Function at 0x140030440
Capabilities:
Check for foreground window switch
Enumerate processes
Get graphical window text
Log keystrokes via polling
Terminate process

Disassembly:
push rbp
push rbx
push r15
lea rbp, [rsp - 0x500]
sub rsp, 0x600
mov rax, qword [0x140041040]
xor rax, rsp
mov qword [rbp + 0x4f0], rax
lea rax, [0x140031ca0]
mov dword [rbp], 0x50
xor r15d, r15d
mov qword [rbp + 8], rax
xor ecx, ecx
mov qword [rbp + 0x10], r15
mov dword [rbp + 4], 3
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xorps xmm0, xmm0
mov qword [rbp + 0x48], r15
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x20], xmm0
lea rbx, str.Sigma_CS2_Hook
movdqa xmmword [rbp + 0x30], xmm1
lea rcx, [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x40], rbx
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov rax, qword [rbp + 0x18]
mov r9d, 0x80000000
mov rdx, qword [rbp + 0x40]
mov r8, rbx
mov qword [rsp + 0x58], r15
mov ecx, 0x80088
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], 0x320
mov dword [rsp + 0x30], 0x500
mov dword [rsp + 0x28], 0x64
mov dword [rsp + 0x20], 0x64
call qword [sym.imp.USER32.dll_CreateWindowExW]
lea rcx, [rbp + 0x2b0]
mov qword [rbp - 0x4c], r15
mov qword [0x140076550], rax
lea edx, [r15 + 1]
mov qword [rbp - 0x30], rax
xor r9d, r9d
lea rax, [0x140076600]
mov qword [rbp - 0x38], 2
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rax, [rbp - 0x70]
mov qword [rbp - 0x20], 2
mov qword [rsp + 0x50], rax
lea rax, [0x1400765f8]
mov qword [rsp + 0x48], rax
lea rax, [0x1400765f0]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], rcx
xor ecx, ecx
mov qword [rbp - 0x60], r15
mov dword [rbp - 0x50], 0x1c
mov dword [rbp - 0x58], 0x3c
mov dword [rbp - 0x54], 1
mov dword [rbp - 0x3c], 0x20
mov qword [rbp - 0x44], 1
mov qword [rbp - 0x28], 1
mov dword [rbp + 0x2b0], 0xb000
mov dword [rbp + 0x2b4], 0xa000
call qword [sym.imp.d3d11.dll_D3D11CreateDeviceAndSwapChain]
test eax, eax
je 0x1400305f1
call fcn.140031bb0
mov rdx, qword [rbp + 0x18]
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.USER32.dll_UnregisterClassW]
lea eax, [r15 + 1]
jmp 0x14003154b
mov qword [rsp + 0x620], rsi
mov qword [rsp + 0x628], rdi
mov qword [rsp + 0x638], r14
call fcn.140031c30
mov rcx, qword [0x140076550]
mov r9d, 2
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov rcx, qword [0x140076550]
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov rcx, qword [0x140076550]
mov edx, 0xa
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x140076550]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rbx, qword [0x1400764f0]
test rbx, rbx
je 0x14003066f
inc dword [rbx + 0xf4]
mov ecx, 0x6db0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x14003068b
xor edx, edx
mov rcx, rax
call fcn.140001550
jmp 0x14003068e
mov rax, r15
mov qword [0x1400764f0], rax
call fcn.140008e00
test rbx, rbx
je 0x1400306a8
mov qword [0x1400764f0], rbx
jmp 0x1400306af
mov rbx, qword [0x1400764f0]
movaps xmm0, xmmword [0x14003b2f0]
lea rcx, [rbp + 0x68]
movaps xmm1, xmmword [0x14003b2a0]
movups xmmword [rbx + 0x48c8], xmm0
movups xmmword [rbx + 0x48f8], xmm1
mov qword [rbx + 0x4908], r15
mov qword [rbx + 0x4910], r15
movaps xmm0, xmmword [0x14003b320]
movups xmmword [rbx + 0x4948], xmm0
movups xmmword [rbx + 0x4958], xmm0
