Function at 0x140026500
Capabilities:
Download url
Encode data using xor
Execute command
Hide graphical window
Receive data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x1f8]
sub rsp, 0x2e0
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
mov rax, qword [0x1400ee098]
xor rax, rsp
mov qword [rbp + 0x1a8], rax
mov ecx, 1
call qword [sym.imp.USER32.dll_BlockInput]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov r14d, 5
mov edx, r14d
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x140021ac0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
lea r8d, [r14 + 0x16]
lea rdx, str._n_n_Initializing_spoofer...
lea rcx, [rsp + 0x58]
call fcn.14001d630
mov dword [rsp + 0x78], reloc.WLDAP32.dll_Ordinal_50
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.140021f90
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x1400265f3
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400265ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140026d19
call fcn.1400b5358
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [str.Q_G5BRAFS7]
mov dword [rsp + 0x30], eax
xor esi, esi
lea r15d, [rsi + 0x1f]
mov edi, dword [reloc.WS2_32.dll_accept]
cmp byte [0x1400d8817], sil
je 0x1400266f3
cmp edi, 2
jl 0x1400266b6
movdqa xmm3, xmmword [0x1400d9790]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x1400d9d10]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x1400d9d10]
shufps xmm2, xmm0, 0xdd
paddd xmm2, xmm3
movd xmm0, r14d
psrad xmm2, xmm0
movd xmm0, r15d
movdqa xmm1, xmm2
psrld xmm1, xmm0
paddd xmm1, xmm2
pmulld xmm1, xmmword [0x1400d97e0]
psubd xmm3, xmm1
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1400d9860]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.2222222222222222zy_yyddb6ced1:]
movd xmm0, eax
pxor xmm2, xmm0
movd dword [rsp + 0x30], xmm2
jmp 0x1400266f3
lea r9, [rsp + 0x30]
mov r8d, esi
nop
mov eax, 0x8d3dcb09
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x3a
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x1400266c0
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x140021af0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, str.C:WindowsSystem32AMIDEWINx64.EXE
lea rdx, str.https:__github.com_Modztw_spoofer_raw_main_AMIDEWINx64.EXE
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, str.C:WindowsSystem32_amifldrv64.sys
lea rdx, str.https:__github.com_Modztw_spoofer_raw_main_amifldrv64.sys
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, str.C:WindowsSystem32mac.bat
lea rdx, str.https:__github.com_Modztw_spoofer_raw_main_mac.bat
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, r14d
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x140021ac0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_26
lea rdx, str._n_n_Changing_Mac_Adress...
lea rcx, [rsp + 0x58]
call fcn.14001d630
mov dword [rsp + 0x78], reloc.WLDAP32.dll_Ordinal_50
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.140021f90
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140026821
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002681c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140026d19
call fcn.1400b5358
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [str.Q_G5BRAFS7]
mov dword [rsp + 0x30], eax
cmp byte [0x1400d8817], 0
je 0x140026913
cmp edi, 2
jl 0x1400268d8
movdqa xmm3, xmmword [0x1400d9790]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x1400d9d10]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x1400d9d10]
shufps xmm2, xmm0, 0xdd
paddd xmm2, xmm3
movd xmm0, r14d
psrad xmm2, xmm0
movd xmm0, r15d
movdqa xmm1, xmm2
psrld xmm1, xmm0
paddd xmm1, xmm2
pmulld xmm1, xmmword [0x1400d97e0]
psubd xmm3, xmm1
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1400d9860]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.2222222222222222zy_yyddb6ced1:]
movd xmm0, eax
pxor xmm2, xmm0
movd dword [rsp + 0x30], xmm2
jmp 0x140026913
lea r9, [rsp + 0x30]
mov r8d, esi
mov eax, 0x8d3dcb09
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x3a
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x1400268e0
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x140021af0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movups xmm0, xmmword [0x1400d92e0]
movups xmmword [rsp + 0x38], xmm0
movsd xmm1, qword [0x1400d92f0]
movsd qword [rsp + 0x48], xmm1
mov eax, dword [0x1400d92f8]
mov dword [rsp + 0x50], eax
cmp byte [0x1400d92fb], 0
je 0x140026b0e
mov ecx, esi
cmp edi, 2
jl 0x140026acc
movdqa xmm5, xmmword [0x1400d9790]
movdqa xmm4, xmmword [0x1400d9d10]
movd xmm6, r14d
movdqa xmm7, xmmword [0x1400d97e0]
movd xmm8, r15d
movdqa xmm0, xmmword [str.2222222222222222zy_yyddb6ced1:]
movdqa xmmword [rbp - 0x70], xmm0
lea rdx, [rsp + 0x3c]
mov r8d, dword [rbp - 0x70]
nop word [rax + rax]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1400d9860]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
