Function at 0x140009940
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
movaps xmmword [rax - 0x48], xmm9
mov rax, qword [0x140107040]
xor rax, rsp
mov qword [rbp + 7], rax
xor r14d, r14d
mov rbx, qword [0x1401588b8]
movss xmm2, dword [rbx + 0x18]
addss xmm2, xmm2
movss xmm7, dword [0x1400f4e40]
movaps xmm1, xmm7
subss xmm1, dword [0x1401589b4]
mulss xmm1, xmm2
addss xmm1, dword [0x1401589b4]
movss dword [0x1401589b4], xmm1
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140158d8c], eax
jle 0x140009a18
lea rcx, [0x140158d8c]
call fcn.1400af770
cmp dword [0x140158d8c], 0xffffffff
jne 0x140009a11
mov rax, qword [0x1401588b8]
mov rdx, qword [rax + 0x3ed8]
movss xmm0, dword [rdx + 0x2c]
movss dword [0x140158a28], xmm0
lea rcx, [0x140158d8c]
call fcn.1400af704
mov rbx, qword [0x1401588b8]
movss xmm2, dword [rbx + 0x18]
addss xmm2, xmm2
mov rax, qword [rbx + 0x3ed8]
movss xmm1, dword [rax + 0x2c]
movss xmm8, dword [0x1400f4e00]
mulss xmm1, xmm8
subss xmm1, dword [0x140158a28]
mulss xmm1, xmm2
addss xmm1, dword [0x140158a28]
movss dword [0x140158a28], xmm1
movss xmm6, dword [0x1401589b4]
lea rcx, [rbx + 0x4838]
movss xmm0, dword [rbx + 0x37c8]
mov dword [rbp - 0x29], r14d
movss dword [rbp - 0x25], xmm0
lea rdx, [rbp - 0x29]
call fcn.1400293e0
movss dword [rbx + 0x37c8], xmm6
call fcn.140021820
cmp byte [0x140158d42], r14b
jne 0x14000a2a3
mov rcx, qword [0x140158d68]
call fcn.14001e880
mov rbx, qword [0x1401588b8]
mov qword [rsp + 0x30], r14
lea rdi, str.Instructions:_click_Inject__inject_the_cheat
mov qword [rsp + 0x28], rdi
movss xmm9, dword [0x1400f4f48]
movss dword [rsp + 0x20], xmm9
movss xmm3, dword [0x1400f4f38]
movss xmm2, dword [rbx + 0x3c10]
lea rdx, [rbp - 0x29]
mov rcx, qword [rbx + 0x3c08]
call fcn.140038360
movss xmm0, dword [rbp - 0x29]
addss xmm0, dword [0x1400f4e38]
cvttss2si eax, xmm0
movd xmm6, eax
cvtdq2ps xmm6, xmm6
mov qword [rsp + 0x30], r14
lea rsi, str.close_the_loader_and_click_Destruct
mov qword [rsp + 0x28], rsi
movss dword [rsp + 0x20], xmm9
movss xmm3, dword [0x1400f4f38]
movss xmm2, dword [rbx + 0x3c10]
lea rdx, [rbp - 0x29]
mov rcx, qword [rbx + 0x3c08]
call fcn.140038360
movss xmm0, dword [rbp - 0x29]
addss xmm0, dword [0x1400f4e38]
cvttss2si eax, xmm0
movd xmm7, eax
cvtdq2ps xmm7, xmm7
movss xmm1, dword [0x140158a28]
subss xmm1, dword [0x1400f4ecc]
movss xmm3, dword [0x140158a50]
mulss xmm3, xmm8
mov rax, qword [rbx + 0x3ed8]
mov byte [rax + 0xb8], 1
mov rax, qword [rbx + 0x3ed8]
movss xmm2, dword [rax + 0x24]
subss xmm2, dword [rax + 0x88]
addss xmm2, xmm1
mulss xmm6, xmm8
subss xmm3, xmm6
movss xmm0, dword [rax + 0x20]
subss xmm0, dword [rax + 0x84]
addss xmm3, xmm0
movss dword [rax + 0x100], xmm3
movss dword [rax + 0x104], xmm2
mov byte [rax + 0x141], 1
movdqa xmm0, xmmword [0x1400f5150]
movups xmmword [rbp - 0x19], xmm0
mov rdx, rdi
lea rcx, [rbp - 0x19]
call fcn.14003e660
movss xmm0, dword [0x140158a28]
subss xmm0, dword [0x1400f4ec4]
movss xmm2, dword [0x140158a50]
mulss xmm2, xmm8
mov rcx, qword [0x1401588b8]
mov rax, qword [rcx + 0x3ed8]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ed8]
movss xmm1, dword [rax + 0x24]
subss xmm1, dword [rax + 0x88]
addss xmm1, xmm0
mulss xmm7, xmm8
subss xmm2, xmm7
movss xmm0, dword [rax + 0x20]
subss xmm0, dword [rax + 0x84]
addss xmm2, xmm0
movss dword [rax + 0x100], xmm2
movss dword [rax + 0x104], xmm1
mov byte [rax + 0x141], 1
movdqa xmm0, xmmword [0x1400f5150]
movups xmmword [rbp - 0x19], xmm0
mov rdx, rsi
lea rcx, [rbp - 0x19]
call fcn.14003e660
call fcn.14001e920
movss xmm0, dword [0x140158a28]
xorps xmm6, xmm6
addss xmm0, xmm6
mov rcx, qword [0x1401588b8]
mov rax, qword [rcx + 0x3ed8]
movss xmm2, dword [rax + 0x28]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ed8]
movss xmm1, dword [rax + 0x24]
subss xmm1, dword [rax + 0x88]
addss xmm1, xmm0
mulss xmm2, xmm8
movss xmm7, dword [0x1400f4ee8]
subss xmm2, xmm7
movss xmm0, dword [rax + 0x20]
subss xmm0, dword [rax + 0x84]
addss xmm2, xmm0
movss dword [rax + 0x100], xmm2
movss dword [rax + 0x104], xmm1
mov byte [rax + 0x141], 1
mov dword [rbp - 0x29], 0x43480000
mov dword [rbp - 0x25], 0x41c80000
lea rdx, [rbp - 0x29]
lea rcx, str.Inject
call fcn.14003ee80
test al, al
je 0x140009d94
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], r14
mov qword [rbp - 1], r14
mov r8d, 0x3b
lea rdx, str.C:Users_adriaAppDataLocalMicrosoftWindowsINetCacheIE
lea rcx, [rbp - 0x19]
call fcn.14000eee0
nop
lea rcx, [rbp - 0x19]
call fcn.1400094e0
nop
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x140009d84
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009d7f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009d7f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400af6c0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140003ad0
movss xmm0, dword [0x140158a28]
addss xmm0, dword [0x1400f4ec0]
mov rcx, qword [0x1401588b8]
mov rax, qword [rcx + 0x3ed8]
movss xmm2, dword [rax + 0x28]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ed8]
movss xmm1, dword [rax + 0x24]
subss xmm1, dword [rax + 0x88]
addss xmm1, xmm0
mulss xmm2, xmm8
subss xmm2, xmm7
movss xmm0, dword [rax + 0x20]
subss xmm0, dword [rax + 0x84]
addss xmm2, xmm0
movss dword [rax + 0x100], xmm2
movss dword [rax + 0x104], xmm1
mov byte [rax + 0x141], 1
mov dword [rbp - 0x29], 0x43480000
mov dword [rbp - 0x25], 0x41c80000
lea rdx, [rbp - 0x29]
lea rcx, str.Destruct
call fcn.14003ee80
test al, al
je 0x140009e87
mov ecx, 1
call fcn.1400af7e8
mov qword [rbp - 0x29], rax
lea rcx, [rbp - 0x11]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x1400102b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x19], rax
test rax, rax
je 0x140009ec7
cmp dword [rbp - 0x11], 0
je 0x140009ebb
movaps xmm0, xmmword [rbp - 0x19]
movdqa xmmword [rbp - 0x29], xmm0
lea rcx, [rbp - 0x29]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140009ebb
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x19], xmm0
mov rcx, qword [0x140158d68]
call fcn.14001e880
lea rbx, [0x140158d48]
cmp qword [0x140158d60], 0xf
cmova rbx, qword [0x140158d48]
mov rdi, qword [0x1401588b8]
test rbx, rbx
jne 0x140009ed7
xorps xmm3, xmm3
jmp 0x140009f20
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x11], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rbx
movss dword [rsp + 0x20], xmm9
movss xmm3, dword [0x1400f4f38]
movss xmm2, dword [rdi + 0x3c10]
lea rdx, [rbp - 0x29]
mov rcx, qword [rdi + 0x3c08]
call fcn.140038360
movss xmm0, dword [rbp - 0x29]
addss xmm0, dword [0x1400f4e38]
cvttss2si eax, xmm0
movd xmm3, eax
cvtdq2ps xmm3, xmm3
movss xmm0, dword [0x140158a28]
addss xmm0, dword [0x1400f4ed4]
movss xmm2, dword [0x140158a50]
mulss xmm2, xmm8
mov rax, qword [rdi + 0x3ed8]
mov byte [rax + 0xb8], 1
mov rax, qword [rdi + 0x3ed8]
movss xmm1, dword [rax + 0x24]
subss xmm1, dword [rax + 0x88]
addss xmm1, xmm0
mulss xmm3, xmm8
subss xmm2, xmm3
movss xmm0, dword [rax + 0x20]
subss xmm0, dword [rax + 0x84]
addss xmm2, xmm0
movss dword [rax + 0x100], xmm2
movss dword [rax + 0x104], xmm1
mov byte [rax + 0x141], 1
movdqa xmm0, xmmword [0x1400f5150]
movups xmmword [rbp - 0x19], xmm0
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.14003e660
call fcn.14001e920
movss xmm0, dword [0x140158a28]
subss xmm0, dword [0x1400f4ed8]
movss xmm2, dword [0x140158a50]
mulss xmm2, xmm8
mov rcx, qword [0x1401588b8]
mov rax, qword [rcx + 0x3ed8]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ed8]
movss xmm1, dword [rax + 0x24]
subss xmm1, dword [rax + 0x88]
addss xmm1, xmm0
movss xmm0, dword [rax + 0x20]
subss xmm0, dword [rax + 0x84]
subss xmm2, dword [0x1400f4ee0]
addss xmm0, xmm2
movss dword [rax + 0x100], xmm0
movss dword [rax + 0x104], xmm1
mov byte [rax + 0x141], 1
cmp dword [0x140157b58], 1
sete r8b
xorps xmm0, xmm0
unpcklps xmm0, xmm6
movq rdx, xmm0
lea rcx, [0x1400cff24]
call fcn.140008f60
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14001f470
test al, al
je 0x14000a0dc
xor ecx, ecx
call fcn.140016130
test al, al
je 0x14000a0dc
mov dword [0x140157b58], 1
mov ecx, 1
call fcn.1400af7e8
mov qword [rbp - 0x29], rax
lea rcx, [rbp - 0x11]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x1400102e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x19], rax
test rax, rax
je 0x14000a25b
cmp dword [rbp - 0x11], 0
je 0x14000a24f
movaps xmm0, xmmword [rbp - 0x19]
movdqa xmmword [rbp - 0x29], xmm0
lea rcx, [rbp - 0x29]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14000a24f
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x19], xmm0
movaps xmm1, xmm9
xorps xmm0, xmm0
call fcn.140021660
cmp dword [0x140157b58], 2
sete r8b
xorps xmm4, xmm4
unpcklps xmm4, xmm6
movq rdx, xmm4
lea rcx, str.SKRIPT
call fcn.140008f60
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14001f470
test al, al
je 0x14000a199
xor ecx, ecx
call fcn.140016130
test al, al
je 0x14000a199
mov dword [0x140157b58], 2
mov ecx, 1
call fcn.1400af7e8
mov qword [rbp - 0x29], rax
lea rcx, [rbp - 0x11]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x1400102e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x19], rax
test rax, rax
je 0x14000a277
cmp dword [rbp - 0x11], 0
je 0x14000a26b
movaps xmm0, xmmword [rbp - 0x19]
movdqa xmmword [rbp - 0x29], xmm0
lea rcx, [rbp - 0x29]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14000a26b
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x19], xmm0
movaps xmm1, xmm9
xorps xmm0, xmm0
call fcn.140021660
cmp dword [0x140157b58], 3
sete r8b
xorps xmm4, xmm4
unpcklps xmm4, xmm6
movq rdx, xmm4
lea rcx, str.GOSTH
call fcn.140008f60
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14001f470
test al, al
je 0x14000a3f0
xor ecx, ecx
call fcn.140016130
test al, al
je 0x14000a3f0
mov dword [0x140157b58], 3
mov ecx, 1
call fcn.1400af7e8
mov qword [rbp - 0x29], rax
lea rcx, [rbp - 0x11]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x1400102e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x19], rax
test rax, rax
je 0x14000a293
cmp dword [rbp - 0x11], 0
je 0x14000a287
movaps xmm0, xmmword [rbp - 0x19]
movdqa xmmword [rbp - 0x29], xmm0
lea rcx, [rbp - 0x29]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14000a287
jmp 0x14000a3f0
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x11], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x11], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x11], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov rbx, qword [0x1401588b8]
movss xmm0, dword [rbx + 0x18]
mulss xmm0, dword [0x1400f4e48]
movss xmm6, dword [0x1401589cc]
subss xmm7, xmm6
mulss xmm0, xmm7
addss xmm6, xmm0
movss dword [0x1401589cc], xmm6
mov dword [rbp - 0x29], r14d
movss xmm0, dword [rbx + 0x37c8]
movss dword [rbp - 0x25], xmm0
lea rcx, [rbx + 0x4838]
lea rdx, [rbp - 0x29]
call fcn.1400293e0
movss dword [rbx + 0x37c8], xmm6
mov rbx, qword [0x1401588b8]
mov qword [rsp + 0x30], r14
lea rdi, str.You_can_close_this__now_you_are_safe
mov qword [rsp + 0x28], rdi
movss xmm0, dword [0x1400f4f48]
movss dword [rsp + 0x20], xmm0
movss xmm3, dword [0x1400f4f38]
movss xmm2, dword [rbx + 0x3c10]
lea rdx, [rbp - 0x29]
mov rcx, qword [rbx + 0x3c08]
call fcn.140038360
movss xmm0, dword [rbp - 0x29]
addss xmm0, dword [0x1400f4e38]
cvttss2si eax, xmm0
movd xmm1, eax
cvtdq2ps xmm1, xmm1
movss xmm2, dword [0x140158a50]
mulss xmm2, xmm8
mov rax, qword [rbx + 0x3ed8]
mov byte [rax + 0xb8], 1
mov rax, qword [rbx + 0x3ed8]
mulss xmm1, xmm8
subss xmm2, xmm1
movss xmm0, dword [rax + 0x20]
subss xmm0, dword [rax + 0x84]
addss xmm2, xmm0
movss xmm1, dword [rax + 0x24]
subss xmm1, dword [rax + 0x88]
movss xmm0, dword [0x140158a28]
subss xmm0, dword [0x1400f4e94]
addss xmm1, xmm0
movss dword [rax + 0x100], xmm2
movss dword [rax + 0x104], xmm1
mov byte [rax + 0x141], 1
movdqa xmm0, xmmword [0x1400f5150]
movups xmmword [rbp - 0x19], xmm0
mov rdx, rdi
lea rcx, [rbp - 0x19]
call fcn.14003e660
mov ecx, 1
call fcn.140012e70
call fcn.140021950
mov ecx, 1
call fcn.140012e70
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.1400af6a0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop rbp
ret