Function at 0x140003010
Capabilities:
Execute command
Query or enumerate registry value
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x490
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rsp + 0x480], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 0xfffffff0
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov edx, 0xfffffff0
mov rcx, rbx
btr eax, 0x10
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongW]
xor ebp, ebp
mov dword [rsp + 0x30], 0x27
mov dword [rsp + 0x28], ebp
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], ebp
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rsi, 0xffffffffffffffff
mov dword [rsp + 0x28], ebp
mov r9d, esi
mov qword [rsp + 0x20], rbp
lea r8, str.SNAILYT_BGMI_FIXER
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
mov eax, 2
mul rdi
cmovb rax, rsi
mov rcx, rax
call fcn.140003bc0
mov r9d, esi
mov dword [rsp + 0x28], edi
lea r8, str.SNAILYT_BGMI_FIXER
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov rcx, rbx
call fcn.140003b8c
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
lea rdx, [rsp + 0x68]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r8d, dword [rsp + 0x6c]
mov r9d, 0x26c
mov edx, dword [rsp + 0x68]
mov rcx, rbx
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x190
call qword [sym.imp.USER32.dll_MoveWindow]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rsp + 0x50]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ecx, word [rsp + 0x5e]
sub cx, word [rsp + 0x5a]
inc cx
mov word [rsp + 0x48], cx
movzx ecx, word [rsp + 0x60]
sub cx, word [rsp + 0x5c]
inc cx
mov word [rsp + 0x4a], cx
mov rcx, rbx
mov edx, dword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
test rax, rax
je 0x1400031d9
mov edx, 0xfffffff0
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov edx, 0xfffffff0
mov rcx, rbx
and eax, 0xfffaffff
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov dword [rsp + 0x30], 0x23
xor r9d, r9d
mov dword [rsp + 0x28], ebp
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], ebp
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowPos]
lea rcx, [0x1400054d8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.___________________________________STOPPING..
call fcn.1400012b0
mov rcx, rax
call fcn.140001490
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameSNAILYT__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400054d8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWARESnailytBGMI_
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400032d0
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea r8, str.EmulatorPath
lea rax, [rsp + 0x80]
mov dword [rsp + 0x48], 0x400
mov qword [rsp + 0x28], rax
mov r9d, 2
xor edx, edx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1400032d0
nop dword [rax]
call fcn.140002990
call fcn.1400024d0
jmp 0x1400032c0
call fcn.1400024d0
call fcn.140002990
jmp 0x1400032d0