Function at 0x1400013a0
Capabilities:
Allocate or change rwx memory
Enumerate process modules
Enumerate processes
Execute command
Log keystrokes
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x858]
sub rsp, 0x930
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
movaps xmmword [rax - 0xa8], xmm13
movaps xmmword [rax - 0xb8], xmm14
movaps xmmword [rax - 0xc8], xmm15
mov rax, qword [0x140009008]
xor rax, rsp
mov qword [rbp + 0x780], rax
xor r15d, r15d
mov edi, r15d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000147e
mov dword [rbp + 0x530], 0x238
lea rdx, [rbp + 0x530]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000147e
lea rdx, str.sr_hv.exe
lea rcx, [rbp + 0x55c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140001478
lea rdx, [rbp + 0x530]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x14000144a
mov edi, dword [rbp + 0x538]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x1400014d3
lea rdx, str.Lancez_le_jeu_avant_de_demarrer_le_Cheat.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003b50
mov rcx, rax
lea rdx, [0x140003d20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140003d20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea eax, [rdi + 1]
jmp 0x1400038fb
lea rdx, str.Saints_Row_IV
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x140001514
lea rdx, str.erreur
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003b50
mov rcx, rax
lea rdx, [0x140003d20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x1400038fb
mov rcx, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
mov dword [rbp + 0x400], r15d
mov byte [rsp + 0x36], r15b
movss xmm12, dword [0x14000682c]
mov dword [rsp + 0x58], 0x42b40000
mov byte [rsp + 0x30], r15b
xorps xmm11, xmm11
mov dword [rbp + 0x3b4], r15d
mov dword [rbp + 0x3bc], r15d
mov dword [rbp + 0x3b8], r15d
mov byte [rsp + 0x34], r15b
mov dword [rbp + 0x3f0], r15d
mov dword [rbp + 0x3f4], r15d
xor al, al
mov byte [rsp + 0x32], al
mov byte [rsp + 0x31], al
xor sil, sil
mov byte [rsp + 0x35], sil
xor r13b, r13b
mov byte [rsp + 0x33], r13b
mov dword [rbp + 0x434], 0x42200000
mov dword [rbp + 0x4cc], 0x43fa0000
movss xmm0, dword [0x140006814]
movss dword [rbp + 0x438], xmm0
movss xmm9, dword [0x140006830]
mov dword [rbp + 0x4d8], 0x42c80000
mov dword [rbp + 0x43c], 0x42200000
mov dword [rbp + 0x4e0], 0x43fa0000
movss xmm0, dword [0x140006800]
movss dword [rbp + 0x440], xmm0
mov dword [rbp + 0x4e4], 0x41a00000
movss xmm0, dword [0x14000680c]
movss dword [rbp + 0x444], xmm0
movss xmm1, dword [0x140006820]
movss dword [rbp + 0x4e8], xmm1
movss xmm0, dword [0x140006804]
movss dword [rbp + 0x448], xmm0
movss xmm1, dword [0x140006828]
movss dword [rbp + 0x4ec], xmm1
mov dword [rbp + 0x44c], 0x42580000
mov dword [rbp + 0x4b0], 0x43fa0000
movss xmm1, dword [0x140006818]
movss dword [rbp + 0x4d0], xmm1
movss xmm0, dword [0x140006824]
movss dword [rbp + 0x42c], xmm0
mov dword [rbp + 0x4d4], 0x42580000
movss xmm1, dword [0x14000683c]
movss dword [rbp + 0x45c], xmm1
mov dword [rsp + 0x48], r15d
movdqa xmm0, xmmword [0x140006850]
movdqa xmmword [rbp + 0x530], xmm0
movdqa xmm1, xmmword [0x140006860]
movdqa xmmword [rbp + 0x540], xmm1
movdqa xmm0, xmmword [str._________._0123456789:_]
movdqa xmmword [rbp + 0x550], xmm0
movdqa xmm1, xmmword [0x140006880]
movdqa xmmword [rbp + 0x560], xmm1
movdqa xmm0, xmmword [0x140006890]
movdqa xmmword [rbp + 0x570], xmm0
movdqa xmm1, xmmword [0x1400068a0]
movdqa xmmword [rbp + 0x580], xmm1
movdqa xmm0, xmmword [0x1400068b0]
movdqa xmmword [rbp + 0x590], xmm0
movdqa xmm1, xmmword [0x1400068c0]
movdqa xmmword [rbp + 0x5a0], xmm1
movdqa xmm0, xmmword [0x1400068d0]
movdqa xmmword [rbp + 0x5b0], xmm0
mov r12d, r15d
mov edx, edi
mov ecx, 0x18
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000177c
mov dword [rsp + 0x70], 0x438
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x14000177c
lea rdx, str.sr_hv.exe
lea rcx, [rbp - 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140001778
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
jmp 0x14000174f
mov r15, qword [rbp - 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x4c], r12d
lea rdx, [rbp + 0x400]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x14000347d
movss xmm13, dword [0x140006834]
movss xmm15, dword [0x1400067f8]
movss xmm10, dword [0x1400067f0]
movss xmm14, dword [0x140006844]
lea r10, [r15 + 0x177f454]
mov byte [rsp + 0x38], r13b
movzx r13d, sil
movzx esi, byte [rsp + 0x31]
movzx edi, byte [rsp + 0x30]
cmp dword [rbp + 0x400], 0x103
jne 0x14000347d
cmp byte [rsp + 0x36], 0
jne 0x140001bcc
lea rax, [rbp + 0x460]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8d, [r9 - 0x36]
lea rdx, [r15 + 0x2a5005]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], 0
mov r9d, 0xa
lea r8, [0x1400065d8]
lea rdx, [r15 + 0x2a5005]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rbp + 0x460]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x460]
