0x400], reloc.WS2_32.dll_ntohs
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Aimbot___Head
lea rcx, [rbp + 0x3e8]
call fcn.14000aa40
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
lea rdx, [rbp + 0x3e8]
lea rcx, [0x1401cb318]
call fcn.14000abb0
cmp byte [0x1401cb2f1], 0
je 0x140006a93
mov ecx, reloc.WS2_32.dll_recvfrom
cmp byte [0x1401cb9e1], 0
je 0x140006991
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x1400068b8
mov dword [rax], 0x6f0062
mov dword [rax + 4], 0x65006e
mov dword [rax + 8], 0x4e005f
mov dword [rax + 0xc], 0x630065
mov byte [rax + 0x10], 0x6b
jmp 0x1400068bb
mov rdi, r15
mov ecx, reloc.WS2_32.dll_gethostname
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140006934
mov dword [rax], 0x6f0062
mov dword [rax + 4], 0x65006e
mov dword [rax + 8], 0x48005f
mov dword [rax + 0xc], 0x700069
mov dword [rax + 0x10], 0x3f3f3f73
mov dword [rax + 0x14], 0x3f3f3f3f
mov dword [rax + 0x18], 0x3f3f3f3f
mov dword [rax + 0x1c], 0x3f3f3f3f
mov dword [rax + 0x20], 0x3f3f3f3f
mov dword [rax + 0x24], 9
mov dword [rax + 0x28], 0x6f0062
mov dword [rax + 0x2c], 0x65006e
mov dword [rax + 0x30], 0x48005f
mov dword [rax + 0x34], 0x610065
mov byte [rax + 0x38], 0x64
jmp 0x140006937
mov rbx, r15
mov qword [rbp + 0x408], r15
mov qword [rbp + 0x418], r15
mov qword [rbp + 0x420], reloc.WS2_32.dll_ntohs
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Aimbot___Neck
lea rcx, [rbp + 0x408]
call fcn.14000aa40
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
lea rdx, [rbp + 0x408]
lea rcx, [0x1401cb318]
call fcn.14000a0b0
jmp 0x140006a93
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x1400069bf
mov dword [rax], 0x6f0062
mov dword [rax + 4], 0x65006e
mov dword [rax + 8], 0x48005f
mov dword [rax + 0xc], 0x700069
mov byte [rax + 0x10], reloc.WS2_32.dll_WSAStartup
jmp 0x1400069c2
mov rdi, r15
mov ecx, reloc.WS2_32.dll_gethostname
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140006a3b
mov dword [rax], 0x6f0062
mov dword [rax + 4], 0x65006e
mov dword [rax + 8], 0x4e005f
mov dword [rax + 0xc], 0x630065
mov dword [rax + 0x10], 0x3f3f3f6b
mov dword [rax + 0x14], 0x3f3f3f3f
mov dword [rax + 0x18], 0x3f3f3f3f
mov dword [rax + 0x1c], 0x3f3f3f3f
mov dword [rax + 0x20], 0x3f3f3f3f
mov dword [rax + 0x24], 9
mov dword [rax + 0x28], 0x6f0062
mov dword [rax + 0x2c], 0x65006e
mov dword [rax + 0x30], 0x48005f
mov dword [rax + 0x34], 0x610065
mov byte [rax + 0x38], 0x64
jmp 0x140006a3e
mov rbx, r15
mov qword [rbp + 0x428], r15
mov qword [rbp + 0x438], r15
mov qword [rbp + 0x440], reloc.WS2_32.dll_ntohs
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Aimbot___Neck
lea rcx, [rbp + 0x428]
call fcn.14000aa40
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
lea rdx, [rbp + 0x428]
lea rcx, [0x1401cb318]
call fcn.14000abb0
cmp byte [0x1401cb2f2], 0
je 0x140006c37
mov ecx, reloc.WS2_32.dll_select
cmp byte [0x1401cb9e2], 0
je 0x140006b77
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140006ae2
mov dword [rax], 0x42a0
mov dword [rax + 4], 0xb1e03fc0
mov dword [rax + 8], 0xffff
mov dword [rax + 0xc], 0x3fc0
mov word [rax + 0x10], 0x3f80
jmp 0x140006ae5
mov rbx, r15
mov ecx, reloc.WS2_32.dll_select
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140006b1a
mov dword [rax], 0x42a0
mov dword [rax + 4], 0x33333fc0
mov dword [rax + 8], 0x4013
mov dword [rax + 0xc], 0x3fc0
mov word [rax + 0x10], 0x3f80
jmp 0x140006b1d
mov rdi, r15
mov qword [rbp + 0x448], r15
mov qword [rbp + 0x458], r15
mov qword [rbp + 0x460], reloc.WS2_32.dll_ntohs
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, str.Aimbot___Scope
lea rcx, [rbp + 0x448]
call fcn.14000aa40
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
mov r9, rsi
xor r8d, r8d
lea rdx, [rbp + 0x448]
lea rcx, [0x1401cb318]
call fcn.14000a0b0
jmp 0x140006c37
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140006ba7
mov dword [rax], 0x42a0
mov dword [rax + 4], 0xb1e03fc0
mov dword [rax + 8], 0xffff
mov dword [rax + 0xc], 0x3fc0
mov word [rax + 0x10], 0x3f80
jmp 0x140006baa
mov rbx, r15
mov ecx, reloc.WS2_32.dll_select
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140006bdf
mov dword [rax], 0x42a0
mov dword [rax + 4], 0x33333fc0
mov dword [rax + 8], 0x4013
mov dword [rax + 0xc], 0x3fc0
mov word [rax + 0x10], 0x3f80
jmp 0x140006be2
mov rdi, r15
mov qword [rbp + 0x468], r15
mov qword [rbp + 0x478], r15
mov qword [rbp + 0x480], reloc.WS2_32.dll_ntohs
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, str.Aimbot___Scope
lea rcx, [rbp + 0x468]
call fcn.14000aa40
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
mov r9, rsi
xor r8d, r8d
lea rdx, [rbp + 0x468]
lea rcx, [0x1401cb318]
call fcn.14000abb0
cmp byte [0x1401cb2f3], 0
je 0x140006e77
mov ecx, 0x34
cmp byte [0x1401cb9e3], 0
je 0x140006d69
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140006cad
mov qword [rax], 0
mov dword [rax + 8], 0
mov dword [rax + 0xc], 0x3f3f3f3f
mov qword [rax + 0x10], reloc.WLDAP32.dll_Ordinal_200
mov qword [rax + 0x18], 0
mov dword [rax + 0x20], 0
mov dword [rax + 0x24], 5
mov dword [rax + 0x28], 1
mov dword [rax + 0x2c], 0x3fb5c28f
mov dword [rax + 0x30], 1
jmp 0x140006cb0
mov rbx, r15
mov ecx, 0x34
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140006d0c
mov qword [rax], 1
mov dword [rax + 8], 0
mov dword [rax + 0xc], 0x3f3f3f3f
mov qword [rax + 0x10], reloc.WLDAP32.dll_Ordinal_200
mov qword [rax + 0x18], 0
mov dword [rax + 0x20], 0
mov dword [rax + 0x24], 5
mov dword [rax + 0x28], 1
mov dword [rax + 0x2c], 0x3fb5c28f
mov dword [rax + 0x30], 1
jmp 0x140006d0f
mov rdi, r15
mov qword [rbp + 0x2a8], r15
mov qword [rbp + 0x2b8], r15
mov qword [rbp + 0x2c0], reloc.WS2_32.dll_ntohs
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.Aimbot___Sniper
lea rcx, [rbp + 0x2a8]
call fcn.14000aa40
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
mov r9, rsi
xor r8d, r8d
lea rdx, [rbp + 0x2a8]
lea rcx, [0x1401cb318]
call fcn.14000a0b0
jmp 0x140006e77
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140006dc0
mov qword [rax], 1
mov dword [rax + 8], 0
mov dword [rax + 0xc], 0x3f3f3f3f
mov qword [rax + 0x10], reloc.WLDAP32.dll_Ordinal_200
mov qword [rax + 0x18], 0
mov dword [rax + 0x20], 0
mov dword [rax + 0x24], 5
mov dword [rax + 0x28], 1
mov dword [rax + 0x2c], 0x3fb5c28f
mov dword [rax + 0x30], 1
jmp 0x140006dc3
mov rbx, r15
mov ecx, 0x34
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140006e1f
mov qword [rax], 0
mov dword [rax + 8], 0
mov dword [rax + 0xc], 0x3f3f3f3f
mov qword [rax + 0x10], reloc.WLDAP32.dll_Ordinal_200
mov qword [rax + 0x18], 0
mov dword [rax + 0x20], 0
mov dword [rax + 0x24], 5
mov dword [rax + 0x28], 1
mov dword [rax + 0x2c], 0x3fb5c28f
mov dword [rax + 0x30], 1
jmp 0x140006e22
mov rdi, r15
mov qword [rbp + 0x4a8], r15
mov qword [rbp + 0x4b8], r15
mov qword [rbp + 0x4c0], reloc.WS2_32.dll_ntohs
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.Aimbot___Sniper
lea rcx, [rbp + 0x4a8]
call fcn.14000aa40
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
mov r9, rsi
xor r8d, r8d
lea rdx, [rbp + 0x4a8]
lea rcx, [0x1401cb318]
call fcn.14000abb0
cmp byte [0x1401cb2f4], 0
je 0x140006fd7
mov ecx, 7
cmp byte [0x1401cb9e4], 0
je 0x140006f39
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140006eb5
mov dword [rax], 0xe59010
mov word [rax + 4], 0x20f0
mov byte [rax + 6], 0xe3
jmp 0x140006eb8
mov rdi, r15
mov ecx, 7
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140006edc
mov dword [rax], 0xae59010
mov word [rax + 4], 0xa000
mov byte [rax + 6], 0xe3
jmp 0x140006edf
mov rbx, r15
mov qword [rbp + 0x4c8], r15
mov qword [rbp + 0x4d8], r15
mov qword [rbp + 0x4e0], reloc.WS2_32.dll_ntohs
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.Bypass___Emulator
lea rcx, [rbp + 0x4c8]
call fcn.14000aa40
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
lea rdx, [rbp + 0x4c8]
lea rcx, [0x1401cb318]
call fcn.14000a0b0
jmp 0x140006fd7
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140006f58
mov dword [rax], 0xe59010
mov word [rax + 4], 0x20f0
mov byte [rax + 6], 0xe3
jmp 0x140006f5b
mov rdi, r15
mov ecx, 7
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140006f7f
mov dword [rax], 0xae59010
mov word [rax + 4], 0xa000
mov byte [rax + 6], 0xe3
jmp 0x140006f82
mov rbx, r15
mov qword [rbp + 0x4e8], r15
mov qword [rbp + 0x4f8], r15
mov qword [rbp + 0x500], reloc.WS2_32.dll_ntohs
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.Bypass___Emulator
lea rcx, [rbp + 0x4e8]
call fcn.14000aa40
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
lea rdx, [rbp + 0x4e8]
lea rcx, [0x1401cb318]
call fcn.14000abb0
cmp byte [0x1401cb2f5], 0
je 0x140007157
mov ecx, reloc.WS2_32.dll_listen
cmp byte [0x1401cb9e5], 0
je 0x1400070a9
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x14000701d
mov dword [rax], 0x80000000
mov dword [rax + 4], 0x2d48303f
mov dword [rax + 8], 0xa04001e9
mov byte [rax + 0xc], 0xe1
jmp 0x140007020
mov rbx, r15
mov ecx, reloc.WS2_32.dll_listen
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x14000704c
mov dword [rax], 0x27c5ac00
mov dword [rax + 4], 0x2d483037
mov dword [rax + 8], 0xa04001e9
mov byte [rax + 0xc], 0xe1
jmp 0x14000704f
mov rdi, r15
mov qword [rbp + 0x508], r15
mov qword [rbp + 0x518], r15
mov qword [rbp + 0x520], reloc.WS2_32.dll_ntohs
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Magic_Bullets
lea rcx, [rbp + 0x508]
call fcn.14000aa40
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
mov r9, rsi
xor r8d, r8d
lea rdx, [rbp + 0x508]
lea rcx, [0x1401cb318]
call fcn.14000a0b0
jmp 0x140007157
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x1400070d0
mov dword [rax], 0x27c5ac00
mov dword [rax + 4], 0x2d483037
mov dword [rax + 8], 0xa04001e9
mov byte [rax + 0xc], 0xe1
jmp 0x1400070d3
mov rbx, r15
mov ecx, reloc.WS2_32.dll_listen
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x1400070ff
mov dword [rax], 0x80000000
mov dword [rax + 4], 0x2d48303f
mov dword [rax + 8], 0xa04001e9
mov byte [rax + 0xc], 0xe1
jmp 0x140007102
mov rdi, r15
mov qword [rbp + 0x528], r15
mov qword [rbp + 0x538], r15
mov qword [rbp + 0x540], reloc.WS2_32.dll_ntohs
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Magic_Bullets
lea rcx, [rbp + 0x528]
call fcn.14000aa40
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
mov r9, rsi
xor r8d, r8d
lea rdx, [rbp + 0x528]
lea rcx, [0x1401cb318]
call fcn.14000abb0
cmp byte [0x1401cb2f7], 0
je 0x140007303
mov ecx, Ordinal_26
cmp byte [0x1401cb9e7], 0
je 0x14000723f
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x1400071a2
mov qword [rax], 0xffffffffffe17b80
mov qword [rax + 8], 0xffffffffffe17b80
mov dword [rax + 0x10], 0x3f0f5c29
mov dword [rax + 0x14], 0x3ec7ae14
jmp 0x1400071a5
mov rbx, r15
mov ecx, Ordinal_26
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x1400071e2
mov dword [rax], 0x3f0147ae
mov dword [rax + 4], 0x3efd70a4
mov dword [rax + 8], 0x3f0147ae
mov dword [rax + 0xc], 0x3ee147ae
mov dword [rax + 0x10], 0x3f0f5c29
mov dword [rax + 0x14], 0x3ec7ae14
jmp 0x1400071e5
mov rdi, r15
mov qword [rbp + 0x548], r15
mov qword [rbp + 0x558], r15
mov qword [rbp + 0x560], reloc.WS2_32.dll_ntohs
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Aimfov___Full
lea rcx, [rbp + 0x548]
call fcn.14000aa40
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
mov r9, rsi
xor r8d, r8d
lea rdx, [rbp + 0x548]
lea rcx, [0x1401cb318]
call fcn.14000a0b0
jmp 0x140007303
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140007277
mov dword [rax], 0x3f0147ae
mov dword [rax + 4], 0x3efd70a4
mov dword [rax + 8], 0x3f0147ae
mov dword [rax + 0xc], 0x3ee147ae
mov dword [rax + 0x10], 0x3f0f5c29
mov dword [rax + 0x14], 0x3ec7ae14
jmp 0x14000727a
mov rbx, r15
mov ecx, Ordinal_26
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x1400072ab
mov qword [rax], 0xffffffffffe17b80
mov qword [rax + 8], 0xffffffffffe17b80
mov dword [rax + 0x10], 0x3f0f5c29
mov dword [rax + 0x14], 0x3ec7ae14
jmp 0x1400072ae
mov rdi, r15
mov qword [rbp + 0x568], r15
mov qword [rbp + 0x578], r15
mov qword [rbp + 0x580], reloc.WS2_32.dll_ntohs
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Aimfov___Full
