Function at 0x140035260
Capabilities:
Create thread
Encode data using xor
Execute command
Manipulate console buffer
Move file
Set console window title
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x240]
sub rsp, 0x340
mov rax, qword [0x14004c028]
xor rax, rsp
mov qword [rbp + 0x230], rax
xor r12d, r12d
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r15, rax
movdqa xmm0, xmmword [0x1400432a0]
movdqu xmmword [rbp + 0x1e0], xmm0
mov dword [rbp + 0x1f0], 0x100f0ec
mov ecx, r12d
nop word [rax + rax]
lea eax, [rcx - 0x7c]
xor byte [rbp + rcx + 0x1e0], al
inc rcx
cmp rcx, 0x12
jb 0x1400352d0
mov byte [rbp + 0x1f3], r12b
lea r8, [rbp + 0x1f2]
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x1c0]
call fcn.14003ba20
nop
lea rcx, [rbp + 0x1c0]
call fcn.140034ae0
mov rbx, rax
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0x10
jb 0x140035358
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035353
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140035353
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003c864
test rbx, rbx
jne 0x14003608e
movdqa xmm0, xmmword [0x140043290]
movdqu xmmword [rbp + 0x1e0], xmm0
mov dword [rbp + 0x1f0], 0x100f0ec
mov rcx, r12
nop
lea eax, [rcx - 0x7c]
xor byte [rbp + rcx + 0x1e0], al
inc rcx
cmp rcx, 0x12
jb 0x140035380
mov byte [rbp + 0x1f3], 0
lea r8, [rbp + 0x1f2]
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x1c0]
call fcn.14003ba20
nop
lea rcx, [rbp + 0x1c0]
call fcn.140034ae0
mov rbx, rax
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0x10
jb 0x140035408
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035403
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140035403
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003c864
test rbx, rbx
jne 0x14003608e
movdqa xmm0, xmmword [0x1400431b0]
movdqu xmmword [rbp + 0x1e0], xmm0
mov dword [rbp + 0x1f0], 0xf3edf1
mov byte [rbp + 0x1f4], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx - 0x7c]
xor byte [rbp + rcx + 0x1e0], al
inc rcx
cmp rcx, 0x13
jb 0x140035440
mov byte [rbp + 0x1f4], 0
lea r8, [rbp + 0x1f3]
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x1c0]
call fcn.14003ba20
nop
lea rcx, [rbp + 0x1c0]
call fcn.140034ae0
mov rbx, rax
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0x10
jb 0x1400354c8
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400354c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400354c3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003c864
test rbx, rbx
jne 0x14003608e
movdqa xmm0, xmmword [0x1400432c0]
movdqu xmmword [rbp + 0x1e0], xmm0
mov dword [rbp + 0x1f0], 0xeff3bbe3
mov word [rbp + 0x1f4], 0xfd
mov byte [rbp + 0x1f6], 1
mov rcx, r12
nop
lea eax, [rcx - 0x7c]
xor byte [rbp + rcx + 0x1e0], al
inc rcx
cmp rcx, 0x15
jb 0x140035500
mov byte [rbp + 0x1f6], 0
lea r8, [rbp + 0x1f5]
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x1c0]
call fcn.14003ba20
nop
lea rcx, [rbp + 0x1c0]
call fcn.140034ae0
mov rbx, rax
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0x10
jb 0x140035588
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035583
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140035583
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003c864
test rbx, rbx
jne 0x14003608e
movdqa xmm0, xmmword [0x140043270]
movdqu xmmword [rbp + 0x1e0], xmm0
mov word [rbp + 0x1f0], 0xf1
mov byte [rbp + 0x1f2], 1
mov rcx, r12
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x7c]
xor byte [rbp + rcx + 0x1e0], al
inc rcx
cmp rcx, 0x11
jb 0x1400355c0
mov byte [rbp + 0x1f2], 0
lea r8, [rbp + 0x1f1]
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x1c0]
call fcn.14003ba20
nop
lea rcx, [rbp + 0x1c0]
call fcn.140034ae0
mov rbx, rax
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0x10
jb 0x140035648
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035643