mov r8d, 0xa
lea rdx, [r15 + 0x2a5005]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov dword [rbp + 0x4bc], 0x42b40000
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x4bc]
lea rdx, [r15 + 0x177f454]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rbp + 0x404]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8d, [r9 - 0x3b]
lea rdx, [r15 + 0x17ed20]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], 0
mov r9d, 5
lea r8, [0x1400065e4]
lea rdx, [r15 + 0x17ed20]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rbp + 0x404]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x404]
mov r8d, 5
lea rdx, [r15 + 0x17ed20]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rax, [rbp + 0x408]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8d, [r9 - 0x3a]
lea rdx, [r15 + 0x17d453]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], 0
mov r9d, 6
lea r8, [0x1400065ec]
lea rdx, [r15 + 0x17d453]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rbp + 0x408]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x408]
mov r8d, 6
lea rdx, [r15 + 0x17d453]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rax, [rbp + 0x40c]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8d, [r9 - 0x36]
lea rdx, [r15 + 0x17f3c5]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], 0
mov r9d, 0xa
lea r8, [0x1400065f8]
lea rdx, [r15 + 0x17f3c5]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rbp + 0x40c]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x40c]
mov r8d, 0xa
lea rdx, [r15 + 0x17f3c5]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rax, [rbp + 0x410]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8d, [r9 - 0x3b]
lea rdx, [r15 + 0x17ed38]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], 0
mov r9d, 5
lea r8, [0x1400065e4]
lea rdx, [r15 + 0x17ed38]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rbp + 0x410]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x410]
mov r8d, 5
lea rdx, [r15 + 0x17ed38]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rax, [rbp + 0x414]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8d, [r9 - 0x3a]
lea rdx, [r15 + 0x17d45c]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], 0
mov r9d, 6
lea r8, [0x1400065ec]
lea rdx, [r15 + 0x17d45c]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rbp + 0x414]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x414]
mov r8d, 6
lea rdx, [r15 + 0x17d45c]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rax, [rbp + 0x418]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8d, [r9 - 0x36]
lea rdx, [r15 + 0x17f3cf]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], 0
mov r9d, 0xa
lea r8, [0x1400065f8]
lea rdx, [r15 + 0x17f3cf]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rbp + 0x418]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x418]
mov r8d, 0xa
lea rdx, [r15 + 0x17f3cf]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov dword [rbp + 0x778], 0xbfc8f5c3
mov dword [rbp + 0x77c], 0x3fc8f5c3
lea rbx, [r15 + 0x1759790]
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [rbp + 0x778]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [rsp + 0x36], 1
lea rdx, str.Cheat_loaded
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003b50
mov rcx, rax
lea rdx, [0x140003d20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea r10, [r15 + 0x177f454]
jmp 0x140001bd3
lea rbx, [r15 + 0x1759790]
mov ecx, dword [rsp + 0x4c]
inc ecx
mov eax, 0x97247453
imul ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x2710
add ecx, eax
mov dword [rsp + 0x4c], ecx
jne 0x140001d7f
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x58]
mov rdx, r10
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rbp + 0x770], 0xbfc8f5c3
mov dword [rbp + 0x774], 0x3fc8f5c3
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [rbp + 0x770]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [rsp + 0x33], 0
je 0x140001d7f
lea rdx, [r15 + 0x1b38024]
xor ebx, ebx
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 4]
lea r8, [rbp + 0x4cc]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [r15 + 0x64e9c40]
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 4]
lea r8, [rbp + 0x4d8]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [r15 + 0x64e9c44]
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 4]
lea r8, [rbp + 0x4e0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [r15 + 0x6502c7c]
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 4]
lea r8, [rbp + 0x4e4]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [r15 + 0x6502c80]
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 4]
lea r8, [rbp + 0x4e8]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [r15 + 0x6502c94]
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 4]
lea r8, [rbp + 0x4ec]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [r15 + 0x654d9a4]
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 4]
