Function at 0x140048960
Capabilities:
Create thread
Log keystrokes via polling
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2b8]
sub rsp, 0x390
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
movaps xmmword [rax - 0xa8], xmm13
movaps xmmword [rax - 0xb8], xmm14
movaps xmmword [rax - 0xc8], xmm15
mov rax, qword [0x14005e040]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
xor r12d, r12d
mov dword [rbp + 0x90], 0x50
mov dword [rbp + 0x94], 0x40
lea rax, [0x14004a400]
mov qword [rbp + 0x98], rax
mov qword [rbp + 0xa0], r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp + 0xa8], rax
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xb0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xc0], xmm1
lea rbx, str.bootim
mov qword [rbp + 0xd0], rbx
mov qword [rbp + 0xd8], r12
lea rcx, [rbp + 0x90]
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov qword [rsp + 0x58], r12
mov rax, qword [rbp + 0xa8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], 5
mov dword [rsp + 0x30], 5
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
mov r9d, 0x80000000
mov r8, rbx
mov rdx, qword [rbp + 0xd0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rbx, rax
mov qword [0x140081b70], rax
mov ecx, 0x20
call qword [sym.imp.d3d9.dll_Direct3DCreate9]
mov rcx, rax
mov qword [0x140081b68], rax
test rax, rax
je 0x14004a347
mov qword [0x140081b10], r12
mov qword [0x140081b1c], r12
mov dword [0x140081b24], r12d
mov qword [0x140081b2c], r12
mov dword [0x140081b34], r12d
mov qword [0x140081b44], r12
mov dword [0x140081b38], 1
mov dword [0x140081b28], 1
mov dword [0x140081b18], r12d
mov dword [0x140081b3c], 1
mov dword [0x140081b40], 0x50
mov dword [0x140081b4c], 1
mov rax, qword [rax]
lea rdx, [0x140081b50]
mov qword [rsp + 0x30], rdx
lea rdx, [0x140081b10]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0x40
mov r9, rbx
xor edx, edx
mov r8d, 1
call qword [rax + 0x80]
test eax, eax
js 0x14004a340
xor edx, edx
mov rcx, qword [0x140081b70]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x140081b70]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rax, qword [0x140081b00]
test rax, rax
je 0x140048b8b
inc dword [rax + 0x3b0]
mov ecx, 0x40b0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbp - 0x68], rax
lea rcx, [rbp - 0x80]
mov qword [rbp - 0x70], rcx
mov qword [rbp - 0x78], rax
test rax, rax
je 0x140048bb7
xor edx, edx
mov rcx, rax
call fcn.1400014f0
jmp 0x140048bba
mov rax, r12
cmp qword [0x140081b00], 0
jne 0x140048bcb
mov qword [0x140081b00], rax
mov rcx, rax
call fcn.140007f20
mov r13, qword [0x140081b00]
or dword [r13 + 8], 0x400
mov qword [r13 + 0x20], r12
mov qword [r13 + 0x28], r12
mov r14, qword [r13 + 0xa8]
lea rdx, [0x14004e9fc]
lea r15, str.c:WindowsFontsVerdana.ttf
mov rcx, r15
call fcn.140002a00
mov rbx, rax
movss xmm13, dword [0x140054f9c]
test rax, rax
je 0x140048e7b
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140048e72
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140048e72
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140048e72
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140048e72
cmp rdi, 0xffffffffffffffff
je 0x140048e72
mov rax, qword [0x140081b00]
test rax, rax
je 0x140048c90
