Function at 0x14000d6f0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create thread
Execute command
Execute shellcode via indirect call
Inject thread
Persist via windows service
Query environment variable
Self delete
Set registry value
Spawn thread to rwx shellcode

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0x3a8]
sub rsp, 0x4a0
mov rax, qword [0x1402d5f38]
xor rax, rsp
mov qword [rbp + 0x360], rax
cmp byte [0x14030c1a0], 0
je 0x140010e8d
mov qword [r11 + 8], rbx
mov ecx, 1
mov qword [r11 + 0x10], rsi
mov qword [r11 - 0x10], r14
mov qword [r11 - 0x18], r15
movaps xmmword [r11 - 0x28], xmm6
movaps xmmword [r11 - 0x38], xmm7
mov qword [rbp - 0x60], 0
call qword [sym.imp.USER32.dll_GetSystemMetrics]
movss xmm0, dword [0x1402d5cd4]
xor ecx, ecx
mulss xmm0, dword [0x1400c9ef4]
cdq
sub eax, edx
sar eax, 1
movd xmm7, eax
cvtdq2ps xmm7, xmm7
subss xmm7, xmm0
call qword [sym.imp.USER32.dll_GetSystemMetrics]
movss xmm0, dword [0x1402d5cd0]
lea r8, [rbp - 0x60]
mulss xmm0, dword [0x1400c9ef4]
lea rcx, [rbp - 0x68]
cdq
sub eax, edx
movss dword [rbp - 0x64], xmm7
sar eax, 1
mov edx, 2
movd xmm1, eax
cvtdq2ps xmm1, xmm1
subss xmm1, xmm0
movss dword [rbp - 0x68], xmm1
call fcn.140037180
movss xmm0, dword [0x1402d5cd0]
lea rcx, [rbp - 0x60]
movss xmm1, dword [0x1402d5cd4]
xor edx, edx
movss dword [rbp - 0x60], xmm0
movss dword [rbp - 0x5c], xmm1
call fcn.140037220
mov rcx, qword [str._________________________________PANEL_PLATANITOS]
lea rdx, [0x14030c1a0]
mov r8d, Ordinal_46
call fcn.140016270
call fcn.14002aa90
lea rcx, [rbp - 0x60]
mov rbx, rax
call fcn.14002aac0
lea rcx, [rbp - 0x58]
call fcn.14002aae0
call fcn.14002a5f0
movaps xmm0, xmmword [0x1400fd950]
lea rcx, [rsp + 0x50]
movups xmmword [rsp + 0x50], xmm0
call fcn.14001c3c0
movss xmm0, dword [rbp - 0x58]
lea r8, [rbp - 0x68]
addss xmm0, dword [rbp - 0x60]
movss xmm1, dword [rbp - 0x5c]
lea rdx, [rbp - 0x60]
addss xmm1, dword [0x1400fd934]
mov dword [rsp + 0x28], 0xc0
mov r9d, eax
mov rcx, rbx
movss dword [rbp - 0x68], xmm0
movss xmm0, dword [0x1400c9ea0]
movss dword [rsp + 0x20], xmm0
movss dword [rbp - 0x64], xmm1
call fcn.1400408b0
lea rcx, [rbp - 0x68]
mov dword [rbp - 0x68], 0x41c80000
mov dword [rbp - 0x64], 0xc2700000
call fcn.140036e40
movaps xmm1, xmmword [0x1400fd980]
xorps xmm0, xmm0
movss xmm6, dword [0x1400c9e80]
movups xmmword [rsp + 0x68], xmm0
mov dword [rbp - 0x68], 0x3f800000
movups xmmword [rsp + 0x78], xmm1
mov dword [rbp - 0x64], 0x3f800000
mov qword [rsp + 0x60], 0
mov rcx, qword [0x14030c510]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x68]
lea rax, [rsp + 0x78]
mov dword [rsp + 0x50], 0x43eb0000
lea r8, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x54], 0x42c80000
call fcn.140057f80
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x43480000
mov dword [rsp + 0x54], 0x41880000
call fcn.140036e40
call fcn.14001a280
cmp dword [reloc.WS2_32.dll_bind], 0
lea rcx, str.Security
sete dl
call fcn.14000a860
xor r15d, r15d
test al, al
je 0x14000d939
mov dword [reloc.WS2_32.dll_bind], r15d
movss xmm7, dword [0x1400c9ea8]
xorps xmm0, xmm0
movaps xmm1, xmm7
call fcn.1400364f0
cmp dword [reloc.WS2_32.dll_bind], 1
lea rcx, str.BALAS
sete dl
call fcn.14000a860
test al, al
je 0x14000d970
mov dword [reloc.WS2_32.dll_bind], 1
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.1400364f0
cmp dword [reloc.WS2_32.dll_bind], 2
lea rcx, str.Visuals
sete dl
call fcn.14000a860
test al, al
je 0x14000d99f
mov dword [reloc.WS2_32.dll_bind], 2
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.1400364f0
cmp dword [reloc.WS2_32.dll_bind], 3
lea rcx, str.Extreme
sete dl
call fcn.14000a860
test al, al
je 0x14000d9ce
mov dword [reloc.WS2_32.dll_bind], 3
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.1400364f0
cmp dword [reloc.WS2_32.dll_bind], 5
lea rcx, [0x1400fbdb0]
sete dl
call fcn.14000a860
test al, al
je 0x14000d9fd
mov dword [reloc.WS2_32.dll_bind], 5
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.1400364f0
cmp dword [reloc.WS2_32.dll_bind], 4
lea rcx, str.Settings
sete dl
call fcn.14000a860
test al, al
je 0x14000da2c
mov dword [reloc.WS2_32.dll_bind], 4
call fcn.1400277b0
mov eax, dword [reloc.WS2_32.dll_bind]
test eax, eax
jne 0x14000de21
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x41f00000
mov dword [rsp + 0x54], 0x42960000
call fcn.140036e40
xor r9d, r9d
mov dword [rsp + 0x50], 0x43820000
xor r8d, r8d
mov dword [rsp + 0x54], 0x43160000
lea rdx, [rsp + 0x50]
lea rcx, str.cuzinhu1
call fcn.140018f60
movaps xmm0, xmm6
call fcn.140036ec0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40400000
mov ecx, 0xa
mov dword [rsp + 0x54], 0x40400000
call fcn.140032cf0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x41200000
mov ecx, reloc.WS2_32.dll_ntohl
mov dword [rsp + 0x54], 0x41200000
call fcn.140032cf0
lea rdx, [0x14030c52a]
lea rcx, str.SEGURIDAD_LOGO
call fcn.140009c90
mov ecx, 1
mov byte [0x14030c580], al
call fcn.140032670
mov ecx, 1
call fcn.140032670
movaps xmm0, xmm6
call fcn.140036ec0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40400000
mov ecx, 0xa
mov dword [rsp + 0x54], 0x40400000
call fcn.140032cf0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40a00000
mov ecx, reloc.WS2_32.dll_ntohl
mov dword [rsp + 0x54], 0x40a00000
call fcn.140032cf0
lea rdx, [0x14030c52b]
lea rcx, str.SEGURIDAD_1_LOGIN
call fcn.140009c90
mov ecx, 1
mov byte [0x14030c581], al
call fcn.140032670
mov ecx, 1
call fcn.140032670
movaps xmm0, xmm6
call fcn.140036ec0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40400000
mov ecx, 0xa
mov dword [rsp + 0x54], 0x40400000
call fcn.140032cf0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40a00000
mov ecx, reloc.WS2_32.dll_ntohl
mov dword [rsp + 0x54], 0x40a00000
call fcn.140032cf0
lea rdx, [0x14030c543]
lea rcx, str.SEGURIDAD_3_LOGIN
call fcn.140009c90
mov ecx, 1
mov byte [0x14030c572], al
call fcn.140032670
mov ecx, 1
call fcn.140032670
movaps xmm0, xmm6
call fcn.140036ec0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40400000
mov ecx, 0xa
mov dword [rsp + 0x54], 0x40400000
call fcn.140032cf0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40a00000
mov dword [rsp + 0x54], 0x40a00000
mov ecx, reloc.WS2_32.dll_ntohl
call fcn.140032cf0
lea rdx, [0x14030c541]
lea rcx, str.SEGURIDAD_4_LOGIN
call fcn.140009c90
mov ecx, 1
mov byte [0x14030c573], al
call fcn.140032670
mov ecx, 1
call fcn.140032670
movaps xmm0, xmm6
call fcn.140036ec0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40400000
mov ecx, 0xa
mov dword [rsp + 0x54], 0x40400000
call fcn.140032cf0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40a00000
mov ecx, reloc.WS2_32.dll_ntohl
mov dword [rsp + 0x54], 0x40a00000
call fcn.140032cf0
lea rdx, [0x14030c542]
lea rcx, str.SEGURIDAD_5_LOGIN
call fcn.140009c90
mov ecx, 1
mov byte [0x14030c574], al
call fcn.140032670
mov ecx, 1
call fcn.140032670
call fcn.140026a50
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x41f00000
mov dword [rsp + 0x54], 0x43610000
call fcn.140036e40
xor r9d, r9d
mov dword [rsp + 0x50], 0x43480000
xor r8d, r8d
mov dword [rsp + 0x54], 0x43160000
lea rdx, [rsp + 0x50]
lea rcx, str.cuzinhu2
call fcn.140018f60
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x42f00000
lea rcx, str.CUT_NETWORK_OFF
mov dword [rsp + 0x54], 0x420c0000
call fcn.140056980
test al, al
je 0x14000ddb0
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock0__dirin_actionblock_profileany_program_C:Program_FilesBlueStacks_nxtHD_Player.exe_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock0__dirout_actionblock_profileany_program_C:Program_FilesBlueStacks_nxtHD_Player.exe_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock1__dirin_actionblock_profileany_program_C:ProgramDataBlueStacks_msi5HD_Player.exe_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock1__dirout_actionblock_profileany_program_C:ProgramDataBlueStacks_msi5HD_Player.exe_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock2__dirin_actionblock_profileany_program_C:Program_FilesBlueStacksHD_Player.exe_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock2__dirout_actionblock_profileany_program_C:Program_FilesBlueStacksHD_Player.exe_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock3__dirin_actionblock_profileany_program_C:Program_FilesBlueStacks_msi2Bluestacks.exe_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock3__dirin_actionblock_profileany_program_C:Program_FilesBlueStacks_msi2HD_Player.exe_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock3__dirout_actionblock_profileany_program_C:Program_FilesBlueStacks_msi2HD_Player.exe_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windows_block_internet.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x42f00000
lea rcx, str.CUT_NETWORK_ON
mov dword [rsp + 0x54], 0x420c0000
call fcn.140056980
test al, al
je 0x14000de16
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:Program_FilesBlueStacks_nxtHD_Player.exe_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:ProgramDataBlueStacks_msi5HD_Player.exe_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:Program_FilesBlueStacksHD_Player.exe_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:Program_FilesBlueStacks_msi2HD_Player.exe_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windows_resume_internet.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140026a50
mov eax, dword [reloc.WS2_32.dll_bind]
cmp eax, 1
jne 0x14000e088
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x41f00000
mov dword [rsp + 0x54], 0x42960000
call fcn.140036e40
xor r9d, r9d
mov dword [rsp + 0x50], 0x432f0000
xor r8d, r8d
mov dword [rsp + 0x54], 0x43160000
lea rdx, [rsp + 0x50]
lea rcx, str.cuzinhu3
call fcn.140018f60
movaps xmm0, xmm6
call fcn.140036ec0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40400000
mov ecx, 0xa
mov dword [rsp + 0x54], 0x40400000
call fcn.140032cf0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40a00000
mov ecx, reloc.WS2_32.dll_ntohl
mov dword [rsp + 0x54], 0x40a00000
call fcn.140032cf0
lea rdx, [0x14030c52e]
lea rcx, str.Balas_Magica_V1
call fcn.140009c90
mov ecx, 1
mov byte [0x14030c55d], al
call fcn.140032670
mov ecx, 1
call fcn.140032670
movaps xmm0, xmm6
call fcn.140036ec0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40400000
mov ecx, 0xa
mov dword [rsp + 0x54], 0x40400000
call fcn.140032cf0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40a00000
mov ecx, reloc.WS2_32.dll_ntohl
mov dword [rsp + 0x54], 0x40a00000
call fcn.140032cf0
lea rdx, [0x14030c522]
lea rcx, str.Balas_Magica_V2
call fcn.140009c90
mov ecx, 1
mov byte [0x14030c57c], al
call fcn.140032670
mov ecx, 1
call fcn.140032670
movaps xmm0, xmm6
call fcn.140036ec0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40400000
mov ecx, 0xa
mov dword [rsp + 0x54], 0x40400000
call fcn.140032cf0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40a00000
mov ecx, reloc.WS2_32.dll_ntohl
mov dword [rsp + 0x54], 0x40a00000
call fcn.140032cf0
lea rdx, [0x14030c523]
lea rcx, str.Remover_Bug_Balas_V1
call fcn.140009c90
mov ecx, 1
mov byte [0x14030c57d], al
call fcn.140032670
mov ecx, 1
call fcn.140032670
movaps xmm0, xmm6
call fcn.140036ec0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40400000
mov ecx, 0xa
mov dword [rsp + 0x54], 0x40400000
call fcn.140032cf0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40a00000
mov dword [rsp + 0x54], 0x40a00000
mov ecx, reloc.WS2_32.dll_ntohl
call fcn.140032cf0
lea rdx, [0x14030c524]
lea rcx, str.Recarga_Rapida
call fcn.140009c90
mov ecx, 1
mov byte [0x14030c57e], al
call fcn.140032670
mov ecx, 1
call fcn.140032670
call fcn.140026a50
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x41f00000
mov dword [rsp + 0x54], 0x43610000
call fcn.140036e40
xor r9d, r9d
mov dword [rsp + 0x50], 0x43480000
xor r8d, r8d
mov dword [rsp + 0x54], 0x43160000
lea rdx, [rsp + 0x50]
lea rcx, str.cuzinhu4
call fcn.140018f60
call fcn.140026a50
mov eax, dword [reloc.WS2_32.dll_bind]
cmp eax, 2
jne 0x14000e598
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x43af0000
mov dword [rsp + 0x54], 0x42960000
call fcn.140036e40
xor r9d, r9d
mov dword [rsp + 0x50], 0x432f0000
xor r8d, r8d
mov dword [rsp + 0x54], 0x43160000
lea rdx, [rsp + 0x50]
lea rcx, str.cuzinhu4
call fcn.140018f60
movaps xmm0, xmm6
call fcn.140036ec0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40400000
mov ecx, 0xa
mov dword [rsp + 0x54], 0x40400000
call fcn.140032cf0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40a00000
mov ecx, reloc.WS2_32.dll_ntohl
mov dword [rsp + 0x54], 0x40a00000
call fcn.140032cf0
lea rdx, [0x14030c520]
lea rcx, str.AIM_AWM1
call fcn.140009c90
mov ecx, 1
mov byte [0x14030c553], al
call fcn.140032670
mov ecx, 1
call fcn.140032670
movaps xmm0, xmm6
call fcn.140036ec0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40400000
mov ecx, 0xa
mov dword [rsp + 0x54], 0x40400000
call fcn.140032cf0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40a00000
mov ecx, reloc.WS2_32.dll_ntohl
mov dword [rsp + 0x54], 0x40a00000
call fcn.140032cf0
lea rdx, [0x14030c536]
lea rcx, str.Cambio_Rapido
call fcn.140009c90
mov ecx, 1
mov byte [0x14030c564], al
call fcn.140032670
mov ecx, 1
call fcn.140032670
movaps xmm0, xmm6
call fcn.140036ec0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40400000
mov ecx, 0xa
mov dword [rsp + 0x54], 0x40400000
call fcn.140032cf0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40a00000
mov ecx, reloc.WS2_32.dll_ntohl
mov dword [rsp + 0x54], 0x40a00000
call fcn.140032cf0
lea rdx, [0x14030c530]
lea rcx, str.GHOST_HACK
call fcn.140009c90
mov ecx, 1
mov byte [0x14030c55f], al
call fcn.140032670
mov ecx, 1
call fcn.140032670
call fcn.140026a50
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x41f00000
mov dword [rsp + 0x54], 0x43610000
call fcn.140036e40
xor r9d, r9d
mov dword [rsp + 0x50], 0x43480000
xor r8d, r8d
mov dword [rsp + 0x54], 0x43160000
lea rdx, [rsp + 0x50]
lea rcx, str.cuzinhu5
call fcn.140018f60
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x3f800000
mov dword [rsp + 0x54], 0x41200000
call fcn.140036e40
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40400000
mov ecx, 0xa
mov dword [rsp + 0x54], 0x40400000
call fcn.140032cf0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40a00000
mov ecx, reloc.WS2_32.dll_ntohl
mov dword [rsp + 0x54], 0x40a00000
call fcn.140032cf0
lea rdx, [0x14030c53c]
lea rcx, str.TELEPORT_TEST
call fcn.140009c90
mov ecx, 1
mov byte [0x14030c571], al
call fcn.140032670
mov ecx, 1
call fcn.140032670
movaps xmm0, xmm6
call fcn.140036ec0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40400000
mov ecx, 0xa
mov dword [rsp + 0x54], 0x40400000
call fcn.140032cf0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40a00000
mov ecx, reloc.WS2_32.dll_ntohl
mov dword [rsp + 0x54], 0x40a00000
call fcn.140032cf0
lea rdx, [0x14030c544]
lea rcx, str.BYPASS_WALLHACK
call fcn.140009c90
mov ecx, 1
mov byte [0x14030c56d], al
call fcn.140032670
mov ecx, 1
call fcn.140032670
movaps xmm0, xmm6
call fcn.140036ec0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40400000
mov ecx, 0xa
mov dword [rsp + 0x54], 0x40400000
call fcn.140032cf0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40a00000
mov ecx, reloc.WS2_32.dll_ntohl
mov dword [rsp + 0x54], 0x40a00000
call fcn.140032cf0
lea rdx, [0x14030c545]
lea rcx, str.WALLHACK
call fcn.140009c90
mov ecx, 1
mov byte [0x14030c56e], al
call fcn.140032670
mov ecx, 1
call fcn.140032670
call fcn.140026a50
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x41f00000
mov dword [rsp + 0x54], 0x42960000
call fcn.140036e40
xor r9d, r9d
mov dword [rsp + 0x50], 0x43480000
xor r8d, r8d
mov dword [rsp + 0x54], 0x43160000
lea rdx, [rsp + 0x50]
lea rcx, str.cuzinhu6
call fcn.140018f60
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x3f800000
mov dword [rsp + 0x54], 0x41200000
call fcn.140036e40
mov dword [rsp + 0x50], 0x40400000
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x54], 0x40400000
mov ecx, 0xa
call fcn.140032cf0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40a00000
mov ecx, reloc.WS2_32.dll_ntohl
mov dword [rsp + 0x54], 0x40a00000
call fcn.140032cf0
lea rdx, [0x14030c529]
lea rcx, str.ESP_BOX_TEST
call fcn.140009c90
mov ecx, 1
mov byte [0x14030c570], al
call fcn.140032670
mov ecx, 1
call fcn.140032670
movaps xmm0, xmm6
call fcn.140036ec0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40400000
mov ecx, 0xa
mov dword [rsp + 0x54], 0x40400000
call fcn.140032cf0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40a00000
mov ecx, reloc.WS2_32.dll_ntohl
mov dword [rsp + 0x54], 0x40a00000
call fcn.140032cf0
lea rdx, [0x14030c53a]
lea rcx, str.Antena_Hombro_M
call fcn.140009c90
mov ecx, 1
mov byte [0x14030c567], al
call fcn.140032670
mov ecx, 1
call fcn.140032670
movaps xmm0, xmm6
call fcn.140036ec0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40400000
mov ecx, 0xa
mov dword [rsp + 0x54], 0x40400000
call fcn.140032cf0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40a00000
mov ecx, reloc.WS2_32.dll_ntohl
mov dword [rsp + 0x54], 0x40a00000
call fcn.140032cf0
lea rdx, [0x14030c521]
lea rcx, str.ANTENA_HOMBRO_F
call fcn.140009c90
mov ecx, 1
mov byte [0x14030c57a], al
call fcn.140032670
mov ecx, 1
call fcn.140032670
call fcn.140026a50
mov eax, dword [reloc.WS2_32.dll_bind]
cmp eax, 3
jne 0x14000e719
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x41f00000
mov dword [rsp + 0x54], 0x42960000
call fcn.140036e40
xor r9d, r9d
mov dword [rsp + 0x50], 0x432f0000
xor r8d, r8d
mov dword [rsp + 0x54], 0x43160000
lea rdx, [rsp + 0x50]
lea rcx, str.cuzinhu8
call fcn.140018f60
movaps xmm0, xmm6
call fcn.140036ec0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40400000
mov ecx, 0xa
mov dword [rsp + 0x54], 0x40400000
call fcn.140032cf0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40a00000
mov ecx, reloc.WS2_32.dll_ntohl
mov dword [rsp + 0x54], 0x40a00000
call fcn.140032cf0
lea rdx, [0x14030c531]
lea rcx, str.Camara_Hack
call fcn.140009c90
mov ecx, 1
mov byte [0x14030c560], al
call fcn.140032670
mov ecx, 1
call fcn.140032670
movaps xmm0, xmm6
call fcn.140036ec0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40400000
mov ecx, 0xa
mov dword [rsp + 0x54], 0x40400000
call fcn.140032cf0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40a00000
mov ecx, reloc.WS2_32.dll_ntohl
mov dword [rsp + 0x54], 0x41200000
call fcn.140032cf0
lea rdx, [0x14030c532]
lea rcx, str.BYPASS_CAMARA
call fcn.140009c90
mov ecx, 1
mov byte [0x14030c57f], al
call fcn.140032670
mov ecx, 1
call fcn.140032670
call fcn.140026a50
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x41f00000
mov dword [rsp + 0x54], 0x43610000
call fcn.140036e40
xor r9d, r9d
mov dword [rsp + 0x50], 0x43480000
xor r8d, r8d
mov dword [rsp + 0x54], 0x43160000
lea rdx, [rsp + 0x50]
lea rcx, str.cuzinhu9
call fcn.140018f60
call fcn.140026a50
mov eax, dword [reloc.WS2_32.dll_bind]
mov qword [rsp + 0x4c0], rdi
cmp eax, 4
jne 0x14000f135
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x41f00000
mov dword [rsp + 0x54], 0x42960000
call fcn.140036e40
xor r9d, r9d
mov dword [rsp + 0x50], 0x43610000
xor r8d, r8d
mov dword [rsp + 0x54], 0x43160000
lea rdx, [rsp + 0x50]
lea rcx, str.cuzinhu112
call fcn.140018f60
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x3f800000
mov dword [rsp + 0x54], 0x41200000
call fcn.140036e40
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40400000
mov ecx, 0xa
mov dword [rsp + 0x54], 0x40400000
call fcn.140032cf0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40a00000
mov ecx, reloc.WS2_32.dll_ntohl
mov dword [rsp + 0x54], 0x40a00000
call fcn.140032cf0
lea rdx, [0x14030c548]
lea rcx, str.STREAM_MODE
call fcn.140009c90
mov ecx, 1
call fcn.140032670
mov ecx, 1
call fcn.140032670
movaps xmm0, xmm6
call fcn.140036ec0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40400000
mov ecx, 0xa
mov dword [rsp + 0x54], 0x40400000
call fcn.140032cf0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40a00000
mov ecx, reloc.WS2_32.dll_ntohl
mov dword [rsp + 0x54], 0x40a00000
call fcn.140032cf0
lea rdx, [0x14030c539]
lea rcx, str.Suspender_Emulador
call fcn.140009c90
test al, al
je 0x14000e984
cmp byte [0x14030c539], r15b
lea rcx, [rsp + 0x50]
je 0x14000e8d2
call fcn.140011380
test rax, rax
je 0x14000e984
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140011450
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x14000e907
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_DebugActiveProcess]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test eax, eax
je 0x14000e8ad
lea rdx, str.Processo_suspenso.
jmp 0x14000e966
lea rdx, str.Falha_ao_suspender_o_processo._C
call fcn.14000cae0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
jmp 0x14000e96b
call fcn.140011380
test rax, rax
je 0x14000e984
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140011450
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x14000e940
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Falha_ao_abrir_o_processo._C
call fcn.14000cae0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x14000d2b0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000e984
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test eax, eax
jne 0x14000e95f
lea rdx, str.Falha_ao_retomar_o_processo._C
jmp 0x14000e8b4
lea rdx, str.Processo_retomado.
call fcn.14000cae0
lea rdx, [0x14000d2b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 1
call fcn.140032670
mov ecx, 1
call fcn.140032670
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x42f00000
lea rcx, str.Destruct
mov dword [rsp + 0x54], 0x420c0000
call fcn.140056980
test al, al
je 0x14000f0e7
lea rcx, str.del__s__f__q__temp_.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__S__Q_C:WINDOWSPrefetch
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RD__S__Q_C:WINDOWSPrefetch
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__f__q_C:Users_username_AppDataLocalCrashDumps_.dmp
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.deltree__y_c:windows_tempor1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.deltree__y_c:windows_temp
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.deltree__y_c:windows_tmp
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.deltree__y_c:windows_ff.tmp
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.deltree__y_c:windowshistory
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.deltree__y_c:windowscookies
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_Dusmsvc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_pcasvc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_dps
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_sysmain
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_bam
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:Users_username_AppDataRoamingMicrosoftWindowsRecentAutomaticDestinations
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rd__s__q_C:Users_username_AppDataRoamingMicrosoftWindowsRecentAutomaticDestinations
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:Users_username_AppDataRoamingMicrosoftWindowsRecentCustomDestinations
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rd__s__q_C:Users_username_AppDataRoamingMicrosoftWindowsRecentCustomDestinations
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_start_pcasvc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_start_dps
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_start_sysmain
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_start_bam
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.fsutil_usn_deletejournal__n_c:
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.fsutil_usn_deletejournal__n_d:
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.fsutil_usn_deletejournal__n_e:
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.fsutil_usn_deletejournal__n_f:
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.fsutil_usn_deletejournal__d_c:
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.fsutil_usn_createJournal_m__2147483648_a__1_C:
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.fsutil_usn_createJournal_m__2147483648_a__1_D:
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.fsutil_usn_createJournal_m__2147483648_a__1_E:
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.fsutil_usn_createJournal_m__2147483648_a__1_F:
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:WindowsSystem32RenamedFiles.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:WindowsSystem32DeletedFiles.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSoftwareGuna___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedPidlMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSaveMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFileExts___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREWinRARArcHistory___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageAppSwitched___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerRecentDocs___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedPidlMRULegacy___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32FirstFolder___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32CIDSizeMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerRunMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsShellBagMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsShellBags___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellBags___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellBagMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession_ManagerAppCompatCache___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001ControlSession_ManagerAppCompatCache___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageAppSwitched___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageShowJumpView___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftDirectInput___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerTypedPaths___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionAppletsRegedit___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_LOCAL_MACHINESYSTEMMountedDevices___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001Services_bamStateUserSettings___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0x140], rax
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x130], xmm0
movups xmmword [rsp + 0x78], xmm0
mov r8d, 0x104
mov qword [rbp - 0x78], rax
lea rdx, [rbp - 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r9, [rbp - 0x50]
mov edx, 0x208
lea r8, str.cmd.exe__C_ping_1.1.1.1__n_1__w_3000___Nul__Del__f__q___s_
lea rcx, [rbp + 0x150]
call fcn.140012190
lea rax, [rsp + 0x78]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x150]
lea rax, [rbp + 0xe0]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
mov dword [rbp + 0xe0], WSAGetLastError
lea rax, [rsp + 0x78]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, str.explorer.exe
lea rax, [rbp + 0xe0]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x8000044
mov dword [rsp + 0x20], r15d
movups xmmword [rbp + 0xe8], xmm0
movups xmmword [rbp + 0xf8], xmm0
movups xmmword [rbp + 0x108], xmm0
movups xmmword [rbp + 0x118], xmm0
movups xmmword [rbp + 0x128], xmm0
movups xmmword [rbp + 0x138], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14000f03c
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x78]
test rsi, rsi
je 0x14000f03c
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x1b0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
test rax, rax
jne 0x14000ef29
mov rcx, rsi
jmp 0x14000f036
lea rcx, str.kernel32.dll
lea rdi, [rax + 0x80]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.WaitForSingleObject
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1400fbbd8]
mov rcx, rbx
mov qword [rbp - 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ExitProcess
mov rcx, rbx
mov qword [rbp - 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DeleteFileA
mov rcx, rbx
mov qword [rbp - 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 2
lea r9, [rbp - 0x30]
mov rdx, rax
mov dword [rsp + 0x28], r15d
mov rcx, rax
mov dword [rsp + 0x20], r15d
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov r8d, 0x104
lea rdx, [rbp - 0x28]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov r9d, 0x80
mov qword [rsp + 0x20], r15
lea r8, [0x140012000]
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, 0x130
mov qword [rsp + 0x20], r15
lea r8, [rbp - 0x50]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rbp - 0x68]
mov dword [rbp - 0x68], r15d
mov qword [rsp + 0x30], rax
mov r9, r14
mov dword [rsp + 0x28], r15d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x14000f03c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 0x104
lea rdx, [rbp + 0x150]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14000f0e7
mov r8d, 0x104
lea rdx, [rbp + 0x150]
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x14000f0e7
lea rdx, str._c_del
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [rbp + 0x150]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.____NUL
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov r8d, 0x104
lea rdx, [rbp + 0x150]
lea rcx, str.ComSpec
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x14000f0e7
mov dword [rsp + 0x28], r15d
lea r9, [rbp - 0x50]
lea r8, [rbp + 0x150]
mov qword [rsp + 0x20], r15
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movaps xmm0, xmm6
call fcn.140036ec0
lea rcx, str.Close_Process:
call fcn.1400605c0
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.1400364f0
movss xmm0, dword [0x1400fd93c]
call fcn.140036ec0
movaps xmm0, xmmword [0x1400fd970]
lea rdx, [0x1400fd7b8]
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.1400605f0
call fcn.140026a50
cmp byte [0x14030c572], r15b
movabs rsi, 0x140737488355327
movaps xmm7, xmmword [rsp + 0x470]
movaps xmm6, xmmword [rsp + 0x480]
je 0x14000f27e
cmp byte [0x14030c543], r15b
je 0x14000f202
mov ecx, 4
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x14000f183
mov dword [rax], 0xe320f000
jmp 0x14000f186
mov rdi, r15
mov ecx, reloc.WS2_32.dll_recv
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x14000f1b5
mov dword [rax], 0xe3a0000a
mov dword [rax + 4], 0xe12fff32
mov dword [rax + 8], 0xeaffffe9
mov dword [rax + 0xc], 0xe3590000
jmp 0x14000f1b8
mov rbx, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, reloc.WS2_32.dll_recv
mov qword [rbp - 0x70], r15
lea rdx, str.Anti_report_logo
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, rsi
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140011940
jmp 0x14000f27e
mov ecx, 1
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x14000f219
mov byte [rax], r15b
jmp 0x14000f21c
mov rdi, r15
mov ecx, 1
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x14000f233
mov byte [rax], r15b
jmp 0x14000f236
mov rbx, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, reloc.WS2_32.dll_recv
mov qword [rbp - 0x70], r15
lea rdx, str.Anti_report_logo
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, rsi
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140012630
cmp byte [0x14030c573], r15b
je 0x14000f3ad
cmp byte [0x14030c541], r15b
je 0x14000f331
mov ecx, 4
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x14000f2b2
mov dword [rax], 0xe320f000
jmp 0x14000f2b5
mov rdi, r15
mov ecx, reloc.WS2_32.dll_recv
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x14000f2e4
mov dword [rax], 0xe3a0000a
mov dword [rax + 4], 0xe12fff1e
mov dword [rax + 8], 0xe3a0000d
mov dword [rax + 0xc], 0xe12fff1e
jmp 0x14000f2e7
mov rbx, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, reloc.WS2_32.dll_recv
mov qword [rbp - 0x70], r15
lea rdx, str.Anti_report_logo
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, rsi
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140011940
jmp 0x14000f3ad
mov ecx, 1
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x14000f348
mov byte [rax], r15b
jmp 0x14000f34b
mov rdi, r15
mov ecx, 1
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x14000f362
mov byte [rax], r15b
jmp 0x14000f365
mov rbx, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, reloc.WS2_32.dll_recv
mov qword [rbp - 0x70], r15
lea rdx, str.Anti_report_logo
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, rsi
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140012630
cmp byte [0x14030c574], r15b
je 0x14000f4d9
cmp byte [0x14030c542], r15b
je 0x14000f45d
mov ecx, 4
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x14000f3e1
mov dword [rax], 0xe320f000
jmp 0x14000f3e4
mov rdi, r15
mov ecx, reloc.WS2_32.dll_listen
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x14000f410
mov dword [rax], 0xe3a0000a
mov dword [rax + 4], 0x3f3f3f3f
mov dword [rax + 8], 0x3f3f3f3f
mov byte [rax + 0xc], 3
jmp 0x14000f413
mov rbx, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, reloc.WS2_32.dll_recv
mov qword [rbp - 0x70], r15
lea rdx, str.Anti_report_logo
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, rsi
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140011940
jmp 0x14000f4d9
mov ecx, 1
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x14000f474
mov byte [rax], r15b
jmp 0x14000f477
mov rdi, r15
mov ecx, 1
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x14000f48e
mov byte [rax], r15b
jmp 0x14000f491
mov rbx, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, reloc.WS2_32.dll_recv
mov qword [rbp - 0x70], r15
lea rdx, str.Anti_report_logo
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, rsi
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140012630
cmp byte [0x14030c580], r15b
je 0x14000f601
cmp byte [0x14030c52a], r15b
je 0x14000f585
mov ecx, 8
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x14000f514
mov dword [rax], 0x464c457f
mov dword [rax + 4], 0xa0101
jmp 0x14000f517
mov rbx, r15
mov ecx, 8
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x14000f538
mov dword [rax], 0x464c457f
mov dword [rax + 4], 0x10101
jmp 0x14000f53b
mov rdi, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, reloc.WS2_32.dll_recv
mov qword [rbp - 0x70], r15
lea rdx, str.Anti_report_logo
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, rsi
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140011940
jmp 0x14000f601
mov ecx, 1
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x14000f59c
mov byte [rax], r15b
jmp 0x14000f59f
mov rdi, r15
mov ecx, 1
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x14000f5b6
mov byte [rax], r15b
jmp 0x14000f5b9
mov rbx, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, reloc.WS2_32.dll_recv
mov qword [rbp - 0x70], r15
lea rdx, str.Anti_report_logo
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, rsi
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140012630
cmp byte [0x14030c581], r15b
je 0x14000f730
cmp byte [0x14030c52b], r15b
je 0x14000f6b4
mov ecx, 4
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x14000f635
mov dword [rax], 0xe320f000
jmp 0x14000f638
mov rdi, r15
mov ecx, reloc.WS2_32.dll_recv
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x14000f667
mov dword [rax], 0xe3a0000a
mov dword [rax + 4], 0xe354006e
mov dword [rax + 8], 0x1300003f
mov dword [rax + 0xc], 0xe8bd8c10
jmp 0x14000f66a
mov rbx, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, 0xa
mov qword [rbp - 0x70], r15
lea rdx, str.Anti_black
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, rsi
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140011940
jmp 0x14000f730
mov ecx, 1
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x14000f6cb
mov byte [rax], r15b
jmp 0x14000f6ce
mov rdi, r15
mov ecx, 1
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x14000f6e5
mov byte [rax], r15b
jmp 0x14000f6e8
mov rbx, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, 0xa
mov qword [rbp - 0x70], r15
lea rdx, str.Anti_black
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, rsi
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140012630
cmp byte [0x14030c553], r15b
movabs r14, 0x7ffffffeffff
je 0x14000f900
cmp byte [0x14030c520], r15b
mov ecx, 1
je 0x14000f82f
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x14000f76b
mov byte [rax], r15b
jmp 0x14000f76e
mov rdi, r15
mov ecx, 0x46
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x14000f7dc
mov qword [rax], 1
mov dword [rax + 8], r15d
mov dword [rax + 0xc], 0x3f3f3f3f
mov dword [rax + 0x10], 0x3f3f3f3f
mov qword [rax + 0x14], reloc.WLDAP32.dll_Ordinal_200
mov qword [rax + 0x1c], r15
mov dword [rax + 0x24], r15d
mov dword [rax + 0x28], 5
mov dword [rax + 0x2c], 1
mov dword [rax + 0x30], 0x3fb5c28f
mov dword [rax + 0x34], 1
mov qword [rax + 0x38], 0x3f3f3f3f
mov dword [rax + 0x40], 0x3f3f3f3f
mov word [rax + 0x44], 0x3f3f
jmp 0x14000f7df
mov rbx, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x70], r15
lea rdx, str.Aimbot___Sniper
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, r14
mov qword [rsp + 0x28], rdi
mov r8d, 0x10000
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140011940
jmp 0x14000f900
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x14000f841
mov byte [rax], r15b
jmp 0x14000f844
mov rdi, r15
mov ecx, 0x46
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x14000f8b2
mov qword [rax], 1
mov dword [rax + 8], r15d
mov dword [rax + 0xc], 0x3f3f3f3f
mov dword [rax + 0x10], 0x3f3f3f3f
mov qword [rax + 0x14], reloc.WLDAP32.dll_Ordinal_200
mov qword [rax + 0x1c], r15
mov dword [rax + 0x24], r15d
mov dword [rax + 0x28], 5
mov dword [rax + 0x2c], 1
mov dword [rax + 0x30], 0x3fb5c28f
mov dword [rax + 0x34], 1
mov qword [rax + 0x38], 0x3f3f3f3f
mov dword [rax + 0x40], 0x3f3f3f3f
mov word [rax + 0x44], 0x3f3f
jmp 0x14000f8b5
mov rbx, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x70], r15
lea rdx, str.Aimbot___Sniper
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, r14
mov qword [rsp + 0x28], rdi
mov r8d, 0x10000
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140012630
cmp byte [0x14030c567], r15b
je 0x14000fa50
cmp byte [0x14030c53a], r15b
mov ecx, listen
je 0x14000f9ba
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x14000f942
mov dword [rax], 0xbf456c0c
mov dword [rax + 4], 0x447a0000
mov dword [rax + 8], 0x3a7e9cc0
jmp 0x14000f945
mov rbx, r15
mov ecx, listen
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x14000f96a
mov dword [rax], 0xbf456c0c
mov dword [rax + 4], r15d
mov dword [rax + 8], 0x3a7e9cc0
jmp 0x14000f96d
mov rdi, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, reloc.WLDAP32.dll_Ordinal_22
mov qword [rbp - 0x70], r15
lea rdx, str.Antena_Hombro_ACTIVADO
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, rsi
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140011940
jmp 0x14000fa50
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x14000f9dd
mov dword [rax], 0xbf456c0c
mov dword [rax + 4], 0x447a0000
mov dword [rax + 8], 0x3a7e9cc0
jmp 0x14000f9e0
mov rbx, r15
mov ecx, listen
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x14000fa05
mov dword [rax], 0xbf456c0c
mov dword [rax + 4], r15d
mov dword [rax + 8], 0x3a7e9cc0
jmp 0x14000fa08
mov rdi, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, Ordinal_26
mov qword [rbp - 0x70], r15
lea rdx, str.Antena_Hombro_Desactivado
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, rsi
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140012630
cmp byte [0x14030c564], r15b
je 0x14000fbef
cmp byte [0x14030c536], r15b
je 0x14000fb2f
mov ecx, 8
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x14000fa8b
mov dword [rax], 0x3db851ec
mov dword [rax + 4], 0x3cf5c28f
jmp 0x14000fa8e
mov rdi, r15
mov ecx, Ordinal_46
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x14000fadf
mov dword [rax], 0x3f3f3f3f
mov qword [rax + 4], 0x3e800000
mov dword [rax + 0xc], 0x3f3f3f3f
mov dword [rax + 0x10], 0x3f3f3f3f
mov dword [rax + 0x14], 0x3f3f3f3f
mov dword [rax + 0x18], 0x3f3f3f3f
mov qword [rax + 0x1c], 0x3f3f3f3f
mov dword [rax + 0x24], r15d
mov dword [rax + 0x28], 0x3f800000
jmp 0x14000fae2
mov rbx, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, listen
mov qword [rbp - 0x70], r15
lea rdx, str.Fast_Switch
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, rsi
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140011940
jmp 0x14000fbef
mov ecx, Ordinal_46
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x14000fb80
mov dword [rax], 0x3f3f3f3f
mov qword [rax + 4], 0x3e800000
mov dword [rax + 0xc], 0x3f3f3f3f
mov dword [rax + 0x10], 0x3f3f3f3f
mov dword [rax + 0x14], 0x3f3f3f3f
mov dword [rax + 0x18], 0x3f3f3f3f
mov qword [rax + 0x1c], 0x3f3f3f3f
mov dword [rax + 0x24], r15d
mov dword [rax + 0x28], 0x3f800000
jmp 0x14000fb83
mov rbx, r15
mov ecx, 8
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x14000fba4
mov dword [rax], 0x3db851ec
mov dword [rax + 4], 0x3cf5c28f
jmp 0x14000fba7
mov rdi, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, listen
mov qword [rbp - 0x70], r15
lea rdx, str.Fast_Switch
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, rsi
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140012630
cmp byte [0x14030c55d], r15b
je 0x14000fd23
cmp byte [0x14030c52e], r15b
je 0x14000fc9d
mov ecx, 4
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x14000fc23
mov dword [rax], 0x3f800000
jmp 0x14000fc26
mov rdi, r15
mov ecx, 7
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x14000fc4a
mov dword [rax], 0x3727c5ac
mov word [rax + 4], 0x4830
mov byte [rax + 6], reloc.WLDAP32.dll_Ordinal_45
jmp 0x14000fc4d
mov rbx, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x70], r15
lea rdx, str.Balas_Magica_V1
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, r14
mov qword [rsp + 0x28], rdi
mov r8d, 0x10000
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140011940
jmp 0x14000fd23
mov ecx, 5
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x14000fcbb
mov dword [rax], 0x3727c5ac
mov byte [rax + 4], Ordinal_50
jmp 0x14000fcbe
mov rbx, r15
mov ecx, 4
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x14000fcd8
mov dword [rax], 0x3f800000
jmp 0x14000fcdb
mov rdi, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x70], r15
lea rdx, str.Balas_Magica_V1
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, rsi
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140012630
cmp byte [0x14030c55f], r15b
je 0x14000feff
cmp byte [0x14030c530], r15b
mov ecx, reloc.WLDAP32.dll_Ordinal_32
je 0x14000fe23
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x14000fd82
mov dword [rax], 0x4a380cc
mov dword [rax + 4], 0x4b5a537
mov dword [rax + 8], 0x4a0b4d8
mov dword [rax + 0xc], 0x4a0b4b0
mov dword [rax + 0x10], 0x4a0b24c
mov dword [rax + 0x14], 0x4a0b214
mov qword [rax + 0x18], 0x4a0b4cc
jmp 0x14000fd85
mov rbx, r15
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x14000fdd0
mov dword [rax], 0x4a380cc
mov dword [rax + 4], 0x4b5a537
mov dword [rax + 8], 0x4a0b4d8
mov dword [rax + 0xc], 0x4a0b4b0
mov dword [rax + 0x10], 0x4a0b24c
mov dword [rax + 0x14], 0x4a0b214
mov dword [rax + 0x18], 0x4a0b4cc
mov dword [rax + 0x1c], 0x447a0000
jmp 0x14000fdd3
mov rdi, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, 0xa
mov qword [rbp - 0x70], r15
lea rdx, str.ghost_hack
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, r14
mov qword [rsp + 0x28], rbx
mov r8d, 0x10000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140011940
jmp 0x14000feff
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x14000fe63
mov dword [rax], 0x4a380cc
mov dword [rax + 4], 0x4b5a537
mov dword [rax + 8], 0x4a0b4d8
mov dword [rax + 0xc], 0x4a0b4b0
mov dword [rax + 0x10], 0x4a0b24c
mov dword [rax + 0x14], 0x4a0b214
mov qword [rax + 0x18], 0x4a0b4cc
jmp 0x14000fe66
mov rbx, r15
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x14000feb1
mov dword [rax], 0x4a380cc
mov dword [rax + 4], 0x4b5a537
mov dword [rax + 8], 0x4a0b4d8
mov dword [rax + 0xc], 0x4a0b4b0
mov dword [rax + 0x10], 0x4a0b24c
mov dword [rax + 0x14], 0x4a0b214
mov dword [rax + 0x18], 0x4a0b4cc
mov dword [rax + 0x1c], 0x447a0000
jmp 0x14000feb4
mov rdi, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, listen
mov qword [rbp - 0x70], r15
lea rdx, str.Aimfov___360
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, r14
mov qword [rsp + 0x28], rbx
mov r8d, 0x10000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140012630
cmp byte [0x14030c560], r15b
je 0x1400100d5
cmp byte [0x14030c531], r15b
mov ecx, reloc.WLDAP32.dll_Ordinal_32
je 0x14000fffc
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x14000ff5e
mov dword [rax], 0x3f800000
mov dword [rax + 4], 0x3f19999a
mov qword [rax + 8], 0x3f800000
mov dword [rax + 0x10], 0x41f00000
mov dword [rax + 0x14], 0x3ecccccd
mov dword [rax + 0x18], 0x42700000
mov dword [rax + 0x1c], 0x3e4ccccd
jmp 0x14000ff61
mov rdi, r15
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x14000ffa9
mov dword [rax], 0x3ecccccd
mov dword [rax + 4], 0x3f19999a
mov dword [rax + 8], 0xbd4ccccd
mov dword [rax + 0xc], r15d
mov dword [rax + 0x10], 0x41f00000
mov dword [rax + 0x14], 0x3ecccccd
mov dword [rax + 0x18], 0x42700000
mov dword [rax + 0x1c], 0x3e4ccccd
jmp 0x14000ffac
mov rbx, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, listen
mov qword [rbp - 0x70], r15
lea rdx, str.Camera_Hack
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, r14
mov qword [rsp + 0x28], rdi
mov r8d, 0x10000
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140011940
jmp 0x1400100d5
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x14001003c
mov dword [rax], 0x3f800000
mov dword [rax + 4], 0x3f19999a
mov qword [rax + 8], 0x3f800000
mov dword [rax + 0x10], 0x41f00000
mov dword [rax + 0x14], 0x3ecccccd
mov dword [rax + 0x18], 0x42700000
mov dword [rax + 0x1c], 0x3e4ccccd
jmp 0x14001003f
mov rdi, r15
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x140010087
mov dword [rax], 0x3ecccccd
mov dword [rax + 4], 0x3f19999a
mov dword [rax + 8], 0xbd4ccccd
mov dword [rax + 0xc], r15d
mov dword [rax + 0x10], 0x41f00000
mov dword [rax + 0x14], 0x3ecccccd
mov dword [rax + 0x18], 0x42700000
mov dword [rax + 0x1c], 0x3e4ccccd
jmp 0x14001008a
mov rbx, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, listen
mov qword [rbp - 0x70], r15
lea rdx, str.Camera_Hack
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, r14
mov qword [rsp + 0x28], rdi
mov r8d, 0x10000
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140012630
cmp byte [0x14030c57f], r15b
je 0x14001029b
cmp byte [0x14030c532], r15b
mov ecx, Ordinal_32
je 0x1400101ca
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x140010133
invalid
mov dword [rax], 0xf020e3
mov dword [rax + 4], 0xe1a0000a
mov dword [rax + 8], 0xebfedde0
mov dword [rax + 0xc], 0xe1a06000
mov dword [rax + 0x10], 0xe3560000
mov dword [rax + 0x14], 0xa00006d
mov dword [rax + 0x18], 0xe59f0bd0
jmp 0x140010136
mov rbx, r15
mov ecx, Ordinal_32
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x14001017a
mov dword [rax], 0xe12fff3c
mov dword [rax + 4], 0xe1a0000a
mov dword [rax + 8], 0xebfedde0
mov dword [rax + 0xc], 0xe1a06000
mov dword [rax + 0x10], 0xe3560000
mov dword [rax + 0x14], 0xa00006d
mov dword [rax + 0x18], 0xe59f0bd0
jmp 0x14001017d
mov rdi, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, reloc.WS2_32.dll_select
mov qword [rbp - 0x70], r15
lea rdx, str.BYPASS_CAMARA_HACK
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, rsi
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140011940
jmp 0x14001029b
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x140010209
mov dword [rax], 0xf020e3
mov dword [rax + 4], 0xe1a0000a
mov dword [rax + 8], 0xebfedde0
mov dword [rax + 0xc], 0xe1a06000
mov dword [rax + 0x10], 0xe3560000
mov dword [rax + 0x14], 0xa00006d
mov dword [rax + 0x18], 0xe59f0bd0
jmp 0x14001020c
mov rbx, r15
mov ecx, Ordinal_32
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x140010250
mov dword [rax], 0xe12fff3c
mov dword [rax + 4], 0xe1a0000a
mov dword [rax + 8], 0xebfedde0
mov dword [rax + 0xc], 0xe1a06000
mov dword [rax + 0x10], 0xe3560000
mov dword [rax + 0x14], 0xa00006d
mov dword [rax + 0x18], 0xe59f0bd0
jmp 0x140010253
mov rdi, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, reloc.WS2_32.dll_listen
mov qword [rbp - 0x70], r15
lea rdx, str.BYPASS_Camara
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, rsi
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140012630
cmp byte [0x14030c56d], r15b
movabs r14, 0x7fffffffffff
je 0x14001043d
cmp byte [0x14030c544], r15b
je 0x1400103c1
mov ecx, Ordinal_41
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x140010318
mov dword [rax], 0xe58d8028
mov dword [rax + 4], 0xe58d8024
mov dword [rax + 8], 0xe58d8020
mov dword [rax + 0xc], 0xe58d801c
mov dword [rax + 0x10], 0xe58d8018
mov dword [rax + 0x14], 0xe58d8010
mov dword [rax + 0x18], 0xe58d6008
mov dword [rax + 0x1c], 0xe88d0082
mov dword [rax + 0x20], 0xe3021710
mov dword [rax + 0x24], 0xe320f000
jmp 0x14001031b
mov rdi, r15
mov ecx, Ordinal_41
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x140010374
mov dword [rax], 0xe58d8028
mov dword [rax + 4], 0xe58d8024
mov dword [rax + 8], 0xe58d8020
mov dword [rax + 0xc], 0xe58d801c
mov dword [rax + 0x10], 0xe58d8018
mov dword [rax + 0x14], 0xe58d8010
mov dword [rax + 0x18], 0xe58d6008
mov dword [rax + 0x1c], 0xe88d0082
mov dword [rax + 0x20], 0xe3021710
mov dword [rax + 0x24], 0xe12fff3c
jmp 0x140010377
mov rbx, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, listen
mov qword [rbp - 0x70], r15
lea rdx, str.ByPass_Wall
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, r14
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140011940
jmp 0x14001043d
mov ecx, 4
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x1400103d8
mov dword [rax], r15d
jmp 0x1400103db
mov rbx, r15
mov ecx, 4
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x1400103f5
mov dword [rax], 0x3fc00000
jmp 0x1400103f8
mov rdi, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
xor r8d, r8d
mov qword [rbp - 0x70], r15
lea rdx, [0x1400c822c]
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, r14
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140012630
cmp byte [0x14030c56e], r15b
je 0x1400105af
cmp byte [0x14030c545], r15b
mov ecx, reloc.WS2_32.dll_recv
je 0x140010508
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x140010486
mov dword [rax], 0xea000000
mov dword [rax + 4], 0xbf800000
mov dword [rax + 8], 0xee238a85
mov dword [rax + 0xc], 0xee229a87
jmp 0x140010489
mov rdi, r15
mov ecx, reloc.WS2_32.dll_recv
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x1400104b8
mov dword [rax], 0xea000000
mov dword [rax + 4], 0x358637bd
mov dword [rax + 8], 0xee238a85
mov dword [rax + 0xc], 0xee229a87
jmp 0x1400104bb
mov rbx, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, 8
mov qword [rbp - 0x70], r15
lea rdx, str.WALLHACK
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, r14
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140011940
jmp 0x1400105af
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x140010532
mov dword [rax], 0xea000000
mov dword [rax + 4], 0xbf800000
mov dword [rax + 8], 0xee238a85
mov dword [rax + 0xc], 0xee229a87
jmp 0x140010535
mov rdi, r15
mov ecx, reloc.WS2_32.dll_recv
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x140010564
mov dword [rax], 0xea000000
mov dword [rax + 4], 0x358637bd
mov dword [rax + 8], 0xee238a85
mov dword [rax + 0xc], 0xee229a87
jmp 0x140010567
mov rbx, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, listen
mov qword [rbp - 0x70], r15
lea rdx, str.WALLHACK_OFF
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, r14
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140012630
cmp byte [0x14030c571], r15b
mov r14, qword [rsp + 0x498]
je 0x14001077d
cmp byte [0x14030c53c], r15b
mov ecx, Ordinal_32
je 0x1400106ac
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x140010615
mov dword [rax], 0x4a0b24c
mov dword [rax + 4], 0x4a0b214
mov dword [rax + 8], 0x4a0b4cc
mov dword [rax + 0xc], 0xc47a0000
mov dword [rax + 0x10], 0x4a0b474
mov dword [rax + 0x14], 0xe92d4ff0
mov dword [rax + 0x18], 0xe28db01c
jmp 0x140010618
mov rbx, r15
mov ecx, Ordinal_32
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x14001065c
mov dword [rax], 0x4a0b24c
mov dword [rax + 4], 0x4a0b214
mov dword [rax + 8], 0x4a0b4cc
mov dword [rax + 0xc], 0x447a0000
mov dword [rax + 0x10], 0x4a0b474
mov dword [rax + 0x14], 0xe92d4ff0
mov dword [rax + 0x18], 0xe28db01c
jmp 0x14001065f
mov rdi, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, listen
mov qword [rbp - 0x70], r15
lea rdx, str.telepor_test
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, rsi
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140011940
jmp 0x14001077d
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x1400106eb
mov dword [rax], 0x4a0b24c
mov dword [rax + 4], 0x4a0b214
mov dword [rax + 8], 0x4a0b4cc
mov dword [rax + 0xc], 0xc47a0000
mov dword [rax + 0x10], 0x4a0b474
mov dword [rax + 0x14], 0xe92d4ff0
mov dword [rax + 0x18], 0xe28db01c
jmp 0x1400106ee
mov rbx, r15
mov ecx, Ordinal_32
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x140010732
mov dword [rax], 0x4a0b24c
mov dword [rax + 4], 0x4a0b214
mov dword [rax + 8], 0x4a0b4cc
mov dword [rax + 0xc], 0x447a0000
mov dword [rax + 0x10], 0x4a0b474
mov dword [rax + 0x14], 0xe92d4ff0
mov dword [rax + 0x18], 0xe28db01c
jmp 0x140010735
mov rdi, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, listen
mov qword [rbp - 0x70], r15
lea rdx, str.telepor_test
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, rsi
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140012630
cmp byte [0x14030c570], r15b
je 0x140010964
cmp byte [0x14030c529], r15b
je 0x1400108e8
mov ecx, 0x42
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x14001080f
mov dword [rax], 0x660065
mov dword [rax + 4], 0x650066
mov dword [rax + 8], 0x740063
mov dword [rax + 0xc], 0x2f0073
mov dword [rax + 0x10], 0x720062
mov dword [rax + 0x14], 0x61005f
mov dword [rax + 0x18], 0x720069
mov dword [rax + 0x1c], 0x720064
mov dword [rax + 0x20], 0x70006f
mov dword [rax + 0x24], 0x6f0062
mov dword [rax + 0x28], 0x6c0078
mov dword [rax + 0x2c], 0x670069
mov qword [rax + 0x30], 0x740068
mov qword [rax + 0x38], r15
mov word [rax + 0x40], r15w
jmp 0x140010812
mov rdi, r15
mov ecx, 0x42
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x14001089b
mov dword [rax], 0x6e0069
mov dword [rax + 4], 0x610067
mov dword [rax + 8], 0x65006d
mov dword [rax + 0xc], 0x63002f
mov dword [rax + 0x10], 0x700061
mov dword [rax + 0x14], 0x750073
mov dword [rax + 0x18], 0x65006c
mov dword [rax + 0x1c], 0x750068
mov dword [rax + 0x20], 0x61006d
mov dword [rax + 0x24], 0x73006e
mov dword [rax + 0x28], 0x69006e
mov dword [rax + 0x2c], 0x650070
mov dword [rax + 0x30], 0x630072
mov dword [rax + 0x34], 0x6c006f
mov dword [rax + 0x38], 0x69006c
mov dword [rax + 0x3c], 0x650064
mov word [rax + 0x40], WSAStartup
jmp 0x14001089e
mov rbx, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, 6
mov qword [rbp - 0x70], r15
lea rdx, str.NPC_NA
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, rsi
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140011940
jmp 0x140010964
mov ecx, 1
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x1400108ff
mov byte [rax], r15b
jmp 0x140010902
mov rdi, r15
mov ecx, 1
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x140010919
mov byte [rax], r15b
jmp 0x14001091c
mov rbx, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, 8
mov qword [rbp - 0x70], r15
lea rdx, str.Npc_Name
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, rsi
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140012630
cmp byte [0x14030c57a], r15b
je 0x140010a94
cmp byte [0x14030c521], r15b
je 0x140010a18
mov ecx, listen
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x1400109a6
mov dword [rax], 0x3dfa309a
mov dword [rax + 4], 0x447a0000
mov dword [rax + 8], 0x3f50da6b
jmp 0x1400109a9
mov rbx, r15
mov ecx, listen
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x1400109cb
mov qword [rax], 0x3dfa309a
mov dword [rax + 8], 0x3f50da6b
jmp 0x1400109ce
mov rdi, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, Ordinal_32
mov qword [rbp - 0x70], r15
lea rdx, str.ANTENA_HOMBRO_MUJER_ACTIVADA
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, rsi
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140011940
jmp 0x140010a94
mov ecx, 1
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x140010a2f
mov byte [rax], r15b
jmp 0x140010a32
mov rdi, r15
mov ecx, 1
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x140010a49
mov byte [rax], r15b
jmp 0x140010a4c
mov rbx, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, 8
mov qword [rbp - 0x70], r15
lea rdx, str.Npc_Name
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, rsi
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140012630
cmp byte [0x14030c57d], r15b
je 0x140010bab
cmp byte [0x14030c523], r15b
mov ecx, 4
je 0x140010b2e
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x140010ac4
mov dword [rax], 0x42c80000
jmp 0x140010ac7
mov rdi, r15
mov ecx, 4
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x140010ae1
mov dword [rax], 0x37a78400
jmp 0x140010ae4
mov rbx, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x70], r15
lea rdx, str.Bug_V1_Removido
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, rsi
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140011940
jmp 0x140010bab
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x140010b43
mov dword [rax], 0x42c80000
jmp 0x140010b46
mov rdi, r15
mov ecx, 4
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x140010b60
mov dword [rax], 0x37a78400
jmp 0x140010b63
mov rbx, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x70], r15
lea rdx, str.Bug_V1_Removido
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, rsi
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140012630
cmp byte [0x14030c57e], r15b
je 0x140010cef
cmp byte [0x14030c524], r15b
je 0x140010c73
mov ecx, listen
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x140010bed
mov dword [rax], 0xe34500ff
mov dword [rax + 4], 0xe12fff1e
mov dword [rax + 8], 0xe1a04000
jmp 0x140010bf0
mov rdi, r15
mov ecx, reloc.WS2_32.dll_sendto
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x140010c26
mov dword [rax], 0xe92d4830
mov dword [rax + 4], 0xe28db008
mov dword [rax + 8], 0xe1a04000
mov dword [rax + 0xc], 0xe3010add
mov dword [rax + 0x10], 0xe3a01000
jmp 0x140010c29
mov rbx, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, reloc.WS2_32.dll_sendto
mov qword [rbp - 0x70], r15
lea rdx, str.Recarga_Ultra_Rapida
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, rsi
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140011940
jmp 0x140010cef
mov ecx, 1
call fcn.1400c3c38
mov rbx, rax
test rax, rax
je 0x140010c8a
mov byte [rax], r15b
jmp 0x140010c8d
mov rbx, r15
mov ecx, 1
call fcn.1400c3c38
mov rdi, rax
test rax, rax
je 0x140010ca4
mov byte [rax], r15b
jmp 0x140010ca7
mov rdi, r15
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
mov r8d, 8
mov qword [rbp - 0x70], r15
lea rdx, str.Npc_Name
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b0a0
mov r9, rsi
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x78]
lea rcx, [0x14030c588]
call fcn.140012630
cmp byte [0x14030c578], r15b
mov rdi, qword [rsp + 0x4c0]
mov rsi, qword [rsp + 0x4b8]
je 0x140010d1d
cmp byte [0x14030c547], r15b
je 0x140010d1d
lea rcx, [0x14030c588]
call fcn.1400111d0
cmp byte [0x14030c582], r15b
je 0x140010d3b
cmp byte [0x14030c54a], r15b
je 0x140010d3b
lea rcx, [0x14030c588]
call fcn.140012270
cmp byte [0x14030c57c], r15b
je 0x140010d59
cmp byte [0x14030c522], r15b
je 0x140010d59
lea rcx, [0x14030c588]
call fcn.1400129f0
cmp byte [0x14030c582], r15b
je 0x140010d77
cmp byte [0x14030c52c], r15b
je 0x140010d77
lea rcx, [0x14030c588]
call fcn.140012270
cmp byte [0x14030c548], r15b
je 0x140010dd4
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rax
mov edx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
xor ecx, ecx
mov qword [rbp - 0x68], r15
call qword [sym.imp.ole32.dll_CoInitialize]
xor edx, edx
lea rax, [rbp - 0x68]
lea r9, [0x14010cfd0]
mov qword [rsp + 0x20], rax
lea rcx, [0x14010cfe0]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x140010e3c
mov rax, qword [rbp - 0x68]
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x28]
jmp 0x140010e23
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
xor ecx, ecx
mov qword [rbp - 0x68], r15
call qword [sym.imp.ole32.dll_CoInitialize]
xor edx, edx
lea rax, [rbp - 0x68]
lea r9, [0x14010cfd0]
mov qword [rsp + 0x20], rax
lea rcx, [0x14010cfe0]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x140010e3c
mov rax, qword [rbp - 0x68]
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x20]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, qword [rbp - 0x68]
mov rdx, rax
call rbx
mov rcx, qword [rbp - 0x68]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x41c80000
mov dword [rsp + 0x54], 0x43b90000
call fcn.140036e40
cmp qword [0x14030c4f8], 0x10
lea rcx, [0x14030c4e0]
cmovae rcx, qword [0x14030c4e0]
call fcn.1400605c0
call fcn.140026530
mov r15, qword [rsp + 0x490]
mov rbx, qword [rsp + 0x4b0]
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.1400c3590
add rsp, 0x4a0
pop rbp
ret