Function at 0x140042fe0
Capabilities:
Access peb ldr_data
Create thread
Encode data using xor
Enumerate processes
Hash data using fnv
Log keystrokes via polling
Resolve function by parsing pe exports
Set console window title
Terminate process
Terminate process by name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x2b0]
sub rsp, 0x3b0
mov rax, qword [0x140055040]
xor rax, rsp
mov qword [rbp + 0x2a0], rax
xor r14d, r14d
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
lea r15, [rbp + 0x2c8]
movabs r12, 0xff00ff00ff00ff00
mov qword [rbp + 0x48], r12
mov qword [rbp + 0x50], r15
mov rax, qword [r15]
xor rax, r12
mov qword [rbp + 0x40], rax
mov qword [r15], r14
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r11, rax
movzx ecx, word [0x14004d648]
mov word [rbp - 0x38], cx
mov byte [rbp - 0x38], 0x77
xor byte [rbp - 0x37], 0x33
mov rcx, qword [str.qzzcc]
mov qword [rbp - 0x30], rcx
lea r10, [rbp - 0x38]
mov r8d, r14d
cmp dword [0x140055090], 2
jl 0x14004316b
movdqa xmm4, xmmword [0x14004de70]
movdqa xmm2, xmmword [0x14004d910]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.4444]
psubd xmm2, xmm0
andps xmm2, xmmword [0x14004d970]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x14004d980]
movd xmm0, dword [rbp - 0x30]
xorps xmm2, xmm0
movd dword [rbp - 0x30], xmm2
movdqa xmm2, xmmword [0x14004d920]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.4444]
psubd xmm2, xmm0
andps xmm2, xmmword [0x14004d970]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x14004d980]
movd xmm0, dword [rbp - 0x2c]
xorps xmm2, xmm0
movd dword [rbp - 0x2c], xmm2
jmp 0x140043199
lea r9, [rbp - 0x30]
nop
mov eax, 0x4ec4ec4f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x34
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 8
jl 0x140043170
mov r9, r11
mov r8, r10
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], 4
mov ecx, 0xf
mov qword [rbp + 0x38], rcx
xor eax, eax
mov dword [rbp + 0x20], eax
mov byte [rbp + 0x24], al
lea rbx, [rbp + 0x20]
mov edi, 4
movabs rsi, 0x842108421084211
movups xmm0, xmmword [str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]
movups xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [0x14004d290]
movups xmmword [rbp - 0x10], xmm1
movups xmm0, xmmword [0x14004d2a0]
movups xmmword [rbp], xmm0
movsd xmm0, qword [0x14004d2b0]
movsd qword [rbp + 0x10], xmm0
mov eax, dword [0x14004d2b8]
mov dword [rbp + 0x18], eax
movzx eax, word [0x14004d2bc]
mov word [rbp + 0x1c], ax
movzx eax, byte [0x14004d2be]
mov byte [rbp + 0x1e], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movsxd rcx, eax
mov rax, rsi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
imul rax, rax, 0x3e
sub rcx, rax
movzx eax, byte [rbp + rcx - 0x20]
mov byte [rbx], al
dec edi
lea rbx, [rbx + 1]
test edi, edi
jg 0x1400431e0
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0xf
cmova rcx, qword [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
mov r9d, 2
mov r8b, 0xe6
mov edx, 0xd6ff9a
mov rcx, rax
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov edx, 0xfffffff0
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xff30ff7f
mov r8d, eax
mov edx, 0xfffffff0
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowLongW]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetSystemMenu]
test rax, rax
je 0x1400432f7
xor r8d, r8d
mov edx, 0xf060
mov rcx, rax
call qword [sym.imp.USER32.dll_RemoveMenu]
mov rcx, rbx
call qword [sym.imp.USER32.dll_DrawMenuBar]
mov edx, 0xd
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.________________________________________________________________n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140044d80
lea rdx, [0x14004d308]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140044d80
lea rdx, [0x14004d340]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140044d80
lea rdx, [0x14004d378]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140044d80
lea rdx, [0x14004d3b0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140044d80
lea rdx, [0x14004d3e8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140044d80
lea rdx, [0x14004d420]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140044d80
lea rdx, str.______________________________________________n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140044d80
lea rdx, str._____________________________________________n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140044d80
lea rdx, str.________________________________________________________________n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140044d80
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x140043454
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140043454
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0xa5a9e85a
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14004344f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x140043430
cmp edx, 0x7b2d0e56
je 0x140043459
test r9d, r9d
jne 0x140043410
mov rax, qword [rax]
jmp 0x1400433e0
mov edx, dword [r11 + 0x1c]
add rdx, r10
mov ecx, dword [r11 + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
lea rcx, str.Pluto_Fortnite_Private
call rax
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
mov r8d, 3
lea rcx, str..1057CF2C_1693_4FEA_B6AD_DABB110E6CDF
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140058940], rax
test rax, rax
je 0x1400434c9
cmp rax, 0xffffffffffffffff
jne 0x140043588
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x140043554
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140043554
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov r8d, dword [rdx + rbx]
add r8, r10
mov edx, 0x16b15602
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14004354f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x140043530
cmp edx, 0xeedb5fc9
je 0x140043559
test r9d, r9d
jne 0x140043510
mov rax, qword [rax]
jmp 0x1400434e0
mov edx, dword [r11 + 0x1c]
add rdx, r10
mov ecx, dword [r11 + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
lea rcx, str.Not_Found_n
call rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], r14
mov r8d, 0x17
lea rdx, str.Waiting_for_Fortnite...
lea rcx, [rbp - 0x20]
call fcn.140037ba0
lea rax, [rbp - 0x20]
mov qword [rbp - 0x30], rax
lea rdx, [0x14004c788]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140044d80
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
mov rcx, rax
call fcn.140045400
lea rdx, [0x140048a50]
mov rcx, rax
call fcn.140044d80
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140043630
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004362b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004362b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140045ca4
cmp qword [0x140058960], 0
jne 0x14004366b
nop word [rax + rax]
lea rdx, str.Fortnite
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x140058960], rax
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x140058960], 0
je 0x140043640
lea rdx, str._Press_F5_Once_in_lobby_to_inject..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140044d80
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x74
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x1400436cd
nop dword [rax + rax]
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x140043a44
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x74
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400436a0
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rbp + 0x60], 0x238
lea rdx, [rbp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14004372d
nop word [rax + rax]
lea rdx, str.FortniteClient_Win64_Shipping.exe
lea rcx, [rbp + 0x8c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov rcx, rbx
test eax, eax
je 0x140043a6c
lea rdx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140043700
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r14d
mov dword [0x140058948], eax
mov byte [rbp - 0x38], 0
mov dword [rsp + 0x64], r14d
mov dword [rsp + 0x60], eax
lea rax, [rbp - 0x38]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r9d, 0x10
lea r8, [rsp + 0x60]
mov edx, 0x2204a8
mov rcx, qword [0x140058940]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov qword [rbp - 0x30], r14
mov dword [rbp - 0x1c], r14d
mov eax, dword [0x140058948]
mov dword [rbp - 0x20], eax
lea rax, [rbp - 0x30]
mov qword [rbp - 0x18], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r9d, 0x10
lea r8, [rbp - 0x20]
mov edx, 0x220528
mov rcx, qword [0x140058940]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rax, qword [rbp - 0x30]
mov qword [0x140058a40], rax
mov ecx, 8
call fcn.140045e98
lea rcx, [0x14003ccf0]
mov qword [rax], rcx
mov qword [rbp - 0x30], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x140045810]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140043d2d
cmp dword [rsp + 0x68], 0
je 0x140043d21
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140043d21
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov edi, r14d
mov esi, r14d
nop dword [rax]
movsxd rcx, esi
add rcx, qword [0x140058a40]
mov qword [0x140058938], rcx
add rcx, 0x12200ee8
call fcn.140044630
mov rbx, rax
lea rcx, [rax + 0x30]
call fcn.140044630
test rbx, rbx
je 0x1400438a4
test rax, rax
je 0x1400438a4
lea rcx, [rax + 0xc0]
call fcn.140044630
cmp rax, rbx
je 0x1400438b4
inc edi
add esi, 0x1000
cmp edi, 0x7fffffff
jl 0x140043860
mov qword [rsp + 0x70], 0x50
mov rax, qword [sym.imp.USER32.dll_DefWindowProcA]
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], r14
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rbp - 0x70], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [rbp - 0x68], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x60], xmm0
lea rbx, [0x14004d250]
mov qword [rbp - 0x50], rbx
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rbp - 0x48], rax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov qword [rsp + 0x58], r14
mov rax, qword [rbp - 0x78]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x20], eax
mov r9d, 0x80000000
lea r8, str.External
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x1400589a0], rax
mov edx, 0xffffffec
mov r8d, 0x800a0
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowLongW]
movdqa xmm0, xmmword [0x14004d880]
movdqu xmmword [rbp - 0x20], xmm0
lea rdx, [rbp - 0x20]
mov rcx, qword [0x1400589a0]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov edx, 5
mov rcx, qword [0x1400589a0]
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rdx, 0xffffffffffffffff
mov rcx, qword [0x1400589a0]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov r9d, 2
mov r8b, 0xff
xor edx, edx
mov rcx, qword [0x1400589a0]
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov rcx, qword [0x1400589a0]
call qword [sym.imp.USER32.dll_UpdateWindow]
lea rdx, [0x1400589b0]
mov ecx, 0x20
call qword [sym.imp.d3d9.dll_Direct3DCreate9Ex]
test eax, eax
jns 0x140043a7a
mov ecx, 3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r9d, 0x40
lea r8, [0x1400488e6]
lea rdx, str.Process_will_be_closed...
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x68]
jmp 0x140043739
mov qword [0x1400589cc], r14
mov qword [0x1400589d8], 1
mov qword [0x1400589f4], r14
mov dword [0x1400589e8], 1
mov r9, qword [0x1400589a0]
mov qword [0x1400589e0], r9
mov dword [0x1400589d4], r14d
mov dword [0x1400589c8], 0x15
mov eax, dword [0x140058adc]
mov dword [0x1400589c0], eax
mov eax, dword [0x140058a54]
mov dword [0x1400589c4], eax
mov dword [0x1400589ec], 1
mov dword [0x1400589f0], 0x50
mov dword [0x1400589fc], r14d
mov rcx, qword [0x1400589b0]
mov rax, qword [rcx]
lea rdx, [0x140058a48]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], r14
lea rdx, [0x1400589c0]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r8d, 1
call qword [rax + 0xa0]
test eax, eax
jns 0x140043b49
mov rcx, qword [0x1400589b0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov ecx, 4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140006090
mov rbx, qword [0x1400589a0]
lea rcx, [0x140058e28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x140043c47
lea rcx, [0x140058e20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140043c47
mov qword [0x140058e18], rbx
mov rcx, qword [0x140058930]
or dword [rcx + 0xc], 6
lea rax, str.imgui_impl_win32
mov qword [rcx + 0xd8], rax
mov qword [rcx + 0x108], rbx
mov dword [rcx + 0x3c], 9
mov dword [rcx + 0x40], 0x25
mov dword [rcx + 0x44], 0x27
mov dword [rcx + 0x48], 0x26
mov dword [rcx + 0x4c], 0x28
mov dword [rcx + 0x50], 0x21
mov dword [rcx + 0x54], 0x22
mov dword [rcx + 0x58], 0x24
mov dword [rcx + 0x5c], 0x23
mov dword [rcx + 0x60], 0x2d
mov dword [rcx + 0x64], 0x2e
mov dword [rcx + 0x68], 8
mov dword [rcx + 0x6c], 0x20
mov dword [rcx + 0x70], 0xd
mov dword [rcx + 0x74], 0x1b
mov dword [rcx + 0x78], 0x41
mov dword [rcx + 0x7c], 0x43
mov dword [rcx + 0x80], 0x56
mov dword [rcx + 0x84], 0x58
mov dword [rcx + 0x88], 0x59
mov dword [rcx + 0x8c], 0x5a
jmp 0x140043c4e
mov rcx, qword [0x140058930]
mov rax, qword [0x140058a48]
cmp byte [0x1400550c0], 0
je 0x140043c65
mov byte [0x1400550c0], 0
lea rdx, str.imgui_impl_dx9
mov qword [rcx + 0xe0], rdx
mov qword [0x140058e08], rax
call fcn.14001cca0
movss xmm2, dword [0x14004d7b4]
mov rcx, qword [rcx + 0xa0]
call fcn.140021200
mov rcx, qword [0x1400589b0]
mov rax, qword [rcx]
call qword [rax + 0x10]
call fcn.140041cf0
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x140043ce5
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043cdf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140043cdf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140045ca4
nop
mov rax, qword [rbp + 0x40]
xor rax, r12
mov qword [r15], rax
xor eax, eax
mov rcx, qword [rbp + 0x2a0]
xor rcx, rsp
call fcn.140045890
lea r11, [rsp + 0x3b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x68], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3