inc dword [rax + 0x3b0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140048e72
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140048ce7
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140081b00]
test rax, rax
je 0x140048cd9
dec dword [rax + 0x3b0]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140048e7b
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xorps xmm1, xmm1
xor eax, eax
movups xmmword [rbp - 0x20], xmm1
movups xmmword [rbp - 0x10], xmm1
movups xmmword [rbp + 0x20], xmm1
movups xmmword [rbp + 0x30], xmm1
mov qword [rbp + 0x60], rax
mov byte [rbp - 0x14], 1
mov dword [rbp - 8], 3
mov dword [rbp - 4], 1
mov dword [rbp + 0x24], 0x7f7fffff
mov dword [rbp + 0x30], 0x3f800000
mov eax, 0xffff
mov word [rbp + 0x34], ax
movaps xmm3, xmmword [rbp - 0x20]
movaps xmmword [rbp + 0x150], xmm3
movaps xmm4, xmmword [rbp - 0x10]
movaps xmmword [rbp + 0x160], xmm4
movaps xmmword [rbp + 0x170], xmm1
xorps xmm5, xmm5
movaps xmmword [rbp + 0x180], xmm5
movaps xmm6, xmmword [rbp + 0x20]
movaps xmmword [rbp + 0x190], xmm6
movaps xmm2, xmmword [rbp + 0x30]
movaps xmmword [rbp + 0x1a0], xmm2
xorps xmm7, xmm7
movaps xmmword [rbp + 0x1b0], xmm7
xorps xmm8, xmm8
movaps xmmword [rbp + 0x1c0], xmm8
movsd xmm9, qword [rbp + 0x60]
movsd qword [rbp + 0x1d0], xmm9
movdqa xmm0, xmm2
psrldq xmm0, 6
movd eax, xmm0
test al, al
jne 0x140048e2f
lea r9, [0x140054e14]
nop dword [rax]
lea rcx, [r9 - 1]
movzx eax, byte [rcx]
cmp al, 0x2f
je 0x140048dc7
cmp al, 0x5c
je 0x140048dc7
mov r9, rcx
cmp rcx, r15
ja 0x140048db0
movsd xmm0, qword [0x140054fe0]
movsd qword [rsp + 0x20], xmm0
lea r8, str._s___.0fpx
mov edx, 0x28
lea rcx, [rbp + 0x1a6]
call fcn.1400028d0
movsd xmm9, qword [rbp + 0x1d0]
movaps xmm8, xmmword [rbp + 0x1c0]
movaps xmm7, xmmword [rbp + 0x1b0]
movaps xmm2, xmmword [rbp + 0x1a0]
movaps xmm6, xmmword [rbp + 0x190]
movaps xmm5, xmmword [rbp + 0x180]
movaps xmm1, xmmword [rbp + 0x170]
movaps xmm4, xmmword [rbp + 0x160]
movaps xmm3, xmmword [rbp + 0x150]
movaps xmmword [rbp - 0x20], xmm3
movaps xmmword [rbp - 0x10], xmm4
movaps xmmword [rbp], xmm1
movaps xmmword [rbp + 0x10], xmm5
movaps xmmword [rbp + 0x20], xmm6
movaps xmmword [rbp + 0x30], xmm2
movaps xmmword [rbp + 0x40], xmm7
movaps xmmword [rbp + 0x50], xmm8
movsd qword [rbp + 0x60], xmm9
mov qword [rbp - 0x20], rsi
mov dword [rbp - 0x18], edi
mov dword [rbp - 0xc], 0x41900000
lea rdx, [rbp - 0x20]
mov rcx, r14
call fcn.14002f5d0
jmp 0x140048e7b
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140081b00]
mov dword [rax + 0x1648], 0x40000000
mov dword [rax + 0x1660], 0x42200000
mov dword [rax + 0x16ac], 0x42200000
mov dword [rax + 0x16b4], 0x42200000
mov dword [rax + 0x1668], 0x42200000
mov dword [rax + 0x1644], 0x40400000
mov dword [rax + 0x1678], 0x41000000
movdqa xmm0, xmmword [0x1400551b0]
movups xmmword [rax + 0x171c], xmm0
mov rcx, qword [0x140081b78]
test rcx, rcx
je 0x140048ef0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x140081b78], r12
lea rdi, [0x140081b78]
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x60], r12
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0xffffffff
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], 0xffffffff
mov dword [rsp + 0x20], 0xffffffff
mov r9d, 0xffffffff
mov r8d, 0x22e71