movups xmmword [rbx + 0x4968], xmm0
movaps xmm1, xmm0
movaps xmm0, xmmword [0x14003b2e0]
movaps xmm1, xmmword [0x14003b2b0]
movups xmmword [rbx + 0x48d8], xmm1
movaps xmm1, xmmword [0x14003b360]
movups xmmword [rbx + 0x4918], xmm0
movups xmmword [rbx + 0x4a18], xmm1
movups xmmword [rbx + 0x4a08], xmm1
movaps xmm0, xmm1
movaps xmm1, xmmword [0x14003b300]
movups xmmword [rbx + 0x49f8], xmm1
mov dword [rbx + 0x4998], 0x3e4ccccd
mov dword [rbx + 0x499c], 0x3e4ccccd
mov qword [rbx + 0x49a0], 0x3e4ccccd
mov dword [rbx + 0x49a8], 0x3e4ccccd
mov dword [rbx + 0x49ac], 0x3e4ccccd
mov qword [rbx + 0x49b0], 0x3e4ccccd
movaps xmm0, xmmword [0x14003b330]
movaps xmm1, xmmword [0x14003b340]
movups xmmword [rbx + 0x4ab8], xmm0
movaps xmm0, xmmword [0x14003b350]
movups xmmword [rbx + 0x4ad8], xmm0
movups xmmword [rbx + 0x4ac8], xmm1
mov dword [rbx + 0x4ae8], 0x3dcccccd
mov dword [rbx + 0x4aec], 0x3dcccccd
mov dword [rbx + 0x4af0], 0x3dcccccd
mov dword [rbx + 0x4af4], 0x3f800000
mov dword [rbx + 0x4af8], 0x3e4ccccd
mov dword [rbx + 0x4afc], 0x3e4ccccd
mov dword [rbx + 0x4b00], 0x3e4ccccd
mov dword [rbx + 0x4b04], 0x3f800000
mov rsi, qword [0x140076550]
mov qword [rbx + 0x47f0], 0x41000000
mov dword [rbx + 0x480c], 0x41000000
mov dword [rbx + 0x4810], 0x3f000000
mov dword [rbx + 0x4824], 0x41000000
mov dword [rbx + 0x4854], r15d
mov dword [rbx + 0x4858], 0x40400000
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14003096a
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14003096a
mov rax, qword [0x1400764f0]
test rax, rax
je 0x140030869
inc dword [rax + 0xf4]
mov ecx, 0x48
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x140030896
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
mov qword [rdi + 0x40], rax
jmp 0x140030899
mov rdi, r15
or dword [rbx + 0xc], 6
lea rax, [0x14003ace8]
mov qword [rbx + 0x88], rax
mov qword [rbx + 0x98], rdi
mov rbx, r15
mov qword [rdi], rsi
mov rax, qword [rbp + 0x68]
mov qword [rdi + 0x20], rax
mov rax, qword [rbp + 0x60]
mov qword [rdi + 0x18], rax
mov rax, qword [0x1400764f0]
mov dword [rdi + 0x28], 9
mov rcx, qword [rax + 0x5860]
mov rax, qword [rcx]
mov qword [rax + 0x28], rsi
lea rax, str.xinput1_4.dll
mov qword [rbp - 0x60], rax
lea rax, str.xinput1_3.dll
mov qword [rbp - 0x58], rax
lea rax, str.xinput9_1_0.dll
mov qword [rbp - 0x50], rax
lea rax, str.xinput1_2.dll
mov qword [rbp - 0x48], rax
lea rax, str.xinput1_1.dll
mov qword [rbp - 0x40], rax
mov byte [rdi + 0x2d], 1
nop
mov rcx, qword [rbp + rbx*8 - 0x60]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x14003093e
inc rbx
cmp rbx, 5
jl 0x140030920
jmp 0x14003096a
lea rdx, str.XInputGetCapabilities
mov qword [rdi + 0x30], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.XInputGetState
mov rcx, rsi
mov qword [rdi + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x40], rax
mov rdi, qword [0x1400764f0]
mov r14, qword [0x140076600]
mov rsi, qword [0x1400765f8]
test rdi, rdi
je 0x14003098a
inc dword [rdi + 0xf4]
mov ecx, 0x78
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x1400309cb
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
mov dword [rax + 0x70], 0x1388
mov dword [rax + 0x74], 0x2710
jmp 0x1400309ce
mov rbx, r15
or dword [rdi + 0xc], 8
lea rax, str.imgui_impl_dx11
mov qword [rdi + 0x90], rax
lea r8, [rbp - 0x70]
mov qword [rdi + 0xa0], rbx
lea rdx, [0x14003acb8]
mov rax, qword [rsi]
mov rcx, rsi
mov qword [rbp - 0x70], r15
mov qword [rbp + 0x2b0], r15
mov qword [rbp - 0x68], r15
call qword [rax]
test eax, eax
jne 0x140030a54
mov rcx, qword [rbp - 0x70]
lea r8, [rbp + 0x2b0]
lea rdx, [0x14003acc8]
mov rax, qword [rcx]
call qword [rax + 0x30]
test eax, eax
jne 0x140030a54
mov rcx, qword [rbp + 0x2b0]
lea r8, [rbp - 0x68]
lea rdx, [0x14003acd8]
mov rax, qword [rcx]
call qword [rax + 0x30]
test eax, eax
jne 0x140030a54
mov qword [rbx], rsi
mov qword [rbx + 8], r14
mov rax, qword [rbp - 0x68]
mov qword [rbx + 0x10], rax
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140030a63
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x2b0]
test rcx, rcx
je 0x140030a75
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rbx + 8]
mov rax, qword [rcx]
call qword [rax + 8]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
lea rdx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rbp + 0xa0]
mov dword [rbp + 0xa0], 0x130
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140030b00
nop word [rax + rax]
lea rdx, str.cs2.exe
lea rcx, [rbp + 0xcc]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x140030cbd
lea rdx, [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140030ad0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r15d
cmp eax, dword [rbp - 0x70]
jne 0x140030a88
mov qword [rsp + 0x630], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x140076560], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [0x140076568], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
mov qword [0x140076570], rax
lea rdx, [rbp + 0x50]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [rbp + 0x50]
mov r8d, dword [rbp + 0x5c]
mov ecx, dword [rbp + 0x54]
mov r9d, dword [rbp + 0x58]
mov eax, r9d
sub eax, edx
mov dword [0x140076588], edx
mov dword [0x140076580], eax
lea rdx, [rbp + 0x2d0]
mov eax, r8d
mov dword [0x140076590], ecx
sub eax, ecx
mov dword [0x140076594], r8d
mov rcx, qword [0x140076570]
mov r8d, 0x104
mov dword [0x140076584], eax
mov dword [0x14007658c], r9d
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rcx, qword [0x140076570]
lea rax, [rbp + 0x2d0]
mov r8d, 0x104
mov qword [0x140076598], rax
lea rdx, [rbp + 0x3e0]
call qword [sym.imp.USER32.dll_GetClassNameA]
mov rcx, qword [0x140076568]
lea rax, [rbp + 0x3e0]
mov r9d, 0x104
mov qword [0x1400765a0], rax
lea r8, [rbp + 0xa0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
lea rax, [rbp + 0xa0]
lea rcx, [rbp + 0x1d0]
mov qword [0x1400765a8], rax
call fcn.140031570
cmp byte [0x1400410c5], r15b
mov byte [rbp + 0x1d3], 1
je 0x1400313ec
movabs rdi, 0x4e94914effff
movabs rsi, 0x431bde82d7b634db
movabs r12, 0x7fffffffffb3b4be
movabs r14, 0x7fffffffffffffff
lea rcx, [rsp + 0x70]
call fcn.140030360
mov rax, qword [rsp + 0x70]
lea rbx, [rax + 0x4c4b40]
cmp rax, r12
jle 0x140030c70
mov rbx, r14
nop
lea rcx, [rsp + 0x78]
call fcn.140030360
mov rax, qword [rsp + 0x78]
cmp rbx, rax
je 0x140030cda
jl 0x140030cda
mov rcx, rbx
sub rcx, rax
cmp rcx, rdi
jg 0x140030cce
mov rax, rsi
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140030cb4
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x140030c70
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0xa8]