lea r8, [rbp + 0x4b0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [r15 + 0x64e5460]
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 4]
lea r8, [rbp + 0x42c]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [r15 + 0x64e5468]
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 4]
lea r8, [rbp + 0x45c]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140001e9b
cmp dil, 0
sete byte [rsp + 0x30]
test dil, dil
jne 0x140001e68
mov ecx, 4
call fcn.140004138
mov qword [rbp + 0x3c8], rax
lea rcx, [rax + 4]
mov qword [rbp + 0x3d8], rcx
mov dword [rax], pe_nt_image_headers64
mov qword [rbp + 0x3d0], rcx
lea rdx, [r15 + 0x1d7d0c0]
lea r8, [rbp + 0x3c8]
mov rcx, r14
call fcn.140001010
mov rbx, rax
xor edi, edi
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 4]
lea r8, [rbp + 0x3b4]
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rdx, [rbx + 4]
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 4]
lea r8, [rbp + 0x3bc]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rdx, [rbx + 8]
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 4]
lea r8, [rbp + 0x3b8]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rdx, str.FlyHack_On
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003b50
mov rcx, rax
lea rdx, [0x140003d20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x2ee
jmp 0x140001e90
lea rdx, str.FlyHack_Off
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003b50
mov rcx, rax
lea rdx, [0x140003d20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x1f4
mov edx, 0x4b
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x74
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140001fa7
cmp sil, 0
sete byte [rsp + 0x31]
lea rbx, [r15 + 0x8336c2]
mov r9d, 0x40
lea r8d, [r9 - 0x37]
mov rdx, rbx
mov rcx, r14
test sil, sil
jne 0x140001f4b
lea rax, [rbp + 0x41c]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
xor esi, esi
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 9]
lea r8, [0x140006638]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rbp + 0x41c]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x41c]
lea r8d, [rsi + 9]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rdx, str.SpamPowerHack_On
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003b50
mov rcx, rax
lea rdx, [0x140003d20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140001fa9
lea rax, [rbp + 0x420]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
xor esi, esi
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 9]
lea r8, [0x140006660]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rbp + 0x420]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x420]
lea r8d, [rsi + 9]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rdx, str.SpamPowerHack_Off
jmp 0x140001f2d
xor esi, esi
mov ecx, 0x75
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140001fc2
cmp byte [rsp + 0x34], 0
sete byte [rsp + 0x34]
mov ecx, 0x76
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140002304
mov ecx, 4
call fcn.140004138
mov qword [rbp + 0x3c8], rax
lea rcx, [rax + 4]
mov qword [rbp + 0x3d8], rcx
mov dword [rax], pe_nt_image_headers64
mov qword [rbp + 0x3d0], rcx
lea rdx, [r15 + 0x1d7d0c0]
lea r8, [rbp + 0x3c8]
mov rcx, r14
call fcn.140001010
mov rdi, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x468], xmm0
movups xmmword [rbp + 0x478], xmm0
mov qword [rbp + 0x488], rax
lea ecx, [rax + 0x20]
call qword [sym.imp.USER32.dll_VkKeyScanW]
movzx ecx, al
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov dword [rbp + 0x468], 1
mov dword [rbp + 0x474], 8
mov word [rbp + 0x472], ax
mov r8d, 0x28
lea rdx, [rbp + 0x468]
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x474], 0xa
mov r8d, 0x28
lea rdx, [rbp + 0x468]
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x3e8], 0
add rdi, 4
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rbp + 0x3e8]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp + 0x3e8]
addss xmm0, dword [0x140006838]
movss dword [rbp + 0x4b4], xmm0
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rbp + 0x4b4]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rbp + 0x4b8], 0x3fc00000
lea rdx, [r15 + 0x1758e44]
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rbp + 0x4b8]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4fc], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x510], xmm1
mov dword [rbp + 0x4f8], esi
lea rbx, [r15 + 0x170b5b]
lea rax, [rbp + 0x424]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8d, [r9 - 0x38]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [0x140006688]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rbp + 0x424]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x424]
mov r8d, 8
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov dword [rbp + 0x50c], 8
mov r8d, 0x28
lea rdx, [rbp + 0x4f8]
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x50c], 2
mov r8d, 0x28
lea rdx, [rbp + 0x4f8]