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140035643
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003c864
test rbx, rbx
jne 0x14003608e
mov dword [rbp + 0x1b0], 0xe4e9f7f4
mov dword [rbp + 0x1b4], 0xa5e4e6e5
mov dword [rbp + 0x1b8], 0xebf5e9
mov byte [rbp + 0x1bc], 1
mov rcx, r12
nop dword [rax]
lea eax, [rcx - 0x7c]
xor byte [rbp + rcx + 0x1b0], al
inc rcx
cmp rcx, 0xb
jb 0x140035680
mov byte [rbp + 0x1bc], 0
lea r8, [rbp + 0x1bb]
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 0x1c0]
call fcn.14003ba20
nop
lea rcx, [rbp + 0x1c0]
call fcn.140034ae0
mov rbx, rax
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0x10
jb 0x140035708
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035703
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140035703
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003c864
test rbx, rbx
jne 0x14003608e
mov dword [rbp + 0x1b0], 0xf6e7e1ed
mov dword [rbp + 0x1b4], 0xeef2eca6
mov word [rbp + 0x1b8], pe_nt_image_headers64
mov rcx, r12
lea eax, [rcx - 0x7c]
xor byte [rbp + rcx + 0x1b0], al
inc rcx
cmp rcx, 8
jb 0x140035731
mov byte [rbp + 0x1b9], 0
lea r8, [rbp + 0x1b8]
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 0x1c0]
call fcn.14003ba20
nop
lea rcx, [rbp + 0x1c0]
call fcn.140034ae0
mov rbx, rax
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0x10
jb 0x1400357b9
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400357b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400357b4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003c864
test rbx, rbx
jne 0x14003608e
mov dword [rbp + 0x1b0], 0xf6e7e1ed
mov dword [rbp + 0x1b4], 0xeea4bdbe
mov dword [rbp + 0x1b8], 0x100e8f4
mov rcx, r12
lea eax, [rcx - 0x7c]
xor byte [rbp + rcx + 0x1b0], al
inc rcx
cmp rcx, 0xa
jb 0x1400357e3
mov byte [rbp + 0x1bb], 0
lea r8, [rbp + 0x1ba]
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 0x1c0]
call fcn.14003ba20
nop
lea rcx, [rbp + 0x1c0]
call fcn.140034ae0
mov rbx, rax
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0x10
jb 0x14003586b
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035866
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140035866
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003c864
test rbx, rbx
jne 0x14003608e
mov dword [rbp + 0x1b0], 0xe2f4ecd3
mov dword [rbp + 0x1b4], 0xf9ebe1fb
mov dword [rbp + 0x1b8], 0xf7eba3e7
mov word [rbp + 0x1bc], 0xf5
mov byte [rbp + 0x1be], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx - 0x7c]
xor byte [rbp + rcx + 0x1b0], al
inc rcx
cmp rcx, 0xd
jb 0x1400358b0
mov byte [rbp + 0x1be], 0
lea r8, [rbp + 0x1bd]
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 0x1c0]
call fcn.14003ba20
nop
lea rcx, [rbp + 0x1c0]
call fcn.140034ae0
mov rbx, rax
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0x10
jb 0x140035938
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035933
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140035933
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003c864
test rbx, rbx
jne 0x14003608e
mov dword [rbp + 0x1b0], 0xe3e2ecc2
mov dword [rbp + 0x1b4], 0xa5f8ece4
mov dword [rbp + 0x1b8], 0xebf5e9
mov byte [rbp + 0x1bc], 1
mov rcx, r12
nop dword [rax]
lea eax, [rcx - 0x7c]
xor byte [rbp + rcx + 0x1b0], al
inc rcx
cmp rcx, 0xb
jb 0x140035970
mov byte [rbp + 0x1bc], 0
lea r8, [rbp + 0x1bb]
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 0x1c0]
call fcn.14003ba20
nop
lea rcx, [rbp + 0x1c0]
call fcn.140034ae0
mov rbx, rax
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0x10
jb 0x1400359f8
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400359f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400359f3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003c864
test rbx, rbx
jne 0x14003608e
mov dword [rbp + 0x1b0], 0xe8e8e0dc
mov dword [rbp + 0x1b4], 0xa5bebffb
mov dword [rbp + 0x1b8], 0xebf5e9
mov byte [rbp + 0x1bc], 1
