Function at 0x140036910
Capabilities:
Create thread
Execute command
Get session user name
Log keystrokes via polling
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x228]
sub rsp, 0x300
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x140097040]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
xor r12d, r12d
mov r15d, r12d
mov dword [rsp + 0x58], r12d
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], r12
lea r8d, [r12 + 0x35]
lea rdx, str.Debugging_is_disabled_after_compilation_is_completed.
lea rcx, [rbp - 0x60]
call fcn.140089790
nop
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400369e6
lea rdx, [0x14008df56]
lea rcx, [rbp - 0x60]
call fcn.14003aa50
test al, al
je 0x1400369cc
lea r8, str._n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x38]
call fcn.14003a630
mov rcx, rax
call fcn.140039250
mov rcx, rax
call fcn.140007230
lea rcx, [rsp + 0x38]
call fcn.140039470
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140036a25
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140036a1f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140036a1f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008a9f0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], r12
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, str.Cache_UserID
lea rcx, [rbp - 0x60]
call fcn.140089790
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x88]
call fcn.14000cdd0
mov dword [rsp + 0x58], r12d
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], r12
mov r8d, 0x4c
lea rdx, str.https:__github.com_Coslly_Rensen_blob_main_Cloud_20Files_UserID.uid_rawtrue
lea rcx, [rbp - 0x60]
call fcn.140089790
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x88]
call fcn.14000cec0
test eax, eax
je 0x140037889
mov dword [rbp - 0x40], 0x100
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], r12
lea rax, [rbp + 0xd0]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140036ad1
lea rdx, [rbp + 0xd0]
lea rcx, [rbp - 0x60]
call fcn.140089790
nop
lea rcx, [rbp - 0x60]
mov r14, qword [rbp - 0x48]
cmp r14, 0xf
seta sil
mov byte [rsp + 0x30], sil
mov rdi, qword [rbp - 0x60]
cmova rcx, rdi
mov r13, qword [rbp - 0x50]
cmp r13, 5
jne 0x140036b70
mov r8, r13
lea rdx, str.22684
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140036b70
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], r12
lea r8d, [r13 + 0x1a]
lea rdx, str.Certification:_Whitelist_passed
lea rcx, [rbp - 0x60]
call fcn.140089790
xor edx, edx
lea rcx, [rbp - 0x60]
call fcn.14000bc60
lea ecx, [r13 + 0x2d]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140036db0
or r15d, 1
movsx ebx, r12w
mov r8d, ebx
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x88]
call fcn.14000d060
mov rdx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x140036b99
mov rdx, qword [rax]
lea rcx, [rbp - 0x60]
test sil, sil
cmovne rcx, rdi
cmp r13, qword [rax + 0x10]
jne 0x140036bc7
mov r8, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140036bc7
mov r9, qword [rsp + 0x78]
mov r8, qword [rsp + 0x60]
mov bl, 1
jmp 0x140036cd7
or r15d, 2
mov r8d, ebx
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x88]
call fcn.14000d060
mov r14, rax
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400395a0
lea rsi, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
jbe 0x140036c0d
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
add rbx, rsi
mov rdi, rsi
jmp 0x140036c1c
lea rbx, [rsp + 0x60]
add rbx, qword [rsp + 0x70]
lea rdi, [rsp + 0x60]
cmp rdi, rbx
je 0x140036c38
sub rsi, rdi
movsx ecx, byte [rdi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov byte [rdi + rsi], al
inc rdi
cmp rdi, rbx
jne 0x140036c24
mov rdx, qword [r14 + 0x18]
cmp rdx, 0xf
jbe 0x140036c72
mov rcx, qword [r14]
inc rdx
cmp rdx, 0x1000
jb 0x140036c6d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140036d8d
mov rcx, r8
call fcn.14008a9f0
mov qword [r14 + 0x10], 0
mov qword [r14 + 0x18], 0xf
mov byte [r14], 0
lea rdx, [rsp + 0x60]
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x78]
cmp r9, 0xf
cmova rdx, r8
cmp qword [rsp + 0x70], 6
jne 0x140036cd5
xor ecx, ecx
lea r10, str.BYPASS
nop
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r10 + rcx - 1]
jne 0x140036cc8
cmp rcx, 6
jne 0x140036cb0
xor eax, eax
jmp 0x140036ccd