pxor xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1400d9860]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
pxor xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x18
jl 0x1400269c0
cmp ecx, 0x1c
jge 0x140026b0e
movsxd rax, ecx
lea r8, [rsp + 0x38]
add r8, rax
nop word [rax + rax]
mov eax, 0x8d3dcb09
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x3a
movzx eax, cl
sub al, dl
add al, 0x32
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x1c
jl 0x140026ae0
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, Ordinal_41
mov dword [rsp + 0x58], eax
movdqa xmm0, xmmword [0x1400d9890]
movdqu xmmword [rsp + 0x5c], xmm0
movdqa xmm1, xmmword [0x1400d9c80]
movdqu xmmword [rsp + 0x6c], xmm1
mov dword [rsp + 0x7c], 0x80b0434
mov dword [rbp - 0x80], 0x1b0f0f42
mov byte [rbp - 0x7c], reloc.WS2_32.dll_WSASetLastError
xor ecx, ecx
mov word [rbp - 0x7b], cx
mov byte [rbp - 0x79], cl
mov edx, esi
test eax, eax
je 0x140026b79
mov eax, edx
lea rcx, [rsp + 0x5c]
add rcx, rax
lea eax, [rdx + 0x48]
xor byte [rcx], al
inc edx
mov eax, dword [rsp + 0x58]
cmp edx, eax
jb 0x140026b60
mov byte [rsp + rax + 0x5c], 0
lea rcx, [rsp + 0x5c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, dword [str.Q_G5BRAFS7]
mov dword [rsp + 0x30], eax
cmp byte [0x1400d8817], 0
je 0x140026c73
cmp edi, 2
jl 0x140026c35
movdqa xmm3, xmmword [0x1400d9790]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x1400d9d10]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x1400d9d10]
shufps xmm2, xmm0, 0xdd
paddd xmm2, xmm3
movd xmm0, r14d
psrad xmm2, xmm0
movd xmm0, r15d
movdqa xmm1, xmm2
psrld xmm1, xmm0
paddd xmm1, xmm2
pmulld xmm1, xmmword [0x1400d97e0]
psubd xmm3, xmm1
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1400d9860]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.2222222222222222zy_yyddb6ced1:]
movd xmm0, eax
pxor xmm2, xmm0
movd dword [rsp + 0x30], xmm2
jmp 0x140026c73
lea r9, [rsp + 0x30]
mov r8d, esi
nop dword [rax]
mov eax, 0x8d3dcb09
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x3a
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x140026c40
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, r14d
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x140021ac0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
mov r8d, Ordinal_27
lea rdx, str._n_n_Spoofing_your_HWID...
lea rcx, [rsp + 0x58]
call fcn.14001d630
mov dword [rsp + 0x78], reloc.WLDAP32.dll_Ordinal_50
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.140021f90
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140026d25
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026d20
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140026d20
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b5358
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x140021af0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp + 0x168], xmm0
mov qword [rbp + 0x178], rsi
mov qword [rbp + 0x180], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x168], 0
movups xmmword [rbp + 0x188], xmm0
mov rbx, rsi
mov qword [rbp + 0x198], rbx
mov edi, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x1a0], rdi
mov byte [rbp + 0x188], bl
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__SM
lea edx, [rdi + 0x19]
lea rcx, [rbp + 0x168]
call fcn.14001dea0
lea rcx, [rsp + 0x38]
call fcn.140022890
lea rcx, [rbp + 0x188]
cmp rcx, rax
je 0x140026dfa
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x188], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x198], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov byte [rax], 0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rdi, xmm0
movq rbx, xmm1
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140026e3a
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026e35
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140026e35
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b5358
lea rdx, [rbp + 0x188]
cmp rdi, 0x10
cmovae rdx, qword [rbp + 0x188]
mov r8, rbx
lea rcx, [rbp + 0x168]
call fcn.140043460
lea rcx, [rbp + 0x168]
cmp qword [rbp + 0x180], 0x10
cmovae rcx, qword [rbp + 0x168]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0x180]
cmp rax, 0x28
jb 0x140026ebf
lea rbx, [rbp + 0x168]
cmp rax, 0x10
cmovae rbx, qword [rbp + 0x168]
mov qword [rbp + 0x178], Ordinal_45
mov r8d, Ordinal_45
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__BM
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x140026ed7
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__BM
mov edx, Ordinal_41
lea rcx, [rbp + 0x168]
call fcn.14001dea0
lea rcx, [rsp + 0x38]
call fcn.140022890
mov rbx, rax
lea rax, [rbp + 0x188]
cmp rax, rbx
je 0x140026f51
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 0x10
jb 0x140026f2d
inc rdx