mov rcx, r12
nop dword [rax]
lea eax, [rcx - 0x7c]
xor byte [rbp + rcx + 0x1b0], al
inc rcx
cmp rcx, 0xb
jb 0x140035a30
mov byte [rbp + 0x1bc], 0
lea r8, [rbp + 0x1bb]
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 0x1c0]
call fcn.14003ba20
nop
lea rcx, [rbp + 0x1c0]
call fcn.140034ae0
mov rbx, rax
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0x10
jb 0x140035ab8
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035ab3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140035ab3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003c864
test rbx, rbx
jne 0x14003608e
movdqa xmm0, xmmword [0x1400432b0]
movdqu xmmword [rbp + 0x1e0], xmm0
mov word [rbp + 0x1f0], pe_nt_image_headers64
mov rcx, r12
nop dword [rax]
lea eax, [rcx - 0x7c]
xor byte [rbp + rcx + 0x1e0], al
inc rcx
cmp rcx, 0x10
jb 0x140035ae0
mov byte [rbp + 0x1f1], 0
lea r8, [rbp + 0x1f0]
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x1c0]
call fcn.14003ba20
nop
lea rcx, [rbp + 0x1c0]
call fcn.140034ae0
mov rbx, rax
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0x10
jb 0x140035b68
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035b63
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140035b63
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003c864
test rbx, rbx
jne 0x14003608e
movdqa xmm0, xmmword [0x1400432d0]
movdqu xmmword [rbp + 0x1e0], xmm0
movdqa xmm1, xmmword [0x140043160]
movdqu xmmword [rbp + 0x1f0], xmm1
mov dword [rbp + 0x200], 0xcec48596
mov dword [rbp + 0x204], 0xce8480dc
mov dword [rbp + 0x208], 0x100c8d4
mov rcx, r12
lea eax, [rcx - 0x7c]
xor byte [rbp + rcx + 0x1e0], al
inc rcx
cmp rcx, 0x2a
jb 0x140035bb2
mov byte [rbp + 0x20b], 0
lea r8, [rbp + 0x20a]
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x1c0]
call fcn.14003ba20
nop
lea rcx, [rbp + 0x1c0]
call fcn.140034ae0
mov rbx, rax
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0x10
jb 0x140035c3a
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035c35
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140035c35
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003c864
test rbx, rbx
jne 0x14003608e
mov dword [rbp + 0x1b0], 0xf2c2f6cf
mov dword [rbp + 0x1b4], 0xf9eff9e5
mov dword [rbp + 0x1b8], 0xeaf6e8a2
mov word [rbp + 0x1bc], pe_nt_image_headers64
mov rcx, r12
nop dword [rax]
lea eax, [rcx - 0x7c]
xor byte [rbp + rcx + 0x1b0], al
inc rcx
cmp rcx, 0xc
jb 0x140035c70
mov byte [rbp + 0x1bd], 0
lea r8, [rbp + 0x1bc]
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 0x1c0]
call fcn.14003ba20
nop
lea rcx, [rbp + 0x1c0]
call fcn.140034ae0
mov rbx, rax
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0x10
jb 0x140035cf8
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035cf3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140035cf3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003c864
test rbx, rbx
jne 0x14003608e
mov dword [rbp + 0x1b0], 0xe3b2b3fc
mov dword [rbp + 0x1b4], 0xeea4eeea
mov dword [rbp + 0x1b8], 0x100e8f4
mov rcx, r12
lea eax, [rcx - 0x7c]
xor byte [rbp + rcx + 0x1b0], al
inc rcx
cmp rcx, 0xa
jb 0x140035d22
mov byte [rbp + 0x1bb], 0
lea r8, [rbp + 0x1ba]
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 0x1c0]
call fcn.14003ba20
nop
lea rcx, [rbp + 0x1c0]
call fcn.140034ae0
mov rbx, rax
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0x10
jb 0x140035daa
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035da5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140035da5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003c864
test rbx, rbx
jne 0x14003608e
movdqa xmm0, xmmword [0x140043270]
movdqu xmmword [rbp + 0x1e0], xmm0
mov word [rbp + 0x1f0], 0xf1
mov byte [rbp + 0x1f2], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx - 0x7c]
xor byte [rbp + rcx + 0x1e0], al
inc rcx
cmp rcx, 0x11
jb 0x140035de0
mov byte [rbp + 0x1f2], 0
lea r8, [rbp + 0x1f1]