jmp 0x140030b0c
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x140030c70
xorps xmm0, xmm0
movups xmmword [0x140075df8], xmm0
movups xmmword [0x140075e08], xmm0
movups xmmword [0x140075e18], xmm0
mov rdx, qword [0x140076550]
lea rcx, [0x140075df8]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140030d32
lea rcx, [0x140075df8]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [0x140075df8]
call qword [sym.imp.USER32.dll_DispatchMessageA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, qword [0x140076570]
cmp rax, rcx
jne 0x140030d81
mov edx, 3
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindow]
mov rcx, qword [0x140076550]
xor r9d, r9d
mov dword [rsp + 0x30], 3
mov rdx, rax
mov dword [rsp + 0x28], r15d
xor r8d, r8d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, qword [0x140076570]
xorps xmm0, xmm0
mov qword [rbp - 0x70], r15
lea rdx, [rbp + 0x50]
movups xmmword [rbp + 0x50], xmm0
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [0x140076570]
lea rdx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [rbp - 0x70]
mov rcx, qword [0x140076570]
mov dword [rbp + 0x50], eax
mov eax, dword [rbp - 0x6c]
mov dword [rbp + 0x54], eax
mov rax, qword [0x1400764f0]
mov qword [rax + 0xd0], rcx
mov edx, dword [rbp + 0x50]
cmp edx, dword [0x140076618]
mov eax, dword [rbp + 0x5c]
mov r9d, dword [rbp + 0x58]
jne 0x140030df8
cmp r9d, dword [0x140076620]
jne 0x140030df8
mov r8d, dword [rbp + 0x54]
cmp r8d, dword [0x14007661c]
jne 0x140030df8
cmp eax, dword [0x140076624]
je 0x140030e53
movups xmm0, xmmword [rbp + 0x50]
mov r8d, dword [rbp - 0x70]
xor edx, edx
mov rcx, qword [0x140076550]
mov dword [rsp + 0x30], 8
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r9d
mov dword [0x140076580], r9d
mov dword [0x140075dd0], r9d
mov r9d, dword [rbp - 0x6c]
movups xmmword [0x140076618], xmm0
mov dword [0x140076584], eax
mov dword [0x140075dd4], eax
call qword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [rbp + 0x5c]
mov r9d, dword [rbp + 0x58]
mov r8d, dword [rbp + 0x54]
mov edx, dword [rbp + 0x50]
mov rcx, qword [0x140076550]
sub eax, r8d
sub r9d, edx
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_MoveWindow]
lea rcx, [rbp + 0x2d0]
call fcn.140031570
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rbp - 0x60]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140030edf
nop dword [rax]
lea rcx, [rbp - 0x60]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x60]
call qword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [rbp - 0x58], 0x12
jne 0x140030ec1
mov byte [0x1400410c5], r15b
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rbp - 0x60]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x140030ea0
cmp byte [0x1400410c5], r15b
je 0x1400313d3
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140030fdb
cmp byte [rbp + 0x2d0], r15b
je 0x140030fdb
mov rdx, qword [rbp + 0x2e0]
lea r8, [rbp + 0x70]
mov rcx, qword [0x1400765b8]
add rdx, 0x1f8
mov r9d, 8
mov qword [rbp + 0x70], 0x101
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x1400764e9], r15b
jne 0x140030f9c
cmp byte [rbp + 0x311], r15b
je 0x140030fdb
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140031ec0
mov rdx, qword [0x1400765b0]
lea r8, [rbp + 0x78]
mov rcx, qword [0x1400765b8]
add rdx, 0x17cc530
mov r9d, 8
mov qword [rbp + 0x78], 0x10001
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x1400764e9], 1
jmp 0x140030fdb
mov rdx, qword [0x1400765b0]
lea r8, [rbp + 0x80]
mov rcx, qword [0x1400765b8]
add rdx, 0x17cc530
mov r9d, 8
mov qword [rbp + 0x80], 0x100
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x1400764e9], r15b
cmp byte [rbp + 0x2d1], r15b
je 0x140031018
mov rdx, qword [rbp + 0x2e0]
lea r8, [rbp + 0x88]
mov rcx, qword [0x1400765b8]
add rdx, 0x135c
mov r9d, 8
mov qword [rbp + 0x88], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [0x1400410c0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140031036
cmp byte [0x1400410c4], r15b
sete byte [0x1400410c4]
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14003104c
mov byte [0x1400410c5], r15b
mov rax, qword [0x1400764f0]
test rax, rax
je 0x140031061
mov rcx, qword [rax + 0xa0]
jmp 0x140031064
mov rcx, r15
cmp qword [rcx + 0x48], r15
jne 0x14003106f
call fcn.140029df0
call fcn.14002ac20
call fcn.140007b60
mov rax, qword [0x1400764f0]
lea rcx, str.Image
xor edx, edx
or dword [rax + 0x5760], 3
lea r8d, [rdx + 1]
mov dword [rax + 0x5780], 0x43480000
mov dword [rax + 0x5784], 0x43480000
mov dword [rax + 0x5768], 1
mov dword [rax + 0x5770], 0x44c80000
mov qword [rax + 0x5774], 0x42c80000
mov dword [rax + 0x577c], r15d
mov dword [rax + 0x5764], 1
call fcn.14000d690
mov rcx, qword [0x1400765f8]
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x30], r15
lea rdx, [0x1400410d0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov r8d, 0x34c87
mov qword [rsp + 0x20], r15
mov qword [rbp + 0x2b0], r15
mov qword [rbp - 0x10], r15
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateTextureFromMemory]
test eax, eax
js 0x140031147
mov rcx, qword [0x1400765f8]
lea r9, [rbp - 0x10]
mov rdx, qword [rbp + 0x2b0]
xor r8d, r8d
mov rax, qword [rcx]
call qword [rax + 0x38]
mov rcx, qword [rbp + 0x2b0]
mov rax, qword [rcx]
call qword [rax + 0x10]
movaps xmm1, xmmword [0x14003b370]
lea rax, [rbp + 0x88]
mov rcx, qword [rbp - 0x10]
lea r9, [rbp - 0x68]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x60]
lea rax, [rbp - 0x80]
mov dword [rbp - 0x68], 0x3f800000
xorps xmm0, xmm0
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x68]
mov dword [rbp - 0x64], 0x3f800000
movups xmmword [rbp + 0x88], xmm0
mov qword [rsp + 0x60], r15
movups xmmword [rbp - 0x80], xmm1
mov dword [rsp + 0x68], 0x43480000
mov dword [rsp + 0x6c], 0x43480000
call fcn.14002f190
cmp byte [0x1400410c4], r15b
je 0x14003132c
xor r8d, r8d
lea rcx, str.Sigma_Overlay_dx11
xor edx, edx
call fcn.14000d690
lea r8, [rbp + 0x60]
mov qword [rbp + 0x60], r15
call fcn.1400058b0
lea rdx, [rbp + 0x2d2]
lea rcx, [0x14003b014]
call fcn.14002f600
lea rdx, [rbp + 0x2d0]
lea rcx, str.Bhop
call fcn.14002f600
lea rdx, [rbp + 0x2d1]
lea rcx, str.No_Flash
call fcn.14002f600
lea rdx, [rbp + 0x2d3]
lea rcx, str.Debug_Info_Window
call fcn.14002f600
lea rdx, [rbp + 0x68]
mov qword [rbp + 0x68], r15
call fcn.14002e390
test al, al
jne 0x140031401
cmp byte [rbp + 0x2d3], r15b
je 0x14003132c
mov rax, qword [0x1400764f0]
lea rcx, str.Debug_Information
xor r8d, r8d
xor edx, edx
or dword [rax + 0x5760], 3
mov dword [rax + 0x5780], 0x43960000
mov dword [rax + 0x5784], 0x43960000