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026f28
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140026f85
call fcn.1400b5358
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x188], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x198], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140026f91
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026f8c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140026f8c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b5358
lea rdx, [rbp + 0x188]
cmp qword [rbp + 0x1a0], 0x10
cmovae rdx, qword [rbp + 0x188]
mov r8, qword [rbp + 0x198]
lea rcx, [rbp + 0x168]
call fcn.140043460
lea rcx, [rbp + 0x168]
cmp qword [rbp + 0x180], 0x10
cmovae rcx, qword [rbp + 0x168]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0x180]
cmp rax, 0x28
jb 0x14002701e
lea rbx, [rbp + 0x168]
cmp rax, 0x10
cmovae rbx, qword [rbp + 0x168]
mov qword [rbp + 0x178], Ordinal_45
mov r8d, Ordinal_45
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__SS
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x140027036
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__SS
mov edx, Ordinal_41
lea rcx, [rbp + 0x168]
call fcn.14001dea0
lea rcx, [rsp + 0x38]
call fcn.140022890
mov rbx, rax
lea rax, [rbp + 0x188]
cmp rax, rbx
je 0x1400270b0
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 0x10
jb 0x14002708c
inc rdx
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027087
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400270e4
call fcn.1400b5358
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x188], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x198], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x1400270f0
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400270eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400270eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b5358
lea rdx, [rbp + 0x188]
cmp qword [rbp + 0x1a0], 0x10
cmovae rdx, qword [rbp + 0x188]
mov r8, qword [rbp + 0x198]
lea rcx, [rbp + 0x168]
call fcn.140043460
lea rcx, [rbp + 0x168]
cmp qword [rbp + 0x180], 0x10
cmovae rcx, qword [rbp + 0x168]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0x180]
cmp rax, 0x28
jb 0x14002717d
lea rbx, [rbp + 0x168]
cmp rax, 0x10
cmovae rbx, qword [rbp + 0x168]
mov qword [rbp + 0x178], Ordinal_45
mov r8d, Ordinal_45
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__SK
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x140027195
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__SK
mov edx, Ordinal_41
lea rcx, [rbp + 0x168]
call fcn.14001dea0
lea rcx, [rsp + 0x38]
call fcn.140022890
mov rbx, rax
lea rax, [rbp + 0x188]
cmp rax, rbx
je 0x14002720f
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 0x10
jb 0x1400271eb
inc rdx
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400271e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027243
call fcn.1400b5358
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x188], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x198], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x14002724f
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002724a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002724a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b5358
lea rdx, [rbp + 0x188]
cmp qword [rbp + 0x1a0], 0x10
cmovae rdx, qword [rbp + 0x188]
mov r8, qword [rbp + 0x198]
lea rcx, [rbp + 0x168]
call fcn.140043460
lea rcx, [rbp + 0x168]
cmp qword [rbp + 0x180], 0x10
cmovae rcx, qword [rbp + 0x168]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0x180]
cmp rax, 0x28
jb 0x1400272dc
lea rbx, [rbp + 0x168]
cmp rax, 0x10
cmovae rbx, qword [rbp + 0x168]
mov qword [rbp + 0x178], Ordinal_45
mov r8d, Ordinal_45
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__BS
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x1400272f4
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__BS
mov edx, Ordinal_41
lea rcx, [rbp + 0x168]
call fcn.14001dea0
lea rcx, [rsp + 0x38]
call fcn.140022890
mov rbx, rax
lea rax, [rbp + 0x188]
cmp rax, rbx
je 0x14002736e
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 0x10
jb 0x14002734a
inc rdx
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027345
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400273a2
call fcn.1400b5358
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x188], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x198], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x1400273ae
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400273a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400273a9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b5358
lea rdx, [rbp + 0x188]
cmp qword [rbp + 0x1a0], 0x10
cmovae rdx, qword [rbp + 0x188]
mov r8, qword [rbp + 0x198]
lea rcx, [rbp + 0x168]
call fcn.140043460
lea rcx, [rbp + 0x168]
cmp qword [rbp + 0x180], 0x10
cmovae rcx, qword [rbp + 0x168]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0x180]
cmp rax, 0x29
jb 0x14002743b
lea rbx, [rbp + 0x168]
cmp rax, 0x10
cmovae rbx, qword [rbp + 0x168]
mov qword [rbp + 0x178], reloc.WLDAP32.dll_Ordinal_41
mov r8d, reloc.WLDAP32.dll_Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__PSN
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x29], 0
jmp 0x140027453
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__PSN
mov edx, reloc.WLDAP32.dll_Ordinal_41
lea rcx, [rbp + 0x168]
call fcn.14001dea0
lea rcx, [rsp + 0x38]
call fcn.140022890
mov rbx, rax
lea rax, [rbp + 0x188]
cmp rax, rbx
je 0x1400274cd
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 0x10
jb 0x1400274a9
inc rdx
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400274a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027501
call fcn.1400b5358
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x188], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x198], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x14002750d
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027508
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140027508
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b5358
lea rdx, [rbp + 0x188]
cmp qword [rbp + 0x1a0], 0x10
cmovae rdx, qword [rbp + 0x188]
mov r8, qword [rbp + 0x198]
lea rcx, [rbp + 0x168]
call fcn.140043460
lea rcx, [rbp + 0x168]
cmp qword [rbp + 0x180], 0x10
cmovae rcx, qword [rbp + 0x168]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0x180]
cmp rax, 0x29
jb 0x14002759a
lea rbx, [rbp + 0x168]
cmp rax, 0x10
cmovae rbx, qword [rbp + 0x168]
mov qword [rbp + 0x178], reloc.WLDAP32.dll_Ordinal_41
mov r8d, reloc.WLDAP32.dll_Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__BLC
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x29], 0
jmp 0x1400275b2
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__BLC
mov edx, reloc.WLDAP32.dll_Ordinal_41
lea rcx, [rbp + 0x168]
call fcn.14001dea0
lea rcx, [rsp + 0x38]
call fcn.140022890
mov rbx, rax
lea rax, [rbp + 0x188]
cmp rax, rbx
je 0x14002762c
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 0x10
jb 0x140027608
inc rdx
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027603
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027660
call fcn.1400b5358
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x188], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x198], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x14002766c
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027667
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140027667
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b5358
lea rdx, [rbp + 0x188]
cmp qword [rbp + 0x1a0], 0x10
cmovae rdx, qword [rbp + 0x188]
mov r8, qword [rbp + 0x198]
lea rcx, [rbp + 0x168]
call fcn.140043460
lea rcx, [rbp + 0x168]
cmp qword [rbp + 0x180], 0x10
cmovae rcx, qword [rbp + 0x168]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0x180]
cmp rax, 0x28
jb 0x1400276f9
lea rbx, [rbp + 0x168]
cmp rax, 0x10
cmovae rbx, qword [rbp + 0x168]
mov qword [rbp + 0x178], Ordinal_45
mov r8d, Ordinal_45
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__BT
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x140027711
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__BT
mov edx, Ordinal_41
lea rcx, [rbp + 0x168]
call fcn.14001dea0
lea rcx, [rsp + 0x38]
call fcn.140022890
mov rbx, rax
lea rax, [rbp + 0x188]
cmp rax, rbx
je 0x14002778b
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 0x10
jb 0x140027767
inc rdx
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027762
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400277bf
call fcn.1400b5358
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x188], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x198], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x1400277cb
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400277c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400277c6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b5358
lea rdx, [rbp + 0x188]
cmp qword [rbp + 0x1a0], 0x10
cmovae rdx, qword [rbp + 0x188]
mov r8, qword [rbp + 0x198]
lea rcx, [rbp + 0x168]
call fcn.140043460
lea rcx, [rbp + 0x168]
cmp qword [rbp + 0x180], 0x10
cmovae rcx, qword [rbp + 0x168]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0x180]
cmp rax, 0x28
jb 0x140027858
lea rbx, [rbp + 0x168]
cmp rax, 0x10
cmovae rbx, qword [rbp + 0x168]
mov qword [rbp + 0x178], Ordinal_45
mov r8d, Ordinal_45
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__CS
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x140027870
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__CS
mov edx, Ordinal_41
lea rcx, [rbp + 0x168]
call fcn.14001dea0
lea rcx, [rsp + 0x38]
call fcn.140022890
mov rbx, rax
lea rax, [rbp + 0x188]
cmp rax, rbx
je 0x1400278ea
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 0x10
jb 0x1400278c6
inc rdx
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400278c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002791e
call fcn.1400b5358
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x188], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x198], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x14002792a
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027925
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140027925
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b5358
lea rdx, [rbp + 0x188]
cmp qword [rbp + 0x1a0], 0x10
cmovae rdx, qword [rbp + 0x188]
mov r8, qword [rbp + 0x198]
lea rcx, [rbp + 0x168]
call fcn.140043460
lea rcx, [rbp + 0x168]
cmp qword [rbp + 0x180], 0x10
cmovae rcx, qword [rbp + 0x168]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0x180]
cmp rax, 0x28
jb 0x1400279b7
lea rbx, [rbp + 0x168]
cmp rax, 0x10
cmovae rbx, qword [rbp + 0x168]
mov qword [rbp + 0x178], Ordinal_45
mov r8d, Ordinal_45
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__CA
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x1400279cf
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__CA
mov edx, Ordinal_41
lea rcx, [rbp + 0x168]
call fcn.14001dea0
lea rcx, [rsp + 0x38]
call fcn.140022890
mov rbx, rax
lea rax, [rbp + 0x188]
cmp rax, rbx
je 0x140027a49
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 0x10
jb 0x140027a25
inc rdx
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027a20
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027a7d
call fcn.1400b5358
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x188], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x198], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140027a89
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027a84
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140027a84
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b5358
lea rdx, [rbp + 0x188]
cmp qword [rbp + 0x1a0], 0x10
cmovae rdx, qword [rbp + 0x188]
mov r8, qword [rbp + 0x198]
lea rcx, [rbp + 0x168]
call fcn.140043460
lea rcx, [rbp + 0x168]
cmp qword [rbp + 0x180], 0x10
cmovae rcx, qword [rbp + 0x168]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0x180]
cmp rax, 0x29
jb 0x140027b16
lea rbx, [rbp + 0x168]
cmp rax, 0x10
cmovae rbx, qword [rbp + 0x168]
mov qword [rbp + 0x178], reloc.WLDAP32.dll_Ordinal_41
mov r8d, reloc.WLDAP32.dll_Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__CSK
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x29], 0
jmp 0x140027b2e
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__CSK
mov edx, reloc.WLDAP32.dll_Ordinal_41
lea rcx, [rbp + 0x168]
call fcn.14001dea0
lea rcx, [rsp + 0x38]
call fcn.140022890
mov rbx, rax
lea rax, [rbp + 0x188]
cmp rax, rbx
je 0x140027ba8
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 0x10
jb 0x140027b84
inc rdx
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027b7f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027bdc
call fcn.1400b5358
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x188], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x198], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140027be8
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027be3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140027be3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b5358
lea rdx, [rbp + 0x188]
cmp qword [rbp + 0x1a0], 0x10
cmovae rdx, qword [rbp + 0x188]
mov r8, qword [rbp + 0x198]
lea rcx, [rbp + 0x168]
call fcn.140043460
lea rcx, [rbp + 0x168]
cmp qword [rbp + 0x180], 0x10
cmovae rcx, qword [rbp + 0x168]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0x180]
cmp rax, 0x28
jb 0x140027c75
lea rbx, [rbp + 0x168]
cmp rax, 0x10
cmovae rbx, qword [rbp + 0x168]
mov qword [rbp + 0x178], Ordinal_45
mov r8d, Ordinal_45
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__CM
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x140027c8d
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__CM
mov edx, Ordinal_41
lea rcx, [rbp + 0x168]
call fcn.14001dea0
lea rcx, [rsp + 0x38]
call fcn.140022890
mov rbx, rax
lea rax, [rbp + 0x188]
cmp rax, rbx
je 0x140027d07
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 0x10
jb 0x140027ce3
inc rdx
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027cde
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027d3b
call fcn.1400b5358
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x188], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x198], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140027d47
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027d42
