Function at 0x14004e770
Capabilities:
Create thread
Execute command
Self delete
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
mov rax, qword [0x140086040]
xor rax, rsp
mov qword [rbp + 0x17], rax
xor esi, esi
cmp byte [0x1401339e0], sil
je 0x14004f96e
movss xmm0, dword [0x140133b08]
movss xmm1, dword [0x140133b0c]
mov rcx, qword [0x140135308]
mov eax, dword [rcx + 0x1dc0]
or eax, 1
mov dword [rcx + 0x1dc0], eax
movss dword [rcx + 0x1dd4], xmm0
movss dword [rcx + 0x1dd8], xmm1
mov qword [rcx + 0x1ddc], rsi
mov dword [rcx + 0x1dc4], 2
mov byte [rcx + 0x1dfc], 1
movss xmm0, dword [0x140133b10]
movss xmm1, dword [0x140133b14]
movss dword [rcx + 0x1de4], xmm0
movss dword [rcx + 0x1de8], xmm1
mov dword [rcx + 0x1dc8], 1
or eax, 0x42
mov dword [rcx + 0x1dc0], eax
mov dword [rcx + 0x1e20], 0x3f800000
movss xmm1, dword [0x14007bae8]
lea ecx, [rsi + 0xb]
call fcn.1400083e0
xorps xmm1, xmm1
lea ecx, [rsi + 3]
call fcn.1400083e0
movss xmm1, dword [0x14007bae8]
lea ecx, [rsi + 0x14]
call fcn.1400083e0
movss xmm1, dword [0x14007ba88]
lea ecx, [rsi + 0x15]
call fcn.1400083e0
mov r8d, 0x13b
lea rdx, [0x1401339e0]
lea rcx, [0x14007adf0]
call fcn.140012610
call fcn.14004e560
mov rbx, qword [0x140135308]
lea rcx, [rbx + 0x1e80]
movss xmm1, dword [rbx + 0x1680]
movss xmm0, dword [rbx + 0x1684]
mov dword [rbp - 9], 0xd
movss dword [rbp - 5], xmm1
movss dword [rbp - 1], xmm0
lea rdx, [rbp - 9]
call fcn.1400280b0
mov dword [rbx + 0x1680], 0x42480000
mov dword [rbx + 0x1684], 0x41a00000
mov rbx, qword [0x140135308]
mov rax, qword [rbx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rbx + 0x1d18]
movss xmm7, dword [0x14007bb64]
cmp byte [rax + 0xd4], sil
jne 0x14004e92d
mov qword [rbp - 9], rsi
movaps xmm1, xmm7
lea rcx, [rbp - 9]
call fcn.140016180
mov rbx, qword [0x140135308]
movsxd rax, dword [rbx + 0x1e80]
lea rcx, [rax + rax*2]
mov rdx, qword [rbx + 0x1e88]
movsxd rax, dword [rdx + rcx*4 - 0xc]
lea r9, [rax + rax*2]
lea rdi, [0x140053350]
mov r8d, dword [rdi + r9*4 + 8]
cmp dword [rdi + r9*4], 8
jne 0x14004e990
mov eax, dword [rdi + r9*4 + 4]
cmp eax, 1
jne 0x14004e973
mov eax, dword [rdx + rcx*4 - 8]
mov dword [r8 + rbx + 0x1638], eax
jmp 0x14004e990
cmp eax, 2
jne 0x14004e990
mov eax, dword [rdx + rcx*4 - 8]
mov dword [r8 + rbx + 0x1638], eax
mov eax, dword [rdx + rcx*4 - 4]
mov dword [r8 + rbx + 0x163c], eax
dec dword [rbx + 0x1e80]
movaps xmm6, xmmword [0x14007bd10]
mov dword [rbp - 0x29], esi
movups xmm0, xmmword [rbx + 0x16fc]
movups xmmword [rbp - 0x25], xmm0
lea rcx, [rbx + 0x1e70]
lea rdx, [rbp - 0x29]
call fcn.1400281a0
movups xmmword [rbx + 0x16fc], xmm6
mov rbx, qword [0x140135308]
lea rcx, [rbx + 0x1e80]
movss xmm1, dword [rbx + 0x1670]
movss xmm0, dword [rbx + 0x1674]
mov dword [rbp - 9], 0xa
movss dword [rbp - 5], xmm1
movss dword [rbp - 1], xmm0
lea rdx, [rbp - 9]
call fcn.1400280b0
mov dword [rbx + 0x1670], 0x42480000
mov dword [rbx + 0x1674], 0x40a00000
mov rbx, qword [0x140135308]
lea rcx, [rbx + 0x1e80]
movss xmm1, dword [rbx + 0x1680]
movss xmm0, dword [rbx + 0x1684]
mov dword [rbp - 9], 0xd
movss dword [rbp - 5], xmm1
movss dword [rbp - 1], xmm0
lea rdx, [rbp - 9]
call fcn.1400280b0
mov dword [rbx + 0x1680], 0x42480000
mov dword [rbx + 0x1684], 0x3f800000
mov rcx, qword [0x140135308]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm1, dword [rax + 0x50]
subss xmm1, dword [rax + 0x9c]
movss xmm8, dword [0x14007bb00]
addss xmm1, xmm8
movss dword [rax + 0x118], xmm1
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm1
movss dword [rax + 0x130], xmm0
mov dword [rbp + 7], 0x14
mov dword [rbp - 9], esi
lea rax, str.Min_cps:__d
mov qword [rsp + 0x28], rax
lea rax, [rbp + 7]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 9]
lea r8, [0x1401338c4]
lea rcx, str.Min_Cps
call fcn.140041950
mov rcx, qword [0x140135308]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm1, dword [rax + 0x50]
subss xmm1, dword [rax + 0x9c]
addss xmm1, xmm8
movss dword [rax + 0x118], xmm1
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm1
movss dword [rax + 0x130], xmm0
mov dword [rbp - 9], 0x14
mov dword [rbp + 7], esi
lea rax, str.Max_cps:__d
mov qword [rsp + 0x28], rax
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 7]
lea r8, [0x1401338c8]
lea rcx, str.Max_Cps
call fcn.140041950
mov rcx, qword [0x140135308]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm1, dword [rax + 0x50]
subss xmm1, dword [rax + 0x9c]
addss xmm1, xmm8
movss dword [rax + 0x118], xmm1
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm1
movss dword [rax + 0x130], xmm0
mov dword [rbp - 9], 0xa
mov dword [rbp + 7], 1
lea rax, str.Jitter_Strenght:__d
mov qword [rsp + 0x28], rax
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 7]
lea r8, [0x1401338d0]
lea rcx, str.Jitter_Strenght
call fcn.140041950
mov rbx, qword [0x140135308]
lea r8, [rbx + 0x1e80]
movsxd rax, dword [r8]
lea rcx, [rax + rax*2]
mov rdx, qword [r8 + 8]
movsxd rax, dword [rdx + rcx*4 - 0xc]
lea rax, [rax + rax*2]
mov r9d, dword [rdi + rax*4 + 8]
cmp dword [rdi + rax*4], 8
jne 0x14004ec48
mov eax, dword [rdi + rax*4 + 4]
cmp eax, 1
jne 0x14004ec2b
mov eax, dword [rdx + rcx*4 - 8]
mov dword [r9 + rbx + 0x1638], eax
jmp 0x14004ec48
cmp eax, 2
jne 0x14004ec48
mov eax, dword [rdx + rcx*4 - 8]
mov dword [r9 + rbx + 0x1638], eax
mov eax, dword [rdx + rcx*4 - 4]
mov dword [r9 + rbx + 0x163c], eax
movsxd rcx, dword [r8]
lea eax, [rcx - 1]
mov dword [r8], eax
lea rax, [rcx - 2]
lea rcx, [rax + rax*2]
mov rdx, qword [r8 + 8]
movsxd rax, dword [rdx + rcx*4]
lea r10, [rax + rax*2]
mov r9d, dword [rdi + r10*4 + 8]
cmp dword [rdi + r10*4], 8
jne 0x14004eca6
mov eax, dword [rdi + r10*4 + 4]
cmp eax, 1
jne 0x14004ec89
mov eax, dword [rdx + rcx*4 + 4]
mov dword [r9 + rbx + 0x1638], eax
jmp 0x14004eca6
cmp eax, 2
jne 0x14004eca6
mov eax, dword [rdx + rcx*4 + 4]
mov dword [r9 + rbx + 0x1638], eax
mov eax, dword [rdx + rcx*4 + 8]
mov dword [r9 + rbx + 0x163c], eax
dec dword [r8]
movsxd rax, dword [rbx + 0x1e70]
lea rdx, [rax + rax*4]
mov rcx, qword [rbx + 0x1e78]
movsxd rax, dword [rcx + rdx*4 - 0x14]
add rax, rax
movups xmm0, xmmword [rcx + rdx*4 - 0x10]
movups xmmword [rbx + rax*8 + 0x16fc], xmm0
dec dword [rbx + 0x1e70]
movss xmm1, dword [rbx + 0x1670]
movss xmm0, dword [rbx + 0x1674]
mov dword [rbp - 9], 0xa
movss dword [rbp - 5], xmm1
movss dword [rbp - 1], xmm0
lea rdx, [rbp - 9]
mov rcx, r8
call fcn.1400280b0
mov dword [rbx + 0x1670], 0x41200000
mov dword [rbx + 0x1674], 0x41200000
mov rbx, qword [0x140135308]
lea rcx, [rbx + 0x1e80]
movss xmm1, dword [rbx + 0x1680]
movss xmm0, dword [rbx + 0x1684]
mov dword [rbp - 9], 0xd
movss dword [rbp - 5], xmm1
movss dword [rbp - 1], xmm0
lea rdx, [rbp - 9]
call fcn.1400280b0
mov dword [rbx + 0x1680], 0x42480000
mov dword [rbx + 0x1684], 0x41a00000
mov rbx, qword [0x140135308]
mov rax, qword [rbx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rbx + 0x1d18]
cmp byte [rax + 0xd4], sil
jne 0x14004ed9f
mov qword [rbp - 9], rsi
movaps xmm1, xmm7
lea rcx, [rbp - 9]
call fcn.140016180
mov rbx, qword [0x140135308]
mov rax, qword [rbx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rbx + 0x1d18]
movss xmm1, dword [rax + 0x50]
subss xmm1, dword [rax + 0x9c]
addss xmm1, xmm8
movss dword [rax + 0x118], xmm1
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm1
movss dword [rax + 0x130], xmm0
movaps xmm6, xmmword [0x14007bd10]
mov dword [rbp - 0x29], esi
movups xmm0, xmmword [rbx + 0x16fc]
movups xmmword [rbp - 0x25], xmm0
lea rcx, [rbx + 0x1e70]
lea rdx, [rbp - 0x29]
call fcn.1400281a0
movups xmmword [rbx + 0x16fc], xmm6
mov qword [rbp - 9], rsi
lea rdx, [rbp - 9]
lea r14, str.Bind:_R
mov rcx, r14
call fcn.14004d450
lea rbx, [0x140005b20]
test al, al
je 0x14004eeba
mov ecx, 0x20
call fcn.14004fee0
lea rcx, [0x1401339d6]
mov qword [rax], rcx
lea rcx, str.Bind:
mov qword [rax + 8], rcx
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], rbx
mov qword [rbp - 9], rax
lea rcx, [rbp + 0xf]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x14004fd10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 7], rax
test rax, rax
je 0x14004f1df
cmp dword [rbp + 0xf], 0
je 0x14004f1d3
movaps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp - 0x29], xmm0
lea rcx, [rbp - 0x29]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14004f1d3
xorps xmm0, xmm0
movdqa xmmword [rbp + 7], xmm0
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.140016560
mov r8, qword [0x140135308]
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
movss xmm0, dword [rax + 0x54]
subss xmm0, dword [rax + 0xa0]
movss xmm2, dword [rax + 0x50]
subss xmm2, dword [rax + 0x9c]
addss xmm0, dword [0x14007bb20]
addss xmm2, dword [0x14007bb28]
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