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
lea rax, [rbp + 0x428]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8d, [r9 - 0x38]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [0x140006698]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rbp + 0x428]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x428]
mov r8d, 8
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x50c], 0x10
mov r8d, 0x28
lea rdx, [rbp + 0x4f8]
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
mov dword [rbp + 0x50c], 4
mov r8d, 0x28
lea rdx, [rbp + 0x4f8]
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
movss xmm0, dword [rbp + 0x3e8]
addss xmm0, dword [0x14000681c]
movss dword [rbp + 0x3e8], xmm0
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rbp + 0x3e8]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x77
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14000234e
cmp byte [rsp + 0x35], 0
sete al
mov byte [rsp + 0x35], al
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test r13b, r13b
lea rdx, str.GodMode_On
je 0x140002339
lea rdx, str.GodMode_Off
call fcn.140003b50
lea rdx, [0x140003d20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x78
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140002395
cmp byte [rsp + 0x33], 0
sete byte [rsp + 0x33]
cmp byte [rsp + 0x38], 0
jne 0x1400026a3
lea rdx, str.SpeedHack_On
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003b50
mov rcx, rax
lea rdx, [0x140003d20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor r13d, r13d
mov ecx, 0x79
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140002497
mov dword [rsp + 0x50], 0x48c
mov dword [rsp + 0x54], 0xdf0
mov ecx, 8
call fcn.140004138
mov qword [rbp + 0x3c8], rax
lea rdx, [rax + 8]
mov qword [rbp + 0x3d8], rdx
mov rcx, qword [rsp + 0x50]
mov qword [rax], rcx
mov qword [rbp + 0x3d0], rdx
lea rdx, [r15 + 0x74e6048]
lea r8, [rbp + 0x3c8]
mov rcx, r14
call fcn.140001010
mov r10, rax
mov r8d, dword [rsp + 0x48]
inc r8d
mov eax, 0x38e38e39
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*8]
shl ecx, 2
sub r8d, ecx
mov dword [rsp + 0x48], r8d
movsxd rax, r8d
mov ecx, dword [rbp + rax*4 + 0x530]
add ecx, 0x3e8
mov dword [rbp + 0x4f0], ecx
mov eax, r8d
shl eax, 6
movsxd rcx, eax
add rcx, 0x654b6f0
add rcx, r15
mov qword [rbp + 0x520], rcx
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x4f0]
mov rdx, r10
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [r15 + 0x5f59550]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x520]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x7a
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x21
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140002501
add r12d, 2
mov eax, 0x55555555
imul r12d
sub edx, r12d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [r12 + rdx]
lea r12d, [rax + rdx*2]
mov edx, r12d
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140003d20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 0x4b
mov ecx, 0x2ee
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x22
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14000255f
inc r12d
mov eax, 0x55555555
imul r12d
sub edx, r12d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [r12 + rdx]
lea r12d, [rax + rdx*2]
mov edx, r12d
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140003d20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 0x4b
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x7b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14000295a
xorps xmm0, xmm0
movups xmmword [rbp + 0x3c8], xmm0
mov qword [rbp + 0x3d8], r13
mov qword [rbp + 0x3e0], 0xf
mov byte [rbp + 0x3c8], 0
movups xmmword [rbp + 0x490], xmm0
mov qword [rbp + 0x4a0], r13
mov qword [rbp + 0x4a8], 0xf
mov byte [rbp + 0x490], 0
lea rdx, str.Command__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003b50
lea rdx, [rbp + 0x3c8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140003d60
lea rcx, [rbp + 0x3c8]
mov rsi, qword [rbp + 0x3e0]
cmp rsi, 0x10
setae r13b
mov rdi, qword [rbp + 0x3c8]
cmovae rcx, rdi
mov rbx, qword [rbp + 0x3d8]
cmp rbx, 3
jne 0x1400027ee
mov r8, rbx
lea rdx, [0x1400066f4]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400027ee
lea rdx, str.Set_new_FOV__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003b50
lea rdx, [rbp + 0x490]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140003d60
lea rcx, [rbp + 0x490]
cmp qword [rbp + 0x4a8], 0x10
cmovae rcx, qword [rbp + 0x490]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
ucomiss xmm1, xmm11
jp 0x140002676
je 0x14000267c
movss dword [rsp + 0x58], xmm1
lea rdx, str.FOV_set_to_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003b50
mov rcx, rax
movss xmm1, dword [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___float____ptr64]
jmp 0x1400028b5
lea rdx, [r15 + 0x1b38024]
xor r13d, r13d
mov qword [rsp + 0x20], r13
lea r9d, [r13 + 4]
lea r8, [rbp + 0x434]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [r15 + 0x64e9c40]
mov qword [rsp + 0x20], r13
lea r9d, [r13 + 4]
lea r8, [rbp + 0x438]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [r15 + 0x64e9c44]
mov qword [rsp + 0x20], r13
lea r9d, [r13 + 4]
lea r8, [rbp + 0x43c]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [r15 + 0x6502c7c]
mov qword [rsp + 0x20], r13
lea r9d, [r13 + 4]
lea r8, [rbp + 0x440]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [r15 + 0x6502c80]
mov qword [rsp + 0x20], r13
lea r9d, [r13 + 4]
lea r8, [rbp + 0x444]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [r15 + 0x6502c94]
mov qword [rsp + 0x20], r13
lea r9d, [r13 + 4]
lea r8, [rbp + 0x448]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [r15 + 0x654d9a4]
mov qword [rsp + 0x20], r13
lea r9d, [r13 + 4]
lea r8, [rbp + 0x44c]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [r15 + 0x64e5460]
mov qword [rsp + 0x20], r13
lea r9d, [r13 + 4]
lea r8, [rbp + 0x42c]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [r15 + 0x64e5468]
mov qword [rsp + 0x20], r13
lea r9d, [r13 + 4]
lea r8, [rbp + 0x45c]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, str.SpeedHack_Off
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003b50
mov rcx, rax
lea rdx, [0x140003d20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140002398
lea rcx, [rbp + 0x3c8]
test r13b, r13b
cmovne rcx, rdi
cmp rbx, 0xa
jne 0x1400028c6
mov r8, rbx
lea rdx, str.mateOffset
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400028c6
lea rdx, str.Set_new_mate_offset__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003b50
lea rdx, [rbp + 0x490]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140003d60
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov r13, rax
lea rbx, [rbp + 0x490]
cmp qword [rbp + 0x4a8], 0x10
cmovae rbx, qword [rbp + 0x490]
mov dword [rax], 0
mov r8d, 0xa
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
mov r12d, eax
cmp rbx, qword [rsp + 0x60]
je 0x140003461
cmp dword [r13], 0x22
je 0x140003453
lea rdx, str.Mate_offset_changed_to_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003b50
mov rcx, rax
mov edx, r12d
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
lea rdx, [0x140003d20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x4a8]
cmp rdx, 0x10
jb 0x140002907
inc rdx
mov rcx, qword [rbp + 0x490]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002902
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000346f
call fcn.140004130
xor r13d, r13d
mov qword [rbp + 0x4a0], r13
mov qword [rbp + 0x4a8], 0xf
mov byte [rbp + 0x490], r13b
cmp rsi, 0x10
jb 0x14000295a
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140002952
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003476
mov rcx, rdi
call fcn.140004130
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140002beb
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140002beb
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x3f8], 0
mov dword [rbp + 0x3fc], 0
mov dword [rbp + 0x4c0], 0x43160000
lea rdx, [r15 + 0x181b2dc]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x3f8]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rdx, [r15 + 0x181b2e4]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x3fc]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp + 0x3fc]
addss xmm0, dword [rbp + 0x3f8]
ucomiss xmm0, xmm11
jp 0x140002a0b
je 0x140002beb
mov ecx, 4
call fcn.140004138
mov qword [rbp + 0x3c8], rax
lea rcx, [rax + 4]
mov qword [rbp + 0x3d8], rcx
mov dword [rax], pe_nt_image_headers64
mov qword [rbp + 0x3d0], rcx
lea rdx, [r15 + 0x1d7d0c0]
lea r8, [rbp + 0x3c8]
mov rcx, r14
call fcn.140001010
mov rdi, rax
mov ecx, 4
call fcn.140004138
mov qword [rbp + 0x3c8], rax
lea rcx, [rax + 4]
mov qword [rbp + 0x3d8], rcx
mov dword [rax], 0x120
mov qword [rbp + 0x3d0], rcx
lea rdx, [r15 + 0x1deab08]
lea r8, [rbp + 0x3c8]
mov rcx, r14
call fcn.140001010
mov rbx, rax
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x3f8]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [rdi + 4]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x4c0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [rdi + 8]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x3fc]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rbp + 0x4c4], r13d
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x4c4]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rbp + 0x4c8], 0xc3fa0000
lea rdx, [r15 + 0x1deabd4]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x4c8]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x468], xmm0
movups xmmword [rbp + 0x478], xmm0
mov qword [rbp + 0x488], rax
lea ecx, [rax + 9]
call qword [sym.imp.USER32.dll_VkKeyScanW]
movzx ecx, al
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov dword [rbp + 0x468], 1
mov dword [rbp + 0x474], 8
mov word [rbp + 0x472], ax
mov r8d, 0x28
lea rdx, [rbp + 0x468]
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x474], 0xa
mov r8d, 0x28
lea rdx, [rbp + 0x468]
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
lea rdx, str.TP_to_GPS
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003b50
mov rcx, rax
lea rdx, [0x140003d20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp byte [rsp + 0x30], 0
je 0x140002fc0
mov ecx, 4
call fcn.140004138
mov qword [rbp + 0x3c8], rax
lea rcx, [rax + 4]
mov qword [rbp + 0x3d8], rcx
mov dword [rax], pe_nt_image_headers64
mov qword [rbp + 0x3d0], rcx
lea rdx, [r15 + 0x1d7d0c0]
lea r8, [rbp + 0x3c8]
mov rcx, r14
call fcn.140001010
mov rbx, rax
mov dword [rbp + 0x3c0], 0
mov dword [rbp + 0x3ec], 0
lea rdx, [r15 + 0x1758e24]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x3c0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rdx, [r15 + 0x1758e44]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x3ec]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp + 0x3c0]
subss xmm0, xmm11
divss xmm0, dword [0x140006810]
mulss xmm0, dword [0x140006840]
subss xmm0, xmm13
movss dword [rbp + 0x3c0], xmm0
movss xmm1, dword [rbp + 0x3ec]
subss xmm1, dword [0x1400067fc]
divss xmm1, dword [0x140006808]
mulss xmm1, xmm13
movss xmm0, dword [0x140006848]
subss xmm0, xmm1
movss dword [rbp + 0x3ec], xmm0
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140002d01
movaps xmm8, xmm15
jmp 0x140002d0a
movss xmm8, dword [0x1400067f4]
mov ecx, 0x5a
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140002d9e
movss xmm6, dword [rbp + 0x3c0]
mulss xmm6, xmm10
movaps xmm7, xmm8
divss xmm7, xmm9
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_sinf
mulss xmm0, xmm7
movss xmm1, dword [rbp + 0x3b4]
subss xmm1, xmm0
movss dword [rbp + 0x3b4], xmm1
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_cosf
mulss xmm0, xmm7
movss xmm1, dword [rbp + 0x3b8]
subss xmm1, xmm0
movss dword [rbp + 0x3b8], xmm1
movss xmm0, dword [rbp + 0x3ec]
mulss xmm0, xmm10
call sub.api_ms_win_crt_math_l1_1_0.dll_sinf
mulss xmm0, xmm7
movss xmm1, dword [rbp + 0x3bc]
addss xmm1, xmm0
movss dword [rbp + 0x3bc], xmm1
mov ecx, 0x53
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140002e32
movss xmm6, dword [rbp + 0x3c0]
mulss xmm6, xmm10
movaps xmm7, xmm8
divss xmm7, xmm9
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_sinf
mulss xmm0, xmm7
movss xmm1, dword [rbp + 0x3b4]
addss xmm1, xmm0
movss dword [rbp + 0x3b4], xmm1
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_cosf
mulss xmm0, xmm7
movss xmm1, dword [rbp + 0x3b8]
addss xmm1, xmm0
movss dword [rbp + 0x3b8], xmm1
movss xmm0, dword [rbp + 0x3ec]
mulss xmm0, xmm10
call sub.api_ms_win_crt_math_l1_1_0.dll_sinf
mulss xmm0, xmm7
movss xmm1, dword [rbp + 0x3bc]
subss xmm1, xmm0
movss dword [rbp + 0x3bc], xmm1
mov ecx, 0x51
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140002e9d
movss xmm7, dword [rbp + 0x3c0]
subss xmm7, xmm12
mulss xmm7, xmm10
movaps xmm6, xmm8
divss xmm6, xmm9
movaps xmm0, xmm7
call sub.api_ms_win_crt_math_l1_1_0.dll_sinf
mulss xmm0, xmm6
movss xmm1, dword [rbp + 0x3b4]
subss xmm1, xmm0
movss dword [rbp + 0x3b4], xmm1
movaps xmm0, xmm7
call sub.api_ms_win_crt_math_l1_1_0.dll_cosf
mulss xmm0, xmm6
movss xmm1, dword [rbp + 0x3b8]
subss xmm1, xmm0
movss dword [rbp + 0x3b8], xmm1
mov ecx, 0x44
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140002f08
movss xmm7, dword [rbp + 0x3c0]
addss xmm7, xmm12
mulss xmm7, xmm10
movaps xmm6, xmm8
divss xmm6, xmm9
movaps xmm0, xmm7
call sub.api_ms_win_crt_math_l1_1_0.dll_sinf
mulss xmm0, xmm6
movss xmm1, dword [rbp + 0x3b4]
subss xmm1, xmm0
movss dword [rbp + 0x3b4], xmm1
movaps xmm0, xmm7
call sub.api_ms_win_crt_math_l1_1_0.dll_cosf
mulss xmm0, xmm6
movss xmm1, dword [rbp + 0x3b8]
subss xmm1, xmm0
movss dword [rbp + 0x3b8], xmm1
addss xmm8, xmm8
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140002f3a
movaps xmm0, xmm8
divss xmm0, xmm9
movss xmm1, dword [rbp + 0x3bc]
addss xmm1, xmm0
movss dword [rbp + 0x3bc], xmm1
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140002f64
divss xmm8, xmm9
movss xmm0, dword [rbp + 0x3bc]
subss xmm0, xmm8
movss dword [rbp + 0x3bc], xmm0
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x3b4]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [rbx + 4]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x3bc]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [rbx + 8]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x3b8]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [rsp + 0x31], 0
je 0x14000307f
mov ecx, 0x41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14000307f
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14000307f
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x468], xmm0
movups xmmword [rbp + 0x478], xmm0
mov qword [rbp + 0x488], rax
lea ecx, [rax + 0x61]
call qword [sym.imp.USER32.dll_VkKeyScanW]
movzx ecx, al
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov dword [rbp + 0x468], 1
mov dword [rbp + 0x474], 8
mov word [rbp + 0x472], ax
mov r8d, 0x28
lea rdx, [rbp + 0x468]
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
mov ecx, 0x1e
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x474], 0xa
mov r8d, 0x28
lea rdx, [rbp + 0x468]
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
cmp byte [rsp + 0x34], 0
je 0x14000337d
mov ecx, 0x45
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx r13d, byte [rsp + 0x32]
test ax, ax
jns 0x14000327b
test r13b, r13b
jne 0x14000327b
mov ecx, 4
call fcn.140004138
mov qword [rbp + 0x3c8], rax
lea rcx, [rax + 4]
mov qword [rbp + 0x3d8], rcx
mov dword [rax], 0x80
mov qword [rbp + 0x3d0], rcx
lea rdx, [r15 + 0x5f595c0]
lea r8, [rbp + 0x3c8]
mov rcx, r14
call fcn.140001010
mov rsi, rax
mov r13b, 1
mov byte [rsp + 0x32], r13b
lea rax, [rbp + 0x454]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8d, [r9 - 0x3c]
lea rdx, [r15 + 0x6d347b]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
xor edi, edi
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 4]
lea r8, [0x14000676c]
lea rdx, [r15 + 0x6d347b]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rbp + 0x454]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x454]
lea r8d, [rdi + 4]
lea rdx, [r15 + 0x6d347b]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rax, [rbp + 0x450]
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 0x40]
lea r8d, [rdi + 6]
lea rdx, [r15 + 0x6d3487]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 6]
lea r8, [0x1400065ec]
lea rdx, [r15 + 0x6d3487]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rbp + 0x450]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x450]
lea r8d, [rdi + 6]
lea rdx, [r15 + 0x6d3487]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rdi, [rsi + 4]
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x3f0]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rbx, [rsi + 0xc]
xor esi, esi
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 4]
lea r8, [rbp + 0x3f4]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp + 0x3f0]
mulss xmm0, xmm14
movss dword [rbp + 0x3f0], xmm0
movss xmm1, dword [rbp + 0x3f4]
mulss xmm1, xmm14
movss dword [rbp + 0x3f4], xmm1
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 4]
lea r8, [rbp + 0x3f0]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 4]
lea r8, [rbp + 0x3f4]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x45
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14000337a
cmp r13b, 1
jne 0x14000337a
mov byte [rsp + 0x32], al
lea rax, [rbp + 0x430]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8d, [r9 - 0x3c]
lea rdx, [r15 + 0x6d347b]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
xor r13d, r13d
mov qword [rsp + 0x20], r13
lea r9d, [r13 + 4]
lea r8, [0x140006774]
lea rdx, [r15 + 0x6d347b]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rbp + 0x430]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x430]
lea r8d, [r13 + 4]
lea rdx, [r15 + 0x6d347b]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rax, [rbp + 0x458]
mov qword [rsp + 0x20], rax
lea r9d, [r13 + 0x40]
lea r8d, [r13 + 6]
lea rdx, [r15 + 0x6d3487]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], r13
lea r9d, [r13 + 6]
lea r8, [0x14000677c]
lea rdx, [r15 + 0x6d3487]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rbp + 0x458]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x458]
lea r8d, [r13 + 6]
lea rdx, [r15 + 0x6d3487]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
jmp 0x14000337d
xor r13d, r13d
movzx esi, byte [rsp + 0x35]
test sil, sil
je 0x140003424
mov ecx, 4
call fcn.140004138
mov qword [rbp + 0x3c8], rax
lea rcx, [rax + 4]
mov qword [rbp + 0x3d8], rcx
mov dword [rax], 0x2030
mov qword [rbp + 0x3d0], rcx
lea rdx, [r15 + 0x5f595c0]
lea r8, [rbp + 0x3c8]
mov rcx, r14
call fcn.140001010
mov rbx, rax
mov dword [rbp + 0x3b0], r13d
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x3b0]
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movd xmm0, dword [rbp + 0x3b0]
cvtdq2ps xmm0, xmm0
movss dword [rbp + 0x4dc], xmm0
lea rdx, [rbx + 0x10]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x4dc]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14000347d
lea rdx, [rbp + 0x400]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x14000347d
movzx r13d, byte [rsp + 0x33]
jmp 0x1400017c6
lea rcx, str.stoi_argument_out_of_range
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
int3
lea rcx, str.invalid_stoi_argument
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const____ptr64_]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rax, [rbp + 0x3b0]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8d, [r9 - 0x36]
lea rdx, [r15 + 0x2a5005]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
xor esi, esi
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 0xa]
lea r8, [0x140006788]
lea rdx, [r15 + 0x2a5005]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rbp + 0x3b0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x3b0]
lea r8d, [rsi + 0xa]
lea rdx, [r15 + 0x2a5005]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rax, [rbp + 0x3b0]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 0x40]
lea r8d, [rsi + 5]
lea rdx, [r15 + 0x17ed20]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 5]
lea r8, [0x140006794]
lea rdx, [r15 + 0x17ed20]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rbp + 0x3b0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x3b0]
lea r8d, [rsi + 5]
lea rdx, [r15 + 0x17ed20]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rax, [rbp + 0x3b0]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 0x40]
lea r8d, [rsi + 6]
lea rdx, [r15 + 0x17d453]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 6]
lea r8, [0x14000679c]
lea rdx, [r15 + 0x17d453]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rbp + 0x3b0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x3b0]
lea r8d, [rsi + 6]
lea rdx, [r15 + 0x17d453]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rax, [rbp + 0x3b0]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 0x40]
lea r8d, [rsi + 0xa]
lea rdx, [r15 + 0x17f3c5]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 0xa]
lea r8, [0x1400067a8]
lea rdx, [r15 + 0x17f3c5]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rbp + 0x3b0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x3b0]
lea r8d, [rsi + 0xa]
lea rdx, [r15 + 0x17f3c5]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rax, [rbp + 0x3b0]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 0x40]
lea r8d, [rsi + 5]
lea rdx, [r15 + 0x17ed38]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 5]
lea r8, [0x1400067b4]
lea rdx, [r15 + 0x17ed38]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rbp + 0x3b0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x3b0]
lea r8d, [rsi + 5]
lea rdx, [r15 + 0x17ed38]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rax, [rbp + 0x3b0]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 0x40]
lea r8d, [rsi + 6]
lea rdx, [r15 + 0x17d45c]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 6]
lea r8, [0x1400067bc]
lea rdx, [r15 + 0x17d45c]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rbp + 0x3b0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x3b0]
lea r8d, [rsi + 6]
lea rdx, [r15 + 0x17d45c]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rax, [rbp + 0x3b0]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 0x40]
lea r8d, [rsi + 0xa]
lea rdx, [r15 + 0x17f3cf]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 0xa]
lea r8, [0x1400067c8]
lea rdx, [r15 + 0x17f3cf]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rbp + 0x3b0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x3b0]
lea r8d, [rsi + 0xa]
lea rdx, [r15 + 0x17f3cf]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rax, [rbp + 0x3b0]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 0x40]
lea r8d, [rsi + 9]
lea rdx, [r15 + 0x8336c2]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 9]
lea r8, [0x140006660]
lea rdx, [r15 + 0x8336c2]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rbp + 0x3b0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x3b0]
lea r8d, [rsi + 9]
lea rdx, [r15 + 0x8336c2]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rdx, [r15 + 0x1b38024]
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 4]
lea r8, [rbp + 0x434]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [r15 + 0x64e9c40]
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 4]
lea r8, [rbp + 0x438]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [r15 + 0x64e9c44]
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 4]
lea r8, [rbp + 0x43c]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [r15 + 0x6502c7c]
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 4]
lea r8, [rbp + 0x440]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [r15 + 0x6502c80]
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 4]
lea r8, [rbp + 0x444]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [r15 + 0x6502c94]
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 4]
lea r8, [rbp + 0x448]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [r15 + 0x654d9a4]
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 4]
lea r8, [rbp + 0x44c]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [r15 + 0x64e5460]
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 4]
lea r8, [rbp + 0x4d0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [r15 + 0x64e5468]
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 4]
lea r8, [rbp + 0x4d4]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor eax, eax
mov rcx, qword [rbp + 0x780]
xor rcx, rsp
call fcn.140004110
lea r11, [rsp + 0x930]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
movaps xmm14, xmmword [r11 - 0x90]
movaps xmm15, xmmword [r11 - 0xa0]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret