Function at 0x14004f5d0
Capabilities:
Create directory
Create process on windows
Create thread
Download url
Encode data using base64
Execute command
Hide graphical window
Log keystrokes via polling
Query environment variable
Receive data
Terminate process

Disassembly:
push rbp
push rbx
push r13
push r14
lea rbp, [rsp - 0x1d988]
mov eax, 0x1da88
call fcn.140122140
sub rsp, rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14004f5fb
call fcn.14004d8b0
call fcn.14004c930
lea rax, str..kdstinker
xor r13d, r13d
mov qword [rbp + 0x640], rax
mov ebx, r13d
lea rax, str..NiGgEr
mov qword [rbp + 0x648], rax
lea rax, str..KsDumper
mov qword [rbp + 0x650], rax
lea r14d, [r13 + 1]
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rbp + rbx*8 + 0x640]
xor r9d, r9d
mov qword [rsp + 0x30], r13
mov r8d, r14d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
jne 0x140056987
inc rbx
cmp rbx, 3
jl 0x14004f640
lea rdx, [rbp + 0x14a0]
mov qword [rsp + 0x20], r13
lea rdx, [rdx + 0x80]
xor r9d, r9d
lea rbx, [0x140000000]
movups xmm0, xmmword [rbx + 0x190050]
lea rcx, [rbx + 0x190050]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
mov rax, qword [rcx + 0x30]
lea r8, [rbp + 0x840]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmm0, xmmword [rcx]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [0x140190120]
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rax
mov eax, dword [rcx + 0x38]
movups xmm0, xmmword [str.C:WindowsSystem32ShaderDumper.dll]
mov dword [rdx + 0x38], eax
movzx eax, byte [rcx + 0x3c]
xor ecx, ecx
mov byte [rdx + 0x3c], al
lea rdx, [rbp + 0x14a0]
movzx eax, word [0x140190130]
mov word [rbp + 0x860], ax
movzx eax, byte [0x140190132]
mov byte [rbp + 0x862], al
movups xmmword [rbp + 0x840], xmm0
movups xmmword [rbp + 0x850], xmm1
call sub.urlmon.dll_URLDownloadToFileA
movups xmm0, xmmword [rbx + 0x190140]
lea rcx, [rbx + 0x190140]
movups xmm1, xmmword [rcx + 0x10]
mov eax, dword [rcx + 0xb0]
lea rdx, [rbp + 0x10e0]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movups xmm0, xmmword [str.C:Windows_temphk4x.dll]
movzx eax, byte [rcx + 0xb4]
mov byte [rdx + 0x34], al
movzx eax, byte [0x140190000]
movups xmmword [rbp + 0x7c0], xmm0
movsd xmm0, qword [0x14018fff8]
movsd qword [rbp + 0x7d0], xmm0
xor r9d, r9d
mov byte [rbp + 0x7d8], al
lea r8, [rbp + 0x7c0]
mov qword [rsp + 0x20], r13
lea rdx, [rbp + 0x10e0]
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToFileA
movups xmm0, xmmword [rbx + 0x190200]
lea rcx, [rbx + 0x190200]
xor r9d, r9d
movups xmm1, xmmword [rcx + 0x10]
mov eax, dword [rcx + 0xb0]
lea rdx, [rbp + 0x1560]
movups xmmword [rdx], xmm0
lea r8, [rbp + 0x820]
mov qword [rsp + 0x20], r13
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, word [rcx + 0xb4]
xor ecx, ecx
movups xmm0, xmmword [str.C:Windows_tempBox3D.dll]
mov word [rdx + 0x34], ax
lea rdx, [rbp + 0x1560]
movzx eax, word [0x140190040]
movups xmmword [rbp + 0x820], xmm0
mov word [rbp + 0x838], ax
movsd xmm0, qword [0x140190038]
movsd qword [rbp + 0x830], xmm0
call sub.urlmon.dll_URLDownloadToFileA
movups xmm0, xmmword [rbx + 0x1902c0]
lea rcx, [rbx + 0x1902c0]
movups xmm1, xmmword [rcx + 0x10]
mov rax, qword [rcx + 0xb0]
lea rdx, [rbp + 0x1320]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rax
movups xmm0, xmmword [str.C:Windows_tempChamsRed.dll]
movzx eax, byte [rcx + 0xb8]
mov byte [rdx + 0x38], al
movups xmmword [rbp + 0x7a0], xmm0
movsd xmm0, qword [0x140190018]
movsd qword [rbp + 0x7b0], xmm0
mov eax, dword [0x140190020]
lea r8, [rbp + 0x7a0]
mov dword [rbp + 0x7b8], eax
lea rdx, [rbp + 0x1320]
movzx eax, byte [0x140190024]
xor r9d, r9d
xor ecx, ecx
mov byte [rbp + 0x7bc], al
mov qword [rsp + 0x20], r13
call sub.urlmon.dll_URLDownloadToFileA
movups xmm0, xmmword [rbx + 0x190380]
lea rcx, [rbx + 0x190380]
xor r9d, r9d
movups xmm1, xmmword [rcx + 0x10]
mov eax, dword [rcx + 0xb0]
lea rdx, [rbp + 0x11a0]
movups xmmword [rdx], xmm0
lea r8, [rbp + 0x7e0]
mov qword [rsp + 0x20], r13
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, byte [rcx + 0xb4]
xor ecx, ecx
movups xmm0, xmmword [str.C:Windows_tempRas1.dll]
mov byte [rdx + 0x34], al
lea rdx, [rbp + 0x11a0]
movzx eax, byte [0x140190450]
movups xmmword [rbp + 0x7e0], xmm0
mov byte [rbp + 0x7f8], al
movsd xmm0, qword [0x140190448]
movsd qword [rbp + 0x7f0], xmm0
call sub.urlmon.dll_URLDownloadToFileA
movups xmm0, xmmword [rbx + 0x190460]
lea rax, [rbx + 0x190460]
movups xmm1, xmmword [rax + 0x10]
lea rcx, [rbp + 0x1020]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx + 0x60], xmm0
movups xmm0, xmmword [rax + 0x80]
movups xmmword [rcx + 0x70], xmm1
movups xmm1, xmmword [rax + 0x90]
movups xmmword [rcx + 0x80], xmm0
movups xmm0, xmmword [rax + 0xa0]
mov eax, dword [rax + 0xb0]
movups xmmword [rcx + 0x90], xmm1
movups xmmword [rcx + 0xa0], xmm0
mov dword [rcx + 0xb0], eax
movups xmm0, xmmword [str.C:Windows_tempwin.dll]
movups xmmword [rbp + 0xb58], xmm0
movsd xmm0, qword [0x14018ffc0]
movsd qword [rbp + 0xb68], xmm0
xor r9d, r9d
mov qword [rsp + 0x20], r13
lea r8, [rbp + 0xb58]
xor ecx, ecx
lea rdx, [rbp + 0x1020]
call sub.urlmon.dll_URLDownloadToFileA
movups xmm0, xmmword [rbx + 0x190520]
lea rax, [rbx + 0x190520]
xor r9d, r9d
movups xmm1, xmmword [rax + 0x10]
lea rcx, [rbp + 0x1620]
mov qword [rsp + 0x20], r13
movups xmmword [rcx], xmm0
lea r8, [rbp + 0xcd8]
movups xmm0, xmmword [rax + 0x20]
lea rdx, [rbp + 0x1620]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax + 0x80]
movups xmmword [rcx - 0x10], xmm1
movups xmm1, xmmword [rax + 0x90]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0xa0]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0xb0]
mov eax, dword [rax + 0xc0]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [str.C:WindowsSystem32Macro2Awm_by_Swatzz.ahk]
movups xmmword [rcx + 0x30], xmm1
mov dword [rcx + 0x40], eax
xor ecx, ecx
movups xmm1, xmmword [0x1401905f8]
mov eax, dword [0x140190610]
movups xmmword [rbp + 0xcd8], xmm0
mov dword [rbp + 0xd00], eax
movsd xmm0, qword [0x140190608]
movups xmmword [rbp + 0xce8], xmm1
movsd qword [rbp + 0xcf8], xmm0
call sub.urlmon.dll_URLDownloadToFileA
movups xmm0, xmmword [rbx + 0x190620]
lea rcx, [rbx + 0x190620]
movups xmm1, xmmword [rcx + 0x10]
mov rax, qword [rcx + 0xb0]
lea rdx, [rbp + 0x13e0]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [0x1401906f0]
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rax
movups xmm0, xmmword [str.C:WindowsSystem32Macrom500.ahk]
movzx eax, word [rcx + 0xb8]
mov word [rdx + 0x38], ax
movups xmmword [rbp + 0xcb0], xmm0
movzx eax, word [0x140190700]
lea r8, [rbp + 0xcb0]
xor r9d, r9d
mov word [rbp + 0xcd0], ax
lea rdx, [rbp + 0x13e0]
mov qword [rsp + 0x20], r13
xor ecx, ecx
movups xmmword [rbp + 0xcc0], xmm1
call sub.urlmon.dll_URLDownloadToFileA
movups xmm0, xmmword [rbx + 0x190710]
lea rcx, [rbx + 0x190710]
xor r9d, r9d
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp + 0x1260]
mov qword [rsp + 0x20], r13
movups xmmword [rdx], xmm0
lea r8, [rbp + 0x780]
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + 0x80]
mov eax, dword [rcx + 0x30]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], eax
movzx eax, word [rcx + 0x34]
movups xmm0, xmmword [str.C:Windows_tempRastss.dll]
mov word [rdx + 0x34], ax
movzx eax, byte [rcx + 0x36]
xor ecx, ecx
mov byte [rdx + 0x36], al
lea rdx, [rbp + 0x1260]
movzx eax, word [0x14018ffe0]
mov word [rbp + 0x798], ax
movzx eax, byte [0x14018ffe2]
movups xmmword [rbp + 0x780], xmm0
mov byte [rbp + 0x79a], al
movsd xmm0, qword [0x14018ffd8]
movsd qword [rbp + 0x790], xmm0
call sub.urlmon.dll_URLDownloadToFileA
lea rcx, str.username
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp + 0x800], xmm0
mov r8, 0xffffffffffffffff
movdqu xmmword [rbp + 0x810], xmm1
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r13b
jne 0x14004fe40
mov qword [rsp + 0x1dab0], rsi
lea rcx, [rbp + 0x800]
mov qword [rsp + 0x1dab8], rdi
mov rdx, rax
mov qword [rsp + 0x1dac0], r12
mov qword [rsp + 0x1da80], r15
movaps xmmword [rsp + 0x1da70], xmm6
movaps xmmword [rsp + 0x1da60], xmm7
movaps xmmword [rsp + 0x1da50], xmm8
movaps xmmword [rsp + 0x1da40], xmm9
movaps xmmword [rsp + 0x1da30], xmm10
movaps xmmword [rsp + 0x1da20], xmm11
movaps xmmword [rsp + 0x1da10], xmm12
movaps xmmword [rsp + 0x1da00], xmm13
movaps xmmword [rsp + 0x1d9f0], xmm14
movaps xmmword [rsp + 0x1d9e0], xmm15
call fcn.14002f3c0
lea r8, [rbp + 0x800]
lea rdx, str.C:Users_
lea rcx, [rbp + 0xe78]
call fcn.140046d30
mov r8d, reloc.WLDAP32.dll_Ordinal_32
lea rdx, str.AppDataLocalTempCheat_Engine
mov rcx, rax
call fcn.14004d820
mov qword [rbp + 0x420], r13
lea rcx, [rbp + 0xe78]
mov qword [rbp + 0x428], r13
xorps xmm0, xmm0
movups xmmword [rbp + 0x410], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x410], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x420], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r13b
call fcn.14002fd20
lea rcx, [rbp + 0x800]
call fcn.14002fd20
lea rcx, [rbp + 0x410]
call fcn.14004e950
test al, al
jne 0x14005697e
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Th__m_c
call fcn.140046ad0
cmp qword [rbp + 0x428], 0xf
lea rdx, [rbp + 0x410]
mov r8, qword [rbp + 0x420]
mov rcx, rax
cmova rdx, qword [rbp + 0x410]
call fcn.140047880
lea rdx, [0x1401907f0]
mov rcx, rax
call fcn.140046ad0
lea rdx, [0x140048190]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor r9d, r9d
mov qword [rsp + 0x28], r13
lea r8, [0x14004b3e0]
mov dword [rsp + 0x20], r13d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x5c0]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140056960
mov rcx, qword [rbp + 0x5c0]
lea rax, [rbp + 0x5b8]
mov edi, reloc.WS2_32.dll_sendto
mov dword [rbp + 0x118], r13d
mov edx, edi
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp + 0x118]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140056960
cmp dword [rbp + 0x118], r13d
setne al
test al, al
je 0x140056960
xor edx, edx
lea rcx, str.C:WindowsLOGIN
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rdx, str.C:WindowsSystem32chams.dll
lea rcx, [rbp + 0x16f0]
call fcn.140048230
lea rcx, [0x140711380]
call fcn.1400cb990
cmp dword [0x140710fc8], r13d
jne 0x140050098
call fcn.140057170
mov rcx, rax
call fcn.1400570d0
mov dword [0x140710fc8], eax
call fcn.140057170
mov edx, dword [0x140710fc8]
mov rcx, rax
call fcn.1400573a0
cmp byte [0x140711598], r13b
jne 0x1400500e5
lea rcx, [0x1407115a0]
call fcn.14004da50
mov rdx, rax
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp dword [0x140710fc8], r13d
jne 0x140050101
call fcn.140057170
mov rcx, rax
call fcn.1400570d0
mov dword [0x140710fc8], eax
call fcn.140057170
mov edx, dword [0x140710fc8]
mov rcx, rax
call fcn.1400573a0
lea rax, [0x14004cfa0]
mov dword [rbp + 0x5f0], 0x50
mov edx, 0x7f00
mov qword [rbp + 0x5f8], rax
xor ecx, ecx
mov dword [rbp + 0x5f4], 0x40
mov qword [rbp + 0x600], r13
mov qword [rbp + 0x608], r13
call qword [sym.imp.USER32.dll_LoadIconA]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rbp + 0x610], rax
call qword [sym.imp.USER32.dll_LoadCursorA]
mov edx, 0x7f00
mov qword [rbp + 0x620], r13
mov qword [rbp + 0x618], rax
xor ecx, ecx
lea rax, str.ImGui
mov qword [rbp + 0x628], rax
lea rax, str.Example
mov qword [rbp + 0x630], rax
call qword [sym.imp.USER32.dll_LoadIconA]
lea rcx, [rbp + 0x5f0]
mov qword [rbp + 0x638], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov ecx, r14d
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
xor ecx, ecx
sub eax, edx
sar eax, 1
lea ebx, [rax - 0x104]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov qword [rsp + 0x58], r13
lea r8, str.Entropy
mov qword [rsp + 0x50], r13
cdq
mov qword [rsp + 0x48], r13
sub eax, edx
mov rdx, qword [rbp + 0x630]
mov r9d, 0x80000000
mov qword [rsp + 0x40], r13
xor ecx, ecx
mov dword [rsp + 0x38], 0x208
sar eax, 1
sub eax, 0x190
mov dword [rsp + 0x30], 0x320
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rcx, rax
mov qword [rbp + 0x340], rax
mov edx, 0xffffffec
mov rsi, rax
call qword [sym.imp.USER32.dll_GetWindowLongA]
mov edx, 0xffffffec
mov rcx, rsi
bts eax, 0x13
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongA]
movzx r8d, byte [0x1406daa20]
mov r9d, r14d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
xorps xmm0, xmm0
lea rdx, [rbp + 0x160]
mov rcx, rsi
movups xmmword [rbp + 0x160], xmm0
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rcx, rsi
call fcn.14004b050
test al, al
jne 0x140050339
call fcn.14004afa0
mov rdx, qword [rbp + 0x608]
mov rcx, qword [rbp + 0x630]
call qword [sym.imp.USER32.dll_UnregisterClassW]
lea rcx, [rbp + 0x410]
call fcn.14002fd20
mov eax, r14d
movaps xmm14, xmmword [rsp + 0x1d9f0]
movaps xmm13, xmmword [rsp + 0x1da00]
movaps xmm12, xmmword [rsp + 0x1da10]
movaps xmm11, xmmword [rsp + 0x1da20]
movaps xmm10, xmmword [rsp + 0x1da30]
movaps xmm9, xmmword [rsp + 0x1da40]
movaps xmm8, xmmword [rsp + 0x1da50]
movaps xmm7, xmmword [rsp + 0x1da60]
movaps xmm6, xmmword [rsp + 0x1da70]
mov r15, qword [rsp + 0x1da80]
mov r12, qword [rsp + 0x1dac0]
mov rdi, qword [rsp + 0x1dab8]
mov rsi, qword [rsp + 0x1dab0]
movaps xmm15, xmmword [rsp + 0x1d9e0]
add rsp, 0x1da88
pop r14
pop r13
pop rbx
pop rbp
ret
mov r15d, 0xa
mov rcx, rsi
mov edx, r15d
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rsi
call qword [sym.imp.USER32.dll_UpdateWindow]
mov qword [rsp + 0x30], 2
lea r9d, [r15 - 2]
mov qword [rsp + 0x28], rdi
lea rcx, str.1.89.3_WIP
mov edx, 0x37b8
mov qword [rsp + 0x20], reloc.WS2_32.dll_recv
mov r8d, 0x418
call fcn.14000a580
xor ecx, ecx
call fcn.14000a0b0
call fcn.14000dce0
lea rcx, [rbp + 0xef0]
mov rdi, rax
call fcn.140021300
mov dword [rbp + 0xf3c], 0x10c
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
call fcn.1400252a0
movss xmm6, dword [0x1401915e0]
lea rdx, [0x140576560]
mov qword [rsp + 0x28], rax
movaps xmm3, xmm6
lea rax, [rbp + 0xef0]
mov r8d, 0x8574
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1400226c0
mov qword [0x1407110d0], rax
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
call fcn.1400252a0
movss xmm3, dword [0x14012eb68]
lea rdx, [0x140576560]
mov qword [rsp + 0x28], rax
mov r8d, 0x8574
lea rax, [rbp + 0xef0]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1400226c0
mov qword [0x1407110c8], rax
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
call fcn.1400252a0
mov qword [rsp + 0x28], rax
lea rdx, [0x14057eae0]
lea rax, [rbp + 0xef0]
movaps xmm3, xmm6
mov r8d, 0xb98
mov qword [rsp + 0x20], rax
mov rcx, rbx
call fcn.1400226c0
mov qword [0x1407110d8], rax
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
call fcn.1400252a0
movss xmm3, dword [0x1401915dc]
lea rdx, [0x14057eae0]
mov qword [rsp + 0x28], rax
mov r8d, 0xb98
lea rax, [rbp + 0xef0]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1400226c0
xor ecx, ecx
mov qword [0x1407110e0], rax
call fcn.140028dd0
mov rcx, rsi
call fcn.14003b910
mov rdx, qword [0x140711378]
mov rcx, qword [0x1407112c8]
call fcn.14003a8d0
movss xmm8, dword [0x14012eb24]
xor bl, bl
mov dword [rbp + 0x11c], ebx
movabs r12, 0x7fffffffffffffff
movss xmm10, dword [0x14012eb40]
xorps xmm7, xmm7
movss xmm9, dword [0x14012eb9c]
movss xmm14, dword [0x14012eafc]
movss xmm11, dword [0x14012eb58]
movss xmm12, dword [0x14012eb48]
movss xmm13, dword [0x1401915f0]
movss xmm15, dword [0x14012ead4]
nop dword [rax]
xor r9d, r9d
mov dword [rsp + 0x20], r14d
xor r8d, r8d
lea rcx, [rbp + 0xd08]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x1400505a4
nop
lea rcx, [rbp + 0xd08]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0xd08]
call qword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [rbp + 0xd10], 0x12
lea rcx, [rbp + 0xd08]
movzx ebx, bl
cmove ebx, r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x140050550
mov dword [rbp + 0x11c], ebx
test bl, bl
jne 0x140056888
call fcn.14003ab50
call fcn.14003bac0
call fcn.140014cb0
mov ecx, reloc.WLDAP32.dll_Ordinal_45
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400505e2
cmp byte [reloc.WS2_32.dll_accept], 0
mov rcx, rsi
sete al
mov byte [reloc.WS2_32.dll_accept], al
neg al
sbb edx, edx
and edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.14004adb0
movzx eax, byte [0x140710fcc]
test al, al
jne 0x1400511f6
call fcn.14000e3d0
xor edx, edx
lea rcx, [rbp + 0x348]
mov r15, rax
mov dword [rax + 0x10], 0x41200000
mov dword [rax + 0x2c], 0x41200000
mov dword [rax + 8], r13d
mov dword [rax + 0xc], 0x41f00000
mov dword [rax + 0x14], r13d
mov dword [rax + 0x44], 0x40800000
mov qword [rax + 0x4c], 0
mov dword [rax + 0x74], 0x40c00000
mov qword [rax + 0x34], 0x41000000
mov dword [rbp + 0x348], 0x44480000
mov dword [rbp + 0x34c], 0x44020000
call fcn.14001b000
lea rcx, [rsp + 0x60]
call fcn.140049fd0
mov rcx, rax
call fcn.140049c70
mov rcx, rax
xor edx, edx
mov r8d, 0x20bb
call fcn.140004dd0
lea rcx, [rbp + 0x358]
call fcn.14000e680
lea rcx, [rbp + 0x350]
call fcn.14000e6a0
lea rcx, [rbp + 0xb48]
call fcn.14000d840
call fcn.14000d910
cvttss2si ecx, dword [0x1406daa28]
mov r9d, 0xff
xor edx, edx
mov r8d, r9d
mov rbx, rax
mov dword [rsp + 0x20], ecx
lea rcx, [rbp + 0xed8]
call fcn.1400484d0
mov rcx, rax
call fcn.140009f70
movss xmm0, dword [rbp + 0x350]
lea r8, [rbp + 0x360]
movss xmm3, dword [rbp + 0x358]
lea rdx, [rbp + 0x368]
movss xmm2, dword [rbp + 0x35c]
addss xmm0, xmm3
movss xmm1, dword [rbp + 0x354]
subss xmm3, xmm8
addss xmm1, xmm2
mov r9d, eax
subss xmm2, xmm8
mov rcx, rbx
addss xmm0, xmm8
movss dword [rbp + 0x368], xmm3
addss xmm1, xmm8
movss dword [rbp + 0x36c], xmm2
movss dword [rbp + 0x360], xmm0
movss xmm0, dword [0x14012eb38]
movss dword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 4
movss dword [rsp + 0x20], xmm10
movss dword [rbp + 0x364], xmm1
call fcn.140023bf0
call fcn.14004adb0
lea rdx, [rbp + 0x160]
mov qword [rbp + 0x110], 0
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rcx, [rbp + 0xb50]
call fcn.14000e680
movss xmm0, dword [rax]
ucomiss xmm0, xmm7
jp 0x1400507b5
jne 0x1400507b5
lea rcx, [rbp + 0xb70]
call fcn.14000e680
movss xmm0, dword [rax + 4]
ucomiss xmm0, xmm7
jp 0x1400507b5
je 0x14005082c
lea rcx, [rbp + 0xb78]
call fcn.14000e680
movd xmm0, dword [rbp + 0x164]
lea rcx, [rbp + 0xb80]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [rax + 4]
cvttss2si ebx, xmm0
call fcn.14000e680
mov r9d, 0x320
mov dword [rsp + 0x28], r14d
mov r8d, ebx
mov rcx, rsi
mov dword [rsp + 0x20], 0x208
movd xmm0, dword [rbp + 0x160]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [rax]
cvttss2si edx, xmm0
call qword [sym.imp.USER32.dll_MoveWindow]
xor edx, edx
mov qword [rbp + 0x370], 0
lea rcx, [rbp + 0x370]
call fcn.14001b330
call fcn.14000e630
lea rcx, [rsp + 0x60]
mov r14, rax
call fcn.14004a530
mov rcx, rax
call fcn.140049d20
lea rcx, [0x1406db1e8]
mov rsi, rax
call fcn.14000d740
lea rcx, [rsp + 0x60]
mov edi, eax
call fcn.14004a350
mov rcx, rax
call fcn.140049d20
mov rdx, rax
movss dword [rsp + 0x20], xmm9
xor r9d, r9d
lea rcx, [rbp + 0xb88]
xor r8d, r8d
call fcn.140008b80
mov rbx, rax
call fcn.14000e6c0
subss xmm0, dword [rbx]
lea r8, [rbp + 0x398]
mov dword [rbp + 0x39c], 0x41400000
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0xb90]
mulss xmm0, xmm14
movss dword [rbp + 0x398], xmm0
call fcn.140049e50
mov rdx, rax
mov qword [rsp + 0x20], r13
mov r9, rsi
mov r8d, edi
mov rcx, r14
call fcn.140023eb0
call fcn.14000d570
lea rcx, [0x1406db1a8]
mov rbx, rax
call fcn.14000d740
lea r8, [rbp + 0x3a0]
mov dword [rbp + 0x3a0], 0x44480000
lea rdx, [rbp + 0x110]
mov dword [rbp + 0x3a4], 0x42340000
lea rcx, [rbp + 0xb98]
mov r9d, eax
call fcn.140049e50
lea r8, [rbp + 0x3a8]
mov qword [rbp + 0x3a8], 0
lea rdx, [rbp + 0x110]
mov r10, rax
lea rcx, [rbp + 0xb00]
call fcn.140049e50
mov rdx, rax
mov dword [rsp + 0x28], Ordinal_50
mov r8, r10
movss dword [rsp + 0x20], xmm11
mov rcx, rbx
call fcn.140023d00
call fcn.14000d570
lea rcx, [0x1406db1b8]
mov rbx, rax
call fcn.14000d740
lea r8, [rbp + 0x3b0]
mov dword [rbp + 0x3b0], 0x44480000
lea rdx, [rbp + 0x110]
mov dword [rbp + 0x3b4], 0x44020000
lea rcx, [rbp + 0xba0]
mov r9d, eax
call fcn.140049e50
lea r8, [rbp + 0x3b8]
mov dword [rbp + 0x3b8], 0
lea rdx, [rbp + 0x110]
mov dword [rbp + 0x3bc], 0x42340000
lea rcx, [rbp + 0xba8]
mov r10, rax
call fcn.140049e50
mov dword [rsp + 0x28], 0xc0
mov rdx, rax
movss dword [rsp + 0x20], xmm11
mov r8, r10
mov rcx, rbx
call fcn.140023d00
mov ecx, reloc.WLDAP32.dll_Ordinal_46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x14005697e
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x140050a16
call fcn.14004de70
lea rcx, [rbp + 0x3c0]
mov dword [rbp + 0x3c0], 0x43340000
mov dword [rbp + 0x3c4], 0x43f28000
call fcn.14001a990
lea rcx, [0x1406da958]
call fcn.14004da50
mov rcx, rax
call fcn.140037db0
lea rdx, [rbp + 0x3c8]
mov dword [rbp + 0x3c8], 0x40e00000
mov ecx, reloc.WS2_32.dll_ntohl
mov dword [rbp + 0x3cc], 0x40e00000
call fcn.140016b80
lea rcx, [rbp + 0x3d0]
mov dword [rbp + 0x3d0], 0x40e00000
mov dword [rbp + 0x3d4], 0x42540000
call fcn.14001a990
call fcn.140007d20
lea rcx, [rsp + 0x60]
mov dword [rbp + 0x3d8], 0x431d0000
mov dword [rbp + 0x3dc], 0x420c0000
call fcn.140049f00
mov rcx, rax
call fcn.140049b30
lea rcx, [rsp + 0x60]
mov rbx, rax
call fcn.140049f70
mov rcx, rax
call fcn.140049b10
cmp dword [0x1407110e8], 0
lea r9, [rbp + 0x3d8]
mov r8, rbx
mov dword [rsp + 0x20], r13d
sete cl
mov rdx, rax
call fcn.1400376b0
test al, al
je 0x140050afb
mov dword [0x1407110e8], r13d
lea rcx, [rsp + 0x60]
mov dword [rbp + 0x3e0], 0x431d0000
mov dword [rbp + 0x3e4], 0x420c0000
call fcn.14004a180
mov rcx, rax
call fcn.140049bf0
lea rcx, [rsp + 0x60]
mov rbx, rax
call fcn.14004a120
mov rcx, rax
call fcn.140049af0
cmp dword [0x1407110e8], 1
lea r9, [rbp + 0x3e0]
mov r8, rbx
mov dword [rsp + 0x20], r13d
sete cl
mov rdx, rax
call fcn.1400376b0
mov r14d, 1
test al, al
je 0x140050b68
mov dword [0x1407110e8], r14d
call fcn.14000bd20
mov ecx, r14d
call fcn.140016580
mov eax, dword [0x1407110f4]
cmp dword [0x1407110e8], eax
jne 0x140050b89
movaps xmm6, xmm8
jmp 0x140050b8d
movaps xmm6, xmm9
call fcn.14000dce0
movaps xmm2, xmm8
movaps xmm1, xmm7
movss xmm0, dword [rax + 0x10]
mulss xmm0, xmm12
mulss xmm0, xmm6
addss xmm0, dword [0x1407110ec]
call fcn.140046fb0
mov eax, dword [0x1407110f4]
cmp dword [0x1407110e8], eax
movss dword [0x1407110ec], xmm0
jne 0x140050bd0
movaps xmm6, xmm8
jmp 0x140050bd4
movaps xmm6, xmm9
call fcn.14000dce0
movaps xmm0, xmm13
mov rbx, rax
call sub.api_ms_win_crt_math_l1_1_0.dll_roundf
mulss xmm0, dword [rbx + 0x10]
movaps xmm2, xmm8
movaps xmm1, xmm7
mulss xmm0, xmm6
addss xmm0, dword [0x1407110f0]
call fcn.140046fb0
movss xmm1, dword [0x1407110ec]
ucomiss xmm1, xmm7
movss dword [0x1407110f0], xmm0
jp 0x140050c2c
jne 0x140050c2c
ucomiss xmm0, xmm7
jp 0x140050c2c
jne 0x140050c2c
mov eax, dword [0x1407110e8]
mov dword [0x1407110f4], eax
lea rcx, [rbp + 0x3e8]
mov dword [rbp + 0x3e8], 0x43340000
mov dword [rbp + 0x3ec], 0x425c0000
call fcn.14001a990
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x140050c5a
call fcn.14004de70
movss xmm1, dword [0x1407110ec]
xor ecx, ecx
mulss xmm1, dword [r15]
call fcn.140016c60
mov eax, dword [0x1407110f4]
cmp eax, 1
jne 0x140050e1b
call fcn.140007d20
lea rcx, [rsp + 0x60]
mov dword [rbp + 0x430], 0x43b18000
mov dword [rbp + 0x434], 0x43b18000
call fcn.14004a3d0
mov rcx, rax
call fcn.140049e00
xor r9d, r9d
lea rdx, [rbp + 0x430]
mov r8b, 1
mov rcx, rax
call fcn.140007760
lea rcx, [rsp + 0x60]
call fcn.140049e80
mov rcx, rax
call fcn.140049ce0
xor r9d, r9d
mov qword [rsp + 0x28], r13
mov rcx, rax
mov qword [rsp + 0x20], r13
lea rdx, [0x140711130]
lea r8d, [r9 + 0x23]
call fcn.1400318c0
lea rcx, [rsp + 0x60]
call fcn.14004a4c0
mov rcx, rax
call fcn.140049db0
xor r9d, r9d
mov qword [rsp + 0x28], r13
mov rcx, rax
mov qword [rsp + 0x20], r13
lea rdx, [0x140711170]
lea r8d, [r9 + 0x23]
call fcn.1400318c0
lea rcx, [rsp + 0x60]
call fcn.14004a040
mov rcx, rax
call fcn.140049bc0
xor r9d, r9d
mov qword [rsp + 0x28], r13
mov rcx, rax
mov qword [rsp + 0x20], r13
lea rdx, [0x1407111b0]
lea r8d, [r9 + 0x23]
call fcn.1400318c0
lea rcx, [rsp + 0x60]
mov dword [rbp + 0x438], 0x43480000
mov dword [rbp + 0x43c], 0x420c0000
call fcn.14004a0b0
mov rcx, rax
call fcn.140049c30
lea rdx, [rbp + 0x438]
mov rcx, rax
call fcn.14002fe90
test al, al
je 0x140050e0b
lea rdx, [0x1407111b0]
lea rcx, [rbp + 0xf80]
call fcn.140048360
lea rdx, [0x140711170]
mov rdi, rax
lea rcx, [rbp + 0xfa0]
call fcn.140048360
lea rdx, [0x140711130]
mov rbx, rax
lea rcx, [rbp + 0x1000]
call fcn.140048360
mov r9, rdi
lea rcx, [0x140711380]
mov r8, rbx
mov rdx, rax
call fcn.1400cf290
cmp byte [0x140711598], 0
lea rcx, [0x1407115a0]
je 0x140050df7
mov byte [0x140710fcc], 1
call fcn.14004da50
mov rdx, rax
lea rcx, [0x1406da958]
call fcn.140049ad0
call fcn.14000b520
call fcn.14000bd20
mov eax, dword [0x1407110f4]
test eax, eax
jne 0x1400511dc
call fcn.140007d20
lea rcx, [rsp + 0x60]
mov dword [rbp + 0x440], 0x43b18000
mov dword [rbp + 0x444], 0x43b18000
call fcn.14004a270
mov rcx, rax
call fcn.140049b90
xor r9d, r9d
lea rdx, [rbp + 0x440]
mov r8b, 1
mov rcx, rax
call fcn.140007760
lea rcx, [rsp + 0x60]
call fcn.14004a1f0
mov rcx, rax
call fcn.140049ca0
xor r9d, r9d
mov qword [rsp + 0x28], r13
mov rcx, rax
mov qword [rsp + 0x20], r13
lea rdx, [0x140711130]
lea r8d, [r9 + 0x28]
call fcn.1400318c0
lea rcx, [rsp + 0x60]
call fcn.14004a450
mov rcx, rax
call fcn.140049d60
xor r9d, r9d
mov qword [rsp + 0x28], r13
mov rcx, rax
mov qword [rsp + 0x20], r13
lea rdx, [0x140711170]
lea r8d, [r9 + 0x28]
call fcn.1400318c0
lea rcx, [rsp + 0x60]
mov dword [rbp + 0x210], 0x43480000
mov dword [rbp + 0x214], 0x42200000
call fcn.14004a2e0
mov rcx, rax
call fcn.140049b60
lea rdx, [rbp + 0x210]
mov rcx, rax
call fcn.14002fe90
test al, al
je 0x1400511d2
lea rdx, [0x140711170]
lea rcx, [rbp + 0xfc0]
call fcn.140048360
lea rdx, [0x140711130]
mov rbx, rax
lea rcx, [rbp + 0xfe0]
call fcn.140048360
mov r8, rbx
lea rcx, [0x140711380]
mov rdx, rax
call fcn.1400cd150
cmp byte [0x140711598], 0
je 0x1400511d2
lea rdx, [0x140711578]
lea rcx, [rbp + 0xdc8]
call fcn.140048240
lea rcx, [rbp + 0xdc8]
call fcn.14004da50
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
movsxd rcx, eax
mov qword [rbp + 0x5c8], rcx
lea rcx, [rbp + 0x5c8]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64]
lea r8, str.Expiry:__d__m__Y
mov edx, reloc.WS2_32.dll_sendto
mov r9, rax
lea rcx, [rbp + 0xd50]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea r8, [0x1407114c0]
mov rbx, rax
lea rdx, str.Usuario:
lea rcx, [rbp + 0xd88]
call fcn.140046e60
lea rdx, [0x140711578]
lea rcx, [rbp + 0xd68]
call fcn.140048240
lea rcx, [rbp + 0xd68]
call fcn.14004da50
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ecx, eax
mov eax, 0xc22e4507
imul ecx
add edx, ecx
lea rcx, [rbp + 0xe98]
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add edx, eax
call fcn.14004f440
mov rcx, rax
call fcn.14004da50
mov rdx, rax
lea rcx, [rbp + 0x640]
call fcn.140048360
lea rcx, [rbp + 0xe98]
call fcn.14002fd20
lea r8, [rbp + 0x640]
lea rdx, str.Dias:
lea rcx, [rbp + 0xeb8]
call fcn.140046e60
lea rdx, str.Status:_Undetected
lea rcx, [rbp + 0xe28]
call fcn.140048360
lea rdx, [rbp + 0xd50]
lea rcx, [rbp + 0xde8]
call fcn.140048360
lea rcx, [rbp + 0xe28]
call fcn.14004da50
mov rdx, rax
lea rcx, [0x1406da958]
call fcn.140049ad0
xorps xmm0, xmm0
lea rdx, [rbp + 0xe48]
xor r9d, r9d
lea rcx, str.1186272039133261936
mov r8d, r14d
movups xmmword [rbp + 0xe48], xmm0
movups xmmword [rbp + 0xe58], xmm0
movups xmmword [rbp + 0xe68], xmm0
call fcn.140040a00
xorps xmm0, xmm0
movups xmmword [rbp + 0xc20], xmm0
movups xmmword [rbp + 0xc30], xmm0
movups xmmword [rbp + 0xc40], xmm0
movups xmmword [rbp + 0xc50], xmm0
movups xmmword [rbp + 0xc60], xmm0
movups xmmword [rbp + 0xc70], xmm0
movups xmmword [rbp + 0xc80], xmm0
movups xmmword [rbp + 0xc90], xmm0
movups xmmword [rbp + 0xca0], xmm0
lea rcx, [rbp + 0xd88]
call fcn.14004da50
lea rcx, [rbp + 0xde8]
mov qword [rbp + 0xc20], rax
call fcn.14004da50
mov qword [rbp + 0xc28], rax
lea rcx, [rbp + 0xc20]
lea rax, str.trilder_x_1
mov qword [rbp + 0xc30], rbx
mov qword [rbp + 0xc40], rax
lea rax, str.Cartel_X_Ultimate
mov qword [rbp + 0xc48], rax
lea rax, str.82ec5c39_9f99_4f1a_b681_d274c05a1134
mov qword [rbp + 0xc50], rax
lea rax, str.Developed_by_Swatzz
mov qword [rbp + 0xc58], rax
call fcn.140040c70
lea rcx, [rbp + 0xde8]
mov byte [0x140710fcc], 1
call fcn.14002fd20
lea rcx, [rbp + 0xe28]
call fcn.14002fd20
lea rcx, [rbp + 0xeb8]
call fcn.14002fd20
lea rcx, [rbp + 0x640]
call fcn.14002fd20
lea rcx, [rbp + 0xd68]
call fcn.14002fd20
lea rcx, [rbp + 0xd88]
call fcn.14002fd20
lea rcx, [rbp + 0xdc8]
call fcn.14002fd20
call fcn.14000b520
call fcn.14000bd20
mov ecx, r14d
call fcn.140016580
call fcn.14000afe0
movzx eax, byte [0x140710fcc]
mov r15d, 0xa
cmp al, 1
jne 0x140056801
mov ecx, dword [0x14071100c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400513c1
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x14005124a
lea rdx, [0x14004bd10]
lea rcx, [rbp + 0xbf0]
call fcn.140046910
mov rcx, rax
call fcn.14004de30
cmp dword [rbp + 0xbf8], 0
je 0x1400513c1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
mov rax, qword [0x140711270]
mov esi, r13d
mov rdx, qword [0x140711268]
sub rax, rdx
sar rax, 3
cmp byte [0x1407110b2], 0
je 0x140051318
mov byte [0x1407110b2], 0
mov dword [rbp - 0x28], 0xc47a0000
mov dword [rbp - 0x24], 0x43f3f3f
mov dword [rbp - 0x20], 0xe92d4ff0
mov dword [rbp - 0x1c], 0xe28db01c
test rax, rax
je 0x1400512e7
mov rdi, r13
nop word [rax + rax]
mov rbx, qword [rdx + rdi]
call fcn.140057170
mov r9d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], r13
lea r8, [rbp - 0x28]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140711270]
lea rdi, [rdi + 8]
mov rdx, qword [0x140711268]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x1400512a0
lea r9, str.Teleport_Amazon_Enable
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0x11880]
call fcn.140048520
lea rcx, [rbp + 0x11880]
call fcn.14004b8b0
mov ecx, 0x320
jmp 0x1400513b6
mov byte [0x1407110b2], 1
mov dword [rbp - 0x18], 0x447a0000
mov dword [rbp - 0x14], 0x43f3f3f
mov dword [rbp - 0x10], 0xe92d4ff0
mov dword [rbp - 0xc], 0xe28db01c
test rax, rax
je 0x14005138a
mov rdi, r13
mov rbx, qword [rdx + rdi]
call fcn.140057170
mov r9d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], r13
lea r8, [rbp - 0x18]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140711270]
lea rdi, [rdi + 8]
mov rdx, qword [0x140711268]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140051343
lea r9, str.Teleport_Amazon_Disable
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0x13890]
call fcn.140048520
lea rcx, [rbp + 0x13890]
call fcn.14004b8b0
mov ecx, 0x190
mov edx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, dword [0x140711010]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140051651
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x14005140b
lea rdx, [0x14004e6c0]
lea rcx, [rbp + 0xc00]
call fcn.140046910
mov rcx, rax
call fcn.14004de30
cmp dword [rbp + 0xc08], 0
jne 0x140051243
jmp 0x140051651
mov rax, qword [0x140711330]
mov esi, r13d
mov rdx, qword [0x140711328]
sub rax, rdx
sar rax, 3
cmp byte [0x1407110b4], 0
je 0x140051538
mov byte [0x1407110b4], 0
mov dword [rbp + 0x70], 0
mov qword [rbp + 0x74], 0x40c38e22
mov dword [rbp + 0x7c], 0
mov dword [rbp + 0x80], 0xbf800000
mov dword [rbp + 0x84], 0
mov dword [rbp + 0x88], 0xbf800000
mov qword [rbp + 0x8c], 0
mov qword [rbp + 0x94], 0x3f800000
mov qword [rbp + 0x9c], 0
mov dword [rbp + 0xa4], 0
mov qword [rbp + 0xa8], 0x3f800000
mov dword [rbp + 0xb0], 0
mov dword [rbp + 0xb4], 0xbf800000
test rax, rax
je 0x140051507
mov rdi, r13
nop dword [rax]
mov rbx, qword [rdx + rdi]
call fcn.140057170
mov r9d, 0x48
mov qword [rsp + 0x20], r13
lea r8, [rbp + 0x70]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140711330]
lea rdi, [rdi + 8]
mov rdx, qword [0x140711328]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x1400514c0
lea r9, str.Dwarf_Camera_Enabled
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0x158a0]
call fcn.140048520
lea rcx, [rbp + 0x158a0]
call fcn.14004b8b0
mov ecx, 0x320
jmp 0x140051646
mov byte [0x1407110b4], 1
mov dword [rbp + 0xc0], 0
mov qword [rbp + 0xc4], 0x3f800000
mov dword [rbp + 0xcc], 0
mov dword [rbp + 0xd0], 0xbf800000
mov dword [rbp + 0xd4], 0
mov dword [rbp + 0xd8], 0xbf800000
mov qword [rbp + 0xdc], 0
mov qword [rbp + 0xe4], 0x3f800000
mov qword [rbp + 0xec], 0
mov dword [rbp + 0xf4], 0
mov qword [rbp + 0xf8], 0x3f800000
mov dword [rbp + 0x100], 0
mov dword [rbp + 0x104], 0xbf800000
test rax, rax
je 0x14005161a
mov rdi, r13
nop
mov rbx, qword [rdx + rdi]
call fcn.140057170
mov r9d, 0x48
mov qword [rsp + 0x20], r13
lea r8, [rbp + 0xc0]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140711330]
lea rdi, [rdi + 8]
mov rdx, qword [0x140711328]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x1400515d0
lea r9, str.Dwarf_Camera_Disabled
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0x178b0]
call fcn.140048520
lea rcx, [rbp + 0x178b0]
call fcn.14004b8b0
mov ecx, 0x190
mov edx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, dword [0x140711014]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400517d8
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x14005169b
lea rdx, [0x14004cd50]
lea rcx, [rbp + 0xc10]
call fcn.140046910
mov rcx, rax
call fcn.14004de30
cmp dword [rbp + 0xc18], 0
jne 0x140051243
jmp 0x1400517d8
mov rax, qword [0x140711640]
mov esi, r13d
mov rdx, qword [0x140711638]
sub rax, rdx
sar rax, 3
cmp byte [0x140711118], 0
je 0x140051748
mov byte [0x140711118], 0
mov dword [rbp - 0x78], 0x42520000
mov dword [rbp - 0x74], 0x3fb33333
mov dword [rbp - 0x70], 0x3ff33333
test rax, rax
je 0x14005172b
mov rdi, r13
mov rbx, qword [rdx + rdi]
call fcn.140057170
mov r9d, recv
mov qword [rsp + 0x20], r13
lea r8, [rbp - 0x78]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140711640]
lea rdi, [rdi + 8]
mov rdx, qword [0x140711638]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x1400516e4
lea rdx, str.Speed_Run_X99_Enabled
lea rcx, [0x1406da958]
call fcn.140049ad0
mov ecx, 0x320
jmp 0x1400517cd
mov byte [0x140711118], 1
mov dword [rsp + 0x78], 0x408e0000
mov dword [rsp + 0x7c], 0x3fb33333
mov word [rbp - 0x80], 0x3333
test rax, rax
je 0x1400517b5
mov rdi, r13
nop dword [rax]
mov rbx, qword [rdx + rdi]
call fcn.140057170
mov r9, r15
mov qword [rsp + 0x20], r13
lea r8, [rsp + 0x78]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140711640]
lea rdi, [rdi + 8]
mov rdx, qword [0x140711638]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140051770
lea rdx, str.Speed_X99_Teleport_Enabled
lea rcx, [0x1406da958]
call fcn.140049ad0
mov ecx, 0x190
mov edx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, dword [0x14071101c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400519ce
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x140051822
lea rdx, [0x14004bdb0]
lea rcx, [rbp + 0xad0]
call fcn.140046910
mov rcx, rax
call fcn.14004de30
cmp dword [rbp + 0xad8], 0
jne 0x140051243
jmp 0x1400519ce
mov rax, qword [0x140711318]
mov esi, r13d
mov rdx, qword [0x140711310]
sub rax, rdx
sar rax, 3
cmp byte [0x14071111c], 0
je 0x140051908
mov byte [0x14071111c], 0
mov dword [rbp - 8], 0xca0000de
mov dword [rbp - 4], 0xea000000
mov dword [rbp], 0xb58637bd
mov dword [rbp + 4], 0xee238a85
mov dword [rbp + 8], 0xee229a87
mov dword [rbp + 0xc], 0xee27ea83
mov dword [rbp + 0x10], 0xee398a08
mov dword [rbp + 0x14], 0xed9c9a01
test rax, rax
je 0x1400518d7
mov rdi, r13
nop
mov rbx, qword [rdx + rdi]
call fcn.140057170
mov r9d, reloc.WLDAP32.dll_Ordinal_32
mov qword [rsp + 0x20], r13
lea r8, [rbp - 8]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140711318]
lea rdi, [rdi + 8]
mov rdx, qword [0x140711310]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140051890
lea r9, str.WALLHACK_ENABLE
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0x198c0]
call fcn.140048520
lea rcx, [rbp + 0x198c0]
call fcn.14004b8b0
mov ecx, 0x320
jmp 0x1400519c3
mov byte [0x14071111c], 1
mov dword [rbp + 0x18], 0xca0000de
mov dword [rbp + 0x1c], 0xea000000
mov dword [rbp + 0x20], 0x358637bd
mov dword [rbp + 0x24], 0xee238a85
mov dword [rbp + 0x28], 0xee229a87
mov dword [rbp + 0x2c], 0xee27ea83
mov dword [rbp + 0x30], 0xee398a08
mov dword [rbp + 0x34], 0xed9c9a01
test rax, rax
je 0x140051997
mov rdi, r13
nop
mov rbx, qword [rdx + rdi]
call fcn.140057170
mov r9d, reloc.WLDAP32.dll_Ordinal_32
mov qword [rsp + 0x20], r13
lea r8, [rbp + 0x18]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140711318]
lea rdi, [rdi + 8]
mov rdx, qword [0x140711310]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140051950
lea r9, str.WALLHACK_DISABLE
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0x1b8d0]
call fcn.140048520
lea rcx, [rbp + 0x1b8d0]
call fcn.14004b8b0
mov ecx, 0x190
mov edx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, dword [0x140711020]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140051fc1
xorps xmm0, xmm0
mov qword [rbp + 0x750], r13
mov r8d, __WSAFDIsSet
mov qword [rbp + 0x758], r13
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock0__dirin_actionblock_profileany_program_C:Program_FilesBlueStacks_nxtHD_Player.exe_
lea rcx, [rbp + 0x740]
movups xmmword [rbp + 0x740], xmm0
call fcn.14002f3c0
lea rcx, [rbp + 0x740]
call fcn.14004b2e0
lea rcx, [rbp + 0x740]
call fcn.14002fd20
xorps xmm0, xmm0
mov qword [rbp + 0x770], r13
mov r8d, __WSAFDIsSet
mov qword [rbp + 0x778], r13
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock0__dirout_actionblock_profileany_program_C:Program_FilesBlueStacks_nxtHD_Player.exe_
lea rcx, [rbp + 0x760]
movups xmmword [rbp + 0x760], xmm0
call fcn.14002f3c0
lea rcx, [rbp + 0x760]
call fcn.14004b2e0
lea rcx, [rbp + 0x760]
call fcn.14002fd20
xorps xmm0, xmm0
mov qword [rbp + 0x670], r13
mov r8d, 0x91
mov qword [rbp + 0x678], r13
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock1__dirin_actionblock_profileany_program_C:ProgramDataBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x660]
movups xmmword [rbp + 0x660], xmm0
call fcn.14002f3c0
lea rcx, [rbp + 0x660]
call fcn.14004b2e0
lea rcx, [rbp + 0x660]
call fcn.14002fd20
xorps xmm0, xmm0
mov qword [rbp + 0x690], r13
mov r8d, __WSAFDIsSet
mov qword [rbp + 0x698], r13
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock1__dirout_actionblock_profileany_program_C:ProgramDataBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x680]
movups xmmword [rbp + 0x680], xmm0
call fcn.14002f3c0
lea rcx, [rbp + 0x680]
call fcn.14004b2e0
lea rcx, [rbp + 0x680]
call fcn.14002fd20
xorps xmm0, xmm0
mov qword [rbp + 0x6b0], r13
mov r8d, __WSAFDIsSet
mov qword [rbp + 0x6b8], r13
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock4__dirin_actionblock_profileany_program_C:Program_FilesBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x6a0]
movups xmmword [rbp + 0x6a0], xmm0
call fcn.14002f3c0
lea rcx, [rbp + 0x6a0]
call fcn.14004b2e0
lea rcx, [rbp + 0x6a0]
call fcn.14002fd20
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock4__dirout_actionblock_profileany_program_C:Program_FilesBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0xda8]
call fcn.140048360
lea rcx, [rbp + 0xda8]
call fcn.14004b2e0
lea rcx, [rbp + 0xda8]
call fcn.14002fd20
xorps xmm0, xmm0
mov qword [rbp + 0x538], r13
mov r8d, Ordinal_143
mov qword [rbp + 0x540], r13
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock2__dirin_actionblock_profileany_program_C:Program_FilesBlueStacksHD_Player.exe_
lea rcx, [rbp + 0x528]
movups xmmword [rbp + 0x528], xmm0
call fcn.14002f3c0
lea rcx, [rbp + 0x528]
call fcn.14004b2e0
mov r8, qword [rbp + 0x540]
cmp r8, 0xf
jbe 0x140051bd7
mov rdx, qword [rbp + 0x528]
lea rcx, [rbp + 0x528]
call fcn.14004d100
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock2__dirout_actionblock_profileany_program_C:Program_FilesBlueStacksHD_Player.exe_
mov qword [rbp + 0x538], r13
lea rcx, [rbp + 0xe08]
mov qword [rbp + 0x540], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x528], 0
call fcn.140048360
lea rcx, [rbp + 0xe08]
call fcn.14004b2e0
lea rcx, [rbp + 0xe08]
call fcn.14002fd20
xorps xmm0, xmm0
mov qword [rbp + 0x6d0], r13
mov r8d, __WSAFDIsSet
mov qword [rbp + 0x6d8], r13
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock3__dirin_actionblock_profileany_program_C:Program_FilesBlueStacks_msi2HD_Player.exe_
lea rcx, [rbp + 0x6c0]
movups xmmword [rbp + 0x6c0], xmm0
call fcn.14002f3c0
lea rcx, [rbp + 0x6c0]
call fcn.14004b2e0
lea rcx, [rbp + 0x6c0]
call fcn.14002fd20
xorps xmm0, xmm0
mov qword [rbp + 0x6f0], r13
mov r8d, __WSAFDIsSet
mov qword [rbp + 0x6f8], r13
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock3__dirout_actionblock_profileany_program_C:Program_FilesBlueStacks_msi2HD_Player.exe_
lea rcx, [rbp + 0x6e0]
movups xmmword [rbp + 0x6e0], xmm0
call fcn.14002f3c0
lea rcx, [rbp + 0x6e0]
call fcn.14004b2e0
lea rcx, [rbp + 0x6e0]
call fcn.14002fd20
mov edx, 0x190
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x2ee
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
mov qword [rbp + 0x880], r13
mov r8d, 0x67
mov qword [rbp + 0x888], r13
lea rdx, str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:Program_FilesBlueStacks_nxtHD_Player.exe_
lea rcx, [rbp + 0x870]
movups xmmword [rbp + 0x870], xmm0
call fcn.14002f3c0
xorps xmm0, xmm0
mov qword [rbp + 0x8a0], r13
mov r8d, 0x66
mov qword [rbp + 0x8a8], r13
lea rdx, str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:ProgramDataBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x890]
movups xmmword [rbp + 0x890], xmm0
call fcn.14002f3c0
xorps xmm0, xmm0
mov qword [rbp + 0x8c0], r13
mov r8d, 0x76
mov qword [rbp + 0x8c8], r13
lea rdx, str.netsh_advfirewall_firewall_delete_rule_name_TemporaryBlock4__program_C:Program_FilesBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x8b0]
movups xmmword [rbp + 0x8b0], xmm0
call fcn.14002f3c0
xorps xmm0, xmm0
mov qword [rbp + 0x8e0], r13
mov r8d, 0x76
mov qword [rbp + 0x8e8], r13
lea rdx, str.netsh_advfirewall_firewall_delete_rule_name_TemporaryBlock4__program_C:Program_FilesBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x8d0]
movups xmmword [rbp + 0x8d0], xmm0
call fcn.14002f3c0
xorps xmm0, xmm0
mov qword [rbp + 0x900], r13
mov r8d, 0x63
mov qword [rbp + 0x908], r13
lea rdx, str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:Program_FilesBlueStacksHD_Player.exe_
lea rcx, [rbp + 0x8f0]
movups xmmword [rbp + 0x8f0], xmm0
call fcn.14002f3c0
xorps xmm0, xmm0
movups xmmword [rbp + 0x910], xmm0
mov r8d, 0x68
mov qword [rbp + 0x920], r13
lea rdx, str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:Program_FilesBlueStacks_msi2HD_Player.exe_
mov qword [rbp + 0x928], r13
lea rcx, [rbp + 0x910]
call fcn.14002f3c0
lea rsi, [rbp + 0x870]
xorps xmm0, xmm0
lea rax, [0x14018ffa0]
movups xmmword [rbp + 0x9f0], xmm0
movabs rcx, 0x7fffffffffffffff
mov dword [rbp + 0x9f0], reloc.WS2_32.dll_WSASetLastError
movups xmmword [rbp + 0xa00], xmm0
mov qword [rbp + 0xa08], rax
mov rax, rcx
mov dword [rbp + 0x9f4], 0x40
movups xmmword [rbp + 0xa10], xmm0
movups xmmword [rbp + 0xa20], xmm0
movups xmmword [rbp + 0xa30], xmm0
movups xmmword [rbp + 0xa40], xmm0
movups xmmword [rbp + 0xa50], xmm0
mov r15, qword [rsi + 0x10]
sub rax, r15
cmp rax, 3
jb 0x1400569a5
cmp qword [rsi + 0x18], 0xf
mov r12, rsi
jbe 0x140051e76
mov r12, qword [rsi]
lea r14, [r15 + 3]
mov qword [rbp + 0x558], r13
mov ebx, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x560], r13
lea rdi, [rbp + 0x548]
movups xmmword [rbp + 0x548], xmm0
cmp r14, rbx
jbe 0x140051ed1
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x140051eb1
mov rbx, rcx
jmp 0x140051ebe
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
call fcn.140046fd0
mov rdi, rax
mov qword [rbp + 0x548], rax
mov ecx, dword [0x14018ffa8]
mov r8, r15
mov qword [rbp + 0x558], r14
mov rdx, r12
mov qword [rbp + 0x560], rbx
mov word [rdi], cx
movzx ecx, byte [reloc.WLDAP32.dll_Ordinal_32]
mov byte [rdi + 2], cl
lea rcx, [rdi + 3]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
lea rax, [rbp + 0x548]
cmp qword [rbp + 0x560], 0xf
lea rcx, [rbp + 0x548]
cmova rax, qword [rbp + 0x548]
mov qword [rbp + 0xa10], rax
call fcn.14002fd20
lea rcx, [rbp + 0x9f0]
mov dword [rbp + 0xa20], r13d
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x140051f67
mov rcx, qword [rbp + 0xa58]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0xa58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsi, 0x20
lea rax, [rbp + 0x930]
cmp rsi, rax
jne 0x140051df5
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea r9, [fcn.14002fd20]
lea rcx, [rbp + 0x870]
lea r8d, [rdx - 0x1a]
call fcn.140121ad8
movabs r12, 0x7fffffffffffffff
mov r14, qword [0x1407114d0]
mov rax, r12
sub rax, r14
cmp rax, 0xa
jb 0x1400569a5
cmp qword [0x1407114d8], 0xf
lea r15, [0x1407114c0]
lea rsi, [r14 + 0xa]
mov qword [rbp + 0x400], r13
cmova r15, qword [0x1407114c0]
lea rdi, [rbp + 0x3f0]
mov ebx, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x408], r13
xorps xmm0, xmm0
movups xmmword [rbp + 0x3f0], xmm0
cmp rsi, rbx
jbe 0x14005204d
mov rbx, rsi
or rbx, 0xf
cmp rbx, r12
jbe 0x14005202d
mov rbx, r12
jmp 0x14005203a
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
call fcn.140046fd0
mov rdi, rax
mov qword [rbp + 0x3f0], rax
movsd xmm0, qword [str.Username:]
mov r8, r14
mov qword [rbp + 0x400], rsi
mov rdx, r15
mov qword [rbp + 0x408], rbx
movsd qword [rdi], xmm0
movzx ecx, word [0x140191278]
mov word [rdi + 8], cx
lea rcx, [rdi + 0xa]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
lea rcx, [rbp + 0x3f0]
cmp qword [rbp + 0x408], 0xf
lea rdx, [rbp + 0x5d0]
mov rbx, qword [rbp + 0x400]
mov edi, 0xa
cmova rcx, qword [rbp + 0x3f0]
xorps xmm0, xmm0
movzx eax, word [0x140191278]
cmp rdi, rbx
movups xmmword [rbp + 0x5d0], xmm0
mov r8, rbx
mov qword [rbp + 0x5e0], rdi
movsd xmm0, qword [str.Username:]
cmovb r8, rdi
mov qword [rbp + 0x5e8], reloc.WS2_32.dll_ntohs
movsd qword [rbp + 0x5d0], xmm0
mov word [rbp + 0x5d8], ax
mov byte [rbp + 0x5da], 0
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14005210e
cmp rbx, rdi
jb 0x14005210e
jbe 0x1400568ce
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x1401297f4]
call fcn.140046ad0
lea rdx, [0x140048190]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, Ordinal_50
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ebx, ax
mov ecx, reloc.WLDAP32.dll_Ordinal_50
shr ebx, 0xf
and bl, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx edi, ax
mov ecx, 0x33
shr edi, 0xf
and dil, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx esi, ax
mov ecx, reloc.WS2_32.dll_WSASetLastError
shr esi, 0xf
and sil, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx r14d, ax
mov ecx, WSAStartup
shr r14d, 0xf
and r14b, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx r15d, ax
mov ecx, WSAStartup
shr r15d, 0xf
and r15b, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx r12d, ax
mov ecx, reloc.WS2_32.dll_WSAStartup
shr r12d, 0xf
and r12b, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx r13d, ax
mov ecx, 0x51
shr r13d, 0xf
and r13b, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
mov ecx, 0x45
and al, 1
mov dword [rsp + 0x68], eax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [0x14071120c]
movzx edx, ax
shr edx, 0xf
and dl, 1
cmp ecx, 1
jne 0x14005222a
test bl, bl
je 0x140052394
cmp byte [0x140710ff3], 0
mov eax, dword [rsp + 0x68]
jne 0x140052398
cmp byte [0x140710fe9], 0
sete byte [0x140710fe9]
jmp 0x140052398
cmp ecx, 2
jne 0x14005225c
test dil, dil
je 0x140052394
cmp byte [0x140710ff4], 0
mov eax, dword [rsp + 0x68]
jne 0x140052398
cmp byte [0x140710fe9], 0
sete byte [0x140710fe9]
jmp 0x140052398
cmp ecx, 3
jne 0x14005228e
test sil, sil
je 0x140052394
cmp byte [0x140710ff5], 0
mov eax, dword [rsp + 0x68]
jne 0x140052398
cmp byte [0x140710fe9], 0
sete byte [0x140710fe9]
jmp 0x140052398
cmp ecx, 4
jne 0x1400522c0
test r14b, r14b
je 0x140052394
cmp byte [0x140710ff6], 0
mov eax, dword [rsp + 0x68]
jne 0x140052398
cmp byte [0x140710fe9], 0
sete byte [0x140710fe9]
jmp 0x140052398
cmp ecx, 5
jne 0x1400522f2
test r15b, r15b
je 0x140052394
cmp byte [0x140710ff7], 0
mov eax, dword [rsp + 0x68]
jne 0x140052398
cmp byte [0x140710fe9], 0
sete byte [0x140710fe9]
jmp 0x140052398
cmp ecx, 6
jne 0x140052321
test r12b, r12b
je 0x140052394
cmp byte [0x140710ff8], 0
mov eax, dword [rsp + 0x68]
jne 0x140052398
cmp byte [0x140710fe9], 0
sete byte [0x140710fe9]
jmp 0x140052398
cmp ecx, 7
jne 0x140052348
test r13b, r13b
je 0x140052394
cmp byte [0x140710ff9], 0
mov eax, dword [rsp + 0x68]
jne 0x140052398
cmp byte [0x140710fe9], 0
sete byte [0x140710fe9]
jmp 0x140052398
cmp ecx, 8
jne 0x14005236e
mov eax, dword [rsp + 0x68]
test al, al
je 0x140052398
cmp byte [0x140710ffa], 0
jne 0x140052398
cmp byte [0x140710fe9], 0
sete byte [0x140710fe9]
jmp 0x140052398
cmp ecx, 9
jne 0x140052394
test dl, dl
je 0x140052394
cmp byte [0x140710ffb], 0
mov eax, dword [rsp + 0x68]
jne 0x140052398
cmp byte [0x140710fe9], 0
sete byte [0x140710fe9]
jmp 0x140052398
mov eax, dword [rsp + 0x68]
mov byte [0x140710ff3], bl
mov byte [0x140710ff4], dil
mov byte [0x140710ff5], sil
mov byte [0x140710ff6], r14b
mov byte [0x140710ff7], r15b
mov byte [0x140710ff8], r12b
mov byte [0x140710ff9], r13b
mov byte [0x140710ffa], al
mov byte [0x140710ffb], dl
call fcn.14000e3d0
xor r15d, r15d
mov qword [rsp + 0x68], rax
xor edx, edx
lea rcx, [rbp + 0x218]
mov dword [rax + 0x10], 0x41200000
mov dword [rax + 0x2c], 0x41200000
mov dword [rax + 8], r15d
mov dword [rax + 0xc], 0x41f00000
mov dword [rax + 0x14], r15d
mov dword [rax + 0x44], 0x40800000
mov qword [rax + 0x4c], r15
mov dword [rax + 0x74], 0x40c00000
mov qword [rax + 0x34], 0x41000000
mov dword [rbp + 0x218], 0x44480000
mov dword [rbp + 0x21c], 0x44020000
call fcn.14001b000
mov r12d, dword [0x140711920]
mov r13, qword gs:[0x58]
mov ecx, 0x134
mov edx, ecx
mov r8d, pe_nt_image_headers64
mov rax, qword [r13 + r12*8]
mov ebx, r8d
mov ecx, dword [rcx + rax]
test cl, 1
jne 0x140052492
or ecx, 1
mov dword [rax + r8 + 6], 0x1cf0129
mov dword [rdx + rax], ecx
lea rcx, [0x140125db0]
mov dword [rax + r8], 0xd56b468c
mov word [rax + r8 + 4], 0xa1b4
call fcn.140122254
mov rcx, qword [r13 + r12*8]
add rcx, rbx
cmp byte [rcx + 9], r15b
je 0x1400524c7
xor byte [rcx], 0xcf
xor byte [rcx + 1], 0x27
xor byte [rcx + 2], 0x19
xor byte [rcx + 3], 0xa1
xor byte [rcx + 4], 0xd1
xor byte [rcx + 5], 0xcd
xor byte [rcx + 6], 9
xor byte [rcx + 7], 0x59
xor byte [rcx + 8], 0xcf
mov byte [rcx + 9], r15b
xor edx, edx
mov r8d, 0x20bb
call fcn.140004dd0
lea rcx, [rbp + 0x228]
call fcn.14000e680
lea rcx, [rbp + 0x220]
call fcn.14000e6a0
lea rcx, [rbp + 0xbb0]
call fcn.14000d840
call fcn.14000d910
cvttss2si ecx, dword [0x1406daa38]
mov rbx, rax
mov dword [rbp + 0x5a0], r15d
mov dword [rbp + 0x5a4], 0x3f800000
mov dword [rbp + 0x5a8], 0x3f800000
movd xmm0, ecx
lea rcx, [rbp + 0x5a0]
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm15
movss dword [rbp + 0x5ac], xmm0
call fcn.140009f70
movss xmm3, dword [rbp + 0x228]
lea r8, [rbp + 0x230]
movss xmm2, dword [rbp + 0x22c]
lea rdx, [rbp + 0x238]
movss xmm0, dword [rbp + 0x220]
mov r9d, eax
movss xmm1, dword [rbp + 0x224]
addss xmm0, xmm3
addss xmm1, xmm2
movss dword [rsp + 0x30], xmm10
subss xmm3, xmm8
mov dword [rsp + 0x28], r15d
subss xmm2, xmm8
movss dword [rsp + 0x20], xmm10
mov rcx, rbx
addss xmm0, xmm8
addss xmm1, xmm8
movss dword [rbp + 0x238], xmm3
movss dword [rbp + 0x23c], xmm2
movss dword [rbp + 0x230], xmm0
movss dword [rbp + 0x234], xmm1
call fcn.140023bf0
mov ecx, WSAStartup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1400527d1
mov rax, qword [0x1407111f8]
mov esi, r15d
mov rdx, qword [0x1407111f0]
sub rax, rdx
sar rax, 3
cmp byte [0x14071111d], r15b
je 0x1400526ec
mov byte [0x14071111d], r15b
mov dword [rbp - 0x68], 0xea000000
mov dword [rbp - 0x64], 0xbf800000
mov dword [rbp - 0x60], 0xee408a85
mov dword [rbp - 0x5c], 0xee409a87
test rax, rax
je 0x140052677
mov rdi, r15
nop
mov rbx, qword [rdx + rdi]
call fcn.140057170
mov r9d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], r15
lea r8, [rbp - 0x68]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x1407111f8]
lea rdi, [rdi + 8]
mov rdx, qword [0x1407111f0]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140052630
lea r9, str.WALLHACK_V2_ENABLE
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0x1800]
call fcn.140048520
mov rax, qword [0x1406db690]
cmp rax, qword [0x1406db698]
je 0x1400526cc
mov r8d, 0x2010
lea rdx, [rbp + 0x1800]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
add qword [0x1406db690], 0x2010
mov ecx, 0x320
jmp 0x1400527c6
lea r8, [rbp + 0x1800]
mov rdx, rax
lea rcx, [0x1406db688]
call fcn.140047350
mov ecx, 0x320
jmp 0x1400527c6
mov byte [0x14071111d], 1
mov dword [rbp - 0x58], 0xea000000
mov dword [rbp - 0x54], 0x358637bd
mov dword [rbp - 0x50], 0xee238a85
mov dword [rbp - 0x4c], 0xee229a87
test rax, rax
je 0x14005275e
mov rdi, r15
mov rbx, qword [rdx + rdi]
call fcn.140057170
mov r9d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], r15
lea r8, [rbp - 0x58]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x1407111f8]
lea rdi, [rdi + 8]
mov rdx, qword [0x1407111f0]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140052717
lea r9, str.WALLHACK_V2_DISABLE
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0x3810]
call fcn.140048520
mov rax, qword [0x1406db690]
cmp rax, qword [0x1406db698]
je 0x1400527ab
mov r8d, 0x2010
lea rdx, [rbp + 0x3810]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
add qword [0x1406db690], 0x2010
jmp 0x1400527c1
lea r8, [rbp + 0x3810]
mov rdx, rax
lea rcx, [0x1406db688]
call fcn.140047350
mov ecx, 0x190
mov edx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, WSAStartup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140052a10
mov rax, qword [0x140711318]
mov esi, r15d
mov rdx, qword [0x140711310]
sub rax, rdx
sar rax, 3
cmp byte [0x14071111c], r15b
je 0x1400528ed
mov byte [0x14071111c], r15b
mov dword [rsp + 0x70], 0xbeac8b44
mov dword [rsp + 0x74], 0xbf1e76c9
test rax, rax
je 0x140052878
mov rdi, r15
nop dword [rax]
mov rbx, qword [rdx + rdi]
call fcn.140057170
mov r9d, 8
mov qword [rsp + 0x20], r15
lea r8, [rsp + 0x70]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140711318]
lea rdi, [rdi + 8]
mov rdx, qword [0x140711310]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140052830
lea r9, str.WALLHACK_ENABLE
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0x5820]
call fcn.140048520
mov rax, qword [0x1406db690]
cmp rax, qword [0x1406db698]
je 0x1400528cd
mov r8d, 0x2010
lea rdx, [rbp + 0x5820]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
add qword [0x1406db690], 0x2010
mov ecx, 0x320
jmp 0x140052a05
lea r8, [rbp + 0x5820]
mov rdx, rax
lea rcx, [0x1406db688]
call fcn.140047350
mov ecx, 0x320
jmp 0x140052a05
mov byte [0x14071111c], 1
mov dword [rbp + 0x38], 0x3f8147ae
mov dword [rbp + 0x3c], 0x3f8147ae
mov dword [rbp + 0x40], 0x3f8147ae
mov dword [rbp + 0x44], 0x3f8147ae
mov dword [rbp + 0x48], 0xeeb71a00
mov dword [rbp + 0x4c], 0xed9f3adc
mov dword [rbp + 0x50], 0xe24f0030
mov dword [rbp + 0x54], 0xeeb02a43
mov dword [rbp + 0x58], 0xf4600aef
mov dword [rbp + 0x5c], 0xeef06a43
mov dword [rbp + 0x60], 0xe28a001c
mov dword [rbp + 0x64], 0xeef05a43
mov word [rbp + 0x68], 0xa8f
test rax, rax
je 0x14005299d
mov rdi, r15
mov rbx, qword [rdx + rdi]
call fcn.140057170
mov r9d, reloc.WLDAP32.dll_Ordinal_50
mov qword [rsp + 0x20], r15
lea r8, [rbp + 0x38]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140711318]
lea rdi, [rdi + 8]
mov rdx, qword [0x140711310]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140052956
lea r9, str.WALLHACK_DISABLE
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0x7830]
call fcn.140048520
mov rax, qword [0x1406db690]
cmp rax, qword [0x1406db698]
je 0x1400529ea
mov r8d, 0x2010
lea rdx, [rbp + 0x7830]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
add qword [0x1406db690], 0x2010
jmp 0x140052a00
lea r8, [rbp + 0x7830]
mov rdx, rax
lea rcx, [0x1406db688]
call fcn.140047350
mov ecx, 0x190
mov edx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140052c1a
mov rax, qword [0x140711270]
mov esi, r15d
mov rdx, qword [0x140711268]
sub rax, rdx
sar rax, 3
cmp byte [0x1407110b2], r15b
je 0x140052b30
mov byte [0x1407110b2], r15b
mov dword [rbp - 0x48], 0xc47a0000
mov dword [rbp - 0x44], 0x43f3f3f
mov dword [rbp - 0x40], 0xe92d4ff0
mov dword [rbp - 0x3c], 0xe28db01c
test rax, rax
je 0x140052abb
mov rdi, r15
mov rbx, qword [rdx + rdi]
call fcn.140057170
mov r9d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], r15
lea r8, [rbp - 0x48]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140711270]
lea rdi, [rdi + 8]
mov rdx, qword [0x140711268]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140052a74
lea r9, str.Teleport_Amazon_Enable
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0x9840]
call fcn.140048520
mov rax, qword [0x1406db690]
cmp rax, qword [0x1406db698]
je 0x140052b10
mov r8d, 0x2010
lea rdx, [rbp + 0x9840]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
add qword [0x1406db690], 0x2010
mov ecx, 0x320
jmp 0x140052c0f
lea r8, [rbp + 0x9840]
mov rdx, rax
lea rcx, [0x1406db688]
call fcn.140047350
mov ecx, 0x320
jmp 0x140052c0f
mov byte [0x1407110b2], 1
mov dword [rbp - 0x38], 0x447a0000
mov dword [rbp - 0x34], 0x43f3f3f
mov dword [rbp - 0x30], 0xe92d4ff0
mov dword [rbp - 0x2c], 0xe28db01c
test rax, rax
je 0x140052ba7
mov rdi, r15
nop dword [rax + rax]
mov rbx, qword [rdx + rdi]
call fcn.140057170
mov r9d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], r15
lea r8, [rbp - 0x38]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140711270]
lea rdi, [rdi + 8]
mov rdx, qword [0x140711268]
inc esi
sub rcx, rdx
movsxd rax, esi
sar rcx, 3
cmp rax, rcx
jb 0x140052b60
lea r9, str.Teleport_Amazon_Disable
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0xb850]
call fcn.140048520
mov rax, qword [0x1406db690]
cmp rax, qword [0x1406db698]
je 0x140052bf4
mov r8d, 0x2010
lea rdx, [rbp + 0xb850]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
add qword [0x1406db690], 0x2010
jmp 0x140052c0a
lea r8, [rbp + 0xb850]
mov rdx, rax
lea rcx, [0x1406db688]
call fcn.140047350
mov ecx, 0x190
mov edx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rdi, qword [rbp + 0x340]
lea rdx, [rbp + 0x160]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rcx, [rbp + 0xbb8]
call fcn.14000e680
movss xmm0, dword [rax]
ucomiss xmm0, xmm7
jp 0x140052c6b
jne 0x140052c6b
lea rcx, [rbp + 0xbc0]
call fcn.14000e680
movss xmm0, dword [rax + 4]
ucomiss xmm0, xmm7
jp 0x140052c6b
je 0x140052ce1
lea rcx, [rbp + 0xbc8]
call fcn.14000e680
movd xmm0, dword [rbp + 0x164]
lea rcx, [rbp + 0xbd0]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [rax + 4]
cvttss2si ebx, xmm0
call fcn.14000e680
mov r9d, 0x320
mov dword [rsp + 0x28], 1
mov r8d, ebx
mov rcx, rdi
mov dword [rsp + 0x20], 0x208
movd xmm0, dword [rbp + 0x160]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [rax]
cvttss2si edx, xmm0
call qword [sym.imp.USER32.dll_MoveWindow]
xor edx, edx
mov qword [rbp + 0x240], r15
lea rcx, [rbp + 0x240]
call fcn.14001b330
call fcn.14000e630
mov rcx, qword [r13 + r12*8]
mov r14, rax
mov eax, 0x160
mov r8d, eax
mov edx, dword [rax + rcx]
mov eax, 0x150
mov ebx, eax
test dl, 1
jne 0x140052d3a
mov word [rcx + rax + 0xb], 0x159
or edx, 1
mov dword [rcx + rax], 0x79d756a2
mov dword [rcx + rax + 4], 0xf375ed7
mov word [rcx + rax + 8], 0x5d2
mov byte [rcx + rax + 0xa], 0xaf
mov dword [r8 + rcx], edx
lea rcx, [0x140126220]
call fcn.140122254
mov rdi, qword [r13 + r12*8]
add rdi, rbx
cmp byte [rdi + 0xc], r15b
je 0x140052d7b
xor byte [rdi], 0xe1
xor byte [rdi + 1], 0x37
xor byte [rdi + 2], 0x8f
xor byte [rdi + 3], 0x59
xor byte [rdi + 4], 0xf7
xor byte [rdi + 5], 0x73
xor byte [rdi + 6], 0x17
xor byte [rdi + 7], 0x41
xor byte [rdi + 8], 0xe1
xor byte [rdi + 9], 0x37
xor byte [rdi + 0xa], 0x8f
xor byte [rdi + 0xb], 0x59
mov byte [rdi + 0xc], r15b
lea rcx, [0x1406db1e8]
call fcn.14000d740
mov rcx, qword [r13 + r12*8]
mov esi, eax
mov eax, 0x148
mov r8d, eax
mov edx, dword [rax + rcx]
mov eax, 0x138
mov ebx, eax
test dl, 1
jne 0x140052dda
mov word [rcx + rax + 0xb], 0x159
or edx, 1
mov dword [rcx + rax], 0x79d756a2
mov dword [rcx + rax + 4], 0xf375ed7
mov word [rcx + rax + 8], 0x5d2
mov byte [rcx + rax + 0xa], 0xaf
mov dword [r8 + rcx], edx
lea rcx, [0x140126250]
call fcn.140122254
mov rdx, qword [r13 + r12*8]
add rdx, rbx
cmp byte [rdx + 0xc], r15b
je 0x140052e1b
xor byte [rdx], 0xe1
xor byte [rdx + 1], 0x37
xor byte [rdx + 2], 0x8f
xor byte [rdx + 3], 0x59
xor byte [rdx + 4], 0xf7
xor byte [rdx + 5], 0x73
xor byte [rdx + 6], 0x17
xor byte [rdx + 7], 0x41
xor byte [rdx + 8], 0xe1
xor byte [rdx + 9], 0x37
xor byte [rdx + 0xa], 0x8f
xor byte [rdx + 0xb], 0x59
mov byte [rdx + 0xc], r15b
xor r9d, r9d
movss dword [rsp + 0x20], xmm9
xor r8d, r8d
lea rcx, [rbp + 0xbd8]
call fcn.140008b80
mov rbx, rax
call fcn.14000e6c0
subss xmm0, dword [rbx]
mov r9, rdi
mov dword [rbp + 0x24c], 0x41400000
mov r8d, esi
mov qword [rsp + 0x20], r15
lea rdx, [rbp + 0x248]
mov rcx, r14
mulss xmm0, xmm14
addss xmm0, xmm7
movss dword [rbp + 0x248], xmm0
call fcn.140023eb0
call fcn.14000d570
lea rcx, [0x1406db1a8]
mov rbx, rax
call fcn.14000d740
mov r9d, eax
mov dword [rsp + 0x28], Ordinal_50
lea r8, [rbp + 0x250]
movss dword [rsp + 0x20], xmm11
lea rdx, [rbp + 0x258]
mov dword [rbp + 0x250], 0x44480000
mov rcx, rbx
mov dword [rbp + 0x254], 0x42340000
mov qword [rbp + 0x258], r15
call fcn.140023d00
call fcn.14000d570
lea rcx, [0x1406db1b8]
mov rbx, rax
call fcn.14000d740
mov r9d, eax
mov dword [rsp + 0x28], 0xc0
lea r8, [rbp + 0x260]
movss dword [rsp + 0x20], xmm11
lea rdx, [rbp + 0x268]
mov dword [rbp + 0x260], 0x44480000
mov rcx, rbx
mov dword [rbp + 0x264], 0x44020000
mov dword [rbp + 0x268], r15d
mov dword [rbp + 0x26c], 0x42340000
call fcn.140023d00
mov ecx, reloc.WLDAP32.dll_Ordinal_46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x14005697e
lea rcx, [rbp + 0x270]
mov dword [rbp + 0x270], 0x41700000
mov dword [rbp + 0x274], 0x43e10000
call fcn.14001a990
mov r14, qword [0x1407114d0]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 7
jb 0x1400569a5
cmp qword [0x1407114d8], 0xf
lea r15, [0x1407114c0]
lea rsi, [r14 + 7]
mov ebx, reloc.WS2_32.dll_ntohs
cmova r15, qword [0x1407114c0]
lea rdi, [rbp + 0x1b0]
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp + 0x1c0], rax
mov qword [rbp + 0x1c8], rax
movups xmmword [rbp + 0x1b0], xmm0
cmp rsi, rbx
jbe 0x140053040
mov rbx, rsi
or rbx, 0xf
cmp rbx, rcx
jbe 0x140052fe6
movabs rax, 0x8000000000000000
mov rbx, rcx
add rax, 0x27
jmp 0x14005300d
cmp rbx, 0x16
mov ecx, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14005302c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400569ab
mov rcx, rax
call fcn.140121ba8
test rax, rax
je 0x1400568fa
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140053039
test rcx, rcx
je 0x140053036
call fcn.140121ba8
mov rdi, rax
mov qword [rbp + 0x1b0], rdi
mov rax, qword [str.User_:]
lea rcx, [rdi + 7]
mov qword [rbp + 0x1c0], rsi
mov r8, r14
mov qword [rbp + 0x1c8], rbx
mov rdx, r15
mov dword [rdi], eax
movzx eax, word [0x1401912b4]
mov word [rdi + 4], ax
movzx eax, byte [reloc.WLDAP32.dll_Ordinal_32]
mov byte [rdi + 6], al
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
lea rcx, [rbp + 0x1b0]
cmp qword [rbp + 0x1c8], 0xf
cmova rcx, qword [rbp + 0x1b0]
call fcn.140037db0
lea rcx, [rbp + 0x278]
mov dword [rbp + 0x278], 0x41700000
mov dword [rbp + 0x27c], 0x43ed8000
call fcn.14001a990
mov rdi, qword [0x140711588]
lea rsi, [0x140711578]
xor r15d, r15d
movabs rax, 0x7fffffffffffffff
cmp qword [0x140711590], 0xf
xorps xmm0, xmm0
movups xmmword [rbp + 0x120], xmm0
cmova rsi, qword [0x140711578]
mov qword [rbp + 0x130], r15
mov qword [rbp + 0x138], r15
cmp rdi, rax
ja 0x1400569a5
cmp rdi, 0xf
ja 0x140053135
mov qword [rbp + 0x130], rdi
lea rcx, [rbp + 0x120]
mov qword [rbp + 0x138], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x120], xmm0
jmp 0x1400531e7
mov rbx, rdi
or rbx, 0xf
cmp rbx, rax
jbe 0x140053154
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x14005317b
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14005319d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400569ab
mov rcx, rax
call fcn.140121ba8
mov rcx, rax
test rax, rax
je 0x1400568fa
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400531ac
test rcx, rcx
je 0x1400531a9
call fcn.140121ba8
jmp 0x1400531ac
mov rax, r15
lea r8, [rdi + 1]
mov qword [rbp + 0x120], rax
mov rdx, rsi
mov qword [rbp + 0x130], rdi
mov rcx, rax
mov qword [rbp + 0x138], rbx
call sub.VCRUNTIME140.dll_memcpy
cmp qword [rbp + 0x138], 0xf
lea rcx, [rbp + 0x120]
cmova rcx, qword [rbp + 0x120]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
movsxd rcx, eax
mov qword [rbp + 0x5b0], rcx
lea rcx, [rbp + 0x5b0]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64]
lea r8, str.Vence:__d__m__Y
mov edx, reloc.WS2_32.dll_sendto
mov r9, rax
lea rcx, [rbp + 0xd38]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
lea rcx, [rbp + 0xd38]
call fcn.140037db0
lea rcx, [rbp + 0x280]
mov dword [rbp + 0x280], 0x43480000
mov dword [rbp + 0x284], 0x43f00000
call fcn.14001a990
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
lea r14, [0x1406da958]
mov rsi, qword [0x1406da968]
lea rdi, [rbp + 0x190]
cmova r14, qword [0x1406da958]
mov ebx, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x1a0], r15
xorps xmm0, xmm0
mov qword [rbp + 0x1a8], r15
movups xmmword [rbp + 0x190], xmm0
cmp rsi, rbx
jbe 0x14005331f
mov rbx, rsi
movabs rcx, 0x7fffffffffffffff
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400532c0
movabs rax, 0x8000000000000000
mov rbx, rcx
add rax, 0x27
jmp 0x1400532e7
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140053306
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400569ab
mov rcx, rax
call fcn.140121ba8
test rax, rax
je 0x1400568fa
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140053318
test rcx, rcx
je 0x140053315
call fcn.140121ba8
mov rdi, rax
jmp 0x140053318
mov rdi, r15
mov qword [rbp + 0x190], rdi
mov r8, rsi
mov qword [rbp + 0x1a0], rsi
mov rdx, r14
mov qword [rbp + 0x1a8], rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], r15b
lea rcx, [rbp + 0x190]
cmp qword [rbp + 0x1a8], 0xf
cmova rcx, qword [rbp + 0x190]
call fcn.140037db0
mov r15, qword [0x1407114d0]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 0xa
jb 0x1400569a5
cmp qword [0x1407114d8], 0xf
lea r14, [0x1407114c0]
lea rsi, [r15 + 0xa]
mov ebx, reloc.WS2_32.dll_ntohs
cmova r14, qword [0x1407114c0]
lea rdi, [rbp + 0x170]
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp + 0x180], rax
mov qword [rbp + 0x188], rax
movups xmmword [rbp + 0x170], xmm0
cmp rsi, rbx
jbe 0x14005343b
mov rbx, rsi
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400533e1
movabs rax, 0x8000000000000000
mov rbx, rcx
add rax, 0x27
jmp 0x140053408
cmp rbx, 0x16
mov ecx, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140053427
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400569ab
mov rcx, rax
call fcn.140121ba8
test rax, rax
je 0x1400568fa
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140053434
test rcx, rcx
je 0x140053431
call fcn.140121ba8
mov rdi, rax
mov qword [rbp + 0x170], rdi
movsd xmm0, qword [str.Username:]
lea rcx, [rdi + 0xa]
mov qword [rbp + 0x180], rsi
mov r8, r15
mov qword [rbp + 0x188], rbx
mov rdx, r14
movsd qword [rdi], xmm0
movzx eax, word [0x140191278]
mov word [rdi + 8], ax
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
lea rcx, [rbp + 0x170]
cmp qword [rbp + 0x188], 0xf
lea rdx, [rbp + 0x378]
mov rbx, qword [rbp + 0x180]
mov r14d, 0xa
cmova rcx, qword [rbp + 0x170]
xorps xmm0, xmm0
movzx eax, word [0x140191278]
cmp r14, rbx
movups xmmword [rbp + 0x378], xmm0
mov r8, rbx
mov qword [rbp + 0x388], r14
movsd xmm0, qword [str.Username:]
cmovb r8, r14
mov qword [rbp + 0x390], reloc.WS2_32.dll_ntohs
movsd qword [rbp + 0x378], xmm0
mov word [rbp + 0x380], ax
mov byte [rbp + 0x382], 0
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400534fd
cmp rbx, r14
jb 0x1400534fd
jbe 0x140056901
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x1401297f4]
call fcn.140046ad0
lea rdx, [0x140048190]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.14004adb0
lea rcx, [rbp + 0x288]
mov dword [rbp + 0x288], 0x43340000
mov dword [rbp + 0x28c], 0x43d20000
call fcn.14001a990
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
lea rcx, [0x1406da980]
cmova rcx, qword [0x1406da980]
call fcn.140037db0
lea rcx, [rbp + 0x290]
mov dword [rbp + 0x290], 0x44160000
mov dword [rbp + 0x294], 0x41f00000
call fcn.14001a990
movaps xmm0, xmmword [0x140135210]
lea rdx, str.Developed_by_Swatzz
lea rcx, [rbp + 0xae0]
movups xmmword [rbp + 0xae0], xmm0
call fcn.140037e20
lea rdx, [rbp + 0x298]
mov dword [rbp + 0x298], 0x40e00000
mov ecx, reloc.WS2_32.dll_ntohl
mov dword [rbp + 0x29c], 0x40e00000
call fcn.140016b80
lea rcx, [rbp + 0x2a0]
mov dword [rbp + 0x2a0], 0x40e00000
mov dword [rbp + 0x2a4], 0x42820000
call fcn.14001a990
call fcn.140007d20
mov ecx, 0x17c
mov dword [rbp + 0x2a8], 0x431d0000
mov dword [rbp + 0x2ac], 0x420c0000
mov rax, qword [r13 + r12*8]
mov edx, ecx
mov r8d, 0x170
mov ebx, r8d
mov ecx, dword [rcx + rax]
test cl, 1
jne 0x14005364e
mov word [rax + r8 + 9], 0x153
or ecx, 1
mov dword [rax + r8], 0xc2603616
mov dword [rdx + rax], ecx
lea rcx, [0x140125d00]
mov dword [rax + r8 + 4], 0xc0dde219
mov byte [rax + r8 + 8], reloc.WLDAP32.dll_Ordinal_33
call fcn.140122254
add rbx, qword [r13 + r12*8]
cmp byte [rbx + 0xa], 0
je 0x140053684
xor byte [rbx], 0x45
xor byte [rbx + 1], 0x53
xor byte [rbx + 2], 7
xor byte [rbx + 3], 0xb7
xor byte [rbx + 4], 0x6b
xor byte [rbx + 5], 0x8b
xor byte [rbx + 6], 0xb9
xor byte [rbx + 7], 0xa1
xor byte [rbx + 8], 0x45
xor byte [rbx + 9], 0x53
mov byte [rbx + 0xa], 0
mov rax, qword [r13 + r12*8]
mov ecx, 0x168
mov edx, ecx
mov r8d, 0x164
mov edi, r8d
mov ecx, dword [rcx + rax]
test cl, 1
jne 0x1400536c0
or ecx, 1
mov word [rax + r8 + 1], 0x153
mov dword [rdx + rax], ecx
lea rcx, [0x140126090]
mov byte [rax + r8], 3
call fcn.140122254
mov rdx, qword [r13 + r12*8]
add rdx, rdi
cmp byte [rdx + 2], 0
je 0x1400536d9
xor byte [rdx], 0x45
xor byte [rdx + 1], 0x53
mov byte [rdx + 2], 0
cmp dword [0x1407110e8], 0
lea r9, [rbp + 0x2a8]
mov r8, rbx
sete cl
xor esi, esi
mov dword [rsp + 0x20], esi
call fcn.1400376b0
test al, al
je 0x140053702
mov dword [0x1407110e8], esi
mov ecx, 0x190
mov dword [rbp + 0x2b0], 0x431d0000
mov dword [rbp + 0x2b4], 0x420c0000
mov rax, qword [r13 + r12*8]
mov edx, ecx
mov r8d, 0x188
mov ebx, r8d
mov ecx, dword [rcx + rax]
test cl, 1
jne 0x140053756
or ecx, 1
mov dword [rax + r8 + 4], 0x1d16978
mov dword [rdx + rax], ecx
lea rcx, [0x1401262e0]
mov dword [rax + r8], 0x5836c86
call fcn.140122254
add rbx, qword [r13 + r12*8]
cmp byte [rbx + 7], sil
je 0x140053780
xor byte [rbx], 0xcd
xor byte [rbx + 1], 5
xor byte [rbx + 2], 0xef
xor byte [rbx + 3], 0x69
xor byte [rbx + 4], 0x1d
xor byte [rbx + 5], 0x1b
xor byte [rbx + 6], 0xd1
mov byte [rbx + 7], sil
mov rax, qword [r13 + r12*8]
mov ecx, 0x184
mov edx, ecx
mov r8d, 0x180
mov edi, r8d
mov ecx, dword [rcx + rax]
test cl, 1
jne 0x1400537bc
or ecx, 1
mov word [rax + r8 + 1], 0x105
mov dword [rdx + rax], ecx
lea rcx, [0x140125c80]
mov byte [rax + r8], Ordinal_143
call fcn.140122254
mov rdx, qword [r13 + r12*8]
add rdx, rdi
cmp byte [rdx + 2], sil
je 0x1400537d5
xor byte [rdx], 0xcd
xor byte [rdx + 1], 5
mov byte [rdx + 2], sil
cmp dword [0x1407110e8], 6
lea r9, [rbp + 0x2b0]
mov r8, rbx
mov dword [rsp + 0x20], esi
sete cl
call fcn.1400376b0
test al, al
je 0x140053800
mov dword [0x1407110e8], 6
mov ecx, 0x1a4
mov dword [rbp + 0x2b8], 0x431d0000
mov dword [rbp + 0x2bc], 0x420c0000
mov rax, qword [r13 + r12*8]
mov edx, ecx
mov r8d, 0x19c
mov ebx, r8d
mov ecx, dword [rcx + rax]
test cl, 1
jne 0x140053853
or ecx, 1
mov dword [rax + r8 + 2], 0x13d5e22
mov dword [rdx + rax], ecx
lea rcx, [0x1401261f0]
mov word [rax + r8], 0xc224
call fcn.140122254
add rbx, qword [r13 + r12*8]
cmp byte [rbx + 5], sil
je 0x140053875
xor byte [rbx], 0x69
xor byte [rbx + 1], 0xab
xor byte [rbx + 2], 0x51
xor byte [rbx + 3], 0x3d
xor byte [rbx + 4], 0x3d
mov byte [rbx + 5], sil
mov rax, qword [r13 + r12*8]
mov ecx, 0x198
mov edx, ecx
mov r8d, 0x194
mov edi, r8d
mov ecx, dword [rcx + rax]
test cl, 1
jne 0x1400538b1
or ecx, 1
mov word [rax + r8 + 1], 0x1ab
mov dword [rdx + rax], ecx
lea rcx, [0x1401263c0]
mov byte [rax + r8], Ordinal_45
call fcn.140122254
mov rdx, qword [r13 + r12*8]
add rdx, rdi
cmp byte [rdx + 2], sil
je 0x1400538ca
xor byte [rdx], 0x69
xor byte [rdx + 1], 0xab
mov byte [rdx + 2], sil
cmp dword [0x1407110e8], 2
lea r9, [rbp + 0x2b8]
mov r8, rbx
mov dword [rsp + 0x20], esi
sete cl
call fcn.1400376b0
test al, al
je 0x1400538f5
mov dword [0x1407110e8], 2
mov ecx, 0x1b8
mov dword [rbp + 0x2c0], 0x431d0000
mov dword [rbp + 0x2c4], 0x420c0000
mov rax, qword [r13 + r12*8]
mov edx, ecx
mov r8d, 0x1b0
mov ebx, r8d
mov ecx, dword [rcx + rax]
test cl, 1
jne 0x140053949
or ecx, 1
mov dword [rax + r8 + 4], 0x1c7cd4c
mov dword [rdx + rax], ecx
lea rcx, [0x1401261c0]
mov dword [rax + r8], 0xc4be96c9
call fcn.140122254
add rbx, qword [r13 + r12*8]
cmp byte [rbx + 7], sil
je 0x140053972
xor byte [rbx], 0x9f
not byte [rbx + 1]
xor byte [rbx + 2], 0xcd
xor byte [rbx + 3], 0xb1
xor byte [rbx + 4], 0x2d
xor byte [rbx + 5], 0xa1
xor byte [rbx + 6], 0xc7
mov byte [rbx + 7], sil
mov rax, qword [r13 + r12*8]
mov ecx, 0x1ac
mov edx, ecx
mov r8d, 0x1a8
mov edi, r8d
mov ecx, dword [rcx + rax]
test cl, 1
jne 0x1400539ae
or ecx, 1
mov word [rax + r8 + 1], 0x1ff
mov dword [rdx + rax], ecx
lea rcx, [0x140126140]
mov byte [rax + r8], Ordinal_217
call fcn.140122254
mov rdx, qword [r13 + r12*8]
add rdx, rdi
cmp byte [rdx + 2], sil
je 0x1400539c6
xor byte [rdx], 0x9f
not byte [rdx + 1]
mov byte [rdx + 2], sil
cmp dword [0x1407110e8], 5
lea r9, [rbp + 0x2c0]
mov r8, rbx
mov dword [rsp + 0x20], esi
sete cl
call fcn.1400376b0
test al, al
je 0x1400539f1
mov dword [0x1407110e8], 5
mov ecx, 0x1d0
mov dword [rbp + 0x2c8], 0x431d0000
mov dword [rbp + 0x2cc], 0x420c0000
mov rax, qword [r13 + r12*8]
mov edx, ecx
mov r8d, 0x1c8
mov ebx, r8d
mov ecx, dword [rcx + rax]
test cl, 1
jne 0x140053a45
or ecx, 1
mov dword [rax + r8 + 4], 0x15b81aa
mov dword [rdx + rax], ecx
lea rcx, [0x140125ef0]
mov dword [rax + r8], 0x1be8801e
call fcn.140122254
add rbx, qword [r13 + r12*8]
cmp byte [rbx + 7], sil
je 0x140053a6f
xor byte [rbx], 0x55
xor byte [rbx + 1], 0xe5
xor byte [rbx + 2], 0x91
xor byte [rbx + 3], 0x79
xor byte [rbx + 4], 0xc3
xor byte [rbx + 5], 0xef
xor byte [rbx + 6], 0x5b
mov byte [rbx + 7], sil
mov rax, qword [r13 + r12*8]
mov ecx, 0x1c0
mov edx, ecx
mov r8d, 0x1bc
mov edi, r8d
mov ecx, dword [rcx + rax]
test cl, 1
jne 0x140053aab
or ecx, 1
mov word [rax + r8 + 1], 0x1e5
mov dword [rdx + rax], ecx
lea rcx, [0x140126370]
mov byte [rax + r8], reloc.WS2_32.dll_recvfrom
call fcn.140122254
mov rdx, qword [r13 + r12*8]
add rdx, rdi
cmp byte [rdx + 2], sil
je 0x140053ac4
xor byte [rdx], 0x55
xor byte [rdx + 1], 0xe5
mov byte [rdx + 2], sil
cmp dword [0x1407110e8], 3
lea r9, [rbp + 0x2c8]
mov r8, rbx
mov dword [rsp + 0x20], esi
sete cl
call fcn.1400376b0
test al, al
je 0x140053aef
mov dword [0x1407110e8], 3
call fcn.14000bd20
mov ecx, 1
call fcn.140016580
mov eax, dword [0x1407110f4]
cmp dword [0x1407110e8], eax
jne 0x140053b12
movaps xmm6, xmm8
jmp 0x140053b16
movaps xmm6, xmm9
call fcn.14000dce0
movss xmm0, dword [rax + 0x10]
mulss xmm0, xmm12
mulss xmm0, xmm6
addss xmm0, dword [0x1407110ec]
comiss xmm7, xmm0
jbe 0x140053b3b
movaps xmm1, xmm7
jmp 0x140053b43
movaps xmm1, xmm8
minss xmm1, xmm0
mov eax, dword [0x1407110f4]
cmp dword [0x1407110e8], eax
movss dword [0x1407110ec], xmm1
jne 0x140053b5f
movaps xmm6, xmm8
jmp 0x140053b63
movaps xmm6, xmm9
call fcn.14000dce0
movaps xmm0, xmm13
mov rbx, rax
call sub.api_ms_win_crt_math_l1_1_0.dll_roundf
mulss xmm0, dword [rbx + 0x10]
mulss xmm0, xmm6
addss xmm0, dword [0x1407110f0]
comiss xmm7, xmm0
jbe 0x140053b8f
movaps xmm1, xmm7
jmp 0x140053b97
movaps xmm1, xmm8
minss xmm1, xmm0
cmp byte [reloc.WS2_32.dll_accept], sil
movss dword [0x1407110f0], xmm1
je 0x140053bb5
call fcn.14004de70
movss xmm1, dword [0x1407110f0]
movss xmm0, dword [0x1407110ec]
ucomiss xmm0, xmm7
jp 0x140053bd7
jne 0x140053bd7
ucomiss xmm1, xmm7
jp 0x140053bd7
jne 0x140053bd7
mov eax, dword [0x1407110e8]
mov dword [0x1407110f4], eax
lea rcx, [rbp + 0x2d0]
mov dword [rbp + 0x2d0], 0x43340000
mov dword [rbp + 0x2d4], 0x425c0000
call fcn.14001a990
mov rax, qword [rsp + 0x68]
xor ecx, ecx
movss xmm1, dword [0x1407110ec]
mulss xmm1, dword [rax]
call fcn.140016c60
mov eax, dword [0x1407110f4]
cmp eax, 6
jne 0x140054948
call fcn.140007d20
movdqa xmm0, xmmword [0x1401916a0]
mov eax, 0x1ec
mov dword [rbp + 0x2d8], 0x43900000
mov dword [rbp + 0x2dc], 0x430c0000
mov rcx, qword [r13 + r12*8]
mov edx, eax
mov word [rbp + 0x598], 0x570b
mov ebx, 0x1d8
mov eax, dword [rax + rcx]
test al, 1
jne 0x140053cb3
or eax, 1
mov dword [rdx + rcx], eax
add rcx, rbx
lea rdx, [rbp + 0x599]
mov byte [rcx + 0x12], 1
lea rax, [rcx + 0x11]
cmp rcx, rdx
ja 0x140053c99
lea rdx, [rbp + 0x588]
cmp rax, rdx
jb 0x140053c99
movzx eax, word [rbp + 0x598]
movups xmmword [rcx], xmm0
mov word [rcx + 0x10], ax
jmp 0x140053ca7
movzx eax, word [rbp + 0x598]
movups xmmword [rcx], xmm0
mov word [rcx + 0x10], ax
lea rcx, [0x1401260b0]
call fcn.140122254
mov rcx, qword [r13 + r12*8]
add rcx, rbx
cmp byte [rcx + 0x12], sil
je 0x140053d0c
xor byte [rcx], 0x7f
xor byte [rcx + 1], 0x57
xor byte [rcx + 2], 0x8b
xor byte [rcx + 3], 0xc3
xor byte [rcx + 4], 5
xor byte [rcx + 5], 0xf5
xor byte [rcx + 6], 0x7d
xor byte [rcx + 7], 0x29
xor byte [rcx + 8], 0x7f
xor byte [rcx + 9], 0x57
xor byte [rcx + 0xa], 0x8b
xor byte [rcx + 0xb], 0xc3
xor byte [rcx + 0xc], 5
xor byte [rcx + 0xd], 0xf5
xor byte [rcx + 0xe], 0x7d
xor byte [rcx + 0xf], 0x29
xor byte [rcx + 0x10], 0x7f
xor byte [rcx + 0x11], 0x57
mov byte [rcx + 0x12], sil
xor r9d, r9d
lea rdx, [rbp + 0x2d8]
mov r8b, 1
call fcn.140007760
mov r14, qword [0x1407114d0]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 0xa
jb 0x1400569a5
cmp qword [0x1407114d8], 0xf
lea r15, [0x1407114c0]
lea rsi, [r14 + 0xa]
mov ebx, reloc.WS2_32.dll_ntohs
cmova r15, qword [0x1407114c0]
lea rdi, [rbp + 0x140]
xor r13d, r13d
xorps xmm0, xmm0
mov qword [rbp + 0x150], r13
mov qword [rbp + 0x158], r13
movups xmmword [rbp + 0x140], xmm0
cmp rsi, rbx
jbe 0x140053db7
mov rbx, rsi
or rbx, 0xf
cmp rbx, rcx
jbe 0x140053d97
mov rbx, rcx
jmp 0x140053da4
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
call fcn.140046fd0
mov rdi, rax
mov qword [rbp + 0x140], rax
movsd xmm0, qword [str.Username:]
mov r8, r14
mov qword [rbp + 0x150], rsi
mov rdx, r15
mov qword [rbp + 0x158], rbx
movsd qword [rdi], xmm0
movzx ecx, word [0x140191278]
mov word [rdi + 8], cx
lea rcx, [rdi + 0xa]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], r13b
lea rcx, [rbp + 0x140]
cmp qword [rbp + 0x158], 0xf
lea rdx, [rbp + 0x1f0]
mov rbx, qword [rbp + 0x150]
mov r14d, 0xa
cmova rcx, qword [rbp + 0x140]
xorps xmm0, xmm0
movzx eax, word [0x140191278]
cmp r14, rbx
movups xmmword [rbp + 0x1f0], xmm0
mov r8, rbx
mov qword [rbp + 0x200], r14
movsd xmm0, qword [str.Username:]
cmovb r8, r14
mov qword [rbp + 0x208], reloc.WS2_32.dll_ntohs
movsd qword [rbp + 0x1f0], xmm0
mov word [rbp + 0x1f8], ax
mov byte [rbp + 0x1fa], r13b
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140053e79
cmp rbx, r14
jb 0x140053e79
jbe 0x14005692d
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x1401297f4]
call fcn.140046ad0
lea rdx, [0x140048190]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x14071106b]
lea rcx, str.Magic_Bullet_V2_Cartel
call fcn.140030af0
test al, al
je 0x140053ec8
cmp byte [0x14071106b], 1
jne 0x140053ec8
lea rcx, [0x140711210]
call fcn.14004b950
lea rdx, [0x140711039]
lea rcx, str.Magic_Cartel_V1
call fcn.140030af0
test al, al
je 0x140053f10
cmp byte [0x140711039], 1
jne 0x140053f10
lea rdx, [0x14004bcb0]
lea rcx, [rbp + 0xaf0]
call fcn.140046910
mov rcx, rax
call fcn.14004de30
cmp dword [rbp + 0xaf8], r13d
jne 0x140051243
xor ecx, ecx
call fcn.14000fa40
test al, al
je 0x140053f31
call fcn.140007e70
lea rcx, str.Enable_in_Logo_Garena_or_Lobby
call fcn.140037db0
call fcn.14000c0d0
mov r8, qword [rbp + 0x208]
cmp r8, 0xf
jbe 0x140053f51
mov rdx, qword [rbp + 0x1f0]
lea rcx, [rbp + 0x1f0]
call fcn.14004d100
mov r8, qword [rbp + 0x158]
mov qword [rbp + 0x200], r13
mov qword [rbp + 0x208], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1f0], r13b
cmp r8, 0xf
jbe 0x140053f8a
mov rdx, qword [rbp + 0x140]
lea rcx, [rbp + 0x140]
call fcn.14004d100
mov qword [rbp + 0x150], r13
mov qword [rbp + 0x158], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x140], r13b
call fcn.14000b520
mov rax, qword gs:[0x58]
mov r12d, dword [0x140711920]
mov dword [rbp + 0x2e0], 0x43900000
mov dword [rbp + 0x2e4], 0x43340000
mov r8d, 0x1f0
mov rdx, qword [rax + r12*8]
mov eax, 0x1fc
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x140054013
mov dword [rdx + r8 + 8], 0x19b846e
or eax, 1
mov dword [rcx + rdx], eax
lea rcx, [0x140125e10]
mov dword [rdx + r8], 0xc0f5a862
mov dword [rdx + r8 + 4], 0x31aaa977
call fcn.140122254
mov rax, qword gs:[0x58]
mov rcx, qword [rax + r12*8]
add rcx, rbx
cmp byte [rcx + 0xb], r13b
je 0x140054058
xor byte [rcx], 0x2f
xor byte [rcx + 1], 0xcd
xor byte [rcx + 2], 0x9b
xor byte [rcx + 3], 0xb5
xor byte [rcx + 4], 0x57
xor byte [rcx + 5], 0xef
xor byte [rcx + 6], 0xe3
xor byte [rcx + 7], 0x77
xor byte [rcx + 8], 0x2f
xor byte [rcx + 9], 0xcd
xor byte [rcx + 0xa], 0x9b
mov byte [rcx + 0xb], r13b
xor r9d, r9d
lea rdx, [rbp + 0x2e0]
mov r8b, 1
call fcn.140007760
xor ecx, ecx
call fcn.14000fa40
test al, al
je 0x14005408b
call fcn.140007e70
lea rcx, str.Activar_en_Game
call fcn.140037db0
call fcn.14000c0d0
lea rdx, [0x140711003]
lea rcx, str.Night_Mode
call fcn.140030af0
test al, al
je 0x1400540b7
cmp byte [0x140711003], 1
jne 0x1400540b7
lea rcx, [0x140711210]
call fcn.14004d5f0
xor ecx, ecx
call fcn.14000fa40
test al, al
je 0x1400540d8
call fcn.140007e70
lea rcx, str.Activar_en_Game
call fcn.140037db0
call fcn.14000c0d0
lea rdx, [0x14071109f]
lea rcx, str.No_Recoil
call fcn.140030af0
test al, al
je 0x140054104
cmp byte [0x14071109f], 1
jne 0x140054104
lea rcx, [0x140711210]
call fcn.14004d700
lea rdx, [0x1407110a2]
lea rcx, str.V_Badge
call fcn.140030af0
test al, al
je 0x140054223
cmp byte [0x1407110a2], 1
jne 0x140054223
lea rcx, [0x140711210]
call fcn.14004b730
mov rdx, rax
lea rcx, [0x140711210]
call fcn.14004af00
test eax, eax
jne 0x140054162
lea r8d, [rax + 0xd]
lea rdx, str.Panel_:_Error
lea rcx, [0x1406da958]
call fcn.140038520
mov ecx, 8
call fcn.1401221a4
mov rbx, rax
test rax, rax
je 0x140054183
mov dword [rax], 0xe3a00001
mov dword [rax + 4], 0xe12fff1e
jmp 0x140054186
mov rbx, r13
mov esi, reloc.WS2_32.dll_sendto
mov ecx, esi
call fcn.1401221a4
test rax, rax
je 0x1400541bb
mov dword [rax], 0xe92d4c70
mov dword [rax + 4], 0xe28db010
mov dword [rax + 8], 0xe1a04001
mov dword [rax + 0xc], 0xe1a05000
mov dword [rax + 0x10], 0xe3040a02
jmp 0x1400541be
mov rax, r13
movabs rdi, 0x7fffffffffff
mov byte [rsp + 0x28], 1
mov r8, rdi
mov qword [rsp + 0x20], rbx
mov r9, rax
lea rcx, [0x140711210]
xor edx, edx
call fcn.14004c7e0
movzx eax, al
lea rdx, str.V_Badge_:_Successfully_applied_
mov r8d, eax
lea rcx, [0x1406da958]
shl r8, 4
add r8, 0xf
test al, al
lea rax, str.V_Badge:_Error_
cmove rdx, rax
call fcn.140038520
mov rcx, qword [0x140711248]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140054232
mov esi, reloc.WS2_32.dll_sendto
movabs rdi, 0x7fffffffffff
call fcn.14000b520
call fcn.14000bd20
movaps xmm1, xmm9
movaps xmm0, xmm7
call fcn.140019e20
call fcn.140007d20
mov rax, qword gs:[0x58]
mov dword [rbp + 0x2e8], 0x43900000
mov dword [rbp + 0x2ec], 0x434d0000
mov r8d, 0x200
mov rdx, qword [rax + r12*8]
mov eax, 0x210
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x1400542be
mov word [rdx + r8 + 0xb], 0x1e3
or eax, 1
mov dword [rdx + r8], 0x96bf48d8
mov dword [rdx + r8 + 4], 0x4cde7ae5
mov dword [rcx + rdx], eax
lea rcx, [0x140125fa0]
mov word [rdx + r8 + 8], 0x42f7
mov byte [rdx + r8 + 0xa], 0xa5
call fcn.140122254
mov rax, qword gs:[0x58]
mov rcx, qword [rax + r12*8]
add rcx, rbx
cmp byte [rcx + 0xc], r13b
je 0x140054307
xor byte [rcx], 0x95
xor byte [rcx + 1], 0x2d
xor byte [rcx + 2], 0xd1
xor byte [rcx + 3], 0xe3
xor byte [rcx + 4], 0xc5
xor byte [rcx + 5], 0x3b
xor byte [rcx + 6], 0xb7
xor byte [rcx + 7], 0x21
xor byte [rcx + 8], 0x95
xor byte [rcx + 9], 0x2d
xor byte [rcx + 0xa], 0xd1
xor byte [rcx + 0xb], 0xe3
mov byte [rcx + 0xc], r13b
xor r9d, r9d
lea rdx, [rbp + 0x2e8]
mov r8b, 1
call fcn.140007760
lea rdx, [0x140711028]
lea rcx, str.Aimbot_External
call fcn.140030af0
test al, al
je 0x140054345
cmp byte [0x140711028], 1
jne 0x140054345
lea rcx, [0x140711210]
call fcn.14004a830
lea rdx, [0x14071102b]
lea rcx, str.Aimbot_Body
call fcn.140030af0
test al, al
je 0x14005444b
cmp byte [0x14071102b], 1
jne 0x14005444b
lea rcx, [0x140711210]
call fcn.14004b730
mov rdx, rax
lea rcx, [0x140711210]
call fcn.14004af00
test eax, eax
jne 0x1400543a3
lea r8d, [rax + 0xd]
lea rdx, str.Panel_:_Error
lea rcx, [0x1406da958]
call fcn.140038520
mov ecx, recv
call fcn.1401221a4
mov rbx, rax
test rax, rax
je 0x1400543cb
mov dword [rax], 0x3e000000
mov dword [rax + 4], 0x3d23d70a
mov dword [rax + 8], 0xbcf9a5d2
jmp 0x1400543ce
mov rbx, r13
mov ecx, recv
call fcn.1401221a4
test rax, rax
je 0x1400543f3
mov dword [rax], 0xbd3952dc
mov dword [rax + 4], 0x3c8bc127
mov dword [rax + 8], 0xb9f8d0c0
jmp 0x1400543f6
mov rax, r13
mov byte [rsp + 0x28], 1
lea rcx, [0x140711210]
mov r9, rax
mov qword [rsp + 0x20], rbx
mov r8, rdi
xor edx, edx
call fcn.14004c7e0
test al, al
lea rdx, str.Aimbot_Body_:_Successfully_applied_
lea rax, str.Aimbot_Body_:_Error_
mov r8d, reloc.WLDAP32.dll_Ordinal_35
cmove r8, rsi
lea rcx, [0x1406da958]
cmove rdx, rax
call fcn.140038520
mov rcx, qword [0x140711248]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x14071102a]
lea rcx, str.Aim_Scope2X
call fcn.140030af0
test al, al
je 0x14005456c
cmp byte [0x14071102a], 1
jne 0x14005456c
lea rcx, [0x140711210]
call fcn.14004b730
mov rdx, rax
lea rcx, [0x140711210]
call fcn.14004b7e0
test eax, eax
je 0x1400544b4
mov r8d, eax
mov dword [0x140711240], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140711248], rax
test rax, rax
jne 0x1400544cd
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Panel_:_Error
lea rcx, [0x1406da958]
call fcn.140038520
mov ecx, 8
call fcn.1401221a4
mov rbx, rax
test rax, rax
je 0x1400544ee
mov dword [rax], 0x3ff00000
mov dword [rax + 4], 0x5c29ffff
jmp 0x1400544f1
mov rbx, r13
mov ecx, 8
call fcn.1401221a4
test rax, rax
je 0x14005450f
mov dword [rax], 0x3ff00000
mov dword [rax + 4], 0x3f800000
jmp 0x140054512
mov rax, r13
mov byte [rsp + 0x28], 1
lea rcx, [0x140711210]
mov r9, rax
mov qword [rsp + 0x20], rbx
mov r8, rdi
xor edx, edx
call fcn.14004c7e0
test al, al
lea rdx, str.Aimbot_Scope_:_Successfully_applied_
mov ecx, reloc.WS2_32.dll_recvfrom
lea rax, str.Scope_2X_:_Error_
mov r8d, Ordinal_41
cmove rdx, rax
cmove r8d, ecx
lea rcx, [0x1406da958]
call fcn.140038520
mov rcx, qword [0x140711248]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14000b520
mov rax, qword gs:[0x58]
mov dword [rbp + 0x2f0], 0x43900000
mov dword [rbp + 0x2f4], 0x438c0000
mov r8d, 0x218
mov rdx, qword [rax + r12*8]
mov eax, 0x224
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x1400545da
mov word [rdx + r8 + 9], 0x1af
or eax, 1
mov dword [rdx + r8], 0x4497ca40
mov dword [rcx + rdx], eax
lea rcx, [0x140125d80]
mov dword [rdx + r8 + 4], 0xed08702b
mov byte [rdx + r8 + 8], 0x68
call fcn.140122254
mov rax, qword gs:[0x58]
mov rcx, qword [rax + r12*8]
add rcx, rbx
cmp byte [rcx + 0xa], r13b
je 0x14005461b
xor byte [rcx], 0xd
xor byte [rcx + 1], 0xaf
xor byte [rcx + 2], 0xf9
xor byte [rcx + 3], 0x31
xor byte [rcx + 4], 0xb
xor byte [rcx + 5], 0x23
xor byte [rcx + 6], 0x69
xor byte [rcx + 7], 0x8b
xor byte [rcx + 8], 0xd
xor byte [rcx + 9], 0xaf
mov byte [rcx + 0xa], r13b
xor r9d, r9d
lea rdx, [rbp + 0x2f0]
mov r8b, 1
call fcn.140007760
lea rdx, [0x140711092]
lea rcx, str.Scope_Awm_New
call fcn.140030af0
test al, al
je 0x14005476d
cmp byte [0x140711092], 1
jne 0x14005476d
lea rcx, [0x140711210]
call fcn.14004b730
mov rdx, rax
lea rcx, [0x140711210]
call fcn.14004b7e0
test eax, eax
je 0x140054696
mov r8d, eax
mov dword [0x140711240], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140711248], rax
test rax, rax
jne 0x1400546af
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Panel_:_Error
lea rcx, [0x1406da958]
call fcn.140038520
mov rcx, rsi
call fcn.1401221a4
mov rbx, rax
test rax, rax
je 0x1400546e3
mov dword [rax], 0xffffb1e0
mov dword [rax + 4], 0xffffb1e0
mov dword [rax + 8], 0xffffb1e0
mov dword [rax + 0xc], 0xffffb1e0
mov dword [rax + 0x10], 0xffffb1e0
jmp 0x1400546e6
mov rbx, r13
mov rcx, rsi
call fcn.1401221a4
test rax, rax
je 0x140054711
mov dword [rax], 0x3f8ccccd
mov dword [rax + 4], 0x3cf5c28f
mov dword [rax + 8], 0x3dcccccd
mov qword [rax + 0xc], 7
jmp 0x140054714
mov rax, r13
mov byte [rsp + 0x28], 1
lea rcx, [0x140711210]
mov r9, rax
mov qword [rsp + 0x20], rbx
mov r8, rdi
xor edx, edx
call fcn.14004c7e0
movzx eax, al
lea rdx, str.Scope_Awm_:_Successfully_applied_
mov r8d, eax
lea rcx, [0x1406da958]
shl r8, 4
add r8, 0x11
test al, al
lea rax, str.Tiro_AWM_:_Error_
cmove rdx, rax
call fcn.140038520
mov rcx, qword [0x140711248]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x140710ffc]
lea rcx, str.AimFov_Awm
call fcn.140030af0
test al, al
je 0x14005489c
cmp byte [0x140710ffc], 1
jne 0x14005489c
lea rcx, [0x140711210]
call fcn.14004b730
mov rdx, rax
lea rcx, [0x140711210]
call fcn.14004b7e0
test eax, eax
je 0x1400547d6
mov r8d, eax
mov dword [0x140711240], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140711248], rax
test rax, rax
jne 0x1400547ef
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Panel_:_Error
lea rcx, [0x1406da958]
call fcn.140038520
mov ecx, 1
call fcn.1401221a4
mov rbx, rax
test rax, rax
je 0x140054806
mov byte [rax], r13b
jmp 0x140054809
mov rbx, r13
mov ecx, 0x24
call fcn.1401221a4
test rax, rax
je 0x14005483f
mov qword [rax], 1
mov qword [rax + 8], r13
mov dword [rax + 0x10], 0xcb
mov dword [rax + 0x14], 0x3f3f3f3f
mov qword [rax + 0x18], 1
mov dword [rax + 0x20], r13d
jmp 0x140054842
mov rax, r13
mov byte [rsp + 0x28], 1
lea rcx, [0x140711210]
mov r9, rax
mov qword [rsp + 0x20], rbx
mov r8, rdi
xor edx, edx
call fcn.14004c7e0
test al, al
lea rdx, str.AimFov_Awm_:_Successfully_applied_
mov ecx, reloc.WS2_32.dll_send
lea rax, str.AimFov_Awm_:_Error_
mov r8d, Ordinal_35
cmove rdx, rax
cmove r8d, ecx
lea rcx, [0x1406da958]
call fcn.140038520
mov rcx, qword [0x140711248]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call fcn.14000fa40
test al, al
je 0x1400548bd
call fcn.140007e70
lea rcx, str.Activar_en_Game
call fcn.140037db0
call fcn.14000c0d0
lea rdx, [0x140711058]
lea rcx, str.Unlimit_Awm
call fcn.140030af0
test al, al
je 0x1400548e9
cmp byte [0x140711058], 1
jne 0x1400548e9
lea rcx, [0x140711210]
call fcn.14004cdf0
xor ecx, ecx
call fcn.14000fa40
test al, al
je 0x14005490a
call fcn.140007e70
lea rcx, str.Activar_en_Game
call fcn.140037db0
call fcn.14000c0d0
lea rdx, [0x140710ff0]
lea rcx, str.Quick_Switch_AWM
call fcn.140030af0
test al, al
je 0x140054936
cmp byte [0x140710ff0], 1
jne 0x140054936
lea rcx, [0x140711210]
call fcn.14004bec0
call fcn.14000b520
call fcn.14000bd20
mov eax, dword [0x1407110f4]
jmp 0x140054952
mov r12d, dword [0x140711920]
xor r13d, r13d
cmp eax, 2
jne 0x14005529c
call fcn.140007d20
mov rax, qword gs:[0x58]
mov ecx, r12d
mov dword [rbp + 0x2f8], 0x43900000
mov dword [rbp + 0x2fc], 0x430c0000
mov r8d, 0x228
mov rdx, qword [rax + rcx*8]
mov eax, 0x238
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x1400549d5
mov word [rdx + r8 + 0xd], 0x187
or eax, 1
mov dword [rdx + r8], 0xf671fc30
mov dword [rdx + r8 + 4], 0x58becb83
mov dword [rcx + rdx], eax
lea rcx, [0x140125e40]
mov dword [rdx + r8 + 8], 0xec76ed1c
mov byte [rdx + r8 + 0xc], 0xcd
call fcn.140122254
mov rax, qword gs:[0x58]
mov ecx, r12d
mov rcx, qword [rax + rcx*8]
add rcx, rbx
cmp byte [rcx + 0xe], 0
je 0x140054a29
xor byte [rcx], 0x7d
xor byte [rcx + 1], 0x99
xor byte [rcx + 2], 0x1f
xor byte [rcx + 3], 0x83
xor byte [rcx + 4], 0xa3
xor byte [rcx + 5], 0x87
xor byte [rcx + 6], 0xd1
xor byte [rcx + 7], 0x3b
xor byte [rcx + 8], 0x7d
xor byte [rcx + 9], 0x99
xor byte [rcx + 0xa], 0x1f
xor byte [rcx + 0xb], 0x83
xor byte [rcx + 0xc], 0xa3
xor byte [rcx + 0xd], 0x87
mov byte [rcx + 0xe], 0
xor r9d, r9d
lea rdx, [rbp + 0x2f8]
mov r8b, 1
call fcn.140007760
lea rdx, [0x140710ffe]
lea rcx, str.Chams_CartelX
call fcn.140030af0
test al, al
je 0x140054a60
cmp byte [0x140710ffe], 0
je 0x140054a60
call fcn.14004b250
lea rdx, [0x140710fed]
lea rcx, str.Chams_RGB
call fcn.140030af0
test al, al
je 0x140054ad9
cmp byte [0x140710fed], 0
je 0x140054ad9
call fcn.140057170
mov rcx, rax
call fcn.1400570d0
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140054ac9
mov rcx, rax
call fcn.14004b900
test al, al
je 0x140054ac0
lea rdx, [0x1402e4760]
mov rcx, rbx
call fcn.1400569c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14004b1c0
lea rdx, [0x140710fec]
lea rcx, str.Antenna_Hombro_V2
call fcn.140030af0
test al, al
je 0x140054b21
cmp byte [0x140710fec], 1
jne 0x140054b21
lea rdx, [0x14004aa00]
lea rcx, [rbp + 0xbe0]
call fcn.140046910
mov rcx, rax
call fcn.14004de30
cmp dword [rbp + 0xbe8], 0
jne 0x140051243
call fcn.14000b520
mov rax, qword gs:[0x58]
mov ecx, r12d
mov dword [rbp + 0x300], 0x43900000
mov dword [rbp + 0x304], 0x43870000
mov r8d, 0x240
mov rdx, qword [rax + rcx*8]
mov eax, 0x250
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x140054b9a
mov word [r8 + rdx + 0xb], 0x1af
or eax, 1
mov dword [r8 + rdx], 0xdabb44fe
mov dword [r8 + rdx + 4], 0x6c0a2c49
mov dword [rcx + rdx], eax
lea rcx, [0x140126280]
mov word [r8 + rdx + 8], 0x53d6
mov byte [r8 + rdx + 0xa], 0xb4
call fcn.140122254
mov rax, qword gs:[0x58]
mov ecx, r12d
mov rcx, qword [rax + rcx*8]
add rcx, rbx
cmp byte [rcx + 0xc], 0
je 0x140054be6
xor byte [rcx], 0xb3
xor byte [rcx + 1], 0x21
xor byte [rcx + 2], 0xd5
xor byte [rcx + 3], 0xaf
xor byte [rcx + 4], 0x69
xor byte [rcx + 5], 0x6f
xor byte [rcx + 6], 0x6b
xor byte [rcx + 7], 1
xor byte [rcx + 8], 0xb3
xor byte [rcx + 9], 0x21
xor byte [rcx + 0xa], 0xd5
xor byte [rcx + 0xb], 0xaf
mov byte [rcx + 0xc], 0
xor r9d, r9d
lea rdx, [rbp + 0x300]
mov r8b, 1
call fcn.140007760
lea rdx, [0x14071105a]
lea rcx, str.Camera_Premium
call fcn.140030af0
test al, al
je 0x140054c40
cmp byte [0x14071105a], 1
jne 0x140054c40
lea rdx, [0x14004af40]
lea rcx, [rbp + 0xb08]
call fcn.140046910
mov rcx, rax
call fcn.14004de30
cmp dword [rbp + 0xb10], 0
jne 0x140051243
lea rdx, [0x140711031]
lea rcx, str.Camera_Hack_Ultimate
call fcn.140030af0
test al, al
je 0x140054d7a
cmp byte [0x140711031], 1
jne 0x140054d7a
lea rcx, [0x140711210]
call fcn.14004b730
mov rdx, rax
lea rcx, [0x140711210]
call fcn.14004b7e0
test eax, eax
je 0x140054ca9
mov r8d, eax
mov dword [0x140711240], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140711248], rax
test rax, rax
jne 0x140054cc2
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Panel_:_Error
lea rcx, [0x1406da958]
call fcn.140038520
mov ecx, recv
call fcn.1401221a4
mov rbx, rax
test rax, rax
je 0x140054cea
mov dword [rax], 0x3f800000
mov dword [rax + 4], 0x3f19999a
mov dword [rax + 8], 0x3f800000
jmp 0x140054ced
mov rbx, r13
mov ecx, recv
call fcn.1401221a4
test rax, rax
je 0x140054d12
mov dword [rax], 0x3ecccccd
mov dword [rax + 4], 0x3f19999a
mov dword [rax + 8], 0xbd4ccccd
jmp 0x140054d15
mov rax, r13
movabs rdi, 0x7fffffffffff
mov byte [rsp + 0x28], 1
mov r8, rdi
mov qword [rsp + 0x20], rbx
mov r9, rax
lea rcx, [0x140711210]
xor edx, edx
call fcn.14004c7e0
movzx eax, al
lea rdx, str.Camera_Hack_:_Successfully_applied_
mov r8d, eax
lea rcx, [0x1406da958]
shl r8, 4
add r8, 0x13
test al, al
lea rax, str.Camera_Hack:_Error_
cmove rdx, rax
call fcn.140038520
mov rcx, qword [0x140711248]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140054d84
movabs rdi, 0x7fffffffffff
lea rdx, [0x14071109c]
lea rcx, str.Camera_FOV
call fcn.140030af0
test al, al
je 0x140054dcc
cmp byte [0x14071109c], 1
jne 0x140054dcc
lea rdx, [0x14004da60]
lea rcx, [rbp + 0xb18]
call fcn.140046910
mov rcx, rax
call fcn.14004de30
cmp dword [rbp + 0xb20], 0
jne 0x140051243
lea rdx, [0x140710fff]
lea rcx, str.Remove_Bug_Camera
call fcn.140030af0
test al, al
je 0x140054f09
cmp byte [0x140710fff], 1
jne 0x140054f09
lea rcx, [0x140711210]
call fcn.14004b730
mov rdx, rax
lea rcx, [0x140711210]
call fcn.14004b7e0
test eax, eax
je 0x140054e35
mov r8d, eax
mov dword [0x140711240], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140711248], rax
test rax, rax
jne 0x140054e4e
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Panel_:_Error
lea rcx, [0x1406da958]
call fcn.140038520
mov ecx, reloc.WS2_32.dll_recv
call fcn.1401221a4
mov rbx, rax
test rax, rax
je 0x140054e7d
mov dword [rax], 0
mov dword [rax + 4], 1
mov dword [rax + 8], 0x42340000
mov dword [rax + 0xc], 0x3e99999a
jmp 0x140054e80
mov rbx, r13
mov ecx, reloc.WS2_32.dll_recv
call fcn.1401221a4
test rax, rax
je 0x140054eac
mov dword [rax], 0x3fc00000
mov dword [rax + 4], 1
mov dword [rax + 8], 0x42340000
mov dword [rax + 0xc], 0x3e99999a
jmp 0x140054eaf
mov rax, r13
mov byte [rsp + 0x28], 1
lea rcx, [0x140711210]
mov r9, rax
mov qword [rsp + 0x20], rbx
mov r8, rdi
xor edx, edx
call fcn.14004c7e0
test al, al
lea rdx, str.Remove_Bug_:_Successfully_applied_
mov ecx, reloc.WS2_32.dll_send
lea rax, str.Remove_Bug_:_Error_
mov r8d, Ordinal_35
cmove rdx, rax
cmove r8d, ecx
lea rcx, [0x1406da958]
call fcn.140038520
mov rcx, qword [0x140711248]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14000b520
call fcn.14000bd20
movaps xmm1, xmm9
movaps xmm0, xmm7
call fcn.140019e20
call fcn.140007d20
mov rax, qword gs:[0x58]
mov ecx, r12d
mov dword [rbp + 0x308], 0x43900000
mov dword [rbp + 0x30c], 0x43340000
mov r8d, 0x258
mov rdx, qword [rax + rcx*8]
mov eax, 0x264
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x140054f8a
mov dword [rdx + r8 + 6], 0x1a9bb80
or eax, 1
mov dword [rcx + rdx], eax
lea rcx, [0x1401260e0]
mov dword [rdx + r8], 0x6ec734e4
mov word [rdx + r8 + 4], 0xefaf
call fcn.140122254
mov rax, qword gs:[0x58]
mov ecx, r12d
mov rcx, qword [rax + rcx*8]
add rcx, rbx
cmp byte [rcx + 9], 0
je 0x140054fca
xor byte [rcx], 0xa9
xor byte [rcx + 1], 0x51
xor byte [rcx + 2], 0xa9
xor byte [rcx + 3], 0x1b
xor byte [rcx + 4], 0x8f
xor byte [rcx + 5], 0xa7
xor byte [rcx + 6], 0xe1
xor byte [rcx + 7], 0xc3
xor byte [rcx + 8], 0xa9
mov byte [rcx + 9], 0
xor r9d, r9d
lea rdx, [rbp + 0x308]
mov r8b, 1
call fcn.140007760
lea rdx, [0x140711094]
lea rcx, str.Fast_Fire___Sew
call fcn.140030af0
test al, al
je 0x140055008
cmp byte [0x140711094], 1
jne 0x140055008
lea rcx, [0x140711210]
call fcn.14004e7c0
lea rdx, [0x140710ff1]
lea rcx, str.Ultra_Quick_Switch
call fcn.140030af0
test al, al
je 0x140055050
cmp byte [0x140710ff1], 1
jne 0x140055050
lea rdx, [0x14004f3e0]
lea rcx, [rbp + 0xb28]
call fcn.140046910
mov rcx, rax
call fcn.14004de30
cmp dword [rbp + 0xb30], 0
jne 0x140051243
lea rdx, [0x14071105e]
lea rcx, str.Fast_Reload
call fcn.140030af0
test al, al
je 0x14005519b
cmp byte [0x14071105e], 1
jne 0x14005519b
lea rcx, [0x140711210]
call fcn.14004b730
mov rdx, rax
lea rcx, [0x140711210]
call fcn.14004b7e0
test eax, eax
je 0x1400550b9
mov r8d, eax
mov dword [0x140711240], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140711248], rax
test rax, rax
jne 0x1400550d2
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Panel_:_Error
lea rcx, [0x1406da958]
call fcn.140038520
mov ecx, 4
call fcn.1401221a4
mov rbx, rax
test rax, rax
je 0x1400550ec
mov dword [rax], 0xe34402ff
jmp 0x1400550ef
mov rbx, r13
mov ecx, 0x24
call fcn.1401221a4
test rax, rax
je 0x14005513e
mov dword [rax], 0xeb000066
mov dword [rax + 4], 0xeeb70a00
mov dword [rax + 8], 0xee010a10
mov dword [rax + 0xc], 0xee310a00
mov dword [rax + 0x10], 0xee015a10
mov dword [rax + 0x14], 0xee210a00
mov dword [rax + 0x18], 0xee100a10
mov dword [rax + 0x1c], 0xe8bd8830
mov dword [rax + 0x20], 0xe92d48f0
jmp 0x140055141
mov rax, r13
mov byte [rsp + 0x28], 1
lea rcx, [0x140711210]
mov r9, rax
mov qword [rsp + 0x20], rbx
mov r8, rdi
xor edx, edx
call fcn.14004c7e0
test al, al
lea rdx, str.Fast_Reload_:_Successfully_applied_
mov ecx, reloc.WS2_32.dll_sendto
lea rax, str.Fast_Reload_:_Error_
mov r8d, reloc.WLDAP32.dll_Ordinal_35
cmove rdx, rax
cmove r8d, ecx
lea rcx, [0x1406da958]
call fcn.140038520
mov rcx, qword [0x140711248]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14000b520
mov rax, qword gs:[0x58]
mov ecx, r12d
mov dword [rbp + 0x310], 0x43900000
mov dword [rbp + 0x314], 0x437a0000
mov r8d, 0x268
mov rdx, qword [rax + rcx*8]
mov eax, 0x278
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x140055214
mov word [rdx + r8 + 0xb], 0x16b
or eax, 1
mov dword [rdx + r8], 0x1e07be62
mov dword [rdx + r8 + 4], 0xf81af405
mov dword [rcx + rdx], eax
lea rcx, [0x140125ca0]
mov word [rdx + r8 + 8], 0xb24d
mov byte [rdx + r8 + 0xa], 7
call fcn.140122254
mov rax, qword gs:[0x58]
mov ecx, r12d
mov rcx, qword [rax + rcx*8]
add rcx, rbx
cmp byte [rcx + 0xc], 0
je 0x140055260
xor byte [rcx], 0x2f
xor byte [rcx + 1], 0xdb
xor byte [rcx + 2], 0x69
xor byte [rcx + 3], 0x6b
xor byte [rcx + 4], 0x25
xor byte [rcx + 5], 0xbf
xor byte [rcx + 6], 0x7f
xor byte [rcx + 7], 0x81
xor byte [rcx + 8], 0x2f
xor byte [rcx + 9], 0xdb
xor byte [rcx + 0xa], 0x69
xor byte [rcx + 0xb], 0x6b
mov byte [rcx + 0xc], 0
xor r9d, r9d
lea rdx, [rbp + 0x310]
mov r8b, 1
call fcn.140007760
lea r8, [0x140711660]
lea rdx, [0x14071101c]
lea rcx, str.WallHack_New
call fcn.1400350d0
call fcn.14000b520
call fcn.14000bd20
mov eax, dword [0x1407110f4]
cmp eax, 3
jne 0x1400554bd
call fcn.140007d20
mov rax, qword gs:[0x58]
mov ecx, r12d
mov dword [rbp + 0x318], 0x440e0000
mov dword [rbp + 0x31c], 0x43480000
mov r8d, 0x280
mov rdx, qword [rax + rcx*8]
mov eax, 0x290
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x14005531a
mov dword [rdx + r8 + 0xc], 0x1d915e4
or eax, 1
mov dword [rdx + r8], 0x86940cf5
mov dword [rcx + rdx], eax
lea rcx, [0x140126190]
mov dword [rdx + r8 + 4], 0x74987991
mov dword [rdx + r8 + 8], 0x8d9a0093
call fcn.140122254
mov rax, qword gs:[0x58]
mov ecx, r12d
mov rcx, qword [rax + rcx*8]
add rcx, rbx
cmp byte [rcx + 0xf], 0
je 0x140055372
xor byte [rcx], 0xb3
xor byte [rcx + 1], 0x4d
xor byte [rcx + 2], 0xdf
xor byte [rcx + 3], 0xc3
xor byte [rcx + 4], 0xb1
xor byte [rcx + 5], 0x35
xor byte [rcx + 6], 0xd9
xor byte [rcx + 7], 0x33
xor byte [rcx + 8], 0xb3
xor byte [rcx + 9], 0x4d
xor byte [rcx + 0xa], 0xdf
xor byte [rcx + 0xb], 0xc3
xor byte [rcx + 0xc], 0xb1
xor byte [rcx + 0xd], 0x35
xor byte [rcx + 0xe], 0xd9
mov byte [rcx + 0xf], 0
xor r9d, r9d
lea rdx, [rbp + 0x318]
mov r8b, 1
call fcn.140007760
lea rdx, [0x140711090]
lea rcx, str.Enable_Macro_M500
call fcn.140030af0
test al, al
je 0x140055436
cmp byte [0x140711090], 1
jne 0x14005542c
cmp byte [0x140711091], 1
jne 0x1400553f9
mov ecx, reloc.WS2_32.dll_WSACleanup
call fcn.14004be50
xor r9d, r9d
mov dword [rsp + 0x28], 1
lea r8, str.C:WindowsSystem32Macrom500.ahk
mov qword [rsp + 0x20], r13
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [0x140711091], 0
jmp 0x140055436
mov dword [rsp + 0x28], 1
lea r8, str.C:WindowsSystem32Macrom500.ahk
xor r9d, r9d
mov qword [rsp + 0x20], r13
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140055436
mov ecx, 0x75
call fcn.14004be50
lea rdx, [0x140711091]
lea rcx, str.Enable_Macro_2Awm
call fcn.140030af0
test al, al
je 0x1400554ad
cmp byte [0x140711091], 1
jne 0x1400554a3
cmp byte [0x140711090], 1
jne 0x140055470
mov ecx, 0x75
mov byte [0x140711090], 0
call fcn.14004be50
mov dword [rsp + 0x28], 1
lea r8, str.C:WindowsSystem32Macro2Awm_by_Swatzz.ahk
xor r9d, r9d
mov qword [rsp + 0x20], r13
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400554ad
mov ecx, reloc.WS2_32.dll_WSACleanup
call fcn.14004be50
call fcn.14000b520
call fcn.14000bd20
mov eax, dword [0x1407110f4]
test eax, eax
jne 0x140055f57
call fcn.140007d20
mov rax, qword gs:[0x58]
mov ecx, r12d
mov dword [rbp + 0x320], 0x440e0000
mov dword [rbp + 0x324], 0x435c0000
mov r8d, 0x298
mov rdx, qword [rax + rcx*8]
mov eax, 0x2a8
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x14005553f
mov word [rdx + r8 + 0xd], 0x1a1
or eax, 1
mov dword [rdx + r8], 0x7ef92230
mov dword [rdx + r8 + 4], 0xa40af2e3
mov dword [rcx + rdx], eax
lea rcx, [0x140126030]
mov dword [rdx + r8 + 8], 0x7ffe3528
mov byte [rdx + r8 + 0xc], 0x9a
call fcn.140122254
mov rax, qword gs:[0x58]
mov ecx, r12d
mov rcx, qword [rax + rcx*8]
add rcx, rbx
cmp byte [rcx + 0xe], 0
je 0x140055593
xor byte [rcx], 0x7d
xor byte [rcx + 1], 0x67
xor byte [rcx + 2], 0xb7
xor byte [rcx + 3], 0x2b
xor byte [rcx + 4], 0xc3
xor byte [rcx + 5], 0xa1
xor byte [rcx + 6], 0x4f
xor byte [rcx + 7], 0xe7
xor byte [rcx + 8], 0x7d
xor byte [rcx + 9], 0x67
xor byte [rcx + 0xa], 0xb7
xor byte [rcx + 0xb], 0x2b
xor byte [rcx + 0xc], 0xc3
xor byte [rcx + 0xd], 0xa1
mov byte [rcx + 0xe], 0
xor r9d, r9d
lea rdx, [rbp + 0x320]
mov r8b, 1
call fcn.140007760
lea rdx, [0x14071108f]
lea rcx, str.Block_Internet
call fcn.140030af0
test al, al
je 0x140055dd1
cmp byte [0x14071108f], 1
xorps xmm0, xmm0
jne 0x140055a7a
mov r8d, __WSAFDIsSet
mov qword [rbp + 0x578], r13
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock0__dirin_actionblock_profileany_program_C:Program_FilesBlueStacks_nxtHD_Player.exe_
mov qword [rbp + 0x580], r13
lea rcx, [rbp + 0x568]
movups xmmword [rbp + 0x568], xmm0
call fcn.14002f3c0
lea rcx, [rbp + 0x568]
call fcn.14004b2e0
mov r8, qword [rbp + 0x580]
cmp r8, 0xf
jbe 0x14005562a
mov rdx, qword [rbp + 0x568]
lea rcx, [rbp + 0x568]
call fcn.14004d100
xorps xmm0, xmm0
mov qword [rbp + 0x578], r13
mov r8d, __WSAFDIsSet
mov qword [rbp + 0x580], reloc.WS2_32.dll_ntohs
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock0__dirout_actionblock_profileany_program_C:Program_FilesBlueStacks_nxtHD_Player.exe_
mov byte [rbp + 0x568], 0
lea rcx, [rbp + 0x448]
mov qword [rbp + 0x458], r13
movups xmmword [rbp + 0x448], xmm0
mov qword [rbp + 0x460], r13
call fcn.14002f3c0
lea rcx, [rbp + 0x448]
call fcn.14004b2e0
mov r8, qword [rbp + 0x460]
cmp r8, 0xf
jbe 0x1400556a0
mov rdx, qword [rbp + 0x448]
lea rcx, [rbp + 0x448]
call fcn.14004d100
xorps xmm0, xmm0
mov qword [rbp + 0x458], r13
mov r8d, 0x91
mov qword [rbp + 0x460], reloc.WS2_32.dll_ntohs
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock1__dirin_actionblock_profileany_program_C:ProgramDataBlueStacks_msi5HD_Player.exe_
mov byte [rbp + 0x448], 0
lea rcx, [rbp + 0x468]
mov qword [rbp + 0x478], r13
movups xmmword [rbp + 0x468], xmm0
mov qword [rbp + 0x480], r13
call fcn.14002f3c0
lea rcx, [rbp + 0x468]
call fcn.14004b2e0
mov r8, qword [rbp + 0x480]
cmp r8, 0xf
jbe 0x140055716
mov rdx, qword [rbp + 0x468]
lea rcx, [rbp + 0x468]
call fcn.14004d100
xorps xmm0, xmm0
mov qword [rbp + 0x478], r13
mov r8d, __WSAFDIsSet
mov qword [rbp + 0x480], reloc.WS2_32.dll_ntohs
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock1__dirout_actionblock_profileany_program_C:ProgramDataBlueStacks_msi5HD_Player.exe_
mov byte [rbp + 0x468], 0
lea rcx, [rbp + 0x700]
mov qword [rbp + 0x710], r13
movups xmmword [rbp + 0x700], xmm0
mov qword [rbp + 0x718], r13
call fcn.14002f3c0
lea rcx, [rbp + 0x700]
call fcn.14004b2e0
lea rcx, [rbp + 0x700]
call fcn.14002fd20
xorps xmm0, xmm0
mov qword [rbp + 0x730], r13
mov r8d, Ordinal_143
mov qword [rbp + 0x738], r13
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock2__dirin_actionblock_profileany_program_C:Program_FilesBlueStacksHD_Player.exe_
lea rcx, [rbp + 0x720]
movups xmmword [rbp + 0x720], xmm0
call fcn.14002f3c0
lea rcx, [rbp + 0x720]
call fcn.14004b2e0
lea rcx, [rbp + 0x720]
call fcn.14002fd20
xorps xmm0, xmm0
mov qword [rbp + 0x498], r13
mov r8d, reloc.WLDAP32.dll_Ordinal_143
mov qword [rbp + 0x4a0], r13
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock2__dirout_actionblock_profileany_program_C:Program_FilesBlueStacksHD_Player.exe_
lea rcx, [rbp + 0x488]
movups xmmword [rbp + 0x488], xmm0
call fcn.14002f3c0
lea rcx, [rbp + 0x488]
call fcn.14004b2e0
mov r8, qword [rbp + 0x4a0]
cmp r8, 0xf
jbe 0x14005581e
mov rdx, qword [rbp + 0x488]
lea rcx, [rbp + 0x488]
call fcn.14004d100
xorps xmm0, xmm0
mov qword [rbp + 0x498], r13
mov r8d, __WSAFDIsSet
mov qword [rbp + 0x4a0], reloc.WS2_32.dll_ntohs
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock4__dirin_actionblock_profileany_program_C:Program_FilesBlueStacks_msi5HD_Player.exe_
mov byte [rbp + 0x488], 0
lea rcx, [rbp + 0x4a8]
mov qword [rbp + 0x4b8], r13
movups xmmword [rbp + 0x4a8], xmm0
mov qword [rbp + 0x4c0], r13
call fcn.14002f3c0
lea rcx, [rbp + 0x4a8]
call fcn.14004b2e0
mov r8, qword [rbp + 0x4c0]
cmp r8, 0xf
jbe 0x140055894
mov rdx, qword [rbp + 0x4a8]
lea rcx, [rbp + 0x4a8]
call fcn.14004d100
xorps xmm0, xmm0
mov qword [rbp + 0x4b8], r13
mov r8d, __WSAFDIsSet
mov qword [rbp + 0x4c0], reloc.WS2_32.dll_ntohs
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock4__dirout_actionblock_profileany_program_C:Program_FilesBlueStacks_msi5HD_Player.exe_
mov byte [rbp + 0x4a8], 0
lea rcx, [rbp + 0x4c8]
mov qword [rbp + 0x4d8], r13
movups xmmword [rbp + 0x4c8], xmm0
mov qword [rbp + 0x4e0], r13
call fcn.14002f3c0
lea rcx, [rbp + 0x4c8]
call fcn.14004b2e0
mov r8, qword [rbp + 0x4e0]
cmp r8, 0xf
jbe 0x14005590a
mov rdx, qword [rbp + 0x4c8]
lea rcx, [rbp + 0x4c8]
call fcn.14004d100
xorps xmm0, xmm0
mov qword [rbp + 0x4d8], r13
mov r8d, __WSAFDIsSet
mov qword [rbp + 0x4e0], reloc.WS2_32.dll_ntohs
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock3__dirin_actionblock_profileany_program_C:Program_FilesBlueStacks_msi2HD_Player.exe_
mov byte [rbp + 0x4c8], 0
lea rcx, [rbp + 0x4e8]
mov qword [rbp + 0x4f8], r13
movups xmmword [rbp + 0x4e8], xmm0
mov qword [rbp + 0x500], r13
call fcn.14002f3c0
lea rcx, [rbp + 0x4e8]
call fcn.14004b2e0
mov r8, qword [rbp + 0x500]
cmp r8, 0xf
jbe 0x140055980
mov rdx, qword [rbp + 0x4e8]
lea rcx, [rbp + 0x4e8]
call fcn.14004d100
xorps xmm0, xmm0
mov qword [rbp + 0x4f8], r13
mov r8d, __WSAFDIsSet
mov qword [rbp + 0x500], reloc.WS2_32.dll_ntohs
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock3__dirout_actionblock_profileany_program_C:Program_FilesBlueStacks_msi2HD_Player.exe_
mov byte [rbp + 0x4e8], 0
lea rcx, [rbp + 0x508]
mov qword [rbp + 0x518], r13
movups xmmword [rbp + 0x508], xmm0
mov qword [rbp + 0x520], r13
call fcn.14002f3c0
lea rcx, [rbp + 0x508]
call fcn.14004b2e0
mov r8, qword [rbp + 0x520]
cmp r8, 0xf
jbe 0x1400559f6
mov rdx, qword [rbp + 0x508]
lea rcx, [rbp + 0x508]
call fcn.14004d100
lea r9, str.Internet_Desactivado
mov qword [rbp + 0x518], r13
xor edx, edx
mov qword [rbp + 0x520], reloc.WS2_32.dll_ntohs
mov r8d, 0xbb8
mov byte [rbp + 0x508], 0
lea rcx, [rbp + 0xd860]
call fcn.140048520
mov rax, qword [0x1406db690]
cmp rax, qword [0x1406db698]
je 0x140055a5f
mov r8d, 0x2010
lea rdx, [rbp + 0xd860]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
add qword [0x1406db690], 0x2010
jmp 0x140055dd1
lea r8, [rbp + 0xd860]
mov rdx, rax
lea rcx, [0x1406db688]
call fcn.140047350
jmp 0x140055dd1
mov r8d, 0x67
mov qword [rbp + 0x940], r13
lea rdx, str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:Program_FilesBlueStacks_nxtHD_Player.exe_
mov qword [rbp + 0x948], r13
lea rcx, [rbp + 0x930]
movups xmmword [rbp + 0x930], xmm0
call fcn.14002f3c0
xorps xmm0, xmm0
mov qword [rbp + 0x960], r13
mov r8d, 0x66
mov qword [rbp + 0x968], r13
lea rdx, str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:ProgramDataBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x950]
movups xmmword [rbp + 0x950], xmm0
call fcn.14002f3c0
xorps xmm0, xmm0
mov qword [rbp + 0x980], r13
mov r8d, 0x63
mov qword [rbp + 0x988], r13
lea rdx, str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:Program_FilesBlueStacksHD_Player.exe_
lea rcx, [rbp + 0x970]
movups xmmword [rbp + 0x970], xmm0
call fcn.14002f3c0
xorps xmm0, xmm0
mov qword [rbp + 0x9a0], r13
mov r8d, 0x68
mov qword [rbp + 0x9a8], r13
lea rdx, str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:Program_FilesBlueStacks_msi2HD_Player.exe_
lea rcx, [rbp + 0x990]
movups xmmword [rbp + 0x990], xmm0
call fcn.14002f3c0
xorps xmm0, xmm0
mov qword [rbp + 0x9c0], r13
mov r8d, 0x76
mov qword [rbp + 0x9c8], r13
lea rdx, str.netsh_advfirewall_firewall_delete_rule_name_TemporaryBlock4__program_C:Program_FilesBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x9b0]
movups xmmword [rbp + 0x9b0], xmm0
call fcn.14002f3c0
xorps xmm0, xmm0
mov qword [rbp + 0x9e0], r13
mov r8d, 0x76
mov qword [rbp + 0x9e8], r13
lea rdx, str.netsh_advfirewall_firewall_delete_rule_name_TemporaryBlock4__program_C:Program_FilesBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x9d0]
movups xmmword [rbp + 0x9d0], xmm0
call fcn.14002f3c0
lea rsi, [rbp + 0x930]
xorps xmm0, xmm0
lea rax, [0x14018ffa0]
movups xmmword [rbp + 0xa60], xmm0
movabs rcx, 0x7fffffffffffffff
mov dword [rbp + 0xa60], reloc.WS2_32.dll_WSASetLastError
movups xmmword [rbp + 0xa70], xmm0
mov qword [rbp + 0xa78], rax
mov rax, rcx
mov dword [rbp + 0xa64], 0x40
movups xmmword [rbp + 0xa80], xmm0
movups xmmword [rbp + 0xa90], xmm0
movups xmmword [rbp + 0xaa0], xmm0
movups xmmword [rbp + 0xab0], xmm0
movups xmmword [rbp + 0xac0], xmm0
mov r15, qword [rsi + 0x10]
sub rax, r15
cmp rax, 3
jb 0x1400569b1
cmp qword [rsi + 0x18], 0xf
mov r12, rsi
jbe 0x140055c25
mov r12, qword [rsi]
lea r14, [r15 + 3]
mov qword [rbp + 0x1e0], r13
mov ebx, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x1e8], r13
lea rdi, [rbp + 0x1d0]
movups xmmword [rbp + 0x1d0], xmm0
cmp r14, rbx
jbe 0x140055c80
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x140055c60
mov rbx, rcx
jmp 0x140055c6d
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
call fcn.140046fd0
mov rdi, rax
mov qword [rbp + 0x1d0], rax
mov ecx, dword [0x14018ffa8]
mov r8, r15
mov qword [rbp + 0x1e0], r14
mov rdx, r12
mov qword [rbp + 0x1e8], rbx
mov word [rdi], cx
movzx ecx, byte [reloc.WLDAP32.dll_Ordinal_32]
mov byte [rdi + 2], cl
lea rcx, [rdi + 3]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
lea rax, [rbp + 0x1d0]
mov r8, qword [rbp + 0x1e8]
mov rdx, qword [rbp + 0x1d0]
cmp r8, 0xf
cmova rax, rdx
mov qword [rbp + 0xa80], rax
jbe 0x140055ce7
lea rcx, [rbp + 0x1d0]
call fcn.14004d100
lea rcx, [rbp + 0xa60]
mov qword [rbp + 0x1e0], r13
mov qword [rbp + 0x1e8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1d0], 0
mov dword [rbp + 0xa90], r13d
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x140055d37
mov rcx, qword [rbp + 0xac8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0xac8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsi, 0x20
lea rax, [rbp + 0x9f0]
cmp rsi, rax
jne 0x140055ba4
lea r9, str.Internet_Activado
xor edx, edx
mov r8d, 0xbb8
lea rcx, [rbp + 0xf870]
call fcn.140048520
mov rax, qword [0x1406db690]
cmp rax, qword [0x1406db698]
je 0x140055d98
mov r8d, 0x2010
lea rdx, [rbp + 0xf870]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
add qword [0x1406db690], 0x2010
jmp 0x140055dae
lea r8, [rbp + 0xf870]
mov rdx, rax
lea rcx, [0x1406db688]
call fcn.140047350
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea r9, [fcn.14002fd20]
lea rcx, [rbp + 0x930]
lea r8d, [rdx - 0x1a]
call fcn.140121ad8
mov r12d, dword [0x140711920]
lea rdx, [0x140711085]
lea rcx, str.Seguridad_Ultimate___Login__
call fcn.140030af0
test al, al
je 0x140055dfd
cmp byte [0x140711085], 1
jne 0x140055dfd
lea rcx, [0x140711210]
call fcn.14004aa60
lea rdx, [0x140711089]
lea rcx, str.Bypass_Camera___Lobby__
call fcn.140030af0
test al, al
je 0x140055f1b
cmp byte [0x140711089], 1
jne 0x140055f1b
lea rcx, [0x140711210]
call fcn.14004b730
mov rdx, rax
lea rcx, [0x140711210]
call fcn.14004b7e0
test eax, eax
je 0x140055e66
mov r8d, eax
mov dword [0x140711240], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140711248], rax
test rax, rax
jne 0x140055e7f
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Panel_:_Error
lea rcx, [0x1406da958]
call fcn.140038520
mov ecx, 4
call fcn.1401221a4
mov rbx, rax
test rax, rax
je 0x140055e99
mov dword [rax], 0xf020e3
jmp 0x140055e9c
mov rbx, r13
mov ecx, 8
call fcn.1401221a4
test rax, rax
je 0x140055eba
mov dword [rax], 0xe12fff34
mov dword [rax + 4], 0xe1a00009
jmp 0x140055ebd
mov rax, r13
mov byte [rsp + 0x28], 1
lea rcx, [0x140711210]
mov r9, rax
mov qword [rsp + 0x20], rbx
xor edx, edx
movabs r8, 0x7fffffffffff
call fcn.14004c7e0
lea rcx, [0x1406da958]
test al, al
je 0x140055efc
mov r8d, Ordinal_41
lea rdx, str.Bypass_Camera_:_Successfully_applied_
jmp 0x140055f09
mov r8d, reloc.WLDAP32.dll_Ordinal_22
lea rdx, str.Bypass_Camera_:_Error_
call fcn.140038520
mov rcx, qword [0x140711248]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x1407110a9]
lea rcx, str.Bypass_WallHack___Lobby__
call fcn.140030af0
test al, al
je 0x140055f47
cmp byte [0x1407110a9], 1
jne 0x140055f47
lea rcx, [0x140711210]
call fcn.14004d8f0
call fcn.14000b520
call fcn.14000bd20
mov eax, dword [0x1407110f4]
cmp eax, 5
jne 0x140056489
call fcn.140007d20
mov rax, qword gs:[0x58]
mov ecx, r12d
mov dword [rbp + 0x328], 0x43960000
mov dword [rbp + 0x32c], 0x435c0000
mov r8d, 0x2b0
mov rdx, qword [rax + rcx*8]
mov eax, 0x2bc
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x140055fcc
mov dword [rdx + r8 + 8], 0x14118c6
or eax, 1
mov dword [rcx + rdx], eax
lea rcx, [0x140126060]
mov dword [rdx + r8], 0xda0f0ec6
mov dword [rdx + r8 + 4], 0xf4cd8e5b
call fcn.140122254
mov rax, qword gs:[0x58]
mov ecx, r12d
mov rcx, qword [rax + rcx*8]
add rcx, rbx
cmp byte [rcx + 0xb], 0
je 0x140056014
xor byte [rcx], 0x8b
xor byte [rcx + 1], 0x4b
xor byte [rcx + 2], 0x41
xor byte [rcx + 3], 0x8f
xor byte [rcx + 4], 0x7b
xor byte [rcx + 5], 0xcd
xor byte [rcx + 6], 0x85
xor byte [rcx + 7], 0xb5
xor byte [rcx + 8], 0x8b
xor byte [rcx + 9], 0x4b
xor byte [rcx + 0xa], 0x41
mov byte [rcx + 0xb], 0
xor r9d, r9d
lea rdx, [rbp + 0x328]
mov r8b, 1
call fcn.140007760
lea rdx, [0x140710ffe]
lea rcx, str.Chams_CartelX
call fcn.140030af0
test al, al
je 0x14005604b
cmp byte [0x140710ffe], 0
je 0x14005604b
call fcn.14004b250
lea rdx, [0x140711002]
lea rcx, str.Chams_Red
call fcn.140030af0
test al, al
je 0x140056070
cmp byte [0x140711002], 0
je 0x140056070
call fcn.14004b1c0
lea rdx, [0x140710ffd]
lea rcx, str.Chams_3D
call fcn.140030af0
test al, al
je 0x1400560d9
cmp byte [0x140710ffd], 0
je 0x1400560d9
call fcn.140057170
mov rcx, rax
call fcn.1400570d0
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400560d9
mov rcx, rax
call fcn.14004b900
test al, al
je 0x1400560d0
lea rdx, [0x1403ad960]
mov rcx, rbx
call fcn.1400569c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call fcn.14000fa40
test al, al
je 0x1400560fa
call fcn.140007e70
lea rcx, str.Activar_en_Partida
call fcn.140037db0
call fcn.14000c0d0
call fcn.14000b520
mov rax, qword gs:[0x58]
mov ecx, r12d
mov dword [rbp + 0x330], 0x43960000
mov dword [rbp + 0x334], 0x438c0000
mov r8d, 0x2c0
mov rdx, qword [rax + rcx*8]
mov eax, 0x2cc
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x140056166
mov dword [rdx + r8 + 8], 0x1b1cdd4
or eax, 1
mov dword [rcx + rdx], eax
lea rcx, [0x140126110]
mov dword [rdx + r8], 0x2cffdadc
mov dword [rdx + r8 + 4], 0x25950efb
call fcn.140122254
mov rax, qword gs:[0x58]
mov ecx, r12d
mov rcx, qword [rax + rcx*8]
add rcx, rbx
cmp byte [rcx + 0xb], 0
je 0x1400561ae
xor byte [rcx], 0x91
xor byte [rcx + 1], 0x9f
xor byte [rcx + 2], 0xb1
xor byte [rcx + 3], 0x79
xor byte [rcx + 4], 0xdb
xor byte [rcx + 5], 0x41
xor byte [rcx + 6], 0xc1
xor byte [rcx + 7], 0x6d
xor byte [rcx + 8], 0x91
xor byte [rcx + 9], 0x9f
xor byte [rcx + 0xa], 0xb1
mov byte [rcx + 0xb], 0
xor r9d, r9d
lea rdx, [rbp + 0x330]
mov r8b, 1
call fcn.140007760
lea rdx, [0x140711003]
lea rcx, str.Night_Mode
call fcn.140030af0
test al, al
je 0x1400562e3
cmp byte [0x140711003], 0
je 0x1400562e3
lea rcx, [0x140711210]
call fcn.14004b730
mov rdx, rax
lea rcx, [0x140711210]
call fcn.14004b7e0
test eax, eax
je 0x140056224
mov r8d, eax
mov dword [0x140711240], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140711248], rax
mov ecx, reloc.WS2_32.dll_recv
call fcn.1401221a4
mov rbx, rax
test rax, rax
je 0x140056253
mov dword [rax], 0x3f7d70a4
mov dword [rax + 4], 0x3f13cd3a
mov dword [rax + 8], 0x3c23d70a
mov dword [rax + 0xc], 0xbf800000
jmp 0x140056256
mov rbx, r13
mov ecx, reloc.WS2_32.dll_recv
call fcn.1401221a4
test rax, rax
je 0x140056282
mov dword [rax], 0x3f7d70a4
mov dword [rax + 4], 0x3f13cd3a
mov dword [rax + 8], 0x3c23d70a
mov dword [rax + 0xc], 0x358637bd
jmp 0x140056285
mov rax, r13
mov byte [rsp + 0x28], 1
lea rcx, [0x140711210]
mov r9, rax
mov qword [rsp + 0x20], rbx
xor edx, edx
movabs r8, 0x7fffffffffff
call fcn.14004c7e0
lea rcx, [0x1406da958]
test al, al
je 0x1400562c4
mov r8d, reloc.WLDAP32.dll_Ordinal_33
lea rdx, str.NightMode_:_Successfully_applied_
jmp 0x1400562d1
mov r8d, reloc.WS2_32.dll_select
lea rdx, str.NightMode_:_Error_
call fcn.140038520
mov rcx, qword [0x140711248]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x14071109f]
lea rcx, str.No_Recoil
call fcn.140030af0
test al, al
je 0x14005630f
cmp byte [0x14071109f], 0
je 0x14005630f
lea rcx, [0x140711210]
call fcn.14004d700
call fcn.14000b520
call fcn.14000bd20
movaps xmm1, xmm9
movaps xmm0, xmm7
call fcn.140019e20
call fcn.140007d20
mov rax, qword gs:[0x58]
mov ecx, r12d
mov dword [rbp + 0x338], 0x43960000
mov dword [rbp + 0x33c], 0x438c0000
mov r8d, 0x2d0
mov rdx, qword [rax + rcx*8]
mov eax, 0x2dc
mov ecx, eax
mov ebx, r8d
mov eax, dword [rax + rdx]
test al, 1
jne 0x140056390
mov dword [rdx + r8 + 6], 0x15dcd4c
or eax, 1
mov dword [rcx + rdx], eax
lea rcx, [0x140125e90]
mov dword [rdx + r8], 0xd4f37e10
mov word [rdx + r8 + 4], 0xaa2f
call fcn.140122254
mov rax, qword gs:[0x58]
mov ecx, r12d
mov rcx, qword [rax + rcx*8]
add rcx, rbx
cmp byte [rcx + 9], 0
je 0x1400563d0
xor byte [rcx], 0x5d
xor byte [rcx + 1], 0x3b
xor byte [rcx + 2], 0xbd
xor byte [rcx + 3], 0x81
xor byte [rcx + 4], 0xf
xor byte [rcx + 5], 0xef
xor byte [rcx + 6], 0x1f
xor byte [rcx + 7], 0x9d
xor byte [rcx + 8], 0x5d
mov byte [rcx + 9], 0
xor r9d, r9d
lea rdx, [rbp + 0x338]
mov r8b, 1
call fcn.140007760
lea rdx, [0x140711000]
lea rcx, str.Chams_Esp_Box_V1
call fcn.140030af0
test al, al
je 0x14005644b
cmp byte [0x140711000], 0
je 0x14005644b
call fcn.140057170
mov rcx, rax
call fcn.1400570d0
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14005644b
mov rcx, rax
call fcn.14004b900
test al, al
je 0x140056442
lea rdx, [0x14033ff60]
mov rcx, rbx
call fcn.1400569c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x140711001]
lea rcx, str.Chams_Esp_Box_V2
call fcn.140030af0
xor ecx, ecx
call fcn.14000fa40
test al, al
je 0x14005647f
call fcn.140007e70
lea rcx, str.Activar_en_Partida
call fcn.140037db0
call fcn.14000c0d0
call fcn.14000b520
call fcn.14000bd20
mov r14d, 1
mov ecx, r14d
call fcn.140016580
cmp byte [0x140711100], 0
je 0x140056618
cmp byte [0x140710fd8], 0
lea ecx, [r14 + 1]
je 0x1400565c8
call fcn.1401221a4
mov rbx, rax
test rax, rax
je 0x1400564c9
mov word [rax], 0x100
jmp 0x1400564cc
mov rbx, r13
mov ecx, 0x81
call fcn.1401221a4
test rax, rax
je 0x1400565a3
mov qword [rax], 0
mov qword [rax + 8], 0
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0
mov dword [rax + 0x20], 0x3f000000
mov dword [rax + 0x24], 0x3f3f3f3f
mov qword [rax + 0x28], 0x3f3f
mov qword [rax + 0x30], 0
mov dword [rax + 0x38], 0x3f800000
mov dword [rax + 0x3c], 0x3f3f3f3f
mov dword [rax + 0x40], 0x3f3f3f3f
mov dword [rax + 0x44], 0x3f3f3f3f
mov dword [rax + 0x48], 0x3f
mov dword [rax + 0x4c], 0x3f3f0000
mov dword [rax + 0x50], 0x3f3f3f3f
mov dword [rax + 0x54], 0x3f3f3f3f
mov dword [rax + 0x58], 0x3f3f3f3f
mov dword [rax + 0x5c], 0x3f3f3f3f
mov dword [rax + 0x60], 0x3f3f3f3f
mov dword [rax + 0x64], 0x3f3f3f3f
mov dword [rax + 0x68], 0x3f3f3f07
mov dword [rax + 0x6c], 0x3f3f3f3f
mov dword [rax + 0x70], 0x3f3f3f08
mov dword [rax + 0x74], 0x3f3f3f3f
mov dword [rax + 0x78], 0x3f3f3f3f
mov dword [rax + 0x7c], 0x3f3f3f3f
mov byte [rax + 0x80], Ordinal_41
jmp 0x1400565a6
mov rax, r13
mov r9, rax
mov qword [rsp + 0x20], rbx
xor edx, edx
lea rcx, [0x140711210]
movabs r8, 0x7fffffffffff
call fcn.14004bff0
jmp 0x140056618
call fcn.1401221a4
mov rbx, rax
test rax, rax
je 0x1400565dc
xor eax, eax
mov word [rbx], ax
jmp 0x1400565df
mov rbx, r13
mov ecx, 2
call fcn.1401221a4
test rax, rax
je 0x1400565f5
xor ecx, ecx
mov word [rax], cx
jmp 0x1400565f8
mov rax, r13
mov r9, rax
mov qword [rsp + 0x20], rbx
xor edx, edx
lea rcx, [0x140711210]
movabs r8, 0x7fffffffffff
call fcn.14004db80
call fcn.14000afe0
mov rdx, qword [rbp + 0x390]
cmp rdx, 0xf
jbe 0x14005665e
mov rcx, qword [rbp + 0x378]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056659
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056959
call fcn.140121be4
mov rdx, qword [rbp + 0x188]
mov qword [rbp + 0x388], r13
mov qword [rbp + 0x390], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x378], 0
cmp rdx, 0xf
jbe 0x1400566b8
mov rcx, qword [rbp + 0x170]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400566b3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056959
call fcn.140121be4
mov rdx, qword [rbp + 0x1a8]
mov qword [rbp + 0x180], r13
mov qword [rbp + 0x188], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x170], 0
cmp rdx, 0xf
jbe 0x140056712
mov rcx, qword [rbp + 0x190]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005670d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056959
call fcn.140121be4
mov rdx, qword [rbp + 0x138]
mov qword [rbp + 0x1a0], r13
mov qword [rbp + 0x1a8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x190], 0
cmp rdx, 0xf
jbe 0x14005676c
mov rcx, qword [rbp + 0x120]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056767
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056959
call fcn.140121be4
mov rdx, qword [rbp + 0x1c8]
mov qword [rbp + 0x130], r13
mov qword [rbp + 0x138], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x120], 0
cmp rdx, 0xf
jbe 0x1400567c6
mov rcx, qword [rbp + 0x1b0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400567c1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056959
call fcn.140121be4
lea rcx, [rbp + 0x5d0]
mov qword [rbp + 0x1c0], r13
mov qword [rbp + 0x1c8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1b0], 0
call fcn.14002fd20
lea rcx, [rbp + 0x3f0]
call fcn.14002fd20
movabs r12, 0x7fffffffffffffff
call fcn.14004c0e0
call fcn.140016dd0
mov rcx, qword [0x140711378]
lea r8, [0x140711658]
xorps xmm0, xmm0
xor r9d, r9d
movups xmmword [rbp + 0xb38], xmm0
mov edx, r14d
mov rax, qword [rcx]
call qword [rax + 0x108]
mov rcx, qword [0x140711378]
lea r8, [rbp + 0xb38]
mov rdx, qword [0x140711658]
mov rax, qword [rcx]
call qword [rax + 0x190]
call fcn.14000d8c0
mov rcx, rax
call fcn.14003abb0
mov rcx, qword [0x140711650]
xor r8d, r8d
mov edx, r14d
mov rax, qword [rcx]
call qword [rax + 0x40]
mov ebx, dword [rbp + 0x11c]
mov r15d, 0xa
mov rsi, qword [rbp + 0x340]
jmp 0x140050530
call fcn.14003b7f0
call fcn.14003bde0
xor ecx, ecx
call fcn.14000af60
call fcn.14004afa0
mov rcx, rsi
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0x608]
mov rcx, qword [rbp + 0x630]
call qword [sym.imp.USER32.dll_UnregisterClassW]
lea rcx, [rbp + 0x410]
call fcn.14002fd20
xor eax, eax
jmp 0x1400502b3
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x1401297f4]
call fcn.140046ad0
lea rdx, [0x140048190]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x1401297f4]
call fcn.140046ad0
lea rdx, [0x140048190]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x1401297f4]
call fcn.140046ad0
lea rdx, [0x140048190]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xor r9d, r9d
lea rdx, str.____Run_the_program_as_admin
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.start_cmd__c_START_CMD__C__COLOR_C__TITLE_Protection__ECHO_KsDumper_Detected.__TIMEOUT_10__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.14004d8b0
mov ecx, 0x9d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.1400384e0
int3
call fcn.140020110
int3
call fcn.1400384e0
int3