lea rdx, [0x14005e0c0]
mov rcx, qword [0x140081b50]
call qword [sym.imp.d3dx9_43.dll_D3DXCreateTextureFromFileInMemoryEx]
call fcn.140035370
mov rcx, qword [0x140081b50]
mov rbx, qword [0x140081b00]
lea rax, str.imgui_impl_dx9
mov qword [rbx + 0xe8], rax
or dword [rbx + 0xc], 0x1008
mov qword [0x140081bd0], rcx
mov rax, qword [rcx]
call qword [rax + 8]
test dword [rbx + 8], 0x400
je 0x140048fe5
mov rax, qword [0x140081b00]
lea rcx, [fcn.140035040]
mov qword [rax + 0x15f0], rcx
lea rcx, [fcn.140035110]
mov qword [rax + 0x15f8], rcx
lea rcx, [0x140035190]
mov qword [rax + 0x1600], rcx
lea rcx, [0x1400351f0]
mov qword [rax + 0x1608], rcx
lea rcx, [0x140035340]
mov qword [rax + 0x1610], rcx
call fcn.140047bc0
xorps xmm0, xmm0
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x130], xmm0
movups xmmword [rbp + 0x140], xmm0
lea rsi, [0x1400484d0]
lea r14, [fcn.140001160]
lea r15, [0x140048420]
movdqa xmm9, xmmword [0x140055430]
movdqa xmm12, xmmword [0x140055210]
movss xmm6, dword [0x140055050]
movss xmm11, dword [0x140055034]
movss xmm7, dword [0x1400550a4]
movss xmm10, dword [0x140055038]
movss xmm15, dword [0x14005505c]
movss xmm14, dword [0x140055070]
movss xmm8, dword [0x140055064]
nop word [rax + rax]
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x120]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x1400490b0
lea rcx, [rbp + 0x120]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x120]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x14004a1ac
cmp qword [0x140081bc0], 0
jne 0x1400490bf
call fcn.140034ed0
mov rbx, qword [0x140081b00]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x78], xmm0
lea rdx, [rbp + 0x78]
mov rcx, qword [0x140081c00]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rbp + 0x84]
sub eax, dword [rbp + 0x7c]
movd xmm1, eax
cvtdq2ps xmm1, xmm1
mov eax, dword [rbp + 0x80]
sub eax, dword [rbp + 0x78]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x10], xmm0
movss dword [rbx + 0x14], xmm1
cmp byte [0x140080f33], 0
je 0x140049169
mov rdi, qword [0x140081b00]
mov ecx, dword [rdi + 0x161c]
test ecx, ecx
jns 0x140049140
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
mov edx, r12d
test eax, eax
cmovg edx, eax
lea rcx, [rdi + 0x1618]
call fcn.140022b20
mov dword [rdi + 0x1618], r12d
xor r9d, r9d
lea r8, [0x140035dd0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplayMonitors]
mov byte [0x140080f33], 0
lea rdi, [0x140081b78]
mov qword [rbp + 0xe0], r12
lea rcx, [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
sub rax, qword [0x140081c08]
xorps xmm1, xmm1
cvtsi2ss xmm1, rax
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x140081c10]
divss xmm1, xmm0
movss dword [rbx + 0x18], xmm1
mov qword [0x140081c08], rcx
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rbx + 0x13c], al
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rbx + 0x13d], al
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rbx + 0x13e], al
mov byte [rbx + 0x13f], 0
call fcn.1400358f0
cmp byte [rbx + 0xcf], 0
je 0x140049210
mov eax, 0xffffffff
jmp 0x14004921d
mov rax, qword [0x140081b00]
mov eax, dword [rax + 0x20d0]
cmp dword [0x140080f3c], eax
je 0x140049230
mov dword [0x140080f3c], eax
call fcn.140035770
call fcn.140035b00
call fcn.140006c00
