Function at 0x140034c70
Capabilities:
Create thread
Download url
Receive data
Resolve function by parsing pe exports
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x1400dd040]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov rdi, rcx
xor r15d, r15d
mov dword [rbp - 0x60], r15d
mov dword [rbp - 0x50], 0x50
mov dword [rbp - 0x4c], 0x40
lea rax, [0x140037e80]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp - 0x38], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
lea rax, [0x1400c9104]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], r15
lea rcx, [rbp - 0x50]
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov qword [rsp + 0x58], r15
mov rax, qword [rbp - 0x38]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], 0x1b3
mov dword [rsp + 0x30], 0x1f8
mov dword [rsp + 0x28], 0x64
mov dword [rsp + 0x20], 0x64
mov r9d, 0x80cf0000
lea r8, str.Luno_Loader
mov rdx, qword [rbp - 0x10]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [rdi + 0x50], rax
lea edx, [r15 - 0x10]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xc00000
mov r8d, eax
lea edx, [r15 - 0x10]
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov dword [rsp + 0x30], 0x23
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rbx, qword [rdi + 0x50]
lea ecx, [r15 + 0x20]
call qword [sym.imp.d3d9.dll_Direct3DCreate9]
mov qword [rdi], rax
lea r14, [rdi + 8]
test rax, rax
je 0x140034e2a
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x1c], r15
mov dword [rdi + 0x24], r15d
mov qword [rdi + 0x28], 1
mov qword [rdi + 0x44], r15
mov dword [rdi + 0x38], 1
mov dword [rdi + 0x18], r15d
mov dword [rdi + 0x3c], 1
mov dword [rdi + 0x40], 0x50
mov dword [rdi + 0x4c], 1
mov qword [rdi + 0x30], rbx
mov rcx, rax
mov rax, qword [rax]
mov r10, qword [rax + 0x80]
lea rax, [rdi + 0x10]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x40
mov r9, qword [rdi + 0x50]
xor edx, edx
lea r8d, [r15 + 1]
call r10
test eax, eax
je 0x140034e8c
mov rcx, qword [r14]
test rcx, rcx
je 0x140034e3b
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [r14], r15
mov rcx, qword [rdi]
test rcx, rcx
je 0x140034e4c
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rdi], r15
mov rdx, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov al, 1
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.1400758f0
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov edx, 0xa
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rax, qword [0x1400e4810]
test rax, rax
je 0x140034eb7
inc dword [rax + 0x3b0]
mov ecx, 0x3f00
call fcn.1400881e0
mov qword [rbp - 0x60], rax
lea rcx, [rsp + 0x60]
mov qword [rbp], rcx
mov qword [rbp + 0x10], rax
test rax, rax
je 0x140034ee3
xor edx, edx
mov rcx, rax
call fcn.140003000
jmp 0x140034ee6
mov rax, r15
cmp qword [0x1400e4810], 0
jne 0x140034ef7
mov qword [0x1400e4810], rax
mov rcx, rax
call fcn.140008e10
mov rax, qword [0x1400e4810]
mov byte [rax + 0x398], 0
call fcn.140037f00
mov rbx, qword [rdi + 0x50]
lea rcx, [0x1400e48b0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14003509c
lea rcx, [0x1400e48a8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14003509c
mov qword [0x1400e48a0], rbx
mov rax, qword [0x1400e4810]
or dword [rax + 0xc], 6
lea rcx, str.imgui_impl_win32
mov qword [rax + 0xd8], rcx
mov qword [rax + 0x120], rbx
mov dword [rax + 0x3c], 9
mov dword [rax + 0x40], 0x25
mov dword [rax + 0x44], 0x27
mov dword [rax + 0x48], 0x26
mov dword [rax + 0x4c], 0x28
mov dword [rax + 0x50], 0x21
mov dword [rax + 0x54], 0x22
mov dword [rax + 0x58], 0x24
mov dword [rax + 0x5c], 0x23
mov dword [rax + 0x60], 0x2d
mov dword [rax + 0x64], 0x2e
mov dword [rax + 0x68], 8
mov dword [rax + 0x6c], 0x20
mov dword [rax + 0x70], 0xd
mov dword [rax + 0x74], 0x1b
mov dword [rax + 0x78], 0xd
mov dword [rax + 0x7c], 0x41
mov dword [rax + 0x80], 0x43
mov dword [rax + 0x84], 0x56
mov dword [rax + 0x88], 0x58
mov dword [rax + 0x8c], 0x59
mov dword [rax + 0x90], 0x5a
lea rax, str.xinput1_4.dll
mov qword [rsp + 0x70], rax
lea rax, str.xinput1_3.dll
mov qword [rsp + 0x78], rax
lea rax, str.xinput9_1_0.dll
mov qword [rbp - 0x80], rax
lea rax, str.xinput1_2.dll
mov qword [rbp - 0x78], rax
lea rax, str.xinput1_1.dll
mov qword [rbp - 0x70], rax
mov rbx, r15
nop dword [rax]
mov rcx, qword [rsp + rbx*8 + 0x70]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x14003506e
inc rbx
cmp rbx, 5
jl 0x140035050
jmp 0x14003509c
lea rdx, str.XInputGetCapabilities
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400e4890], rax
lea rdx, str.XInputGetState
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400e4898], rax
mov rsi, qword [r14]
mov rbx, qword [0x1400e4810]
test rbx, rbx
je 0x1400350b1
inc dword [rbx + 0x3b0]
mov ecx, 0x28
call fcn.1400881e0
test rax, rax
je 0x1400350df
mov qword [rax], r15
mov qword [rax + 8], r15
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], r15
mov dword [rax + 0x20], 0x1388
mov dword [rax + 0x24], 0x2710
jmp 0x1400350e2
mov rax, r15
mov qword [rbx + 0xf0], rax
lea rcx, str.imgui_impl_dx9
mov qword [rbx + 0xe0], rcx
or dword [rbx + 0xc], 8
mov qword [rax], rsi
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 8]
movabs rax, 0x1c2fe8793acc9bcc
mov qword [rbp], rax
movabs rbx, 0x614c1f010b9add60
mov qword [rbp + 8], rbx
movabs r13, 0x4040860c7690a18f
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x18], rbx
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rbp], xmm0
lea rax, [rsp + 0x70]
mov qword [rbp + 0x10], rax
lea r12, [rbp]
lea rax, [rbp]
mov rsi, 0xffffffffffffffff
nop dword [rax + rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x140035160
call fcn.1400748b4
mov r14d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r15
mov edx, 7
mov qword [rbp - 0x78], rdx
mov word [rsp + 0x70], r15w
mov dword [rbp - 0x60], 4
test rsi, rsi
je 0x14003521c
cmp rsi, 0x7fffffff
ja 0x140035692
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov r8d, esi
mov rdx, r12
mov ecx, eax
call fcn.1400748dc
mov rbx, rax
mov rcx, rax
shr rcx, 0x20
test ecx, ecx
jne 0x140035698
xor r8d, r8d
movsxd rdx, ebx
lea rcx, [rsp + 0x70]
call fcn.1400317c0
lea r9, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova r9, qword [rsp + 0x70]
mov dword [rsp + 0x20], ebx
mov r8d, esi
mov rdx, r12
mov ecx, r14d
call fcn.1400748dc
shr rax, 0x20
test eax, eax
jne 0x14003569e
mov rdx, qword [rbp - 0x78]
movabs rbx, 0x614c1f010b9add60
lea rcx, [rsp + 0x70]
cmp rdx, 7
cmova rcx, qword [rsp + 0x70]
call fcn.1400749f0
shr rax, 0x20
test eax, eax
jne 0x1400356a6
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x14003527d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035278
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400356b3
call fcn.140075b8c
movabs rax, 0x1c2fe8793acc9bcc
mov qword [rsp + 0x70], rax
movabs rax, 0x52d706d65edb204
mov qword [rsp + 0x78], rax
movabs rax, 0x9ba825be4339aa64
mov qword [rbp - 0x80], rax
movabs r8, 0x1f610e73fb8aac8a
mov qword [rbp - 0x78], r8
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x18], rbx
movabs rdx, 0x9ba840c62617d801
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x28], r8
movdqa xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [rbp - 0x80]
xorps xmm1, xmmword [rbp + 0x20]
movdqa xmmword [rbp - 0x80], xmm1
movabs rax, 0x6f6fbc7f06e4d5e7
mov qword [rbp + 0x50], rax
movabs r13, 0x4f7e6c6264f4a80c
mov qword [rbp + 0x58], r13
movabs r12, 0xfedd31a35438ad73
mov qword [rbp + 0x60], r12
movabs r15, 0x460f6b0394b5d8f9
mov qword [rbp + 0x68], r15
movabs r14, 0x412213603cbb5282
mov qword [rbp + 0x70], r14
movabs rax, 0xeaaae9d370875409
mov qword [rbp + 0x78], rax
movabs rax, 0xec7265d2e4765871
mov qword [rbp + 0x80], rax
movabs rcx, 0x874b2ccfcbc6cabe
mov qword [rbp + 0x88], rcx
movabs rax, 0x4040860c7690a18f
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x28], r8
movabs rsi, 0x2747411859df3ce3
mov qword [rbp + 0x30], rsi
movabs rbx, 0x8bc585bd07e83034
mov qword [rbp + 0x38], rbx
movabs rax, 0xec7265d2e4043d15
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rcx
movdqa xmm0, xmmword [rbp + 0x50]
xorps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rbp + 0x50], xmm0
movdqa xmm1, xmmword [rbp + 0x60]
xorps xmm1, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x60], xmm1
movdqa xmm0, xmmword [rbp + 0x70]
xorps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x70], xmm0
movdqa xmm1, xmmword [rbp + 0x80]
xorps xmm1, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x80], xmm1
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x70]
lea rdx, [rbp + 0x50]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movabs rax, 0x1c2fe8793acc9bcc
mov qword [rbp + 0x10], rax
movabs rax, 0x61387e6325e2b919
mov qword [rbp + 0x18], rax
movabs rax, 0x4040860c7690a18f
mov qword [rbp], rax
movabs rax, 0x614c1f010b9add60
mov qword [rbp + 8], rax
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp]
movdqa xmmword [rbp + 0x10], xmm0
movabs rax, 0x6f6fbc7f06e4d5e7
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], r14
movabs rax, 0x8bc585bd73895209
mov qword [rbp - 0x68], rax
movabs r13, 0x4040860c7690a18f
mov qword [rbp + 0x50], r13
movabs r12, 0x614c1f010b9add60
mov qword [rbp + 0x58], r12
movabs r14, 0x9ba840c62617d801
mov qword [rbp + 0x60], r14
movabs r15, 0x1f610e73fb8aac8a
mov qword [rbp + 0x68], r15
mov qword [rbp + 0x70], rsi
mov qword [rbp + 0x78], rbx
movdqa xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [rbp - 0x80]
xorps xmm1, xmmword [rbp + 0x60]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [rbp - 0x70]
xorps xmm0, xmmword [rbp + 0x70]
movdqa xmmword [rbp - 0x70], xmm0
xor ebx, ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movabs rsi, 0x1c2fe8793acc9bcc
mov qword [rsp + 0x70], rsi
movabs rax, 0x52d706d65edb204
mov qword [rsp + 0x78], rax
movabs rax, 0x9ba825be4339aa64
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], r15
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x18], r12
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], r15
movdqa xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [rbp - 0x80]
xorps xmm1, xmmword [rbp + 0x20]
movdqa xmmword [rbp - 0x80], xmm1
lea edx, [rbx + 2]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov qword [rbp + 0x10], rsi
movabs rax, 0x61387e6325e2b919
mov qword [rbp + 0x18], rax
mov qword [rbp], r13
mov qword [rbp + 8], r12
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp]
movdqa xmmword [rbp + 0x10], xmm0
lea edx, [rbx + 2]
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov byte [rdi + 0x68], 1
lea ecx, [rbx + 0x10]
call fcn.140075910
mov qword [rax], rdi
lea rcx, [0x1400382a0]
mov qword [rax + 8], rcx
mov qword [rbp + 0x10], rax
lea rcx, [rbp + 8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x1400387c0]
xor edx, edx
xor ecx, ecx
call fcn.140088320
mov qword [rbp], rax
test rax, rax
je 0x140035684
cmp dword [rbp + 8], ebx
je 0x140035679
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp + 0x10], xmm0
lea rcx, [rbp + 0x10]
call fcn.140074890
test eax, eax
jne 0x140035679
xorps xmm0, xmm0
movdqa xmmword [rbp], xmm0
lea ecx, [rbx + 0x10]
call fcn.140075910
mov qword [rax], rdi
lea rcx, [0x1400381c0]
mov qword [rax + 8], rcx
mov qword [rbp + 0x10], rax
lea rcx, [rbp + 8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x1400387c0]
xor edx, edx
xor ecx, ecx
call fcn.140088320
mov qword [rbp], rax
test rax, rax
je 0x1400356c4
cmp dword [rbp + 8], ebx
je 0x1400356b9
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp + 0x10], xmm0
lea rcx, [rbp + 0x10]
call fcn.140074890
test eax, eax
jne 0x1400356b9
jmp 0x140034e5a
mov ecx, 1
call fcn.140073ea8
nop
mov dword [rbp + 8], ebx
mov ecx, 6
call fcn.140073ea8
nop
call fcn.140034440
int3
call fcn.1400344a0
int3
mov ecx, eax
call fcn.1400344a0
nop
lea r8, [rsp + 0x70]
mov edx, eax
call fcn.140034c00
nop
call fcn.14007caa4
nop
mov ecx, 1
call fcn.140073ea8
nop
mov dword [rbp + 8], ebx
mov ecx, 6
call fcn.140073ea8
int3