Function at 0x140003310
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create thread
Enumerate process modules
Enumerate processes
Hide graphical window
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x8e0]
sub rsp, 0x9e0
movaps xmmword [rsp + 0x950], xmm14
mov rax, qword [0x14006c010]
xor rax, rsp
mov qword [rbp + 0x840], rax
lea r8, str.firexi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 1
cmp eax, 0xb7
je 0x1400055e3
xor edx, edx
lea ecx, [rdi + 1]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [rbp + 0x600], 0x130
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400055e3
lea rdx, [rbp + 0x600]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400033db
nop
lea rdx, str.Minecraft.Windows.exe
lea rcx, [rbp + 0x62c]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
mov rcx, rbx
test eax, eax
je 0x1400033e9
lea rdx, [rbp + 0x600]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400033b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400055e3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [rbp + 0x608]
test edi, edi
je 0x1400055de
mov ecx, 8
call fcn.140058ef0
lea rcx, [0x140002f10]
xor r14d, r14d
mov r9, rax
lea r8, [0x1400069b0]
xor edx, edx
mov qword [rax], rcx
lea rcx, [rbp + 0x5f0]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x5e8], rax
test rax, rax
je 0x1400055cb
lea ecx, [r14 + 8]
call fcn.140058ef0
lea rdx, [rbp + 0x5e0]
mov r9, rax
mov qword [rsp + 0x28], rdx
lea rcx, [0x1400031c0]
lea r8, [0x1400069b0]
mov dword [rsp + 0x20], r14d
mov qword [rax], rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x5d8], rax
test rax, rax
je 0x1400055b8
mov edx, edi
lea ecx, [r14 + 8]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [rbp + 0x600], 0x238
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140003505
lea rdx, [rbp + 0x600]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x1400034fc
nop dword [rax]
nop dword [rax + rax]
lea rdx, str.Minecraft.Windows.exe
lea rcx, [rbp + 0x630]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbscmp]
test eax, eax
je 0x1400034fc
lea rdx, [rbp + 0x600]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x1400034d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x2c0]
mov edx, 4
lea rax, [rbp + 0x600]
nop dword [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x140003520
movups xmm0, xmmword [rax]
mov r8d, edi
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x20]
mov rax, qword [rax + 0x30]
movups xmmword [rcx + 0x10], xmm1
movups xmmword [rcx + 0x20], xmm0
mov qword [rcx + 0x30], rax
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, dword [rbp + 0x620]
lea rcx, [rbp + 0x5b8]
mov rsi, rax
xorps xmm0, xmm0
xor eax, eax
mov edx, ebx
mov qword [rbp + 0x5c8], rax
movups xmmword [rbp + 0x5b8], xmm0
call fcn.140005e50
mov r8, qword [rbp + 0x5b8]
mov r9d, ebx
mov rdx, qword [rbp + 0x618]
mov rcx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x14006cce0]
xorps xmm0, xmm0
sub rdx, qword [0x14006ccd8]
sar rdx, 2
mov qword [rbp - 0x40], r14
movdqu xmmword [rbp - 0x50], xmm0
test rdx, rdx
je 0x140003640
lea rcx, [rbp - 0x50]
call fcn.140001980
mov rdx, qword [0x14006ccd8]
mov rbx, qword [0x14006cce0]
mov rdi, qword [rbp - 0x50]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar rbx, 2
lea rax, [rdi + rbx*4]
mov qword [rbp - 0x48], rax
mov rbx, qword [rbp + 0x5c0]
xorps xmm0, xmm0
movabs r15, 0x7fffffffffffffff
mov qword [rbp + 0x30], r14
movdqu xmmword [rbp + 0x20], xmm0
sub rbx, qword [rbp + 0x5b8]
je 0x1400036eb
cmp rbx, r15
ja 0x140005623
cmp rbx, 0x1000
jb 0x1400036a8
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140005629
call fcn.140058ef0
test rax, rax
je 0x1400036a1
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x1400036b3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140058ef0
mov r14, rax
mov rdi, qword [rbp + 0x5c0]
lea rcx, [r14 + rbx]
mov rbx, qword [rbp + 0x5b8]
mov r8, rdi
mov qword [rbp + 0x30], rcx
sub r8, rbx
mov rdx, rbx
mov qword [rbp + 0x20], r14
mov rcx, r14
call sub.VCRUNTIME140.dll_memmove
sub rdi, rbx
add rdi, r14
mov qword [rbp + 0x28], rdi
xor r14d, r14d
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x20]
call fcn.140001af0
mov rdx, qword [0x14006cc08]
xorps xmm0, xmm0
sub rdx, qword [0x14006cc00]
sar rdx, 2
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x40], r14
movdqu xmmword [rbp - 0x50], xmm0
test rdx, rdx
je 0x140003754
lea rcx, [rbp - 0x50]
call fcn.140001980
mov rdx, qword [0x14006cc00]
mov rbx, qword [0x14006cc08]
mov rdi, qword [rbp - 0x50]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar rbx, 2
lea rax, [rdi + rbx*4]
mov qword [rbp - 0x48], rax
mov rbx, qword [rbp + 0x5c0]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r14
sub rbx, qword [rbp + 0x5b8]
je 0x1400037f5
cmp rbx, r15
ja 0x14000562f
cmp rbx, 0x1000
jb 0x1400037b2
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140005635
call fcn.140058ef0
test rax, rax
je 0x1400037ab
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x1400037bd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140058ef0
mov r14, rax
mov rdi, qword [rbp + 0x5c0]
lea rcx, [rbx + r14]
mov rbx, qword [rbp + 0x5b8]
mov r8, rdi
mov qword [rbp + 0x30], rcx
sub r8, rbx
mov rdx, rbx
mov qword [rbp + 0x20], r14
mov rcx, r14
call sub.VCRUNTIME140.dll_memmove
sub rdi, rbx
add rdi, r14
mov qword [rbp + 0x28], rdi
xor r14d, r14d
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x20]
call fcn.140001af0
mov rdx, qword [0x14006cc98]
xorps xmm0, xmm0
sub rdx, qword [0x14006cc90]
mov r13, rax
sar rdx, 2
mov qword [rbp + 0x68], r14
movdqu xmmword [rbp + 0x58], xmm0
test rdx, rdx
je 0x14000385d
lea rcx, [rbp + 0x58]
call fcn.140001980
mov rdx, qword [0x14006cc90]
mov rbx, qword [0x14006cc98]
mov rdi, qword [rbp + 0x58]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar rbx, 2
lea rax, [rdi + rbx*4]
mov qword [rbp + 0x60], rax
mov rbx, qword [rbp + 0x5c0]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r14
sub rbx, qword [rbp + 0x5b8]
je 0x1400038fe
cmp rbx, r15
ja 0x14000563b
cmp rbx, 0x1000
jb 0x1400038bb
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14000561d
call fcn.140058ef0
test rax, rax
je 0x1400038b4
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x1400038c6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140058ef0
mov r14, rax
mov rdi, qword [rbp + 0x5c0]
lea rcx, [r14 + rbx]
mov rbx, qword [rbp + 0x5b8]
mov r8, rdi
mov qword [rbp + 0x50], rcx
sub r8, rbx
mov rdx, rbx
mov qword [rbp + 0x40], r14
mov rcx, r14
call sub.VCRUNTIME140.dll_memmove
sub rdi, rbx
add rdi, r14
mov qword [rbp + 0x48], rdi
xor r14d, r14d
lea rdx, [rbp + 0x58]
lea rcx, [rbp + 0x40]
call fcn.140001af0
mov r12, qword [rbp + 0x2d8]
mov r15, rax
mov qword [rbp + 0x38], rax
mov rax, qword [rbp - 0x20]
test rax, rax
je 0x140003cc9
mov rdx, qword [0x14006cc50]
lea rdi, [rax + r12]
sub rdx, qword [0x14006cc48]
xorps xmm0, xmm0
sar rdx, 2
mov qword [rbp - 0x10], rdi
mov qword [rbp - 0x58], r14
movdqu xmmword [rbp - 0x68], xmm0
test rdx, rdx
je 0x140003997
lea rcx, [rbp - 0x68]
call fcn.140001980
mov rdx, qword [0x14006cc48]
mov rbx, qword [0x14006cc50]
mov rdi, qword [rbp - 0x68]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar rbx, 2
lea rcx, [rbp - 0x28]
mov qword [rbp - 0x28], r14
lea rax, [rdi + rbx*4]
mov qword [rbp - 0x60], rax
call fcn.140001a10
mov rdi, qword [rbp - 0x10]
lea rdx, [rbp - 0x68]
mov rcx, rdi
call fcn.140001ed0
mov r14, rax
lea rcx, [rbp + 0x80]
lea rax, [rbp + 0x2c0]
mov edx, 4
nop dword [rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x1400039c0
movups xmm0, xmmword [rax]
mov r9, qword [0x14006cc20]
lea rdx, [rbp + 0x80]
movups xmm1, xmmword [rax + 0x10]
sub r9, qword [0x14006cc18]
movups xmmword [rcx], xmm0
sar r9, 2
movups xmm0, xmmword [rax + 0x20]
mov rax, qword [rax + 0x30]
movups xmmword [rcx + 0x10], xmm1
mov dword [rsp + 0x20], 1
movups xmmword [rcx + 0x20], xmm0
mov qword [rcx + 0x30], rax
mov rcx, rsi
call fcn.140001f50
lea rdx, [0x14006cc18]
mov qword [rbp - 8], rax
lea rcx, [rbp + 0x510]
mov rbx, rax
call fcn.140001a80
mov rdx, rax
mov rcx, rbx
call fcn.140002190
add rbx, 0x1000
lea rdx, [0x14006cc60]
lea rcx, [rsp + 0x60]
mov qword [rbp], rbx
sub r14, rax
call fcn.140001a80
mov r9, rax
lea rcx, [rbp + 0x510]
mov r8, rdi
mov rdx, rsi
call fcn.140001ce0
mov rdx, rax
lea rcx, [0x14006cc60]
call fcn.140005f90
lea rcx, [rbp + 0x510]
call fcn.140005f30
lea rdx, [0x14006cc48]
lea rcx, [rsp + 0x60]
call fcn.140001a80
mov rdx, qword [rbp - 8]
lea rcx, [rbp + 0x510]
sub rdx, rdi
mov r8, rax
sub rdx, 5
call fcn.140002210
mov rdx, rax
lea rcx, [0x14006cc48]
call fcn.140005f90
lea rcx, [rbp + 0x510]
call fcn.140005f30
mov rdx, qword [0x14006cc20]
xorps xmm0, xmm0
sub rdx, qword [0x14006cc18]
sar rdx, 2
mov qword [rbp - 0x58], 0
movdqu xmmword [rbp - 0x68], xmm0
test rdx, rdx
je 0x140003b74
lea rcx, [rbp - 0x68]
call fcn.140001980
mov rdx, qword [0x14006cc18]
mov rbx, qword [0x14006cc20]
mov rdi, qword [rbp - 0x68]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar rbx, 2
lea rax, [rdi + rbx*4]
mov rbx, qword [rbp]
mov qword [rbp - 0x60], rax
lea r8, [rbp - 0x68]
lea rdx, [r14 - 5]
lea rcx, [rsp + 0x60]
call fcn.140002210
mov rdx, rax
lea rcx, [0x14006cc18]
call fcn.140005f90
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140003bd8
mov rdx, qword [rsp + 0x70]
mov rax, rcx
sub rdx, rcx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x140003bd3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003bd3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140059254
xor r14d, r14d
lea r8, [0x14006c048]
mov rdx, rbx
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea r9d, [r14 + 4]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x14006cc20]
xorps xmm0, xmm0
sub rdx, qword [0x14006cc18]
sar rdx, 2
mov qword [rbp - 0x58], r14
movdqu xmmword [rbp - 0x68], xmm0
test rdx, rdx
je 0x140003c4f
lea rcx, [rbp - 0x68]
call fcn.140001980
mov rdx, qword [0x14006cc18]
mov rbx, qword [0x14006cc20]
mov rdi, qword [rbp - 0x68]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar rbx, 2
lea rax, [rdi + rbx*4]
mov qword [rbp - 0x60], rax
mov rdx, qword [rbp - 8]
lea r8, [rbp - 0x68]
mov rcx, rsi
call fcn.140002d30
mov rdx, qword [0x14006cc50]
xorps xmm0, xmm0
sub rdx, qword [0x14006cc48]
sar rdx, 2
mov qword [rbp - 0x58], r14
movdqu xmmword [rbp - 0x68], xmm0
test rdx, rdx
je 0x140003cb7
lea rcx, [rbp - 0x68]
call fcn.140001980
mov rdx, qword [0x14006cc48]
mov rbx, qword [0x14006cc50]
mov rdi, qword [rbp - 0x68]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar rbx, 2
lea rax, [rdi + rbx*4]
mov qword [rbp - 0x60], rax
mov rdx, qword [rbp - 0x10]
lea r8, [rbp - 0x68]
mov rcx, rsi
call fcn.140002d30
jmp 0x140003ce1
mov rax, qword [rbp - 0x70]
mov qword [rbp], rax
mov rax, qword [rbp - 0x70]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x70]
mov qword [rbp - 8], rax
movss xmm14, dword [0x140062a54]
test r15, r15
je 0x140004202
mov rdx, qword [0x14006ccb0]
lea r14, [r15 + r12]
sub rdx, qword [0x14006cca8]
xorps xmm0, xmm0
sar rdx, 2
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x78], 0
movdqu xmmword [rsp + 0x78], xmm0
test rdx, rdx
je 0x140003d5a
lea rcx, [rsp + 0x78]
call fcn.140001980
mov rdx, qword [0x14006cca8]
mov rbx, qword [0x14006ccb0]
mov rdi, qword [rsp + 0x78]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar rbx, 2
lea rax, [rdi + rbx*4]
mov qword [rbp - 0x80], rax
lea rdx, [rsp + 0x78]
mov rcx, r14
call fcn.140001ed0
mov r15, rax
lea rcx, [rbp + 0x80]
lea rax, [rbp + 0x2c0]
mov edx, 4
nop dword [rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x140003d80
movups xmm0, xmmword [rax]
mov r9, qword [0x14006cc38]
lea rdx, [rbp + 0x80]
movups xmm1, xmmword [rax + 0x10]
sub r9, qword [0x14006cc30]
movups xmmword [rcx], xmm0
sar r9, 2
movups xmm0, xmmword [rax + 0x20]
mov rax, qword [rax + 0x30]
movups xmmword [rcx + 0x10], xmm1
mov dword [rsp + 0x20], 1
movups xmmword [rcx + 0x20], xmm0
mov qword [rcx + 0x30], rax
mov rcx, rsi
call fcn.140001f50
mov rdx, qword [0x14006cc38]
xorps xmm0, xmm0
sub rdx, qword [0x14006cc30]
mov rbx, rax
sar rdx, 2
mov qword [rbp + 8], rax
mov qword [rbp - 0x78], 0
movdqu xmmword [rsp + 0x78], xmm0
test rdx, rdx
je 0x140003e84
lea rcx, [rsp + 0x78]
call fcn.140001980
mov rdx, qword [0x14006cc30]
mov rbx, qword [0x14006cc38]
mov rdi, qword [rsp + 0x78]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar rbx, 2
lea rax, [rdi + rbx*4]
mov rbx, qword [rbp + 8]
mov qword [rbp - 0x80], rax
mov r14, rbx
lea rdx, [rsp + 0x78]
sub r14, qword [rbp - 0x38]
mov rcx, rbx
call fcn.140002190
mov rdx, qword [0x14006cc80]
sub r15, rax
sub rdx, qword [0x14006cc78]
lea rax, [rbx + 0x1000]
sar rdx, 2
xorps xmm0, xmm0
mov qword [rbp + 0x10], rax
mov qword [rbp - 0x78], 0
movdqu xmmword [rsp + 0x78], xmm0
test rdx, rdx
je 0x140003f05
lea rcx, [rsp + 0x78]
call fcn.140001980
mov rdx, qword [0x14006cc78]
mov rbx, qword [0x14006cc80]
mov rdi, qword [rsp + 0x78]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar rbx, 2
lea rax, [rdi + rbx*4]
mov qword [rbp - 0x80], rax
mov r8, qword [rbp - 0x38]
lea r9, [rsp + 0x78]
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.140001ce0
mov rdx, rax
lea rcx, [0x14006cc78]
call fcn.140005f90
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140003f6d
mov rdx, qword [rsp + 0x70]
mov rax, rcx
sub rdx, rcx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x140003f68
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003f68
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140059254
mov rdx, qword [0x14006ccb0]
xorps xmm0, xmm0
sub rdx, qword [0x14006cca8]
sar rdx, 2
mov qword [rbp - 0x78], 0
movdqu xmmword [rsp + 0x78], xmm0
test rdx, rdx
je 0x140003fcc
lea rcx, [rsp + 0x78]
call fcn.140001980
mov rdx, qword [0x14006cca8]
mov rbx, qword [0x14006ccb0]
mov rdi, qword [rsp + 0x78]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar rbx, 2
lea rax, [rdi + rbx*4]
mov qword [rbp - 0x80], rax
lea r8, [rsp + 0x78]
lea rdx, [r14 - 5]
lea rcx, [rsp + 0x60]
call fcn.140002210
mov rdx, rax
lea rcx, [0x14006cca8]
call fcn.140005f90
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140004031
mov rdx, qword [rsp + 0x70]
mov rax, rcx
sub rdx, rcx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x14000402c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000402c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140059254
mov rdx, qword [0x14006cc38]
xor r14d, r14d
sub rdx, qword [0x14006cc30]
xorps xmm0, xmm0
sar rdx, 2
mov qword [rbp - 0x78], r14
movdqu xmmword [rsp + 0x78], xmm0
test rdx, rdx
je 0x14000408f
lea rcx, [rsp + 0x78]
call fcn.140001980
mov rdx, qword [0x14006cc30]
mov rbx, qword [0x14006cc38]
mov rdi, qword [rsp + 0x78]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar rbx, 2
lea rax, [rdi + rbx*4]
mov qword [rbp - 0x80], rax
lea r8, [rsp + 0x78]
lea rdx, [r15 - 5]
lea rcx, [rsp + 0x60]
call fcn.140002210
mov rdx, rax
lea rcx, [0x14006cc30]
call fcn.140005f90
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400040f4
mov rdx, qword [rsp + 0x70]
mov rax, rcx
sub rdx, rcx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x1400040ef
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400040ef
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140059254
movss xmm0, dword [0x14006c054]
lea r8, [rbp + 0x5d0]
mov rdx, qword [rbp + 0x10]
mov r9d, 4
mulss xmm0, xmm14
mov rcx, rsi
mov qword [rsp + 0x20], r14
movss dword [rbp + 0x5d0], xmm0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x14006cc38]
xorps xmm0, xmm0
sub rdx, qword [0x14006cc30]
sar rdx, 2
mov qword [rbp - 0x78], r14
movdqu xmmword [rsp + 0x78], xmm0
test rdx, rdx
je 0x140004183
lea rcx, [rsp + 0x78]
call fcn.140001980
mov rdx, qword [0x14006cc30]
mov rbx, qword [0x14006cc38]
mov rdi, qword [rsp + 0x78]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar rbx, 2
lea rax, [rdi + rbx*4]
mov qword [rbp - 0x80], rax
mov rdx, qword [rbp + 8]
lea r8, [rsp + 0x78]
mov rcx, rsi
call fcn.140002d30
mov rdx, qword [0x14006ccb0]
xorps xmm0, xmm0
sub rdx, qword [0x14006cca8]
sar rdx, 2
mov qword [rbp - 0x78], r14
movdqu xmmword [rsp + 0x78], xmm0
test rdx, rdx
je 0x1400041ef
lea rcx, [rsp + 0x78]
call fcn.140001980
mov rdx, qword [0x14006cca8]
mov rbx, qword [0x14006ccb0]
mov rdi, qword [rsp + 0x78]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar rbx, 2
lea rax, [rdi + rbx*4]
mov qword [rbp - 0x80], rax
mov rdx, qword [rbp - 0x38]
lea r8, [rsp + 0x78]
mov rcx, rsi
call fcn.140002d30
jmp 0x14000421a
mov rax, qword [rbp - 0x70]
mov qword [rbp + 0x10], rax
mov rax, qword [rbp - 0x70]
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 0x70]
mov qword [rbp + 8], rax
test r13, r13
je 0x140004a00
mov rdx, qword [0x14006ccc8]
add r13, 2
sub rdx, qword [0x14006ccc0]
xor edi, edi
sar rdx, 2
xorps xmm0, xmm0
mov qword [rsp + 0x70], rdi
lea r14, [r12 + r13]
mov qword [rbp - 0x28], r14
movdqu xmmword [rsp + 0x60], xmm0
test rdx, rdx
je 0x140004290
lea rcx, [rsp + 0x60]
call fcn.140001980
mov rdx, qword [0x14006ccc0]
mov rbx, qword [0x14006ccc8]
mov rdi, qword [rsp + 0x60]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar rbx, 2
lea rax, [rdi + rbx*4]
xor edi, edi
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
mov rcx, r14
call fcn.140001ed0
mov r15, rax
lea rcx, [rbp + 0x80]
lea rax, [rbp + 0x2c0]
mov edx, 4
nop dword [rax]
nop word [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x1400042c0
movups xmm0, xmmword [rax]
mov r9, qword [0x14006cd10]
lea rdx, [rbp + 0x80]
movups xmm1, xmmword [rax + 0x10]
sub r9, qword [0x14006cd08]
movups xmmword [rcx], xmm0
sar r9, 2
movups xmm0, xmmword [rax + 0x20]
mov rax, qword [rax + 0x30]
movups xmmword [rcx + 0x10], xmm1
mov dword [rsp + 0x20], 2
movups xmmword [rcx + 0x20], xmm0
mov qword [rcx + 0x30], rax
mov rcx, rsi
call fcn.140001f50
mov rdx, qword [0x14006cd10]
xorps xmm0, xmm0
sub rdx, qword [0x14006cd08]
mov rbx, rax
sar rdx, 2
mov qword [rbp - 0x18], rax
mov qword [rsp + 0x70], rdi
movdqu xmmword [rsp + 0x60], xmm0
test rdx, rdx
je 0x1400043c4
lea rcx, [rsp + 0x60]
call fcn.140001980
mov rdx, qword [0x14006cd08]
mov rbx, qword [0x14006cd10]
mov rdi, qword [rsp + 0x60]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar rbx, 2
lea rax, [rdi + rbx*4]
mov rbx, qword [rbp - 0x18]
mov qword [rsp + 0x68], rax
xor edi, edi
lea rax, [r12 + r13]
mov r14, rbx
lea rdx, [rsp + 0x60]
mov rcx, rbx
sub r14, rax
call fcn.140002190
mov rdx, qword [0x14006ccf8]
sub r15, rax
sub rdx, qword [0x14006ccf0]
lea rax, [rbx + 0x1000]
sar rdx, 2
xorps xmm0, xmm0
mov qword [rbp + 0x18], rax
lea rax, [rbx + 0x1004]
mov qword [rbp - 0x30], rax
mov qword [rsp + 0x70], rdi
movdqu xmmword [rsp + 0x60], xmm0
test rdx, rdx
je 0x140004453
lea rcx, [rsp + 0x60]
call fcn.140001980
mov rdx, qword [0x14006ccf0]
mov rbx, qword [0x14006ccf8]
mov rdi, qword [rsp + 0x60]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar rbx, 2
lea rax, [rdi + rbx*4]
xor edi, edi
mov qword [rsp + 0x68], rax
lea r9, [rsp + 0x60]
mov rdx, rsi
lea r8, [r12 + r13]
lea rcx, [rbp + 0x510]
call fcn.140001ce0
mov rdx, rax
lea rcx, [0x14006ccf0]
call fcn.140005f90
mov rcx, qword [rbp + 0x510]
test rcx, rcx
je 0x1400044c1
mov rdx, qword [rbp + 0x520]
mov rax, rcx
sub rdx, rcx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x1400044bc
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400044bc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140059254
mov rdx, qword [0x14006ccc8]
xorps xmm0, xmm0
sub rdx, qword [0x14006ccc0]
sar rdx, 2
mov qword [rsp + 0x70], rdi
movdqu xmmword [rsp + 0x60], xmm0
test rdx, rdx
je 0x140004520
lea rcx, [rsp + 0x60]
call fcn.140001980
mov rdx, qword [0x14006ccc0]
mov rbx, qword [0x14006ccc8]
mov rdi, qword [rsp + 0x60]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar rbx, 2
lea rax, [rdi + rbx*4]
xor edi, edi
mov qword [rsp + 0x68], rax
lea r8, [rsp + 0x60]
lea rdx, [r14 - 5]
lea rcx, [rbp + 0x510]
call fcn.140002210
mov rdx, rax
lea rcx, [0x14006ccc0]
call fcn.140005f90
mov rcx, qword [rbp + 0x510]
test rcx, rcx
je 0x14000458b
mov rdx, qword [rbp + 0x520]
mov rax, rcx
sub rdx, rcx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x140004586
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004586
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140059254
mov rdx, qword [0x14006cd10]
xorps xmm0, xmm0
sub rdx, qword [0x14006cd08]
sar rdx, 2
mov qword [rsp + 0x70], rdi
movdqu xmmword [rsp + 0x60], xmm0
test rdx, rdx
je 0x1400045ea
lea rcx, [rsp + 0x60]
call fcn.140001980
mov rdx, qword [0x14006cd08]
mov rbx, qword [0x14006cd10]
mov rdi, qword [rsp + 0x60]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar rbx, 2
lea rax, [rdi + rbx*4]
xor edi, edi
mov qword [rsp + 0x68], rax
lea r8, [rsp + 0x60]
lea rdx, [r15 - 5]
lea rcx, [rbp + 0x510]
call fcn.140002210
mov rdx, rax
lea rcx, [0x14006cd08]
call fcn.140005f90
mov rcx, qword [rbp + 0x510]
test rcx, rcx
je 0x140004655
mov rdx, qword [rbp + 0x520]
mov rax, rcx
sub rdx, rcx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x140004650
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004650
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140059254
lea rdx, [r12 + 5]
mov qword [rbp + 0x500], 5
add rdx, r13
mov qword [rsp + 0x20], rdi
mov r9d, 1
lea r8, [rbp + 0x500]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x14006cd10]
xorps xmm0, xmm0
sub rdx, qword [0x14006cd08]
sar rdx, 2
mov qword [rsp + 0x70], rdi
movdqu xmmword [rsp + 0x60], xmm0
test rdx, rdx
je 0x1400046e2
lea rcx, [rsp + 0x60]
call fcn.140001980
mov rdx, qword [0x14006cd08]
mov rbx, qword [0x14006cd10]
mov rdi, qword [rsp + 0x60]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar rbx, 2
lea rax, [rdi + rbx*4]
xor edi, edi
mov qword [rsp + 0x68], rax
mov r14, qword [rbp + 0x500]
lea rdx, [rsp + 0x60]
mov r8, r14
lea rcx, [rbp + 0x510]
call fcn.140001e00
mov rdx, rax
lea rcx, [0x14006cd08]
call fcn.140005f90
mov rcx, qword [rbp + 0x510]
test rcx, rcx
je 0x140004753
mov rdx, qword [rbp + 0x520]
mov rax, rcx
sub rdx, rcx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x14000474e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000474e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140059254
mov rdx, qword [0x14006cd10]
xorps xmm0, xmm0
sub rdx, qword [0x14006cd08]
sar rdx, 2
mov qword [rsp + 0x70], rdi
movdqu xmmword [rsp + 0x60], xmm0
test rdx, rdx
je 0x1400047b2
lea rcx, [rsp + 0x60]
call fcn.140001980
mov rdx, qword [0x14006cd08]
mov rbx, qword [0x14006cd10]
mov rdi, qword [rsp + 0x60]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar rbx, 2
lea rax, [rdi + rbx*4]
xor edi, edi
mov qword [rsp + 0x68], rax
lea r8, [r14 + 4]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x510]
call fcn.140001e00
mov rdx, rax
lea rcx, [0x14006cd08]
call fcn.140005f90
mov rcx, qword [rbp + 0x510]
test rcx, rcx
je 0x14000481d
mov rdx, qword [rbp + 0x520]
mov rax, rcx
sub rdx, rcx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x140004818
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004818
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140059254
mov rdx, qword [0x14006cd10]
xorps xmm0, xmm0
sub rdx, qword [0x14006cd08]
sar rdx, 2
mov qword [rsp + 0x70], rdi
movdqu xmmword [rsp + 0x60], xmm0
test rdx, rdx
je 0x14000487a
lea rcx, [rsp + 0x60]
call fcn.140001980
mov rdx, qword [0x14006cd08]
mov rbx, qword [0x14006cd10]
mov rdi, qword [rsp + 0x60]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar rbx, 2
lea rax, [rdi + rbx*4]
mov qword [rsp + 0x68], rax
lea r8, [r14 + 8]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x510]
call fcn.140001e00
mov rdx, rax
lea rcx, [0x14006cd08]
call fcn.140005f90
mov rcx, qword [rbp + 0x510]
test rcx, rcx
je 0x1400048e5
mov rdx, qword [rbp + 0x520]
mov rax, rcx
sub rdx, rcx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x1400048e0
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400048e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140059254
mov rdx, qword [rbp + 0x18]
lea r8, [0x14006c050]
xor r14d, r14d
mov rcx, rsi
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 4]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [rbp - 0x30]
lea r9d, [r14 + 4]
lea r8, [0x14006c044]
mov qword [rsp + 0x20], r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x14006cd10]
xorps xmm0, xmm0
sub rdx, qword [0x14006cd08]
sar rdx, 2
mov qword [rsp + 0x70], r14
movdqu xmmword [rsp + 0x60], xmm0
test rdx, rdx
je 0x14000497f
lea rcx, [rsp + 0x60]
call fcn.140001980
mov rdx, qword [0x14006cd08]
mov rbx, qword [0x14006cd10]
mov rdi, qword [rsp + 0x60]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar rbx, 2
lea rax, [rdi + rbx*4]
mov qword [rsp + 0x68], rax
mov rdx, qword [rbp - 0x18]
lea r8, [rsp + 0x60]
mov rcx, rsi
call fcn.140002d30
mov rdx, qword [0x14006ccc8]
xorps xmm0, xmm0
sub rdx, qword [0x14006ccc0]
sar rdx, 2
mov qword [rsp + 0x70], r14
movdqu xmmword [rsp + 0x60], xmm0
test rdx, rdx
je 0x1400049ed
lea rcx, [rsp + 0x60]
call fcn.140001980
mov rdx, qword [0x14006ccc0]
mov rbx, qword [0x14006ccc8]
mov rdi, qword [rsp + 0x60]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar rbx, 2
lea rax, [rdi + rbx*4]
mov qword [rsp + 0x68], rax
mov rdx, qword [rbp - 0x28]
lea r8, [rsp + 0x60]
mov rcx, rsi
call fcn.140002d30
jmp 0x140004a20
mov rax, qword [rbp - 0x70]
mov r12, qword [rbp - 0x70]
mov qword [rbp + 0x18], rax
mov rax, qword [rbp - 0x70]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x70]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x18], r12
mov rax, qword [0x14006cbf0]
test rax, rax
je 0x140004a3c
mov rcx, qword [rax + 0x98]
test rcx, rcx
je 0x140004a3c
mov byte [rcx + 0x30], 1
xor edx, edx
mov ebx, 4
lea ecx, [rdx + 0xa]
call fcn.140047220
test eax, eax
je 0x140004ac2
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rbx + rcx]
cmp dword [0x14006cd98], eax
jle 0x140004a9b
lea rcx, [0x14006cd98]
call fcn.140059450
cmp dword [0x14006cd98], 0xffffffff
jne 0x140004a9b
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x14006cd98]
mov qword [0x14006cda8], rax
call fcn.1400593f0
mov rcx, qword [0x14006cda8]
lea rdx, str.SetThreadDpiAwarenessContext
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140004ac2
mov rcx, 0xfffffffffffffffc
call rax
jmp 0x140004b47
mov edx, 3
lea ecx, [rdx + 3]
call fcn.140047220
test eax, eax
je 0x140004b41
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rbx + rcx]
cmp dword [0x14006cda0], eax
jle 0x140004b1f
lea rcx, [0x14006cda0]
call fcn.140059450
cmp dword [0x14006cda0], 0xffffffff
jne 0x140004b1f
lea rcx, str.shcore.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x14006cda0]
mov qword [0x14006cd88], rax
call fcn.1400593f0
mov rcx, qword [0x14006cd88]
lea rdx, str.SetProcessDpiAwareness
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140004b41
mov ecx, 2
call rax
jmp 0x140004b47
call qword [sym.imp.USER32.dll_SetProcessDPIAware]
lea rax, [0x140005740]
mov dword [rbp + 0x560], 0x50
xor ecx, ecx
mov qword [rbp + 0x568], rax
mov dword [rbp + 0x564], 0x40
mov qword [rbp + 0x570], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xorps xmm0, xmm0
mov qword [rbp + 0x5a8], r14
mov qword [rbp + 0x578], rax
lea rcx, [rbp + 0x560]
lea rax, str.ImGui
movdqa xmmword [rbp + 0x580], xmm0
xorps xmm1, xmm1
mov qword [rbp + 0x5a0], rax
movdqa xmmword [rbp + 0x590], xmm1
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov rax, qword [rbp + 0x578]
lea r8, str.ImGui_DirectX11
mov rdx, qword [rbp + 0x5a0]
mov edi, 1
mov qword [rsp + 0x58], r14
mov r9d, 0x80000000
mov qword [rsp + 0x50], rax
xor ecx, ecx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov edx, 0x7f00
mov dword [0x14006c9d0], 0x210
xor ecx, ecx
mov qword [rbp - 0x70], rax
mov r15, rax
mov qword [0x14006c9d8], rax
mov dword [0x14006c9e0], edi
mov dword [0x14006c9e4], 7
mov dword [0x14006c9e8], 0x400
call qword [sym.imp.USER32.dll_LoadIconA]
lea r8, str.firexi
mov qword [0x14006c9f0], rax
lea edx, [rdi + 0x7f]
lea rcx, [0x14006c9f8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea rax, [rbp + 0x5b0]
mov qword [rbp + 0x524], r14
lea rbx, [0x14006cd38]
mov qword [rbp + 0x538], 2
mov qword [rsp + 0x58], rbx
lea r14, [0x14006cd30]
mov qword [rsp + 0x50], rax
xor r9d, r9d
mov qword [rsp + 0x48], r14
lea rax, [0x14006cd28]
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x510]
mov qword [rbp + 0x550], 2
mov qword [rsp + 0x38], rax
mov edx, edi
mov dword [rsp + 0x30], 7
lea rax, [rbp + 0x500]
mov dword [rsp + 0x28], 2
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x510], 0
mov dword [rbp + 0x520], 0x1c
mov dword [rbp + 0x518], 0x3c
mov dword [rbp + 0x51c], edi
mov dword [rbp + 0x534], 0x20
mov qword [rbp + 0x540], r15
mov qword [rbp + 0x52c], rdi
mov qword [rbp + 0x548], rdi
mov dword [rbp + 0x500], 0xb000
mov dword [rbp + 0x504], 0xa000
call qword [sym.imp.d3d11.dll_D3D11CreateDeviceAndSwapChain]
cmp eax, 0x887a0004
jne 0x140004da5
mov qword [rsp + 0x58], rbx
lea rax, [rbp + 0x5b0]
mov qword [rsp + 0x50], rax
lea edx, [rdi + 4]
mov qword [rsp + 0x48], r14
lea rax, [0x14006cd28]
mov qword [rsp + 0x40], rax
xor r9d, r9d
lea rax, [rbp + 0x510]
xor r8d, r8d
mov qword [rsp + 0x38], rax
xor ecx, ecx
mov dword [rsp + 0x30], 7
lea rax, [rbp + 0x500]
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], rax
call qword [sym.imp.d3d11.dll_D3D11CreateDeviceAndSwapChain]
test eax, eax
je 0x140004deb
call fcn.140005650
mov rdx, qword [rbp + 0x578]
mov rcx, qword [rbp + 0x5a0]
call qword [sym.imp.USER32.dll_UnregisterClassW]
lea rcx, [rbp + 0x5b8]
call fcn.140005df0
cmp dword [rbp + 0x5e0], 0
jne 0x140004de4
cmp dword [rbp + 0x5f0], 0
je 0x1400055e3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
movaps xmmword [rsp + 0x9d0], xmm6
movaps xmmword [rsp + 0x9c0], xmm7
movaps xmmword [rsp + 0x9b0], xmm8
movaps xmmword [rsp + 0x9a0], xmm9
movaps xmmword [rsp + 0x990], xmm10
movaps xmmword [rsp + 0x980], xmm11
movaps xmmword [rsp + 0x970], xmm12
movaps xmmword [rsp + 0x960], xmm13
call fcn.1400056d0
xor edx, edx
mov rcx, r15
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, r15
call qword [sym.imp.USER32.dll_UpdateWindow]
call fcn.14000bde0
call fcn.14000e1c0
xor ecx, ecx
mov r14, rax
or dword [rax], 0x401
mov qword [rax + 0x18], 0
call fcn.1400396c0
call fcn.140009a90
test dword [r14], 0x400
mov rdx, rax
movss xmm7, dword [0x1400629f4]
je 0x140004f9a
movss xmm6, dword [0x1400629a4]
lea rcx, [rbp + 0x500]
movaps xmm2, xmm6
mov dword [rax + 0x10], 0
movaps xmm1, xmm6
mov dword [rax + 0x114], 0x3f800000
call fcn.140001950
movss xmm5, dword [0x140062988]
lea rcx, [rbp - 0x50]
movss xmm4, dword [0x1400629e0]
movaps xmm3, xmm5
movsd xmm0, qword [rbp + 0x500]
movaps xmm2, xmm5
movaps xmm1, xmm4
movss dword [rsp + 0x20], xmm7
movsd qword [rdx + 0x20], xmm0
mov dword [rdx + 0x18], 0x43480000
mov dword [rdx + 0x3c], 0x41700000
mov dword [rdx + 0x44], 0x3f800000
mov dword [rdx + 0x50], 0x40400000
call fcn.140001960
movss xmm1, dword [0x1400629b0]
lea rcx, [rbp - 0x50]
movss dword [rsp + 0x20], xmm1
movaps xmm1, xmm4
movups xmm0, xmmword [rax]
movups xmmword [rdx + 0x198], xmm0
call fcn.140001960
movss xmm1, dword [0x1400629d0]
lea rcx, [rbp - 0x50]
movss dword [rsp + 0x20], xmm1
movaps xmm1, xmm4
movups xmm0, xmmword [rax]
movups xmmword [rdx + 0x238], xmm0
call fcn.140001960
lea rcx, [rbp - 0x50]
movss dword [rsp + 0x20], xmm7
movups xmm0, xmmword [rax]
movups xmmword [rdx + 0x248], xmm0
call fcn.140001960
movss xmm2, dword [0x140062998]
lea rcx, [rbp - 0x50]
movss dword [rsp + 0x20], xmm2
movaps xmm3, xmm6
movaps xmm2, xmm6
movaps xmm1, xmm6
movups xmm0, xmmword [rax]
movups xmmword [rdx + 0x258], xmm0
call fcn.140001960
movups xmm0, xmmword [rax]
movups xmmword [rdx + 0x3f8], xmm0
mov rcx, r15
call fcn.140044e80
call fcn.140044420
movss xmm2, dword [0x140062a50]
mov rcx, qword [r14 + 0x30]
call fcn.14003e0e0
movss xmm9, dword [0x1400629bc]
xor bl, bl
movss xmm13, dword [0x1400629e4]
movss xmm10, dword [0x140062a20]
movss xmm8, dword [0x140062978]
movss xmm6, dword [0x140062968]
movss xmm11, dword [0x140062abc]
movss xmm12, dword [0x140062a74]
mov r12, qword [rbp + 0x18]
mov r15, qword [rbp - 0x30]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor r8d, r8d
lea rcx, [rbp + 0x510]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140005078
mov r15d, 1
lea rcx, [rbp + 0x510]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x510]
call qword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [rbp + 0x518], 0x12
lea rcx, [rbp + 0x510]
movzx ebx, bl
cmove ebx, r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x140005023
mov r15, qword [rbp - 0x30]
test bl, bl
jne 0x140005421
lea edi, [rax + 1]
call fcn.140044790
call fcn.140045c40
call fcn.14000f0d0
cmp byte [0x14006c04d], 0
je 0x1400053c6
xorps xmm3, xmm3
movss dword [rsp + 0x20], xmm7
xorps xmm2, xmm2
lea rcx, [rbp + 0x40]
xorps xmm1, xmm1
call fcn.140001960
lea rdx, [rbp + 0x40]
xor ecx, ecx
call fcn.140009b60
movaps xmm3, xmm7
movss dword [rsp + 0x20], xmm9
movaps xmm2, xmm7
lea rcx, [rbp + 0x58]
movaps xmm1, xmm7
call fcn.140001960
lea rdx, [rbp + 0x58]
mov ecx, 0x16
call fcn.140009b60
movaps xmm3, xmm7
movss dword [rsp + 0x20], xmm13
movaps xmm2, xmm7
lea rcx, [rbp + 0x20]
movaps xmm1, xmm7
call fcn.140001960
lea rdx, [rbp + 0x20]
mov ecx, 0x17
call fcn.140009b60
movaps xmm2, xmm10
lea rcx, [rbp + 0x500]
movaps xmm1, xmm10
call fcn.140001950
lea rdx, [rbp + 0x500]
mov ecx, 0xb
call fcn.140009c20
mov r8d, 0x22
lea rdx, [0x14006c060]
lea rcx, str.firexi_v0.7
call fcn.140015650
mov ecx, 3
call fcn.140009bc0
mov ecx, edi
call fcn.140009cb0
cmp byte [0x14006c060], 0
movzx ebx, bl
cmove ebx, edi
cmp qword [rbp - 0x20], 0
je 0x1400051b7
lea rax, str._.2fm
movaps xmm3, xmm8
movaps xmm2, xmm6
mov qword [rsp + 0x20], rax
lea rdx, [0x14006c048]
lea rcx, str.REACH
call fcn.14004e7a0
test al, al
je 0x1400051c3
mov rdx, qword [rbp]
lea r8, [0x14006c048]
mov r9d, 4
mov qword [rsp + 0x20], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x1400051c3
lea rcx, str.Error:_Reach_failed_to_inject
call fcn.14004a310
mov rdi, qword [rbp + 0x38]
test rdi, rdi
je 0x140005230
lea rax, str._.2fx
movaps xmm3, xmm8
movaps xmm2, xmm6
mov qword [rsp + 0x20], rax
lea rdx, [0x14006c054]
lea rcx, str.TIMER
call fcn.14004e7a0
test al, al
je 0x14000523c
movss xmm0, dword [0x14006c054]
lea r8, [rbp + 0x5b0]
mov rdx, qword [rbp + 0x10]
mov r9d, 4
mulss xmm0, xmm14
mov rcx, rsi
mov qword [rsp + 0x20], 0
movss dword [rbp + 0x5b0], xmm0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x14000523c
lea rcx, str.Error:_Timer_failed_to_inject
call fcn.14004a310
test r13, r13
je 0x140005307
lea rax, str._.1f__
movaps xmm3, xmm7
movaps xmm2, xmm8
mov qword [rsp + 0x20], rax
lea rdx, [0x14006c05c]
lea rcx, str.LINEAR
call fcn.14004e7a0
test al, al
je 0x1400052a5
movss xmm0, dword [0x14006c05c]
lea r8, [0x14006c050]
mulss xmm0, xmm6
mov r9d, 4
mov rdx, r12
mov qword [rsp + 0x20], 0
mov rcx, rsi
movss dword [0x14006c050], xmm0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, str._.1f__
movaps xmm3, xmm7
movaps xmm2, xmm8
mov qword [rsp + 0x20], rax
lea rdx, [0x14006c058]
lea rcx, str.HEIGHT
call fcn.14004e7a0
test al, al
je 0x140005313
movss xmm0, dword [0x14006c058]
lea r8, [0x14006c044]
mulss xmm0, xmm6
mov r9d, 4
mov rdx, r15
mov qword [rsp + 0x20], 0
mov rcx, rsi
movss dword [0x14006c044], xmm0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x140005313
lea rcx, str.Error:_Velocity_failed_to_inject
call fcn.14004a310
cmp qword [rbp - 0x20], 0
je 0x140005324
test rdi, rdi
je 0x140005324
test r13, r13
jne 0x14000534e
xorps xmm3, xmm3
movss dword [rsp + 0x20], xmm9
movaps xmm2, xmm9
lea rcx, [rbp - 0x50]
movaps xmm1, xmm7
call fcn.140001960
lea rdx, str.Try_restarting_the_game_._._.
lea rcx, [rbp - 0x50]
call fcn.14004a260
xorps xmm2, xmm2
lea rcx, [rbp + 0x70]
movaps xmm1, xmm10
call fcn.140001950
lea rdx, [rbp + 0x70]
mov ecx, 0xe
call fcn.140009c20
call fcn.14004c110
test al, al
je 0x140005384
lea rdx, [0x14006c9d0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
xor ecx, ecx
call fcn.14000dc80
test al, al
je 0x14000539b
lea rcx, str.Minimize_to_system_tray
call fcn.14001cfe0
movaps xmm1, xmm11
xorps xmm0, xmm0
call fcn.14001be70
movaps xmm0, xmm12
call fcn.14001bf20
call fcn.14004e820
mov edi, 1
mov ecx, edi
call fcn.140009cb0
call fcn.140018530
call fcn.1400116b0
mov rcx, qword [0x14006cd38]
lea r8, [0x14006cd20]
xor r9d, r9d
mov edx, edi
mov rax, qword [rcx]
call qword [rax + 0x108]
call fcn.14000e1d0
mov rcx, rax
call fcn.140043140
test dword [r14], 0x400
je 0x140005407
call fcn.140025950
call fcn.140025cd0
mov rcx, qword [0x14006cd28]
xor r8d, r8d
mov edx, edi
mov rax, qword [rcx]
call qword [rax + 0x40]
test bl, bl
je 0x140005000
call fcn.140044650
call fcn.140044e90
call fcn.14000bec0
call fcn.140005650
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0x578]
mov rcx, qword [rbp + 0x5a0]
call qword [sym.imp.USER32.dll_UnregisterClassW]
cmp qword [rbp - 0x20], 0
movaps xmm13, xmmword [rsp + 0x960]
movaps xmm12, xmmword [rsp + 0x970]
movaps xmm11, xmmword [rsp + 0x980]
movaps xmm10, xmmword [rsp + 0x990]
movaps xmm9, xmmword [rsp + 0x9a0]
movaps xmm8, xmmword [rsp + 0x9b0]
movaps xmm7, xmmword [rsp + 0x9c0]
movaps xmm6, xmmword [rsp + 0x9d0]
mov r12, qword [rbp - 0x18]
je 0x1400054f2
lea rdx, [0x14006cc60]
lea rcx, [rbp + 0x510]
call fcn.140001a80
mov rdx, qword [rbp - 0x10]
mov r8, rax
mov rcx, rsi
call fcn.140002d30
mov rdx, qword [rbp - 8]
mov r9d, 0x8000
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, qword [rbp]
mov r9d, 0x8000
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
cmp qword [rbp + 0x38], 0
je 0x140005547
lea rdx, [0x14006cc78]
lea rcx, [rbp + 0x510]
call fcn.140001a80
mov rdx, qword [rbp - 0x38]
mov r8, rax
mov rcx, rsi
call fcn.140002d30
mov rdx, qword [rbp + 8]
mov r9d, 0x8000
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, qword [rbp + 0x10]
mov r9d, 0x8000
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test r13, r13
je 0x1400055af
lea rdx, [0x14006ccf0]
lea rcx, [rbp + 0x510]
call fcn.140001a80
mov rdx, qword [rbp - 0x28]
mov r8, rax
mov rcx, rsi
call fcn.140002d30
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, qword [rbp + 0x18]
mov r9d, 0x8000
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, qword [rbp - 0x30]
mov r9d, 0x8000
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 6
mov dword [rbp + 0x5e0], r14d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rbp + 0x5f0], r14d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov edi, 1
mov eax, edi
mov rcx, qword [rbp + 0x840]
xor rcx, rsp
call fcn.140058ed0
lea r11, [rsp + 0x9e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm14, xmmword [r11 - 0x90]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001850
int3
call fcn.140005f10
int3
call fcn.140001850
int3
call fcn.140005f10
int3
call fcn.140001850
int3
call fcn.140005f10
int3