Function at 0x14007ada0
Capabilities:
Access peb ldr_data
Check for debugger via api
Check for peb beingdebugged flag
Check processdebugport
Create thread
Encode data using xor
Enumerate gui resources
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [0x140196600]
xor rax, rsp
mov qword [rbp + 0xc0], rax
lea rcx, [0x140197010]
call fcn.140092c80
call fcn.140059a20
call fcn.1400732b0
xor edx, edx
lea rcx, [0x140059c80]
call qword [sym.imp.USER32.dll_EnumWindows]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14007ae05
mov dword [0], 0xdead
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14007ae1a
mov dword [0], 0xdead
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rbp - 0x50], 0
je 0x14007ae3e
mov dword [0], 0xdead
mov rax, qword gs:[0x60]
cmp byte [rax + 2], 0
je 0x14007ae58
mov dword [0], 0xdead
mov rax, qword gs:[0x60]
test byte [rax + 0x68], 0x70
je 0x14007ae72
mov dword [0], 0xdead
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor esi, esi
lea r8, [rbp - 0x50]
mov rcx, rax
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 8]
lea edx, [rsi + 7]
call sub.ntdll.dll_NtQueryInformationProcess
cmp qword [rbp - 0x50], rsi
je 0x14007aea3
mov dword [0], 0xdead
mov dword [rbp - 0x50], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 4
mov qword [rsp + 0x20], rsi
mov rcx, rax
lea r8, [rbp - 0x50]
lea edx, [r9 + 0x1b]
call sub.ntdll.dll_NtQueryInformationProcess
cmp dword [rbp - 0x50], esi
jne 0x14007aed7
mov dword [0], 0xdead
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 8
mov qword [rsp + 0x20], rsi
mov rcx, rax
lea r8, [rbp - 0x40]
lea edx, [r9 + 0x16]
call sub.ntdll.dll_NtQueryInformationProcess
cmp qword [rbp - 0x40], rsi
je 0x14007af09
mov dword [0], 0xdead
call fcn.140059960
test eax, eax
je 0x14007af1d
mov dword [0], 0xdead
mov rax, qword gs:[0x60]
test byte [rax + 0x68], 0x70
je 0x14007af37
mov dword [0], 0xdead
mov r8b, 1
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_NtSetDebugFilterState]
test eax, eax
jne 0x14007af53
mov dword [0], 0xdead
call fcn.140059980
test eax, eax
je 0x14007af67
mov dword [0], 0xdead
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14007af7c
mov dword [0], 0xdead
xor edx, edx
lea rcx, [0x140059c80]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 8
call fcn.1400ea42c
lea r14, [0x140059a00]
test rax, rax
je 0x14007afa6
mov qword [rax], r14
jmp 0x14007afa9
mov rax, rsi
lea rcx, [rbp - 0x58]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x140055170]
xor ecx, ecx
mov dword [rsp + 0x20], esi
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x60], rax
test rax, rax
je 0x14007c076
cmp dword [rbp - 0x58], esi
je 0x14007c06b
movaps xmm0, xmmword [rbp - 0x60]
lea rcx, [rbp - 0x40]
movdqa xmmword [rbp - 0x40], xmm0
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x14007c06b
lea ecx, [rax + 8]
call fcn.1400ea42c
test rax, rax
je 0x14007b013
lea rcx, [0x140058310]
mov qword [rax], rcx
jmp 0x14007b016
mov rax, rsi
lea rcx, [rbp - 0x68]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x140055170]
xor ecx, ecx
mov dword [rsp + 0x20], esi
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x70], rax
test rax, rax
je 0x14007c0d0
cmp dword [rbp - 0x68], esi
je 0x14007c0c5
movaps xmm0, xmmword [rbp - 0x70]
lea rcx, [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm0
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x14007c0c5
lea ecx, [rax + 8]
call fcn.1400ea42c
test rax, rax
je 0x14007b080
lea rcx, [0x140058a80]
mov qword [rax], rcx
jmp 0x14007b083
mov rax, rsi
lea rcx, [rbp - 0x78]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x140055170]
xor ecx, ecx
mov dword [rsp + 0x20], esi
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x80], rax
test rax, rax
je 0x14007c0b7
cmp dword [rbp - 0x78], esi
je 0x14007c0ac
movaps xmm0, xmmword [rbp - 0x80]
lea rcx, [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm0
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x14007c0ac
mov qword [rsp + 0x200], rbx
lea rcx, [0x140059c80]
xor edx, edx
mov qword [rsp + 0x208], rdi
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [0x140196f04]
call fcn.14005bbf0
test al, al
je 0x14007b320
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14007b197
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14007b197
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14007b192
