-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathsdk.cpp
1883 lines (1706 loc) · 71 KB
/
sdk.cpp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#include "stdafx.h"
#include "sdk.h"
#include "xor.hpp"
#include "lazyimporter.h"
#include "memory.h"
#include <map>
#include "defs.h"
#include "globals.h"
namespace process
{
HWND hwnd;
BOOL CALLBACK EnumWindowCallBack(HWND hWnd, LPARAM lParam)
{
DWORD dwPid = 0;
GetWindowThreadProcessId(hWnd, &dwPid);
if (dwPid == lParam)
{
hwnd = hWnd;
return FALSE;
}
return TRUE;
}
HWND get_process_window()
{
if (hwnd)
return hwnd;
EnumWindows(EnumWindowCallBack, GetCurrentProcessId());
if (hwnd == NULL)
Exit();
return hwnd;
}
}
namespace g_data
{
uintptr_t base;
uintptr_t peb;
HWND hWind;
uintptr_t visible_base;
void init()
{
base = (uintptr_t)(iat(GetModuleHandleA).get()("ModernWarfare.exe"));
hWind = process::get_process_window();
peb = __readgsqword(0x60);
}
}
namespace sdk
{
const DWORD nTickTime = 64;//64 ms
bool bUpdateTick = false;
std::map<DWORD, velocityInfo_t> velocityMap;
uint64_t current_visible_offset;
uint64_t last_visible_offset;
uint64_t cached_visible_base;
uintptr_t _get_player(int i)
{
auto cl_info_base = get_client_info_base();
if (is_bad_ptr(cl_info_base))return 0;
auto base_address = *(uintptr_t*)(cl_info_base);
if (is_bad_ptr(base_address))return 0;
return sdk::get_client_info_base() + (i * player_info::size);
}
bool in_game()
{
auto gameMode = *(int*)(g_data::base + game_mode);
return gameMode > 4;
}
int get_game_mode()
{
return *(int*)(g_data::base + game_mode + 0x4);
}
int get_max_player_count()
{
return *(int*)(g_data::base + game_mode);
}
Vector3 _get_pos(uintptr_t address)
{
auto local_pos_ptr = *(uintptr_t*)((uintptr_t)address + player_info::position_ptr);
if (local_pos_ptr)
{
return *(Vector3*)(local_pos_ptr + 0x40);
}
return Vector3{};
}
uint32_t _get_index(uintptr_t address)
{
auto cl_info_base = get_client_info_base();
if (is_bad_ptr(cl_info_base))return 0;
return ((uintptr_t)address - cl_info_base) / player_info::size;
}
int _team_id(uintptr_t address) {
return *(int*)((uintptr_t)address + player_info::team_id);
}
int decrypt_visible_flag(int i, QWORD valid_list)
{
auto ptr = valid_list + ((i + i * 8) * 8) + 0xA83; //80 BF ? ? ? ? ? 74 20 80 BF ? ? ? ? ? 74 17
DWORD dw1 = (*(DWORD*)(ptr + 4) ^ (DWORD)ptr);
DWORD dw2 = ((dw1 + 2) * dw1);
BYTE dec_visible_flag = *(BYTE*)(ptr) ^ BYTE1(dw2) ^ (BYTE)dw2;
return (int)dec_visible_flag;
}
bool _is_visible(uintptr_t address)
{
if (IsValidPtr<uintptr_t>(&g_data::visible_base))
{
uint64_t VisibleList = *(uint64_t*)(g_data::visible_base + 0x108);
if (is_bad_ptr( VisibleList))
return false;
uint64_t rdx = VisibleList + (_get_index(address) * 9 + 0x14E) * 8;
if (is_bad_ptr(rdx))
return false;
DWORD VisibleFlags = (rdx + 0x10) ^ (*(DWORD*)(rdx + 0x14));
if (is_bad_ptr(VisibleFlags))
return false;
DWORD v511 = VisibleFlags * (VisibleFlags + 2);
if (!v511)
return false;
BYTE VisibleFlags1 = *(DWORD*)(rdx + 0x10) ^ v511 ^ BYTE1(v511);
if (VisibleFlags1 == 3) {
return true;
}
}
return false;
}
uint64_t get_client_info()
{
auto baseModuleAddr = g_data::base;
auto Peb = __readgsqword(0x60);
uint64_t rax = baseModuleAddr, rbx = baseModuleAddr, rcx = baseModuleAddr, rdx = baseModuleAddr, rdi = baseModuleAddr, rsi = baseModuleAddr, r8 = baseModuleAddr, r9 = baseModuleAddr, r10 = baseModuleAddr, r11 = baseModuleAddr, r12 = baseModuleAddr, r13 = baseModuleAddr, r14 = baseModuleAddr, r15 = baseModuleAddr;
rbx = *(uint64_t*)(baseModuleAddr + 0x1E910518);
if (!rbx)
return rbx;
rdx = Peb; //mov rdx, gs:[rax]
rax = 0; //and rax, 0xFFFFFFFFC0000000
rax = _rotl64(rax, 0x10); //rol rax, 0x10
rax ^= *(uint64_t*)(baseModuleAddr + 0x71510ED); //xor rax, [0x0000000004ED7491]
rax = _byteswap_uint64(rax); //bswap rax
rbx *= *(uint64_t*)(rax + 0xb); //imul rbx, [rax+0x0B]
rbx += rdx; //add rbx, rdx
rax = rbx; //mov rax, rbx
rcx = rbx; //mov rcx, rbx
rax >>= 0xB; //shr rax, 0x0B
rbx = rdx; //mov rbx, rdx
rcx ^= rax; //xor rcx, rax
rax = rcx; //mov rax, rcx
rax >>= 0x16; //shr rax, 0x16
rcx ^= rax; //xor rcx, rax
rax = baseModuleAddr + 0x5FE0; //lea rax, [0xFFFFFFFFFDD8C358]
rbx *= rax; //imul rbx, rax
rax = rcx; //mov rax, rcx
rax >>= 0x2C; //shr rax, 0x2C
rbx ^= rax; //xor rbx, rax
rax = 0xC4138E51387F1EA1; //mov rax, 0xC4138E51387F1EA1
rbx ^= rcx; //xor rbx, rcx
rbx *= rax; //imul rbx, rax
rax = 0x42D230AEBD9F3922; //mov rax, 0x42D230AEBD9F3922
rbx ^= rax; //xor rbx, rax
return rbx;
}
uint64_t get_client_info_base()
{
auto baseModuleAddr = g_data::base;
auto Peb = __readgsqword(0x60);
uint64_t rax = baseModuleAddr, rbx = baseModuleAddr, rcx = baseModuleAddr, rdx = baseModuleAddr, rdi = baseModuleAddr, rsi = baseModuleAddr, r8 = baseModuleAddr, r9 = baseModuleAddr, r10 = baseModuleAddr, r11 = baseModuleAddr, r12 = baseModuleAddr, r13 = baseModuleAddr, r14 = baseModuleAddr, r15 = baseModuleAddr;
rax = *(uint64_t*)(get_client_info() + 0xae308);
if (!rax)
return rax;
rdi = Peb; //mov rdi, gs:[rcx]
rcx = rdi; //mov rcx, rdi
rcx = _rotl64(rcx, 0x22); //rol rcx, 0x22
rcx &= 0xF;
switch (rcx) {
case 0:
{
rbx = baseModuleAddr; //lea rbx, [0xFFFFFFFFFDD862D9]
r10 = *(uint64_t*)(baseModuleAddr + 0x7151139); //mov r10, [0x0000000004ED7392]
rcx = rax; //mov rcx, rax
rcx >>= 0x2; //shr rcx, 0x02
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x4; //shr rcx, 0x04
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x8; //shr rcx, 0x08
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x10; //shr rcx, 0x10
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x20; //shr rcx, 0x20
rax ^= rcx; //xor rax, rcx
rcx = 0x3614DC28B2B4B103; //mov rcx, 0x3614DC28B2B4B103
rax *= rcx; //imul rax, rcx
rcx = baseModuleAddr + 0x6965; //lea rcx, [0xFFFFFFFFFDD8C9C8]
rax += rdi; //add rax, rdi
rax += rcx; //add rax, rcx
rcx = 0; //and rcx, 0xFFFFFFFFC0000000
rcx = _rotl64(rcx, 0x10); //rol rcx, 0x10
rcx ^= r10; //xor rcx, r10
rcx = ~rcx; //not rcx
rax *= *(uint64_t*)(rcx + 0x9); //imul rax, [rcx+0x09]
rcx = rax; //mov rcx, rax
rcx >>= 0x26; //shr rcx, 0x26
rax ^= rcx; //xor rax, rcx
rcx = 0xC0E9608E29382049; //mov rcx, 0xC0E9608E29382049
rax *= rcx; //imul rax, rcx
rax += rbx; //add rax, rbx
rcx = 0x8620C22020E040C1; //mov rcx, 0x8620C22020E040C1
rax ^= rcx; //xor rax, rcx
return rax;
}
case 1:
{
rbx = baseModuleAddr; //lea rbx, [0xFFFFFFFFFDD85D06]
r9 = *(uint64_t*)(baseModuleAddr + 0x7151139); //mov r9, [0x0000000004ED6DDE]
rax += rdi; //add rax, rdi
rcx = 0xCB4523AB3671CB5B; //mov rcx, 0xCB4523AB3671CB5B
rax *= rcx; //imul rax, rcx
rax += rbx; //add rax, rbx
rcx = rax; //mov rcx, rax
rcx >>= 0x26; //shr rcx, 0x26
rax ^= rcx; //xor rax, rcx
rcx = 0x5CC5BC52843E5AF; //mov rcx, 0x5CC5BC52843E5AF
rax *= rcx; //imul rax, rcx
r11 = 0x4B971A0A30E5AC0; //mov r11, 0x4B971A0A30E5AC0
rax += r11; //add rax, r11
rcx = 0; //and rcx, 0xFFFFFFFFC0000000
rcx = _rotl64(rcx, 0x10); //rol rcx, 0x10
rcx ^= r9; //xor rcx, r9
rcx = ~rcx; //not rcx
rax *= *(uint64_t*)(rcx + 0x9); //imul rax, [rcx+0x09]
rcx = rdi; //mov rcx, rdi
rcx = ~rcx; //not rcx
rax += rcx; //add rax, rcx
rax -= rbx; //sub rax, rbx
rax -= 0x2BD942E4; //sub rax, 0x2BD942E4
return rax;
}
case 2:
{
r10 = *(uint64_t*)(baseModuleAddr + 0x7151139); //mov r10, [0x0000000004ED6A75]
rbx = baseModuleAddr; //lea rbx, [0xFFFFFFFFFDD8592A]
rdx = baseModuleAddr + 0x42E99BA4; //lea rdx, [0x0000000040C1F477]
rcx = rdi; //mov rcx, rdi
rcx = ~rcx; //not rcx
rcx ^= rax; //xor rcx, rax
rax = baseModuleAddr + 0x1BCD6F2F; //lea rax, [0x0000000019A5C511]
rcx ^= rax; //xor rcx, rax
rax = rdi; //mov rax, rdi
rax ^= rdx; //xor rax, rdx
rcx += rax; //add rcx, rax
rax = rdi + 0xffffffffffff6769; //lea rax, [rdi-0x9897]
rcx -= rbx; //sub rcx, rbx
rax += rcx; //add rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x20; //shr rcx, 0x20
rax ^= rcx; //xor rax, rcx
rcx = 0xA8C9167DC25FE0F; //mov rcx, 0xA8C9167DC25FE0F
rax *= rcx; //imul rax, rcx
rcx = 0x415794CE48E83B12; //mov rcx, 0x415794CE48E83B12
rax += rcx; //add rax, rcx
r11 = 0x38D8DF6FD893701F; //mov r11, 0x38D8DF6FD893701F
rax += r11; //add rax, r11
rcx = 0; //and rcx, 0xFFFFFFFFC0000000
rcx = _rotl64(rcx, 0x10); //rol rcx, 0x10
rcx ^= r10; //xor rcx, r10
rcx = ~rcx; //not rcx
rax *= *(uint64_t*)(rcx + 0x9); //imul rax, [rcx+0x09]
return rax;
}
case 3:
{
rbx = baseModuleAddr; //lea rbx, [0xFFFFFFFFFDD85506]
r9 = *(uint64_t*)(baseModuleAddr + 0x7151139); //mov r9, [0x0000000004ED65DA]
rcx = rax; //mov rcx, rax
rcx >>= 0x1C; //shr rcx, 0x1C
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x38; //shr rcx, 0x38
rax ^= rcx; //xor rax, rcx
rax += rbx; //add rax, rbx
rcx = rbx + 0x72d5b242; //lea rcx, [rbx+0x72D5B242]
rcx += rdi; //add rcx, rdi
rax ^= rcx; //xor rax, rcx
rax ^= rdi; //xor rax, rdi
rcx = 0x4730EC87E12C22C; //mov rcx, 0x4730EC87E12C22C
rax ^= rcx; //xor rax, rcx
rcx = 0x32B4C91E2D57D988; //mov rcx, 0x32B4C91E2D57D988
rax += rcx; //add rax, rcx
rcx = 0xFB6F374D513999ED; //mov rcx, 0xFB6F374D513999ED
rax *= rcx; //imul rax, rcx
rcx = 0; //and rcx, 0xFFFFFFFFC0000000
rcx = _rotl64(rcx, 0x10); //rol rcx, 0x10
rcx ^= r9; //xor rcx, r9
rcx = ~rcx; //not rcx
rax *= *(uint64_t*)(rcx + 0x9); //imul rax, [rcx+0x09]
return rax;
}
case 4:
{
r10 = *(uint64_t*)(baseModuleAddr + 0x7151139); //mov r10, [0x0000000004ED612C]
rbx = baseModuleAddr; //lea rbx, [0xFFFFFFFFFDD84FEC]
rax += rbx; //add rax, rbx
rcx = 0xE8E1551BD670F715; //mov rcx, 0xE8E1551BD670F715
rax *= rcx; //imul rax, rcx
rcx = 0x1DAD297E91C0E8AE; //mov rcx, 0x1DAD297E91C0E8AE
rax -= rcx; //sub rax, rcx
rcx = rdi; //mov rcx, rdi
rcx -= rbx; //sub rcx, rbx
rcx += 0xFFFFFFFF81A79BB7; //add rcx, 0xFFFFFFFF81A79BB7
rax += rcx; //add rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x25; //shr rcx, 0x25
rax ^= rcx; //xor rax, rcx
rcx = 0; //and rcx, 0xFFFFFFFFC0000000
rcx = _rotl64(rcx, 0x10); //rol rcx, 0x10
rcx ^= r10; //xor rcx, r10
rcx = ~rcx; //not rcx
rax *= *(uint64_t*)(rcx + 0x9); //imul rax, [rcx+0x09]
rcx = 0x87FB17E76E4325C5; //mov rcx, 0x87FB17E76E4325C5
rax += rcx; //add rax, rcx
rax += rbx; //add rax, rbx
return rax;
}
case 5:
{
rbx = baseModuleAddr; //lea rbx, [0xFFFFFFFFFDD84AFC]
rdx = *(uint64_t*)(baseModuleAddr + 0x7151139); //mov rdx, [0x0000000004ED5BD9]
rcx = 0x43A6F57288B545E2; //mov rcx, 0x43A6F57288B545E2
rax += rcx; //add rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x16; //shr rcx, 0x16
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x2C; //shr rcx, 0x2C
rax ^= rcx; //xor rax, rcx
rax -= rdi; //sub rax, rdi
rcx = baseModuleAddr + 0x415C4D63; //lea rcx, [0x000000003F349464]
rcx -= rdi; //sub rcx, rdi
rax ^= rcx; //xor rax, rcx
rcx = 0xDAA0ABF4F2176CF9; //mov rcx, 0xDAA0ABF4F2176CF9
rax *= rcx; //imul rax, rcx
rax -= rbx; //sub rax, rbx
uintptr_t RSP_0xFFFFFFFFFFFFFF80;
RSP_0xFFFFFFFFFFFFFF80 = 0x5660AE0D8FE019D3; //mov rcx, 0x5660AE0D8FE019D3 : RBP+0xFFFFFFFFFFFFFF80
rax += RSP_0xFFFFFFFFFFFFFF80; //add rax, [rbp-0x80]
rcx = 0; //and rcx, 0xFFFFFFFFC0000000
rcx = _rotl64(rcx, 0x10); //rol rcx, 0x10
rcx ^= rdx; //xor rcx, rdx
rcx = ~rcx; //not rcx
rax *= *(uint64_t*)(rcx + 0x9); //imul rax, [rcx+0x09]
return rax;
}
case 6:
{
rbx = baseModuleAddr; //lea rbx, [0xFFFFFFFFFDD846CC]
r10 = *(uint64_t*)(baseModuleAddr + 0x7151139); //mov r10, [0x0000000004ED57A5]
rax -= rbx; //sub rax, rbx
uintptr_t RSP_0x68;
RSP_0x68 = 0xD581FA5F208D6FBB; //mov rcx, 0xD581FA5F208D6FBB : RSP+0x68
rax ^= RSP_0x68; //xor rax, [rsp+0x68]
rcx = 0; //and rcx, 0xFFFFFFFFC0000000
rcx = _rotl64(rcx, 0x10); //rol rcx, 0x10
rcx ^= r10; //xor rcx, r10
rcx = ~rcx; //not rcx
rax *= *(uint64_t*)(rcx + 0x9); //imul rax, [rcx+0x09]
rcx = 0x5098219BA5D3A99F; //mov rcx, 0x5098219BA5D3A99F
rax *= rcx; //imul rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x1E; //shr rcx, 0x1E
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x3C; //shr rcx, 0x3C
rax ^= rcx; //xor rax, rcx
rcx = 0x3A60D00674385E4B; //mov rcx, 0x3A60D00674385E4B
rax ^= rcx; //xor rax, rcx
rcx = rdi; //mov rcx, rdi
rcx = ~rcx; //not rcx
uintptr_t RSP_0xFFFFFFFFFFFFFF80;
RSP_0xFFFFFFFFFFFFFF80 = baseModuleAddr + 0x7946FC98; //lea rcx, [0x00000000771F4379] : RBP+0xFFFFFFFFFFFFFF80
rcx += RSP_0xFFFFFFFFFFFFFF80; //add rcx, [rbp-0x80]
rax ^= rcx; //xor rax, rcx
rax += rdi; //add rax, rdi
return rax;
}
case 7:
{
r10 = *(uint64_t*)(baseModuleAddr + 0x7151139); //mov r10, [0x0000000004ED537F]
rbx = baseModuleAddr; //lea rbx, [0xFFFFFFFFFDD8423F]
rax -= rbx; //sub rax, rbx
rcx = 0xCF11CC43A518562C; //mov rcx, 0xCF11CC43A518562C
rax ^= rcx; //xor rax, rcx
rcx = 0; //and rcx, 0xFFFFFFFFC0000000
rcx = _rotl64(rcx, 0x10); //rol rcx, 0x10
rcx ^= r10; //xor rcx, r10
rcx = ~rcx; //not rcx
rax *= *(uint64_t*)(rcx + 0x9); //imul rax, [rcx+0x09]
rcx = rax; //mov rcx, rax
rcx >>= 0x23; //shr rcx, 0x23
rax ^= rcx; //xor rax, rcx
rcx = rbx + 0x4444; //lea rcx, [rbx+0x4444]
rcx += rdi; //add rcx, rdi
rax ^= rcx; //xor rax, rcx
rcx = 0x7E57D567755F9808; //mov rcx, 0x7E57D567755F9808
rax ^= rcx; //xor rax, rcx
rcx = 0xA0F53D7EAD386BD7; //mov rcx, 0xA0F53D7EAD386BD7
rax *= rcx; //imul rax, rcx
rcx = rbx + 0x7ead; //lea rcx, [rbx+0x7EAD]
rcx += rdi; //add rcx, rdi
rax ^= rcx; //xor rax, rcx
return rax;
}
case 8:
{
r10 = *(uint64_t*)(baseModuleAddr + 0x7151139); //mov r10, [0x0000000004ED4EDE]
rcx = rax; //mov rcx, rax
rcx >>= 0xA; //shr rcx, 0x0A
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x14; //shr rcx, 0x14
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x28; //shr rcx, 0x28
rax ^= rcx; //xor rax, rcx
rcx = baseModuleAddr + 0xEF19; //lea rcx, [0xFFFFFFFFFDD92A16]
rdx = rdi; //mov rdx, rdi
rax += rcx; //add rax, rcx
rdx = ~rdx; //not rdx
rax += rdx; //add rax, rdx
rdx = baseModuleAddr + 0x8630; //lea rdx, [0xFFFFFFFFFDD8C334]
rcx = 0xE3E5140ADA297923; //mov rcx, 0xE3E5140ADA297923
rax ^= rcx; //xor rax, rcx
rcx = rdi; //mov rcx, rdi
rcx = ~rcx; //not rcx
rcx *= rdx; //imul rcx, rdx
rax += rcx; //add rax, rcx
rcx = 0; //and rcx, 0xFFFFFFFFC0000000
rcx = _rotl64(rcx, 0x10); //rol rcx, 0x10
rcx ^= r10; //xor rcx, r10
rcx = ~rcx; //not rcx
rcx = *(uint64_t*)(rcx + 0x9); //mov rcx, [rcx+0x09]
uintptr_t RSP_0xFFFFFFFFFFFFFF80;
RSP_0xFFFFFFFFFFFFFF80 = 0x4731D26EBE5B963F; //mov rcx, 0x4731D26EBE5B963F : RBP+0xFFFFFFFFFFFFFF80
rcx *= RSP_0xFFFFFFFFFFFFFF80; //imul rcx, [rbp-0x80]
rax *= rcx; //imul rax, rcx
rcx = 0x6F73924E5D00230B; //mov rcx, 0x6F73924E5D00230B
rax -= rcx; //sub rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x5; //shr rcx, 0x05
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0xA; //shr rcx, 0x0A
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x14; //shr rcx, 0x14
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x28; //shr rcx, 0x28
rax ^= rcx; //xor rax, rcx
return rax;
}
case 9:
{
rbx = baseModuleAddr; //lea rbx, [0xFFFFFFFFFDD837C8]
r11 = *(uint64_t*)(baseModuleAddr + 0x7151139); //mov r11, [0x0000000004ED48AF]
rcx = rax; //mov rcx, rax
rcx >>= 0xB; //shr rcx, 0x0B
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x16; //shr rcx, 0x16
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x2C; //shr rcx, 0x2C
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x2; //shr rcx, 0x02
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x4; //shr rcx, 0x04
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x8; //shr rcx, 0x08
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x10; //shr rcx, 0x10
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x20; //shr rcx, 0x20
rax ^= rcx; //xor rax, rcx
rdx = rax; //mov rdx, rax
rdx >>= 0x23; //shr rdx, 0x23
rdx ^= rax; //xor rdx, rax
r8 = 0; //and r8, 0xFFFFFFFFC0000000
r8 = _rotl64(r8, 0x10); //rol r8, 0x10
r8 ^= r11; //xor r8, r11
rax = 0xE068C563D16D8F05; //mov rax, 0xE068C563D16D8F05
rdx *= rax; //imul rdx, rax
rax = 0xE22A467A21B263F1; //mov rax, 0xE22A467A21B263F1
r8 = ~r8; //not r8
rcx = rbx; //mov rcx, rbx
rcx *= rax; //imul rcx, rax
rax = 0xA794251B31804DF7; //mov rax, 0xA794251B31804DF7
rax += rdx; //add rax, rdx
rax += rcx; //add rax, rcx
rax *= *(uint64_t*)(r8 + 0x9); //imul rax, [r8+0x09]
return rax;
}
case 10:
{
rbx = baseModuleAddr; //lea rbx, [0xFFFFFFFFFDD83351]
r11 = baseModuleAddr + 0x21BE859E; //lea r11, [0x000000001F96B8D7]
r9 = *(uint64_t*)(baseModuleAddr + 0x7151139); //mov r9, [0x0000000004ED441F]
rcx = rax; //mov rcx, rax
rcx >>= 0xA; //shr rcx, 0x0A
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x14; //shr rcx, 0x14
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x28; //shr rcx, 0x28
rax ^= rcx; //xor rax, rcx
rax -= rbx; //sub rax, rbx
rax -= rdi; //sub rax, rdi
rcx = 0x6A3FC3C778863DF1; //mov rcx, 0x6A3FC3C778863DF1
rax *= rcx; //imul rax, rcx
rcx = r11; //mov rcx, r11
rcx = ~rcx; //not rcx
rcx ^= rdi; //xor rcx, rdi
rax -= rcx; //sub rax, rcx
rcx = 0xF950B1E674466089; //mov rcx, 0xF950B1E674466089
rax ^= rcx; //xor rax, rcx
rax -= rbx; //sub rax, rbx
rcx = 0; //and rcx, 0xFFFFFFFFC0000000
rcx = _rotl64(rcx, 0x10); //rol rcx, 0x10
rcx ^= r9; //xor rcx, r9
rcx = ~rcx; //not rcx
rax *= *(uint64_t*)(rcx + 0x9); //imul rax, [rcx+0x09]
return rax;
}
case 11:
{
rbx = baseModuleAddr + 0xECD7; //lea rbx, [0xFFFFFFFFFDD91B73]
r10 = *(uint64_t*)(baseModuleAddr + 0x7151139); //mov r10, [0x0000000004ED3F73]
rcx = rbx; //mov rcx, rbx
rcx ^= rdi; //xor rcx, rdi
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x27; //shr rcx, 0x27
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x18; //shr rcx, 0x18
rax ^= rcx; //xor rax, rcx
rdx = 0; //and rdx, 0xFFFFFFFFC0000000
rcx = rax; //mov rcx, rax
rdx = _rotl64(rdx, 0x10); //rol rdx, 0x10
rdx ^= r10; //xor rdx, r10
rcx >>= 0x30; //shr rcx, 0x30
rax ^= rcx; //xor rax, rcx
rdx = ~rdx; //not rdx
rax *= *(uint64_t*)(rdx + 0x9); //imul rax, [rdx+0x09]
rcx = 0x60C7EC28E7999765; //mov rcx, 0x60C7EC28E7999765
rax *= rcx; //imul rax, rcx
rcx = 0x7376CF3E6CF9900C; //mov rcx, 0x7376CF3E6CF9900C
rax += rcx; //add rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x4; //shr rcx, 0x04
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x8; //shr rcx, 0x08
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x10; //shr rcx, 0x10
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x20; //shr rcx, 0x20
rax ^= rcx; //xor rax, rcx
rcx = 0xF4A897B8F6F79DBD; //mov rcx, 0xF4A897B8F6F79DBD
rax *= rcx; //imul rax, rcx
return rax;
}
case 12:
{
rbx = baseModuleAddr; //lea rbx, [0xFFFFFFFFFDD829D3]
r10 = *(uint64_t*)(baseModuleAddr + 0x7151139); //mov r10, [0x0000000004ED3AA3]
rcx = baseModuleAddr + 0x407F; //lea rcx, [0xFFFFFFFFFDD86588]
rcx = ~rcx; //not rcx
rcx += rdi; //add rcx, rdi
rax += rcx; //add rax, rcx
rcx = 0xD34834AD3FF6BC4; //mov rcx, 0xD34834AD3FF6BC4
rax ^= rcx; //xor rax, rcx
rcx = 0x564A48D6BFC062D7; //mov rcx, 0x564A48D6BFC062D7
rax *= rcx; //imul rax, rcx
rcx = 0x33DA61190ABBC492; //mov rcx, 0x33DA61190ABBC492
rax -= rcx; //sub rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x1F; //shr rcx, 0x1F
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x3E; //shr rcx, 0x3E
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0xC; //shr rcx, 0x0C
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x18; //shr rcx, 0x18
rax ^= rcx; //xor rax, rcx
rdx = 0; //and rdx, 0xFFFFFFFFC0000000
rdx = _rotl64(rdx, 0x10); //rol rdx, 0x10
rdx ^= r10; //xor rdx, r10
rcx = rax; //mov rcx, rax
rdx = ~rdx; //not rdx
rcx >>= 0x30; //shr rcx, 0x30
rax ^= rcx; //xor rax, rcx
rax *= *(uint64_t*)(rdx + 0x9); //imul rax, [rdx+0x09]
rax -= rbx; //sub rax, rbx
return rax;
}
case 13:
{
r11 = *(uint64_t*)(baseModuleAddr + 0x7151139); //mov r11, [0x0000000004ED35D2]
rbx = baseModuleAddr; //lea rbx, [0xFFFFFFFFFDD82492]
rdx = 0xA7EF47892BCE6574; //mov rdx, 0xA7EF47892BCE6574
rax ^= rbx; //xor rax, rbx
rcx = baseModuleAddr + 0x2C31; //lea rcx, [0xFFFFFFFFFDD84FC2]
rcx = ~rcx; //not rcx
rcx ^= rdi; //xor rcx, rdi
rcx += rdx; //add rcx, rdx
rax += rcx; //add rax, rcx
rcx = 0x118F0BC41931911C; //mov rcx, 0x118F0BC41931911C
rax += rcx; //add rax, rcx
rdx = rax; //mov rdx, rax
rdx >>= 0x27; //shr rdx, 0x27
rdx ^= rax; //xor rdx, rax
rax = rdi; //mov rax, rdi
rax = ~rax; //not rax
rax += rdx; //add rax, rdx
rax -= rbx; //sub rax, rbx
rcx = 0x512A06E5A89C89E3; //mov rcx, 0x512A06E5A89C89E3
r8 = 0; //and r8, 0xFFFFFFFFC0000000
rax *= rcx; //imul rax, rcx
r8 = _rotl64(r8, 0x10); //rol r8, 0x10
rcx = 0x2F5211956108A689; //mov rcx, 0x2F5211956108A689
r8 ^= r11; //xor r8, r11
rax -= rcx; //sub rax, rcx
r8 = ~r8; //not r8
rax *= *(uint64_t*)(r8 + 0x9); //imul rax, [r8+0x09]
return rax;
}
case 14:
{
r9 = *(uint64_t*)(baseModuleAddr + 0x7151139); //mov r9, [0x0000000004ED3237]
rcx = rax; //mov rcx, rax
rcx >>= 0x6; //shr rcx, 0x06
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0xC; //shr rcx, 0x0C
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x18; //shr rcx, 0x18
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x30; //shr rcx, 0x30
rax ^= rcx; //xor rax, rcx
rcx = 0x8F69920EB2B46367; //mov rcx, 0x8F69920EB2B46367
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x3; //shr rcx, 0x03
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x6; //shr rcx, 0x06
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0xC; //shr rcx, 0x0C
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x18; //shr rcx, 0x18
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x30; //shr rcx, 0x30
rax ^= rcx; //xor rax, rcx
rcx = 0x35833DAFED12173F; //mov rcx, 0x35833DAFED12173F
rax += rcx; //add rax, rcx
rax -= rdi; //sub rax, rdi
rcx = 0xB0007B38500FE4E7; //mov rcx, 0xB0007B38500FE4E7
rax *= rcx; //imul rax, rcx
rcx = 0; //and rcx, 0xFFFFFFFFC0000000
rcx = _rotl64(rcx, 0x10); //rol rcx, 0x10
rcx ^= r9; //xor rcx, r9
rcx = ~rcx; //not rcx
rax *= *(uint64_t*)(rcx + 0x9); //imul rax, [rcx+0x09]
rax -= rdi; //sub rax, rdi
return rax;
}
case 15:
{
r10 = *(uint64_t*)(baseModuleAddr + 0x7151139); //mov r10, [0x0000000004ED2D5A]
rbx = baseModuleAddr; //lea rbx, [0xFFFFFFFFFDD81C1A]
r12 = baseModuleAddr + 0x7481; //lea r12, [0xFFFFFFFFFDD89083]
rcx = rdi; //mov rcx, rdi
rcx = ~rcx; //not rcx
uintptr_t RSP_0xFFFFFFFFFFFFFFB8;
RSP_0xFFFFFFFFFFFFFFB8 = baseModuleAddr + 0x1610; //lea rcx, [0xFFFFFFFFFDD831EE] : RBP+0xFFFFFFFFFFFFFFB8
rcx ^= RSP_0xFFFFFFFFFFFFFFB8; //xor rcx, [rbp-0x48]
rax -= rcx; //sub rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x21; //shr rcx, 0x21
rax ^= rcx; //xor rax, rcx
rax ^= rbx; //xor rax, rbx
rcx = 0; //and rcx, 0xFFFFFFFFC0000000
rcx = _rotl64(rcx, 0x10); //rol rcx, 0x10
rcx ^= r10; //xor rcx, r10
rcx = ~rcx; //not rcx
rax *= *(uint64_t*)(rcx + 0x9); //imul rax, [rcx+0x09]
rcx = 0x1878E588DC30511; //mov rcx, 0x1878E588DC30511
rax *= rcx; //imul rax, rcx
rcx = 0x1BDFAD63E7B0499E; //mov rcx, 0x1BDFAD63E7B0499E
rax += rcx; //add rax, rcx
rcx = 0xD2F688CE4CF2546B; //mov rcx, 0xD2F688CE4CF2546B
rax ^= rcx; //xor rax, rcx
rcx = rdi + 0x1; //lea rcx, [rdi+0x01]
rcx *= r12; //imul rcx, r12
rax += rcx; //add rax, rcx
return rax;
}
}
}
uint64_t get_bone_ptr()
{
auto baseModuleAddr = g_data::base;
auto Peb = __readgsqword(0x60);
uint64_t rax = baseModuleAddr, rbx = baseModuleAddr, rcx = baseModuleAddr, rdx = baseModuleAddr, rdi = baseModuleAddr, rsi = baseModuleAddr, r8 = baseModuleAddr, r9 = baseModuleAddr, r10 = baseModuleAddr, r11 = baseModuleAddr, r12 = baseModuleAddr, r13 = baseModuleAddr, r14 = baseModuleAddr, r15 = baseModuleAddr;
rdx = *(uint64_t*)(baseModuleAddr + 0x1BA9BFE8);
if (!rdx)
return rdx;
r10 = Peb; //mov r10, gs:[rax]
rax = r10; //mov rax, r10
rax >>= 0x13; //shr rax, 0x13
rax &= 0xF;
switch (rax) {
case 0:
{
r15 = baseModuleAddr + 0x7CEA; //lea r15, [0xFFFFFFFFFDC958D7]
r11 = baseModuleAddr; //lea r11, [0xFFFFFFFFFDC8DBD5]
r9 = *(uint64_t*)(baseModuleAddr + 0x7151233); //mov r9, [0x0000000004DDEDCA]
rdx ^= r10; //xor rdx, r10
rcx = r10; //mov rcx, r10
rcx = ~rcx; //not rcx
rax = r15; //mov rax, r15
rax = ~rax; //not rax
rdx += rax; //add rdx, rax
rdx += rcx; //add rdx, rcx
rdx -= r10; //sub rdx, r10
rax = 0; //and rax, 0xFFFFFFFFC0000000
rax = _rotl64(rax, 0x10); //rol rax, 0x10
rax ^= r9; //xor rax, r9
rax = ~rax; //not rax
rdx *= *(uint64_t*)(rax + 0xd); //imul rdx, [rax+0x0D]
rax = rdx; //mov rax, rdx
rax >>= 0x23; //shr rax, 0x23
rdx ^= rax; //xor rdx, rax
rax = 0xC8F0AF33880E5BCF; //mov rax, 0xC8F0AF33880E5BCF
rdx *= rax; //imul rdx, rax
rax = r11 + 0x11b0; //lea rax, [r11+0x11B0]
rax += r10; //add rax, r10
rdx ^= rax; //xor rdx, rax
rax = r10; //mov rax, r10
rax -= r11; //sub rax, r11
rax += 0xFFFFFFFFB40A59F8; //add rax, 0xFFFFFFFFB40A59F8
rdx += rax; //add rdx, rax
return rdx;
}
case 1:
{
//failed to translate: pop rdx
r9 = *(uint64_t*)(baseModuleAddr + 0x7151233); //mov r9, [0x0000000004DDE964]
r15 = baseModuleAddr + 0x1851D8C4; //lea r15, [0x00000000161AAFDD]
r12 = baseModuleAddr + 0x6D105AE1; //lea r12, [0x000000006AD931EE]
r13 = baseModuleAddr + 0x2E0A0DA9; //lea r13, [0x000000002BD2E4AA]
rax = rdx; //mov rax, rdx
rax >>= 0x22; //shr rax, 0x22
rdx ^= rax; //xor rdx, rax
rax = 0xFC68A9112A83A459; //mov rax, 0xFC68A9112A83A459
rdx *= rax; //imul rdx, rax
rax = r10; //mov rax, r10
rax *= r15; //imul rax, r15
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x12; //shr rax, 0x12
rdx ^= rax; //xor rdx, rax
rcx = rdx; //mov rcx, rdx
rcx >>= 0x24; //shr rcx, 0x24
rdx ^= rcx; //xor rdx, rcx
rax = r10; //mov rax, r10
rax *= r12; //imul rax, r12
rdx -= rax; //sub rdx, rax
rcx = r13; //mov rcx, r13
rcx = ~rcx; //not rcx
//failed to translate: inc rcx
rcx += r10; //add rcx, r10
rax = 0; //and rax, 0xFFFFFFFFC0000000
rax = _rotl64(rax, 0x10); //rol rax, 0x10
rax ^= r9; //xor rax, r9
rax = ~rax; //not rax
rdx *= *(uint64_t*)(rax + 0xd); //imul rdx, [rax+0x0D]
rdx ^= rcx; //xor rdx, rcx
rax = rdx; //mov rax, rdx
rax >>= 0xF; //shr rax, 0x0F
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x1E; //shr rax, 0x1E
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x3C; //shr rax, 0x3C
rdx ^= rax; //xor rdx, rax
return rdx;
}
case 2:
{
r11 = baseModuleAddr; //lea r11, [0xFFFFFFFFFDC8D143]
r12 = baseModuleAddr + 0x12A7D395; //lea r12, [0x000000001070A4CC]
r9 = *(uint64_t*)(baseModuleAddr + 0x7151233); //mov r9, [0x0000000004DDE307]
rcx = 0; //and rcx, 0xFFFFFFFFC0000000
rcx = _rotl64(rcx, 0x10); //rol rcx, 0x10
rcx ^= r9; //xor rcx, r9
rax = r11 + 0xa045; //lea rax, [r11+0xA045]
rcx = ~rcx; //not rcx
rax += r10; //add rax, r10
rdx ^= rax; //xor rdx, rax
rdx *= *(uint64_t*)(rcx + 0xd); //imul rdx, [rcx+0x0D]
rdx ^= r11; //xor rdx, r11
rax = r12; //mov rax, r12
rax = ~rax; //not rax
rax ^= r10; //xor rax, r10
rdx += rax; //add rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x25; //shr rax, 0x25
rdx ^= rax; //xor rdx, rax
rax = 0xBE0966A117A4CCA0; //mov rax, 0xBE0966A117A4CCA0
rdx ^= rax; //xor rdx, rax
rax = 0xF3CDB9AE04A5DE9B; //mov rax, 0xF3CDB9AE04A5DE9B
rdx *= rax; //imul rdx, rax
rax = 0x3CFDFB48A269239A; //mov rax, 0x3CFDFB48A269239A
rdx += rax; //add rdx, rax
return rdx;
}
case 3:
{
r11 = baseModuleAddr; //lea r11, [0xFFFFFFFFFDC8CC1F]
r15 = baseModuleAddr + 0x4D7964CE; //lea r15, [0x000000004B4230E1]
r9 = *(uint64_t*)(baseModuleAddr + 0x7151233); //mov r9, [0x0000000004DDDE23]
rdx ^= r10; //xor rdx, r10
rax = 0xE43F2E4C7BB83B4B; //mov rax, 0xE43F2E4C7BB83B4B
rdx *= rax; //imul rdx, rax
rax = r10; //mov rax, r10
rax ^= r15; //xor rax, r15
rdx -= rax; //sub rdx, rax
rax = r11 + 0x6c89d3e6; //lea rax, [r11+0x6C89D3E6]
rax += r10; //add rax, r10
rdx += rax; //add rdx, rax
rdx -= r10; //sub rdx, r10
rax = rdx; //mov rax, rdx
rax >>= 0x9; //shr rax, 0x09
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x12; //shr rax, 0x12
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x24; //shr rax, 0x24
rdx ^= rax; //xor rdx, rax
rax = 0xAB9EA13EFAD12F7; //mov rax, 0xAB9EA13EFAD12F7
rdx -= rax; //sub rdx, rax
rax = 0; //and rax, 0xFFFFFFFFC0000000
rax = _rotl64(rax, 0x10); //rol rax, 0x10
rax ^= r9; //xor rax, r9
rax = ~rax; //not rax
rdx *= *(uint64_t*)(rax + 0xd); //imul rdx, [rax+0x0D]
return rdx;
}
case 4:
{
r9 = *(uint64_t*)(baseModuleAddr + 0x7151233); //mov r9, [0x0000000004DDD91E]
r11 = baseModuleAddr; //lea r11, [0xFFFFFFFFFDC8C6D8]
rax = rdx; //mov rax, rdx
rax >>= 0x20; //shr rax, 0x20
rdx ^= rax; //xor rdx, rax
rdx -= r11; //sub rdx, r11
rax = 0x676EAABFE95D694B; //mov rax, 0x676EAABFE95D694B
rdx *= rax; //imul rdx, rax
rax = 0x70068A9FE4DF2257; //mov rax, 0x70068A9FE4DF2257
rdx -= rax; //sub rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x1; //shr rax, 0x01
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x2; //shr rax, 0x02
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x4; //shr rax, 0x04
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x8; //shr rax, 0x08
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rcx = 0; //and rcx, 0xFFFFFFFFC0000000
rax >>= 0x10; //shr rax, 0x10
rdx ^= rax; //xor rdx, rax
rcx = _rotl64(rcx, 0x10); //rol rcx, 0x10
rcx ^= r9; //xor rcx, r9
rcx = ~rcx; //not rcx
rax = rdx; //mov rax, rdx
rax >>= 0x20; //shr rax, 0x20
rdx ^= rax; //xor rdx, rax
rdx *= *(uint64_t*)(rcx + 0xd); //imul rdx, [rcx+0x0D]
rax = rdx; //mov rax, rdx
rax >>= 0x1C; //shr rax, 0x1C
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x38; //shr rax, 0x38
rdx ^= rax; //xor rdx, rax
rax = 0xE9BBCE7C879EE545; //mov rax, 0xE9BBCE7C879EE545
rdx *= rax; //imul rdx, rax
return rdx;
}
case 5:
{
r11 = baseModuleAddr; //lea r11, [0xFFFFFFFFFDC8C088]
r8 = *(uint64_t*)(baseModuleAddr + 0x7151233); //mov r8, [0x0000000004DDD259]
rax = 0; //and rax, 0xFFFFFFFFC0000000
rax = _rotl64(rax, 0x10); //rol rax, 0x10
rax ^= r8; //xor rax, r8
rax = ~rax; //not rax
rdx *= *(uint64_t*)(rax + 0xd); //imul rdx, [rax+0x0D]
rax = 0xD607BDC612D39625; //mov rax, 0xD607BDC612D39625
rdx += rax; //add rdx, rax
rdx += r11; //add rdx, r11
rax = 0x59993DD6A38BDC5C; //mov rax, 0x59993DD6A38BDC5C
rdx -= rax; //sub rdx, rax
rax = 0x30F0D6E93C3440EB; //mov rax, 0x30F0D6E93C3440EB
rdx *= rax; //imul rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x1F; //shr rax, 0x1F
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x3E; //shr rax, 0x3E
rdx ^= rax; //xor rdx, rax
rdx += 0xFFFFFFFFB8E61505; //add rdx, 0xFFFFFFFFB8E61505
return rdx;
}
case 6:
{
r9 = *(uint64_t*)(baseModuleAddr + 0x7151233); //mov r9, [0x0000000004DDCE11]
r15 = baseModuleAddr + 0x74AE; //lea r15, [0xFFFFFFFFFDC93074]
rcx = r10; //mov rcx, r10
rcx = ~rcx; //not rcx
rax = baseModuleAddr + 0x2CD0; //lea rax, [0xFFFFFFFFFDC8E6E0]
rcx *= rax; //imul rcx, rax