Function at 0x140057fd0
Capabilities:
Create process on windows
Create thread
Download url
Enumerate processes
Execute command
Log keystrokes via polling
Receive data
Set registry value
Terminate process

Disassembly:
push rbp
push rbx
push r12
lea rbp, [rsp - 0xa50]
sub rsp, 0xb50
lea rdx, [rbp + 0x830]
xor r12d, r12d
lea rdx, [rdx + 0x80]
mov qword [rsp + 0x20], r12
lea rbx, [0x140000000]
xor r9d, r9d
movups xmm0, xmmword [rbx + 0x16b550]
lea rcx, [rbx + 0x16b550]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
mov eax, dword [rcx + 0x30]
lea r8, [rbp - 0x70]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rcx]
movups xmmword [rdx - 0x20], xmm0
movups xmm0, xmmword [rcx - 0x10]
movups xmmword [rdx - 0x10], xmm0
movups xmm0, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm1
movups xmm1, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [str.C:WindowsTempprueba.dll]
movups xmmword [rdx + 0x20], xmm1
mov dword [rdx + 0x30], eax
movzx eax, word [rcx + 0x34]
mov word [rdx + 0x34], ax
movzx eax, byte [rcx + 0x36]
xor ecx, ecx
mov byte [rdx + 0x36], al
lea rdx, [rbp + 0x830]
movzx eax, word [0x14016b460]
mov word [rbp - 0x58], ax
movzx eax, byte [0x14016b462]
movups xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x56], al
movsd xmm0, qword [0x14016b458]
movsd qword [rbp - 0x60], xmm0
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x16b610]
lea rax, [rbx + 0x16b610]
mov qword [rsp + 0x20], r12
movups xmm1, xmmword [rax + 0x10]
lea rcx, [rbp + 0x830]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx + 0x60], xmm0
movups xmm0, xmmword [rax + 0x80]
movups xmmword [rcx + 0x70], xmm1
movups xmm1, xmmword [rax + 0x90]
movups xmmword [rcx + 0x80], xmm0
movups xmm0, xmmword [rax + 0xa0]
mov rax, qword [rax + 0xb0]
movups xmmword [rcx + 0x90], xmm1
movups xmmword [rcx + 0xa0], xmm0
mov qword [rcx + 0xb0], rax
movups xmm0, xmmword [str.C:WindowsTempmoco.ll.dll]
mov eax, dword [0x14016b490]
mov dword [rbp - 0x58], eax
movups xmmword [rbp - 0x70], xmm0
movsd xmm0, qword [0x14016b488]
movsd qword [rbp - 0x60], xmm0
xor r9d, r9d
lea r8, [rbp - 0x70]
lea rdx, [rbp + 0x830]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x16b6d0]
lea rcx, [rbx + 0x16b6d0]
xor r9d, r9d
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp + 0x830]
mov qword [rsp + 0x20], r12
movups xmmword [rdx], xmm0
lea r8, [rbp - 0x50]
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + 0x80]
mov rax, qword [rcx + 0x30]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [0x14016b4a8]
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rax
mov eax, dword [rcx + 0x38]
movups xmm0, xmmword [str.C:WindowsTempChamsBlanca_1.dll]
mov dword [rdx + 0x38], eax
movzx eax, word [rcx + 0x3c]
xor ecx, ecx
mov word [rdx + 0x3c], ax
lea rdx, [rbp + 0x830]
movzx eax, word [0x14016b4b8]
mov word [rbp - 0x30], ax
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm1
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [rbx + 0x16b790]
lea rcx, [rbx + 0x16b790]
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp + 0x830]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + 0x80]
mov rax, qword [rcx + 0x30]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rax
mov eax, dword [rcx + 0x38]
mov dword [rdx + 0x38], eax
movzx eax, word [rcx + 0x3c]
mov word [rdx + 0x3c], ax
movups xmm0, xmmword [str.C:WindowsTempPERSONAJES_3D.dll]
movzx eax, word [0x14016b4e0]
xor r9d, r9d
movups xmm1, xmmword [0x14016b4d0]
lea r8, [rbp - 0x50]
mov word [rbp - 0x30], ax
lea rdx, [rbp + 0x830]
mov qword [rsp + 0x20], r12
xor ecx, ecx
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm1
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov eax, dword [0x14016b880]
lea r8, [rbp - 0x70]
movups xmm0, xmmword [str.https:__github.com_edsonpepe_dll_raw_main_glew32.dll]
mov dword [rbp + 0x30], eax
xor r9d, r9d
movzx eax, byte [0x14016b884]
lea rdx, [rbp]
movups xmm1, xmmword [0x14016b860]
mov byte [rbp + 0x34], al
xor ecx, ecx
movzx eax, word [0x14016b500]
movups xmmword [rbp], xmm0
mov word [rbp - 0x58], ax
movups xmm0, xmmword [0x14016b870]
movzx eax, byte [0x14016b502]
movups xmmword [rbp + 0x10], xmm1
mov byte [rbp - 0x56], al
movups xmmword [rbp + 0x20], xmm0
mov qword [rsp + 0x20], r12
movups xmm0, xmmword [str.C:WindowsTempglew32.dll]
movups xmmword [rbp - 0x70], xmm0
movsd xmm0, qword [0x14016b4f8]
movsd qword [rbp - 0x60], xmm0
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov eax, dword [0x14016b8b8]
lea r8, [rbp - 0x70]
movups xmm0, xmmword [str.https:__github.com_edsonpepe_dll_raw_main_glew64.dll]
mov dword [rbp + 0x30], eax
xor r9d, r9d
movzx eax, byte [0x14016b8bc]
lea rdx, [rbp]
movups xmm1, xmmword [0x14016b898]
mov byte [rbp + 0x34], al
xor ecx, ecx
movzx eax, word [0x14016b520]
movups xmmword [rbp], xmm0
mov word [rbp - 0x58], ax
movups xmm0, xmmword [0x14016b8a8]
movzx eax, byte [0x14016b522]
movups xmmword [rbp + 0x10], xmm1
mov byte [rbp - 0x56], al
movups xmmword [rbp + 0x20], xmm0
mov qword [rsp + 0x20], r12
movups xmm0, xmmword [str.C:WindowsTempglew64.dll]
movups xmmword [rbp - 0x70], xmm0
movsd xmm0, qword [0x14016b518]
movsd qword [rbp - 0x60], xmm0
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmm0, xmmword [str.https:__github.com_cracker90900_dll_raw_main_BLACKBULLMENU.dll]
mov eax, dword [0x14016b8f8]
movups xmm1, xmmword [0x14016b8d0]
mov dword [rbp + 0x38], eax
movzx eax, word [0x14016b8fc]
movups xmmword [rbp], xmm0
mov word [rbp + 0x3c], ax
movups xmm0, xmmword [0x14016b8e0]
movzx eax, byte [0x14016b8fe]
movups xmmword [rbp + 0x10], xmm1
mov byte [rbp + 0x3e], al
movups xmm1, xmmword [0x14016b538]
movzx eax, word [0x14016b548]
movups xmmword [rbp + 0x20], xmm0
mov word [rbp - 0x30], ax
movsd xmm0, qword [0x14016b8f0]
movsd qword [rbp + 0x30], xmm0
movups xmm0, xmmword [str.C:WindowsTempBLACKBULLMENU.dll]
mov qword [rsp + 0x20], r12
movups xmmword [rbp - 0x40], xmm1
movups xmmword [rbp - 0x50], xmm0
xor r9d, r9d
lea r8, [rbp - 0x50]
lea rdx, [rbp]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movaps xmm0, xmmword [str.https:__github.com_edsonpepe_dll_raw_main_1266365991831470162.wav]
lea r8, [rbp - 0x50]
movaps xmm1, xmmword [0x14016b910]
lea rdx, [rbp + 0x7e0]
movzx eax, word [0x14016b940]
xor r9d, r9d
movaps xmmword [rbp + 0x7e0], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x14016b920]
movaps xmmword [rbp + 0x7f0], xmm1
movaps xmm1, xmmword [0x14016b930]
mov word [rbp + 0x820], ax
movzx eax, word [0x140169870]
movaps xmmword [rbp + 0x800], xmm0
movups xmm0, xmmword [str.C:Windows1266365991831470162.wav]
mov word [rbp - 0x30], ax
movzx eax, byte [0x140169872]
movaps xmmword [rbp + 0x810], xmm1
movups xmm1, xmmword [0x140169860]
mov byte [rbp - 0x2e], al
movups xmmword [rbp - 0x50], xmm0
mov qword [rsp + 0x20], r12
movups xmmword [rbp - 0x40], xmm1
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov eax, dword [0x14016b980]
lea r8, [rbp - 0x70]
movups xmm0, xmmword [str.https:__github.com_cracker90900_dll_raw_main_blackbullvoz.wav]
mov dword [rbp + 0x38], eax
xor r9d, r9d
movzx eax, word [0x14016b984]
lea rdx, [rbp]
movups xmm1, xmmword [0x14016b958]
mov word [rbp + 0x3c], ax
xor ecx, ecx
mov eax, dword [0x14016b9a0]
movups xmmword [rbp], xmm0
mov dword [rbp - 0x58], eax
movups xmm0, xmmword [0x14016b968]
mov qword [rsp + 0x20], r12
movups xmmword [rbp + 0x10], xmm1
movups xmmword [rbp + 0x20], xmm0
movsd xmm0, qword [0x14016b978]
movsd qword [rbp + 0x30], xmm0
movups xmm0, xmmword [str.C:Windows_blackbullvoz.wav]
movups xmmword [rbp - 0x70], xmm0
movsd xmm0, qword [0x14016b998]
movsd qword [rbp - 0x60], xmm0
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
call fcn.140053500
xor r9d, r9d
mov qword [rsp + 0x28], r12
lea r8, [0x140052490]
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], r12
lea r8, [0x1400525d0]
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 8
call fcn.140129c04
lea rcx, [0x1400516f0]
mov r9, rax
lea r8, [0x14005f2c0]
xor edx, edx
mov qword [rax], rcx
lea rcx, [rbp - 8]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], r12d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x10], rax
test rax, rax
je 0x14005cd3d
cmp dword [rbp - 8], r12d
je 0x14005cd31
movaps xmm0, xmmword [rbp - 0x10]
lea rcx, [rbp + 0x330]
movdqa xmmword [rbp + 0x330], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14005cd31
xorps xmm0, xmm0
mov qword [rsp + 0xb70], rsi
movdqa xmmword [rbp - 0x10], xmm0
call fcn.140051750
lea rcx, [0x140327d70]
call fcn.1400d3c20
cmp dword [0x140306a48], r12d
jne 0x140058677
call fcn.14005f510
call fcn.14005f470
mov dword [0x140306a48], eax
mov qword [rsp + 0xb78], rdi
call fcn.14005f510
mov ebx, dword [0x140306a48]
mov rsi, rax
mov dword [rax + 8], ebx
test ebx, ebx
jne 0x140058707
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rbp + 0x830]
mov dword [rbp + 0x830], 0x130
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rbp + 0x830]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140058700
lea rdx, str.HD_Player.exe
lea rcx, [rbp + 0x85c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
mov ebx, dword [rbp + 0x838]
lea rdx, [rbp + 0x830]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400586d2
mov dword [rsi + 8], ebx
test ebx, ebx
je 0x14005871a
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsi], rax
lea rcx, [0x140327d70]
call fcn.1400d3c20
cmp byte [0x140327f88], r12b
jne 0x140058760
lea rcx, [0x140327f90]
call fcn.140043980
mov rdx, rax
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rax, [0x14005cf60]
mov qword [rsp + 0xb40], r15
mov edx, 0x7f00
mov qword [rbp + 0x398], rax
xor ecx, ecx
mov dword [rbp + 0x390], 0x50
mov dword [rbp + 0x394], 0x40
mov qword [rbp + 0x3a0], r12
mov qword [rbp + 0x3a8], r12
call qword [sym.imp.USER32.dll_LoadIconA]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rbp + 0x3b0], rax
call qword [sym.imp.USER32.dll_LoadCursorA]
lea rdi, str.BLACK_BULL
mov qword [rbp + 0x3c0], r12
mov qword [rbp + 0x3b8], rax
mov edx, 0x7f00
lea rax, str.ImGui
mov qword [rbp + 0x3d0], rdi
xor ecx, ecx
mov qword [rbp + 0x3c8], rax
call qword [sym.imp.USER32.dll_LoadIconA]
lea rcx, [rbp + 0x390]
mov qword [rbp + 0x3d8], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov r15d, 1
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
xor ecx, ecx
sub eax, edx
sar eax, 1
lea ebx, [rax - 0x122]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov qword [rsp + 0x58], r12
mov r9d, 0x80000000
mov qword [rsp + 0x50], r12
cdq
mov qword [rsp + 0x48], r12
sub eax, edx
mov rdx, qword [rbp + 0x3d0]
mov r8, rdi
mov qword [rsp + 0x40], r12
xor ecx, ecx
mov dword [rsp + 0x38], 0x244
sar eax, 1
sub eax, 0x1f4
mov dword [rsp + 0x30], 0x3e8
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
movdqa xmm0, xmmword [0x14016cbf0]
lea rdx, [rbp + 0x6d8]
mov rcx, rax
mov qword [0x140306a28], rax
movdqu xmmword [rbp + 0x6d8], xmm0
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rcx, qword [0x140306a28]
lea rdx, [0x140306a38]
xorps xmm0, xmm0
movups xmmword [0x140306a38], xmm0
call qword [sym.imp.USER32.dll_GetWindowRect]
call fcn.14005cd50
test al, al
jne 0x1400588e3
call fcn.14005cee0
mov rdx, qword [rbp + 0x3a8]
mov rcx, qword [rbp + 0x3d0]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov eax, r15d
jmp 0x14005ccb3
mov rcx, qword [0x140306a28]
mov edx, 0xa
mov qword [rsp + 0xb48], r14
movaps xmmword [rsp + 0xb30], xmm6
movaps xmmword [rsp + 0xb20], xmm7
movaps xmmword [rsp + 0xb10], xmm8
movaps xmmword [rsp + 0xb00], xmm9
movaps xmmword [rsp + 0xaf0], xmm10
movaps xmmword [rsp + 0xae0], xmm11
movaps xmmword [rsp + 0xad0], xmm12
movaps xmmword [rsp + 0xac0], xmm13
movaps xmmword [rsp + 0xab0], xmm14
movaps xmmword [rsp + 0xaa0], xmm15
call qword [sym.imp.USER32.dll_ShowWindow]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x140306a28]
call qword [sym.imp.USER32.dll_UpdateWindow]
call fcn.140006c30
call fcn.140008bf0
lea rcx, [rbp + 0x830]
mov rbx, rax
or dword [rax], 3
call fcn.140029fb0
movss xmm15, dword [0x14016cac0]
lea rax, [rbp + 0x830]
mov rcx, qword [rbx + 0x50]
lea rdi, [0x140164f60]
mov qword [rsp + 0x28], rdi
lea rdx, [0x1401d2a10]
movaps xmm3, xmm15
mov qword [rsp + 0x20], rax
mov r8d, 0x26368
mov dword [rbp + 0x87c], 0x10c
call fcn.14002aab0
movss xmm3, dword [0x14016cab8]
lea rdx, [0x1401d2a10]
mov rcx, qword [rbx + 0x50]
mov r8d, 0x26368
mov qword [0x140306a10], rax
lea rax, [rbp + 0x830]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.14002aab0
movss xmm3, dword [0x14016cad8]
lea rdx, [0x1402e07b0]
mov rcx, qword [rbx + 0x50]
mov r8d, 0xf40
mov qword [0x140306a88], rax
lea rax, [rbp + 0x830]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.14002aab0
mov rcx, qword [rbx + 0x50]
lea rdx, [0x1402bae50]
mov qword [0x140306a90], rax
movaps xmm3, xmm15
lea rax, [rbp + 0x830]
mov qword [rsp + 0x28], rdi
mov r8d, 0x25958
mov qword [rsp + 0x20], rax
call fcn.14002aab0
movss xmm3, dword [0x14016cae0]
lea rdx, [0x1402bae50]
mov rcx, qword [rbx + 0x50]
mov r8d, 0x25958
mov qword [0x140306a80], rax
lea rax, [rbp + 0x830]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.14002aab0
movss xmm3, dword [0x14016cacc]
lea rdx, [0x1402e16f0]
mov rcx, qword [rbx + 0x50]
mov r8d, 0x954
mov qword [0x140306a18], rax
lea rax, [rbp + 0x830]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.14002aab0
mov rcx, qword [rbx + 0x50]
lea rdx, [0x14020aea0]
mov qword [0x140306a78], rax
movaps xmm3, xmm15
lea rax, [rbp + 0x830]
mov qword [rsp + 0x28], rdi
mov r8d, 0x4d2c4
mov qword [rsp + 0x20], rax
call fcn.14002aab0
movss xmm7, dword [0x14016caec]
lea rdx, [0x1402e23c0]
mov rcx, qword [rbx + 0x50]
movaps xmm3, xmm7
mov qword [rsp + 0x28], rdi
mov r8d, 0x20fe0
mov qword [0x140306a08], rax
mov qword [rsp + 0x20], r12
call fcn.14002aab0
cmp qword [0x1403069c8], r12
mov qword [rbp + 0x360], rax
jne 0x140058b90
mov rcx, qword [0x140306a58]
lea rax, [0x1403069c8]
mov qword [rsp + 0x30], r12
lea r9, [0x140305728]
mov qword [rsp + 0x28], rax
lea rdx, [0x140258a00]
mov qword [rsp + 0x20], rcx
mov r8d, 0x79a6
mov rcx, qword [0x14033c910]
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x140306998], r12
jne 0x140058bd7
mov rcx, qword [0x14033c910]
lea rax, [0x140306998]
mov qword [rsp + 0x30], r12
lea r9, [0x140305728]
mov qword [rsp + 0x28], rax
lea rdx, [0x1401f8d80]
mov rax, qword [0x140306a58]
mov r8d, 0x10ea4
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x1403069e8], r12
jne 0x140058c1e
mov rcx, qword [0x14033c910]
lea rax, [0x1403069e8]
mov qword [rsp + 0x30], r12
lea r9, [0x140305728]
mov qword [rsp + 0x28], rax
lea rdx, [0x1403033a0]
mov rax, qword [0x140306a58]
mov r8d, 0xeb6
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x1403069e0], r12
jne 0x140058c65
mov rcx, qword [0x14033c910]
lea rax, [0x1403069e0]
mov qword [rsp + 0x30], r12
lea r9, [0x140305728]
mov qword [rsp + 0x28], rax
lea rdx, [0x1402e2050]
mov rax, qword [0x140306a58]
mov r8d, 0x36f
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x1403069a0], r12
jne 0x140058cac
mov rcx, qword [0x14033c910]
lea rax, [0x1403069a0]
mov qword [rsp + 0x30], r12
lea r9, [0x140305728]
mov qword [rsp + 0x28], rax
lea rdx, [0x140185110]
mov rax, qword [0x140306a58]
mov r8d, 0x4d8f3
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x1403069b0], r12
jne 0x140058cf3
mov rcx, qword [0x14033c910]
lea rax, [0x1403069b0]
mov qword [rsp + 0x30], r12
lea r9, [0x140305728]
mov qword [rsp + 0x28], rax
lea rdx, [0x140258170]
mov rax, qword [0x140306a58]
mov r8d, 0x88b
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x1403069a8], r12
jne 0x140058d3a
mov rcx, qword [0x14033c910]
lea rax, [0x1403069a8]
mov qword [rsp + 0x30], r12
lea r9, [0x140305728]
mov qword [rsp + 0x28], rax
lea rdx, [0x140209c30]
mov rax, qword [0x140306a58]
mov r8d, 0x103c
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x1403069d0], r12
jne 0x140058d81
mov rcx, qword [0x14033c910]
lea rax, [0x1403069d0]
mov qword [rsp + 0x30], r12
lea r9, [0x140305728]
mov qword [rsp + 0x28], rax
lea rdx, case.0x1400d0129.22
mov rax, qword [0x140306a58]
mov r8d, 0x8f30
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x1403069c0], r12
jne 0x140058dc8
mov rcx, qword [0x14033c910]
lea rax, [0x1403069c0]
mov qword [rsp + 0x30], r12
lea r9, [0x140305728]
mov qword [rsp + 0x28], rax
lea rdx, [0x1402603b0]
mov rax, qword [0x140306a58]
mov r8d, reloc.WLDAP32.dll_Ordinal_211
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x1403069b8], r12
jne 0x140058e0f
mov rcx, qword [0x14033c910]
lea rax, [0x1403069b8]
mov qword [rsp + 0x30], r12
lea r9, [0x140305728]
mov qword [rsp + 0x28], rax
lea rdx, [0x14020ac70]
mov rax, qword [0x140306a58]
mov r8d, 0x230
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x1403069d8], r12
jne 0x140058e56
mov rcx, qword [0x14033c910]
lea rax, [0x1403069d8]
mov qword [rsp + 0x30], r12
lea r9, [0x140305728]
mov qword [rsp + 0x28], rax
lea rdx, [0x140260490]
mov rax, qword [0x140306a58]
mov r8d, 0x51a88
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
call fcn.140046500
call fcn.140046110
movss xmm14, dword [0x14016cbb8]
xor bl, bl
movss xmm8, dword [0x14016c9a0]
xorps xmm13, xmm13
movss xmm10, dword [0x14016ca30]
movss xmm11, dword [0x14016c9dc]
movss xmm12, dword [0x14016ca60]
movss xmm9, dword [0x14016cb08]
mov dword [rbp - 0x80], ebx
mov qword [rsp + 0xb80], r13
movss xmm6, dword [0x14016cab0]
lea rcx, [rbp]
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor r8d, r8d
xor edx, edx
movabs r14, 0x7fffffffffff
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140058f19
lea rcx, [rbp]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp]
call qword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [rbp + 8], 0x12
lea rcx, [rbp]
movzx ebx, bl
cmove ebx, r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x140058ed4
mov dword [rbp - 0x80], ebx
test bl, bl
jne 0x14005ca1c
mov ecx, 0x7b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140058f51
lea rdx, [0x140057ae0]
lea rcx, [rbp + 0x6e8]
call fcn.14005dda0
mov rcx, rax
call fcn.140051540
cmp dword [rbp + 0x6f0], 0
jne 0x14005ccd7
mov ecx, reloc.WLDAP32.dll_Ordinal_46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x14005cd01
mov ecx, reloc.WLDAP32.dll_Ordinal_45
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140058f84
call fcn.140056c00
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x140306990]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140058fbc
lea rdx, [0x140057780]
lea rcx, [rbp + 0x6f8]
call fcn.14005dda0
mov rcx, rax
call fcn.140051540
cmp dword [rbp + 0x700], 0
jne 0x14005ccde
mov ecx, dword [0x1403069f8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140059046
lea rdx, [0x14016b120]
lea rcx, [rbp - 0x50]
call fcn.140043a10
lea rdx, [0x140159a4a]
mov rsi, rax
lea rcx, [rbp + 0x400]
call fcn.140043a10
lea rdx, [0x140159a4a]
mov rdi, rax
lea rcx, [rbp + 0x420]
call fcn.140043a10
lea rdx, [0x14016b120]
mov rbx, rax
lea rcx, [rbp + 0x3e0]
call fcn.140043a10
mov qword [rsp + 0x30], rsi
lea rcx, [0x1403056d0]
mov qword [rsp + 0x28], rdi
mov r9, r14
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rdx, rax
call fcn.1400558e0
mov ecx, dword [0x140306a4c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [0x1403069fc]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400591d5
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In1__dirin_actionblock_program__ProgramFiles_BlueStacks_nxtHD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In1__dirout_actionblock_program__ProgramFiles_Bluestacks_nxtHD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In2__dirin_actionblock_program__ProgramFiles_BlueStacksHD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In2__dirout_actionblock_program__ProgramFiles_BluestacksHD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In3__dirin_actionblock_program__ProgramFiles_BlueStacks_msi2HD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In3__dirout_actionblock_program__ProgramFiles_Bluestacks_msi2HD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In6__dirin_actionblock_program__ProgramFiles_BlueStacks_msi5HD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In6__dirout_actionblock_program__ProgramFiles_BlueStacks_msi5HD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In4__dirin_actionblock_program__ProgramData_BlueStacks_msi5HD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In4__dirout_actionblock_program__ProgramData_Bluestacks_msi5HD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In5__dirin_actionblock_program__ProgramFiles_x86__SmartGaGaProjectTitanEngineProjectTitan.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In5__dirout_actionblock_program__ProgramFiles_x86__SmartGaGaProjectTitanEngineProjectTitan.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
mov edx, 0x190
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, str.Fix_Lag_3_seg_Activado_
lea rcx, [0x140305708]
call fcn.140043990
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameall_program__ProgramFiles_BlueStacks_nxtHD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameall_program__ProgramFiles_BlueStacksHD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameall_program__ProgramFiles_BlueStacks_msi2HD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameall_program__ProgramFiles_BlueStacks_msi5HD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameall_program__ProgramData_BlueStacks_msi5HD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameall_program__ProgramFiles_x86__SmartGaGaProjectTitanEngineProjectTitan.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.Fix_Lag_3_seg_Desactivado_
lea rcx, [0x140305708]
call fcn.140043990
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_50
call fcn.140057a20
mov ecx, reloc.WLDAP32.dll_Ordinal_50
movzx r13d, al
call fcn.140057a20
mov ecx, 0x33
mov byte [rsp + 0x60], al
call fcn.140057a20
mov ecx, reloc.WS2_32.dll_WSASetLastError
mov byte [rsp + 0x61], al
call fcn.140057a20
mov ecx, WSAStartup
mov byte [rsp + 0x62], al
call fcn.140057a20
mov ecx, WSAStartup
mov byte [rsp + 0x63], al
call fcn.140057a20
mov ecx, reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x64], al
call fcn.140057a20
mov ecx, 0x51
mov byte [rsp + 0x65], al
call fcn.140057a20
mov ecx, 0x45
mov byte [rsp + 0x66], al
call fcn.140057a20
mov ecx, dword [0x140306970]
movzx r9d, byte [0x14030694b]
movzx r10d, byte [0x140306a71]
movzx r11d, byte [0x140306997]
movzx ebx, byte [0x140306981]
movzx edi, byte [0x140306a06]
movzx esi, byte [0x140306994]
movzx r14d, byte [0x14030694d]
movzx r15d, byte [0x14030694f]
movzx r12d, byte [0x140306a04]
mov byte [rsp + 0x67], al
cmp ecx, 1
jne 0x1400592d8
test r13b, r13b
je 0x140059492
movzx edx, byte [rsp + 0x60]
movzx ecx, byte [rsp + 0x61]
movzx r8d, byte [rsp + 0x62]
test r9b, r9b
jne 0x1400594a2
cmp byte [0x140306a69], r9b
sete byte [0x140306a69]
jmp 0x1400594a2
cmp ecx, 2
jne 0x140059311
movzx edx, byte [rsp + 0x60]
test dl, dl
je 0x140059497
movzx ecx, byte [rsp + 0x61]
movzx r8d, byte [rsp + 0x62]
test r10b, r10b
jne 0x1400594a2
cmp byte [0x140306a69], r10b
sete byte [0x140306a69]
jmp 0x1400594a2
cmp ecx, 3
jne 0x14005934a
movzx ecx, byte [rsp + 0x61]
movzx edx, byte [rsp + 0x60]
movzx r8d, byte [rsp + 0x62]
test cl, cl
je 0x1400594a2
test r11b, r11b
jne 0x1400594a2
cmp byte [0x140306a69], r11b
sete byte [0x140306a69]
jmp 0x1400594a2
cmp ecx, 4
jne 0x140059382
movzx r8d, byte [rsp + 0x62]
movzx edx, byte [rsp + 0x60]
test r8b, r8b
je 0x14005949d
movzx ecx, byte [rsp + 0x61]
test bl, bl
jne 0x1400594a2
cmp byte [0x140306a69], bl
sete byte [0x140306a69]
jmp 0x1400594a2
cmp ecx, 5
jne 0x1400593be
cmp byte [rsp + 0x63], 0
je 0x140059492
movzx edx, byte [rsp + 0x60]
movzx ecx, byte [rsp + 0x61]
movzx r8d, byte [rsp + 0x62]
test dil, dil
jne 0x1400594a2
cmp byte [0x140306a69], dil
sete byte [0x140306a69]
jmp 0x1400594a2
cmp ecx, 6
jne 0x1400593fa
cmp byte [rsp + 0x64], 0
je 0x140059492
movzx edx, byte [rsp + 0x60]
movzx ecx, byte [rsp + 0x61]
movzx r8d, byte [rsp + 0x62]
test sil, sil
jne 0x1400594a2
cmp byte [0x140306a69], sil
sete byte [0x140306a69]
jmp 0x1400594a2
cmp ecx, 7
jne 0x140059433
cmp byte [rsp + 0x65], 0
je 0x140059492
movzx edx, byte [rsp + 0x60]
movzx ecx, byte [rsp + 0x61]
movzx r8d, byte [rsp + 0x62]
test r14b, r14b
jne 0x1400594a2
cmp byte [0x140306a69], r14b
sete byte [0x140306a69]
jmp 0x1400594a2
cmp ecx, 8
jne 0x140059464
cmp byte [rsp + 0x66], 0
je 0x140059492
movzx edx, byte [rsp + 0x60]
movzx ecx, byte [rsp + 0x61]
movzx r8d, byte [rsp + 0x62]
test r15b, r15b
jne 0x1400594a2
cmp byte [0x140306a69], r15b
sete byte [0x140306a69]
jmp 0x1400594a2
cmp ecx, 9
jne 0x140059492
test al, al
je 0x140059492
movzx edx, byte [rsp + 0x60]
movzx ecx, byte [rsp + 0x61]
movzx r8d, byte [rsp + 0x62]
test r12b, r12b
jne 0x1400594a2
cmp byte [0x140306a69], r12b
sete byte [0x140306a69]
jmp 0x1400594a2
movzx edx, byte [rsp + 0x60]
movzx r8d, byte [rsp + 0x62]
movzx ecx, byte [rsp + 0x61]
mov eax, dword [0x140306a00]
cmp eax, 1
jne 0x1400594be
test r13b, r13b
je 0x140059553
test r9b, r9b
jmp 0x140059543
cmp eax, 2
jne 0x1400594d0
test dl, dl
je 0x140059553
test r10b, r10b
jmp 0x140059543
cmp eax, 3
jne 0x1400594e2
test cl, cl
je 0x140059553
test r11b, r11b
jmp 0x140059543
cmp eax, 4
jne 0x1400594f0
test r8b, r8b
je 0x140059553
test bl, bl
jmp 0x140059543
cmp eax, 5
jne 0x140059501
cmp byte [rsp + 0x63], 0
je 0x140059553
test dil, dil
jmp 0x140059543
cmp eax, 6
jne 0x140059512
cmp byte [rsp + 0x64], 0
je 0x140059553
test sil, sil
jmp 0x140059543
cmp eax, 7
jne 0x140059523
cmp byte [rsp + 0x65], 0
je 0x140059553
test r14b, r14b
jmp 0x140059543
cmp eax, 8
jne 0x140059534
cmp byte [rsp + 0x66], 0
je 0x140059553
test r15b, r15b
jmp 0x140059543
cmp eax, 9
jne 0x140059553
cmp byte [rsp + 0x67], 0
je 0x140059553
test r12b, r12b
jne 0x140059553
cmp byte [0x140306a6c], 0
sete byte [0x140306a6c]
mov eax, dword [0x14030698c]
cmp eax, 1
jne 0x14005956f
test r13b, r13b
je 0x140059604
test r9b, r9b
jmp 0x1400595f4
cmp eax, 2
jne 0x140059581
test dl, dl
je 0x140059604
test r10b, r10b
jmp 0x1400595f4
cmp eax, 3
jne 0x140059593
test cl, cl
je 0x140059604
test r11b, r11b
jmp 0x1400595f4
cmp eax, 4
jne 0x1400595a1
test r8b, r8b
je 0x140059604
test bl, bl
jmp 0x1400595f4
cmp eax, 5
jne 0x1400595b2
cmp byte [rsp + 0x63], 0
je 0x140059604
test dil, dil
jmp 0x1400595f4
cmp eax, 6
jne 0x1400595c3
cmp byte [rsp + 0x64], 0
je 0x140059604
test sil, sil
jmp 0x1400595f4
cmp eax, 7
jne 0x1400595d4
cmp byte [rsp + 0x65], 0
je 0x140059604
test r14b, r14b
jmp 0x1400595f4
cmp eax, 8
jne 0x1400595e5
cmp byte [rsp + 0x66], 0
je 0x140059604
test r15b, r15b
jmp 0x1400595f4
cmp eax, 9
jne 0x140059604
cmp byte [rsp + 0x67], 0
je 0x140059604
test r12b, r12b
jne 0x140059604
cmp byte [0x140306a66], 0
sete byte [0x140306a66]
mov eax, dword [0x140306968]
cmp eax, 1
jne 0x140059620
test r13b, r13b
je 0x1400596b5
test r9b, r9b
jmp 0x1400596a5
cmp eax, 2
jne 0x140059632
test dl, dl
je 0x1400596b5
test r10b, r10b
jmp 0x1400596a5
cmp eax, 3
jne 0x140059644
test cl, cl
je 0x1400596b5
test r11b, r11b
jmp 0x1400596a5
cmp eax, 4
jne 0x140059652
test r8b, r8b
je 0x1400596b5
test bl, bl
jmp 0x1400596a5
cmp eax, 5
jne 0x140059663
cmp byte [rsp + 0x63], 0
je 0x1400596b5
test dil, dil
jmp 0x1400596a5
cmp eax, 6
jne 0x140059674
cmp byte [rsp + 0x64], 0
je 0x1400596b5
test sil, sil
jmp 0x1400596a5
cmp eax, 7
jne 0x140059685
cmp byte [rsp + 0x65], 0
je 0x1400596b5
test r14b, r14b
jmp 0x1400596a5
cmp eax, 8
jne 0x140059696
cmp byte [rsp + 0x66], 0
je 0x1400596b5
test r15b, r15b
jmp 0x1400596a5
cmp eax, 9
jne 0x1400596b5
cmp byte [rsp + 0x67], 0
je 0x1400596b5
test r12b, r12b
jne 0x1400596b5
cmp byte [0x140306a6a], 0
sete byte [0x140306a6a]
mov eax, dword [0x140306a24]
cmp eax, 1
jne 0x1400596d1
test r13b, r13b
je 0x140059766
test r9b, r9b
jmp 0x140059756
cmp eax, 2
jne 0x1400596e3
test dl, dl
je 0x140059766
test r10b, r10b
jmp 0x140059756
cmp eax, 3
jne 0x1400596f5
test cl, cl
je 0x140059766
test r11b, r11b
jmp 0x140059756
cmp eax, 4
jne 0x140059703
test r8b, r8b
je 0x140059766
test bl, bl
jmp 0x140059756
cmp eax, 5
jne 0x140059714
cmp byte [rsp + 0x63], 0
je 0x140059766
test dil, dil
jmp 0x140059756
cmp eax, 6
jne 0x140059725
cmp byte [rsp + 0x64], 0
je 0x140059766
test sil, sil
jmp 0x140059756
cmp eax, 7
jne 0x140059736
cmp byte [rsp + 0x65], 0
je 0x140059766
test r14b, r14b
jmp 0x140059756
cmp eax, 8
jne 0x140059747
cmp byte [rsp + 0x66], 0
je 0x140059766
test r15b, r15b
jmp 0x140059756
cmp eax, 9
jne 0x140059766
cmp byte [rsp + 0x67], 0
je 0x140059766
test r12b, r12b
jne 0x140059766
cmp byte [0x140306a68], 0
sete byte [0x140306a68]
mov eax, dword [0x140306984]
cmp eax, 1
jne 0x140059782
test r13b, r13b
je 0x140059817
test r9b, r9b
jmp 0x140059807
cmp eax, 2
jne 0x140059794
test dl, dl
je 0x140059817
test r10b, r10b
jmp 0x140059807
cmp eax, 3
jne 0x1400597a6
test cl, cl
je 0x140059817
test r11b, r11b
jmp 0x140059807
cmp eax, 4
jne 0x1400597b4
test r8b, r8b
je 0x140059817
test bl, bl
jmp 0x140059807
cmp eax, 5
jne 0x1400597c5
cmp byte [rsp + 0x63], 0
je 0x140059817
test dil, dil
jmp 0x140059807
cmp eax, 6
jne 0x1400597d6
cmp byte [rsp + 0x64], 0
je 0x140059817
test sil, sil
jmp 0x140059807
cmp eax, 7
jne 0x1400597e7
cmp byte [rsp + 0x65], 0
je 0x140059817
test r14b, r14b
jmp 0x140059807
cmp eax, 8
jne 0x1400597f8
cmp byte [rsp + 0x66], 0
je 0x140059817
test r15b, r15b
jmp 0x140059807
cmp eax, 9
jne 0x140059817
cmp byte [rsp + 0x67], 0
je 0x140059817
test r12b, r12b
jne 0x140059817
cmp byte [0x140306a6d], 0
sete byte [0x140306a6d]
mov eax, dword [0x140306974]
cmp eax, 1
jne 0x14005983e
test r13b, r13b
je 0x14005989b
test r9b, r9b
jne 0x14005989b
cmp byte [0x140306a55], 0
sete al
mov byte [0x140306a55], al
jmp 0x1400598a2
cmp eax, 2
jne 0x14005984c
test dl, dl
je 0x14005989b
test r10b, r10b
jmp 0x14005982a
cmp eax, 3
jne 0x14005985a
test cl, cl
je 0x14005989b
test r11b, r11b
jmp 0x14005982a
cmp eax, 4
jne 0x140059868
test r8b, r8b
je 0x14005989b
test bl, bl
jmp 0x14005982a
cmp eax, 5
jne 0x140059879
cmp byte [rsp + 0x63], 0
je 0x14005989b
test dil, dil
jmp 0x14005982a
cmp eax, 6
jne 0x14005988a
cmp byte [rsp + 0x64], 0
je 0x14005989b
test sil, sil
jmp 0x14005982a
cmp eax, 7
jne 0x14005989b
cmp byte [rsp + 0x65], 0
je 0x14005989b
test r14b, r14b
jmp 0x14005982a
movzx eax, byte [0x140306a55]
mov ecx, dword [0x140306988]
cmp ecx, 8
jne 0x1400598b9
cmp byte [rsp + 0x66], 0
je 0x1400598d3
test r15b, r15b
jmp 0x1400598c8
cmp ecx, 9
jne 0x1400598d3
cmp byte [rsp + 0x67], 0
je 0x1400598d3
test r12b, r12b
jne 0x1400598d3
test al, al
sete byte [0x140306a55]
mov r8d, dword [0x140306a50]
cmp r8d, 1
jne 0x140059907
test r13b, r13b
je 0x1400599a0
test r9b, r9b
jne 0x1400599a0
cmp byte [0x140306a64], 0
sete dl
mov byte [0x140306a64], dl
jmp 0x1400599a7
cmp r8d, 2
jne 0x14005991a
test dl, dl
je 0x1400599a0
test r10b, r10b
jmp 0x1400598ec
cmp r8d, 3
jne 0x14005992c
cmp byte [rsp + 0x61], 0
je 0x1400599a0
test r11b, r11b
jmp 0x1400598ec
cmp r8d, 4
jne 0x14005993d
cmp byte [rsp + 0x62], 0
je 0x1400599a0
test bl, bl
jmp 0x1400598ec
cmp r8d, 5
jne 0x14005994f
cmp byte [rsp + 0x63], 0
je 0x1400599a0
test dil, dil
jmp 0x1400598ec
cmp r8d, 6
jne 0x140059961
cmp byte [rsp + 0x64], 0
je 0x1400599a0
test sil, sil
jmp 0x1400598ec
cmp r8d, 7
jne 0x140059976
cmp byte [rsp + 0x65], 0
je 0x1400599a0
test r14b, r14b
jmp 0x1400598ec
cmp r8d, 8
jne 0x14005998b
cmp byte [rsp + 0x66], 0
je 0x1400599a0
test r15b, r15b
jmp 0x1400598ec
cmp r8d, 9
jne 0x1400599a0
cmp byte [rsp + 0x67], 0
je 0x1400599a0
test r12b, r12b
jmp 0x1400598ec
movzx edx, byte [0x140306a64]
cmp ecx, 1
jne 0x1400599d6
test r13b, r13b
je 0x140059b38
movzx ecx, byte [rsp + 0x60]
test r9b, r9b
jne 0x140059b3d
cmp byte [0x140306a56], r9b
sete byte [0x140306a56]
jmp 0x140059b3d
cmp ecx, 2
jne 0x140059a04
movzx ecx, byte [rsp + 0x60]
test cl, cl
je 0x140059b3d
test r10b, r10b
jne 0x140059b3d
cmp byte [0x140306a56], r10b
sete byte [0x140306a56]
jmp 0x140059b3d
cmp ecx, 3
jne 0x140059a35
cmp byte [rsp + 0x61], 0
je 0x140059b38
movzx ecx, byte [rsp + 0x60]
test r11b, r11b
jne 0x140059b3d
cmp byte [0x140306a56], r11b
sete byte [0x140306a56]
jmp 0x140059b3d
cmp ecx, 4
jne 0x140059a64
cmp byte [rsp + 0x62], 0
je 0x140059b38
movzx ecx, byte [rsp + 0x60]
test bl, bl
jne 0x140059b3d
cmp byte [0x140306a56], bl
sete byte [0x140306a56]
jmp 0x140059b3d
cmp ecx, 5
jne 0x140059a95
cmp byte [rsp + 0x63], 0
je 0x140059b38
movzx ecx, byte [rsp + 0x60]
test dil, dil
jne 0x140059b3d
cmp byte [0x140306a56], dil
sete byte [0x140306a56]
jmp 0x140059b3d
cmp ecx, 6
jne 0x140059ac6
cmp byte [rsp + 0x64], 0
je 0x140059b38
movzx ecx, byte [rsp + 0x60]
test sil, sil
jne 0x140059b3d
cmp byte [0x140306a56], sil
sete byte [0x140306a56]
jmp 0x140059b3d
cmp ecx, 7
jne 0x140059aec
cmp byte [rsp + 0x65], 0
je 0x140059b38
movzx ecx, byte [rsp + 0x60]
test r14b, r14b
jne 0x140059b3d
cmp byte [0x140306a56], r14b
sete byte [0x140306a56]
jmp 0x140059b3d
cmp ecx, 8
jne 0x140059b12
cmp byte [rsp + 0x66], 0
je 0x140059b38
movzx ecx, byte [rsp + 0x60]
test r15b, r15b
jne 0x140059b3d
cmp byte [0x140306a56], r15b
sete byte [0x140306a56]
jmp 0x140059b3d
cmp ecx, 9
jne 0x140059b38
cmp byte [rsp + 0x67], 0
je 0x140059b38
movzx ecx, byte [rsp + 0x60]
test r12b, r12b
jne 0x140059b3d
cmp byte [0x140306a56], r12b
sete byte [0x140306a56]
jmp 0x140059b3d
movzx ecx, byte [rsp + 0x60]
mov eax, dword [0x140306978]
cmp eax, 1
jne 0x140059b59
test r13b, r13b
je 0x140059bf3
test r9b, r9b
jmp 0x140059be3
cmp eax, 2
jne 0x140059b6b
test cl, cl
je 0x140059bf3
test r10b, r10b
jmp 0x140059be3
cmp eax, 3
jne 0x140059b80
cmp byte [rsp + 0x61], 0
je 0x140059bf3
test r11b, r11b
jmp 0x140059be3
cmp eax, 4
jne 0x140059b90
cmp byte [rsp + 0x62], 0
je 0x140059bf3
test bl, bl
jmp 0x140059be3
cmp eax, 5
jne 0x140059ba1
cmp byte [rsp + 0x63], 0
je 0x140059bf3
test dil, dil
jmp 0x140059be3
cmp eax, 6
jne 0x140059bb2
cmp byte [rsp + 0x64], 0
je 0x140059bf3
test sil, sil
jmp 0x140059be3
cmp eax, 7
jne 0x140059bc3
cmp byte [rsp + 0x65], 0
je 0x140059bf3
test r14b, r14b
jmp 0x140059be3
cmp eax, 8
jne 0x140059bd4
cmp byte [rsp + 0x66], 0
je 0x140059bf3
test r15b, r15b
jmp 0x140059be3
cmp eax, 9
jne 0x140059bf3
cmp byte [rsp + 0x67], 0
je 0x140059bf3
test r12b, r12b
jne 0x140059bf3
cmp byte [0x140306a67], 0
sete byte [0x140306a67]
mov eax, dword [0x140306a74]
cmp eax, 1
jne 0x140059c0f
test r13b, r13b
je 0x140059cc5
test r9b, r9b
jmp 0x140059cb5
cmp eax, 2
jne 0x140059c24
test cl, cl
je 0x140059cc5
test r10b, r10b
jmp 0x140059cb5
cmp eax, 3
jne 0x140059c3c
cmp byte [rsp + 0x61], 0
je 0x140059cc5
test r11b, r11b
jmp 0x140059cb5
cmp eax, 4
jne 0x140059c50
cmp byte [rsp + 0x62], 0
je 0x140059cc5
test bl, bl
jmp 0x140059cb5
cmp eax, 5
jne 0x140059c73
cmp byte [rsp + 0x63], 0
je 0x140059cc5
test dil, dil
jne 0x140059cc5
cmp byte [0x140306a65], dil
sete al
mov byte [0x140306a65], al
jmp 0x140059ccc
cmp eax, 6
jne 0x140059c84
cmp byte [rsp + 0x64], 0
je 0x140059cc5
test sil, sil
jmp 0x140059cb5
cmp eax, 7
jne 0x140059c95
cmp byte [rsp + 0x65], 0
je 0x140059cc5
test r14b, r14b
jmp 0x140059cb5
cmp eax, 8
jne 0x140059ca6
cmp byte [rsp + 0x66], 0
je 0x140059cc5
test r15b, r15b
jmp 0x140059cb5
cmp eax, 9
jne 0x140059cc5
cmp byte [rsp + 0x67], 0
je 0x140059cc5
test r12b, r12b
jne 0x140059cc5
cmp byte [0x140306a6b], 0
sete byte [0x140306a6b]
movzx eax, byte [0x140306a65]
mov ecx, dword [0x140306a60]
cmp ecx, 1
jne 0x140059cfc
test r13b, r13b
je 0x140059e30
movzx ecx, byte [rsp + 0x60]
test r9b, r9b
jne 0x140059e35
test al, al
sete byte [0x140306a65]
jmp 0x140059e35
cmp ecx, 2
jne 0x140059d25
movzx ecx, byte [rsp + 0x60]
test cl, cl
je 0x140059e35
test r10b, r10b
jne 0x140059e35
test al, al
sete byte [0x140306a65]
jmp 0x140059e35
cmp ecx, 3
jne 0x140059d51
cmp byte [rsp + 0x61], 0
je 0x140059e30
movzx ecx, byte [rsp + 0x60]
test r11b, r11b
jne 0x140059e35
cmp ecx, 4
jne 0x140059d7c
cmp byte [rsp + 0x62], 0
je 0x140059e30
cmp ecx, 5
jne 0x140059da8
movzx ecx, byte [rsp + 0x60]
mov eax, dword [0x14030697c]
cmp eax, 1
jne 0x140059e6a
mov rbx, qword [0x140306950]
test rbx, rbx
je 0x14005ca36
mov rdi, qword [rbx + 0xa0]
test rdi, rdi
jne 0x14005ca5a
jmp 0x14005ca39
mov rdi, r12
mov r8d, 0x241
lea rdx, str.C:UserscrackOneDriveEscritorioImgui_Personalizado_backendsimgui_impl_dx11.cpp
lea rcx, str.bd___nullptr___No_renderer_backend_to_shutdown__or_already_shutdown__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x140306950]
test rbx, rbx
jne 0x14005ca80
mov r8d, 0x1033
lea rdx, str.C:UserscrackOneDriveEscritorioImgui_Personalizadoimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x140306950]
call fcn.140045fd0
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14005ca94
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi]
test rcx, rcx
je 0x14005caa2
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14005cab1
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
and dword [rbx + 0xc], 0xfffffff7
mov rax, qword [0x140306950]
mov qword [rbx + 0x90], r12
mov qword [rbx + 0xa0], r12
test rax, rax
je 0x14005cad5
dec dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [0x140306950]
test rax, rax
je 0x14005caf8
mov rbx, qword [rax + 0x98]
test rbx, rbx
jne 0x14005cb1c
jmp 0x14005cafb
mov rbx, r12
mov r8d, 0xb7
lea rdx, str.C:UserscrackOneDriveEscritorioImgui_Personalizado_backendsimgui_impl_win32.cpp
lea rcx, str.bd___nullptr___No_platform_backend_to_shutdown__or_already_shutdown__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [0x140306950]
test rax, rax
jne 0x14005cb42
mov r8d, 0x1033
lea rdx, str.C:UserscrackOneDriveEscritorioImgui_Personalizadoimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [0x140306950]
mov rcx, qword [rbx + 0x30]
lea rdi, [rax + 8]
test rcx, rcx
je 0x14005cb5c
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [0x140306950]
and dword [rdi + 4], 0xfffffff8
mov qword [rdi + 0x80], r12
mov qword [rdi + 0x90], r12
test rax, rax
je 0x14005cb79
dec dword [rax + 0xf4]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [0x140306950]
mov qword [0x140306950], rbx
call fcn.1400070b0
mov qword [0x140306950], r12
test rbx, rbx
je 0x14005cbc4
mov rcx, rbx
call fcn.140021e60
mov rax, qword [0x140306950]
test rax, rax
je 0x14005cbbb
dec dword [rax + 0xf4]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x14032c558]
test rcx, rcx
je 0x14005cbdd
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x14032c558], r12
mov rcx, qword [0x14033c8c8]
test rcx, rcx
je 0x14005cbf6
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x14033c8c8], r12
mov rcx, qword [0x14033c918]
test rcx, rcx
je 0x14005cc0f
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x14033c918], r12
mov rcx, qword [0x14033c910]
test rcx, rcx
je 0x14005cc28
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x14033c910], r12
mov rcx, qword [0x140306a28]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0x3a8]
mov rcx, qword [rbp + 0x3d0]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov r13, qword [rsp + 0xb80]
xor eax, eax
movaps xmm13, xmmword [rsp + 0xac0]
movaps xmm12, xmmword [rsp + 0xad0]
movaps xmm11, xmmword [rsp + 0xae0]
movaps xmm10, xmmword [rsp + 0xaf0]
movaps xmm9, xmmword [rsp + 0xb00]
movaps xmm8, xmmword [rsp + 0xb10]
movaps xmm7, xmmword [rsp + 0xb20]
movaps xmm6, xmmword [rsp + 0xb30]
movaps xmm14, xmmword [rsp + 0xab0]
mov r14, qword [rsp + 0xb48]
movaps xmm15, xmmword [rsp + 0xaa0]
mov r15, qword [rsp + 0xb40]
mov rdi, qword [rsp + 0xb78]
mov rsi, qword [rsp + 0xb70]
add rsp, 0xb50
pop r12
pop rbx
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
lea rcx, str.taskkill__f__im_HD_Player.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_Bluestacks.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_HD_Agent.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rbp - 8], r12d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3