Function at 0x140024a50
Capabilities:
Log keystrokes via polling
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x148]
sub rsp, 0x230
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
movaps xmmword [rax - 0x58], xmm9
movaps xmmword [rax - 0x68], xmm10
mov rax, qword [0x140295040]
xor rax, rsp
mov qword [rbp + 0xd0], rax
cmp byte [0x1402d2b88], 0
jne 0x140025986
xor esi, esi
movabs r14, 0x7fffffffffffffff
mov r12d, 0xff
mov r15d, 4
movsd xmm9, qword [0x1402867f0]
movsd xmm10, qword [0x140286748]
movss xmm7, dword [0x1402868c0]
movss xmm8, dword [0x1402866b8]
xorps xmm6, xmm6
nop dword [rax]
movsxd rbx, dword [0x1402d2b98]
lea rcx, [rsp + 0x48]
call fcn.140001570
mov rcx, qword [rsp + 0x48]
mov qword [rbp - 0x28], rcx
test rbx, rbx
je 0x140024b40
js 0x140024b40
imul rdx, rbx, 0xf4240
mov rax, r14
sub rax, rdx
cmp rcx, rax
je 0x140024b3c
mov r8d, 1
cmovl r8d, r12d
test r8b, r8b
jns 0x140024b3c
lea rax, [rcx + rdx]
mov qword [rbp - 0x28], rax
jmp 0x140024b40
mov qword [rbp - 0x28], r14
lea rcx, [rbp - 0x28]
call fcn.140004960
lea rdx, [0x140092980]
lea rcx, [rsp + 0x78]
call fcn.140025a60
nop
lea rdx, str.FiveM_
lea rcx, [rbp - 0x68]
call fcn.140025a60
nop
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x68]
call fcn.140023da0
mov ebx, eax
mov rdx, qword [rbp - 0x50]
cmp rdx, 7
jbe 0x140024bbd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024bb7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400259cf
call fcn.140089f14
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 7
jbe 0x140024bfe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024bf9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400259d6
call fcn.140089f14
test ebx, ebx
je 0x1400259dd
cmp qword [0x1402d4220], 0
je 0x140025979
mov ecx, dword [0x1402d2b54]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140024c33
cmp byte [0x1402d2b60], 0
sete byte [0x1402d2b60]
mov ecx, dword [0x1402d2b50]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140024c52
cmp byte [0x1402d2b45], 0
sete byte [0x1402d2b45]
mov ecx, dword [0x1402d2b58]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140024c71
cmp byte [0x1402d2b4b], 0
sete byte [0x1402d2b4b]
mov ecx, dword [0x1402d2b5c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140024c90
cmp byte [0x1402d2b44], 0
sete byte [0x1402d2b44]
movzx eax, byte [0x1402d2b4b]
cmp byte [0x1402d3cd0], al
je 0x140024cb1
call fcn.1400246e0
movzx eax, byte [0x1402d2b4b]
mov byte [0x1402d3cd0], al
movzx ecx, byte [0x1402d2b4c]
cmp byte [0x1402d3cd1], cl
je 0x140024cd2
call fcn.140024510
movzx eax, byte [0x1402d2b4c]
mov byte [0x1402d3cd1], al
movzx ecx, byte [0x1402d2b4d]
mov r10, qword [0x1402d3e28]
cmp byte [0x1402d3ea2], cl
je 0x140024d86
test cl, cl
setne al
add al, 0xc8
mov byte [rbp - 0x48], al
test r10, r10
je 0x140024d38
cmp dword [0x1402d3d94], 0
je 0x140024d38
mov rdx, qword [0x1402d3d48]
add rdx, qword [0x1402d4220]
mov qword [rsp + 0x20], rsi
mov r9d, 1
lea r8, [rbp - 0x48]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx ecx, byte [0x1402d2b4d]
mov r10, qword [0x1402d3e28]
test cl, cl
sete byte [rbp - 0x40]
test r10, r10
je 0x140024d80
cmp dword [0x1402d3d94], 0
je 0x140024d80
mov rdx, qword [0x1402d4220]
add rdx, qword [0x1402d3d60]
mov qword [rsp + 0x20], rsi
mov r9d, 1
lea r8, [rbp - 0x40]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx ecx, byte [0x1402d2b4d]
mov r10, qword [0x1402d3e28]
mov byte [0x1402d3ea2], cl
movzx ecx, byte [0x1402d2b48]
cmp byte [0x1402d3ea1], cl
je 0x140024dea
mov eax, 0x20
test cl, cl
cmovne eax, esi
mov byte [rbp - 0x38], al
test r10, r10
je 0x140024de4
cmp dword [0x1402d3d94], 0
je 0x140024de4
mov rdx, qword [0x1402d4220]
add rdx, qword [0x1402d3d38]
mov qword [rsp + 0x20], rsi
mov r9d, 1
lea r8, [rbp - 0x38]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx ecx, byte [0x1402d2b48]
mov r10, qword [0x1402d3e28]
mov byte [0x1402d3ea1], cl
mov r9, qword [0x1402d4220]
test r9, r9
je 0x140024eaa
test r10, r10
je 0x140024e38
cmp dword [0x1402d3d94], 0
je 0x140024e38
mov rdx, qword [0x1402d3d28]
add rdx, r9
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp + 0x20]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r9, qword [0x1402d4220]
mov r10, qword [0x1402d3e28]
mov rdx, qword [rbp + 0x20]
test rdx, rdx
je 0x140024eaa
movzx eax, byte [0x1402d2b4f]
movzx ecx, byte [0x1402d2b4e]
test cl, cl
jne 0x140024e57
test al, al
je 0x140024eaa
neg cl
sbb ecx, ecx
and ecx, 0x4000
neg al
sbb eax, eax
and eax, 0x2000
or ecx, eax
mov dword [rbp - 0x20], ecx
test r10, r10
je 0x140024eaa
cmp dword [0x1402d3d94], 0
je 0x140024eaa
add rdx, 0x218
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rbp - 0x20]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9, qword [0x1402d4220]
mov r10, qword [0x1402d3e28]
cmp byte [0x1402d2b44], 0
je 0x140024f0a
test r9, r9
je 0x140024f03
movd xmm0, dword [0x1402d2b40]
cvtdq2ps xmm0, xmm0
movss dword [rbp + 0x18], xmm0
test r10, r10
je 0x140024f03
cmp dword [0x1402d3d94], 0
je 0x140024f03
lea rdx, [r9 + 0x280]
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rbp + 0x18]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9, qword [0x1402d4220]
mov r10, qword [0x1402d3e28]
mov byte [0x1402d2b44], 0
cmp byte [0x1402d2b60], 0
je 0x14002505f
test r9, r9
je 0x140025058
test r10, r10
je 0x140024f62
cmp dword [0x1402d3d94], 0
je 0x140024f62
mov rdx, qword [0x1402d3d40]
add rdx, 4
add rdx, r9
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rbp - 0x18]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r9, qword [0x1402d4220]
mov r10, qword [0x1402d3e28]
test dword [rbp - 0x18], 0x40000000
je 0x140025058
test r9, r9
je 0x140025058
test r10, r10
je 0x140024fb9
cmp dword [0x1402d3d94], 0
je 0x140024fb9
mov rdx, qword [0x1402d3d30]
add rdx, r9
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp + 0xc0]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r9, qword [0x1402d4220]
mov r10, qword [0x1402d3e28]
cmp qword [rbp + 0xc0], 0
je 0x140025058
test r9, r9
je 0x140025058
test r10, r10
je 0x140025011
cmp dword [0x1402d3d94], 0
je 0x140025011
mov rdx, qword [0x1402d3d30]
add rdx, r9
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp + 0xb8]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r9, qword [0x1402d4220]
mov r10, qword [0x1402d3e28]
mov rcx, qword [rbp + 0xb8]
test rcx, rcx
je 0x140025058
mov byte [rbp - 0x30], 0x17
test r10, r10
je 0x140025058
cmp dword [0x1402d3d94], 0
je 0x140025058
mov rdx, qword [0x1402d3d68]
add rdx, rcx
mov qword [rsp + 0x20], rsi
mov r9d, 1
lea r8, [rbp - 0x30]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9, qword [0x1402d4220]
mov byte [0x1402d2b60], 0
mov edx, 0xdf
mov rcx, r9
cmp byte [0x1402d2b47], 0
je 0x140025075
mov r8b, 1
jmp 0x140025078
xor r8d, r8d
call fcn.140023ca0
xor r8d, r8d
mov edx, 0x156
mov rcx, qword [0x1402d4220]
cmp byte [0x1402d2b46], r8b
je 0x1400250b3
call fcn.140023ca0
mov r8b, 1
mov edx, 0xfc
mov rcx, qword [0x1402d4220]
call fcn.140023ca0
mov r8b, 1
jmp 0x1400250cf
call fcn.140023ca0
xor r8d, r8d
mov edx, 0x1c
mov rcx, qword [0x1402d4220]
call fcn.140023ca0
xor r8d, r8d
mov edx, 0x8d
mov rcx, qword [0x1402d4220]
call fcn.140023ca0
movzx edi, byte [0x1402d2b45]
test dil, dil
je 0x14002518a
mov rbx, qword [0x1402d4220]
test rbx, rbx
je 0x14002518a
mov r10, qword [0x1402d3e28]
test r10, r10
je 0x14002513e
cmp dword [0x1402d3d94], 0
je 0x14002513e
lea rdx, [rbx + 0x188]
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp + 0xb0]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1402d3e28]
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
btr rax, 8
bts rcx, 8
test dil, dil
cmove rcx, rax
mov qword [rbp - 0x28], rcx
test r10, r10
je 0x14002518a
cmp dword [0x1402d3d94], 0
je 0x14002518a
lea rdx, [rbx + 0x188]
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp - 0x28]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edx, 0x13a
mov rcx, qword [0x1402d4220]
cmp byte [0x1402d2b49], 0
je 0x1400251a4
mov r8b, 1
jmp 0x1400251a7
xor r8d, r8d
call fcn.140023ca0
cmp byte [0x1402d2b4a], 0
je 0x14002523d
mov rdx, qword [0x1402d4220]
mov rcx, qword [0x1402d3e28]
test rdx, rdx
jne 0x1400251d1
mov rdx, rsi
jmp 0x14002520c
test rcx, rcx
je 0x140025205
cmp dword [0x1402d3d94], 0
je 0x140025205
add rdx, qword [0x1402d3d28]
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1402d3e28]
mov rdx, qword [rbp + 0xa8]
mov dword [rbp - 0x10], 0x42c40000
test rcx, rcx
je 0x140025244
cmp dword [0x1402d3d94], 0
je 0x140025244
add rdx, qword [0x1402d3d50]
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x1402d3e28]
cmp byte [0x1402d2b38], 0
je 0x140025425
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [r15 + rcx]
cmp dword [0x1402d4280], eax
jle 0x140025296
lea rcx, [0x1402d4280]
call fcn.140089ff0
cmp dword [0x1402d4280], 0xffffffff
jne 0x140025296
lea rcx, [0x1402d4260]
call fcn.140001570
lea rcx, [0x1402d4280]
call fcn.140089f84
lea rcx, [rsp + 0x70]
call fcn.140001570
mov rax, qword [rsp + 0x70]
sub rax, qword [0x1402d4260]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm0, xmm9
comisd xmm0, xmm10
jb 0x14002541e
mov rdx, qword [0x1402d4220]
mov rcx, qword [0x1402d3e28]
test rdx, rdx
jne 0x1400252dc
mov rdx, rsi
jmp 0x14002530e
test rcx, rcx
je 0x14002530a
cmp dword [0x1402d3d94], 0
je 0x14002530a
add rdx, 0x30
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp + 0x78]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1402d3e28]
mov rdx, qword [rbp + 0x78]
test rcx, rcx
je 0x1400253dc
cmp dword [0x1402d3d94], 0
je 0x140025343
add rdx, 0x10
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1402d3e28]
test rcx, rcx
je 0x1400253dc
cmp dword [0x1402d3d94], 0
je 0x14002537c
mov rdx, qword [rbp + 0xa0]
add rdx, 0x20
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1402d3e28]
test rcx, rcx
je 0x1400253dc
cmp dword [0x1402d3d94], 0
je 0x1400253ae
mov rdx, qword [rbp + 0x28]
add rdx, 0x70
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1402d3e28]
test rcx, rcx
je 0x1400253dc
cmp dword [0x1402d3d94], 0
je 0x1400253dc
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp + 0x38]
mov rdx, qword [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1402d3e28]
cmp byte [0x1402d2b38], 0
je 0x1400253ea
movaps xmm0, xmm7
jmp 0x1400253ee
movaps xmm0, xmm8
movss dword [rbp - 8], xmm0
test rcx, rcx
je 0x140025425
cmp dword [0x1402d3d94], 0
je 0x140025425
mov rdx, qword [rbp + 0x38]
add rdx, 0x2c
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rbp - 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x1402d3e28]
mov rdx, qword [0x1402d4220]
test rdx, rdx
je 0x140025582
test rcx, rcx
je 0x140025466
cmp dword [0x1402d3d94], 0
je 0x140025466
add rdx, qword [0x1402d3d30]
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1402d3e28]
mov rbx, qword [rbp + 0x40]
test rbx, rbx
je 0x140025582
test rcx, rcx
je 0x1400254a7
cmp dword [0x1402d3d94], 0
je 0x1400254a7
mov rdx, qword [0x1402d3d58]
add rdx, rbx
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1402d3e28]
mov rax, qword [0x1402d4220]
cmp qword [rbp + 0x48], rax
jne 0x1400255a0
mov byte [0x1402d3cf0], 1
test rcx, rcx
je 0x1400254ed
cmp dword [0x1402d3d94], 0
je 0x1400254ed
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1402d3e28]
mov rax, qword [rbp + 0x50]
mov qword [0x1402d3ce8], rax
mov qword [0x1402d3cf8], rbx
test rcx, rcx
je 0x14002552d
cmp dword [0x1402d3d94], 0
je 0x14002552d
lea rdx, [rbx + 0x30]
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1402d3e28]
mov rax, qword [rbp + 0x58]
mov qword [0x1402d3ce0], rax
test rcx, rcx
je 0x14002556a
cmp dword [0x1402d3d94], 0
je 0x14002556a
lea rdx, [rbx + 0x90]
mov qword [rsp + 0x20], rsi
mov r9d, 0xc
lea r8, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1402d3e28]
movsd xmm0, qword [rsp + 0x60]
movsd qword [0x1402d3e70], xmm0
mov eax, dword [rsp + 0x68]
mov dword [0x1402d3e78], eax
cmp byte [0x1402d3cf0], 0
jne 0x1400256a2
mov rdx, qword [0x1402d4220]
test rdx, rdx
jne 0x1400255a9
mov rax, rsi
jmp 0x1400255db
mov byte [0x1402d3cf0], 0
jmp 0x14002558f
test rcx, rcx
je 0x1400255d7
cmp dword [0x1402d3d94], 0
je 0x1400255d7
add rdx, 0x20
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1402d3e28]
mov rax, qword [rbp + 0x60]
mov qword [0x1402d3ce8], rax
mov rdx, qword [0x1402d4220]
mov qword [0x1402d3cf8], rdx
test rdx, rdx
jne 0x1400255fa
mov rax, rsi
jmp 0x14002562c
test rcx, rcx
je 0x140025628
cmp dword [0x1402d3d94], 0
je 0x140025628
add rdx, 0x30
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1402d3e28]
mov rax, qword [rbp + 0x68]
mov qword [0x1402d3ce0], rax
cmp qword [0x1402d4220], 0
jne 0x140025651
movss dword [rsp + 0x38], xmm6
movaps xmm0, xmm6
unpcklps xmm0, xmm6
movsd qword [rsp + 0x30], xmm0
jmp 0x14002568a
test rcx, rcx
je 0x14002568a
cmp dword [0x1402d3d94], 0
je 0x14002568a
mov rdx, qword [0x1402d4220]
add rdx, 0x90
mov qword [rsp + 0x20], rsi
mov r9d, 0xc
lea r8, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1402d3e28]
movsd xmm0, qword [rsp + 0x30]
movsd qword [0x1402d3e70], xmm0
mov eax, dword [rsp + 0x38]
mov dword [0x1402d3e78], eax
mov rdx, qword [0x1402d4158]
test rdx, rdx
je 0x140025712
test rcx, rcx
je 0x1400256df
cmp dword [0x1402d3d94], 0
je 0x1400256df
add rdx, 0x3c0
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1402d3e28]
mov rdx, qword [rbp + 0x70]
test rdx, rdx
je 0x140025712
test rcx, rcx
je 0x140025723
cmp dword [0x1402d3d94], 0
je 0x140025723
add rdx, 0x40
mov qword [rsp + 0x20], rsi
mov r9d, 0xc
lea r8, [rsp + 0x3c]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x140025723
mov qword [rsp + 0x3c], 0
mov dword [rsp + 0x44], 0
movsd xmm0, qword [rsp + 0x3c]
movsd qword [rsp + 0x50], xmm0
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x58], eax
lea rcx, [rsp + 0x50]
call fcn.1400240d0
mov rdx, qword [0x1402d4220]
test rdx, rdx
je 0x140025979
mov rcx, qword [0x1402d3e28]
test rcx, rcx
je 0x14002578c
cmp dword [0x1402d3d94], 0
je 0x14002578c
add rdx, qword [0x1402d3d70]
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1402d3e28]
mov rbx, qword [rbp + 0xc8]
test rbx, rbx
je 0x140025979
cmp byte [0x1402d2b39], 0
je 0x140025815
test rcx, rcx
je 0x1400257d6
cmp dword [0x1402d3d94], 0
je 0x1400257d6
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1402d3e28]
mov dword [rbp], 0
test rcx, rcx
je 0x140025815
cmp dword [0x1402d3d94], 0
je 0x140025815
mov rdx, qword [rbp + 0x80]
add rdx, 0x2f4
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rbp]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x1402d3e28]
cmp byte [0x1402d2b3b], 0
je 0x14002588e
test rcx, rcx
je 0x14002584f
cmp dword [0x1402d3d94], 0
je 0x14002584f
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1402d3e28]
mov dword [rbp + 8], 0x447a0000
test rcx, rcx
je 0x14002588e
cmp dword [0x1402d3d94], 0
je 0x14002588e
mov rdx, qword [rbp + 0x88]
add rdx, 0x134
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x1402d3e28]
cmp byte [0x1402d2b3a], 0
je 0x140025907
test rcx, rcx
je 0x1400258c8
cmp dword [0x1402d3d94], 0
je 0x1400258c8
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1402d3e28]
mov dword [rbp + 0x10], 0
test rcx, rcx
je 0x140025907
cmp dword [0x1402d3d94], 0
je 0x140025907
mov rdx, qword [rbp + 0x90]
add rdx, 0x84
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x1402d3e28]
cmp byte [0x1402d2b3c], 0
je 0x140025979
test rcx, rcx
je 0x140025941
cmp dword [0x1402d3d94], 0
je 0x140025941
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1402d3e28]
mov dword [rbp - 0x28], 0x447a0000
test rcx, rcx
je 0x140025979
cmp dword [0x1402d3d94], 0
je 0x140025979
mov rdx, qword [rbp + 0x98]
add rdx, 0x28c
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x1402d2b88], 0
je 0x140024af0
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.140089c70
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3