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14007b170
cmp r8d, 0xcded1a85
je 0x14007b19c
test r9d, r9d
jne 0x14007b150
mov rax, qword [rax]
jmp 0x14007b120
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14007b247
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14007b247
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14007b242
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14007b220
cmp r8d, 0xe80fd3a
je 0x14007b24c
test r9d, r9d
jne 0x14007b200
mov rax, qword [rax]
jmp 0x14007b1d0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14007b2f7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14007b2f7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14007b2f2
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14007b2d0
cmp r8d, 0xa52bcaf9
je 0x14007b2fc
test r9d, r9d
jne 0x14007b2b0
mov rax, qword [rax]
jmp 0x14007b280
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
call rax
mov dword [0], 0xdead
mov ecx, 1
call fcn.1400ea42c
lea rcx, [rbp + 0x28]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x1400551a0]
xor ecx, ecx
mov dword [rsp + 0x20], esi
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x20], rax
test rax, rax
je 0x14007c09e
cmp byte [0x140196ded], sil
je 0x14007b580
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14007b3f7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14007b3f7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14007b3f2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14007b3d0
cmp r8d, 0xcded1a85
je 0x14007b3fc
test r9d, r9d
jne 0x14007b3b0
mov rax, qword [rax]
jmp 0x14007b380
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14007b4a7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14007b4a7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14007b4a2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14007b480
cmp r8d, 0xe80fd3a
je 0x14007b4ac
test r9d, r9d
jne 0x14007b460
mov rax, qword [rax]
jmp 0x14007b430
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14007b557
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14007b557
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14007b552
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14007b530
cmp r8d, 0xa52bcaf9
je 0x14007b55c
test r9d, r9d
jne 0x14007b510
mov rax, qword [rax]
jmp 0x14007b4e0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
call rax
mov dword [0], 0xdead
xor edx, edx
lea rcx, [0x140059c80]
call qword [sym.imp.USER32.dll_EnumWindows]
mov byte [0x140196f01], sil
call fcn.14006e8c0
call fcn.14006fa90
call fcn.14006f080
call fcn.14006f2d0
call fcn.14006f7f0
call fcn.14006ed90
call fcn.14006eb40
call fcn.14006fa70
cmp byte [0x140196f01], sil
je 0x14007b7e0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14007b657
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14007b657
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14007b652
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14007b630
cmp r8d, 0xcded1a85
je 0x14007b65c
test r9d, r9d
jne 0x14007b610
mov rax, qword [rax]
jmp 0x14007b5e0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14007b707
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14007b707
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14007b702
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14007b6e0
cmp r8d, 0xe80fd3a
je 0x14007b70c
test r9d, r9d
jne 0x14007b6c0
mov rax, qword [rax]
jmp 0x14007b690
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14007b7b7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14007b7b7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14007b7b2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14007b790
cmp r8d, 0xa52bcaf9
je 0x14007b7bc
test r9d, r9d
jne 0x14007b770
mov rax, qword [rax]
jmp 0x14007b740
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
call rax
mov dword [0], 0xdead
mov ecx, 8
call fcn.1400ea42c
test rax, rax
je 0x14007b7f4
mov qword [rax], r14
jmp 0x14007b7f7
mov rax, rsi
lea rcx, [rsp + 0x78]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x140055170]
xor ecx, ecx
mov dword [rsp + 0x20], esi
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14007c08f
cmp dword [rsp + 0x78], esi
je 0x14007c084
movaps xmm0, xmmword [rsp + 0x70]
lea rcx, [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm0
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x14007c084
mov eax, dword [str.eBR_M:]
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], eax
xor edx, edx
movzx eax, word [0x140166f40]
xor byte [rsp + 0x61], 0x36
xor byte [rsp + 0x62], 0x37
xor byte [rsp + 0x63], 0x38
mov word [rsp + 0x64], ax
xor al, 0x39
xor byte [rsp + 0x65], 0x3a
mov byte [rsp + 0x64], al
mov byte [rsp + 0x60], reloc.WLDAP32.dll_Ordinal_46
call fcn.14005b940
test al, al
je 0x14007bab1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14007b927
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14007b927
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14007b922
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14007b900
cmp r8d, 0xcded1a85
je 0x14007b92c
test r9d, r9d
jne 0x14007b8e0
mov rax, qword [rax]
jmp 0x14007b8b0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14007b9d7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14007b9d7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14007b9d2
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14007b9b0
cmp r8d, 0xe80fd3a
je 0x14007b9dc
test r9d, r9d
jne 0x14007b990
mov rax, qword [rax]
jmp 0x14007b960
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14007ba87
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14007ba87
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14007ba82
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14007ba60
cmp r8d, 0xa52bcaf9
je 0x14007ba8c
test r9d, r9d
jne 0x14007ba40
mov rax, qword [rax]
jmp 0x14007ba10
mov edx, dword [rdi + 0x24]
add rdx, r10
movzx r8d, word [rdx + r9*2]
mov edx, dword [rdi + 0x1c]
add rdx, r10
mov eax, dword [rdx + r8*4]
add rax, r10
call rax
mov dword [0], 0xdead
xor edx, edx
lea rcx, [0x140059c80]
call qword [sym.imp.USER32.dll_EnumWindows]
lea rax, [0x14006dea0]
mov dword [rbp - 0x30], 0x50
xor ecx, ecx
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x2c], 0x40
mov qword [rbp - 0x20], rsi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xorps xmm0, xmm0
mov qword [rbp + 0x18], rsi
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0x30]
mov rax, qword [str.Impact_Loader]
xorps xmm1, xmm1
mov qword [rbp + 0x10], rax
movdqa xmmword [rbp - 0x10], xmm0
movdqa xmmword [rbp], xmm1
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov rax, qword [rbp - 0x18]
mov r9d, 0x80000000
mov r8, qword [str.Impact_Loader]
xor ecx, ecx
mov rdx, qword [rbp + 0x10]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], 5
mov dword [rsp + 0x30], 5
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov ecx, reloc.WLDAP32.dll_Ordinal_32
mov qword [0x140196d90], rax
mov rbx, rax
call sub.d3d9.dll_Direct3DCreate9
mov qword [0x140196de0], rax
mov rcx, rax
test rax, rax
je 0x14007bfe0
lea rdx, [0x140196d98]
mov qword [0x140196da0], rsi
mov qword [rsp + 0x30], rdx
lea r14, [0x140196da0]
xor edx, edx
mov qword [0x140196dac], rsi
mov dword [0x140196db4], esi
mov r9, rbx
mov qword [0x140196dbc], rsi
mov dword [0x140196dc4], esi
mov qword [0x140196dd4], rsi
lea r8d, [rdx + 1]
mov dword [0x140196dc8], 1
mov dword [0x140196db8], 1
mov dword [0x140196da8], esi
mov dword [0x140196dcc], 1
mov dword [0x140196dd0], 0x50
mov dword [0x140196ddc], 1
mov rax, qword [rax]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0x40
call qword [rax + 0x80]
test eax, eax
js 0x14007bfd9
mov rcx, qword [0x140196d90]
xor edx, edx
movaps xmmword [rsp + 0x1e0], xmm6
movaps xmmword [rsp + 0x1d0], xmm7
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x140196d90]
call qword [sym.imp.USER32.dll_UpdateWindow]
xor ecx, ecx
call fcn.14000b430
call fcn.140018e60
mov rdi, rax
or dword [rax], 0x400
mov qword [rax + 0x18], rsi
call fcn.140019530
test dword [rdi], 0x400
je 0x14007bc7b
mov dword [rax + 0xc], esi
mov dword [rax + 0xf0], 0x3f800000
mov rcx, qword [0x140196d90]
call fcn.140040de0
mov rcx, qword [0x140196d98]
call fcn.14003f6d0
movss xmm2, dword [0x1400f5f0c]
lea rdx, str.C:WindowsFontsimpact.ttf
mov rcx, qword [rdi + 0xa0]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
call fcn.14002d730
lea rcx, [rbp + 0x30]
call fcn.14002c650
movss xmm3, dword [0x1400f601c]
lea rax, [rbp + 0x30]
mov byte [rbp + 0x78], 1
lea rbx, [0x140166f44]
mov byte [rbp + 0x50], 1
lea rdx, [0x1400fd2b0]
mov rcx, qword [rdi + 0xa0]
mov r8d, 0x3934b
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call fcn.14002da70
movss xmm3, dword [0x140166f98]
lea rdx, [0x1400fd2b0]
mov rcx, qword [rdi + 0xa0]
mov r8d, 0x3934b
