Function at 0x140003e80
Capabilities:
Create process on windows
Delete file
Encode data using xor
Execute command
Get token membership
Set console window title
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x6a8]
sub rsp, 0x780
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x14008d080]
xor rax, rsp
mov qword [rbp + 0x660], rax
xor edi, edi
mov dword [rbp + 0xd0], edi
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r14, rax
lea edx, [rdi + 7]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dword [rbp + 0xd0], edi
mov qword [rbp - 0x60], rdi
mov dword [rbp + 0xd4], edi
mov word [rbp + 0xd8], 0x500
lea rax, [rbp - 0x60]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
mov r9d, 0x220
lea r8d, [rdi + 0x20]
mov dl, 2
lea rcx, [rbp + 0xd4]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140003f5b
lea r8, [rbp + 0xd0]
mov rdx, qword [rbp - 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x140003f51
mov dword [rbp + 0xd0], edi
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rbp + 0xd0], 1
je 0x140003fd0
mov edx, 4
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.___Este_programa_requer_privilegios_de_administrador._Execute_novamente_como_administrador.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400075b0
lea rdx, [0x140007780]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.___Caso_Este_Erro_Persista_Contate:_walkers1000_ou_azovwernerr
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400075b0
lea rdx, [0x140007780]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xfa0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [0x14008e428], rdi
mov qword [0x14008e178], rdi
mov word [0x14008e180], di
mov byte [0x14008e182], dil
xorps xmm0, xmm0
xor eax, eax
movups xmmword [0x14008e430], xmm0
movups xmmword [0x14008e440], xmm0
movups xmmword [0x14008e450], xmm0
movups xmmword [0x14008e460], xmm0
mov byte [0x14008e470], al
mov dword [0x14008e134], eax
movups xmmword [0x14008e188], xmm0
mov qword [0x14008e198], rax
mov dword [0x14008e1a0], eax
mov byte [0x14008e1a4], al
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
mov edx, 0xffffffec
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowLongA]
bts eax, 0x13
mov r8d, eax
mov edx, 0xffffffec
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov r9d, 2
mov r8b, reloc.WLDAP32.dll_Ordinal_200
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
movups xmm0, xmmword [str.oXVPYOM]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [0x140080fa0]
movups xmmword [rsp + 0x70], xmm1
movups xmm0, xmmword [0x140080fb0]
movups xmmword [rbp - 0x80], xmm0
movzx eax, byte [0x140080fc0]
mov byte [rbp - 0x70], al
mov r8d, edi
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x1400041e5
movdqa xmm5, xmmword [0x1400810b0]
movdqa xmm4, xmmword [0x140081100]
movdqa xmm6, xmmword [0x1400810d0]
movdqa xmm0, xmmword [str.8888888888888888]
movdqa xmmword [rbp - 0x60], xmm0
lea rcx, [rsp + 0x64]
mov edx, dword [rbp - 0x60]
nop dword [rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400810e0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400810e0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x30
jl 0x1400040e0
cmp r8d, 0x31
jge 0x140004220
movsxd rax, r8d
lea r9, [rsp + 0x60]
add r9, rax
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x38
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x31
jl 0x1400041f0
lea rax, [rsp + 0x60]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], dil
jne 0x140004230
mov r12, qword [0x14008e148]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r12
cmp rax, rbx
jb 0x1400058b1
lea r13, [0x14008e138]
cmp qword [0x14008e150], 0xf
cmova r13, qword [0x14008e138]
xorps xmm0, xmm0
movups xmmword [rbp + 0x120], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x130], xmm1
lea r15, [r12 + rbx]
mov edi, reloc.WS2_32.dll_ntohs
lea rsi, [rbp + 0x120]
cmp r15, rdi
jbe 0x140004319
mov rdi, r15
or rdi, 0xf
cmp rdi, rcx
jbe 0x1400042d2
mov rdi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14006dd80
test rax, rax
je 0x1400042fa
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140004312
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140004301
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400058b7
jmp 0x1400042b7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140004310
call fcn.14006dd80
mov rsi, rax
jmp 0x140004312
xor esi, esi
mov qword [rbp + 0x120], rsi
mov qword [rbp + 0x130], r15
mov qword [rbp + 0x138], rdi
mov r8, rbx
lea rdx, [rsp + 0x60]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsi + rbx]
mov r8, r12
mov rdx, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r15], 0
mov r8d, 1
lea rdx, reloc.WLDAP32.dll_Ordinal_32
lea rcx, [rbp + 0x120]
call fcn.1400072b0
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x110], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x100], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x110], xmm1
xor edi, edi
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], dil
lea rdx, [0x14008e158]
cmp qword [0x14008e170], 0xf
cmova rdx, qword [0x14008e158]
mov r8, qword [0x14008e168]
lea rcx, [rbp + 0x100]
call fcn.1400072b0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1e8], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1d8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1e8], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], dil
mov rdx, qword [rbp + 0x118]
cmp rdx, 0xf
jbe 0x140004446
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004441
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004441
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006dffc
movdqa xmm0, xmmword [0x1400810a0]
movdqu xmmword [rbp + 0x110], xmm0
mov byte [rbp + 0x100], 0
mov rdx, qword [rbp + 0x138]
cmp rdx, 0xf
jbe 0x1400044a1
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000449c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000449c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006dffc
movdqa xmm0, xmmword [0x1400810a0]
movdqu xmmword [rbp + 0x130], xmm0
mov byte [rbp + 0x120], 0
lea rcx, [rbp + 0x1d8]
cmp qword [rbp + 0x1f0], 0xf
cmova rcx, qword [rbp + 0x1d8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov edx, 8
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.___Spoofer_By:_Walkers_and_Zoio_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400075b0
lea rdx, str.___Canal:_Walkers_Geraldo___AZOV_TEAM__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400075b0
lea rdx, [0x14007fab0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400075b0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14007facc]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 1
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, reloc.WS2_32.dll_ioctlsocket
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400075b0
lea rcx, [0x14008e1b0]
call fcn.140017550
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f8], xmm0
movdqa xmm1, xmmword [0x1400810a0]
movdqu xmmword [rbp + 0x208], xmm1
mov byte [rbp + 0x1f8], 0
lea rdx, str.___Adquira_o_seu_em:_discord.gg_mVGxX8rnGU
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400075b0
lea rdx, [0x140007780]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0x1f8]
lea rcx, [rsp + 0x60]
call fcn.140006af0
mov rdx, rax
lea rcx, [0x14008e1b0]
call fcn.140018ee0
xorps xmm0, xmm0
movups xmmword [rbp + 0x198], xmm0
mov qword [rbp + 0x1a8], rdi
mov qword [rbp + 0x1b0], rdi
mov r8d, 7
lea rdx, str.walkers
lea rcx, [rbp + 0x198]
call fcn.140007d50
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x178], xmm0
mov qword [rbp + 0x188], rdi
mov qword [rbp + 0x190], rdi
mov r8d, 7
lea rdx, str.walkers
lea rcx, [rbp + 0x178]
call fcn.140007d50
nop
lea rdx, str.Digite_o_login:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400075b0
xorps xmm0, xmm0
movups xmmword [rbp + 0x140], xmm0
mov qword [rbp + 0x150], rdi
mov qword [rbp + 0x158], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x140], 0
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp + 0x140]
mov rcx, rbx
call fcn.140008cf0
lea rdx, str.Digite_a_senha:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400075b0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b8], xmm0
mov qword [rbp + 0x1c8], rdi
mov qword [rbp + 0x1d0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1b8], 0
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp + 0x1b8]
mov rcx, rbx
call fcn.140008cf0
lea rdx, [rbp + 0x198]
mov r15, qword [rbp + 0x198]
cmp qword [rbp + 0x1b0], 0xf
cmova rdx, r15
lea rcx, [rbp + 0x140]
mov r12, qword [rbp + 0x140]
cmp qword [rbp + 0x158], 0xf
cmova rcx, r12
mov rax, qword [rbp + 0x150]
cmp rax, qword [rbp + 0x1a8]
jne 0x140005839
mov r8, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140005839
lea rdx, [rbp + 0x178]
mov rbx, qword [rbp + 0x178]
cmp qword [rbp + 0x190], 0xf
cmova rdx, rbx
lea rcx, [rbp + 0x1b8]
mov rdi, qword [rbp + 0x1b8]
mov r13, qword [rbp + 0x1d0]
cmp r13, 0xf
cmova rcx, rdi
mov rsi, qword [rbp + 0x1c8]
cmp rsi, qword [rbp + 0x188]
jne 0x140005839
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140005839
lea edx, [rax + 2]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14007facc]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._n___Login_bem_sucedido_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400075b0
lea rdx, [0x140007780]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.___Bem_Vindo_a___Walkers_Spoofer
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400075b0
lea rdx, [0x140007780]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14007facc]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 8
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
cmp dword [0x14008e130], 0
jne 0x140005677
lea rdx, [rbp + 0x198]
cmp qword [rbp + 0x1b0], 0xf
cmova rdx, r15
lea rcx, [rbp + 0x140]
cmp qword [rbp + 0x158], 0xf
cmova rcx, r12
mov r8, qword [rbp + 0x150]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140004a16
lea rdx, [rbp + 0x178]
cmp qword [rbp + 0x190], 0xf
cmova rdx, rbx
lea rcx, [rbp + 0x1b8]
cmp r13, 0xf
cmova rcx, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140004a16
lea rdx, str.____Walkers_and_Zoio_Spoofer
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400078e0
lea rdx, [0x140007ab0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.____discord.gg_mVGxX8rnGU_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400078e0
lea rdx, [0x140007ab0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 4
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.____Obtendo_Logs...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400078e0
lea rdx, [0x140007ab0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.____Logs_Deletadas...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400078e0
lea rdx, [0x140007ab0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, [0x14007facc]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 1
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.___Walkers_and_Zoio_Spoofer________Melhores_Spoofer
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400078e0
lea rdx, [0x140007ab0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.___Version:_1.1
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400078e0
lea rdx, [0x140007ab0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.___discord.gg_mVGxX8rnGU_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400078e0
lea rdx, [0x140007ab0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [0x14007fd80]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400078e0
lea rdx, [0x140007ab0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14008e1b0]
call fcn.140017550
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], rax
movups xmmword [rbp + 0xe0], xmm0
xor r14d, r14d
mov qword [rbp + 0xf0], r14
mov qword [rbp + 0xf8], r14
lea r8d, [rax + 6]
lea rdx, str.967780
lea rcx, [rbp + 0xe0]
call fcn.140007d50
lea r8, [rbp + 0xe0]
lea rdx, [rbp + 0x120]
lea rcx, [0x14008e1b0]
call fcn.140014ef0
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], rax
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
lea r8d, [r14 + 6]
lea rdx, str.571601
lea rcx, [rsp + 0x60]
call fcn.140007d50
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x100]
lea rcx, [0x14008e1b0]
call fcn.140014ef0
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x170], rax
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r14
mov qword [rbp + 0xf8], r14
lea r8d, [r14 + 6]
lea rdx, str.044333
lea rcx, [rbp + 0xe0]
call fcn.140007d50
lea r8, [rbp + 0xe0]
lea rdx, [rbp + 0x160]
lea rcx, [0x14008e1b0]
call fcn.140014ef0
nop
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x550]
call sub.VCRUNTIME140.dll_memset
lea rsi, [0x140081048]
mov qword [rbp + 0x550], rsi
lea rcx, [rbp + 0x5f8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rbp + 0xd0], reloc.WS2_32.dll_ntohs
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x558]
lea rcx, [rbp + 0x550]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x550]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x550], rax
mov rax, qword [rbp + 0x550]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x54c], edx
lea rcx, [rbp + 0x558]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x558], rax
mov byte [rbp + 0x5d4], r14b
mov byte [rbp + 0x5c9], r14b
lea rcx, [rbp + 0x558]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp + 0x5d8], r14
mov rax, qword [0x14008e478]
mov qword [rbp + 0x5cc], rax
mov qword [rbp + 0x5c0], r14
lea r9d, [r14 + 0x40]
lea r8d, [r14 + 0x22]
lea rdx, str.C:WindowsPantherUnattendGCghjsopus.exe
lea rcx, [rbp + 0x558]
call fcn.140006f10
test rax, rax
jne 0x140004c50
mov rax, qword [rbp + 0x550]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x550]
add rcx, rax
xor r8d, r8d
lea edx, [r14 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov r8, qword [rbp + 0x128]
mov rdx, qword [rbp + 0x120]
sub r8, rdx
lea rcx, [rbp + 0x550]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x558]
call fcn.140006e50
test rax, rax
jne 0x140004ca1
mov rax, qword [rbp + 0x550]
movsxd rdx, dword [rax + 4]
lea rcx, [rbp + 0x550]
add rcx, rdx
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rcx, str.C:WindowsPantherUnattendGCghjsopus.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsPantherUnattendGCghjsopus.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
cmp dword [0x14008e130], 0
jne 0x14000549b
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x440]
call sub.VCRUNTIME140.dll_memset
mov qword [rbp + 0x440], rsi
lea rcx, [rbp + 0x4e8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rbp + 0xd0], Ordinal_32
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x448]
lea rcx, [rbp + 0x440]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x440]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x440], rax
mov rax, qword [rbp + 0x440]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x43c], edx
lea rcx, [rbp + 0x448]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x448], rax
mov byte [rbp + 0x4c4], 0
mov byte [rbp + 0x4b9], 0
lea rcx, [rbp + 0x448]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp + 0x4c8], r14
mov rax, qword [0x14008e478]
mov qword [rbp + 0x4bc], rax
mov qword [rbp + 0x4b0], r14
mov r9d, 0x40
lea r8d, [r9 - 0x1e]
lea rdx, str.C:WindowsPantherUnattendGCgklpdf.sys
lea rcx, [rbp + 0x448]
call fcn.140006f10
test rax, rax
jne 0x140004ddf
mov rax, qword [rbp + 0x440]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x440]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov r8, qword [rbp + 0x108]
mov rdx, qword [rbp + 0x100]
sub r8, rdx
lea rcx, [rbp + 0x440]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x448]
call fcn.140006e50
test rax, rax
jne 0x140004e30
mov rax, qword [rbp + 0x440]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x440]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x330]
call sub.VCRUNTIME140.dll_memset
mov qword [rbp + 0x330], rsi
lea rcx, [rbp + 0x3d8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rbp + 0xd0], 0x3f
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x338]
lea rcx, [rbp + 0x330]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x330]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x330], rax
mov rax, qword [rbp + 0x330]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x32c], edx
lea rcx, [rbp + 0x338]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x338], rax
mov byte [rbp + 0x3b4], 0
mov byte [rbp + 0x3a9], 0
lea rcx, [rbp + 0x338]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp + 0x3b8], r14
mov rax, qword [0x14008e478]
mov qword [rbp + 0x3ac], rax
mov qword [rbp + 0x3a0], r14
mov r9d, 0x40
lea r8d, [r9 - 0x1e]
lea rdx, str.C:WindowsPantherUnattendGC_fkfk.exe
lea rcx, [rbp + 0x338]
call fcn.140006f10
test rax, rax
jne 0x140004f47
mov rax, qword [rbp + 0x330]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x330]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov r8, qword [rbp + 0x168]
mov rdx, qword [rbp + 0x160]
sub r8, rdx
lea rcx, [rbp + 0x330]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x338]
call fcn.140006e50
test rax, rax
jne 0x140004f98
mov rax, qword [rbp + 0x330]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x330]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r14
lea r9, str.C:WindowsPantherUnattendGCgklpdf.sys
lea r8, str.C:WindowsPantherUnattendGC_fkfk.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x50], xmm1
mov r8d, Ordinal_41
lea rdx, str.C:WindowsPantherUnattendGC_fkfk.exe
lea rcx, [rbp - 0x60]
call fcn.140007d50
nop
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp - 0x40]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
cmova rdx, qword [rbp - 0x60]
lea rcx, [rbp - 0x40]
call fcn.140006640
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
mov esi, dword [rbp + rcx - 0x30]
lea rcx, [rbp - 0x40]
call fcn.140003aa0
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140005064
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000505f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000505f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006dffc
test esi, esi
jne 0x140005580
lea ecx, [rsi + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x50], xmm1
lea r8d, [rsi + 0x28]
lea rdx, str.C:WindowsPantherUnattendGCgklpdf.sys
lea rcx, [rbp - 0x60]
call fcn.140007d50
nop
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp - 0x40]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
cmova rdx, qword [rbp - 0x60]
lea rcx, [rbp - 0x40]
call fcn.140006640
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
mov esi, dword [rbp + rcx - 0x30]
lea rcx, [rbp - 0x40]
call fcn.140003aa0
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140005115
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005110
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005110
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006dffc
test esi, esi
jne 0x140005539
lea ecx, [rsi + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [rsi + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:WindowsPantherUnattendGCgklpdf.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:WindowsPantherUnattendGC_fkfk.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], rax
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
lea r8d, [rsi + 6]
lea rdx, str.915334
lea rcx, [rsp + 0x60]
call fcn.140007d50
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0xe0]
lea rcx, [0x14008e1b0]
call fcn.140014ef0
nop
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x220]
call sub.VCRUNTIME140.dll_memset
lea rax, [0x140081048]
mov qword [rbp + 0x220], rax
lea rcx, [rbp + 0x2c8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rbp + 0xd0], 0x7f
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x228]
lea rcx, [rbp + 0x220]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x220]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x220], rax
mov rax, qword [rbp + 0x220]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x21c], edx
lea rcx, [rbp + 0x228]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x228], rax
mov byte [rbp + 0x2a4], sil
mov byte [rbp + 0x299], sil
lea rcx, [rbp + 0x228]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp + 0x2a8], r14
mov rax, qword [0x14008e478]
mov qword [rbp + 0x29c], rax
mov qword [rbp + 0x290], r14
lea r9d, [rsi + 0x40]
lea r8d, [rsi + 0x22]
lea rdx, str.C:WindowsPantherUnattendGCServiceHub.ThreadedWaitGui.exe
lea rcx, [rbp + 0x228]
call fcn.140006f10
test rax, rax
jne 0x1400052b4
mov rax, qword [rbp + 0x220]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x220]
add rcx, rax
xor r8d, r8d
lea edx, [rsi + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov r8, qword [rbp + 0xe8]
mov rdx, qword [rbp + 0xe0]
sub r8, rdx
lea rcx, [rbp + 0x220]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x50], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_60
lea rdx, str.C:WindowsPantherUnattendGCServiceHub.ThreadedWaitGui.exe
lea rcx, [rbp - 0x60]
call fcn.140007d50
nop
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp - 0x40]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
cmova rdx, qword [rbp - 0x60]
lea rcx, [rbp - 0x40]
call fcn.140006640
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
mov esi, dword [rbp + rcx - 0x30]
lea rcx, [rbp - 0x40]
call fcn.140003aa0
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140005374
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000536f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000536f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006dffc
test esi, esi
jne 0x1400054f2
lea ecx, [rsi + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.___Spoofado_Com_Sucesso
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400078e0
lea rdx, [0x140007ab0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.___Feche_ou_Aguarde_o_Loader_Fechar_Automaticamente...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400078e0
lea rdx, [0x140007ab0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, [rbp + 0x228]
call fcn.140006e50
test rax, rax
jne 0x1400053fd
mov rax, qword [rbp + 0x220]
movsxd r8, dword [rax + 4]
lea rcx, [rbp + 0x220]
add rcx, r8
xor r8d, r8d
lea edx, [rsi + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rcx, str.C:WindowsPantherUnattendGCServiceHub.ThreadedWaitGui.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x1b58
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x14008e130], 1
lea rcx, [rbp + 0x220]
call fcn.140003b60
nop
mov rcx, qword [rbp + 0xe0]
test rcx, rcx
je 0x140005481
mov rdx, qword [rbp + 0xf0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000546a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000546a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006dffc
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r14
lea rcx, [rbp + 0x330]
call fcn.140003b60
nop
lea rcx, [rbp + 0x440]
call fcn.140003b60
nop
lea rcx, [rbp + 0x550]
call fcn.140003b60
nop
mov rcx, qword [rbp + 0x160]
test rcx, rcx
je 0x1400055de
mov rdx, qword [rbp + 0x170]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400055c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400055c7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rcx, [0x14007facc]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.___Ocorreu_o_Erro:_004__Contate:_walkers1000_ou_azovwernerr
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400078e0
lea rdx, [0x140007ab0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rcx, [0x14007facc]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.___Ocorreu_o_Erro:_002__Contate:_walkers1000_ou_azovwernerr
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400078e0
lea rdx, [0x140007ab0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [0x14007facc]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.___Ocorreu_o_Erro:_003__Contate:_walkers1000_ou_azovwernerr
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400078e0
lea rdx, [0x140007ab0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call fcn.14006dffc
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x170], r14
mov rcx, qword [rbp + 0x100]
test rcx, rcx
je 0x140005633
mov rdx, qword [rbp + 0x110]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000561c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000561c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006dffc
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], r14
mov rcx, qword [rbp + 0x120]
test rcx, rcx
je 0x140005677
mov rdx, qword [rbp + 0x130]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005671
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005671
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006dffc
nop
cmp r13, 0xf
jbe 0x1400056b2
lea rdx, [r13 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400056a9
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400056a9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.14006dffc
nop
mov rax, qword [rbp + 0x158]
cmp rax, 0xf
jbe 0x1400056f5
lea rdx, [rax + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x1400056ec
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400056ec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r12
call fcn.14006dffc
nop
mov rax, qword [rbp + 0x190]
cmp rax, 0xf
jbe 0x140005737
lea rdx, [rax + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000572e
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000572e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14006dffc
nop
mov rax, qword [rbp + 0x1b0]
cmp rax, 0xf
jbe 0x140005779
lea rdx, [rax + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x140005770
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005770
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.14006dffc
nop
mov rdx, qword [rbp + 0x210]
cmp rdx, 0xf
jbe 0x1400057be
inc rdx
mov rcx, qword [rbp + 0x1f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400057b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400057b8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006dffc
nop
mov rdx, qword [rbp + 0x1f0]
cmp rdx, 0xf
jbe 0x140005802
inc rdx
mov rcx, qword [rbp + 0x1d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400057fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400057fd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006dffc
xor eax, eax
mov rcx, qword [rbp + 0x660]
xor rcx, rsp
call fcn.14006dd60
lea r11, [rsp + 0x780]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov edx, 4
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.____Nome_de_usuario_ou_senha_incorretos.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400075b0
lea rdx, [0x140007780]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.____Obter_Senha:_discord.gg_mVGxX8rnGU
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400075b0
lea rdx, [0x140007780]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14007facc]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call fcn.140001dd0
int3
call fcn.140001d30
int3