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140036cd5
mov bl, 1
jmp 0x140036cd7
xor bl, bl
test r15b, 2
je 0x140036d2f
and r15d, 0xfffffffd
cmp r9, 0xf
jbe 0x140036d18
lea rdx, [r9 + 1]
mov rax, r8
cmp rdx, 0x1000
jb 0x140036d10
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036d94
mov rcx, r8
call fcn.14008a9f0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
and r15d, 0xfffffffe
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x140036d6c
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140036d67
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036d94
call fcn.14008a9f0
mov rdi, qword [rbp - 0x60]
test bl, bl
jne 0x140036da9
inc r12w
mov eax, 0x2710
cmp r12w, ax
jg 0x140036d9b
movzx esi, byte [rsp + 0x30]
jmp 0x140036b70
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xor r12d, r12d
mov esi, r12d
mov ebx, esi
mov r14, qword [rbp - 0x48]
jmp 0x140036db7
mov r14, qword [rbp - 0x48]
xor r12d, r12d
mov ebx, 1
mov esi, ebx
lea rcx, [rbp + 0x88]
call fcn.14000d290
cmp byte [rsp + 0x30], 0
je 0x140036dfb
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140036df3
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037070
mov rcx, rdi
call fcn.14008a9f0
test ebx, ebx
je 0x140037889
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], r12
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, str.Cache_Update
lea rcx, [rbp - 0x60]
call fcn.140089790
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0xa8]
call fcn.14000cdd0
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], r12
mov r8d, 0x4a
lea rdx, str.https:__github.com_Coslly_Rensen_blob_main_Rensen_Rensen_Main.cpp_rawtrue
lea rcx, [rbp - 0x60]
call fcn.140089790
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0xa8]
call fcn.14000cec0
test eax, eax
je 0x14003707c
mov r8d, 3
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0xa8]
call fcn.14000d060
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
seta r14b
mov rdi, qword [rbp - 0x60]
cmova rcx, rdi
mov rbx, qword [rbp - 0x50]
test rbx, rbx
jne 0x140036ebc
mov r8, rbx
lea rdx, [0x14008df56]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140036f21
mov eax, 0x1d
cmp rbx, rax
cmovb rax, rbx
lea rcx, [rbp - 0x60]
test r14b, r14b
cmovne rcx, rdi
sub rbx, rax
lea r8, [rbx + 1]
lea rdx, [rcx + rax]
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x50], rbx
lea rdx, [rbx - 0xf]
cmp rbx, rdx
jae 0x140036ef6
call fcn.140039dc0
int3
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
cmova rcx, qword [rbp - 0x60]
add rcx, rdx
add rbx, 0xfffffffffffffff1
mov r8, rbx
sub r8, rdx
inc r8
lea rdx, [rcx + 0xf]
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x50], rbx
lea rcx, [rbp + 0xa8]
call fcn.14000d290
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x38]
call fcn.1400395a0
mov rbx, rax
mov rcx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x140036f4b
mov rcx, qword [rax]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm6, xmm6
cvtsd2ss xmm6, xmm0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140036f92
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140036f8d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140037037
mov rcx, r8
call fcn.14008a9f0
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
comiss xmm6, dword [0x140090540]
jbe 0x14003703e
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
mov r8d, 0xd
lea rdx, str.Rensen_Update
lea rcx, [rsp + 0x38]
call fcn.140089790
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], r12
mov r8d, 0x59
lea rdx, str.A_new_version_has_been_released._nDo_you_want_to_update_now__nIt_may_take_tens_of_seconds._n
lea rcx, [rbp - 0x80]
call fcn.140089790
mov r8d, 0x44
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x38]
call fcn.140008480
cmp eax, 6
jne 0x14003703e
lea rdx, str.https:__github.com_Coslly_Rensen_releases_download_Release_Rensen.exe
lea rcx, [rsp + 0x38]
call fcn.140039560
mov rcx, rax
call fcn.14000ae90
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x14003707c
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037077
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140037077
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008a9f0
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
and dword [rbp - 0x40], 0xffffffbf
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, dword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [0x14008df68]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x190
mov edx, 0xa
mov r9d, 0x258
mov r8d, edx
call qword [sym.imp.USER32.dll_MoveWindow]
lea rcx, str.Welcome_to_Rensen_for_Counter_Strike_2_cheat._nThe_Rensen_project_is_a_version_converted_from_FreeCS._nNo_team_author_By:_https:__github.com_Coslly_nThe_following_information_returned_is_debugging_information._n
call fcn.140007230
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
mov r8d, 0x13
lea rdx, str.Load_Thread:_main__
lea rcx, [rsp + 0x38]
call fcn.140089790
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.14000bc60
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140098098]
lea rcx, [rsp + 0x38]
call fcn.1400395a0
mov rbx, rax
mov rcx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x140037167
mov rcx, qword [rax]
xor edx, edx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__access]
mov edi, eax
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x1400371a7
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1400371a2
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400371f0
mov rcx, r8
call fcn.14008a9f0
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
cmp edi, 0xffffffff
jne 0x1400371f7
lea rdx, [0x140098150]
lea rcx, [rsp + 0x38]
call fcn.1400395a0
mov rbx, rax
lea rdx, [0x140098098]
lea rcx, [rbp - 0x80]
call fcn.1400395a0
mov rcx, rax
mov rdx, rbx
call fcn.14000b4b0
call fcn.14000bb10
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov ecx, 8
call fcn.14008aadc
lea rcx, [0x14001ebf0]
mov qword [rax], rcx
lea rcx, [rbp + 0x80]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14008a8f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x78], rax
test rax, rax
je 0x140037876
mov ecx, 8
call fcn.14008aadc
lea rcx, [0x1400266c0]
mov qword [rax], rcx
lea rcx, [rbp + 0x70]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14008a8f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x68], rax
test rax, rax
je 0x140037866
mov ecx, gethostbyname
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 8
call fcn.14008aadc
lea rcx, [0x14002b250]
mov qword [rax], rcx
lea rcx, [rbp + 0x60]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14008a8f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x58], rax
test rax, rax
je 0x140037856
mov ecx, 8
call fcn.14008aadc
lea rcx, [0x14002b3f0]
mov qword [rax], rcx
lea rcx, [rbp + 0x50]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14008a8f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x48], rax
test rax, rax
je 0x140037846
mov ecx, 8
call fcn.14008aadc
lea rcx, [0x14002c400]
mov qword [rax], rcx
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14008a8f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x38], rax
test rax, rax
je 0x140037836
mov ecx, 8
call fcn.14008aadc
lea rcx, [0x14002cb60]
mov qword [rax], rcx
lea rcx, [rbp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14008a8f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x28], rax
test rax, rax
je 0x140037826
mov ecx, 8
call fcn.14008aadc
lea rcx, [0x14002cee0]
mov qword [rax], rcx
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14008a8f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x18], rax
test rax, rax
je 0x140037816
mov ecx, 8
call fcn.14008aadc
lea rcx, [0x14002d9d0]
mov qword [rax], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14008a8f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 8], rax
test rax, rax
je 0x140037806
mov ecx, 8
call fcn.14008aadc
lea rcx, [0x14002dc60]
mov qword [rax], rcx
lea rcx, [rbp]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14008a8f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 8], rax
test rax, rax
je 0x1400377f6
mov ecx, 8
call fcn.14008aadc
lea rcx, [0x140032c20]
mov qword [rax], rcx
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14008a8f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x18], rax
test rax, rax
je 0x1400377e6
mov ecx, 8
call fcn.14008aadc
lea rdx, [0x140034920]
mov qword [rax], rdx
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14008a8f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x28], rax
test rax, rax
je 0x1400377d6
mov ecx, 8
call fcn.14008aadc
lea rcx, [0x140036620]
mov qword [rax], rcx
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14008a8f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x38], rax
test rax, rax
je 0x1400377c6
test rsi, rsi
je 0x1400377bd
mov edi, 0xff
lea rsi, [0x140098068]
movsd xmm7, qword [0x1400904c8]
movsd xmm6, qword [0x1400904a0]
nop
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140037574
mov ecx, 0x2e
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x140037790
mov ecx, dword [0x140097f74]
movsx eax, word [0x140097b5c]
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
divss xmm0, dword [0x140097eb0]
cmp dword [0x1400970cc], 0
je 0x1400375ae
cvtps2pd xmm2, xmm0
divsd xmm2, xmm7
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm2, xmm0
jmp 0x1400375c1
movd xmm2, eax
cvtdq2pd xmm2, xmm2
cvtps2pd xmm1, xmm0
divsd xmm1, xmm6
subsd xmm2, xmm1
cvttsd2si ebx, xmm2
mov word [0x140097b5c], bx
movsx eax, bx
cmp eax, ecx
jl 0x1400375df
movzx ebx, cx
mov word [0x140097b5c], cx
jmp 0x1400375ef
test bx, bx
jg 0x1400375ef
movzx ebx, r12w
mov word [0x140097b5c], bx
cmp bx, di
jl 0x1400375f9
movzx ebx, di
jmp 0x140037602
test bx, bx
jg 0x140037602
movzx ebx, r12w
mov r9d, 2
movzx r8d, bl
xor edx, edx
mov rcx, qword [0x140097fe8]
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
movsx eax, bx
mov dword [0x140097fe0], eax
mov ebx, dword [0x140097fac]
cmp dword [0x1400981d4], 0
jne 0x140037655
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14003764c
mov dword [0x1400981d4], 1
jmp 0x140037669
cmp dword [0x1400981d4], 0
je 0x140037684
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14003767b
mov dword [0x1400981d4], r12d
xor r9d, r9d
lea r8d, [r9 + 2]
xor edx, edx
movzx ecx, bl
call qword [sym.imp.USER32.dll_keybd_event]
cmp dword [0x1400981d4], 0
jne 0x1400376aa
mov rcx, qword [0x140097fe8]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, 1
mov rcx, qword [0x140097fe8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
jmp 0x1400376c6
cmp word [0x140097b5c], 0
jne 0x1400376c3
xor edx, edx
mov rcx, qword [0x140097fe8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov eax, r12d
mov dword [0x1400970cc], eax
lea rdx, [rbp + 0xd0]
call fcn.14000e830
mov rdx, rax
lea rcx, [0x140097dd0]
call fcn.1400378e0
lea rcx, [rbp + 0xd0]
call fcn.140015f80
cmp dword [0x140097dc0], 0
jne 0x140037726
mov rax, qword [0x140097e58]
mov ecx, dword [rax + 0xc]
mov edx, dword [rax + 0x10]
mov r8d, dword [rax + 0x14]
mov dword [0x140097e0c], ecx
mov dword [0x140097e10], edx
mov dword [0x140097e14], r8d
mov dword [0x140097e18], edi
cmp qword [0x140098078], 0
jne 0x140037760
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
mov r8d, 7
lea rdx, str.Verdana
lea rcx, [rsp + 0x38]
call fcn.140089790
lea rdx, [rsp + 0x38]
jmp 0x14003776f
mov rdx, rsi
lea rcx, [rbp - 0x80]
call fcn.1400395a0
mov rdx, rax
call fcn.14000dd90
mov eax, dword [0x1400980cc]
mov dword [0x140097fd0], eax
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140037550
mov edx, gethostbyname
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.140007af0
mov rcx, qword [rax]
call fcn.14000abd0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rbp - 0x30], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp - 0x20], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp - 0x10], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp + 0x10], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp + 0x20], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp + 0x30], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp + 0x40], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp + 0x50], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp + 0x60], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp + 0x70], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp + 0x80], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
lea rdx, str.Your_identity_cannot_be_passed._n_nAuthor:_https:__github.com_Coslly_n
lea rcx, [rbp - 0x80]
call fcn.140039560
mov rbx, rax
lea rcx, [rsp + 0x38]
call fcn.14000b940
mov r8, rax
lea rdx, str.Rensen__
lea rcx, [rbp - 0x60]
call fcn.14003a2e0
mov rcx, rax
mov r8d, 0x10
mov rdx, rbx
call fcn.140008480
lea rcx, [rsp + 0x38]
call fcn.140039470
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3