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x1c0]
call fcn.14003ba20
nop
lea rcx, [rbp + 0x1c0]
call fcn.140034ae0
mov rbx, rax
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0x10
jb 0x140035e68
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035e63
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140035e63
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003c864
test rbx, rbx
jne 0x14003608e
movdqa xmm0, xmmword [0x140043260]
movdqu xmmword [rbp + 0x1e0], xmm0
mov word [rbp + 0x1f0], pe_nt_image_headers64
mov rcx, r12
nop dword [rax]
lea eax, [rcx - 0x7c]
xor byte [rbp + rcx + 0x1e0], al
inc rcx
cmp rcx, 0x10
jb 0x140035e90
mov byte [rbp + 0x1f1], 0
lea rdx, [rbp + 0x1e0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14003608e
mov dword [rbp + 0x1b0], 0xe8ebe0c9
mov dword [rbp + 0x1b4], 0xddaaf0fa
mov dword [rbp + 0x1b8], 0xeaf9e8e5
mov word [rbp + 0x1bc], 0xe2
mov byte [rbp + 0x1be], 1
mov rcx, r12
lea eax, [rcx - 0x7c]
xor byte [rbp + rcx + 0x1b0], al
inc rcx
cmp rcx, 0xd
jb 0x140035ef3
mov byte [rbp + 0x1be], 0
lea rdx, [rbp + 0x1b0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14003608e
mov dword [rbp + 0x1b0], 0xe4e9f7d4
mov dword [rbp + 0x1b4], 0xabf9faed
mov dword [rbp + 0x1b8], 0xfbfde4c0
mov word [rbp + 0x1bc], pe_nt_image_headers64
mov rcx, r12
nop
lea eax, [rcx - 0x7c]
xor byte [rbp + rcx + 0x1b0], al
inc rcx
cmp rcx, 0xc
jb 0x140035f50
mov byte [rbp + 0x1bd], 0
lea rdx, [rbp + 0x1b0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14003608e
mov dword [rbp + 0x1b0], 0xf2c2f6cf
mov dword [rbp + 0x1b4], 0xf9eff9e5
mov word [rbp + 0x1b8], pe_nt_image_headers64
mov rcx, r12
lea eax, [rcx - 0x7c]
xor byte [rbp + rcx + 0x1b0], al
inc rcx
cmp rcx, 8
jb 0x140035fa2
mov byte [rbp + 0x1b9], 0
lea rdx, [rbp + 0x1b0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14003608e
mov dword [rbp + 0x1b0], 0xd7d2d1cc
mov dword [rbp + 0x1b4], 0xe9efcda8
mov dword [rbp + 0x1b8], 0xeae9eaf9
mov word [rbp + 0x1bc], 0xe2
mov byte [rbp + 0x1be], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx - 0x7c]
xor byte [rbp + rcx + 0x1b0], al
inc rcx
cmp rcx, 0xd
jb 0x140036010
mov byte [rbp + 0x1be], 0
lea rdx, [rbp + 0x1b0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14003608e
mov dword [rbp + 0x1b0], 0xfeeae9cb
mov dword [rbp + 0x1b4], 0xedebcc
mov byte [rbp + 0x1b8], 1
mov rcx, r12
nop dword [rax]
lea eax, [rcx - 0x7c]
xor byte [rbp + rcx + 0x1b0], al
inc rcx
cmp rcx, 7
jb 0x140036060
mov byte [rbp + 0x1b8], 0
lea rdx, [rbp + 0x1b0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400360c7
lea r9, [rsp + 0x60]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc0000420
call qword [sym.imp.ntdll.dll_NtRaiseHardError]
lea rcx, [0x140042b50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 8
call fcn.14003c8dc
lea rcx, [0x140032560]
mov qword [rax], rcx
mov qword [rbp + 0x1b0], rax
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14003c3f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140036d31
cmp dword [rsp + 0x78], 0
je 0x140036d25
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp + 0x1e0], xmm0
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140036d25
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
lea ecx, [rax + 8]
call fcn.14003c8dc
lea rcx, [0x140032800]
mov qword [rax], rcx
mov qword [rbp + 0x1b0], rax
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14003c3f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140036d14
cmp dword [rsp + 0x78], 0
je 0x140036d08
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp + 0x1e0], xmm0
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140036d08
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
lea ecx, [rax + 8]
call fcn.14003c8dc
lea rcx, [0x1400329e0]
mov qword [rax], rcx
mov qword [rbp + 0x1b0], rax
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14003c3f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140036cf7
cmp dword [rsp + 0x78], 0
je 0x140036ceb
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp + 0x1e0], xmm0
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140036ceb
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
lea ecx, [rax + 8]
call fcn.14003c8dc
lea rcx, [0x140032260]
mov qword [rax], rcx
mov qword [rbp + 0x1b0], rax
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14003c3f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140036cda
cmp dword [rsp + 0x78], 0
je 0x140036cce
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp + 0x1e0], xmm0
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140036cce
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
lea ecx, [rax + 8]
call fcn.14003c8dc
lea rcx, [0x140032c50]
mov qword [rax], rcx
mov qword [rbp + 0x1b0], rax
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14003c3f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140036cbd
cmp dword [rsp + 0x78], 0
je 0x140036cb1
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp + 0x1e0], xmm0
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140036cb1
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
lea edx, [rax + 0xf]
lea rcx, [rbp + 0x1c0]
call fcn.140034f30
mov r14, rax
cmp qword [rax + 0x18], 0x10
jb 0x140036372
mov r14, qword [rax]
mov r8d, 0x104
lea rdx, [rbp - 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1e0], xmm0
lea rax, [rbp - 0x70]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400363a0
movabs rdi, 0x7fffffffffffffff
cmp rbx, rdi
ja 0x140036d42
cmp rbx, 0x10
jae 0x1400363f4
mov qword [rbp + 0x1f0], rbx
mov qword [rbp + 0x1f8], 0xf
mov r8, rbx
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x1e0]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx + 0x1e0], 0
jmp 0x140036495
mov rax, rbx
or rax, 0xf
cmp rax, rdi
jbe 0x140036429
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14003c8dc
test rax, rax
je 0x140036454
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14003646d
mov rdi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x14003645b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140036d48
jmp 0x14003640e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14003646a
call fcn.14003c8dc
mov rsi, rax
jmp 0x14003646d
mov rsi, r12
mov qword [rbp + 0x1e0], rsi
mov qword [rbp + 0x1f0], rbx
mov qword [rbp + 0x1f8], rdi
mov r8, rbx
lea rdx, [rbp - 0x70]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
lea rcx, [rbp + 0x1e0]
cmp qword [rbp + 0x1f8], 0x10
cmovae rcx, qword [rbp + 0x1e0]
mov rdx, r14
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
mov rdx, qword [rbp + 0x1f8]
cmp rdx, 0x10
jb 0x1400364f9
inc rdx
mov rcx, qword [rbp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400364f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400364f4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003c864
mov qword [rbp + 0x1f0], r12
mov qword [rbp + 0x1f8], 0xf
mov byte [rbp + 0x1e0], 0
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0x10
jb 0x140036556
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140036551
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140036551
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003c864
mov edx, 0x1e
lea rcx, [rbp + 0x1c0]
call fcn.140034f30
cmp qword [rax + 0x18], 0x10
jb 0x140036571
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0x10
jb 0x1400365be
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400365b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400365b9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003c864
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
mov edx, 0xb
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dword [rbp - 0x80], r12d
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdi, rax
lea rdx, [rbp + 0x1e0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movsx r8d, word [rbp + 0x1e2]
movsx ecx, word [rbp + 0x1e0]
imul r8d, ecx
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
mov ebx, r12d
mov r9d, ebx
mov dl, 0x20
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
movsx r8d, word [rbp + 0x1e2]
movsx eax, word [rbp + 0x1e0]
imul r8d, eax
mov edx, 7
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov rcx, qword [0x14004d450]
test rcx, rcx
jne 0x1400366e9
nop dword [rax]
mov dword [rbp + 0x1b0], 0x7c756943
mov dword [rbp + 0x1b4], 0x697f6367
mov word [rbp + 0x1b8], 0x2e2d
xor eax, eax
mov byte [rbp + 0x1ba], al
mov ecx, r12d
mov rdx, r12
nop dword [rax + rax]
lea eax, [rcx + 5]
xor byte [rbp + rdx + 0x1b0], al
inc ecx
movsxd rdx, ecx
cmp rdx, 0xa
jb 0x1400366a0
mov byte [rbp + 0x1ba], 0
lea rdx, [rbp + 0x1b0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x14004d450], rax
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x14004d450]
test rcx, rcx
je 0x140036670
lea rdx, [0x14004d3ac]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call fcn.1400319b0
test al, al
je 0x1400368bf
mov rbx, qword [0x14004d498]
mov eax, dword [0x14004d3ac]
mov dword [rbx], eax
cmp dword [rbx + 0x20], 0
je 0x1400367d9
mov qword [rsp + 0x70], r12
mov dword [rbp + 0x1e0], eax
lea rax, [rsp + 0x70]
mov qword [rbp + 0x1e8], rax
lea rcx, [0x14004d4a0]
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x140036750
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov eax, dword [0x14004d4ec]
cmp eax, 0x7fffffff
jne 0x140036771
dec eax
mov dword [0x14004d4ec], eax
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
lea rax, [rbx + 0x18]
mov qword [rbp + 0x1c0], rax
mov dword [rbp + 0x1c8], 6
lea rax, [rbp + 0x1e0]
mov qword [rbp + 0x1d0], rax
lea rax, [rbp - 0x80]
mov qword [rbp + 0x1d8], rax
mov rax, qword [rbx + 8]
movups xmm0, xmmword [rbp + 0x1c0]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbp + 0x1d0]
movups xmmword [rax + 0x10], xmm1
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea rcx, [0x14004d4a0]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rax, qword [rsp + 0x70]
jmp 0x1400368b8
mov qword [rbp + 0x1b0], r12
mov dword [rsp + 0x64], r12d
mov dword [rbp - 0x70], eax
lea rax, [rbp + 0x1b0]
mov qword [rbp + 0x198], rax
lea rax, [rsp + 0x64]
mov qword [rbp + 0x1a0], rax
lea r8, str.FortniteClient_Win64_Shipping.exe
mov edx, 0xff
lea rcx, [rbp - 0x6c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rcx, [0x14004d4a0]
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x140036835
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov eax, dword [0x14004d4ec]
cmp eax, 0x7fffffff
jne 0x140036856
dec eax
mov dword [0x14004d4ec], eax
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
lea rax, [rbx + 0x18]
mov qword [rbp + 0x1c0], rax
mov dword [rbp + 0x1c8], 5
lea rax, [rbp - 0x70]
mov qword [rbp + 0x1d0], rax
lea rax, [rbp - 0x7c]
mov qword [rbp + 0x1d8], rax
mov rax, qword [rbx + 8]
movups xmm0, xmmword [rbp + 0x1c0]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbp + 0x1d0]
movups xmmword [rax + 0x10], xmm1
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea rcx, [0x14004d4a0]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rax, qword [rbp + 0x1b0]
mov qword [0x14004d448], rax
mov edx, 0x3e8
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Beep]
movdqa xmm0, xmmword [0x1400431d0]
movdqu xmmword [rbp + 0x1e0], xmm0
movdqa xmm1, xmmword [0x140043230]
movdqu xmmword [rbp + 0x1f0], xmm1
mov dword [rbp + 0x200], 0xdfc38be7
mov word [rbp + 0x204], 0xcd
mov byte [rbp + 0x206], 1
mov rcx, r12
nop dword [rax]
lea eax, [rcx - 0x7c]
xor byte [rbp + rcx + 0x1e0], al
inc rcx
cmp rcx, 0x25
jb 0x140036910
mov byte [rbp + 0x206], 0
lea r8, [rbp + 0x205]
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x1c0]
call fcn.14003ba20
nop
lea rcx, [rbp + 0x1c0]
call fcn.140034ae0
mov rbx, rax
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0x10
jb 0x140036998
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140036993
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140036993
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003c864
test rbx, rbx
je 0x1400369bf
lea rdx, str._DaekyWare_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003b7f0
mov rcx, rax
lea rdx, str.Loaded_With_Easy_Anti_Cheat__n_n
call fcn.14003b7f0
movdqa xmm0, xmmword [0x1400431d0]
movdqu xmmword [rbp + 0x1e0], xmm0
movdqa xmm1, xmmword [0x140043240]
movdqu xmmword [rbp + 0x1f0], xmm1
mov dword [rbp + 0x200], 0xc2dec08a
mov word [rbp + 0x204], pe_nt_image_headers64
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx - 0x7c]
xor byte [rbp + rcx + 0x1e0], al
inc rcx
cmp rcx, 0x24
jb 0x140036a00
mov byte [rbp + 0x205], 0
lea r8, [rbp + 0x204]
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x1c0]
call fcn.14003ba20
nop
lea rcx, [rbp + 0x1c0]
call fcn.140034ae0
mov rbx, rax
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0x10
jb 0x140036a88
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140036a83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140036a83
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003c864
test rbx, rbx
je 0x140036aaf
lea rdx, str._DaekyWare_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003b7f0
mov rcx, rax
lea rdx, str.Loaded_With_Battle_Eye__n_n
call fcn.14003b7f0
mov rdx, qword [0x14004d448]
lea rcx, str._DaekyWare__Fortnites_Id_Base_Is:__p
call fcn.140031140
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x140036d50]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x1e0], 0x50
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x1f0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x200], xmm1
movdqa xmmword [rbp + 0x210], xmm0
mov qword [rbp + 0x228], r12
lea rbx, str.About_Windows
mov qword [rbp + 0x220], rbx
lea rax, [0x14003ab70]
mov qword [rbp + 0x1e8], rax
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov rcx, qword [0x14004d450]
test rcx, rcx
je 0x140036ca5
lea rdx, [0x14004d460]
call qword [sym.imp.USER32.dll_GetClientRect]
lea rdx, [rbp + 0x1b0]
mov rcx, qword [0x14004d450]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [rbp + 0x1b0]
mov dword [0x14004d460], eax
mov eax, dword [rbp + 0x1b4]
mov dword [0x14004d464], eax
mov ecx, dword [0x14004d468]
mov dword [0x14004d478], ecx
mov eax, dword [0x14004d46c]
mov dword [0x14004d424], eax
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
mov r9d, 0x90000000
lea r8, str.Winver
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x14004d570], rax
lea rdx, [0x1400425d0]
mov rcx, rax
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov edx, 0xffffffec
mov r8d, 0x800a0
mov rcx, qword [0x14004d570]
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov edx, 5
mov rcx, qword [0x14004d570]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x14004d570]
call qword [sym.imp.USER32.dll_UpdateWindow]
call fcn.140036e50
call fcn.14003a830
mov rcx, qword [0x14004d398]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x14004d598]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x14004d430]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x14004d570]
call qword [sym.imp.USER32.dll_DestroyWindow]
xor edx, edx
lea rcx, str.fgers
call qword [sym.imp.USER32.dll_UnregisterClassA]
xor eax, eax
mov rcx, qword [rbp + 0x230]
xor rcx, rsp
call fcn.14003c440
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x78], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x78], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x78], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x78], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x78], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
call fcn.140031340
int3
call fcn.1400312a0
int3