mov qword [rbp - 9], 0
lea rdx, [rbp - 9]
lea r14, str.Hide_Bind:_F7
mov rcx, r14
call fcn.14004d450
test al, al
je 0x14004efec
mov ecx, 0x20
call fcn.14004fee0
lea rcx, [0x140133af8]
mov qword [rax], rcx
lea rcx, str.Hide_Bind:
mov qword [rax + 8], rcx
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], rbx
mov qword [rbp + 7], rax
lea rcx, [rbp - 0x21]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x14004fd10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x29], rax
test rax, rax
je 0x14004f1fa
cmp dword [rbp - 0x21], 0
je 0x14004f1ee
movaps xmm0, xmmword [rbp - 0x29]
movdqa xmmword [rbp + 7], xmm0
lea rcx, [rbp + 7]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14004f1ee
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x29], xmm0
mov r8, qword [0x140135308]
movsxd rax, dword [r8 + 0x1e70]
lea rdx, [rax + rax*4]
mov rcx, qword [r8 + 0x1e78]
movsxd rax, dword [rcx + rdx*4 - 0x14]
add rax, rax
movups xmm0, xmmword [rcx + rdx*4 - 0x10]
movups xmmword [r8 + rax*8 + 0x16fc], xmm0
dec dword [r8 + 0x1e70]
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
movss xmm1, dword [rax + 0x50]
subss xmm1, dword [rax + 0x9c]
addss xmm1, xmm8
movss dword [rax + 0x118], xmm1
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm1
movss dword [rax + 0x130], xmm0
lea rdx, [0x1401338cc]
lea rcx, str.Toggle
call fcn.14004df20
mov rcx, qword [0x140135308]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm1, dword [rax + 0x50]
subss xmm1, dword [rax + 0x9c]
addss xmm1, xmm8
movss dword [rax + 0x118], xmm1
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm1
movss dword [rax + 0x130], xmm0
lea rdx, [0x1401339d4]
lea rcx, str.Break_Blocks
call fcn.14004df20
mov rcx, qword [0x140135308]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm1, dword [rax + 0x50]
subss xmm1, dword [rax + 0x9c]
addss xmm1, xmm8
movss dword [rax + 0x118], xmm1
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm1
movss dword [rax + 0x130], xmm0
lea rdx, [0x1401338cd]
lea rcx, str.Jitter
call fcn.14004df20
mov rcx, qword [0x140135308]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm1, dword [rax + 0x50]
subss xmm1, dword [rax + 0x9c]
addss xmm1, xmm8
movss dword [rax + 0x118], xmm1
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm1
movss dword [rax + 0x130], xmm0
lea rdx, [0x1401338d4]
lea rcx, str.Only_minecraft_window
call fcn.14004df20
mov rbx, qword [0x140135308]
movsxd rax, dword [rbx + 0x1e80]
lea rcx, [rax + rax*2]
mov rdx, qword [rbx + 0x1e88]
movsxd rax, dword [rdx + rcx*4 - 0xc]
lea rax, [rax + rax*2]
mov r8d, dword [rdi + rax*4 + 8]
cmp dword [rdi + rax*4], 8
jne 0x14004f226
mov eax, dword [rdi + rax*4 + 4]
cmp eax, 1
jne 0x14004f209
mov eax, dword [rdx + rcx*4 - 8]
mov dword [r8 + rbx + 0x1638], eax
jmp 0x14004f226
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0xf], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x21], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
