Function at 0x140001360
Capabilities:
Enumerate processes
Parse pe header

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0xd8]
sub rsp, 0x1d0
mov rax, qword [0x140059010]
xor rax, rsp
mov qword [rbp + 0x90], rax
cmp byte [0x140059050], 1
jne 0x140002584
mov rcx, qword [0x14008a980]
lea rdx, [0x140059050]
mov r8d, dword [0x14008a970]
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov eax, dword [rcx + 0x40f0]
mov qword [r11 + 0x18], rdi
or eax, 2
mov dword [rcx + 0x40f0], eax
or eax, 0x40
movsd xmm0, qword [0x140059058]
mov qword [r11 - 0x10], r12
mov qword [r11 - 0x18], r13
mov qword [r11 - 0x20], r14
movsd qword [rcx + 0x4114], xmm0
mov dword [rcx + 0x40f0], eax
mov dword [rcx + 0x40f8], 2
mov dword [rcx + 0x4150], 0x3f800000
lea rcx, str.VloneHack__t.me_VloneHack
mov qword [r11 - 0x28], r15
movaps xmmword [r11 - 0x38], xmm6
call fcn.1400129d0
mov sil, 0x15
mov byte [rsp + 0x30], 0x3b
xor sil, 0x3b
mov cl, 0x7f
mov dl, 0x16
mov byte [rsp + 0x3a], sil
mov bl, 0x5e
xor cl, 0x3b
xor dl, 0x3b
mov byte [rsp + 0x32], cl
xor esi, esi
mov byte [rsp + 0x33], dl
mov dil, 0x49
mov al, 0x73
mov r8b, 0x6b
mov r9b, 0x57
mov r10b, 0x5a
mov r11b, 0x42
movzx r14d, bl
lea ecx, [rsi + 2]
movzx r12d, bl
xor dil, 0x3b
xor al, 0x3b
mov byte [rsp + 0x39], dil
xor r8b, 0x3b
mov byte [rsp + 0x31], al
xor r9b, 0x3b
mov byte [rsp + 0x34], r8b
xor r10b, 0x3b
mov byte [rsp + 0x35], r9b
xor r11b, 0x3b
mov byte [rsp + 0x36], r10b
mov r15b, 0x43
mov byte [rsp + 0x37], r11b
xor r13d, r13d
xor bl, 0x3b
xor r14b, 0x3b
mov byte [rsp + 0x38], bl
xor r15b, 0x3b
mov byte [rsp + 0x3b], r14b
xor r12b, 0x3b
mov byte [rsp + 0x3c], r15b
xor edx, edx
mov byte [rsp + 0x3d], r12b
mov byte [rsp + 0x3e], r13b
mov edi, esi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r15, qword [rsp + 0x1b0]
mov rbx, rax
mov r13, qword [rsp + 0x1c0]
mov r12, qword [rsp + 0x1c8]
cmp rax, 0xffffffffffffffff
je 0x1400024be
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14000152b
nop word [rax + rax]
lea rdx, [rsp + 0x31]
lea rcx, [rbp - 0x74]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140001527
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140001500
jmp 0x14000152b
mov edi, dword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
mov dword [0x14008a9dc], edi
setne byte [0x14008a9d1]
test edi, edi
je 0x1400024d8
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x48], 0x42640000
lea rcx, str.Legit
mov dword [rsp + 0x4c], 0x41980000
call fcn.140041c10
test al, al
je 0x140001576
mov dword [0x14008a9d8], esi
movss xmm1, dword [0x140051b88]
xorps xmm0, xmm0
xorps xmm6, xmm6
call fcn.1400170c0
lea rcx, str.Visuals
mov dword [rsp + 0x48], 0x42700000
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x4c], 0x41980000
call fcn.140041c10
test al, al
je 0x1400015b8
mov dword [0x14008a9d8], 1
movss xmm1, dword [0x140051b88]
xorps xmm0, xmm0
call fcn.1400170c0
lea rcx, str.Misc
mov dword [rsp + 0x48], 0x42640000
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x4c], 0x41980000
call fcn.140041c10
test al, al
je 0x1400015f7
mov dword [0x14008a9d8], 2
movss xmm1, dword [0x140051b88]
xorps xmm0, xmm0
call fcn.1400170c0
lea rcx, str.Other
mov dword [rsp + 0x48], 0x42640000
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x4c], 0x41980000
call fcn.140041c10
test al, al
je 0x140001636
mov dword [0x14008a9d8], 3
mov rcx, qword [0x14008a980]
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x48], 0x42880000
mov dword [rsp + 0x4c], 0x41980000
mov rax, qword [rcx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rcx + 0x3fe0]
lea rcx, str.Unhook
movss xmm0, dword [rax + 0x48]
subss xmm0, dword [rax + 0x98]
movss xmm2, dword [rax + 0x4c]
subss xmm2, dword [rax + 0x9c]
addss xmm0, dword [0x140051c28]
addss xmm2, dword [0x140051be4]
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
call fcn.140041c10
test al, al
je 0x140001769
cmp byte [0x14008a9e2], sil
je 0x1400016eb
call fcn.1400033a0
cmp byte [0x14008a9d6], sil
je 0x1400016f9
call fcn.1400036d0
cmp byte [0x14008a9d5], sil
je 0x140001707
call fcn.140003a10
cmp byte [0x14008a9d3], sil
je 0x140001715
call fcn.140003d70
cmp byte [0x14008a9d4], sil
je 0x140001723
call fcn.140003060
cmp byte [0x14008a9d2], sil
je 0x140001731
call fcn.1400040e0
cmp byte [0x14008a9d7], sil
je 0x14000173f
call fcn.140004450
cmp byte [0x14008a9e0], sil
je 0x14000174d
call fcn.1400047c0
cmp byte [0x14008a9d0], sil
je 0x14000175b
call fcn.140004b00
cmp byte [0x14008a9e1], sil
je 0x140001769
call fcn.140002d10
mov eax, dword [0x14008a9d8]
test eax, eax
jne 0x140001bae
mov rbx, qword [0x14008a980]
lea rcx, str.child0
xor edx, edx
mov dword [rsp + 0x48], 0x43b88000
mov dword [rsp + 0x4c], 0x438d0000
mov rax, qword [rbx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rbx + 0x3fe0]
movss xmm0, dword [rax + 0x48]
subss xmm0, dword [rax + 0x98]
movss xmm2, dword [rax + 0x4c]
subss xmm2, dword [rax + 0x9c]
addss xmm0, dword [0x140051bc4]
addss xmm2, dword [0x140051bec]
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
mov rax, qword [rbx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov r8, qword [rbx + 0x3fe0]
movsxd rax, dword [r8 + 0x108]
mov r8, qword [r8 + 0x110]
mov r8d, dword [r8 + rax*4 - 4]
call fcn.140006ea0
mov edi, eax
cmp dword [rbx + 0x401c], eax
jne 0x140001858
lea r8, str.child0
mov edx, 0xb
mov ecx, eax
call fcn.1400290d0
lea r8, [rsp + 0x48]
mov edx, edi
lea rcx, str.child0
call fcn.14000f930
mov cl, 0x33
mov byte [rsp + 0x48], 0x5a
movzx ebx, cl
mov byte [rsp + 0x52], sil
xor cl, 0x5a
mov dl, 0x37
xor dl, 0x5a
mov byte [rsp + 0x4a], cl
mov al, 0x1b
mov byte [rsp + 0x4b], dl
mov r8b, 0x7a
lea rcx, [rsp + 0x49]
mov r9b, 0x16
lea rdx, [0x14008a9e2]
mov r10b, 0x3f
mov r11b, 0x3d
xor al, 0x5a
xor r8b, 0x5a
xor r9b, 0x5a
mov byte [rsp + 0x49], al
xor r10b, 0x5a
mov byte [rsp + 0x4c], r8b
xor r11b, 0x5a
mov byte [rsp + 0x4d], r9b
mov dil, 0x2e
mov byte [rsp + 0x4e], r10b
xor bl, 0x5a
mov byte [rsp + 0x4f], r11b
xor dil, 0x5a
mov byte [rsp + 0x50], bl
mov byte [rsp + 0x51], dil
call fcn.140043220
test al, al
je 0x1400018ff
cmp byte [0x14008a9e2], sil
je 0x1400018fa
call fcn.140003200
jmp 0x1400018ff
call fcn.1400033a0
mov cl, 0x4c
mov byte [rsp + 0x30], 0x25
movzx ebx, cl
mov dl, 0x48
movzx esi, dl
xor cl, 0x25
xor dl, 0x25
mov byte [rsp + 0x32], cl
mov al, 0x64
mov byte [rsp + 0x33], dl
mov r8b, 5
lea rdx, [0x14008a9d6]
mov r9b, 0x68
lea rcx, [rsp + 0x31]
mov r10b, 0x40
mov r11b, 0x41
xor al, 0x25
xor r8b, 0x25
xor r9b, 0x25
mov byte [rsp + 0x31], al
xor r10b, 0x25
mov byte [rsp + 0x34], r8b
xor r11b, 0x25
mov byte [rsp + 0x35], r9b
mov dil, 0x50
mov byte [rsp + 0x36], r10b
xor r14d, r14d
mov byte [rsp + 0x37], r11b
xor bl, 0x25
mov byte [rsp + 0x3b], r14b
xor dil, 0x25
mov byte [rsp + 0x38], bl
xor sil, 0x25
mov byte [rsp + 0x39], dil
mov byte [rsp + 0x3a], sil
call fcn.140043220
test al, al
je 0x1400019a2
cmp byte [0x14008a9e2], r14b
je 0x14000199d
call fcn.140003540
jmp 0x1400019a2
call fcn.1400036d0
mov rbx, qword [0x14008a980]
lea rcx, str.child1
xor edx, edx
mov dword [rsp + 0x48], 0x433c0000
mov dword [rsp + 0x4c], 0x43090000
mov rax, qword [rbx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rbx + 0x3fe0]
movss xmm0, dword [rax + 0x48]
subss xmm0, dword [rax + 0x98]
movss xmm2, dword [rax + 0x4c]
subss xmm2, dword [rax + 0x9c]
addss xmm0, dword [0x140051c1c]
addss xmm2, xmm6
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
mov rax, qword [rbx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov r8, qword [rbx + 0x3fe0]
movsxd rax, dword [r8 + 0x108]
mov r8, qword [r8 + 0x110]
mov r8d, dword [r8 + rax*4 - 4]
call fcn.140006ea0
mov edi, eax
cmp dword [rbx + 0x401c], eax
jne 0x140001a7f
lea r8, str.child1
mov edx, 0xb
mov ecx, eax
call fcn.1400290d0
lea r8, [rsp + 0x48]
mov edx, edi
lea rcx, str.child1
call fcn.14000f930
movdqa xmm1, xmmword [0x140051d20]
lea rdx, [0x14008a9d5]
movd ecx, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov byte [rsp + 0x3f], r14b
xor byte [rsp + 0x32], cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
psrldq xmm0, 1
movd eax, xmm0
xor al, cl
lea rcx, [rsp + 0x31]
mov byte [rsp + 0x31], al
call fcn.140043220
test al, al
je 0x140001b1a
cmp byte [0x14008a9d5], r14b
je 0x140001b15
call fcn.140003860
jmp 0x140001b1a
call fcn.140003a10
movdqa xmm1, xmmword [0x140051d10]
lea rdx, [0x14008a9d3]
movd ecx, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov byte [rsp + 0x3f], r14b
xor byte [rsp + 0x32], cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
psrldq xmm0, 1
movd eax, xmm0
xor al, cl
lea rcx, [rsp + 0x31]
mov byte [rsp + 0x31], al
call fcn.140043220
test al, al
je 0x140002557
cmp byte [0x14008a9d3], r14b
je 0x140001ba4
call fcn.140003bc0
jmp 0x140002557
call fcn.140003d70
jmp 0x140002557
cmp eax, 1
jne 0x140001f2f
mov rbx, qword [0x14008a980]
lea rcx, str.child0
xor edx, edx
mov dword [rsp + 0x48], 0x43b88000
mov dword [rsp + 0x4c], 0x438d0000
mov rax, qword [rbx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rbx + 0x3fe0]
movss xmm0, dword [rax + 0x48]
subss xmm0, dword [rax + 0x98]
movss xmm2, dword [rax + 0x4c]
subss xmm2, dword [rax + 0x9c]
addss xmm0, dword [0x140051bc4]
addss xmm2, dword [0x140051bec]
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
mov rax, qword [rbx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov r8, qword [rbx + 0x3fe0]
movsxd rax, dword [r8 + 0x108]
mov r8, qword [r8 + 0x110]
mov r8d, dword [r8 + rax*4 - 4]
call fcn.140006ea0
mov edi, eax
cmp dword [rbx + 0x401c], eax
jne 0x140001c98
lea r8, str.child0
mov edx, 0xb
mov ecx, eax
call fcn.1400290d0
lea r8, [rsp + 0x48]
mov edx, edi
lea rcx, str.child0
call fcn.14000f930
mov cl, 0x6e
mov byte [rsp + 0x30], 0xf
movzx r8d, cl
movzx ebx, cl
xor cl, 0xf
mov dl, 0x6b
xor dl, 0xf
mov byte [rsp + 0x32], cl
mov al, 0x5d
mov byte [rsp + 0x33], dl
mov r9b, 0x7d
lea rcx, [rsp + 0x31]
mov r10b, 0x2f
lea rdx, [0x14008a9d4]
mov r11b, 0x67
xor al, 0xf
xor r8b, 0xf
mov byte [rsp + 0x31], al
xor r9b, 0xf
mov byte [rsp + 0x34], r8b
xor r10b, 0xf
mov byte [rsp + 0x35], r9b
xor r11b, 0xf
mov byte [rsp + 0x36], r10b
mov dil, 0x6c
mov byte [rsp + 0x37], r11b
mov sil, 0x64
xor r14d, r14d
xor bl, 0xf
mov byte [rsp + 0x3b], r14b
xor dil, 0xf
mov byte [rsp + 0x38], bl
xor sil, 0xf
mov byte [rsp + 0x39], dil
mov byte [rsp + 0x3a], sil
call fcn.140043220
test al, al
je 0x140001d4f
cmp byte [0x14008a9d4], r14b
je 0x140001d4a
call fcn.140002ec0
jmp 0x140001d4f
call fcn.140003060
mov cl, 0x26
mov byte [rsp + 0x48], 0x42
movzx edx, cl
mov al, 3
xor dl, 0x42
xor cl, 0x42
mov r8b, 0x62
mov byte [rsp + 0x4b], dl
mov r9b, 0x31
mov byte [rsp + 0x4a], cl
mov r10b, 0x21
lea rdx, [0x14008a9d2]
mov r11b, 0x2d
lea rcx, [rsp + 0x49]
xor al, 0x42
xor r8b, 0x42
xor r9b, 0x42
mov byte [rsp + 0x49], al
xor r10b, 0x42
mov byte [rsp + 0x4c], r8b
xor r11b, 0x42
mov byte [rsp + 0x4d], r9b
mov bl, 0x30
mov byte [rsp + 0x4e], r10b
mov dil, 0x27
mov byte [rsp + 0x4f], r11b
xor esi, esi
xor bl, 0x42
xor dil, 0x42
mov byte [rsp + 0x50], bl
mov byte [rsp + 0x51], dil
mov byte [rsp + 0x52], sil
call fcn.140043220
test al, al
je 0x140001de5
cmp byte [0x14008a9d2], sil
je 0x140001de0
call fcn.140003f20
jmp 0x140001de5
call fcn.1400040e0
mov cl, 0x7e
mov byte [rsp + 0x30], 0x10
xor cl, 0x10
mov byte [rsp + 0x3b], r14b
mov dl, 0x64
mov byte [rsp + 0x32], cl
xor dl, 0x10
lea rcx, [rsp + 0x31]
mov al, 0x51
mov byte [rsp + 0x33], dl
mov r8b, 0x79
lea rdx, [0x14008a9d7]
mov r9b, 0x30
mov r10b, 0x56
mov r11b, 0x7c
xor al, 0x10
xor r8b, 0x10
mov byte [rsp + 0x31], al
xor r9b, 0x10
mov byte [rsp + 0x34], r8b
xor r10b, 0x10
mov byte [rsp + 0x35], r9b
xor r11b, 0x10
mov byte [rsp + 0x36], r10b
mov bl, 0x71
mov byte [rsp + 0x37], r11b
mov dil, 0x63
mov sil, 0x78
xor bl, 0x10
xor dil, 0x10
xor sil, 0x10
mov byte [rsp + 0x38], bl
mov byte [rsp + 0x39], dil
mov byte [rsp + 0x3a], sil
call fcn.140043220
test al, al
je 0x140001e84
cmp byte [0x14008a9d7], r14b
je 0x140001e7f
call fcn.1400042a0
jmp 0x140001e84
call fcn.140004450
mov cl, 0x4c
mov byte [rsp + 0x30], 0x22
xor cl, 0x22
mov byte [rsp + 0x3b], r14b
mov dl, 0x56
mov byte [rsp + 0x32], cl
xor dl, 0x22
lea rcx, [rsp + 0x31]
mov al, 0x63
mov byte [rsp + 0x33], dl
mov r8b, 0x4b
lea rdx, [0x14008a9e0]
mov r9b, 2
mov r10b, 0x71
mov r11b, 0x4f
xor al, 0x22
xor r8b, 0x22
mov byte [rsp + 0x31], al
xor r9b, 0x22
mov byte [rsp + 0x34], r8b
xor r10b, 0x22
mov byte [rsp + 0x35], r9b
xor r11b, 0x22
mov byte [rsp + 0x36], r10b
mov bl, 0x4d
mov byte [rsp + 0x37], r11b
mov dil, 0x49
mov sil, 0x47
xor bl, 0x22
xor dil, 0x22
xor sil, 0x22
mov byte [rsp + 0x38], bl
mov byte [rsp + 0x39], dil
mov byte [rsp + 0x3a], sil
call fcn.140043220
test al, al
je 0x140002557
cmp byte [0x14008a9e0], r14b
je 0x140001f25
call fcn.140004600
jmp 0x140002557
call fcn.1400047c0
jmp 0x140002557
cmp eax, 2
jne 0x140002148
mov rbx, qword [0x14008a980]
lea rcx, str.child0
xor edx, edx
mov dword [rsp + 0x48], 0x43b88000
mov dword [rsp + 0x4c], 0x438d0000
mov rax, qword [rbx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rbx + 0x3fe0]
movss xmm0, dword [rax + 0x48]
subss xmm0, dword [rax + 0x98]
movss xmm2, dword [rax + 0x4c]
subss xmm2, dword [rax + 0x9c]
addss xmm0, dword [0x140051bc4]
addss xmm2, dword [0x140051bec]
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
mov rax, qword [rbx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov r8, qword [rbx + 0x3fe0]
movsxd rax, dword [r8 + 0x108]
mov r8, qword [r8 + 0x110]
mov r8d, dword [r8 + rax*4 - 4]
call fcn.140006ea0
mov edi, eax
cmp dword [rbx + 0x401c], eax
jne 0x140002019
lea r8, str.child0
mov edx, 0xb
mov ecx, eax
call fcn.1400290d0
lea r8, [rsp + 0x48]
mov edx, edi
lea rcx, str.child0
call fcn.14000f930
mov dl, 0x45
mov byte [rsp + 0x48], 0x29
movzx r8d, dl
mov byte [rsp + 0x51], sil
xor dl, 0x29
mov cl, 0x48
xor cl, 0x29
mov byte [rsp + 0x4b], dl
mov al, 0x7e
mov byte [rsp + 0x4a], cl
mov r9b, 0x7a
lea rdx, [0x14008a9d0]
mov r10b, 0x41
lea rcx, [rsp + 0x49]
mov r11b, 0x46
xor al, 0x29
xor r8b, 0x29
mov byte [rsp + 0x49], al
xor r9b, 0x29
mov byte [rsp + 0x4c], r8b
xor r10b, 0x29
mov byte [rsp + 0x4d], r9b
xor r11b, 0x29
mov byte [rsp + 0x4e], r10b
mov bl, 0x5d
mov byte [rsp + 0x4f], r11b
xor bl, 0x29
mov byte [rsp + 0x50], bl
call fcn.140043220
test al, al
je 0x1400020b4
cmp byte [0x14008a9d0], sil
je 0x1400020af
call fcn.140004980
jmp 0x1400020b4
call fcn.140004b00
mov r9b, 0x46
mov byte [rsp + 0x48], 0x2d
movzx r11d, r9b
mov byte [rsp + 0x51], sil
mov cl, 0x41
mov dl, 0x4c
xor cl, 0x2d
xor dl, 0x2d
mov al, 0x6f
mov byte [rsp + 0x4a], cl
mov r8b, 0x4e
mov byte [rsp + 0x4b], dl
mov r10b, 0x7e
lea rdx, [0x14008a9e1]
xor r11b, 0x2d
lea rcx, [rsp + 0x49]
xor al, 0x2d
mov byte [rsp + 0x4f], r11b
xor r8b, 0x2d
mov byte [rsp + 0x49], al
xor r9b, 0x2d
mov byte [rsp + 0x4c], r8b
xor r10b, 0x2d
mov byte [rsp + 0x4d], r9b
mov bl, 0x54
mov byte [rsp + 0x4e], r10b
xor bl, 0x2d
mov byte [rsp + 0x50], bl
call fcn.140043220
test al, al
je 0x140002557
cmp byte [0x14008a9e1], sil
je 0x14000213e
call fcn.140002b60
jmp 0x140002557
call fcn.140002d10
jmp 0x140002557
cmp eax, 3
jne 0x140002557
mov rbx, qword [0x14008a980]
lea rcx, str.child0
xor edx, edx
mov dword [rsp + 0x48], 0x43b88000
mov dword [rsp + 0x4c], 0x438d0000
mov rax, qword [rbx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rbx + 0x3fe0]
movss xmm0, dword [rax + 0x48]
subss xmm0, dword [rax + 0x98]
movss xmm2, dword [rax + 0x4c]
subss xmm2, dword [rax + 0x9c]
addss xmm0, dword [0x140051bc4]
addss xmm2, dword [0x140051bec]
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
mov rax, qword [rbx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov r8, qword [rbx + 0x3fe0]
movsxd rax, dword [r8 + 0x108]
mov r8, qword [r8 + 0x110]
mov r8d, dword [r8 + rax*4 - 4]
call fcn.140006ea0
mov edi, eax
cmp dword [rbx + 0x401c], eax
jne 0x140002232
lea r8, str.child0
mov edx, 0xb
mov ecx, eax
call fcn.1400290d0
lea r8, [rsp + 0x48]
mov edx, edi
lea rcx, str.child0
call fcn.14000f930
mov rcx, qword [0x14008a980]
mov rax, qword [rcx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rcx + 0x3fe0]
movss xmm0, dword [rax + 0x48]
subss xmm0, dword [rax + 0x98]
movss xmm2, dword [rax + 0x4c]
subss xmm2, dword [rax + 0x9c]
addss xmm0, dword [0x140051bd8]
addss xmm2, dword [0x140051c04]
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
movss xmm0, dword [0x140051c0c]
call fcn.140017170
lea rcx, str.Created_by_enera
call fcn.140041370
mov r9, qword [0x14008a980]
mov rax, qword [r9 + 0x3fe0]
mov byte [rax + 0xcd], 1
mov r8, qword [r9 + 0x3fe0]
mov rax, qword [r8 + 0x1f0]
movsxd rdx, dword [r8 + 0x1e8]
mov ecx, dword [rax + rdx*4 - 4]
lea eax, [rdx - 1]
mov dword [r8 + 0x1e8], eax
mov dword [r8 + 0x1dc], ecx
mov rax, qword [r9 + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [r9 + 0x3fe0]
movss xmm0, dword [rax + 0x48]
subss xmm0, dword [rax + 0x98]
movss xmm2, dword [rax + 0x4c]
subss xmm2, dword [rax + 0x9c]
addss xmm0, dword [0x140051bd8]
addss xmm2, dword [0x140051bf8]
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
movss xmm0, dword [0x140051c18]
call fcn.140017170
lea rcx, str.Build_Date:_25.09.23_22:19
call fcn.140041370
mov r9, qword [0x14008a980]
mov rax, qword [r9 + 0x3fe0]
mov byte [rax + 0xcd], 1
mov r8, qword [r9 + 0x3fe0]
mov rax, qword [r8 + 0x1f0]
movsxd rdx, dword [r8 + 0x1e8]
mov ecx, dword [rax + rdx*4 - 4]
lea eax, [rdx - 1]
mov dword [r8 + 0x1e8], eax
mov dword [r8 + 0x1dc], ecx
mov rax, qword [r9 + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [r9 + 0x3fe0]
movss xmm0, dword [rax + 0x48]
subss xmm0, dword [rax + 0x98]
movss xmm2, dword [rax + 0x4c]
subss xmm2, dword [rax + 0x9c]
addss xmm0, dword [0x140051bdc]
addss xmm2, dword [0x140051c10]
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
movss xmm0, dword [0x140051bfc]
call fcn.140017170
lea rcx, str.TG:__VloneHack
call fcn.140041370
mov rcx, qword [0x14008a980]
mov rax, qword [rcx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov r8, qword [rcx + 0x3fe0]
movsxd rdx, dword [r8 + 0x1e8]
mov rax, qword [r8 + 0x1f0]
mov ecx, dword [rax + rdx*4 - 4]
lea eax, [rdx - 1]
mov dword [r8 + 0x1e8], eax
mov dword [r8 + 0x1dc], ecx
jmp 0x140002557
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x14008a9dc], esi
mov byte [0x14008a9d1], sil
movdqa xmm1, xmmword [0x140051d90]
mov dl, 0x4f
movd ecx, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8b, 0x42
mov byte [rsp + 0x42], sil
xor dl, cl
psrldq xmm0, 1
xor byte [rsp + 0x32], cl
xor r8b, cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
movd eax, xmm0
mov byte [rsp + 0x40], dl
mov byte [rsp + 0x41], r8b
xor al, cl
lea rcx, [rsp + 0x31]
mov byte [rsp + 0x31], al
call fcn.140041370
call fcn.140015860
movaps xmm6, xmmword [rsp + 0x1a0]
mov r14, qword [rsp + 0x1b8]
mov rdi, qword [rsp + 0x1f0]
mov rsi, qword [rsp + 0x1e8]
mov rbx, qword [rsp + 0x1e0]
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.140049e50
add rsp, 0x1d0
pop rbp
ret