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, 0x11
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
cmp byte [0x140080f31], 0
je 0x1400496d5
mov rax, qword [0x140081b00]
or dword [rax + 0x1dc0], 2
mov dword [rax + 0x1de4], 0x43c80000
mov dword [rax + 0x1de8], 0x43960000
mov dword [rax + 0x1dc8], 1
cmp dword [0x140081c60], 0
jne 0x1400496d0
mov r8d, 0x12a
lea rdx, [0x140080f31]
lea rcx, [0x14004eb80]
call fcn.14000cee0
mov dword [rbp - 0x40], 0x42820000
mov dword [rbp - 0x3c], 0x42820000
mov rcx, qword [0x140081b00]
mov rax, qword [rcx + 0x1d18]
movss xmm2, dword [rax + 0x118]
movss xmm0, dword [rax + 0x11c]
addss xmm2, dword [0x140055058]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
xorps xmm0, xmm0
movups xmmword [rbp + 0x78], xmm0
movups xmmword [rbp - 0x60], xmm9
mov dword [rbp - 0x50], 0x3f800000
mov dword [rbp - 0x4c], 0x3f800000
mov qword [rbp - 0x48], 0
movsxd rax, dword [0x140081b58]
lea rcx, [rbp + 0x78]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x50]
lea r8, [rbp - 0x48]
lea rdx, [rbp - 0x40]
mov rcx, qword [rdi + rax*8]
call fcn.14003b9b0
mov rax, qword [0x140081b00]
mov rcx, qword [rax + 0x1d18]
movss xmm0, dword [rcx + 0x54]
movss xmm1, dword [rcx + 0x50]
unpcklps xmm1, xmm0
movq rdx, xmm1
call fcn.140047840
mov ebx, 4
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov eax, dword [rbx + rdi]
cmp dword [0x140081db0], eax
jle 0x140049434
lea rcx, [0x140081db0]
call fcn.14004b358
cmp dword [0x140081db0], 0xffffffff
jne 0x140049434
mov eax, dword [rbx + rdi]
cmp dword [0x140081da0], eax
jle 0x140049428
lea rcx, [0x140081da0]
call fcn.14004b358
cmp dword [0x140081da0], 0xffffffff
jne 0x140049428
mov ecx, 0x28
call fcn.14004b8d4
mov qword [rbp + 0x70], rax
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov qword [rax + 0x20], rcx
mov rcx, rax
call fcn.1400470a0
nop
mov qword [0x140081da8], rax
lea rcx, [0x140081da0]
call fcn.14004b2ec
nop
lea rcx, [0x140081db0]
call fcn.14004b2ec
mov eax, dword [rbx + rdi]
cmp dword [0x140081dc8], eax
jle 0x140049468
lea rcx, [0x140081dc8]
call fcn.14004b358
cmp dword [0x140081dc8], 0xffffffff
jne 0x140049468
movups xmmword [0x140081db8], xmm12
lea rcx, [0x140081dc8]
call fcn.14004b2ec
mov eax, dword [rbx + rdi]
cmp dword [0x140081dcc], eax
jle 0x14004949c
lea rcx, [0x140081dcc]
call fcn.14004b358
cmp dword [0x140081dcc], 0xffffffff
jne 0x14004949c
movups xmmword [0x140081d90], xmm9
lea rcx, [0x140081dcc]
call fcn.14004b2ec
mov rcx, qword [0x140081b00]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x54]
subss xmm0, dword [rax + 0xa0]
movss xmm2, dword [rax + 0x50]
subss xmm2, dword [rax + 0x9c]
addss xmm2, dword [0x140055048]
addss xmm0, dword [0x140055054]
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
mov qword [rbp - 0x38], 0
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0xff
lea r8, [0x1400810f1]
lea rdx, str.Username
lea rcx, str.username
call fcn.14003f620
mov rcx, qword [0x140081b00]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm2, dword [rax + 0x50]
subss xmm2, dword [rax + 0x9c]
movss xmm0, dword [rax + 0x54]
subss xmm0, dword [rax + 0xa0]
addss xmm2, dword [0x140055048]
addss xmm0, dword [0x140055060]
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