lea rcx, [rbp + 0x568]
call fcn.14000aa40
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
mov r9, rsi
xor r8d, r8d
lea rdx, [rbp + 0x568]
lea rcx, [0x1401cb318]
call fcn.14000abb0
cmp byte [0x1401cb2f6], 0
je 0x1400074f3
mov ecx, Ordinal_33
cmp byte [0x1401cb9e6], 0
je 0x14000740d
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140007365
mov dword [rax], 0xaeffffff
mov dword [rax + 4], 0x293ee147
mov dword [rax + 8], 0x143f0f5c
mov dword [rax + 0xc], 0xf6ffffff
mov qword [rax + 0x10], 0x3f1c28
mov dword [rax + 0x18], 0x3fc000
mov word [rax + 0x1c], 0
mov byte [rax + 0x1e], 0
jmp 0x140007368
mov rdi, r15
mov ecx, Ordinal_33
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x1400073b0
mov dword [rax], 0xae3f0147
mov dword [rax + 4], 0x293ee147
mov dword [rax + 8], 0x143f0f5c
mov dword [rax + 0xc], 0xf63ec7ae
mov qword [rax + 0x10], 0x3f1c28
mov dword [rax + 0x18], 0x3fc000
mov word [rax + 0x1c], 0
mov byte [rax + 0x1e], 0
jmp 0x1400073b3
mov rbx, r15
mov qword [rbp + 0x588], r15
mov qword [rbp + 0x598], r15
mov qword [rbp + 0x5a0], reloc.WS2_32.dll_ntohs
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, str.Aimfov___Legit
lea rcx, [rbp + 0x588]
call fcn.14000aa40
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
lea rdx, [rbp + 0x588]
lea rcx, [0x1401cb318]
call fcn.14000a0b0
jmp 0x1400074f3
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140007450
mov dword [rax], 0xae3f0147
mov dword [rax + 4], 0x293ee147
mov dword [rax + 8], 0x143f0f5c
mov dword [rax + 0xc], 0xf63ec7ae
mov qword [rax + 0x10], 0x3f1c28
mov dword [rax + 0x18], 0x3fc000
mov word [rax + 0x1c], 0
mov byte [rax + 0x1e], 0
jmp 0x140007453
mov rdi, r15
mov ecx, Ordinal_33
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x14000749b
mov dword [rax], 0xaeffffff
mov dword [rax + 4], 0x293ee147
mov dword [rax + 8], 0x143f0f5c
mov dword [rax + 0xc], 0xf6ffffff
mov qword [rax + 0x10], 0x3f1c28
mov dword [rax + 0x18], 0x3fc000
mov word [rax + 0x1c], 0
mov byte [rax + 0x1e], 0
jmp 0x14000749e
mov rbx, r15
mov qword [rbp + 0x5a8], r15
mov qword [rbp + 0x5b8], r15
mov qword [rbp + 0x5c0], reloc.WS2_32.dll_ntohs
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, str.Aimfov___Legit
lea rcx, [rbp + 0x5a8]
call fcn.14000aa40
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
lea rdx, [rbp + 0x5a8]
lea rcx, [0x1401cb318]
call fcn.14000abb0
cmp byte [0x1401cb2f8], 0
je 0x1400076df
mov ecx, reloc.WLDAP32.dll_Ordinal_27
cmp byte [0x1401cb9e8], 0
je 0x1400075fb
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140007554
mov dword [rax], 0xed9f0a03
mov dword [rax + 4], 0xee010a10
mov dword [rax + 8], 0xee810a00
mov dword [rax + 0xc], 0xee100a10
mov dword [rax + 0x10], 0xe8bd8c10
mov dword [rax + 0x14], 0
mov word [rax + 0x18], 0x48f0
mov byte [rax + 0x1a], reloc.WLDAP32.dll_Ordinal_45
jmp 0x140007557
mov rdi, r15
mov ecx, reloc.WLDAP32.dll_Ordinal_27
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x14000759e
mov dword [rax], 0xed9f0a03
mov dword [rax + 4], 0xee010a10
mov dword [rax + 8], 0xee810a00
mov dword [rax + 0xc], 0xee100a10
mov dword [rax + 0x10], 0xe8bd8c10
mov dword [rax + 0x14], 0x447a0000
mov word [rax + 0x18], 0x48f0
mov byte [rax + 0x1a], reloc.WLDAP32.dll_Ordinal_45
jmp 0x1400075a1
mov rbx, r15
mov qword [rbp + 0x5c8], r15
mov qword [rbp + 0x5d8], r15
mov qword [rbp + 0x5e0], reloc.WS2_32.dll_ntohs
mov r8d, 9
lea rdx, str.No_Recoil
lea rcx, [rbp + 0x5c8]
call fcn.14000aa40
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
lea rdx, [rbp + 0x5c8]
lea rcx, [0x1401cb318]
call fcn.14000a0b0
jmp 0x1400076df
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x14000763d
mov dword [rax], 0xed9f0a03
mov dword [rax + 4], 0xee010a10
mov dword [rax + 8], 0xee810a00
mov dword [rax + 0xc], 0xee100a10
mov dword [rax + 0x10], 0xe8bd8c10
mov dword [rax + 0x14], 0x447a0000
mov word [rax + 0x18], 0x48f0
mov byte [rax + 0x1a], reloc.WLDAP32.dll_Ordinal_45
jmp 0x140007640
mov rdi, r15
mov ecx, reloc.WLDAP32.dll_Ordinal_27
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140007687
mov dword [rax], 0xed9f0a03
mov dword [rax + 4], 0xee010a10
mov dword [rax + 8], 0xee810a00
mov dword [rax + 0xc], 0xee100a10
mov dword [rax + 0x10], 0xe8bd8c10
mov dword [rax + 0x14], 0
mov word [rax + 0x18], 0x48f0
mov byte [rax + 0x1a], reloc.WLDAP32.dll_Ordinal_45
jmp 0x14000768a
mov rbx, r15
mov qword [rbp + 0x5e8], r15
mov qword [rbp + 0x5f8], r15
mov qword [rbp + 0x600], reloc.WS2_32.dll_ntohs
mov r8d, 9
lea rdx, str.No_Recoil
lea rcx, [rbp + 0x5e8]
call fcn.14000aa40
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
lea rdx, [rbp + 0x5e8]
lea rcx, [0x1401cb318]
call fcn.14000abb0
cmp byte [0x1401cb2f9], 0
je 0x140007811
mov rcx, r12
cmp byte [0x1401cb9e9], 0
je 0x140007789
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140007711
mov dword [rax], 0xbf800000
jmp 0x140007714
mov rdi, r15
mov rcx, r12
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x14000772c
mov dword [rax], 0x3e4ccccd
jmp 0x14000772f
mov rbx, r15
mov qword [rbp + 0x2c8], r15
mov qword [rbp + 0x2d8], r15
mov qword [rbp + 0x2e0], reloc.WS2_32.dll_ntohs
mov r8d, 9
lea rdx, str.Fast_Fire
lea rcx, [rbp + 0x2c8]
call fcn.14000aa40
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
lea rdx, [rbp + 0x2c8]
lea rcx, [0x1401cb318]
call fcn.14000a0b0
jmp 0x140007811
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x14000779e
mov dword [rax], 0x3e4ccccd
jmp 0x1400077a1
mov rdi, r15
mov rcx, r12
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x1400077b9
mov dword [rax], 0xbf800000
jmp 0x1400077bc
mov rbx, r15
mov qword [rbp + 0x2e8], r15
mov qword [rbp + 0x2f8], r15
mov qword [rbp + 0x300], reloc.WS2_32.dll_ntohs
mov r8d, 9
lea rdx, str.Fast_Fire
lea rcx, [rbp + 0x2e8]
call fcn.14000aa40
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
lea rdx, [rbp + 0x2e8]
lea rcx, [0x1401cb318]
call fcn.14000abb0
cmp byte [0x1401cb2fa], 0
je 0x140007965
mov ecx, 8
cmp byte [0x1401cb9ea], 0
je 0x1400078cd
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x14000784c
mov dword [rax], 0xe92d4c70
mov dword [rax + 4], 0xe18db010
jmp 0x14000784f
mov rdi, r15
mov ecx, 8
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140007870
mov dword [rax], 0x464c457f
mov dword [rax + 4], 0x10101
jmp 0x140007873
mov rbx, r15
mov qword [rbp + 0x308], r15
mov qword [rbp + 0x318], r15
mov qword [rbp + 0x320], reloc.WS2_32.dll_ntohs
mov r8d, 7
lea rdx, str.Aimlock
lea rcx, [rbp + 0x308]
call fcn.14000aa40
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
lea rdx, [rbp + 0x308]
lea rcx, [0x1401cb318]
call fcn.14000a0b0
jmp 0x140007965
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x1400078e9
mov dword [rax], 0x464c457f
mov dword [rax + 4], 0x10101
jmp 0x1400078ec
mov rdi, r15
mov ecx, 8
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x14000790d
mov dword [rax], 0xe92d4c70
mov dword [rax + 4], 0xe18db010
jmp 0x140007910
mov rbx, r15
mov qword [rbp + 0x328], r15
mov qword [rbp + 0x338], r15
mov qword [rbp + 0x340], reloc.WS2_32.dll_ntohs
mov r8d, 7
lea rdx, str.Aimlock
lea rcx, [rbp + 0x328]
call fcn.14000aa40
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
lea rdx, [rbp + 0x328]
lea rcx, [0x1401cb318]
call fcn.14000abb0
cmp byte [0x1401cb2fb], 0
je 0x140007ab9
mov ecx, 8
cmp byte [0x1401cb9eb], 0
je 0x140007a21
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x1400079a0
mov dword [rax], 0xbeac8844
mov dword [rax + 4], 0xbf1e07c9
jmp 0x1400079a3
mov rdi, r15
mov ecx, 8
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x1400079c4
mov dword [rax], 0x3f8147ae
mov dword [rax + 4], 0x3f8147ae
jmp 0x1400079c7
mov rbx, r15
mov qword [rbp + 0x348], r15
mov qword [rbp + 0x358], r15
mov qword [rbp + 0x360], reloc.WS2_32.dll_ntohs
mov r8d, 8
lea rdx, str.Glo_Wall
lea rcx, [rbp + 0x348]
call fcn.14000aa40
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
lea rdx, [rbp + 0x348]
lea rcx, [0x1401cb318]
call fcn.14000a0b0
jmp 0x140007ab9
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140007a3d
mov dword [rax], 0x3f8147ae
mov dword [rax + 4], 0x3f8147ae
jmp 0x140007a40
mov rdi, r15
mov ecx, 8
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140007a61
mov dword [rax], 0xbeac8844
mov dword [rax + 4], 0xbf1e07c9
jmp 0x140007a64
mov rbx, r15
mov qword [rbp + 0x368], r15
mov qword [rbp + 0x378], r15
mov qword [rbp + 0x380], reloc.WS2_32.dll_ntohs
mov r8d, 8
lea rdx, str.Glo_Wall
lea rcx, [rbp + 0x368]
call fcn.14000aa40
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
lea rdx, [rbp + 0x368]
lea rcx, [0x1401cb318]
call fcn.14000abb0
cmp byte [0x1401cb2fc], 0
je 0x140007c0d
mov ecx, 8
cmp byte [0x1401cb9ec], 0
je 0x140007b75
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140007af4
mov dword [rax], 0x464c457f
mov dword [rax + 4], 0x10101
jmp 0x140007af7
mov rdi, r15
mov ecx, 8
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140007b18
mov dword [rax], 0xe92d4c70
mov dword [rax + 4], 0xe18db010
jmp 0x140007b1b
mov rbx, r15
mov qword [rbp + 0x388], r15
mov qword [rbp + 0x398], r15
mov qword [rbp + 0x3a0], reloc.WS2_32.dll_ntohs
mov r8d, 9
lea rdx, str.Lock_Head
lea rcx, [rbp + 0x388]
call fcn.14000aa40
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
lea rdx, [rbp + 0x388]
lea rcx, [0x1401cb318]
call fcn.14000a0b0
jmp 0x140007c0d
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140007b91
mov dword [rax], 0x464c457f
mov dword [rax + 4], 0x10101
jmp 0x140007b94
mov rdi, r15
mov ecx, 8
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140007bb5
mov dword [rax], 0xe92d4c70
mov dword [rax + 4], 0xe18db010
jmp 0x140007bb8
mov rbx, r15
mov qword [rbp + 0x3a8], r15
mov qword [rbp + 0x3b8], r15
mov qword [rbp + 0x3c0], reloc.WS2_32.dll_ntohs
mov r8d, 9
lea rdx, str.Lock_Head
lea rcx, [rbp + 0x3a8]
call fcn.14000aa40
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
lea rdx, [rbp + 0x3a8]
lea rcx, [0x1401cb318]
call fcn.14000abb0
cmp byte [0x1401cb305], 0
je 0x140007d2e
cmp byte [0x1401cb9f5], 0
je 0x140007cbc
mov rcx, r13
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140007c3e
mov word [rax], 0x437a
jmp 0x140007c41
mov rdi, r15
mov ecx, 0xa
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140007c68
mov dword [rax], 0xcd9d3f80
mov dword [rax + 4], 0xc0533e7e
mov word [rax + 8], 0x3f77
jmp 0x140007c6b
mov rbx, r15
mov qword [rbp + 0x488], r15
mov qword [rbp + 0x498], r15
mov qword [rbp + 0x4a0], reloc.WS2_32.dll_ntohs
lea rdx, str.Antena____Hand
lea rcx, [rbp + 0x488]
call fcn.14000aa20
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
lea rdx, [rbp + 0x488]
lea rcx, [0x1401cb318]
call fcn.14000a0b0
jmp 0x140007d2e
mov ecx, 3
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140007cd9
mov word [rax], 0x3f80
mov byte [rax + 2], 0x9d
jmp 0x140007cdc
mov rdi, r15
mov ecx, 3
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140007cf9
mov word [rax], 0x437a
mov byte [rax + 2], 0x9d
jmp 0x140007cfc
mov rbx, r15
lea rdx, str.Antena____Hand
lea rcx, [rbp + 0x758]
call fcn.140003070
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000abb0
cmp byte [0x1401cb307], 0
je 0x140007e4c
cmp byte [0x1401cb9f7], 0
je 0x140007dca
mov rcx, r13
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140007d5f
mov word [rax], 0x437a
jmp 0x140007d62
mov rdi, r15
mov ecx, reloc.WS2_32.dll_ntohl
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140007d90
mov dword [rax], 0xf2313f80
mov dword [rax + 4], 0x55603e99
mov dword [rax + 8], 0x3985bf6d
mov word [rax + 0xc], 0x3e65
jmp 0x140007d93
mov rbx, r15
lea rdx, str.Antena_Female___Hand
lea rcx, [rbp + 0x778]
call fcn.140003070
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000a0b0
jmp 0x140007e4c
mov ecx, 9
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140007def
mov dword [rax], 0x3ecbee53
mov dword [rax + 4], 0x3f800000
mov byte [rax + 8], Ordinal_50
jmp 0x140007df2
mov rdi, r15
mov ecx, 9
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140007e17
mov dword [rax], 0x3ecbee53
mov dword [rax + 4], 0x437a0000
mov byte [rax + 8], Ordinal_50
jmp 0x140007e1a
mov rbx, r15
lea rdx, str.Antena_Female___Hand
lea rcx, [rbp + 0x798]
call fcn.140003070
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000abb0
cmp byte [0x1401cb306], 0
je 0x140007f7b
cmp byte [0x1401cb9f6], 0
je 0x140007ef3
mov ecx, 8
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140007e87
mov dword [rax], 0xe3440080
mov dword [rax + 4], 0xe12eff1e
jmp 0x140007e8a
mov rdi, r15
mov ecx, reloc.WS2_32.dll_recv
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140007eb9
mov dword [rax], 0xe92d4c70
mov dword [rax + 4], 0xe28db010
mov dword [rax + 8], 0xe1a04001
mov dword [rax + 0xc], 0xe1a05000
jmp 0x140007ebc
mov rbx, r15
lea rdx, str.Speed_Hack
lea rcx, [rbp + 0x7b8]
call fcn.140003070
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000a0b0
jmp 0x140007f7b
mov ecx, reloc.WS2_32.dll_recv
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140007f22
mov dword [rax], 0xe92d4c70
mov dword [rax + 4], 0xe28db010
mov dword [rax + 8], 0xe1a04001
mov dword [rax + 0xc], 0xe1a05000
jmp 0x140007f25
mov rbx, r15
mov ecx, 8
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140007f46
mov dword [rax], 0xe3440080
mov dword [rax + 4], 0xe12eff1e
jmp 0x140007f49
mov rdi, r15
lea rdx, str.Speed_Hack
lea rcx, [rbp + 0x7d8]
call fcn.140003070
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000abb0
cmp byte [0x1401cb308], 0
je 0x1400080f4
cmp byte [0x1401cb9f9], 0
je 0x140008047
mov ecx, 8
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140007fb6
mov dword [rax], 0x3db851ec
mov dword [rax + 4], 0x3cf5c28f
jmp 0x140007fb9
mov rdi, r15
mov ecx, Ordinal_46
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x14000800d
mov dword [rax], 0x3f3f3f3f
mov qword [rax + 4], 0x3e800000
mov dword [rax + 0xc], 0x3f3f3f3f
mov dword [rax + 0x10], 0x3f3f3f3f
mov dword [rax + 0x14], 0x3f3f3f3f
mov dword [rax + 0x18], 0x3f3f3f3f
mov qword [rax + 0x1c], 0x3f3f3f3f
mov dword [rax + 0x24], 0
mov dword [rax + 0x28], 0x3f800000
jmp 0x140008010
mov rbx, r15
lea rdx, str.Fast_Switch
lea rcx, [rbp + 0x7f8]
call fcn.140003070
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000a0b0
jmp 0x1400080f4
mov ecx, Ordinal_46
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x14000809b
mov dword [rax], 0x3f3f3f3f
mov qword [rax + 4], 0x3e800000
mov dword [rax + 0xc], 0x3f3f3f3f
mov dword [rax + 0x10], 0x3f3f3f3f
mov dword [rax + 0x14], 0x3f3f3f3f
mov dword [rax + 0x18], 0x3f3f3f3f
mov qword [rax + 0x1c], 0x3f3f3f3f
mov dword [rax + 0x24], 0
mov dword [rax + 0x28], 0x3f800000
jmp 0x14000809e
mov rbx, r15
mov ecx, 8
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x1400080bf
mov dword [rax], 0x3db851ec
mov dword [rax + 4], 0x3cf5c28f
jmp 0x1400080c2
mov rdi, r15
lea rdx, str.Fast_Switch
lea rcx, [rbp + 0x818]
call fcn.140003070
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000abb0
cmp byte [0x1401cb301], 0
je 0x1400082ae
cmp byte [0x1401cb9f1], 0
je 0x1400081be
mov ecx, 1
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140008125
mov byte [rax], 0
jmp 0x140008128
mov rdi, r15
mov ecx, 0x34
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140008184
mov qword [rax], 1
mov dword [rax + 8], 0
mov dword [rax + 0xc], 0x3f3f3f3f
mov qword [rax + 0x10], reloc.WLDAP32.dll_Ordinal_200
mov qword [rax + 0x18], 0
mov dword [rax + 0x20], 0
mov dword [rax + 0x24], 5
mov dword [rax + 0x28], 1
mov dword [rax + 0x2c], 0x3fb5c28f
mov dword [rax + 0x30], 1
jmp 0x140008187
mov rbx, r15
lea rdx, str.Aimbot___Sniper
lea rcx, [rbp + 0x838]
call fcn.140003070
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000a0b0
jmp 0x1400082ae
mov ecx, 0x34
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x14000821a
mov qword [rax], 1
mov dword [rax + 8], 0
mov dword [rax + 0xc], 0x3f3f3f3f
mov qword [rax + 0x10], reloc.WLDAP32.dll_Ordinal_200
mov qword [rax + 0x18], 0
mov dword [rax + 0x20], 0
mov dword [rax + 0x24], 5
mov dword [rax + 0x28], 1
mov dword [rax + 0x2c], 0x3fb5c28f
mov dword [rax + 0x30], 1
jmp 0x14000821d
mov rdi, r15
mov ecx, 0x34
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140008279
mov qword [rax], 0
mov dword [rax + 8], 0
mov dword [rax + 0xc], 0x3f3f3f3f
mov qword [rax + 0x10], reloc.WLDAP32.dll_Ordinal_200
mov qword [rax + 0x18], 0
mov dword [rax + 0x20], 0
mov dword [rax + 0x24], 5
mov dword [rax + 0x28], 1
mov dword [rax + 0x2c], 0x3fb5c28f
mov dword [rax + 0x30], 1
jmp 0x14000827c
mov rbx, r15
lea rdx, str.Aimbot___Sniper
lea rcx, [rbp + 0x858]
call fcn.140003070
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000abb0
cmp byte [0x1401cb302], 0
je 0x1400083d0
cmp byte [0x1401cb9f2], 0
je 0x140008340
mov rcx, r13
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x1400082db
mov word [rax], 0
jmp 0x1400082de
mov rdi, r15
mov ecx, ntohs
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140008306
mov dword [rax], 0x48f0447a
mov dword [rax + 4], 0xb010e92d
mov dword [rax + 8], 0x8b02e28d
jmp 0x140008309
mov rbx, r15
lea rdx, str.No_Recoil
lea rcx, [rbp + 0x878]
call fcn.140003070
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000a0b0
jmp 0x1400083d0
mov ecx, reloc.WS2_32.dll_listen
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x14000836c
mov dword [rax], 0xf0447a00
mov dword [rax + 4], 0x10e92d48
mov dword [rax + 8], 0x2e28db0
mov byte [rax + 0xc], 0x8b
jmp 0x14000836f
mov rdi, r15
mov ecx, reloc.WS2_32.dll_listen
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x14000839b
mov dword [rax], 0xf0000000
mov dword [rax + 4], 0x10e92d48
mov dword [rax + 8], 0x2e28db0
mov byte [rax + 0xc], 0x8b
jmp 0x14000839e
mov rbx, r15
lea rdx, str.No_Recoil
lea rcx, [rbp + 0x898]
call fcn.140003070
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000abb0
cmp byte [0x1401cb303], 0
je 0x14000852e
cmp byte [0x1401cb9f3], 0
je 0x14000847c
mov rcx, r12
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140008402
mov dword [rax], 0x41200000
jmp 0x140008405
mov rdi, r15
mov ecx, Ordinal_26
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140008442
mov dword [rax], 0x358637bd
mov dword [rax + 4], 0xe3510000
mov dword [rax + 8], 0x15911004
mov dword [rax + 0xc], 0x3a01000
mov dword [rax + 0x10], 0xe5801024
mov dword [rax + 0x14], 0xe12fff1e
jmp 0x140008445
mov rbx, r15
lea rdx, str.Night_Mode
lea rcx, [rbp + 0x8b8]
call fcn.140003070
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000a0b0
jmp 0x14000852e
mov ecx, Ordinal_26
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x1400084b9
mov dword [rax], 0x358637bd
mov dword [rax + 4], 0xe3510000
mov dword [rax + 8], 0x15911004
mov dword [rax + 0xc], 0x3a01000
mov dword [rax + 0x10], 0xe5801024
mov dword [rax + 0x14], 0xe12fff1e
jmp 0x1400084bc
mov rbx, r15
mov ecx, Ordinal_26
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x1400084f9
mov dword [rax], 0x41200000
mov dword [rax + 4], 0xe3510000
mov dword [rax + 8], 0x15911004
mov dword [rax + 0xc], 0x3a01000
mov dword [rax + 0x10], 0xe5801024
mov dword [rax + 0x14], 0xe12fff1e
jmp 0x1400084fc
mov rdi, r15
lea rdx, str.Night_Mode
lea rcx, [rbp + 0x8d8]
call fcn.140003070
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000abb0
cmp byte [0x1401cb304], 0
je 0x14000868c
mov ecx, reloc.WS2_32.dll_select
cmp byte [0x1401cb9f4], 0
je 0x1400085ef
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x14000857d
mov dword [rax], 0x42a0
mov dword [rax + 4], 0xb1e03fc0
mov dword [rax + 8], 0xffff
mov dword [rax + 0xc], 0x3fc0
mov word [rax + 0x10], 0x3f80
jmp 0x140008580
mov rdi, r15
mov ecx, reloc.WS2_32.dll_select
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x1400085b5
mov dword [rax], 0x42a0
mov dword [rax + 4], 0x33333fc0
mov dword [rax + 8], 0x4013
mov dword [rax + 0xc], 0x3fc0
mov word [rax + 0x10], 0x3f80
jmp 0x1400085b8
mov rbx, r15
lea rdx, str.Aimbot_Mira
lea rcx, [rbp + 0x8f8]
call fcn.140003070
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000a0b0
jmp 0x14000868c
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x14000861f
mov dword [rax], 0x42a0
mov dword [rax + 4], 0x33333fc0
mov dword [rax + 8], 0x4013
mov dword [rax + 0xc], 0x3fc0
mov word [rax + 0x10], 0x3f80
jmp 0x140008622
mov rdi, r15
mov ecx, reloc.WS2_32.dll_select
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140008657
mov dword [rax], 0x42a0
mov dword [rax + 4], 0xb1e03fc0
mov dword [rax + 8], 0xffff
mov dword [rax + 0xc], 0x3fc0
mov word [rax + 0x10], 0x3f80
jmp 0x14000865a
mov rbx, r15
lea rdx, str.Aimbot_Mira
lea rcx, [rbp + 0x918]
call fcn.140003070
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000abb0
cmp byte [0x1401cb2fd], 0
je 0x140008786
cmp byte [0x1401cb9ed], 0
je 0x140008718
mov rcx, r12
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x1400086ba
mov dword [rax], 0x3f800000
jmp 0x1400086bd
mov rdi, r15
mov ecx, 7
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x1400086e1
mov dword [rax], 0x3727c5ac
mov word [rax + 4], 0x4830
mov byte [rax + 6], reloc.WLDAP32.dll_Ordinal_45
jmp 0x1400086e4
mov rbx, r15
lea rdx, str.Bala_Magica
lea rcx, [rbp + 0x938]
call fcn.140003070
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000a0b0
jmp 0x140008786
mov ecx, 5
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140008736
mov dword [rax], 0x3727c5ac
mov byte [rax + 4], Ordinal_50
jmp 0x140008739
mov rbx, r15
mov rcx, r12
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140008751
mov dword [rax], 0x3f800000
jmp 0x140008754
mov rdi, r15
lea rdx, str.Bala_Magica
lea rcx, [rbp + 0x958]
call fcn.140003070
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000abb0
cmp byte [0x1401cb2fe], 0
je 0x14000888e
cmp byte [0x1401cba01], 0
je 0x140008816
mov ecx, ntohs
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x1400087c4
mov dword [rax], 0x6d9dfa0d
mov dword [rax + 4], 0x6d9dfa0d
mov dword [rax + 8], 0x6d9dfa0d
jmp 0x1400087c7
mov rbx, r15
mov rcx, r12
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x1400087df
mov dword [rax], 0xed9dfa0d
jmp 0x1400087e2
mov rdi, r15
lea rdx, str.Aimbot
lea rcx, [rbp + 0x978]
call fcn.140003070
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000a0b0
jmp 0x14000888e
mov rcx, r12
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x14000882e
mov dword [rax], 0xed9dfa0d
jmp 0x140008831
mov rdi, r15
mov ecx, ntohs
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140008859
mov dword [rax], 0x6d9dfa0d
mov dword [rax + 4], 0x6d9dfa0d
mov dword [rax + 8], 0x6d9dfa0d
jmp 0x14000885c
mov rbx, r15
lea rdx, str.Wall_Hack
lea rcx, [rbp + 0x998]
call fcn.140003070
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000abb0
cmp byte [0x1401cb2ff], 0
je 0x1400089f4
mov ecx, Ordinal_26
cmp byte [0x1401cb9ef], 0
je 0x140008953
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x1400088d9
mov qword [rax], 0xffffffffffe17b80
mov qword [rax + 8], 0xffffffffffe17b80
mov dword [rax + 0x10], 0x3f0f5c29
mov dword [rax + 0x14], 0x3ec7ae14
jmp 0x1400088dc
mov rbx, r15
mov ecx, Ordinal_26
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140008919
mov dword [rax], 0x3f0147ae
mov dword [rax + 4], 0x3efd70a4
mov dword [rax + 8], 0x3f0147ae
mov dword [rax + 0xc], 0x3ee147ae
mov dword [rax + 0x10], 0x3f0f5c29
mov dword [rax + 0x14], 0x3ec7ae14
jmp 0x14000891c
mov rdi, r15
lea rdx, str.Aimfov___360
lea rcx, [rbp + 0x9b8]
call fcn.140003070
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000a0b0
jmp 0x1400089f4
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x14000898b
mov dword [rax], 0x3f0147ae
mov dword [rax + 4], 0x3efd70a4
mov dword [rax + 8], 0x3f0147ae
mov dword [rax + 0xc], 0x3ee147ae
mov dword [rax + 0x10], 0x3f0f5c29
mov dword [rax + 0x14], 0x3ec7ae14
jmp 0x14000898e
mov rbx, r15
mov ecx, Ordinal_26
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x1400089bf
mov qword [rax], 0xffffffffffe17b80
mov qword [rax + 8], 0xffffffffffe17b80
mov dword [rax + 0x10], 0x3f0f5c29
mov dword [rax + 0x14], 0x3ec7ae14
jmp 0x1400089c2
mov rdi, r15
lea rdx, str.Aimfov___360
lea rcx, [rbp + 0x9d8]
call fcn.140003070
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000abb0
cmp byte [0x1401cb300], 0
je 0x140008b3a
mov ecx, reloc.WS2_32.dll_recv
cmp byte [0x1401cb9f0], 0
je 0x140008aa9
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140008a3d
mov dword [rax], 0xe3a00001
mov dword [rax + 4], 0xe12fff1e
mov dword [rax + 8], 0xe1a04000
mov dword [rax + 0xc], 0xe3010c72
jmp 0x140008a40
mov rdi, r15
mov ecx, reloc.WS2_32.dll_recv
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140008a6f
mov dword [rax], 0xe92d4830
mov dword [rax + 4], 0xe28db008
mov dword [rax + 8], 0xe1a04000
mov dword [rax + 0xc], 0xe3010c72
jmp 0x140008a72
mov rbx, r15
lea rdx, str.Camera_Hack
lea rcx, [rbp + 0x9f8]
call fcn.140003070
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000a0b0
jmp 0x140008b3a
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140008ad3
mov dword [rax], 0xe92d4830
mov dword [rax + 4], 0xe28db008
mov dword [rax + 8], 0xe1a04000
mov dword [rax + 0xc], 0xe3010c72
jmp 0x140008ad6
mov rdi, r15
mov ecx, reloc.WS2_32.dll_recv
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140008b05
mov dword [rax], 0xe3a00001
mov dword [rax + 4], 0xe12fff1e
mov dword [rax + 8], 0xe1a04000
mov dword [rax + 0xc], 0xe3010c72
jmp 0x140008b08
mov rbx, r15
lea rdx, str.Camera_Hack
lea rcx, [rbp + 0xa18]
call fcn.140003070
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000abb0
cmp byte [0x1401cb309], 0
je 0x140008c8c
mov ecx, reloc.WS2_32.dll_ntohs
cmp byte [0x1401cb9fa], 0
je 0x140008bf5
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140008b86
mov dword [rax], 0x40800000
mov dword [rax + 4], 0x3f000000
mov dword [rax + 8], 0x42340000
mov word [rax + 0xc], 0xcccd
mov byte [rax + 0xe], 0xcc
jmp 0x140008b89
mov rdi, r15
mov ecx, reloc.WS2_32.dll_ntohs
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140008bbb
mov dword [rax], 0x3e99999a
mov dword [rax + 4], 0x3f000000
mov dword [rax + 8], 0x42340000
mov word [rax + 0xc], 0xcccd
mov byte [rax + 0xe], 0xcc
jmp 0x140008bbe
mov rbx, r15
lea rdx, [0x1400c17cc]
lea rcx, [rbp + 0xa38]
call fcn.140003070
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000a0b0
jmp 0x140008c8c
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140008c22
mov dword [rax], 0x3e99999a
mov dword [rax + 4], 0x3f000000
mov dword [rax + 8], 0x42340000
mov word [rax + 0xc], 0xcccd
mov byte [rax + 0xe], 0xcc
jmp 0x140008c25
mov rdi, r15
mov ecx, reloc.WS2_32.dll_ntohs
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140008c57
mov dword [rax], 0x40800000
mov dword [rax + 4], 0x3f000000
mov dword [rax + 8], 0x42340000
mov word [rax + 0xc], 0xcccd
mov byte [rax + 0xe], 0xcc
jmp 0x140008c5a
mov rbx, r15
lea rdx, [0x1400c17cc]
lea rcx, [rbp + 0xa58]
call fcn.140003070
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000abb0
cmp byte [0x1401cb30a], 0
je 0x140008d93
mov ecx, 8
cmp byte [0x1401cb9fb], 0
je 0x140008d1e
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140008cc3
mov dword [rax], 0x40a00000
mov dword [rax + 4], 0x40a00000
jmp 0x140008cc6
mov rdi, r15
mov ecx, 8
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140008ce7
mov dword [rax], 0x3da3d70a
mov dword [rax + 4], 0x3e99999a
jmp 0x140008cea
mov rbx, r15
lea rdx, str.Fly_Underground
lea rcx, [rbp + 0xa78]
call fcn.140003070
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000a0b0
jmp 0x140008d93
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140008d3a
mov dword [rax], 0x3da3d70a
mov dword [rax + 4], 0x3e99999a
jmp 0x140008d3d
mov rdi, r15
mov ecx, 8
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140008d5e
mov dword [rax], 0x40a00000
mov dword [rax + 4], 0x40a00000
jmp 0x140008d61
mov rbx, r15
lea rdx, str.Fly_Underground
lea rcx, [rbp + 0xa98]
call fcn.140003070
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000abb0
cmp byte [0x1401cb30b], 0
je 0x140008eb9
mov ecx, 0xa
cmp byte [0x1401cb9fc], 0
je 0x140008e38
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140008dd4
mov dword [rax], 0x3fe147ae
mov dword [rax + 4], 0x40400000
mov word [rax + 8], 0x851f
jmp 0x140008dd7
mov rdi, r15
mov ecx, 0xa
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140008dfe
mov dword [rax], 0x3f333333
mov dword [rax + 4], 0x40400000
mov word [rax + 8], 0x851f
jmp 0x140008e01
mov rbx, r15
lea rdx, str.Car_Speed
lea rcx, [rbp + 0xab8]
call fcn.140003070
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000a0b0
jmp 0x140008eb9
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140008e5a
mov dword [rax], 0x3f333333
mov dword [rax + 4], 0x40400000
mov word [rax + 8], 0x851f
jmp 0x140008e5d
mov rdi, r15
mov ecx, 0xa
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140008e84
mov dword [rax], 0x3fe147ae
mov dword [rax + 4], 0x40400000
mov word [rax + 8], 0x851f
jmp 0x140008e87
mov rbx, r15
lea rdx, str.Car_Speed
lea rcx, [rbp + 0xad8]
call fcn.140003070
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000abb0
cmp byte [0x1401cb30c], 0
je 0x140009063
mov ecx, Ordinal_30
cmp byte [0x1401cb9fd], 0
je 0x140008fa0
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140008f1b
mov dword [rax], 0x1303e0a9
mov dword [rax + 4], 0xc24ff4aa
mov dword [rax + 8], 0x1f0040a8
mov dword [rax + 0xc], 0x5f03c0d6
mov dword [rax + 0x10], 0x14ff4d6
mov dword [rax + 0x14], 0x27bfda9
mov dword [rax + 0x18], 0x83fda9
mov byte [rax + 0x1c], 0x91
jmp 0x140008f1e
mov rdi, r15
mov ecx, Ordinal_30
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140008f66
mov dword [rax], 0x1303e0a9
mov dword [rax + 4], 0xc24ff4aa
mov dword [rax + 8], 0x1f0040a8
mov dword [rax + 0xc], 0x1d0ff5d6
mov dword [rax + 0x10], 0x14ff4f8
mov dword [rax + 0x14], 0x27bfda9
mov dword [rax + 0x18], 0x83fda9
mov byte [rax + 0x1c], 0x91
jmp 0x140008f69
mov rbx, r15
lea rdx, str.Alok_Fix
lea rcx, [rbp + 0xaf8]
call fcn.140003070
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000a0b0
jmp 0x140009063
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140008fe3
mov dword [rax], 0x1303e0a9
mov dword [rax + 4], 0xc24ff4aa
mov dword [rax + 8], 0x1f0040a8
mov dword [rax + 0xc], 0x1d0ff5d6
mov dword [rax + 0x10], 0x14ff4f8
mov dword [rax + 0x14], 0x27bfda9
mov dword [rax + 0x18], 0x83fda9
mov byte [rax + 0x1c], 0x91
jmp 0x140008fe6
mov rdi, r15
mov ecx, Ordinal_30
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x14000902e
mov dword [rax], 0x1303e0a9
mov dword [rax + 4], 0xc24ff4aa
mov dword [rax + 8], 0x1f0040a8
mov dword [rax + 0xc], 0x5f03c0d6
mov dword [rax + 0x10], 0x14ff4d6
mov dword [rax + 0x14], 0x27bfda9
mov dword [rax + 0x18], 0x83fda9
mov byte [rax + 0x1c], 0x91
jmp 0x140009031
mov rbx, r15
lea rdx, str.Alok_Fix
lea rcx, [rbp + 0x658]
call fcn.140003070
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000abb0
cmp byte [0x1401cb30d], 0
je 0x1400091c5
mov ecx, reloc.WS2_32.dll_sendto
cmp byte [0x1401cb9fe], 0
je 0x140009126
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x1400090b3
mov dword [rax], 0x2b34c8c
mov dword [rax + 4], 0x2b34a70
mov dword [rax + 8], 0xe3a00000
mov dword [rax + 0xc], 0xe12fff1e
mov dword [rax + 0x10], 0xe24dd010
jmp 0x1400090b6
mov rdi, r15
mov ecx, reloc.WS2_32.dll_sendto
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x1400090ec
mov dword [rax], 0x2b34c8c
mov dword [rax + 4], 0x2b34a70
mov dword [rax + 8], 0xe92d4df0
mov dword [rax + 0xc], 0xe28db018
mov dword [rax + 0x10], 0xe24dd010
jmp 0x1400090ef
mov rbx, r15
lea rdx, str.Running_Medkit
lea rcx, [rbp + 0x678]
call fcn.140003070
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000a0b0
jmp 0x1400091c5
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140009157
mov dword [rax], 0x2b34c8c
mov dword [rax + 4], 0x2b34a70
mov dword [rax + 8], 0xe92d4df0
mov dword [rax + 0xc], 0xe28db018
mov dword [rax + 0x10], 0xe24dd010
jmp 0x14000915a
mov rdi, r15
mov ecx, reloc.WS2_32.dll_sendto
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140009190
mov dword [rax], 0x2b34c8c
mov dword [rax + 4], 0x2b34a70
mov dword [rax + 8], 0xe3a00000
mov dword [rax + 0xc], 0xe12fff1e
mov dword [rax + 0x10], 0xe24dd010
jmp 0x140009193
mov rbx, r15
lea rdx, str.Running_Medkit
lea rcx, [rbp + 0x698]
call fcn.140003070
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000abb0
cmp byte [0x1401cb30e], 0
je 0x1400092ef
mov ecx, ntohs
cmp byte [0x1401cb9ff], 0
je 0x14000926c
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140009207
mov dword [rax], Ordinal_79
mov dword [rax + 4], 0x40a00000
mov dword [rax + 8], 0x40400000
jmp 0x14000920a
mov rdi, r15
mov ecx, ntohs
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140009232
mov dword [rax], Ordinal_79
mov dword [rax + 4], 0x40a00000
mov dword [rax + 8], 0x40800000
jmp 0x140009235
mov rbx, r15
lea rdx, str.Fast_Medkit
lea rcx, [rbp + 0x6b8]
call fcn.140003070
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000a0b0
jmp 0x1400092ef
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x14000928f
mov dword [rax], Ordinal_79
mov dword [rax + 4], 0x40a00000
mov dword [rax + 8], 0x40800000
jmp 0x140009292
mov rdi, r15
mov ecx, ntohs
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x1400092ba
mov dword [rax], Ordinal_79
mov dword [rax + 4], 0x40a00000
mov dword [rax + 8], 0x40400000
jmp 0x1400092bd
mov rbx, r15
lea rdx, str.Fast_Medkit
lea rcx, [rbp + 0x6f8]
call fcn.140003070
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000abb0
cmp byte [0x1401cb30f], 0
je 0x140009425
mov ecx, Ordinal_26
cmp byte [0x1401cba00], 0
je 0x14000939c
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x140009334
mov qword [rax], 0x461c3c00
mov qword [rax + 8], 0
mov qword [rax + 0x10], 0x1000100
jmp 0x140009337
mov rdi, r15
mov ecx, Ordinal_26
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x140009362
mov qword [rax], 0x3e99999a
mov qword [rax + 8], 0
mov qword [rax + 0x10], 0x1000100
jmp 0x140009365
mov rbx, r15
lea rdx, str.Climb_Wall
lea rcx, [rbp + 0x718]
call fcn.140003070
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000a0b0
jmp 0x140009425
call fcn.1400bc080
mov rdi, rax
test rax, rax
je 0x1400093c2
mov qword [rax], 0x3e99999a
mov qword [rax + 8], 0
mov qword [rax + 0x10], 0x1000100
jmp 0x1400093c5
mov rdi, r15
mov ecx, Ordinal_26
call fcn.1400bc080
mov rbx, rax
test rax, rax
je 0x1400093f0
mov qword [rax], 0x461c3c00
mov qword [rax + 8], 0
mov qword [rax + 0x10], 0x1000100
jmp 0x1400093f3
mov rbx, r15
lea rdx, str.Climb_Wall
lea rcx, [rbp + 0x738]
call fcn.140003070
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401cb318]
call fcn.14000abb0
cmp byte [0x1401cb312], 0
je 0x140009443
cmp byte [0x1401cba01], 0
je 0x140009443
lea rcx, [0x1401cb318]
call fcn.140009910
cmp byte [0x1401cb310], 0
je 0x140009461
cmp byte [0x1401cba04], 0
je 0x140009461
lea rcx, [0x1401cb318]
call fcn.1400041f0
cmp byte [0x1401cba02], 0
je 0x1400094e4
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rax
mov edx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
mov qword [rbp + 0xb20], r15
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rax, [rbp + 0xb20]
mov qword [rsp + 0x20], rax
lea r9, [0x1401028b0]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x1401028c0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x14000955b
mov rax, qword [rbp + 0xb20]
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x28]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdx, rax
mov rcx, qword [rbp + 0xb20]
call rbx
mov rcx, qword [rbp + 0xb20]
jmp 0x140009555
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
mov qword [rbp + 0xb18], r15
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rax, [rbp + 0xb18]
mov qword [rsp + 0x20], rax
lea r9, [0x1401028b0]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x1401028c0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x14000955b
mov rax, qword [rbp + 0xb18]
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x20]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdx, rax
mov rcx, qword [rbp + 0xb18]
call rbx
mov rcx, qword [rbp + 0xb18]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov dword [rsp + 0x78], 0x41c80000
movss xmm0, dword [0x1400c1820]
movss dword [rsp + 0x7c], xmm0
lea rcx, [rsp + 0x78]
call fcn.14002ec70
lea rcx, [0x1401cb9a0]
call fcn.14000aba0
mov rcx, rax
call fcn.140057db0
call fcn.14001e800
mov rcx, qword [rbp + 0x12d0]
xor rcx, rsp
call fcn.1400bbf50
lea r11, [rsp + 0x1400]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret