Function at 0x14001ca40
Capabilities:
Contain obfuscated stackstrings
Create thread
Encode data using xor
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x300]
sub rsp, 0x400
mov rax, qword [0x140133080]
xor rax, rsp
mov qword [rbp + 0x2f8], rax
xor r12d, r12d
cmp byte [0x1401d3374], r12b
jne 0x14001d8bb
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
mov qword [rbp - 0x60], r12
lea rdi, [0x140113362]
lea r14, [0x14010f590]
sub rdi, r14
je 0x14001cacf
mov rdx, rdi
lea rcx, [rbp - 0x70]
call fcn.1400161f0
mov rbx, qword [rbp - 0x70]
mov r8, rdi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea rdx, [rdi + rbx]
mov qword [rbp - 0x68], rdx
jmp 0x14001cad3
mov rdx, qword [rbp - 0x68]
sub rdx, qword [rbp - 0x70]
jne 0x14001cb79
movdqa xmm0, xmmword [0x14011a8b0]
movdqu xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [str.drv_buffer_size_n__c_____invalid_y_n_t_t_t_c_____get_5555555555555555z__4z.2_z92__.z_]
movdqu xmmword [rbp - 0x40], xmm1
mov byte [rbp - 0x30], dl
lea rcx, [rbp - 0x4f]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], r12
mov r8d, reloc.WLDAP32.dll_Ordinal_30
lea rdx, str._c_____invalid_drv_buffer_size
lea rcx, [rbp]
call fcn.1400045f0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
xor r8d, r8d
lea rdx, [0x140107b79]
lea rcx, [rsp + 0x40]
call fcn.1400045f0
nop
lea r8, [rsp + 0x40]
lea rdx, [rbp]
call fcn.14001bc20
nop
lea rcx, [rsp + 0x40]
call fcn.1400092d0
nop
lea rcx, [rbp]
call fcn.1400092d0
jmp 0x14001ce61
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], rax
movdqu xmmword [rbp], xmm0
mov qword [rbp + 0x10], r12
lea rcx, [rbp]
call fcn.1400161f0
mov rdi, qword [rbp]
mov rbx, qword [rbp - 0x70]
mov rsi, qword [rbp - 0x68]
mov r8, rsi
sub r8, rbx
mov rdx, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sub rsi, rbx
add rsi, rdi
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x10], r12
mov qword [rbp + 8], r12
mov rcx, qword [rbp]
mov qword [rbp], r12
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], r12
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x68], r12
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x60], rcx
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
mov qword [rbp + 0x68], rcx
movzx eax, word [rcx + 0x14]
add rcx, 0x18
add rcx, rax
mov qword [rbp + 0x70], rcx
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
mov qword [rbp - 0x80], r12
mov edx, 0x3680
lea rcx, [rsp + 0x70]
call fcn.1400161f0
mov rbx, qword [rsp + 0x70]
mov r8d, 0x3680
lea rdx, [0x140113370]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + 0x3680]
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x50]
call fcn.14001b9a0
nop
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14001cca9
mov rdx, qword [rbp - 0x80]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cca3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001cca3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400f18f4
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova rdx, qword [rbp - 0x50]
mov r8, qword [rbp - 0x40]
lea rcx, [0x1401d1760]
call fcn.1400162f0
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, str..AsUpdateio
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [0x1401d31e0], rax
lea rcx, [rbp - 0x50]
call fcn.1400092d0
test rbx, rbx
jne 0x14001cecd
mov word [rsp + 0x70], 0x6321
mov byte [rsp + 0x72], bl
movdqa xmm0, xmmword [0x14011ad50]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x6f6c206f
mov dword [rsp + 0x54], 0x64206461
mov dword [rsp + 0x58], 0x65766972
mov word [rsp + 0x5c], WSAStartup
mov r9d, Ordinal_50
lea r8, [rsp + 0x71]
lea rdx, [rsp + 0x41]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r12
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str.Unable_to_load_driver
lea rcx, [rsp + 0x70]
call fcn.1400045f0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
xor r8d, r8d
lea rdx, [0x140107b79]
lea rcx, [rsp + 0x40]
call fcn.1400045f0
nop
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x70]
call fcn.14001bc20
nop
lea rcx, [rsp + 0x40]
call fcn.1400092d0
nop
lea rcx, [rsp + 0x70]
call fcn.1400092d0
nop
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14001ce1b
mov rdx, qword [rbp + 0x58]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ce0a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d866
call fcn.1400f18f4
mov qword [rbp + 0x48], r12
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x50], xmm0
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x14001ce61
mov rdx, qword [rbp + 0x40]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ce50
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d866
call fcn.1400f18f4
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r12
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x14001ce9b
mov rdx, qword [rbp - 0x60]
sub rdx, rcx
cmp rdx, 0x1000
mov rax, rcx
jb 0x14001ce96
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d8af
call fcn.1400f18f4
mov al, 1
mov rcx, qword [rbp + 0x2f8]
xor rcx, rsp
call fcn.1400f1580
lea r11, [rsp + 0x400]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rcx, [rbp + 0x20]
call fcn.140017240
xor edx, edx
mov r8d, 0xe8
lea rcx, [rbp + 0x1f0]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x1f0]
call fcn.1400200d0
nop
lea rdx, str._c_
lea rcx, [rbp + 0x1f0]
call fcn.14000c550
lea rdx, str.NtShutdownSystem
mov rcx, rax
call fcn.14000c550
mov rcx, rax
lea rdx, str._mapped_physical_page___
call fcn.14000c550
mov rbx, rax
mov rdx, qword [0x1401d31d8]
lea rcx, [rbp - 0x50]
call fcn.140003030
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x14001cf4a
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.1400117a0
nop
lea rcx, [rbp - 0x50]
call fcn.1400092d0
lea rdx, [rbp]
lea rcx, [rbp + 0x1f8]
call fcn.140020490
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
xor r8d, r8d
lea rdx, [0x140107b79]
lea rcx, [rsp + 0x40]
call fcn.1400045f0
nop
lea r8, [rsp + 0x40]
lea rdx, [rbp]
call fcn.14001bc20
nop
lea rcx, [rsp + 0x40]
call fcn.1400092d0
nop
lea rcx, [rbp]
call fcn.1400092d0
xor edx, edx
mov r8d, 0xe8
lea rcx, [rbp + 0xc0]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0xc0]
call fcn.1400200d0
nop
lea rdx, str._c_
lea rcx, [rbp + 0xc0]
call fcn.14000c550
lea rdx, str.NtShutdownSystem
mov rcx, rax
call fcn.14000c550
mov rcx, rax
lea rdx, str._page_offset___
call fcn.14000c550
mov rbx, rax
movzx edx, word [0x1401d31ec]
lea rcx, [rbp - 0x50]
call fcn.140002f40
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x14001d02e
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.1400117a0
nop
lea rcx, [rbp - 0x50]
call fcn.1400092d0
mov eax, 0x5a4d
cmp word [0x14010f590], ax
jne 0x14001d061
movsxd r8, dword [0x14010f5cc]
add r8, 8
add r8, r14
jmp 0x14001d067
mov r8d, 4
mov r8d, dword [r8]
lea r9, [rbp + 0x2f5]
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x14001d071
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
lea rax, [rbp + 0x2f5]
cmp r9, rax
jne 0x14001d0d1
mov rbx, r12
mov qword [rsp + 0x50], rbx
mov edi, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x58], rdi
mov byte [rsp + 0x40], bl
jmp 0x14001d0f2
lea r8, [rbp + 0x2f5]
sub r8, r9
mov rdx, r9
lea rcx, [rsp + 0x40]
call fcn.1400045f0
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], r12
mov r8d, reloc.WS2_32.dll_select
lea rdx, str.Driver_timestamp:
lea rcx, [rbp]
call fcn.1400045f0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r12
xor r8d, r8d
lea rdx, [0x140107b79]
lea rcx, [rsp + 0x70]
call fcn.1400045f0
nop
movabs rax, 0x7fffffffffffffff
mov rcx, qword [rbp + 0x10]
sub rax, rcx
cmp rax, rbx
jb 0x14001e768
lea r9, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova r9, qword [rbp]
lea rax, [rsp + 0x40]
cmp rdi, 0xf
cmova rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x50]
call fcn.140010f50
nop
lea r8, [rsp + 0x70]
lea rdx, [rbp - 0x50]
call fcn.14001bc20
nop
lea rcx, [rbp - 0x50]
call fcn.1400092d0
nop
lea rcx, [rsp + 0x70]
call fcn.1400092d0
nop
lea rcx, [rbp]
call fcn.1400092d0
nop
lea rcx, [rsp + 0x40]
call fcn.1400092d0
lea rax, vtable.std::_Func_impl_no_alloc_class__bool___cdecl_cortex::roblox::init_void_::_8::_lambda_4___unsigned_long_long_unsigned___int64___char_const____ptr64__char_const____ptr64_.0
mov qword [rbp - 0x50], rax
lea rax, [rbp - 0x50]
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x30]
call fcn.140016780
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], r12
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str.Driver_imports_fixed.
lea rcx, [rbp]
call fcn.1400045f0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
xor r8d, r8d
lea rdx, [0x140107b79]
lea rcx, [rsp + 0x40]
call fcn.1400045f0
nop
lea r8, [rsp + 0x40]
lea rdx, [rbp]
call fcn.14001bc20
nop
lea rcx, [rsp + 0x40]
call fcn.1400092d0
nop
lea rcx, [rbp]
call fcn.1400092d0
mov r9, qword [rbp + 0x48]
mov rdi, qword [rbp + 0x50]
cmp r9, rdi
je 0x14001d269
mov rdi, r9
mov qword [rbp + 0x50], r9
mov rax, qword [rbp + 0x68]
mov ebx, dword [rax + 0x50]
mov rcx, rdi
sub rcx, r9
cmp rbx, rcx
jae 0x14001d281
lea rax, [rbx + r9]
jmp 0x14001d2b9
jbe 0x14001d2bd
mov rax, qword [rbp + 0x58]
sub rax, r9
cmp rbx, rax
jbe 0x14001d2a1
mov rdx, rbx
lea rcx, [rbp + 0x48]
call fcn.1400168e0
mov r9, qword [rbp + 0x48]
jmp 0x14001d2bd
sub rbx, rcx
mov r8, rbx
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
lea rax, [rbx + rdi]
mov r9, qword [rbp + 0x48]
mov qword [rbp + 0x50], rax
mov rax, qword [rbp + 0x68]
mov ecx, dword [rax + 0x54]
test ecx, ecx
je 0x14001d2db
mov r8d, ecx
mov rdx, qword [rbp + 0x30]
mov rcx, r9
call sub.VCRUNTIME140.dll_memmove
mov r9, qword [rbp + 0x48]
mov rbx, r12
mov rax, qword [rbp + 0x68]
cmp r12w, word [rax + 6]
jae 0x14001d32a
mov rdi, r12
nop dword [rax]
mov rdx, qword [rbp + 0x70]
mov ecx, dword [rdx + rdi + 0xc]
add rcx, r9
mov r8d, dword [rdx + rdi + 0x10]
mov edx, dword [rdx + rdi + 0x14]
add rdx, qword [rbp + 0x30]
test r8d, r8d
je 0x14001d316
call sub.VCRUNTIME140.dll_memmove
mov r9, qword [rbp + 0x48]
inc rbx
add rdi, 0x28
mov rax, qword [rbp + 0x68]
movzx ecx, word [rax + 6]
cmp rbx, rcx
jb 0x14001d2f0
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], r12
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, str.Driver_mapped.
lea rcx, [rbp]
call fcn.1400045f0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
xor r8d, r8d
lea rdx, [0x140107b79]
lea rcx, [rsp + 0x40]
call fcn.1400045f0
nop
lea r8, [rsp + 0x40]
lea rdx, [rbp]
call fcn.14001bc20
nop
lea rcx, [rsp + 0x40]
call fcn.1400092d0
nop
lea rcx, [rbp]
call fcn.1400092d0
mov rax, qword [rbp + 0x68]
mov esi, dword [rax + 0x50]
mov r13d, reloc.WS2_32.dll_recv
mov ebx, r13d
mov rax, qword gs:[0x58]
add rbx, qword [rax]
mov eax, dword [rbx]
cmp dword [0x1401d4c18], eax
jle 0x14001d3f7
lea rcx, [0x1401d4c18]
call fcn.1400f19d0
cmp dword [0x1401d4c18], 0xffffffff
jne 0x14001d3f7
xor r8d, r8d
lea rdx, [0x140109c78]
call fcn.140016a30
mov qword [0x1401d4be0], rax
lea rcx, [0x1401d4c18]
call fcn.1400f1964
mov rdi, qword [0x1401d4be0]
mov eax, dword [rbx]
cmp dword [0x1401d4c00], eax
jle 0x14001d44d
lea rcx, [0x1401d4c00]
call fcn.1400f19d0
cmp dword [0x1401d4c00], 0xffffffff
jne 0x14001d44d
lea rcx, [0x140109c50]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401d4bf0], rax
lea rcx, [0x1401d4c00]
call fcn.1400f1964
mov rcx, qword [0x1401d31d8]
mov rdx, rdi
call fcn.140016f40
mov rax, qword [0x1401d4bf0]
mov rdx, rsi
xor ecx, ecx
call rax
mov r15, rax
mov rcx, qword [0x1401d31d8]
call fcn.140017140
mov rcx, qword [rbp + 0x68]
test byte [rcx + 0x16], 1
jne 0x14001d578
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.dbghelp.dll_ImageNtHeader]
mov r14, rax
mov r8d, 5
lea r9, [rsp + 0x70]
mov dl, 1
mov rcx, rax
call qword [sym.imp.dbghelp.dll_ImageDirectoryEntryToData]
mov rbx, rax
mov rdi, r15
sub rdi, qword [r14 + 0x30]
je 0x14001d574
mov ecx, dword [rsp + 0x70]
test ecx, ecx
je 0x14001d574
lea rsi, [rax + rcx]
cmp rax, rsi
jae 0x14001d574
lea r13, [0x140000000]
nop word [rax + rax]
xor r9d, r9d
mov r8d, dword [rbx]
mov rdx, qword [rbp + 0x48]
mov rcx, r14
call qword [sym.imp.dbghelp.dll_ImageRvaToVa]
mov r9, rax
mov r8d, dword [rbx + 4]
sub r8d, 8
shr r8d, 1
lea rbx, [rbx + 8]
mov r10d, r12d
je 0x14001d565
nop word [rax + rax]
movzx edx, word [rbx]
mov ecx, edx
shr ecx, 0xc
cmp ecx, 0xa
ja case.0x14001d528.5
mov ecx, dword [r13 + rcx*4 + 0x1e770]
add rcx, r13
jmp rcx
and edx, 0xfff
add rdx, r9
mov rax, rdi
shr rax, 0x10
add word [rdx], ax
jmp case.0x14001d528.0
and edx, 0xfff
add rdx, r9
add word [rdx], di
jmp case.0x14001d528.0
and edx, 0xfff
add rdx, r9
add qword [rdx], rdi
inc r10d
add rbx, 2
cmp r10d, r8d
jb 0x14001d510
cmp rbx, rsi
jb 0x14001d4e0
mov r13d, reloc.WS2_32.dll_recv
mov rcx, qword [rbp + 0x68]
mov edi, dword [rcx + 0x50]
mov rsi, qword [rbp + 0x48]
mov rax, qword gs:[0x58]
mov rbx, qword [rax]
mov eax, r13d
mov ecx, dword [rax + rbx]
cmp dword [0x1401d4c04], ecx
jle 0x14001d5d0
lea rcx, [0x1401d4c04]
call fcn.1400f19d0
cmp dword [0x1401d4c04], 0xffffffff
jne 0x14001d5d0
xor r8d, r8d
lea rdx, str.RtlCopyMemory
call fcn.140016a30
mov qword [0x1401d4c10], rax
lea rcx, [0x1401d4c04]
call fcn.1400f1964
mov qword [rsp + 0x20], rdi
mov r9, rsi
mov r8, r15
call fcn.140017f40
mov rax, qword [rbp + 0x68]
mov edi, dword [rax + 0x28]
add rdi, r15
mov esi, dword [rax + 0x50]
mov eax, r13d
mov ecx, dword [rax + rbx]
cmp dword [0x1401d4c98], ecx
jle 0x14001d640
lea rcx, [0x1401d4c98]
call fcn.1400f19d0
cmp dword [0x1401d4c98], 0xffffffff
jne 0x14001d640
lea rcx, [0x140109c50]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401d4c90], rax
lea rcx, [0x1401d4c98]
call fcn.1400f1964
mov rcx, qword [0x1401d31d8]
mov rdx, rdi
call fcn.140016f40
mov rdx, rsi
mov rcx, r15
call qword [0x1401d4c90]
mov rcx, qword [0x1401d31d8]
call fcn.140017140
mov rax, qword [rbp + 0x68]
mov edi, dword [rax + 0x54]
mov eax, r13d
mov ecx, dword [rax + rbx]
cmp dword [0x1401d4be8], ecx
jle 0x14001d6b3
lea rcx, [0x1401d4be8]
call fcn.1400f19d0
cmp dword [0x1401d4be8], 0xffffffff
jne 0x14001d6b3
xor r8d, r8d
lea rdx, str.RtlZeroMemory
call fcn.140016a30
mov qword [0x1401d4bd0], rax
lea rcx, [0x1401d4be8]
call fcn.1400f1964
mov rbx, qword [0x1401d4bd0]
mov r9d, r13d
mov rax, qword gs:[0x58]
mov r8, qword [rax]
mov eax, dword [r9 + r8]
cmp dword [0x1401d4c78], eax
jle 0x14001d71a
lea rcx, [0x1401d4c78]
call fcn.1400f19d0
cmp dword [0x1401d4c78], 0xffffffff
jne 0x14001d71a
lea rcx, [0x140109c50]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401d4bd8], rax
lea rcx, [0x1401d4c78]
call fcn.1400f1964
mov rcx, qword [0x1401d31d8]
mov rdx, rbx
call fcn.140016f40
mov rdx, rdi
mov rcx, r15
call qword [0x1401d4bd8]
mov rcx, qword [0x1401d31d8]
call fcn.140017140
mov byte [0x1401d3374], 1
mov rax, qword [rbp + 0xc0]
movsxd rcx, dword [rax + 4]
lea rbx, vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0xc0], rbx
mov rax, qword [rbp + 0xc0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rbp + rcx + 0xbc], edx
lea rcx, [rbp + 0xc8]
call fcn.140020010
lea rcx, [rbp + 0xd0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x148]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rax, qword [rbp + 0x1f0]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x1f0], rbx
mov rax, qword [rbp + 0x1f0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rbp + rcx + 0x1ec], edx
lea rcx, [rbp + 0x1f8]
call fcn.140020010
lea rcx, [rbp + 0x200]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x278]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14001d835
mov rdx, qword [rbp + 0x58]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d824
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d866
call fcn.1400f18f4
mov qword [rbp + 0x48], r12
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x50], xmm0
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x14001d87e
mov rdx, qword [rbp + 0x40]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d86d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001d86d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400f18f4
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r12
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x14001d8bb
mov rdx, qword [rbp - 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d8b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001d8b6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400f18f4
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
mov r8d, 3
lea rcx, str..IoControl
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1401d3218], rax
test rax, rax
je 0x14001e6cb
cmp rax, 0xffffffffffffffff
je 0x14001e6cb
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], r12
mov r8d, Ordinal_30
lea rdx, str.Driver_mapping_completed.
lea rcx, [rbp - 0x70]
call fcn.1400045f0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
xor r8d, r8d
lea rdx, [0x140107b79]
lea rcx, [rsp + 0x40]
call fcn.1400045f0
nop
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x70]
call fcn.14001bc20
nop
lea rcx, [rsp + 0x40]
call fcn.1400092d0
nop
lea rcx, [rbp - 0x70]
call fcn.1400092d0
movdqa xmm0, xmmword [0x14011ad60]
movdqu xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x60], 0x78652e61
mov word [rbp - 0x5c], 0x65
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rbp + 0xc0], 0x130
lea rdx, [rbp + 0xc0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14001d9ed
nop word [rax + rax]
lea rdx, [rbp - 0x6f]
lea rcx, [rbp + 0xec]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x14001da8f
lea rdx, [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14001d9c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r12d
mov dword [0x1401d3210], eax
test eax, eax
jne 0x14001daa0
lea rdx, [rbp - 0x50]
call fcn.14001e7e0
movzx edx, byte [rax]
xor byte [rax + 1], dl
xor byte [rax + 2], dl
xor byte [rax + 3], dl
xor byte [rax + 4], dl
xor byte [rax + 5], dl
xor byte [rax + 6], dl
xor byte [rax + 7], dl
xor byte [rax + 8], dl
xor byte [rax + 9], dl
xor byte [rax + 0xa], dl
xor byte [rax + 0xb], dl
xor byte [rax + 0xc], dl
xor byte [rax + 0xd], dl
xor byte [rax + 0xe], dl
xor byte [rax + 0xf], dl
xor byte [rax + 0x10], dl
xor byte [rax + 0x11], dl
xor byte [rax + 0x12], dl
xor byte [rax + 0x13], dl
xor byte [rax + 0x14], dl
xor byte [rax + 0x15], dl
xor byte [rax + 0x16], dl
xor byte [rax + 0x17], dl
xor byte [rax + 0x18], dl
xor byte [rax + 0x19], dl
xor byte [rax + 0x1a], dl
xor byte [rax + 0x1b], dl
xor byte [rax + 0x1c], dl
xor byte [rax + 0x1d], dl
xor byte [rax + 0x1e], dl
xor byte [rax + 0x1f], dl
xor byte [rax + 0x20], dl
xor byte [rax + 0x21], dl
mov byte [rax + 0x22], 0
lea rcx, [rax + 1]
call fcn.140019eb0
mov ecx, 0x1d4c0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0xc8]
jmp 0x14001d9f9
mov dword [rsp + 0x70], 0x626f5262
mov dword [rsp + 0x74], 0x786f6c
lea rdx, [rsp + 0x71]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x1401d32c0], rax
call fcn.14001c070
lea rcx, [rax + 0x10]
call fcn.140020620
mov rdi, rax
call fcn.14001c070
lea rcx, [rax + 0x118]
call fcn.140020620
lea rcx, [rax + 0x198]
call fcn.140020620
mov rbx, rax
mov qword [rbp], rax
mov qword [0x1401d32a0], rax
test rdi, rdi
jne 0x14001dc81
mov dword [rsp + 0x70], 0x726f636b
mov dword [rsp + 0x74], 0x786574
movdqa xmm0, xmmword [0x14011acd0]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x14011ad10]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x14011ad00]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x14011acf0]
movdqa xmmword [rbp - 0x20], xmm1
mov dword [rbp - 0x10], 0x12415c47
mov word [rbp - 0xc], reloc.WS2_32.dll_gethostname
mov rcx, r12
nop dword [rax]
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x4f], al
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x4e], al
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x4d], al
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x4c], al
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x4b], al
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x4a], al
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x49], al
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x48], al
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x47], al
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x46], al
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x45], al
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x44], al
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x43], al
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x42], al
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x41], al
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x40], al
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x3f], al
add rcx, 0x11
cmp rcx, 0x44
jb 0x14001db60
mov byte [rbp - 0xb], 0
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rsp + 0x71]
lea rdx, [rbp - 0x4f]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], r12
mov r8d, 0x43
lea rdx, str.failed_to_get_visual_engine__please_run_the_cheat_as_administrator_
lea rcx, [rbp - 0x70]
call fcn.1400045f0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
xor r8d, r8d
lea rdx, [0x140107b79]
lea rcx, [rsp + 0x40]
call fcn.1400045f0
nop
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x70]
call fcn.14001bc20
nop
lea rcx, [rsp + 0x40]
call fcn.1400092d0
nop
lea rcx, [rbp - 0x70]
call fcn.1400092d0
test rbx, rbx
jne 0x14001ddf9
mov dword [rsp + 0x70], 0x726f633f
mov dword [rsp + 0x74], 0x786574
movdqa xmm0, xmmword [0x14011a910]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x14011a9b0]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x14011a8e0]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x14011add0]
movdqa xmmword [rbp - 0x20], xmm1
mov word [rbp - 0x10], 0x50
mov rcx, r12
nop word [rax + rax]
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x4f], al
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x4e], al
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x4d], al
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x4c], al
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x4b], al
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x4a], al
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x49], al
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x48], al
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x47], al
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x46], al
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x45], al
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x44], al
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x43], al
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x42], al
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x41], al
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x40], al
add rcx, 0x10
cmp rcx, 0x40
jb 0x14001dce0
mov byte [rbp - 0xf], 0
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rsp + 0x71]
lea rdx, [rbp - 0x4f]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], r12
mov r8d, 0x3f
lea rdx, str.failed_to_get_datamodel__please_run_the_cheat_as_administrator_
lea rcx, [rbp - 0x70]
call fcn.1400045f0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
xor r8d, r8d
lea rdx, [0x140107b79]
lea rcx, [rsp + 0x40]
call fcn.1400045f0
nop
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x70]
call fcn.14001bc20
nop
lea rcx, [rsp + 0x40]
call fcn.1400092d0
nop
lea rcx, [rbp - 0x70]
call fcn.1400092d0
mov qword [0x1401d32a0], rbx
call fcn.14003fbc0
test rax, rax
je 0x14001ce9d
movabs rcx, 0x41a8da65a
cmp rax, rcx
jne 0x14001de36
movdqa xmm0, xmmword [0x14011ad30]
movdqu xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x60], reloc.WS2_32.dll_WSACleanup
lea rdx, [rbp - 0x6f]
jmp 0x14001de50
mov dword [rsp + 0x70], 0x616c5006
mov dword [rsp + 0x74], 0x73726579
mov byte [rsp + 0x78], 0
lea rdx, [rsp + 0x71]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
mov rsi, 0xffffffffffffffff
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14001de70
lea rcx, [rsp + 0x40]
call fcn.1400045f0
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x60]
lea rcx, [rbp]
call fcn.14001f440
mov rbx, qword [rsp + 0x60]
test rbx, rbx
jne 0x14001df35
mov dword [rsp + 0x70], 0x726f6372
mov dword [rsp + 0x74], 0x786574
movdqa xmm0, xmmword [0x14011ace0]
movdqu xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x14011ad20]
movdqu xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x14011ade0]
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x495b1a6e
mov dword [rbp - 0x1c], 0x575e5b1a
mov dword [rbp - 0x18], 0x305453
mov rcx, r12
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x4f], al
movzx eax, byte [rbp - 0x50]
xor byte [rbp + rcx - 0x4e], al
add rcx, 2
cmp rcx, 0x3a
jb 0x14001df00
mov byte [rbp - 0x15], 0
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rsp + 0x71]
lea rdx, [rbp - 0x4f]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
mov r8d, 9
lea rdx, str.Workspace
lea rcx, [rsp + 0x40]
call fcn.1400045f0
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x70]
lea rcx, [rbp]
call fcn.14001f440
mov rax, qword [rsp + 0x70]
mov qword [0x1401d3298], rax
mov qword [0x1401d32b0], rbx
mov qword [0x1401d32b8], rdi
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xa0], 0
lea rcx, [rbx + 0x100]
call fcn.140020850
lea rcx, [rax + 0x1d0]
call fcn.140020850
test rax, rax
je 0x14001e0e6
lea rcx, [rax + 0x48]
call fcn.140020620
mov rdi, rax
test rax, rax
je 0x14001e02c
lea rcx, [rax + 0x18]
call fcn.140020780
cmp eax, 0x10
jb 0x14001e005
mov rcx, rdi
call fcn.140020620
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14001f0e0
jmp 0x14001e06b
mov rdx, rdi
lea rcx, [rbp - 0x50]
call fcn.14001f0e0
nop
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x40]
call fcn.140007410
nop
lea rcx, [rbp - 0x50]
call fcn.1400092d0
jmp 0x14001e06b
mov dword [rsp + 0x70], 0x3f3f3f71
mov byte [rsp + 0x74], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
lea rax, [rsp + 0x71]
inc rsi
cmp byte [rax + rsi], 0
jne 0x14001e050
mov r8, rsi
lea rdx, [rsp + 0x71]
lea rcx, [rsp + 0x40]
call fcn.1400045f0
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x14001e0af
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e0aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001e0aa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400f18f4
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rbp + 0xa0], xmm0
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [rbp + 0xb0], xmm1
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], 0
lea rcx, [rsp + 0x40]
call fcn.1400092d0
jmp 0x14001e11d
mov dword [rsp + 0x70], 0x6e6f6e2d
mov word [rsp + 0x74], 0x65
lea rax, [rsp + 0x71]
nop word [rax + rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x14001e100
mov r8, rsi
lea rdx, [rsp + 0x71]
lea rcx, [rbp + 0xa0]
call fcn.1400162f0
lea rcx, [rbx + 0x100]
call fcn.140020850
mov qword [0x1401d3288], rax
mov ecx, 8
call fcn.1400f15a0
lea rcx, [fcn.140019800]
mov qword [rax], rcx
mov qword [rbp], rax
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x140018710]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14001e6ba
cmp dword [rsp + 0x78], 0
je 0x14001e6ae
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp], xmm0
lea rcx, [rbp]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14001e6ae
xorps xmm0, xmm0
movaps xmmword [rbp], xmm0
movdqa xmmword [rsp + 0x70], xmm0
mov ecx, 8
call fcn.1400f15a0
lea rcx, [0x140019550]
mov qword [rax], rcx
mov qword [rbp], rax
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x140018710]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14001e69d
cmp dword [rsp + 0x78], 0
je 0x14001e691
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp], xmm0
lea rcx, [rbp]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14001e691
xorps xmm0, xmm0
movaps xmmword [rbp], xmm0
movdqa xmmword [rsp + 0x70], xmm0
mov eax, 1
xchg byte [0x1401d32ac], al
mov ecx, 8
call fcn.1400f15a0
lea rcx, [0x14001c630]
mov qword [rax], rcx
mov qword [rbp], rax
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x140018710]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14001e680
cmp dword [rsp + 0x78], 0
je 0x14001e674
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp], xmm0
lea rcx, [rbp]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14001e674
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
mov ecx, 8
call fcn.1400f15a0
lea rcx, [0x14002a410]
mov qword [rax], rcx
mov qword [rbp], rax
lea rcx, [rbp + 0x88]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x140018710]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x80], rax
test rax, rax
je 0x14001e661
mov qword [rsp + 0x68], rax
cmp dword [rbp + 0x88], 0
je 0x14001e655
movaps xmm0, xmmword [rbp + 0x80]
movdqa xmmword [rbp], xmm0
lea rcx, [rbp]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14001e655
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x80], xmm0
mov ecx, Ordinal_26
call fcn.1400f15a0
lea rcx, [rsp + 0x68]
mov qword [rax], rcx
lea rcx, [rbp + 0x80]
mov qword [rax + 8], rcx
lea rcx, [0x14002abb0]
mov qword [rax + 0x10], rcx
mov qword [rbp], rax
lea rcx, [rbp + 0x98]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x1400212a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x90], rax
test rax, rax
je 0x14001e642
cmp dword [rbp + 0x98], 0
je 0x14001e636
movaps xmm0, xmmword [rbp + 0x90]
movdqa xmmword [rbp], xmm0
lea rcx, [rbp]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14001e636
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x90], xmm0
mov ecx, 8
call fcn.1400f15a0
lea rcx, [0x14009a630]
mov qword [rax], rcx
mov qword [rbp], rax
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x140018710]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14001e625
cmp dword [rsp + 0x78], 0
je 0x14001e619
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp], xmm0
lea rcx, [rbp]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14001e619
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], r12
mov r8d, reloc.WLDAP32.dll_Ordinal_22
lea rdx, str.injected_successfully.
lea rcx, [rbp - 0x70]
call fcn.1400045f0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
xor r8d, r8d
lea rdx, [0x140107b79]
lea rcx, [rsp + 0x40]
call fcn.1400045f0
nop
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x70]
call fcn.14001bc20
nop
lea rcx, [rsp + 0x40]
call fcn.1400092d0
nop
lea rcx, [rbp - 0x70]
call fcn.1400092d0
lea rdx, str._Hyperion_4.0__Returned_players_as____0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c550
mov rbx, rax
mov rcx, qword [rsp + 0x60]
add rcx, 0x100
call fcn.140020850
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
movdqa xmm0, xmmword [0x14011a8c0]
movdqu xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x14011ad80]
movdqu xmmword [rbp - 0x40], xmm1
mov dword [rbp - 0x30], 0xa7865
lea rcx, [rbp - 0x4f]
call fcn.140019eb0
movdqa xmm0, xmmword [0x14011ad40]
movdqu xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x60], 0x78657472
mov dword [rbp - 0x5c], 0x786c6272
mov word [rbp - 0x58], 0xa
lea rcx, [rbp - 0x6f]
call fcn.140019eb0
movdqa xmm0, xmmword [0x14011adc0]
movdqu xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x60], 0x74656420
mov dword [rbp - 0x5c], 0x65746365
mov word [rbp - 0x58], 0xa64
mov byte [rbp - 0x56], 0
lea rcx, [rbp - 0x6f]
call fcn.140019eb0
movdqa xmm0, xmmword [0x14011adb0]
movdqu xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x60], 0x74746120
mov dword [rbp - 0x5c], 0x69686361
mov dword [rbp - 0x58], 0xa676e
lea rcx, [rbp - 0x6f]
call fcn.140019eb0
movdqa xmm0, xmmword [0x14011ad70]
movdqu xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x60], 0x61207865
mov dword [rbp - 0x5c], 0x63617474
mov dword [rbp - 0x58], 0xa646568
mov byte [rbp - 0x54], 0
lea rcx, [rbp - 0x6f]
call fcn.140019eb0
mov qword [rsp + 0x60], 1
nop dword [rax + rax]
lea rcx, [rsp + 0x60]
call fcn.14000c760
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, qword [0x1401d32c0]
sete byte [0x1401d3279]
mov dword [rsp + 0x70], 0x626f5248
mov dword [rsp + 0x74], 0x786f6c
lea rdx, [rsp + 0x71]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14001e5d0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x78], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0x98], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0x88], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x78], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x78], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x78], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
lea rdx, [rsp + 0x70]
call fcn.14001e7d0
mov rcx, rax
lea r8, [rax + 1]
movzx eax, byte [r8]
xor al, byte [rcx]
mov byte [r8], al
mov byte [r8 + 1], 0
lea rdx, [rbp - 0x70]
call fcn.14001e7a0
lea rdx, [rax + 1]
movzx r9d, byte [rax]
xor byte [rdx], r9b
xor byte [rax + 2], r9b
xor byte [rax + 3], r9b
xor byte [rax + 4], r9b
xor byte [rax + 5], r9b
xor byte [rax + 6], r9b
xor byte [rax + 7], r9b
xor byte [rax + 8], r9b
xor byte [rax + 9], r9b
xor byte [rax + 0xa], r9b
xor byte [rax + 0xb], r9b
xor byte [rax + 0xc], r9b
xor byte [rax + 0xd], r9b
xor byte [rax + 0xe], r9b
xor byte [rax + 0xf], r9b
xor byte [rax + 0x10], r9b
xor byte [rax + 0x11], r9b
xor byte [rax + 0x12], r9b
xor byte [rax + 0x13], r9b
xor byte [rdx + 0x13], r9b
mov byte [rdx + 0x14], 0
xor ecx, ecx
mov r9d, Ordinal_50
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x2ee0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call fcn.140002840
int3