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
call fcn.14002da70
mov rbx, qword [rdi + 0xa0]
mov rcx, rbx
call fcn.140030890
movss xmm3, dword [0x1400f6020]
lea rdx, [0x140136600]
mov qword [rsp + 0x28], rax
mov r8d, 0x2ce4b
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call fcn.14002da70
call fcn.14007a4f0
movss xmm7, dword [0x1400ef0e0]
xorps xmm0, xmm0
movups xmmword [0x140196ec0], xmm0
movups xmmword [0x140196ed0], xmm0
movups xmmword [0x140196ee0], xmm0
xorps xmm6, xmm6
nop word [rax + rax]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [0x140196ec0]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x14007bdd0
lea rcx, [0x140196ec0]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [0x140196ec0]
call qword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x14007bf48
call fcn.14003f8b0
call fcn.1400411a0
call fcn.14001fd30
cmp dword [0x140197300], esi
jne 0x14007be4a
movss xmm0, dword [0x140196218]
ucomiss xmm0, xmm6
mov rax, qword [0x140196d98]
mov qword [0x1401972f0], rax
jp 0x14007be3e
jne 0x14007be3e
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rbp - 0x60]
call qword [sym.imp.USER32.dll_GetWindowRect]
movd xmm0, dword [rbp - 0x58]
movd xmm1, dword [rbp - 0x54]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [0x140196210], xmm0
movss dword [0x140196214], xmm1
mov dword [0x140197300], 1
jmp 0x14007be4f
call fcn.1400737b0
call fcn.140015c30
mov rcx, qword [0x140196d98]
mov r9d, 3
mov dword [rsp + 0x30], esi
xor r8d, r8d
movss dword [rsp + 0x28], xmm7
xor edx, edx
mov dword [rsp + 0x20], esi
mov rax, qword [rcx]
call qword [rax + 0x158]
mov rcx, qword [0x140196d98]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x14007beb3
call fcn.140021c40
call fcn.140018920
mov rcx, rax
call fcn.14003f9b0
mov rcx, qword [0x140196d98]
mov rax, qword [rcx]
call qword [rax + 0x150]
test dword [rdi], 0x400
je 0x14007bec9
call fcn.140028550
xor edx, edx
xor ecx, ecx
call fcn.1400228d0
mov rcx, qword [0x140196d98]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x14007bf3f
mov rcx, qword [0x140196d98]
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
cmp eax, 0x88760869
jne 0x14007bf3f
call fcn.14003f770
mov rcx, qword [0x140196d98]
mov rdx, r14
mov rax, qword [rcx]
call qword [rax + 0x80]
cmp eax, 0x8876086c
jne 0x14007bf3a
mov r8d, gethostname
lea rdx, str.C:UsershuabiDownloadsimpact_v13__1___1_impact_v13__1_zchairs_loaderMain.h
lea rcx, [0x1400ef8b8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
call fcn.14003f240
cmp byte [reloc.WS2_32.dll_accept], sil
je 0x14007bf57
cmp dword [0x140196ec8], 0x12
jne 0x14007bd90
jmp 0x14007bf61
mov dword [0x140196ec8], 0x12
call fcn.140040650
call fcn.140041900
xor ecx, ecx
call fcn.14000b900
mov rcx, qword [0x140196e78]
movaps xmm7, xmmword [rsp + 0x1d0]
movaps xmm6, xmmword [rsp + 0x1e0]
test rcx, rcx
je 0x14007bfa4
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [0x140196e78]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [0x140196e70]
test rcx, rcx
je 0x14007bfb6
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [0x140196e60]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [0x140196e28]
mov rcx, qword [0x140196e50]
call qword [sym.imp.USER32.dll_UnregisterClassA]
jmp 0x14007c028
mov rcx, qword [0x140196de0]
mov rdx, qword [0x140196d98]
test rdx, rdx
je 0x14007c003
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [0x140196de0]
mov qword [0x140196d98], rsi
test rcx, rcx
je 0x14007c015
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x140196de0], rsi
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.USER32.dll_UnregisterClassA]
mov esi, 1
cmp dword [rbp + 0x28], 0
je 0x14007c035
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
mov rbx, qword [rsp + 0x200]
mov eax, esi
mov rdi, qword [rsp + 0x208]
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.1400e9cd0
lea r11, [rsp + 0x1f0]
mov rsi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, 6
mov dword [rbp - 0x58], esi
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, 6
mov dword [rsp + 0x78], esi
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, 6
mov dword [rbp + 0x28], esi
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, 6
mov dword [rbp - 0x78], esi
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, 6
mov dword [rbp - 0x68], esi
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3