mov qword [rbp - 0x30], 0
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0xff
lea r8, [0x1400811f0]
lea rdx, str.Password
lea rcx, str.password
call fcn.14003f620
mov rcx, qword [0x140081b00]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x54]
subss xmm0, dword [rax + 0xa0]
movss xmm2, dword [rax + 0x50]
subss xmm2, dword [rax + 0x9c]
addss xmm0, dword [0x14005506c]
addss xmm2, dword [0x140055048]
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
mov qword [rbp - 0x28], 0
lea rdx, [rbp - 0x28]
lea rcx, str.Login
call fcn.1400398f0
test al, al
je 0x1400496bc
mov dword [0x140081c60], 1
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, 0x11
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
call fcn.14000ffd0
cmp dword [0x140081c60], 1
jne 0x140049c8b
mov r8d, 0x12a
lea rdx, [0x140080f31]
lea rcx, [0x14004eb80]
call fcn.14000cee0
mov rax, qword [0x140081b00]
mov rcx, qword [rax + 0x1d18]
movss xmm0, dword [rcx + 0x54]
movss xmm1, dword [rcx + 0x50]
unpcklps xmm1, xmm0
movq rdx, xmm1
call fcn.140047840
mov rcx, qword [0x140081b00]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm2, dword [rax + 0x50]
subss xmm2, dword [rax + 0x9c]
movss xmm0, dword [rax + 0x54]
subss xmm0, dword [rax + 0xa0]
addss xmm2, xmm6
addss xmm0, xmm11
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
cmp dword [0x140081c60], 1
sete dl
lea rcx, str.Software
call fcn.1400469c0
test al, al
je 0x1400497c0
mov r8d, 1
mov dword [0x140081c60], r8d
jmp 0x1400497c7
mov r8d, dword [0x140081c60]
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.140010dc0
cmp r8d, 2
sete dl
lea rcx, str.Spoofing
call fcn.1400469c0
test al, al
je 0x1400497f3
mov dword [0x140081c60], 2
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.140010dc0
mov r8, qword [0x140081b00]
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
movss xmm2, dword [rax + 0x50]
subss xmm2, dword [rax + 0x9c]
movss xmm0, dword [rax + 0x54]
subss xmm0, dword [rax + 0xa0]
addss xmm2, xmm10
addss xmm0, xmm6
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
mov qword [rbp - 0x78], 0
lea rdx, [rbp - 0x78]
lea rcx, str.__Attach_to_Fivem
call fcn.1400398f0
test al, al
je 0x14004990d
mov ecx, 8
call fcn.14004b8d4
mov qword [rax], rsi
mov qword [rbp + 0x78], rax
lea rcx, [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14004b0c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0xf0], rax
test rax, rax
je 0x14004a1c7
cmp dword [rbp + 0xf8], 0
je 0x14004a1bb
movaps xmm0, xmmword [rbp + 0xf0]
movdqa xmmword [rbp - 0x60], xmm0
lea rcx, [rbp - 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14004a1bb
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xf0], xmm0
mov rcx, qword [0x140081b00]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x54]
subss xmm0, dword [rax + 0xa0]
movss xmm2, dword [rax + 0x50]
subss xmm2, dword [rax + 0x9c]
addss xmm0, xmm15
addss xmm2, dword [0x140055040]
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
mov qword [rbp - 0x70], 0
lea rdx, [rbp - 0x70]
lea rcx, str.__Destruct
call fcn.1400398f0
test al, al
je 0x140049a20
mov ecx, 8
call fcn.14004b8d4
mov qword [rax], r14
mov qword [rbp + 0x78], rax
lea rcx, [rbp + 0x108]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14004b0c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x100], rax
test rax, rax
je 0x14004a1e6
cmp dword [rbp + 0x108], 0
je 0x14004a1da
movaps xmm0, xmmword [rbp + 0x100]
movdqa xmmword [rbp - 0x60], xmm0
lea rcx, [rbp - 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14004a1da
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x100], xmm0
mov rcx, qword [0x140081b00]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm2, dword [rax + 0x50]
subss xmm2, dword [rax + 0x9c]
movss xmm0, dword [rax + 0x54]
subss xmm0, dword [rax + 0xa0]
addss xmm0, xmm14
addss xmm2, xmm6
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
cmp byte [0x14005e0b4], 0
je 0x140049aad
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, 0x11
jmp 0x140049ab5
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
mov rcx, qword [0x140081b00]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm2, dword [rax + 0x50]
subss xmm2, dword [rax + 0x9c]
movss xmm0, dword [rax + 0x54]
subss xmm0, dword [rax + 0xa0]
addss xmm0, dword [0x140055068]
addss xmm2, xmm6
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
lea rdx, [0x14005e0b4]
lea rcx, str.Stream_Mode
call fcn.14003bdb0
mov rdx, qword [0x140081b00]
mov rcx, qword [rdx + 0x1d18]
cmp byte [rdx + 0x1fa7], 0
je 0x140049ba3
cmp byte [rdx + 0x1fa6], 0
jne 0x140049ba3
mov r8d, dword [rcx + 0x164]
mov eax, dword [rdx + 0x1f58]
cmp eax, r8d
jne 0x140049b94
test eax, eax
je 0x140049b94
cmp r8d, dword [rcx + 8]
jne 0x140049b90
cmp byte [rcx + 0xd1], 0
jne 0x140049b94
mov al, 1
jmp 0x140049b96
xor al, al
test al, al
je 0x140049c8b
jmp 0x140049c73
mov eax, dword [rcx + 0x168]
test al, 1
je 0x140049c8b
cmp qword [rdx + 0x1d20], rcx
je 0x140049bc2
test al, al
jns 0x140049c8b
mov eax, dword [rdx + 0x1d6c]
test eax, eax
je 0x140049be9
cmp eax, dword [rcx + 0x164]
je 0x140049be9
cmp byte [rdx + 0x1d79], 0
jne 0x140049be9
cmp eax, dword [rcx + 0x94]
jne 0x140049c8b
mov rax, qword [rdx + 0x1f50]
test rax, rax
je 0x140049c25
mov rax, qword [rax + 0x3d8]
test rax, rax
je 0x140049c25
cmp byte [rax + 0xd0], 0
je 0x140049c25
cmp rax, qword [rcx + 0x3d8]
je 0x140049c25
mov r8d, dword [rax + 0xc]
bt r8d, 0x1b
jb 0x140049c8b
bt r8d, 0x1a
jb 0x140049c8b
mov rax, qword [rdx + 0x1f10]
cmp qword [rcx + 0x38], rax
je 0x140049c4e
mov rax, qword [rdx + 0x1d38]
test rax, rax
je 0x140049c8b
mov rax, qword [rax + 0x3d8]
cmp qword [rcx + 0x3d8], rax
jne 0x140049c8b
test byte [rdx + 0x1d54], 4
jne 0x140049c8b
mov eax, dword [rcx + 0x164]
cmp eax, dword [rcx + 8]
je 0x140049c6a
cmp eax, dword [rcx + 0x94]
jne 0x140049c73
cmp byte [rcx + 0xd1], 0
jne 0x140049c8b
xor edx, edx
call fcn.1400114e0
lea rcx, str.Will_Be_Sometimes_Detected_From_Anticheats
call fcn.140038e30
call fcn.14000ffd0
cmp dword [0x140081c60], 2
jne 0x140049feb
mov r8d, 0x12a
lea rdx, [0x140080f31]
lea rcx, [0x14004eb80]
call fcn.14000cee0
mov rax, qword [0x140081b00]
mov rcx, qword [rax + 0x1d18]
movss xmm0, dword [rcx + 0x54]
movss xmm1, dword [rcx + 0x50]
unpcklps xmm1, xmm0
movq rdx, xmm1
call fcn.140047840
mov rcx, qword [0x140081b00]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x54]
subss xmm0, dword [rax + 0xa0]
movss xmm2, dword [rax + 0x50]
subss xmm2, dword [rax + 0x9c]
addss xmm0, xmm11
addss xmm2, xmm6
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
cmp dword [0x140081c60], 1
sete dl
lea rcx, str.Software
call fcn.1400469c0
test al, al
je 0x140049d76
mov r8d, 1
mov dword [0x140081c60], r8d
jmp 0x140049d7d
mov r8d, dword [0x140081c60]
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.140010dc0
cmp r8d, 2
sete dl
lea rcx, str.Spoofing
call fcn.1400469c0
test al, al
je 0x140049da9
mov dword [0x140081c60], 2
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.140010dc0
mov r8, qword [0x140081b00]
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
movss xmm2, dword [rax + 0x50]
subss xmm2, dword [rax + 0x9c]
movss xmm0, dword [rax + 0x54]
subss xmm0, dword [rax + 0xa0]
addss xmm2, xmm10
addss xmm0, xmm6
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
mov qword [rbp - 0x68], 0
lea rdx, [rbp - 0x68]
lea rcx, str.__Spoofing_Fivem
call fcn.1400398f0
test al, al
je 0x140049ec3
mov ecx, 8
call fcn.14004b8d4
mov qword [rax], r15
mov qword [rbp + 0x78], rax
lea rcx, [rbp + 0x118]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14004b0c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x110], rax
test rax, rax
je 0x14004a205
cmp dword [rbp + 0x118], 0
je 0x14004a1f9
movaps xmm0, xmmword [rbp + 0x110]
movdqa xmmword [rbp - 0x60], xmm0
lea rcx, [rbp - 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14004a1f9
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x110], xmm0
mov rcx, qword [0x140081b00]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x50]
subss xmm0, dword [rax + 0x9c]
movss xmm2, dword [rax + 0x54]
subss xmm2, dword [rax + 0xa0]
addss xmm0, xmm6
addss xmm2, xmm8
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
cmp byte [0x14005e0b5], 0
je 0x140049f50
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, 0x11
jmp 0x140049f58
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
mov rcx, qword [0x140081b00]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x50]
subss xmm0, dword [rax + 0x9c]
movss xmm2, dword [rax + 0x54]
subss xmm2, dword [rax + 0xa0]
addss xmm0, xmm6
addss xmm2, xmm8
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
lea rdx, [0x14005e0b5]
lea rcx, str.Stream_Mode
call fcn.14003bdb0
call fcn.140009360
mov rcx, qword [0x140081b50]
mov rax, qword [rcx]
mov dword [rsp + 0x30], r12d
movss dword [rsp + 0x28], xmm13
mov dword [rsp + 0x20], r12d
mov r9d, 3
xor r8d, r8d
xor edx, edx
call qword [rax + 0x158]
mov rcx, qword [0x140081b50]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x14004a06b
call fcn.140009830
mov rax, qword [0x140081b00]
mov rcx, qword [rax + 0x1ef8]
mov rax, qword [rcx]
add rax, 0xa8
mov rcx, r12
cmp byte [rax], r12b
cmovne rcx, rax
call fcn.1400346b0
mov rcx, qword [0x140081b50]
mov rax, qword [rcx]
call qword [rax + 0x150]
test dword [r13 + 8], 0x400
je 0x14004a158
call fcn.140018bd0
mov rbx, qword [0x140081b00]
mov r14d, 1
mov eax, dword [rbx + 0x1628]
cmp eax, r14d
jle 0x14004a0ec
mov esi, 8
nop dword [rax + rax]
mov rax, qword [rbx + 0x1630]
mov rdi, qword [rsi + rax]
test dword [rdi + 4], 0x400
jne 0x14004a0da
mov rax, qword [rbx + 0x15c0]
test rax, rax
je 0x14004a0c7
xor edx, edx
mov rcx, rdi
call rax
mov rax, qword [rbx + 0x1608]
test rax, rax
je 0x14004a0da
xor edx, edx
mov rcx, rdi
call rax
inc r14d
add rsi, 8
mov eax, dword [rbx + 0x1628]
cmp r14d, eax
jl 0x14004a0a0
mov r14d, 1
cmp eax, r14d
jle 0x14004a14a
mov esi, 8
nop dword [rax]
mov rax, qword [rbx + 0x1630]
mov rdi, qword [rsi + rax]
test dword [rdi + 4], 0x400
jne 0x14004a13a
mov rax, qword [rbx + 0x15c8]
test rax, rax
je 0x14004a127
xor edx, edx
mov rcx, rdi
call rax
mov rax, qword [rbx + 0x1610]
test rax, rax
je 0x14004a13a
xor edx, edx
mov rcx, rdi
call rax
inc r14d
add rsi, 8
cmp r14d, dword [rbx + 0x1628]
jl 0x14004a100
lea r15, [0x140048420]
lea r14, [fcn.140001160]
mov rcx, qword [0x140081b50]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x14004a195
mov rcx, qword [0x140081b50]
mov rax, qword [rcx]
call qword [rax + 0x18]
cmp eax, 0x88760869
jne 0x14004a195
call fcn.140047000
cmp byte [0x140080f31], 0
je 0x14004a218
lea rdi, [0x140081b78]
lea rsi, [0x1400484d0]
cmp dword [rbp + 0x128], 0x12
jne 0x140049070
jmp 0x14004a222
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0xf8], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0x108], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0x118], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0x128], 0x12
call fcn.1400191b0
call fcn.140034f60
mov rcx, qword [0x140081bd0]
test rcx, rcx
je 0x14004a245
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x140081bd0], r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdx, rax
lea rcx, str.ImGui_Platform
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov rcx, qword [0x140081be8]
test rcx, rcx
je 0x14004a26f
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x140081be8], r12
mov qword [0x140081bf0], r12
mov qword [0x140081bf8], r12
mov qword [0x140081c00], r12
mov qword [0x140081c08], r12
mov qword [0x140081c10], r12
mov dword [0x140080f3c], 9
mov byte [0x140081be0], 0
mov byte [0x140080f32], 1
mov rbx, qword [0x140081b00]
mov rcx, rbx
call fcn.140008280
cmp qword [0x140081b00], rbx
jne 0x14004a2d0
mov qword [0x140081b00], r12
test rbx, rbx
je 0x14004a2f8
mov rcx, rbx
call fcn.140023710
mov rax, qword [0x140081b00]
test rax, rax
je 0x14004a2ef
dec dword [rax + 0x3b0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x140081b50]
test rcx, rcx
je 0x14004a311
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x140081b50], r12
mov rcx, qword [0x140081b68]
test rcx, rcx
je 0x14004a32a
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x140081b68], r12
mov rdx, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0xd0]
call qword [sym.imp.USER32.dll_UnregisterClassW]
jmp 0x14004a395
mov rcx, qword [0x140081b68]
mov rdx, qword [0x140081b50]
test rdx, rdx
je 0x14004a36a
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x10]
mov qword [0x140081b50], r12
mov rcx, qword [0x140081b68]
test rcx, rcx
je 0x14004a37c
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x140081b68], r12
mov rdx, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0xd0]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov eax, 1
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.14004b290
lea r11, [rsp + 0x390]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
movaps xmm14, xmmword [r11 - 0x90]
movaps xmm15, xmmword [r11 - 0xa0]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret