Function at 0x140026630
Capabilities:
Download url
Encode data using xor
Execute command
Hide graphical window
Receive data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xf0
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x1400ef0c0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov edi, ecx
mov ecx, 1
call qword [sym.imp.USER32.dll_BlockInput]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x140021da0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x61], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x51], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_27
lea rdx, str._n_n_Initializing_spoofer...
lea rcx, [rbp - 0x61]
call fcn.14001d920
mov dword [rbp - 0x41], reloc.WLDAP32.dll_Ordinal_50
lea rdx, [rbp - 0x61]
mov rcx, rbx
call fcn.1400222a0
nop
mov rdx, qword [rbp - 0x49]
cmp rdx, 0xf
jbe 0x140026709
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026704
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140026e35
call fcn.1400b6090
cmp edi, 5
jne 0x140026752
lea rdx, [0x140021dd0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rbx, rax
lea rdx, str._n_n_FORTNITE_SPECIAL
lea rcx, [rbp - 0x61]
call fcn.14001d4e0
mov dword [rbp - 0x41], reloc.WLDAP32.dll_Ordinal_50
lea rdx, [rbp - 0x61]
mov rcx, rbx
call fcn.1400222a0
nop
lea rcx, [rbp - 0x61]
call fcn.14001d480
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [str.PXF6]
mov dword [rbp - 0x69], eax
xor esi, esi
mov edi, dword [reloc.WS2_32.dll_accept]
cmp byte [0x1400d6e33], sil
je 0x140026845
cmp edi, 2
jl 0x140026805
movdqa xmm3, xmmword [0x1400da7a0]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x1400daab0]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x1400daab0]
shufps xmm2, xmm0, 0xdd
paddd xmm2, xmm3
psrad xmm2, 5
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [0x1400da7f0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400da870]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.3333333333333333]
movd xmm0, eax
xorps xmm2, xmm0
movd dword [rbp - 0x69], xmm2
jmp 0x140026845
lea r9, [rbp - 0x69]
mov r8d, esi
nop dword [rax]
mov eax, 0xa0a0a0a1
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul ecx, eax, 0x33
add cl, r8b
xor byte [r9], cl
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x140026810
lea rcx, [rbp - 0x69]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x140021e00]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, str.C:WindowsSystem32AMIDEWINx64.EXE
lea rdx, str.https:__github.com_Modztw_spoofer_raw_main_AMIDEWINx64.EXE
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, str.C:WindowsSystem32_amifldrv64.sys
lea rdx, str.https:__github.com_Modztw_spoofer_raw_main_amifldrv64.sys
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, str.C:WindowsSystem32mac.bat
lea rdx, str.https:__github.com_Modztw_spoofer_raw_main_mac.bat
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x140021da0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x61], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x51], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_26
lea rdx, str._n_n_Changing_Mac_Adress...
lea rcx, [rbp - 0x61]
call fcn.14001d920
mov dword [rbp - 0x41], reloc.WLDAP32.dll_Ordinal_50
lea rdx, [rbp - 0x61]
mov rcx, rbx
call fcn.1400222a0
nop
mov rdx, qword [rbp - 0x49]
cmp rdx, 0xf
jbe 0x14002696d
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026968
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140026e35
call fcn.1400b6090
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [str.PXF6]
mov dword [rbp - 0x69], eax
cmp byte [0x1400d6e33], 0
je 0x140026a55
cmp edi, 2
jl 0x140026a18
movdqa xmm3, xmmword [0x1400da7a0]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x1400daab0]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x1400daab0]
shufps xmm2, xmm0, 0xdd
paddd xmm2, xmm3
psrad xmm2, 5
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [0x1400da7f0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400da870]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.3333333333333333]
movd xmm0, eax
xorps xmm2, xmm0
movd dword [rbp - 0x69], xmm2
jmp 0x140026a55
lea r9, [rbp - 0x69]
mov r8d, esi
nop
mov eax, 0xa0a0a0a1
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul ecx, eax, 0x33
add cl, r8b
xor byte [r9], cl
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x140026a20
lea rcx, [rbp - 0x69]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x140021e00]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movups xmm0, xmmword [0x1400d7698]
movups xmmword [rbp - 0x61], xmm0
movsd xmm0, qword [0x1400d76a8]
movsd qword [rbp - 0x51], xmm0
mov eax, dword [0x1400d76b0]
mov dword [rbp - 0x49], eax
cmp byte [0x1400d76b3], 0
je 0x140026c40
mov ecx, esi
cmp edi, 2
jl 0x140026bfa
movdqa xmm5, xmmword [0x1400da7a0]
movdqa xmm4, xmmword [0x1400daab0]
movdqa xmm6, xmmword [0x1400da7f0]
movdqa xmm0, xmmword [str.3333333333333333]
movdqa xmmword [rbp - 0x29], xmm0
lea rdx, [rbp - 0x5d]
mov r8d, dword [rbp - 0x29]
nop word [rax + rax]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400da870]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400da870]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
xorps xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x18
jl 0x140026af0
cmp ecx, 0x1c
jge 0x140026c40
movsxd rax, ecx
lea r8, [rbp - 0x61]
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0xa0a0a0a1
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul edx, eax, 0x33
add dl, cl
xor byte [r8], dl
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x1c
jl 0x140026c10
lea rcx, [rbp - 0x61]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, Ordinal_41
mov dword [rbp - 0x61], eax
movdqa xmm0, xmmword [0x1400da8a0]
movdqu xmmword [rbp - 0x5d], xmm0
movdqa xmm1, xmmword [0x1400daa30]
movdqu xmmword [rbp - 0x4d], xmm1
mov dword [rbp - 0x3d], 0x80b0434
mov dword [rbp - 0x39], 0x1b0f0f42
mov byte [rbp - 0x35], reloc.WS2_32.dll_WSASetLastError
xor ecx, ecx
mov word [rbp - 0x34], cx
mov byte [rbp - 0x32], cl
mov edx, esi
test eax, eax
je 0x140026ca7
nop dword [rax]
mov eax, edx
lea rcx, [rbp - 0x5d]
add rcx, rax
lea eax, [rdx + 0x48]
xor byte [rcx], al
inc edx
mov eax, dword [rbp - 0x61]
cmp edx, eax
jb 0x140026c90
mov byte [rbp + rax - 0x5d], 0
lea rcx, [rbp - 0x5d]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, dword [str.PXF6]
mov dword [rbp - 0x69], eax
cmp byte [0x1400d6e33], 0
je 0x140026d95
cmp edi, 2
jl 0x140026d56
movdqa xmm3, xmmword [0x1400da7a0]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x1400daab0]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x1400daab0]
shufps xmm2, xmm0, 0xdd
paddd xmm2, xmm3
psrad xmm2, 5
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [0x1400da7f0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400da870]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.3333333333333333]
movd xmm0, eax
xorps xmm2, xmm0
movd dword [rbp - 0x69], xmm2
jmp 0x140026d95
lea r9, [rbp - 0x69]
mov r8d, esi
nop dword [rax]
mov eax, 0xa0a0a0a1
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul ecx, eax, 0x33
add cl, r8b
xor byte [r9], cl
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x140026d60
lea rcx, [rbp - 0x69]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x140021da0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x61], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x51], xmm1
mov r8d, Ordinal_26
lea rdx, str._n_n_Spoofing_your_HWID...
lea rcx, [rbp - 0x61]
call fcn.14001d920
mov dword [rbp - 0x41], reloc.WLDAP32.dll_Ordinal_50
lea rdx, [rbp - 0x61]
mov rcx, rbx
call fcn.1400222a0
nop
mov rdx, qword [rbp - 0x49]
cmp rdx, 0xf
jbe 0x140026e41
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026e3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140026e3c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6090
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x140021e00]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp - 9], xmm0
mov qword [rbp + 7], rsi
mov qword [rbp + reloc.WS2_32.dll_ntohs], 0xf
mov byte [rbp - 9], 0
movups xmmword [rbp + 0x17], xmm0
mov rbx, rsi
mov qword [rbp + 0x27], rbx
mov edi, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x2f], rdi
mov byte [rbp + 0x17], bl
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__SM
lea edx, [rdi + 0x19]
lea rcx, [rbp - 9]
call fcn.14001e200
lea rcx, [rbp - 0x61]
call fcn.140022b50
lea rcx, [rbp + 0x17]
cmp rcx, rax
je 0x140026ef1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x17], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x27], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov byte [rax], 0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rdi, xmm0
movq rbx, xmm1
mov rdx, qword [rbp - 0x49]
cmp rdx, 0xf
jbe 0x140026f2f
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026f2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140026f2a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6090
lea rdx, [rbp + 0x17]
cmp rdi, 0xf
cmova rdx, qword [rbp + 0x17]
mov r8, rbx
lea rcx, [rbp - 9]
call fcn.140044530
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 0xf
cmova rcx, qword [rbp - 9]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xf]
cmp rax, 0x28
jb 0x140026f96
lea rbx, [rbp - 9]
cmp rax, 0xf
cmova rbx, qword [rbp - 9]
mov qword [rbp + 7], Ordinal_46
mov r8d, Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__BM
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x140026fab
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__BM
mov edx, Ordinal_41
lea rcx, [rbp - 9]
call fcn.14001e200
lea rcx, [rbp - 0x61]
call fcn.140022b50
mov rbx, rax
lea rax, [rbp + 0x17]
cmp rax, rbx
je 0x140027015
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0xf
jbe 0x140026ff7
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026ff2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027047
call fcn.1400b6090
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x17], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x27], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x49]
cmp rdx, 0xf
jbe 0x140027053
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002704e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002704e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6090
lea rdx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 0xf
cmova rdx, qword [rbp + 0x17]
mov r8, qword [rbp + 0x27]
lea rcx, [rbp - 9]
call fcn.140044530
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 0xf
cmova rcx, qword [rbp - 9]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xf]
cmp rax, 0x28
jb 0x1400270bc
lea rbx, [rbp - 9]
cmp rax, 0xf
cmova rbx, qword [rbp - 9]
mov qword [rbp + 7], Ordinal_46
mov r8d, Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__BP
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x1400270d1
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__BP
mov edx, Ordinal_41
lea rcx, [rbp - 9]
call fcn.14001e200
lea rcx, [rbp - 0x61]
call fcn.140022b50
mov rbx, rax
lea rax, [rbp + 0x17]
cmp rax, rbx
je 0x14002713b
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0xf
jbe 0x14002711d
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027118
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002716d
call fcn.1400b6090
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x17], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x27], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x49]
cmp rdx, 0xf
jbe 0x140027179
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027174
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140027174
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6090
lea rdx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 0xf
cmova rdx, qword [rbp + 0x17]
mov r8, qword [rbp + 0x27]
lea rcx, [rbp - 9]
call fcn.140044530
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 0xf
cmova rcx, qword [rbp - 9]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xf]
cmp rax, 0x28
jb 0x1400271e2
lea rbx, [rbp - 9]
cmp rax, 0xf
cmova rbx, qword [rbp - 9]
mov qword [rbp + 7], Ordinal_46
mov r8d, Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__SS
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x1400271f7
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__SS
mov edx, Ordinal_41
lea rcx, [rbp - 9]
call fcn.14001e200
lea rcx, [rbp - 0x61]
call fcn.140022b50
mov rbx, rax
lea rax, [rbp + 0x17]
cmp rax, rbx
je 0x140027261
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0xf
jbe 0x140027243
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002723e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027293
call fcn.1400b6090
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x17], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x27], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x49]
cmp rdx, 0xf
jbe 0x14002729f
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002729a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002729a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6090
lea rdx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 0xf
cmova rdx, qword [rbp + 0x17]
mov r8, qword [rbp + 0x27]
lea rcx, [rbp - 9]
call fcn.140044530
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 0xf
cmova rcx, qword [rbp - 9]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xf]
cmp rax, 0x28
jb 0x140027308
lea rbx, [rbp - 9]
cmp rax, 0xf
cmova rbx, qword [rbp - 9]
mov qword [rbp + 7], Ordinal_46
mov r8d, Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__SK
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x14002731d
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__SK
mov edx, Ordinal_41
lea rcx, [rbp - 9]
call fcn.14001e200
lea rcx, [rbp - 0x61]
call fcn.140022b50
mov rbx, rax
lea rax, [rbp + 0x17]
cmp rax, rbx
je 0x140027387
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0xf
jbe 0x140027369
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027364
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400273b9
call fcn.1400b6090
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x17], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x27], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x49]
cmp rdx, 0xf
jbe 0x1400273c5
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400273c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400273c0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6090
lea rdx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 0xf
cmova rdx, qword [rbp + 0x17]
mov r8, qword [rbp + 0x27]
lea rcx, [rbp - 9]
call fcn.140044530
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 0xf
cmova rcx, qword [rbp - 9]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xf]
cmp rax, 0x28
jb 0x14002742e
lea rbx, [rbp - 9]
cmp rax, 0xf
cmova rbx, qword [rbp - 9]
mov qword [rbp + 7], Ordinal_46
mov r8d, Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__BS
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x140027443
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__BS
mov edx, Ordinal_41
lea rcx, [rbp - 9]
call fcn.14001e200
lea rcx, [rbp - 0x61]
call fcn.140022b50
mov rbx, rax
lea rax, [rbp + 0x17]
cmp rax, rbx
je 0x1400274ad
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0xf
jbe 0x14002748f
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002748a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400274df
call fcn.1400b6090
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x17], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x27], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x49]
cmp rdx, 0xf
jbe 0x1400274eb
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400274e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400274e6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6090
lea rdx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 0xf
cmova rdx, qword [rbp + 0x17]
mov r8, qword [rbp + 0x27]
lea rcx, [rbp - 9]
call fcn.140044530
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 0xf
cmova rcx, qword [rbp - 9]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xf]
cmp rax, 0x29
jb 0x140027554
lea rbx, [rbp - 9]
cmp rax, 0xf
cmova rbx, qword [rbp - 9]
mov qword [rbp + 7], reloc.WLDAP32.dll_Ordinal_41
mov r8d, reloc.WLDAP32.dll_Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__PSN
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x29], 0
jmp 0x140027569
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__PSN
mov edx, reloc.WLDAP32.dll_Ordinal_41
lea rcx, [rbp - 9]
call fcn.14001e200
lea rcx, [rbp - 0x61]
call fcn.140022b50
mov rbx, rax
lea rax, [rbp + 0x17]
cmp rax, rbx
je 0x1400275d3
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0xf
jbe 0x1400275b5
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400275b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027605
call fcn.1400b6090
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x17], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x27], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x49]
cmp rdx, 0xf
jbe 0x140027611
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002760c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002760c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6090
lea rdx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 0xf
cmova rdx, qword [rbp + 0x17]
mov r8, qword [rbp + 0x27]
lea rcx, [rbp - 9]
call fcn.140044530
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 0xf
cmova rcx, qword [rbp - 9]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xf]
cmp rax, 0x29
jb 0x14002767a
lea rbx, [rbp - 9]
cmp rax, 0xf
cmova rbx, qword [rbp - 9]
mov qword [rbp + 7], reloc.WLDAP32.dll_Ordinal_41
mov r8d, reloc.WLDAP32.dll_Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__BLC
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x29], 0
jmp 0x14002768f
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__BLC
mov edx, reloc.WLDAP32.dll_Ordinal_41
lea rcx, [rbp - 9]
call fcn.14001e200
lea rcx, [rbp - 0x61]
call fcn.140022b50
mov rbx, rax
lea rax, [rbp + 0x17]
cmp rax, rbx
je 0x1400276f9
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0xf
jbe 0x1400276db
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400276d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002772b
call fcn.1400b6090
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x17], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x27], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x49]
cmp rdx, 0xf
jbe 0x140027737
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027732
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140027732
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6090
lea rdx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 0xf
cmova rdx, qword [rbp + 0x17]
mov r8, qword [rbp + 0x27]
lea rcx, [rbp - 9]
call fcn.140044530
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 0xf
cmova rcx, qword [rbp - 9]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xf]
cmp rax, 0x28
jb 0x1400277a0
lea rbx, [rbp - 9]
cmp rax, 0xf
cmova rbx, qword [rbp - 9]
mov qword [rbp + 7], Ordinal_46
mov r8d, Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__BT
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x1400277b5
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__BT
mov edx, Ordinal_41
lea rcx, [rbp - 9]
call fcn.14001e200
lea rcx, [rbp - 0x61]
call fcn.140022b50
mov rbx, rax
lea rax, [rbp + 0x17]
cmp rax, rbx
je 0x14002781f
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0xf
jbe 0x140027801
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400277fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027851
call fcn.1400b6090
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x17], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x27], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x49]
cmp rdx, 0xf
jbe 0x14002785d
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027858
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140027858
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6090
lea rdx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 0xf
cmova rdx, qword [rbp + 0x17]
mov r8, qword [rbp + 0x27]
lea rcx, [rbp - 9]
call fcn.140044530
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 0xf
cmova rcx, qword [rbp - 9]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xf]
cmp rax, 0x28
jb 0x1400278c6
lea rbx, [rbp - 9]
cmp rax, 0xf
cmova rbx, qword [rbp - 9]
mov qword [rbp + 7], Ordinal_46
mov r8d, Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__CS
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x1400278db
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__CS
mov edx, Ordinal_41
lea rcx, [rbp - 9]
call fcn.14001e200
lea rcx, [rbp - 0x61]
call fcn.140022b50
mov rbx, rax
lea rax, [rbp + 0x17]
cmp rax, rbx
je 0x140027945
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0xf
jbe 0x140027927
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027922
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027977
call fcn.1400b6090
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x17], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x27], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x49]
cmp rdx, 0xf
jbe 0x140027983
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002797e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002797e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6090
lea rdx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 0xf
cmova rdx, qword [rbp + 0x17]
mov r8, qword [rbp + 0x27]
lea rcx, [rbp - 9]
call fcn.140044530
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 0xf
cmova rcx, qword [rbp - 9]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xf]
cmp rax, 0x28
jb 0x1400279ec
lea rbx, [rbp - 9]
cmp rax, 0xf
cmova rbx, qword [rbp - 9]
mov qword [rbp + 7], Ordinal_46
mov r8d, Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__CA
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x140027a01
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__CA
mov edx, Ordinal_41
lea rcx, [rbp - 9]
call fcn.14001e200
lea rcx, [rbp - 0x61]
call fcn.140022b50
mov rbx, rax
lea rax, [rbp + 0x17]
cmp rax, rbx
je 0x140027a6b
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0xf
jbe 0x140027a4d
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027a48
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027a9d
call fcn.1400b6090
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x17], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x27], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x49]
cmp rdx, 0xf
jbe 0x140027aa9
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027aa4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140027aa4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6090
lea rdx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 0xf
cmova rdx, qword [rbp + 0x17]
mov r8, qword [rbp + 0x27]
lea rcx, [rbp - 9]
call fcn.140044530
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 0xf
cmova rcx, qword [rbp - 9]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xf]
cmp rax, 0x29
jb 0x140027b12
lea rbx, [rbp - 9]
cmp rax, 0xf
cmova rbx, qword [rbp - 9]
mov qword [rbp + 7], reloc.WLDAP32.dll_Ordinal_41
mov r8d, reloc.WLDAP32.dll_Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__CSK
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x29], 0
jmp 0x140027b27
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__CSK
mov edx, reloc.WLDAP32.dll_Ordinal_41
lea rcx, [rbp - 9]
call fcn.14001e200
lea rcx, [rbp - 0x61]
call fcn.140022b50
mov rbx, rax
lea rax, [rbp + 0x17]
cmp rax, rbx
je 0x140027b91
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0xf
jbe 0x140027b73
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027b6e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027bc3
call fcn.1400b6090
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x17], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x27], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x49]
cmp rdx, 0xf
jbe 0x140027bcf
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027bca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140027bca
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6090
lea rdx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 0xf
cmova rdx, qword [rbp + 0x17]
mov r8, qword [rbp + 0x27]
lea rcx, [rbp - 9]
call fcn.140044530
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 0xf
cmova rcx, qword [rbp - 9]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xf]
cmp rax, 0x28
jb 0x140027c38
lea rbx, [rbp - 9]
cmp rax, 0xf
cmova rbx, qword [rbp - 9]
mov qword [rbp + 7], Ordinal_46
mov r8d, Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__CM
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x140027c4d
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__CM
mov edx, Ordinal_41
lea rcx, [rbp - 9]
call fcn.14001e200
lea rcx, [rbp - 0x61]
call fcn.140022b50
mov rbx, rax
lea rax, [rbp + 0x17]
cmp rax, rbx
je 0x140027cb7
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0xf
jbe 0x140027c99
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027c94
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027ce9
call fcn.1400b6090
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x17], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x27], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x49]
cmp rdx, 0xf
jbe 0x140027cf5
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027cf0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140027cf0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6090
lea rdx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 0xf
cmova rdx, qword [rbp + 0x17]
mov r8, qword [rbp + 0x27]
lea rcx, [rbp - 9]
call fcn.140044530
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 0xf
cmova rcx, qword [rbp - 9]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xf]
cmp rax, 0x28
jb 0x140027d5e
lea rbx, [rbp - 9]
cmp rax, 0xf
cmova rbx, qword [rbp - 9]
mov qword [rbp + 7], Ordinal_46
mov r8d, Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__CM
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x140027d73
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__CM
mov edx, Ordinal_41
lea rcx, [rbp - 9]
call fcn.14001e200
lea rcx, [rbp - 0x61]
call fcn.140022b50
mov rbx, rax
lea rax, [rbp + 0x17]
cmp rax, rbx
je 0x140027ddd
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0xf
jbe 0x140027dbf
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027dba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027e0f
call fcn.1400b6090
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x17], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x27], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x49]
cmp rdx, 0xf
jbe 0x140027e1b
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027e16
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140027e16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6090
lea rdx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 0xf
cmova rdx, qword [rbp + 0x17]
mov r8, qword [rbp + 0x27]
lea rcx, [rbp - 9]
call fcn.140044530
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 0xf
cmova rcx, qword [rbp - 9]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xf]
cmp rax, 0x28
jb 0x140027e84
lea rbx, [rbp - 9]
cmp rax, 0xf
cmova rbx, qword [rbp - 9]
mov qword [rbp + 7], Ordinal_46
mov r8d, Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__CO
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x140027e99
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__CO
mov edx, Ordinal_41
lea rcx, [rbp - 9]
call fcn.14001e200
lea rcx, [rbp - 0x61]
call fcn.140022b50
mov rbx, rax
lea rax, [rbp + 0x17]
cmp rax, rbx
je 0x140027f03
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0xf
jbe 0x140027ee5
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027ee0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027f35
call fcn.1400b6090
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x17], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x27], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x49]
cmp rdx, 0xf
jbe 0x140027f41
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027f3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140027f3c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6090
lea rdx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 0xf
cmova rdx, qword [rbp + 0x17]
mov r8, qword [rbp + 0x27]
lea rcx, [rbp - 9]
call fcn.140044530
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 0xf
cmova rcx, qword [rbp - 9]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xf]
cmp rax, 0x28
jb 0x140027faa
lea rbx, [rbp - 9]
cmp rax, 0xf
cmova rbx, qword [rbp - 9]
mov qword [rbp + 7], Ordinal_46
mov r8d, Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__CT
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x140027fbf
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__CT
mov edx, Ordinal_41
lea rcx, [rbp - 9]
call fcn.14001e200
lea rcx, [rbp - 0x61]
call fcn.140022b50
mov rbx, rax
lea rax, [rbp + 0x17]
cmp rax, rbx
je 0x140028029
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0xf
jbe 0x14002800b
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028006
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002805b
call fcn.1400b6090
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x17], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x27], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x49]
cmp rdx, 0xf
jbe 0x140028067
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028062
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140028062
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6090
lea rdx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 0xf
cmova rdx, qword [rbp + 0x17]
mov r8, qword [rbp + 0x27]
lea rcx, [rbp - 9]
call fcn.140044530
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 0xf
cmova rcx, qword [rbp - 9]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xf]
cmp rax, 0x29
jb 0x1400280d0
lea rbx, [rbp - 9]
cmp rax, 0xf
cmova rbx, qword [rbp - 9]
mov qword [rbp + 7], reloc.WLDAP32.dll_Ordinal_41
mov r8d, reloc.WLDAP32.dll_Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__PAT
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x29], 0
jmp 0x1400280e5
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__PAT
mov edx, reloc.WLDAP32.dll_Ordinal_41
lea rcx, [rbp - 9]
call fcn.14001e200
lea rcx, [rbp - 0x61]
call fcn.140022b50
mov rbx, rax
lea rax, [rbp + 0x17]
cmp rax, rbx
je 0x140028156
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0xf
jbe 0x140028138
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028133
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140028133
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6090
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x17], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x27], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
lea rcx, [rbp - 0x61]
call fcn.14001d480
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 9]
call fcn.140042f40
lea rcx, [rbp - 9]
call fcn.14001d470
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__PPN
lea rcx, [rbp - 9]
call fcn.14001e080
lea rcx, [rbp - 0x61]
call fcn.140022b50
mov rdx, rax
lea rcx, [rbp + 0x17]
call fcn.14001e100
lea rcx, [rbp - 0x61]
call fcn.14001d480
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 9]
call fcn.140042f40
lea rcx, [rbp - 9]
call fcn.14001d470
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__BV
lea rcx, [rbp - 9]
call fcn.14001e080
lea rcx, [rbp - 0x61]
call fcn.140022b50
mov rdx, rax
lea rcx, [rbp + 0x17]
call fcn.14001e100
lea rcx, [rbp - 0x61]
call fcn.14001d480
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 9]
call fcn.140042f40
lea rcx, [rbp - 9]
call fcn.14001d470
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__IV
lea rcx, [rbp - 9]
call fcn.14001e080
lea rcx, [rbp - 0x61]
call fcn.140022b50
mov rdx, rax
lea rcx, [rbp + 0x17]
call fcn.14001e100
lea rcx, [rbp - 0x61]
call fcn.14001d480
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 9]
call fcn.140042f40
lea rcx, [rbp - 9]
call fcn.14001d470
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__IVN
lea rcx, [rbp - 9]
call fcn.14001e080
lea rcx, [rbp - 0x61]
call fcn.140022b50
mov rdx, rax
lea rcx, [rbp + 0x17]
call fcn.14001e100
lea rcx, [rbp - 0x61]
call fcn.14001d480
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 9]
call fcn.140042f40
lea rcx, [rbp - 9]
call fcn.14001d470
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__ID
lea rcx, [rbp - 9]
call fcn.14001e080
lea rcx, [rbp - 0x61]
call fcn.140022b50
mov rdx, rax
lea rcx, [rbp + 0x17]
call fcn.14001e100
lea rcx, [rbp - 0x61]
call fcn.14001d480
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 9]
call fcn.140042f40
lea rcx, [rbp - 9]
call fcn.14001d470
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__SP
lea rcx, [rbp - 9]
call fcn.14001e080
lea rcx, [rbp - 0x61]
call fcn.140022b50
mov rdx, rax
lea rcx, [rbp + 0x17]
call fcn.14001e100
lea rcx, [rbp - 0x61]
call fcn.14001d480
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 9]
call fcn.140042f40
lea rcx, [rbp - 9]
call fcn.14001d470
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__SV
lea rcx, [rbp - 9]
call fcn.14001e080
lea rcx, [rbp - 0x61]
call fcn.140022b50
mov rdx, rax
lea rcx, [rbp + 0x17]
call fcn.14001e100
lea rcx, [rbp - 0x61]
call fcn.14001d480
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 9]
call fcn.140042f40
lea rcx, [rbp - 9]
call fcn.14001d470
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__SU_auto
lea rcx, [rbp - 9]
call fcn.14001e080
lea rcx, [rbp - 9]
call fcn.14001d470
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__SF
lea rcx, [rbp - 9]
call fcn.14001e080
lea rcx, [rbp - 0x61]
call fcn.140022b50
mov rdx, rax
lea rcx, [rbp + 0x17]
call fcn.14001e100
lea rcx, [rbp - 0x61]
call fcn.14001d480
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 9]
call fcn.140042f40
lea rcx, [rbp - 9]
call fcn.14001d470
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__BP
lea rcx, [rbp - 9]
call fcn.14001e080
lea rcx, [rbp - 0x61]
call fcn.140022b50
mov rdx, rax
lea rcx, [rbp + 0x17]
call fcn.14001e100
lea rcx, [rbp - 0x61]
call fcn.14001d480
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 9]
call fcn.140042f40
lea rcx, [rbp - 9]
call fcn.14001d470
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__CV
lea rcx, [rbp - 9]
call fcn.14001e080
lea rcx, [rbp - 0x61]
call fcn.140022b50
mov rdx, rax
lea rcx, [rbp + 0x17]
call fcn.14001e100
lea rcx, [rbp - 0x61]
call fcn.14001d480
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 9]
call fcn.140042f40
lea rcx, [rbp - 9]
call fcn.14001d470
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__OS_1
lea rcx, [rbp - 9]
call fcn.14001e080
lea rcx, [rbp - 0x61]
call fcn.140022b50
mov rdx, rax
lea rcx, [rbp + 0x17]
call fcn.14001e100
lea rcx, [rbp - 0x61]
call fcn.14001d480
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 9]
call fcn.140042f40
lea rcx, [rbp - 9]
call fcn.14001d470
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__OS_2
lea rcx, [rbp - 9]
call fcn.14001e080
lea rcx, [rbp - 0x61]
call fcn.140022b50
mov rdx, rax
lea rcx, [rbp + 0x17]
call fcn.14001e100
lea rcx, [rbp - 0x61]
call fcn.14001d480
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 9]
call fcn.140042f40
lea rcx, [rbp - 9]
call fcn.14001d470
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__OS_3
lea rcx, [rbp - 9]
call fcn.14001e080
lea rcx, [rbp - 0x61]
call fcn.140022b50
mov rdx, rax
lea rcx, [rbp + 0x17]
call fcn.14001e100
lea rcx, [rbp - 0x61]
call fcn.14001d480
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 9]
call fcn.140042f40
lea rcx, [rbp - 9]
call fcn.14001d470
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__OS_4
lea rcx, [rbp - 9]
call fcn.14001e080
lea rcx, [rbp - 0x61]
call fcn.140022b50
mov rdx, rax
lea rcx, [rbp + 0x17]
call fcn.14001e100
lea rcx, [rbp - 0x61]
call fcn.14001d480
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 9]
call fcn.140042f40
lea rcx, [rbp - 9]
call fcn.14001d470
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__OS_5
lea rcx, [rbp - 9]
call fcn.14001e080
lea rcx, [rbp - 0x61]
call fcn.140022b50
mov rdx, rax
lea rcx, [rbp + 0x17]
call fcn.14001e100
lea rcx, [rbp - 0x61]
call fcn.14001d480
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 9]
call fcn.140042f40
lea rcx, [rbp - 9]
call fcn.14001d470
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__OS_6
lea rcx, [rbp - 9]
call fcn.14001e080
lea rcx, [rbp - 0x61]
call fcn.140022b50
mov rdx, rax
lea rcx, [rbp + 0x17]
call fcn.14001e100
lea rcx, [rbp - 0x61]
call fcn.14001d480
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 9]
call fcn.140042f40
lea rcx, [rbp - 9]
call fcn.14001d470
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__OS_7
lea rcx, [rbp - 9]
call fcn.14001e080
lea rcx, [rbp - 0x61]
call fcn.140022b50
mov rdx, rax
lea rcx, [rbp + 0x17]
call fcn.14001e100
lea rcx, [rbp - 0x61]
call fcn.14001d480
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 9]
call fcn.140042f40
lea rcx, [rbp - 9]
call fcn.14001d470
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__OS_8
lea rcx, [rbp - 9]
call fcn.14001e080
lea rcx, [rbp - 0x61]
call fcn.140022b50
mov rdx, rax
lea rcx, [rbp + 0x17]
call fcn.14001e100
lea rcx, [rbp - 0x61]
call fcn.14001d480
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 9]
call fcn.140042f40
lea rcx, [rbp - 9]
call fcn.14001d470
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rbp - 0x61]
call fcn.1400289c0
mov rcx, rax
call fcn.140042930
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rbp - 0x61]
call fcn.140028a20
mov rcx, rax
call fcn.140042930
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, str.C:WindowsSystem32Volumeid.exe
lea rdx, str.https:__github.com_Modztw_spoofer_raw_main_Volumeid.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, str.C:WindowsSystem32Volumeid64.exe
lea rdx, str.https:__github.com_Modztw_spoofer_raw_main_Volumeid64.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
lea rcx, [rbp - 0x29]
call fcn.140022940
nop
mov r8, rax
lea rdx, str.C:WindowsSystem32VolumeID.exe_C:
lea rcx, [rbp - 0x61]
call fcn.1400452e0
mov rcx, rax
call fcn.14001d470
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x61]
call fcn.14001d480
nop
lea rcx, [rbp - 0x29]
call fcn.14001d480
lea rcx, [rbp - 0x29]
call fcn.140022940
nop
mov r8, rax
lea rdx, str.C:WindowsSystem32VolumeID.exe_D:
lea rcx, [rbp - 0x61]
call fcn.1400452e0
mov rcx, rax
call fcn.14001d470
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x61]
call fcn.14001d480
nop
lea rcx, [rbp - 0x29]
call fcn.14001d480
lea rcx, [rbp - 0x29]
call fcn.140022940
nop
mov r8, rax
lea rdx, str.C:WindowsSystem32VolumeID.exe_E:
lea rcx, [rbp - 0x61]
call fcn.1400452e0
mov rcx, rax
call fcn.14001d470
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x61]
call fcn.14001d480
nop
lea rcx, [rbp - 0x29]
call fcn.14001d480
lea rcx, [rbp - 0x29]
call fcn.140022940
nop
mov r8, rax
lea rdx, str.C:WindowsSystem32VolumeID.exe_F:
lea rcx, [rbp - 0x61]
call fcn.1400452e0
mov rcx, rax
call fcn.14001d470
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x61]
call fcn.14001d480
nop
lea rcx, [rbp - 0x29]
call fcn.14001d480
lea rcx, [rbp - 0x29]
call fcn.140022940
nop
mov r8, rax
lea rdx, str.C:WindowsSystem32VolumeID.exe_G:
lea rcx, [rbp - 0x61]
call fcn.1400452e0
mov rcx, rax
call fcn.14001d470
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x61]
call fcn.14001d480
nop
lea rcx, [rbp - 0x29]
call fcn.14001d480
lea rdx, [rbp - 0x61]
call fcn.140028a90
mov rcx, rax
call fcn.140042930
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rbp - 0x61]
call fcn.140028af0
mov rcx, rax
call fcn.140042930
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Beep]
nop
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0xf
jbe 0x14002894b
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028945
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140028945
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6090
nop
mov rdx, qword [rbp + 0xf]
cmp rdx, 0xf
jbe 0x140028989
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028984
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140028984
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6090
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400b5c40
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rbp
ret