Function at 0x18001cec0
Capabilities:
Check if file exists
Create process on windows
Create thread
Enumerate processes
Execute command
Inject thread
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x708]
sub rsp, 0x7f0
movaps xmmword [rax - 0x28], xmm6
mov rax, qword [0x180052040]
xor rax, rsp
mov qword [rbp + 0x6d8], rax
xor r15d, r15d
mov ecx, dword [0x180053d30]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
lea rdi, str.cmd.exe
test al, 1
je 0x18001d2d7
mov edx, 0x190
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, str.Fix_Lag_2_seg_Activado_
call fcn.18001f9b0
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock0__dirin_actionblock_profileany_program_C:Program_FilesBlueStacks_nxtHD_Player.exe_
lea rcx, [rbp + 0x6a0]
call fcn.18001fa30
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001cce0
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001f9d0
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock0__dirout_actionblock_profileany_program_C:Program_FilesBlueStacks_nxtHD_Player.exe_
lea rcx, [rbp + 0x6a0]
call fcn.18001fa30
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001cce0
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001f9d0
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock1__dirin_actionblock_profileany_program_C:ProgramDataBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x6a0]
call fcn.18001fa30
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001cce0
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001f9d0
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock1__dirout_actionblock_profileany_program_C:ProgramDataBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x6a0]
call fcn.18001fa30
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001cce0
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001f9d0
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock2__dirin_actionblock_profileany_program_C:Program_FilesBlueStacksHD_Player.exe_
lea rcx, [rbp + 0x6a0]
call fcn.18001fa30
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001cce0
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001f9d0
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock2__dirout_actionblock_profileany_program_C:Program_FilesBlueStacksHD_Player.exe_
lea rcx, [rbp + 0x6a0]
call fcn.18001fa30
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001cce0
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001f9d0
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlockMSI5_In__dirin_actionblock_profileany_program_C:Program_FilesBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x6a0]
call fcn.18001fa30
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001cce0
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001f9d0
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlockMSI5_Out__dirout_actionblock_profileany_program_C:Program_FilesBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x6a0]
call fcn.18001fa30
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001cce0
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001f9d0
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock3__dirin_actionblock_profileany_program_C:Program_FilesBlueStacks_msi2Bluestacks.exe_
lea rcx, [rbp + 0x6a0]
call fcn.18001fa30
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001cce0
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001f9d0
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock3__dirin_actionblock_profileany_program_C:Program_FilesBlueStacks_msi2HD_Player.exe_
lea rcx, [rbp + 0x6a0]
call fcn.18001fa30
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001cce0
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001f9d0
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock3__dirout_actionblock_profileany_program_C:Program_FilesBlueStacks_msi2HD_Player.exe_
lea rcx, [rbp + 0x6a0]
call fcn.18001fa30
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001cce0
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001f9d0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:Program_FilesBlueStacks_nxtHD_Player.exe_
lea rcx, [rbp + 0x5e0]
call fcn.18001fa30
nop
lea rdx, str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:ProgramDataBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x600]
call fcn.18001fa30
nop
lea rdx, str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:Program_FilesBlueStacksHD_Player.exe_
lea rcx, [rbp + 0x620]
call fcn.18001fa30
nop
lea rdx, str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:Program_FilesBlueStacks_msi2HD_Player.exe_
lea rcx, [rbp + 0x640]
call fcn.18001fa30
nop
lea rdx, str.netsh_advfirewall_firewall_delete_rule_name_TemporaryBlockMSI5_In__program_C:Program_FilesBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x660]
call fcn.18001fa30
nop
lea rdx, str.netsh_advfirewall_firewall_delete_rule_name_TemporaryBlockMSI5_Out__program_C:Program_FilesBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x680]
call fcn.18001fa30
nop
lea rbx, [rbp + 0x5e0]
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
mov dword [rsp + 0x40], 0x70
mov dword [rsp + 0x44], 0x40
mov qword [rsp + 0x58], rdi
mov r8, rbx
lea rcx, [rbp + 0x6a0]
call fcn.18001fd00
cmp qword [rax + 0x18], 0xf
jbe 0x18001d201
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rdx, qword [rbp + 0x6b8]
cmp rdx, 0xf
jbe 0x18001d247
inc rdx
mov rcx, qword [rbp + 0x6a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001d242
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001d5c9
call fcn.180040d9c
mov dword [rsp + 0x70], r15d
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x18001d274
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 0x20
lea rax, [rbp + 0x6a0]
cmp rbx, rax
jne 0x18001d1b0
mov r8d, 0x1a
lea rdx, str.Fix_Lag_2_seg_Desactivado_
call fcn.18001fb70
mov edx, 0xc8
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
mov edx, 0xc8
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
nop
lea r9, [fcn.18001f9d0]
mov edx, 0x20
lea r8d, [rdx - 0x1a]
lea rcx, [rbp + 0x5e0]
call fcn.18004106c
mov ecx, dword [0x180053d38]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x18001d7d7
mov edx, 0x190
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Beep]
mov r8d, 0x17
lea rdx, str.Fix_Lag_3_seg_Activado_
call fcn.18001fb70
xorps xmm0, xmm0
movups xmmword [rbp + 0x6a0], xmm0
mov ecx, 0xa0
call fcn.1800409f0
mov rcx, rax
mov qword [rbp + 0x6a0], rax
mov qword [rbp + 0x6b0], 0x92
mov qword [rbp + 0x6b8], 0x9f
movaps xmm0, xmmword [str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock0__dirin_actionblock_profileany_program_C:Program_FilesBlueStacks_nxtHD_Player.exe_]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x180049b80]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x180049b90]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x180049ba0]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x180049bb0]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x180049bc0]
movups xmmword [rax + 0x50], xmm1
movaps xmm0, xmmword [0x180049bd0]
movups xmmword [rax + 0x60], xmm0
movaps xmm1, xmmword [0x180049be0]
movups xmmword [rax + 0x70], xmm1
movaps xmm0, xmmword [0x180049bf0]
movups xmmword [rax + 0x80], xmm0
movzx eax, word [0x180049c00]
mov word [rcx + 0x90], ax
mov byte [rcx + 0x92], 0
lea rcx, [rbp + 0x6a0]
call fcn.18001cce0
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001f9d0
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock0__dirout_actionblock_profileany_program_C:Program_FilesBlueStacks_nxtHD_Player.exe_
lea rcx, [rbp + 0x6a0]
call fcn.18001fa30
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001cce0
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001f9d0
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock1__dirin_actionblock_profileany_program_C:ProgramDataBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x6a0]
call fcn.18001fa30
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001cce0
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001f9d0
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock1__dirout_actionblock_profileany_program_C:ProgramDataBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x6a0]
call fcn.18001fa30
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001cce0
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001f9d0
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock2__dirin_actionblock_profileany_program_C:Program_FilesBlueStacksHD_Player.exe_
lea rcx, [rbp + 0x6a0]
call fcn.18001fa30
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001cce0
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001f9d0
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock2__dirout_actionblock_profileany_program_C:Program_FilesBlueStacksHD_Player.exe_
lea rcx, [rbp + 0x6a0]
call fcn.18001fa30
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001cce0
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001f9d0
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlockMSI5_In__dirin_actionblock_profileany_program_C:Program_FilesBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x6a0]
call fcn.18001fa30
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001cce0
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001f9d0
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlockMSI5_Out__dirout_actionblock_profileany_program_C:Program_FilesBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x6a0]
call fcn.18001fa30
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001cce0
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001f9d0
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock3__dirin_actionblock_profileany_program_C:Program_FilesBlueStacks_msi2Bluestacks.exe_
lea rcx, [rbp + 0x6a0]
call fcn.18001fa30
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001cce0
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001f9d0
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock3__dirin_actionblock_profileany_program_C:Program_FilesBlueStacks_msi2HD_Player.exe_
lea rcx, [rbp + 0x6a0]
call fcn.18001fa30
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001cce0
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001f9d0
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock3__dirout_actionblock_profileany_program_C:Program_FilesBlueStacks_msi2HD_Player.exe_
lea rcx, [rbp + 0x6a0]
call fcn.18001fa30
nop
lea rcx, [rbp + 0x6a0]
call fcn.18001cce0
nop
mov rdx, qword [rbp + 0x6b8]
cmp rdx, 0xf
jbe 0x18001d5d5
inc rdx
mov rcx, qword [rbp + 0x6a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001d5d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001d5d0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.180040d9c
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:Program_FilesBlueStacks_nxtHD_Player.exe_
lea rcx, [rbp + 0x520]
call fcn.18001fa30
nop
lea rdx, str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:ProgramDataBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x540]
call fcn.18001fa30
nop
lea rdx, str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:Program_FilesBlueStacksHD_Player.exe_
lea rcx, [rbp + 0x560]
call fcn.18001fa30
nop
lea rdx, str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:Program_FilesBlueStacks_msi2HD_Player.exe_
lea rcx, [rbp + 0x580]
call fcn.18001fa30
nop
lea rdx, str.netsh_advfirewall_firewall_delete_rule_name_TemporaryBlockMSI5_In__program_C:Program_FilesBlueStacks_msi5HD_Player.exe_
lea rcx, [rbp + 0x5a0]
call fcn.18001fa30
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x5c0], xmm0
mov qword [rbp + 0x5d0], r15
mov qword [rbp + 0x5d8], 0xf
mov ecx, 0x80
call fcn.180001d20
mov rbx, rax
mov qword [rbp + 0x5c0], rax
mov qword [rbp + 0x5d0], 0x7d
mov qword [rbp + 0x5d8], 0x7f
mov r8d, 0x7d
lea rdx, str.netsh_advfirewall_firewall_delete_rule_name_TemporaryBlockMSI5_Out__program_C:Program_FilesBlueStacks_msi5HD_Player.exe_
mov rcx, rax
call fcn.18001fb50
mov byte [rbx + 0x7d], 0
lea rbx, [rbp + 0x520]
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
mov dword [rsp + 0x40], 0x70
mov dword [rsp + 0x44], 0x40
mov qword [rsp + 0x58], rdi
mov r8, rbx
lea rcx, [rbp + 0x6a0]
call fcn.18001fd00
cmp qword [rax + 0x18], 0xf
jbe 0x18001d701
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rdx, qword [rbp + 0x6b8]
cmp rdx, 0xf
jbe 0x18001d747
inc rdx
mov rcx, qword [rbp + 0x6a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001d742
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e349
call fcn.180040d9c
mov dword [rsp + 0x70], r15d
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x18001d774
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 0x20
lea rax, [rbp + 0x5e0]
cmp rbx, rax
jne 0x18001d6b0
mov r8d, 0x1a
lea rdx, str.Fix_Lag_3_seg_Desactivado_
call fcn.18001fb70
mov edx, 0xc8
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
mov edx, 0xc8
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
nop
lea r9, [fcn.18001f9d0]
mov edx, 0x20
lea r8d, [rdx - 0x1a]
lea rcx, [rbp + 0x520]
call fcn.18004106c
mov ecx, dword [0x180053ccc]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x18001e877
mov edx, 0x190
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Beep]
mov r8d, 0x17
lea rdx, str.Fix_Lag_5_seg_Activado_
call fcn.18001fb70
xorps xmm0, xmm0
movups xmmword [rbp + 0x6a0], xmm0
mov ecx, 0xa0
call fcn.1800409f0
mov rcx, rax
mov qword [rbp + 0x6a0], rax
mov qword [rbp + 0x6b0], 0x92
mov qword [rbp + 0x6b8], 0x9f
movaps xmm0, xmmword [str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock0__dirin_actionblock_profileany_program_C:Program_FilesBlueStacks_nxtHD_Player.exe_]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x180049b80]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x180049b90]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x180049ba0]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x180049bb0]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x180049bc0]
movups xmmword [rax + 0x50], xmm1
movaps xmm0, xmmword [0x180049bd0]
movups xmmword [rax + 0x60], xmm0
movaps xmm1, xmmword [0x180049be0]
movups xmmword [rax + 0x70], xmm1
movaps xmm0, xmmword [0x180049bf0]
movups xmmword [rax + 0x80], xmm0
movzx eax, word [0x180049c00]
mov word [rcx + 0x90], ax
mov byte [rcx + 0x92], 0
lea rcx, [rbp + 0x6a0]
call fcn.18001cce0
nop
mov rdx, qword [rbp + 0x6b8]
cmp rdx, 0xf
jbe 0x18001d909
inc rdx
mov rcx, qword [rbp + 0x6a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001d904
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e342
call fcn.180040d9c
xorps xmm0, xmm0
movups xmmword [rbp + 0x6a0], xmm0
mov ecx, 0xa0
call fcn.1800409f0
mov rcx, rax
mov qword [rbp + 0x6a0], rax
mov qword [rbp + 0x6b0], 0x93
mov qword [rbp + 0x6b8], 0x9f
movaps xmm0, xmmword [str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock0__dirout_actionblock_profileany_program_C:Program_FilesBlueStacks_nxtHD_Player.exe_]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x180049c20]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x180049c30]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x180049c40]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x180049c50]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x180049c60]
movups xmmword [rax + 0x50], xmm1
movaps xmm0, xmmword [0x180049c70]
movups xmmword [rax + 0x60], xmm0
movaps xmm1, xmmword [0x180049c80]
movups xmmword [rax + 0x70], xmm1
movaps xmm0, xmmword [0x180049c90]
movups xmmword [rax + 0x80], xmm0
movzx eax, word [0x180049ca0]
mov word [rcx + 0x90], ax
movzx eax, byte [0x180049ca2]
mov byte [rcx + 0x92], al
mov byte [rcx + 0x93], 0
lea rcx, [rbp + 0x6a0]
call fcn.18001cce0
nop
mov rdx, qword [rbp + 0x6b8]
cmp rdx, 0xf
jbe 0x18001da12
inc rdx
mov rcx, qword [rbp + 0x6a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001da0d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e342
call fcn.180040d9c
xorps xmm0, xmm0
movups xmmword [rbp + 0x6a0], xmm0
mov ecx, 0xa0
call fcn.1800409f0
mov rcx, rax
mov qword [rbp + 0x6a0], rax
mov qword [rbp + 0x6b0], 0x91
mov qword [rbp + 0x6b8], 0x9f
movaps xmm0, xmmword [str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock1__dirin_actionblock_profileany_program_C:ProgramDataBlueStacks_msi5HD_Player.exe_]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x180049cc0]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x180049cd0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x180049ce0]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x180049cf0]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x180049d00]
movups xmmword [rax + 0x50], xmm1
movaps xmm0, xmmword [0x180049d10]
movups xmmword [rax + 0x60], xmm0
movaps xmm1, xmmword [0x180049d20]
movups xmmword [rax + 0x70], xmm1
movaps xmm0, xmmword [0x180049d30]
movups xmmword [rax + 0x80], xmm0
movzx eax, byte [0x180049d40]
mov byte [rcx + 0x90], al
mov byte [rcx + 0x91], 0
lea rcx, [rbp + 0x6a0]
call fcn.18001cce0
nop
mov rdx, qword [rbp + 0x6b8]
cmp rdx, 0xf
jbe 0x18001db0d
inc rdx
mov rcx, qword [rbp + 0x6a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001db08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e342
call fcn.180040d9c
xorps xmm0, xmm0
movups xmmword [rbp + 0x6a0], xmm0
mov ecx, 0xa0
call fcn.1800409f0
mov rcx, rax
mov qword [rbp + 0x6a0], rax
mov qword [rbp + 0x6b0], 0x92
mov qword [rbp + 0x6b8], 0x9f
movaps xmm0, xmmword [str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock1__dirout_actionblock_profileany_program_C:ProgramDataBlueStacks_msi5HD_Player.exe_]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x180049d60]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x180049d70]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x180049d80]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x180049d90]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x180049da0]
movups xmmword [rax + 0x50], xmm1
movaps xmm0, xmmword [0x180049db0]
movups xmmword [rax + 0x60], xmm0
movaps xmm1, xmmword [0x180049dc0]
movups xmmword [rax + 0x70], xmm1
movaps xmm0, xmmword [0x180049dd0]
movups xmmword [rax + 0x80], xmm0
movzx eax, word [0x180049de0]
mov word [rcx + 0x90], ax
mov byte [rcx + 0x92], 0
lea rcx, [rbp + 0x6a0]
call fcn.18001cce0
nop
mov rdx, qword [rbp + 0x6b8]
cmp rdx, 0xf
jbe 0x18001dc09
inc rdx
mov rcx, qword [rbp + 0x6a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001dc04
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e342
call fcn.180040d9c
xorps xmm0, xmm0
movups xmmword [rbp + 0x6a0], xmm0
mov ecx, 0x90
call fcn.1800409f0
mov rcx, rax
mov qword [rbp + 0x6a0], rax
mov qword [rbp + 0x6b0], 0x8e
mov qword [rbp + 0x6b8], 0x8f
movaps xmm0, xmmword [str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock2__dirin_actionblock_profileany_program_C:Program_FilesBlueStacksHD_Player.exe_]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x180049e00]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x180049e10]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x180049e20]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x180049e30]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x180049e40]
movups xmmword [rax + 0x50], xmm1
movaps xmm0, xmmword [0x180049e50]
movups xmmword [rax + 0x60], xmm0
movaps xmm1, xmmword [0x180049e60]
movups xmmword [rax + 0x70], xmm1
movsd xmm0, qword [0x180049e70]
movsd qword [rax + 0x80], xmm0
mov eax, dword [0x180049e78]
mov dword [rcx + 0x88], eax
movzx eax, word [0x180049e7c]
mov word [rcx + 0x8c], ax
mov byte [rcx + 0x8e], 0
lea rcx, [rbp + 0x6a0]
call fcn.18001cce0
nop
mov rdx, qword [rbp + 0x6b8]
cmp rdx, 0xf
jbe 0x18001dd13
inc rdx
mov rcx, qword [rbp + 0x6a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001dd0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e342
call fcn.180040d9c
xorps xmm0, xmm0
movups xmmword [rbp + 0x6a0], xmm0
mov ecx, 0x90
call fcn.1800409f0
mov rcx, rax
mov qword [rbp + 0x6a0], rax
mov qword [rbp + 0x6b0], 0x8f
mov qword [rbp + 0x6b8], 0x8f
movaps xmm0, xmmword [str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock2__dirout_actionblock_profileany_program_C:Program_FilesBlueStacksHD_Player.exe_]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x180049e90]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x180049ea0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x180049eb0]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x180049ec0]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x180049ed0]
movups xmmword [rax + 0x50], xmm1
movaps xmm0, xmmword [0x180049ee0]
movups xmmword [rax + 0x60], xmm0
movaps xmm1, xmmword [0x180049ef0]
movups xmmword [rax + 0x70], xmm1
movsd xmm0, qword [0x180049f00]
movsd qword [rax + 0x80], xmm0
mov eax, dword [0x180049f08]
mov dword [rcx + 0x88], eax
movzx eax, word [0x180049f0c]
mov word [rcx + 0x8c], ax
movzx eax, byte [0x180049f0e]
mov byte [rcx + 0x8e], al
mov byte [rcx + 0x8f], 0
lea rcx, [rbp + 0x6a0]
call fcn.18001cce0
nop
mov rdx, qword [rbp + 0x6b8]
cmp rdx, 0xf
jbe 0x18001de2a
inc rdx
mov rcx, qword [rbp + 0x6a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001de25
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e342
call fcn.180040d9c
xorps xmm0, xmm0
movups xmmword [rbp + 0x6a0], xmm0
mov ecx, 0xa0
call fcn.1800409f0
mov rcx, rax
mov qword [rbp + 0x6a0], rax
mov qword [rbp + 0x6b0], 0x99
mov qword [rbp + 0x6b8], 0x9f
movaps xmm0, xmmword [str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlockMSI5_In__dirin_actionblock_profileany_program_C:Program_FilesBlueStacks_msi5HD_Player.exe_]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x180049f20]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x180049f30]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x180049f40]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x180049f50]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x180049f60]
movups xmmword [rax + 0x50], xmm1
movaps xmm0, xmmword [0x180049f70]
movups xmmword [rax + 0x60], xmm0
movaps xmm1, xmmword [0x180049f80]
movups xmmword [rax + 0x70], xmm1
movaps xmm0, xmmword [0x180049f90]
movups xmmword [rax + 0x80], xmm0
movsd xmm0, qword [0x180049fa0]
movsd qword [rax + 0x90], xmm0
movzx eax, byte [0x180049fa8]
mov byte [rcx + 0x98], al
mov byte [rcx + 0x99], 0
lea rcx, [rbp + 0x6a0]
call fcn.18001cce0
nop
mov rdx, qword [rbp + 0x6b8]
cmp rdx, 0xf
jbe 0x18001df35
inc rdx
mov rcx, qword [rbp + 0x6a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001df30
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e342
call fcn.180040d9c
xorps xmm0, xmm0
movups xmmword [rbp + 0x6a0], xmm0
mov ecx, 0xa0
call fcn.1800409f0
mov rcx, rax
mov qword [rbp + 0x6a0], rax
mov qword [rbp + 0x6b0], 0x9b
mov qword [rbp + 0x6b8], 0x9f
movaps xmm0, xmmword [str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlockMSI5_Out__dirout_actionblock_profileany_program_C:Program_FilesBlueStacks_msi5HD_Player.exe_]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x180049fc0]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x180049fd0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x180049fe0]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x180049ff0]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x18004a000]
movups xmmword [rax + 0x50], xmm1
movaps xmm0, xmmword [0x18004a010]
movups xmmword [rax + 0x60], xmm0
movaps xmm1, xmmword [0x18004a020]
movups xmmword [rax + 0x70], xmm1
movaps xmm0, xmmword [0x18004a030]
movups xmmword [rax + 0x80], xmm0
movsd xmm0, qword [0x18004a040]
movsd qword [rax + 0x90], xmm0
movzx eax, word [0x18004a048]
mov word [rcx + 0x98], ax
movzx eax, byte [0x18004a04a]
mov byte [rcx + 0x9a], al
mov byte [rcx + 0x9b], 0
lea rcx, [rbp + 0x6a0]
call fcn.18001cce0
nop
mov rdx, qword [rbp + 0x6b8]
cmp rdx, 0xf
jbe 0x18001e04e
inc rdx
mov rcx, qword [rbp + 0x6a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001e049
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e342
call fcn.180040d9c
xorps xmm0, xmm0
movups xmmword [rbp + 0x6a0], xmm0
mov ecx, 0xa0
call fcn.1800409f0
mov rcx, rax
mov qword [rbp + 0x6a0], rax
mov qword [rbp + 0x6b0], 0x94
mov qword [rbp + 0x6b8], 0x9f
movaps xmm0, xmmword [str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock3__dirin_actionblock_profileany_program_C:Program_FilesBlueStacks_msi2Bluestacks.exe_]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x18004a060]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x18004a070]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x18004a080]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x18004a090]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x18004a0a0]
movups xmmword [rax + 0x50], xmm1
movaps xmm0, xmmword [0x18004a0b0]
movups xmmword [rax + 0x60], xmm0
movaps xmm1, xmmword [0x18004a0c0]
movups xmmword [rax + 0x70], xmm1
movaps xmm0, xmmword [0x18004a0d0]
movups xmmword [rax + 0x80], xmm0
mov eax, dword [0x18004a0e0]
mov dword [rcx + 0x90], eax
mov byte [rcx + 0x94], 0
lea rcx, [rbp + 0x6a0]
call fcn.18001cce0
nop
mov rdx, qword [rbp + 0x6b8]
cmp rdx, 0xf
jbe 0x18001e148
inc rdx
mov rcx, qword [rbp + 0x6a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001e143
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e342
call fcn.180040d9c
xorps xmm0, xmm0
movups xmmword [rbp + 0x6a0], xmm0
mov ecx, 0xa0
call fcn.1800409f0
mov rcx, rax
mov qword [rbp + 0x6a0], rax
mov qword [rbp + 0x6b0], 0x93
mov qword [rbp + 0x6b8], 0x9f
movaps xmm0, xmmword [str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock3__dirin_actionblock_profileany_program_C:Program_FilesBlueStacks_msi2HD_Player.exe_]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x18004a100]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x18004a110]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x18004a120]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x18004a130]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x18004a140]
movups xmmword [rax + 0x50], xmm1
movaps xmm0, xmmword [0x18004a150]
movups xmmword [rax + 0x60], xmm0
movaps xmm1, xmmword [0x18004a160]
movups xmmword [rax + 0x70], xmm1
movaps xmm0, xmmword [0x18004a170]
movups xmmword [rax + 0x80], xmm0
movzx eax, word [0x18004a180]
mov word [rcx + 0x90], ax
movzx eax, byte [0x18004a182]
mov byte [rcx + 0x92], al
mov byte [rcx + 0x93], 0
lea rcx, [rbp + 0x6a0]
call fcn.18001cce0
nop
mov rdx, qword [rbp + 0x6b8]
cmp rdx, 0xf
jbe 0x18001e251
inc rdx
mov rcx, qword [rbp + 0x6a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001e24c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e342
call fcn.180040d9c
xorps xmm0, xmm0
movups xmmword [rbp + 0x6a0], xmm0
mov ecx, 0xa0
call fcn.1800409f0
mov rcx, rax
mov qword [rbp + 0x6a0], rax
mov qword [rbp + 0x6b0], 0x94
mov qword [rbp + 0x6b8], 0x9f
movaps xmm0, xmmword [str.netsh_advfirewall_firewall_add_rule_name_TemporaryBlock3__dirout_actionblock_profileany_program_C:Program_FilesBlueStacks_msi2HD_Player.exe_]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x18004a1a0]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x18004a1b0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x18004a1c0]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x18004a1d0]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x18004a1e0]
movups xmmword [rax + 0x50], xmm1
movaps xmm0, xmmword [0x18004a1f0]
movups xmmword [rax + 0x60], xmm0
movaps xmm1, xmmword [0x18004a200]
movups xmmword [rax + 0x70], xmm1
movaps xmm0, xmmword [0x18004a210]
movups xmmword [rax + 0x80], xmm0
mov eax, dword [0x18004a220]
mov dword [rcx + 0x90], eax
mov byte [rcx + 0x94], 0
lea rcx, [rbp + 0x6a0]
call fcn.18001cce0
nop
mov rdx, qword [rbp + 0x6b8]
cmp rdx, 0xf
jbe 0x18001e355
inc rdx
mov rcx, qword [rbp + 0x6a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001e350
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001e350
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.180040d9c
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rbp + 0x460], xmm0
mov qword [rbp + 0x470], r15
mov qword [rbp + 0x478], 0xf
mov ecx, 0x70
call fcn.1800409f0
mov rcx, rax
mov qword [rbp + 0x460], rax
mov qword [rbp + 0x470], 0x67
mov qword [rbp + 0x478], 0x6f
movaps xmm0, xmmword [str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:Program_FilesBlueStacks_nxtHD_Player.exe_]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x18004a240]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x18004a250]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x18004a260]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x18004a270]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x18004a280]
movups xmmword [rax + 0x50], xmm1
mov eax, dword [0x18004a290]
mov dword [rcx + 0x60], eax
movzx eax, word [0x18004a294]
mov word [rcx + 0x64], ax
movzx eax, byte [0x18004a296]
mov byte [rcx + 0x66], al
mov byte [rcx + 0x67], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x480], xmm0
mov qword [rbp + 0x490], r15
mov qword [rbp + 0x498], 0xf
mov ecx, 0x70
call fcn.1800409f0
mov rcx, rax
mov qword [rbp + 0x480], rax
mov qword [rbp + 0x490], 0x66
mov qword [rbp + 0x498], 0x6f
movaps xmm0, xmmword [str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:ProgramDataBlueStacks_msi5HD_Player.exe_]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x18004a2b0]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x18004a2c0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x18004a2d0]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x18004a2e0]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x18004a2f0]
movups xmmword [rax + 0x50], xmm1
mov eax, dword [0x18004a300]
mov dword [rcx + 0x60], eax
movzx eax, word [0x18004a304]
mov word [rcx + 0x64], ax
mov byte [rcx + 0x66], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x4a0], xmm0
mov qword [rbp + 0x4b0], r15
mov qword [rbp + 0x4b8], 0xf
mov ecx, 0x70
call fcn.1800409f0
mov rcx, rax
mov qword [rbp + 0x4a0], rax
mov qword [rbp + 0x4b0], 0x63
mov qword [rbp + 0x4b8], 0x6f
movaps xmm0, xmmword [str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:Program_FilesBlueStacksHD_Player.exe_]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x18004a320]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x18004a330]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x18004a340]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x18004a350]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x18004a360]
movups xmmword [rax + 0x50], xmm1
movzx eax, word [0x18004a370]
mov word [rcx + 0x60], ax
movzx eax, byte [0x18004a372]
mov byte [rcx + 0x62], al
mov byte [rcx + 0x63], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x4c0], xmm0
mov qword [rbp + 0x4d0], r15
mov qword [rbp + 0x4d8], 0xf
mov ecx, 0x70
call fcn.1800409f0
mov qword [rbp + 0x4c0], rax
mov qword [rbp + 0x4d0], 0x68
mov qword [rbp + 0x4d8], 0x6f
movaps xmm0, xmmword [str.netsh_advfirewall_firewall_delete_rule_nameall_program_C:Program_FilesBlueStacks_msi2HD_Player.exe_]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x18004a390]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x18004a3a0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x18004a3b0]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x18004a3c0]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x18004a3d0]
movups xmmword [rax + 0x50], xmm1
movsd xmm0, qword [0x18004a3e0]
movsd qword [rax + 0x60], xmm0
mov byte [rax + 0x68], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x4e0], xmm0
mov qword [rbp + 0x4f0], r15
mov qword [rbp + 0x4f8], 0xf
mov ecx, 0x80
call fcn.1800409f0
mov rcx, rax
mov qword [rbp + 0x4e0], rax
mov qword [rbp + 0x4f0], 0x7c
mov qword [rbp + 0x4f8], 0x7f
movaps xmm0, xmmword [str.netsh_advfirewall_firewall_delete_rule_name_TemporaryBlockMSI5_In__program_C:Program_FilesBlueStacks_msi5HD_Player.exe_]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x18004a400]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x18004a410]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x18004a420]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x18004a430]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x18004a440]
movups xmmword [rax + 0x50], xmm1
movaps xmm0, xmmword [0x18004a450]
movups xmmword [rax + 0x60], xmm0
movsd xmm0, qword [0x18004a460]
movsd qword [rax + 0x70], xmm0
mov eax, dword [0x18004a468]
mov dword [rcx + 0x78], eax
mov byte [rcx + 0x7c], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x500], xmm0
mov qword [rbp + 0x510], r15
mov qword [rbp + 0x518], 0xf
mov ecx, 0x80
call fcn.1800409f0
mov rcx, rax
mov qword [rbp + 0x500], rax
mov qword [rbp + 0x510], 0x7d
mov qword [rbp + 0x518], 0x7f
movaps xmm0, xmmword [str.netsh_advfirewall_firewall_delete_rule_name_TemporaryBlockMSI5_Out__program_C:Program_FilesBlueStacks_msi5HD_Player.exe_]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x18004a480]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x18004a490]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x18004a4a0]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x18004a4b0]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x18004a4c0]
movups xmmword [rax + 0x50], xmm1
movaps xmm0, xmmword [0x18004a4d0]
movups xmmword [rax + 0x60], xmm0
movsd xmm0, qword [0x18004a4e0]
movsd qword [rax + 0x70], xmm0
mov eax, dword [0x18004a4e8]
mov dword [rcx + 0x78], eax
movzx eax, byte [0x18004a4ec]
mov byte [rcx + 0x7c], al
mov byte [rcx + 0x7d], 0
lea rbx, [rbp + 0x460]
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
mov dword [rsp + 0x40], 0x70
mov dword [rsp + 0x44], 0x40
mov qword [rsp + 0x58], rdi
mov r8, rbx
lea rcx, [rbp + 0x6a0]
call fcn.18001fd00
cmp qword [rax + 0x18], 0xf
jbe 0x18001e7a1
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rdx, qword [rbp + 0x6b8]
cmp rdx, 0xf
jbe 0x18001e7e7
inc rdx
mov rcx, qword [rbp + 0x6a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001e7e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ea13
call fcn.180040d9c
mov dword [rsp + 0x70], r15d
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x18001e814
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 0x20
lea rax, [rbp + 0x520]
cmp rbx, rax
jne 0x18001e750
mov r8d, 0x1a
lea rdx, str.Fix_Lag_5_seg_Desactivado_
call fcn.18001fb70
mov edx, 0xc8
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
mov edx, 0xc8
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
nop
lea r9, [fcn.18001f9d0]
mov edx, 0x20
lea r8d, [rdx - 0x1a]
lea rcx, [rbp + 0x460]
call fcn.18004106c
mov ecx, dword [0x180053cc8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x18001e917
mov ecx, 8
call fcn.1800409f0
lea rcx, [0x18001cc90]
mov qword [rax], rcx
mov qword [rbp + 0x1f0], rax
lea rcx, [rbp + 0x208]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x1800201a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x200], rax
test rax, rax
je 0x18001ea26
cmp dword [rbp + 0x208], 0
je 0x18001ea1a
movaps xmm0, xmmword [rbp + 0x200]
movdqa xmmword [rbp + 0x1f0], xmm0
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x18001ea1a
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x200], xmm0
mov ecx, 0x72
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18001eb73
mov edi, r15d
mov rax, qword [0x180085050]
cmp byte [0x180053c75], 0
je 0x18001ea39
mov byte [0x180053c75], 0
mov dword [rbp + 0x1f0], 0xbeac8b44
mov dword [rbp + 0x1f4], 0xbf1e76c9
mov rcx, qword [0x180085048]
sub rax, rcx
sar rax, 3
test rax, rax
je 0x18001e9f1
mov rbx, r15
nop word [rax + rax]
mov rsi, qword [rcx + rbx]
mov rax, qword [0x180053d48]
test rax, rax
jne 0x18001e9b0
lea ecx, [rax + 0x10]
call fcn.1800409f0
mov qword [rbp + 0x200], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], r15d
mov qword [0x180053d48], rax
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rbp + 0x1f0]
mov rdx, rsi
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
inc edi
add rbx, 8
mov rdx, qword [0x180085050]
mov rcx, qword [0x180085048]
sub rdx, rcx
sar rdx, 3
movsxd rax, edi
cmp rax, rdx
jb 0x18001e980
mov edx, 0x2bc
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
mov r8d, 0x20
lea rdx, str.Wallhack_:_Successfully_applied_
jmp 0x18001eb6e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0x208], r15d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov byte [0x180053c75], 1
mov dword [rbp + 0x6a0], 0x3f8147ae
mov dword [rbp + 0x6a4], 0x3f8147ae
mov dword [rbp + 0x6a8], 0x3f8147ae
mov dword [rbp + 0x6ac], 0x3f8147ae
mov dword [rbp + 0x6b0], 0xeeb71a00
mov dword [rbp + 0x6b4], 0xed9f3adc
mov dword [rbp + 0x6b8], 0xe24f0030
mov dword [rbp + 0x6bc], 0xeeb02a43
mov dword [rbp + 0x6c0], 0xf4600aef
mov dword [rbp + 0x6c4], 0xeef06a43
mov dword [rbp + 0x6c8], 0xe28a001c
mov dword [rbp + 0x6cc], 0xeef05a43
mov word [rbp + 0x6d0], 0xa8f
mov rdx, qword [0x180085048]
sub rax, rdx
sar rax, 3
test rax, rax
je 0x18001eb51
mov rbx, r15
nop word [rax + rax]
mov rsi, qword [rdx + rbx]
mov rax, qword [0x180053d48]
test rax, rax
jne 0x18001eb10
lea ecx, [rax + 0x10]
call fcn.1800409f0
mov qword [rbp + 0x200], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], r15d
mov qword [0x180053d48], rax
mov qword [rsp + 0x20], r15
mov r9d, 0x32
lea r8, [rbp + 0x6a0]
mov rdx, rsi
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
inc edi
add rbx, 8
mov rcx, qword [0x180085050]
mov rdx, qword [0x180085048]
sub rcx, rdx
sar rcx, 3
movsxd rax, edi
cmp rax, rcx
jb 0x18001eae0
mov edx, 0x2bc
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
mov r8d, 0x21
lea rdx, str.Wallhack_:_Successfully_Removido_
call fcn.18001fb70
call fcn.18001c5f0
mov ebx, dword [0x180053d34]
test ebx, ebx
jne 0x18001ec36
cmp qword [0x180053d48], 0
jne 0x18001ebb0
lea ecx, [rbx + 0x10]
call fcn.1800409f0
mov qword [rbp + 0x200], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], r15d
mov qword [0x180053d48], rax
mov ebx, r15d
mov edi, r15d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rbp + 0x220], 0x238
lea rdx, [rbp + 0x220]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
lea rdx, [rbp + 0x220]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x18001ec30
lea rdx, str.HD_Player.exe
lea rcx, [rbp + 0x24c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x18001ec1c
mov eax, dword [rbp + 0x23c]
cmp eax, edi
jle 0x18001ec1c
mov edi, eax
mov ebx, dword [rbp + 0x228]
lea rdx, [rbp + 0x220]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18001ebf2
mov dword [0x180053d34], ebx
mov rdi, qword [0x180053d48]
test rdi, rdi
jne 0x18001ec6b
lea ecx, [rdi + 0x10]
call fcn.1800409f0
mov rdi, rax
mov qword [rbp + 0x200], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], r15d
mov qword [0x180053d48], rax
mov ebx, dword [0x180053d34]
mov dword [rdi + 8], ebx
test ebx, ebx
jne 0x18001eccd
xor edx, edx
lea ecx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rbp - 0x50], 0x238
lea rdx, [rbp - 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
lea rdx, [rbp - 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x18001ecca
lea rdx, str.HD_Player.exe
lea rcx, [rbp - 0x24]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov ebx, dword [rbp - 0x48]
lea rdx, [rbp - 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18001eca5
mov dword [rdi + 8], ebx
cmp dword [rdi + 8], 0
je 0x18001ece6
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rdi], rax
mov rdx, qword [0x180053d20]
mov rax, qword [rdx + 0x48a8]
mov rcx, qword [rax]
movss xmm1, dword [rcx + 0x18]
addss xmm1, dword [0x18004b174]
movss xmm0, dword [rcx + 0x14]
addss xmm0, dword [0x18004b1b0]
movss dword [rdx + 0x47b8], xmm0
movss dword [rdx + 0x47bc], xmm1
mov qword [rdx + 0x47c0], r15
mov dword [rdx + 0x47ac], 4
or dword [rdx + 0x47a8], 3
mov dword [rdx + 0x47c8], 0x43c80000
mov dword [rdx + 0x47cc], 0x43960000
mov dword [rdx + 0x47b0], 4
movss xmm0, dword [rdx + 0x3c08]
mulss xmm0, dword [0x18004b174]
call fcn.1800135e0
mov rcx, qword [0x180053d20]
mov rax, qword [rcx + 0x3ed0]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ed0]
movss xmm6, dword [0x18004b1e4]
cmp byte [rax + 0xbb], 0
jne 0x18001edba
mov qword [rbp + 0x1f0], 0
movaps xmm1, xmm6
lea rcx, [rbp + 0x1f0]
call fcn.180013210
mov rcx, qword [0x180053d20]
mov rax, qword [rcx + 0x3ed0]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ed0]
cmp byte [rax + 0xbb], 0
jne 0x18001edf9
mov qword [rbp + 0x1f0], 0
movaps xmm1, xmm6
lea rcx, [rbp + 0x1f0]
call fcn.180013210
mov rcx, qword [0x180053d20]
mov rax, qword [rcx + 0x3ed0]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ed0]
cmp byte [rax + 0xbb], 0
jne 0x18001ee31
mov qword [rbp + 0x1f0], 0
movaps xmm1, xmm6
lea rcx, [rbp + 0x1f0]
call fcn.180013210
lea r8, [0x180089514]
lea rdx, [0x180053cc8]
lea rcx, str.Aimbot
call fcn.180033fa0
mov rcx, qword [0x180053d20]
mov rax, qword [rcx + 0x3ed0]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ed0]
cmp byte [rax + 0xbb], 0
jne 0x18001ee8a
mov qword [rbp + 0x1f0], 0
movaps xmm1, xmm6
lea rcx, [rbp + 0x1f0]
call fcn.180013210
mov rax, qword [0x180053d20]
mov rcx, qword [rax + 0x3ed0]
cmp byte [rcx + 0xbb], 0
jne 0x18001eeb9
or dword [rax + 0x4758], 2
mov byte [rax + 0x4768], 1
mov dword [rax + 0x4764], 2
mov byte [rcx + 0xb8], 1
mov rbx, qword [rax + 0x3ed0]
cmp byte [rbx + 0xbb], 0
jne 0x18001f504
movsxd r8, dword [rbx + 0xf0]
mov rax, qword [rbx + 0xf8]
mov r8d, dword [rax + r8*4 - 4]
xor edx, edx
lea rcx, str.Chams___Mode
call fcn.180003f30
mov edi, eax
mov rcx, qword [rbx]
cmp dword [rcx + 0x3f18], eax
jne 0x18001ef15
lea r8, str.Chams___Mode
mov edx, 0xb
mov ecx, eax
call fcn.18001ac20
xor r9d, r9d
lea r8, str.Chams___Mode
lea edx, [r9 + 0x1a]
mov ecx, edi
call fcn.18003e130
test al, al
je 0x18001f504
mov rcx, qword [0x180053d20]
mov rax, qword [rcx + 0x3ed0]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ed0]
cmp byte [rax + 0xbb], 0
jne 0x18001ef78
mov qword [rbp + 0x1f0], 0
movaps xmm1, xmm6
lea rcx, [rbp + 0x1f0]
call fcn.180013210
mov rcx, qword [0x180053d20]
mov rax, qword [rcx + 0x3ed0]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ed0]
cmp byte [rax + 0xbb], 0
jne 0x18001efb7
mov qword [rbp + 0x1f0], 0
movaps xmm1, xmm6
lea rcx, [rbp + 0x1f0]
call fcn.180013210
mov rcx, qword [0x180053d20]
mov rax, qword [rcx + 0x3ed0]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ed0]
cmp byte [rax + 0xbb], 0
jne 0x18001eff6
mov qword [rbp + 0x1f0], 0
movaps xmm1, xmm6
lea rcx, [rbp + 0x1f0]
call fcn.180013210
mov rcx, qword [0x180053d20]
mov rax, qword [rcx + 0x3ed0]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ed0]
cmp byte [rax + 0xbb], 0
jne 0x18001f035
mov qword [rbp + 0x1f0], 0
movaps xmm1, xmm6
lea rcx, [rbp + 0x1f0]
call fcn.180013210
mov rcx, qword [0x180053d20]
mov rax, qword [rcx + 0x3ed0]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ed0]
cmp byte [rax + 0xbb], 0
jne 0x18001f06d
mov qword [rbp + 0x1f0], 0
movaps xmm1, xmm6
lea rcx, [rbp + 0x1f0]
call fcn.180013210
call fcn.1800373f0
test al, al
je 0x18001f3cb
cmp byte [0x180053c76], 1
jne 0x18001f3cb
xorps xmm0, xmm0
movups xmmword [rbp + 0x6a0], xmm0
mov qword [rbp + 0x6b0], r15
mov qword [rbp + 0x6b8], 7
mov word [rbp + 0x6a0], r15w
movups xmmword [rbp + 0x200], xmm0
mov qword [rbp + 0x210], r15
mov qword [rbp + 0x218], 7
mov word [rbp + 0x200], r15w
lea r9, str.HD_Player.exe
mov edx, 0xd
lea rcx, [rbp + 0x6a0]
call fcn.18001fe40
mov rax, qword [rbp + 0x218]
cmp rax, 0x18
jb 0x18001f12b
lea rbx, [rbp + 0x200]
cmp rax, 7
cmova rbx, qword [rbp + 0x200]
mov qword [rbp + 0x210], 0x18
mov r8d, 0x30
lea rdx, str.C:Windowsmenuchams.dll
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + 0x30], r15w
jmp 0x18001f143
lea r9, str.C:Windowsmenuchams.dll
mov edx, 0x18
lea rcx, [rbp + 0x200]
call fcn.18001fe40
lea rcx, [rbp + 0x200]
cmp qword [rbp + 0x218], 7
cmova rcx, qword [rbp + 0x200]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea rcx, [rbp + 0x6a0]
cmp qword [rbp + 0x6b8], 7
cmova rcx, qword [rbp + 0x6a0]
call fcn.18001cdf0
test eax, eax
jne 0x18001f212
mov ecx, 0xdac
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x18004a644]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18001f2fb
mov dword [rbp - 0x50], 0x238
lea rdx, [rbp - 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x18001f2fb
cmp dword [rbp - 0x48], 0
jne 0x18001f1e3
lea rdx, [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
lea rdx, [0x18004a648]
lea rcx, [rbp - 0x24]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x18001f2fb
lea rdx, [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18001f1e3
jmp 0x18001f2fb
lea rbx, [rbp + 0x200]
cmp qword [rbp + 0x218], 7
cmova rbx, qword [rbp + 0x200]
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18001f305
mov rcx, 0xffffffffffffffff
nop dword [rax]
lea rcx, [rcx + 1]
cmp word [rbx + rcx*2], 0
jne 0x18001f250
lea r14, [rcx*2 + 2]
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, r14
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
mov qword [rsp + 0x20], r15
mov r9, r14
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, rdi
test eax, eax
je 0x18001f2fe
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rsi
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rbx, rax
test rax, rax
jne 0x18001f2e0
mov r8d, 0x8000
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rdi
jmp 0x18001f2fe
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 0x8000
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x218]
cmp rdx, 7
jbe 0x18001f34e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001f349
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001f349
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180040d9c
mov qword [rbp + 0x210], r15
mov qword [rbp + 0x218], 7
mov word [rbp + 0x200], r15w
mov rdx, qword [rbp + 0x6b8]
cmp rdx, 7
jbe 0x18001f3b1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x6a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001f3ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001f3ac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180040d9c
mov qword [rbp + 0x6b0], r15
mov qword [rbp + 0x6b8], 7
mov word [rbp + 0x6a0], r15w
mov rcx, qword [0x180053d20]
mov r8, qword [rcx + 0x3ed0]
cmp byte [rcx + 0x48ef], 0
je 0x18001f417
cmp byte [rcx + 0x48ee], 0
jne 0x18001f417
test byte [rcx + 0x4770], 4
jne 0x18001f504
mov eax, dword [rcx + 0x48b8]
cmp eax, dword [rcx + 0x476c]
jne 0x18001f504
test eax, eax
je 0x18001f504
jmp 0x18001f4ec
mov eax, dword [rcx + 0x4774]
test al, 1
je 0x18001f504
cmp qword [rcx + 0x3ed8], r8
je 0x18001f436
test al, al
jns 0x18001f504
mov eax, dword [rcx + 0x3f30]
test eax, eax
je 0x18001f45b
cmp eax, dword [rcx + 0x476c]
je 0x18001f45b
cmp byte [rcx + 0x3f3d], 0
jne 0x18001f45b
cmp eax, dword [r8 + 0x7c]
jne 0x18001f504
mov rax, qword [0x180053d20]
mov rdx, qword [rax + 0x48b0]
test rdx, rdx
je 0x18001f4cd
mov rdx, qword [rdx + 0x378]
test rdx, rdx
je 0x18001f4cd
cmp byte [rdx + 0xb7], 0
je 0x18001f4cd
mov rax, qword [r8 + 0x378]
cmp rdx, rax
je 0x18001f4cd
mov r9d, dword [rdx + 0x14]
bt r9d, 0x1b
jb 0x18001f4a1
bt r9d, 0x1a
jae 0x18001f4cd
cmp qword [rax + 0x378], rdx
je 0x18001f4cd
nop word [rax + rax]
cmp rax, rdx
je 0x18001f4cd
mov rax, qword [rax + 0x370]
test rax, rax
jne 0x18001f4b0
test dword [rcx + 0x4770], 0x100
je 0x18001f504
test byte [rcx + 0x4770], 4
jne 0x18001f504
mov eax, dword [r8 + 0x7c]
cmp dword [rcx + 0x476c], eax
jne 0x18001f4ec
cmp byte [r8 + 0xb8], 0
jne 0x18001f504
xor ecx, ecx
call fcn.180014280
lea rcx, str.Escribe_chams
call fcn.1800356a0
call fcn.18000fde0
mov rcx, qword [0x180053d20]
mov rax, qword [rcx + 0x3ed0]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ed0]
cmp byte [rax + 0xbb], 0
jne 0x18001f543
mov qword [rbp + 0x1f0], 0
movaps xmm1, xmm6
lea rcx, [rbp + 0x1f0]
call fcn.180013210
mov rcx, qword [0x180053d20]
mov rax, qword [rcx + 0x3ed0]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ed0]
cmp byte [rax + 0xbb], 0
jne 0x18001f582
mov qword [rbp + 0x1f0], 0
movaps xmm1, xmm6
lea rcx, [rbp + 0x1f0]
call fcn.180013210
mov rcx, qword [0x180053d20]
mov rax, qword [rcx + 0x3ed0]
mov byte [rax + 0xb8], 1
mov rbx, qword [rcx + 0x3ed0]
cmp byte [rbx + 0xbb], 0
jne 0x18001f792
movsxd rax, dword [rbx + 0xf0]
mov r8, qword [rbx + 0xf8]
mov r8d, dword [r8 + rax*4 - 4]
xor edx, edx
lea rcx, str.FakeLag___Mode
call fcn.180003f30
mov edi, eax
mov rcx, qword [rbx]
cmp dword [rcx + 0x3f18], eax
jne 0x18001f5ec
lea r8, str.FakeLag___Mode
mov edx, 0xb
mov ecx, eax
call fcn.18001ac20
xor r9d, r9d
lea r8, str.FakeLag___Mode
lea edx, [r9 + 0x1a]
mov ecx, edi
call fcn.18003e130
test al, al
je 0x18001f792
mov rcx, qword [0x180053d20]
mov rax, qword [rcx + 0x3ed0]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ed0]
cmp byte [rax + 0xbb], 0
jne 0x18001f64f
mov qword [rbp + 0x1f0], 0
movaps xmm1, xmm6
lea rcx, [rbp + 0x1f0]
call fcn.180013210
mov rcx, qword [0x180053d20]
mov rax, qword [rcx + 0x3ed0]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ed0]
cmp byte [rax + 0xbb], 0
jne 0x18001f68e
mov qword [rbp + 0x1f0], 0
movaps xmm1, xmm6
lea rcx, [rbp + 0x1f0]
call fcn.180013210
mov rcx, qword [0x180053d20]
mov rax, qword [rcx + 0x3ed0]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ed0]
cmp byte [rax + 0xbb], 0
jne 0x18001f6cd
mov qword [rbp + 0x1f0], 0
movaps xmm1, xmm6
lea rcx, [rbp + 0x1f0]
call fcn.180013210
mov rcx, qword [0x180053d20]
mov rax, qword [rcx + 0x3ed0]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ed0]
cmp byte [rax + 0xbb], 0
jne 0x18001f705
mov qword [rbp + 0x1f0], 0
movaps xmm1, xmm6
lea rcx, [rbp + 0x1f0]
call fcn.180013210
lea r8, [0x180089510]
lea rdx, [0x180053d30]
lea rcx, str.Fix_Lag_2_seg
call fcn.180033fa0
lea r8, [0x180089510]
lea rdx, [0x180053d38]
lea rcx, str.Fix_Lag_3_seg
call fcn.180033fa0
lea r8, [0x180089510]
lea rdx, [0x180053ccc]
lea rcx, str.Fix_Lag_5_seg
call fcn.180033fa0
mov rcx, qword [0x180053d20]
mov rax, qword [rcx + 0x3ed0]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ed0]
cmp byte [rax + 0xbb], 0
jne 0x18001f792
mov qword [rbp + 0x1f0], 0
movaps xmm1, xmm6
lea rcx, [rbp + 0x1f0]
call fcn.180013210
mov rcx, qword [0x180053d20]
mov rax, qword [rcx + 0x3ed0]
mov byte [rax + 0xb8], 1
mov r8, qword [rcx + 0x3ed0]
movsxd rdx, dword [r8 + 0x1c8]
mov rax, qword [r8 + 0x1d0]
mov ecx, dword [rax + rdx*4 - 4]
mov dword [r8 + 0x1bc], ecx
lea eax, [rdx - 1]
mov dword [r8 + 0x1c8], eax
lea rcx, [0x180053598]
cmp qword [0x1800535b0], 0xf
cmova rcx, qword [0x180053598]
call fcn.1800356a0
call fcn.18000fde0
mov rcx, qword [rbp + 0x6d8]
xor rcx, rsp
call fcn.1800409d0
lea r11, [rsp + 0x7f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop rbp
ret