Function at 0x1400a83d0
Capabilities:
Enumerate processes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x650]
sub rsp, 0x750
mov rax, qword [0x1401ab100]
xor rax, rsp
mov qword [rbp + 0x640], rax
mov r15, rdx
mov r12d, ecx
xor r13d, r13d
mov dword [rsp + 0x40], r13d
mov byte [0x140264cac], 1
lea rcx, [rsp + 0x50]
call fcn.1400d11c0
mov rbx, rax
mov r8, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rax, rcx
sub rax, r8
cmp rax, 2
jb 0x1400a84bd
lea rax, [r8 + 2]
mov qword [rbx + 0x10], rax
mov rdi, rbx
cmp rcx, 0xf
jbe 0x1400a8452
mov rdi, qword [rbx]
lea rax, [0x140172562]
lea r14, [0x140172560]
cmp rax, rdi
jbe 0x1400a8480
lea rax, [rdi + r8]
cmp r14, rax
ja 0x1400a8480
cmp rdi, r14
ja 0x1400a8478
mov rsi, r13
jmp 0x1400a8485
mov rsi, rdi
sub rsi, r14
jmp 0x1400a8485
mov esi, 2
lea rcx, [rdi + 2]
inc r8
mov rdx, rdi
call fcn.140152160
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call fcn.140152160
lea rcx, [rdi + rsi]
mov r8d, 2
sub r8, rsi
lea rdx, [r14 + 2]
add rdx, rsi
call fcn.140152160
jmp 0x1400a84e2
mov qword [rsp + 0x28], 2
lea r14, [0x140172560]
mov qword [rsp + 0x20], r14
mov edx, 2
mov rcx, rbx
call fcn.1400156d0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], r13
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rbx + 0x10], r13
mov esi, reloc.WS2_32.dll_ntohs
mov qword [rbx + 0x18], rsi
mov byte [rbx], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, rsi
jbe 0x1400a854c
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a8547
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a9b0e
call fcn.140074ba0
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], rsi
mov byte [rsp + 0x50], 0
cmp r12d, 0xa
je 0x1400a85a6
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x1400a859c
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a8597
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a9af1
call fcn.140074ba0
mov eax, 1
jmp 0x1400a8a4c
mov rdx, qword [r15 + 8]
mov qword [0x140264e28], rdx
mov rdi, qword [r15 + 0x20]
mov rbx, qword [r15 + 0x30]
mov r14, qword [r15 + 0x38]
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], r13
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x1400a85d3
lea rcx, [rbp + 0x40]
call fcn.1400115f0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], r13
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdi + r8], 0
jne 0x1400a8600
mov rdx, rdi
lea rcx, [rbp + 0x20]
call fcn.1400115f0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], r13
mov qword [rbp + 0x98], r13
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], 0
jne 0x1400a8636
mov rdx, rbx
lea rcx, [rbp + 0x80]
call fcn.1400115f0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x78], r13
mov r8, 0xffffffffffffffff
inc r8
cmp byte [r14 + r8], 0
jne 0x1400a8666
mov rdx, r14
lea rcx, [rbp + 0x60]
call fcn.1400115f0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], 0
jne 0x1400a8696
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.1400115f0
nop
lea r8, [rbp + 0x60]
lea rdx, [rsp + 0x50]
lea rcx, [rbp]
call fcn.1400aa990
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400a86ff
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a86f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a9b14
call fcn.140074ba0
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x1400a873a
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a8735
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a9b25
call fcn.140074ba0
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x1400a9b1a
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rdx, [rbp]
lea rcx, [rsp + 0x50]
call fcn.14000bf10
mov rdi, rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x70]
call fcn.14000bf10
mov rbx, rax
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x70]
call fcn.14000bf10
nop
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.1400a9c00
lea rcx, [0x140262fa0]
test al, al
je 0x1400a9af7
lea rdx, str._n___ready_n
call fcn.14000f200
lea rcx, [rbp - 0x50]
mov r8, qword [rbp - 0x40]
cmp qword [rbp - 0x38], 0xf
jbe 0x1400a87cd
mov rdx, qword [rbp - 0x50]
add r8, rdx
jmp 0x1400a87d4
add r8, rcx
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140010180
nop
mov ebx, r13d
mov dword [rsp + 0x48], ebx
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400a887f
mov dword [rbp + 0x430], 0x130
lea rdx, [rbp + 0x430]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400a887f
nop dword [rax + rax]
mov dword [rsp + 0x28], 0x104
lea rax, [rbp + 0x1f0]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rbp + 0x45c]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rdx, str.RustClient.exe
lea rcx, [rbp + 0x1f0]
call fcn.14007cd1c
test eax, eax
cmove ebx, dword [rbp + 0x438]
lea rdx, [rbp + 0x430]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400a8820
mov dword [rsp + 0x48], ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x1400a8a7c
cmp byte [0x140264cac], 0
je 0x1400a8a7c
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Error
lea rdx, str.close_game_before_launching
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x1400a88fa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a88f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a9b25
call fcn.140074ba0
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r13w
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x1400a8946
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a8941
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a9ae5
call fcn.140074ba0
mov byte [rbp], 0
mov qword [rbp + 0x18], rsi
mov qword [rbp + 0x10], r13
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x1400a8994
inc rdx
mov rcx, qword [rbp + 0x80]
cmp rdx, 0x1000
mov rax, rcx
jb 0x1400a898e
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a9b37
call fcn.140074ba0
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x1400a89d0
inc rdx
mov rcx, qword [rbp + 0x20]
cmp rdx, 0x1000
mov rax, rcx
jb 0x1400a89ca
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a9b3d
call fcn.140074ba0
nop
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x1400a8a0c
inc rdx
mov rcx, qword [rbp + 0x40]
cmp rdx, 0x1000
mov rax, rcx
jb 0x1400a8a06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a9b43
call fcn.140074ba0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x1400a8a47
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a8a42
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a9af1
call fcn.140074ba0
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x640]
xor rcx, rsp
call fcn.140074b80
lea r11, [rsp + 0x750]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rdx, str.____preparing_driver_n
lea rcx, [0x140262fa0]
call fcn.14000f200
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rcx, qword [rbp - 0x30]
call fcn.14012c990
cmp eax, 0xffffffff
jne 0x1400a8b58
lea rdx, str.____drv_failed_nPress_enter_to_continue..._n
lea rcx, [0x140262fa0]
call fcn.14000f200
call fcn.14000b090
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x1400a8b04
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a8aff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a9b25
call fcn.140074ba0
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r13w
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x1400a8946
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a8941
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a9ae5
jmp 0x1400a8941
mov qword [rsp + 0x40], 0x1f4
lea rcx, [rsp + 0x40]
call fcn.14000ff50
mov ecx, Ordinal_26
call fcn.140074cc8
mov r14, rax
mov qword [rbp + 0x60], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], rax
mov r13, qword [rbp - 0x40]
movabs rax, 0x7fffffffffffffff
mov rcx, rax
sub rcx, r13
cmp rcx, 4
jb 0x1400a9b2b
lea r12, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova r12, qword [rbp - 0x50]
movups xmmword [rsp + 0x50], xmm0
xor edx, edx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rdx
lea r15, [r13 + 4]
lea rdi, [rsp + 0x50]
cmp r15, 0xf
jbe 0x1400a8c50
mov rsi, r15
or rsi, 0xf
cmp rsi, rax
jbe 0x1400a8c11
mov rsi, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140074cc8
test rax, rax
je 0x1400a9b31
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400a8c4b
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmp rsi, rax
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x1400a8c39
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400a9aeb
jmp 0x1400a8bf2
test rcx, rcx
je 0x1400a8c48
call fcn.140074cc8
mov rdi, rax
jmp 0x1400a8c4b
mov rdi, rdx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], rsi
mov eax, dword [0x1401725f4]
mov dword [rdi], eax
lea rcx, [rdi + 4]
mov r8, r13
mov rdx, r12
call fcn.140152160
mov byte [rdi + r15], 0
mov dword [rsp + 0x40], 7
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
xor esi, esi
mov qword [r14], rsi
mov qword [r14 + 8], rsi
mov dword [r14 + 0x10], esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [r14], rax
mov rdx, rax
call fcn.14000b2a0
mov rcx, rax
lea rdx, str.______drive_n
call fcn.14000f200
nop
mov qword [0x140264ec8], r14
lea rcx, [rsp + 0x50]
call fcn.140007a90
mov rax, qword [0x140264ec8]
lea rcx, [0x140262fa0]
cmp qword [rax], 0xffffffffffffffff
jne 0x1400a8e29
lea rdx, str.____drv_failed2_nPress_enter_to_continue..._n
call fcn.14000f200
call fcn.14000b090
nop
lea rcx, [rbp - 0x30]
call fcn.140003630
nop
lea rcx, [rbp]
call fcn.140007a90
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x1400a8d6e
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a8d68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a9b37
call fcn.140074ba0
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x1400a8daa
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a8da4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a9b3d
call fcn.140074ba0
nop
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x1400a8de6
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a8de0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a9b43
call fcn.140074ba0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x1400a8a47
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a8a42
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a9af1
jmp 0x1400a8a42
lea rdx, str.___drv_ready_n
call fcn.14000f200
lea rcx, str.Medal.exe
call fcn.1400d20b0
test eax, eax
jne 0x1400a8f1c
mov qword [rsp + 0x40], 0x3e8
xor ebx, ebx
nop dword [rax]
nop dword [rax + rax]
mov edi, ebx
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400a8efb
mov dword [rbp + 0x430], 0x130
lea rdx, [rbp + 0x430]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400a8efb
nop dword [rax + rax]
mov dword [rsp + 0x28], 0x104
lea rax, [rbp + 0x1f0]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rbp + 0x45c]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rdx, str.Medal.exe
lea rcx, [rbp + 0x1f0]
call fcn.14007cd1c
test eax, eax
cmove edi, dword [rbp + 0x438]
lea rdx, [rbp + 0x430]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400a8ea0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x40]
call fcn.14000ff50
test edi, edi
je 0x1400a8e60
mov ebx, dword [rsp + 0x48]
xor esi, esi
lea rdx, str.medal_ready_n
lea rcx, [0x140262fa0]
call fcn.14000f200
lea rcx, [rsp + 0x40]
call fcn.140002970
movabs r15, 0x7fffffffc46535ff
mov rax, qword [rsp + 0x40]
movabs r14, 0x7fffffffffffffff
cmp rax, r15
jge 0x1400a8f64
add rax, 0x3b9aca00
mov qword [rsp + 0x40], rax
jmp 0x1400a8f69
mov qword [rsp + 0x40], r14
lea rcx, [rsp + 0x40]
call fcn.1400144d0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.vvare
lea rdx, str.start_game_now
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
test ebx, ebx
jne 0x1400a9066
mov qword [rsp + 0x40], 0x3e8
mov ebx, esi
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400a904b
mov dword [rbp + 0x430], 0x130
lea rdx, [rbp + 0x430]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400a904b
nop dword [rax]
mov dword [rsp + 0x28], 0x104
lea rax, [rbp + 0x1f0]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rbp + 0x45c]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rdx, str.RustClient.exe
lea rcx, [rbp + 0x1f0]
call fcn.14007cd1c
test eax, eax
cmove ebx, dword [rbp + 0x438]
lea rdx, [rbp + 0x430]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400a8ff0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x40]
call fcn.14000ff50
test ebx, ebx
je 0x1400a8fb1
mov edx, ebx
call fcn.14000b6d0
mov rcx, rax
lea rdx, str._get_rust_n
call fcn.14000f200
mov ecx, ebx
mov rax, qword [0x140264ec8]
mov qword [rax + 8], rcx
cmp qword [0x140264df0], 0
jne 0x1400a90f5
nop dword [rax]
nop word [rax + rax]
lea rdx, str.MedalOverlay
lea rcx, str.MedalOverlayClass
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x140264df0], rax
lea rcx, [rsp + 0x48]
call fcn.140002970
mov rax, qword [rsp + 0x48]
cmp rax, r15
jge 0x1400a90dc
add rax, 0x3b9aca00
mov qword [rsp + 0x40], rax
jmp 0x1400a90e1
mov qword [rsp + 0x40], r14
lea rcx, [rsp + 0x40]
call fcn.1400144d0
cmp qword [0x140264df0], 0
je 0x1400a90a0
cmp byte [0x140264cac], 0
je 0x1400a9172
movabs rbx, 0x7fffffffff67697f
nop dword [rax + rax]
mov ecx, reloc.WLDAP32.dll_Ordinal_46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1400a915b
lea rcx, [rsp + 0x48]
call fcn.140002970
mov rax, qword [rsp + 0x48]
cmp rax, rbx
jge 0x1400a9141
add rax, 0x989680
mov qword [rsp + 0x40], rax
jmp 0x1400a9146
mov qword [rsp + 0x40], r14
lea rcx, [rsp + 0x40]
call fcn.1400144d0
cmp byte [0x140264cac], 0
jne 0x1400a9110
jmp 0x1400a9172
cmp byte [0x140264cac], 0
je 0x1400a9172
mov edx, reloc.WLDAP32.dll_Ordinal_200
lea ecx, [rdx + 0x64]
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 8
call fcn.140074cc8
lea rcx, [0x1400b5f90]
mov qword [rax], rcx
mov qword [rbp + 0x60], rax
lea rcx, [rbp - 8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140015bf0]
xor edx, edx
xor ecx, ecx
call fcn.14007d57c
mov qword [rbp - 0x10], rax
test rax, rax
je 0x1400a9ad7
cmp byte [0x140264d45], 0
jne 0x1400a9209
movabs rbx, 0x7fffffffee1e5cff
nop word [rax + rax]
lea rcx, [rsp + 0x48]
call fcn.140002970
mov rax, qword [rsp + 0x48]
cmp rax, rbx
jge 0x1400a91f1
add rax, 0x11e1a300
mov qword [rsp + 0x40], rax
jmp 0x1400a91f6
mov qword [rsp + 0x40], r14
lea rcx, [rsp + 0x40]
call fcn.1400144d0
cmp byte [0x140264d45], 0
je 0x1400a91d0
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x140264d74], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x140264d9c], eax
movups xmm0, xmmword [str.GameAssembly.dll]
movaps xmmword [rbp + 0x430], xmm0
movups xmm1, xmmword [0x140172698]
movaps xmmword [rbp + 0x440], xmm1
movzx eax, word [0x1401726a8]
mov word [rbp + 0x450], ax
xor edx, edx
mov r8d, 0x1e6
lea rcx, [rbp + 0x452]
call fcn.140152800
mov rcx, qword [0x140264ec8]
mov qword [rbp + 0x1f8], rsi
mov qword [rbp + 0x200], rsi
mov qword [rbp + 0x208], rsi
mov qword [rbp + 0x210], rsi
mov qword [rbp + 0x218], rsi
mov rax, qword [rcx + 8]
mov qword [rbp + 0x1f0], rax
mov rdx, rsi
nop
movzx eax, word [rbp + rdx + 0x430]
mov word [rbp + rdx + 0x220], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x1400a92a0
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x238
lea rax, [rbp + 0x1f0]
mov qword [rsp + 0x20], rax
mov r9d, 0x238
lea r8, [rbp + 0x1f0]
mov edx, 0x221de4
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1400a9309
lea rdx, str.failed_get_module_base_n_n
lea rcx, [0x140262fa0]
call fcn.14000f200
mov rax, qword [rbp + 0x218]
mov qword [0x140264d48], rax
mov rax, qword [0x140262fa0]
movsxd rcx, dword [rax + 4]
lea rax, [0x140262fb8]
add rcx, rax
mov eax, dword [rcx]
and eax, 0xfffff9ff
bts eax, 0xb
mov dword [rcx], eax
lea rdx, str.gBjasfje_addr:__0x
lea rcx, [0x140262fa0]
call fcn.14000f200
mov rdx, qword [0x140264d48]
mov rcx, rax
call fcn.14000b4d0
mov rcx, rax
lea rdx, [0x140170ac4]
call fcn.14000f200
cmp qword [0x140264d48], 0
jne 0x1400a93c1
cmp dword [rbp - 8], 0
jne 0x1400a9be8
lea rcx, [rbp - 0x30]
call fcn.140003630
nop
lea rcx, [rbp]
call fcn.140007a90
nop
lea rcx, [rbp + 0x80]
call fcn.140007a90
nop
lea rcx, [rbp + 0x20]
call fcn.140007a90
nop
lea rcx, [rbp + 0x40]
call fcn.140007a90
nop
lea rcx, [rbp - 0x50]
call fcn.140007a90
jmp 0x1400a8a47
cmp byte [0x140264cac], 0
je 0x1400a93d8
mov edx, reloc.WLDAP32.dll_Ordinal_200
lea ecx, [rdx + 0x64]
call qword [sym.imp.KERNEL32.dll_Beep]
mov qword [rsp + 0x40], Ordinal_301
lea rcx, [rsp + 0x40]
call fcn.14000ff50
mov ecx, Ordinal_26
call fcn.140074cc8
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov rbx, qword [0x1402650b0]
mov qword [0x1402650b0], rax
test rbx, rbx
je 0x1400a9449
mov rdx, qword [rbx + 0x10]
test rdx, rdx
je 0x1400a9421
call fcn.14000d8a0
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x1400a942f
call fcn.14000d8a0
mov rdx, qword [rbx]
test rdx, rdx
je 0x1400a943c
call fcn.14000d8a0
mov edx, Ordinal_26
mov rcx, rbx
call fcn.140074ba0
lea rcx, [rsp + 0x40]
call fcn.1400102e0
mov rdx, rax
mov rcx, qword [0x1402650b0]
call fcn.14000f1d0
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x1400a9471
call fcn.14000d8a0
lea rcx, [rsp + 0x40]
call fcn.1400102e0
mov rcx, qword [0x1402650b0]
add rcx, 8
mov rdx, rax
call fcn.14000f1d0
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x1400a949d
call fcn.14000d8a0
lea rcx, [rsp + 0x40]
call fcn.1400102e0
mov rcx, qword [0x1402650b0]
add rcx, 0x10
mov rdx, rax
call fcn.14000f1d0
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x1400a94c9
call fcn.14000d8a0
mov ecx, Ordinal_26
call fcn.140074cc8
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
lea rcx, [0x140265068]
call fcn.1400103c0
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x1400a9513
mov rcx, rbx
call fcn.14000d390
mov edx, Ordinal_26
mov rcx, rbx
call fcn.140074ba0
mov ecx, Ordinal_26
call fcn.140074cc8
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
lea rcx, [0x1402650e8]
call fcn.1400103c0
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x1400a955d
mov rcx, rbx
call fcn.14000d390
mov edx, Ordinal_26
mov rcx, rbx
call fcn.140074ba0
mov ecx, Ordinal_26
call fcn.140074cc8
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
lea rcx, [0x1402650b8]
call fcn.140010410
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x1400a95a7
mov rcx, rbx
call fcn.14000d130
mov edx, Ordinal_26
mov rcx, rbx
call fcn.140074ba0
mov ecx, Ordinal_26
call fcn.140074cc8
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
lea rcx, [0x1402650c8]
call fcn.140010410
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x1400a95f1
mov rcx, rbx
call fcn.14000d130
mov edx, Ordinal_26
mov rcx, rbx
call fcn.140074ba0
mov ecx, Ordinal_26
call fcn.140074cc8
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
lea rcx, [0x140265060]
call fcn.140010410
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x1400a963b
mov rcx, rbx
call fcn.14000d130
mov edx, Ordinal_26
mov rcx, rbx
call fcn.140074ba0
mov ecx, Ordinal_26
call fcn.140074cc8
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
lea rcx, [0x1402650f8]
call fcn.140010410
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x1400a9685
mov rcx, rbx
call fcn.14000d130
mov edx, Ordinal_26
mov rcx, rbx
call fcn.140074ba0
mov ecx, Ordinal_26
call fcn.140074cc8
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
lea rcx, [0x140265050]
call fcn.140010410
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x1400a96cf
mov rcx, rbx
call fcn.14000d130
mov edx, Ordinal_26
mov rcx, rbx
call fcn.140074ba0
lea rcx, [rsp + 0x40]
call fcn.140010460
mov rdx, qword [rax]
mov qword [rax], rsi
mov rcx, qword [0x140265058]
mov qword [0x140265058], rdx
test rcx, rcx
je 0x1400a96fc
mov edx, 1
call fcn.14000da30
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400a9710
mov edx, 1
call fcn.14000da30
lea rcx, [rsp + 0x40]
call fcn.140010460
mov rdx, qword [rax]
mov qword [rax], rsi
mov rcx, qword [0x140265100]
mov qword [0x140265100], rdx
test rcx, rcx
je 0x1400a973d
mov edx, 1
call fcn.14000da30
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400a9751
mov edx, 1
call fcn.14000da30
lea rcx, [rsp + 0x40]
call fcn.140010460
mov rdx, qword [rax]
mov qword [rax], rsi
mov rcx, qword [0x1402650e0]
mov qword [0x1402650e0], rdx
test rcx, rcx
je 0x1400a977e
mov edx, 1
call fcn.14000da30
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400a9792
mov edx, 1
call fcn.14000da30
mov qword [rsp + 0x40], Ordinal_301
lea rcx, [rsp + 0x40]
call fcn.14000ff50
lea rdx, [0x1400af3a0]
lea rcx, [rbp + 0x150]
call fcn.140010550
nop
lea rdx, [0x1400ae1b0]
lea rcx, [rbp + 0x140]
call fcn.140010550
nop
lea rdx, [0x1400ab620]
lea rcx, [rbp + 0x130]
call fcn.140010550
nop
lea rdx, [0x1400ac940]
lea rcx, [rbp + 0x120]
call fcn.140010550
nop
lea rdx, [0x1400acce0]
lea rcx, [rbp + 0x110]
call fcn.140010550
nop
lea rdx, [0x1400aced0]
lea rcx, [rbp + 0x100]
call fcn.140010550
nop
lea rdx, [0x1400aae80]
lea rcx, [rbp + 0xf0]
call fcn.140010550
nop
lea rdx, [0x1400ac7a0]
lea rcx, [rbp + 0xe0]
call fcn.140010550
nop
lea rdx, [0x1400abe80]
lea rcx, [rbp + 0xd0]
call fcn.140010550
nop
lea rdx, [0x1400ac380]
lea rcx, [rbp + 0xc0]
call fcn.140010550
nop
lea rdx, [0x1400ac430]
lea rcx, [rbp + 0xb0]
call fcn.140010550
nop
lea rdx, [0x1400abd30]
lea rcx, [rbp + 0xa0]
call fcn.140010550
nop
lea rdx, [0x1400abc50]
lea rcx, [rbp + 0x1e0]
call fcn.140010550
nop
lea rdx, [0x1400cf360]
lea rcx, [rbp + 0x1d0]
call fcn.140010550
nop
lea rdx, [0x1400cf4f0]
lea rcx, [rbp + 0x1c0]
call fcn.140010550
nop
lea rdx, [0x1400ac2f0]
lea rcx, [rbp + 0x1b0]
call fcn.140010550
nop
lea rdx, [0x1400ac120]
lea rcx, [rbp + 0x1a0]
call fcn.140010550
nop
lea rdx, [0x1400abfe0]
lea rcx, [rbp + 0x190]
call fcn.140010550
nop
lea rdx, [0x1400ad330]
lea rcx, [rbp + 0x180]
call fcn.140010550
nop
lea rdx, [0x1400ad4b0]
lea rcx, [rbp + 0x170]
call fcn.140010550
nop
lea rdx, [0x1400ae070]
lea rcx, [rbp + 0x160]
call fcn.140010550
nop
cmp dword [rbp - 8], 0
je 0x1400a9b49
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp - 8], eax
je 0x1400a9b54
movaps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp + 0x60], xmm0
xor edx, edx
lea rcx, [rbp + 0x60]
call fcn.140071a30
test eax, eax
jne 0x1400a9b5f
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
cmp dword [rbp + 0x168], eax
jne 0x1400a9b6a
cmp dword [rbp + 0x178], eax
jne 0x1400a9b70
cmp dword [rbp + 0x188], eax
jne 0x1400a9b76
cmp dword [rbp + 0x198], eax
jne 0x1400a9b7c
cmp dword [rbp + 0x1a8], eax
jne 0x1400a9b82
cmp dword [rbp + 0x1b8], eax
jne 0x1400a9b88
cmp dword [rbp + 0x1c8], eax
jne 0x1400a9b8e
cmp dword [rbp + 0x1d8], eax
jne 0x1400a9b94
cmp dword [rbp + 0x1e8], eax
jne 0x1400a9b9a
cmp dword [rbp + 0xa8], eax
jne 0x1400a9ba0
cmp dword [rbp + 0xb8], eax
jne 0x1400a9ba6
cmp dword [rbp + 0xc8], eax
jne 0x1400a9bac
cmp dword [rbp + 0xd8], eax
jne 0x1400a9bb2
cmp dword [rbp + 0xe8], eax
jne 0x1400a9bb8
cmp dword [rbp + 0xf8], eax
jne 0x1400a9bbe
cmp dword [rbp + 0x108], eax
jne 0x1400a9bc4
cmp dword [rbp + 0x118], eax
jne 0x1400a9bca
cmp dword [rbp + 0x128], eax
jne 0x1400a9bd0
cmp dword [rbp + 0x138], eax
jne 0x1400a9bd6
cmp dword [rbp + 0x148], eax
jne 0x1400a9bdc
cmp dword [rbp + 0x158], eax
jne 0x1400a9be2
psrldq xmm0, 8
movd eax, xmm0
test eax, eax
jne 0x1400a9be8
lea rcx, [rbp - 0x30]
call fcn.140003630
nop
lea rcx, [rbp]
call fcn.140007a90
nop
lea rcx, [rbp + 0x80]
call fcn.140007a90
nop
lea rcx, [rbp + 0x20]
call fcn.140007a90
nop
lea rcx, [rbp + 0x40]
call fcn.140007a90
nop
lea rcx, [rbp - 0x50]
call fcn.140007a90
xor eax, eax
jmp 0x1400a8a4c
mov dword [rbp - 8], esi
mov ecx, 6
call fcn.140071dd8
nop
call fcn.140087618
nop
call fcn.1400019a0
nop
call fcn.140087618
nop
lea rdx, str._n____failed_n
call fcn.14000f200
mov ecx, 1
call fcn.14007c058
nop
call fcn.140087618
nop
call fcn.140087618
nop
mov ecx, 1
call fcn.14007c058
int3
call fcn.140087618
nop
call fcn.140001a40
int3
call fcn.140087618
nop
call fcn.140087618
nop
call fcn.140087618
nop
call fcn.140087618
nop
mov ecx, 1
call fcn.140071dd8
int3
mov ecx, 5
call fcn.140071dd8
int3
mov ecx, 2
call fcn.140071dd8
nop
call fcn.1400847b8
nop
call fcn.1400847b8
nop
call fcn.1400847b8
nop
call fcn.1400847b8
nop
call fcn.1400847b8
nop
call fcn.1400847b8
nop
call fcn.1400847b8
nop
call fcn.1400847b8
nop
call fcn.1400847b8
nop
call fcn.1400847b8
nop
call fcn.1400847b8
nop
call fcn.1400847b8
nop
call fcn.1400847b8
nop
call fcn.1400847b8
nop
call fcn.1400847b8
nop
call fcn.1400847b8
nop
call fcn.1400847b8
nop
call fcn.1400847b8
nop
call fcn.1400847b8
nop
call fcn.1400847b8
nop
call fcn.1400847b8
nop
call fcn.1400847b8
int3