mov dword [rax + 0x5768], 1
mov dword [rax + 0x5770], 0x44a28000
mov qword [rax + 0x5774], 0x43480000
mov dword [rax + 0x577c], r15d
mov dword [rax + 0x5764], 1
call fcn.14000d690
cmp qword [rbp + 0x2d8], r15
je 0x1400312bc
lea rcx, str.VALID_HWND_Handle
call fcn.14002d990
cmp qword [rbp + 0x340], 0xf
lea rcx, [rbp + 0x328]
cmova rcx, qword [rbp + 0x328]
call fcn.14002d990
cmp qword [rbp + 0x360], 0xf
lea rcx, [rbp + 0x348]
cmova rcx, qword [rbp + 0x348]
call fcn.14002d990
cmp qword [rbp + 0x380], 0xf
lea rcx, [rbp + 0x368]
cmova rcx, qword [rbp + 0x368]
call fcn.14002d990
cmp qword [rbp + 0x3a0], 0xf
lea rcx, [rbp + 0x388]
cmova rcx, qword [rbp + 0x388]
call fcn.14002d990
call fcn.14000fa00
call fcn.14000a800
mov rcx, qword [0x140076600]
lea r8, [0x1400765e8]
movaps xmm0, xmmword [0x14003b2c0]
xor r9d, r9d
movups xmmword [rbp + 0x2b8], xmm0
mov rax, qword [rcx]
lea edx, [r9 + 1]
call qword [rax + pe_nt_image_headers64]
mov rcx, qword [0x140076600]
lea r8, [rbp + 0x2b8]
mov rdx, qword [0x1400765e8]
mov rax, qword [rcx]
call qword [rax + 0x190]
mov rax, qword [0x1400764f0]
mov rcx, qword [rax + 0x5860]
mov rax, qword [rcx]
mov rcx, r15
add rax, 0x48
cmp byte [rax], r15b
cmovne rcx, rax
call fcn.140029390
mov rcx, qword [0x1400765f0]
xor r8d, r8d
mov rax, qword [rcx]
lea edx, [r8 + 1]
call qword [rax + 0x40]
lea rcx, [rbp + 0x2d0]
call fcn.140031a40
cmp dword [0x140075e00], 0x12
jne 0x140030cf2
jmp 0x1400313df
lea rcx, [rbp + 0x2d0]
call fcn.140031a40
cmp byte [0x1400410c5], r15b
jne 0x140030c50
mov rdi, qword [0x1400764f0]
test rdi, rdi
je 0x14003140a
mov rbx, qword [rdi + 0xa0]
jmp 0x14003140d
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rbx, r15
call fcn.14002a330
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140031421
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14003142f
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14003143e
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, qword [0x1400764f0]
mov qword [rdi + 0x90], r15
mov qword [rdi + 0xa0], r15
test rax, rax
je 0x14003145e
dec dword [rax + 0xf4]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [0x1400764f0]
test rax, rax
je 0x14003147c
mov rbx, qword [rax + 0x98]
jmp 0x14003147f
mov rbx, r15
mov rcx, qword [rbx + 0x30]
lea rdi, [rax + 8]
test rcx, rcx
je 0x140031499
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [0x1400764f0]
mov qword [rdi + 0x80], r15
mov qword [rdi + 0x90], r15
test rax, rax
je 0x1400314b2
dec dword [rax + 0xf4]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [0x1400764f0]
mov qword [0x1400764f0], rbx
call fcn.1400091e0
mov qword [0x1400764f0], r15
test rbx, rbx
je 0x1400314fd
mov rcx, rbx
call fcn.1400190e0
mov rax, qword [0x1400764f0]
test rax, rax
je 0x1400314f4
dec dword [rax + 0xf4]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call fcn.140031bb0
mov rcx, qword [0x140076550]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0x18]
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.USER32.dll_UnregisterClassW]
lea rcx, [rbp + 0x1d0]
call fcn.140031a40
mov r12, qword [rsp + 0x630]
xor eax, eax
mov rdi, qword [rsp + 0x628]
mov rsi, qword [rsp + 0x620]
mov r14, qword [rsp + 0x638]
mov rcx, qword [rbp + 0x4f0]
xor rcx, rsp
call fcn.1400323a0
add rsp, 0x600
pop r15
pop rbx
pop rbp
ret