cmp eax, 2
jne 0x14004f226
mov eax, dword [rdx + rcx*4 - 8]
mov dword [r8 + rbx + 0x1638], eax
mov eax, dword [rdx + rcx*4 - 4]
mov dword [r8 + rbx + 0x163c], eax
movsxd rcx, dword [rbx + 0x1e80]
lea eax, [rcx - 1]
mov dword [rbx + 0x1e80], eax
lea rax, [rcx - 2]
lea rcx, [rax + rax*2]
mov rdx, qword [rbx + 0x1e88]
movsxd rax, dword [rdx + rcx*4]
lea r9, [rax + rax*2]
mov r8d, dword [rdi + r9*4 + 8]
cmp dword [rdi + r9*4], 8
jne 0x14004f28e
mov eax, dword [rdi + r9*4 + 4]
cmp eax, 1
jne 0x14004f271
mov eax, dword [rdx + rcx*4 + 4]
mov dword [r8 + rbx + 0x1638], eax
jmp 0x14004f28e
cmp eax, 2
jne 0x14004f28e
mov eax, dword [rdx + rcx*4 + 4]
mov dword [r8 + rbx + 0x1638], eax
mov eax, dword [rdx + rcx*4 + 8]
mov dword [r8 + rbx + 0x163c], eax
dec dword [rbx + 0x1e80]
mov eax, dword [0x1401338c4]
cmp eax, dword [0x1401338c8]
jle 0x14004f2a8
mov dword [0x1401338c8], eax
movaps xmm6, xmmword [0x14007bd10]
mov dword [rbp - 0x29], esi
movups xmm0, xmmword [rbx + 0x16fc]
movups xmmword [rbp - 0x25], xmm0
lea rcx, [rbx + 0x1e70]
lea rdx, [rbp - 0x29]
call fcn.1400281a0
movups xmmword [rbx + 0x16fc], xmm6
mov rbx, qword [0x140135308]
mov rax, qword [rbx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rbx + 0x1d18]
movss xmm0, dword [rax + 0x50]
subss xmm0, dword [rax + 0x9c]
movss xmm2, dword [rax + 0x54]
subss xmm2, dword [rax + 0xa0]
addss xmm0, dword [0x14007bb38]
addss xmm2, dword [0x14007bae0]
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
movss xmm1, dword [rbx + 0x1670]
movss xmm0, dword [rbx + 0x1674]
mov dword [rbp - 9], 0xa
movss dword [rbp - 5], xmm1
movss dword [rbp - 1], xmm0
lea rcx, [rbx + 0x1e80]
lea rdx, [rbp - 9]
call fcn.1400280b0
mov dword [rbx + 0x1670], 0x41200000
mov dword [rbx + 0x1674], 0x40a00000
mov qword [rbp - 9], 0
lea rdx, [rbp - 9]
call fcn.14003f090
test al, al
je 0x14004f3b3
mov byte [0x1401339e0], 0
mov r8, qword [0x140135308]
movsxd rax, dword [r8 + 0x1e70]
lea rdx, [rax + rax*4]
mov rcx, qword [r8 + 0x1e78]
movsxd rax, dword [rcx + rdx*4 - 0x14]
add rax, rax
movups xmm0, xmmword [rcx + rdx*4 - 0x10]
movups xmmword [r8 + rax*8 + 0x16fc], xmm0
dec dword [r8 + 0x1e70]
movsxd rax, dword [r8 + 0x1e80]
lea rcx, [rax + rax*2]
mov rdx, qword [r8 + 0x1e88]
movsxd rax, dword [rdx + rcx*4 - 0xc]
lea r10, [rax + rax*2]
mov r9d, dword [rdi + r10*4 + 8]
cmp dword [rdi + r10*4], 8
jne 0x14004f445
mov eax, dword [rdi + r10*4 + 4]
cmp eax, 1
jne 0x14004f428
mov eax, dword [rdx + rcx*4 - 8]
mov dword [r9 + r8 + 0x1638], eax
jmp 0x14004f445
cmp eax, 2
jne 0x14004f445
mov eax, dword [rdx + rcx*4 - 8]
mov dword [r9 + r8 + 0x1638], eax
mov eax, dword [rdx + rcx*4 - 4]
mov dword [r9 + r8 + 0x163c], eax
dec dword [r8 + 0x1e80]
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
movss xmm0, dword [rax + 0x50]
subss xmm0, dword [rax + 0x9c]
movss xmm2, dword [rax + 0x54]
subss xmm2, dword [rax + 0xa0]
addss xmm0, dword [0x14007bae8]
addss xmm2, dword [0x14007bb34]
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
lea rcx, str._alteik
call fcn.14003e5d0
movaps xmm6, xmmword [0x14007bd10]
mov rbx, qword [0x140135308]
mov dword [rbp - 0x29], esi
movups xmm0, xmmword [rbx + 0x16fc]
movups xmmword [rbp - 0x25], xmm0
lea rcx, [rbx + 0x1e70]
lea rdx, [rbp - 0x29]
call fcn.1400281a0
movups xmmword [rbx + 0x16fc], xmm6
mov rbx, qword [0x140135308]
movss xmm1, dword [rbx + 0x1670]
movss xmm0, dword [rbx + 0x1674]
mov dword [rbp - 9], 0xa
movss dword [rbp - 5], xmm1
movss dword [rbp - 1], xmm0
lea rcx, [rbx + 0x1e80]
lea rdx, [rbp - 9]
call fcn.1400280b0
mov dword [rbx + 0x1670], 0x420c0000
mov dword [rbx + 0x1674], 0x40800000
mov rcx, qword [0x140135308]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x50]
subss xmm0, dword [rax + 0x9c]
movss xmm2, dword [rax + 0x54]
subss xmm2, dword [rax + 0xa0]
addss xmm0, dword [0x14007bb1c]
movss xmm7, dword [0x14007bb30]
addss xmm2, xmm7
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
mov qword [rbp - 9], 0
lea rdx, [rbp - 9]
lea rcx, str.DISCORD
call fcn.14004d450
test al, al
je 0x14004f5f9
lea rcx, str.start_https:__youtu.be_dQw4w9WgXcQ_si3pzJoMfdS2c4x6LD
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rbx, qword [0x140135308]
movsxd rax, dword [rbx + 0x1e70]
lea rdx, [rax + rax*4]
mov rcx, qword [rbx + 0x1e78]
movsxd rax, dword [rcx + rdx*4 - 0x14]
add rax, rax
movups xmm0, xmmword [rcx + rdx*4 - 0x10]
movups xmmword [rbx + rax*8 + 0x16fc], xmm0
dec dword [rbx + 0x1e70]
movsxd rax, dword [rbx + 0x1e80]
lea rcx, [rax + rax*2]
mov rdx, qword [rbx + 0x1e88]
movsxd rax, dword [rdx + rcx*4 - 0xc]
lea r10, [rax + rax*2]
mov r9d, dword [rdi + r10*4 + 8]
cmp dword [rdi + r10*4], 8
jne 0x14004f689
mov eax, dword [rdi + r10*4 + 4]
cmp eax, 1
jne 0x14004f66c
mov eax, dword [rdx + rcx*4 - 8]
mov dword [r9 + rbx + 0x1638], eax
jmp 0x14004f689
cmp eax, 2
jne 0x14004f689
mov eax, dword [rdx + rcx*4 - 8]
mov dword [r9 + rbx + 0x1638], eax
mov eax, dword [rdx + rcx*4 - 4]
mov dword [r9 + rbx + 0x163c], eax
dec dword [rbx + 0x1e80]
movaps xmm6, xmmword [0x14007bd10]
mov dword [rbp - 0x29], esi
movups xmm0, xmmword [rbx + 0x16fc]
movups xmmword [rbp - 0x25], xmm0
lea rdx, [rbp - 0x29]
lea rcx, [rbx + 0x1e70]
call fcn.1400281a0
movups xmmword [rbx + 0x16fc], xmm6
mov rbx, qword [0x140135308]
movss xmm1, dword [rbx + 0x1670]
movss xmm0, dword [rbx + 0x1674]
mov dword [rbp - 9], 0xa
movss dword [rbp - 5], xmm1
movss dword [rbp - 1], xmm0
lea rcx, [rbx + 0x1e80]
lea rdx, [rbp - 9]
call fcn.1400280b0
mov dword [rbx + 0x1670], 0x41700000
mov dword [rbx + 0x1674], 0x40800000
mov rcx, qword [0x140135308]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x50]
subss xmm0, dword [rax + 0x9c]
movss xmm2, dword [rax + 0x54]
subss xmm2, dword [rax + 0xa0]
addss xmm0, dword [0x14007bb2c]
addss xmm2, xmm7
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
mov qword [rbp - 9], 0
lea rdx, [rbp - 9]
lea rcx, str.SELF_DESTRUCT
call fcn.14004d450
test al, al
je 0x14004f8c6
lea rcx, str.FOR__F__tokens______G_in__wevtutil.exe_el__DO__call_:do_clear______G__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__f__q__temp_.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rd__s__q__temp_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.md__temp_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x14007b190]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD__HKEY_USERS_usersid_SoftwareMicrosoftWindowsCurrentVersionSearchRecentApps_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE___HKEY_USERS___usersid___SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_USERS___usersid___SoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints2___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD__HKEY_USERS___usersid___SoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints2_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32FirstFolder___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedPidlMRU___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedPidlMRULegacy___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRU_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellBagMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellBags___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsShellBagMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsShellBags___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_USERS___usersid___SoftwareMicrosoftWindowsCurrentVersionSearchRecentApps___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD__HKEY_USERS_usersid_SoftwareMicrosoftWindowsCurrentVersionSearchRecentApps_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerRunMRU___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov byte [0x1401339e0], 0
mov r8, qword [0x140135308]
movsxd rax, dword [r8 + 0x1e70]
lea rdx, [rax + rax*4]
mov rcx, qword [r8 + 0x1e78]
movsxd rax, dword [rcx + rdx*4 - 0x14]
add rax, rax
movups xmm0, xmmword [rcx + rdx*4 - 0x10]
movups xmmword [r8 + rax*8 + 0x16fc], xmm0
dec dword [r8 + 0x1e70]
movsxd rax, dword [r8 + 0x1e80]
lea rcx, [rax + rax*2]
mov rdx, qword [r8 + 0x1e88]
movsxd rax, dword [rdx + rcx*4 - 0xc]
lea r10, [rax + rax*2]
mov r9d, dword [rdi + r10*4 + 8]
cmp dword [rdi + r10*4], 8
jne 0x14004f958
mov eax, dword [rdi + r10*4 + 4]
cmp eax, 1
jne 0x14004f93b
mov eax, dword [rdx + rcx*4 - 8]
mov dword [r9 + r8 + 0x1638], eax
jmp 0x14004f958
cmp eax, 2
jne 0x14004f958
mov eax, dword [rdx + rcx*4 - 8]
mov dword [r9 + r8 + 0x1638], eax
mov eax, dword [rdx + rcx*4 - 4]
mov dword [r9 + r8 + 0x163c], eax
dec dword [r8 + 0x1e80]
call fcn.1400156b0
mov ecx, 4
call fcn.140008460
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.14004fda0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop rbp
ret