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140027d42
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b5358
lea rdx, [rbp + 0x188]
cmp qword [rbp + 0x1a0], 0x10
cmovae rdx, qword [rbp + 0x188]
mov r8, qword [rbp + 0x198]
lea rcx, [rbp + 0x168]
call fcn.140043460
lea rcx, [rbp + 0x168]
cmp qword [rbp + 0x180], 0x10
cmovae rcx, qword [rbp + 0x168]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0x180]
cmp rax, 0x29
jb 0x140027dd4
lea rbx, [rbp + 0x168]
cmp rax, 0x10
cmovae rbx, qword [rbp + 0x168]
mov qword [rbp + 0x178], reloc.WLDAP32.dll_Ordinal_41
mov r8d, reloc.WLDAP32.dll_Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__PAT
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x29], 0
jmp 0x140027dec
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__PAT
mov edx, reloc.WLDAP32.dll_Ordinal_41
lea rcx, [rbp + 0x168]
call fcn.14001dea0
lea rcx, [rsp + 0x38]
call fcn.140022890
mov rbx, rax
lea rax, [rbp + 0x188]
cmp rax, rbx
je 0x140027e66
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 0x10
jb 0x140027e42
inc rdx
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027e3d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027e9a
call fcn.1400b5358
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x188], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x198], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140027ea6
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027ea1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140027ea1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b5358
lea rdx, [rbp + 0x188]
cmp qword [rbp + 0x1a0], 0x10
cmovae rdx, qword [rbp + 0x188]
mov r8, qword [rbp + 0x198]
lea rcx, [rbp + 0x168]
call fcn.140043460
lea rcx, [rbp + 0x168]
cmp qword [rbp + 0x180], 0x10
cmovae rcx, qword [rbp + 0x168]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0x180]
cmp rax, 0x29
jb 0x140027f33
lea rbx, [rbp + 0x168]
cmp rax, 0x10
cmovae rbx, qword [rbp + 0x168]
mov qword [rbp + 0x178], reloc.WLDAP32.dll_Ordinal_41
mov r8d, reloc.WLDAP32.dll_Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__PPN
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x29], 0
jmp 0x140027f4b
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__PPN
mov edx, reloc.WLDAP32.dll_Ordinal_41
lea rcx, [rbp + 0x168]
call fcn.14001dea0
lea rcx, [rsp + 0x38]
call fcn.140022890
mov rbx, rax
lea rax, [rbp + 0x188]
cmp rax, rbx
je 0x140027fc5
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 0x10
jb 0x140027fa1
inc rdx
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027f9c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027ff9
call fcn.1400b5358
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x188], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x198], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140028005
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028000
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140028000
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b5358
lea rdx, [rbp + 0x188]
cmp qword [rbp + 0x1a0], 0x10
cmovae rdx, qword [rbp + 0x188]
mov r8, qword [rbp + 0x198]
lea rcx, [rbp + 0x168]
call fcn.140043460
lea rcx, [rbp + 0x168]
cmp qword [rbp + 0x180], 0x10
cmovae rcx, qword [rbp + 0x168]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0x180]
cmp rax, 0x28
jb 0x140028092
lea rbx, [rbp + 0x168]
cmp rax, 0x10
cmovae rbx, qword [rbp + 0x168]
mov qword [rbp + 0x178], Ordinal_45
mov r8d, Ordinal_45
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__BV
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x1400280aa
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__BV
mov edx, Ordinal_41
lea rcx, [rbp + 0x168]
call fcn.14001dea0
lea rcx, [rsp + 0x38]
call fcn.140022890
mov rbx, rax
lea rax, [rbp + 0x188]
cmp rax, rbx
je 0x140028124
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 0x10
jb 0x140028100
inc rdx
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400280fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140028158
call fcn.1400b5358
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x188], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x198], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140028164
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002815f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002815f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b5358
lea rdx, [rbp + 0x188]
cmp qword [rbp + 0x1a0], 0x10
cmovae rdx, qword [rbp + 0x188]
mov r8, qword [rbp + 0x198]
lea rcx, [rbp + 0x168]
call fcn.140043460
lea rcx, [rbp + 0x168]
cmp qword [rbp + 0x180], 0x10
cmovae rcx, qword [rbp + 0x168]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0x180]
cmp rax, 0x28
jb 0x1400281f1
lea rbx, [rbp + 0x168]
cmp rax, 0x10
cmovae rbx, qword [rbp + 0x168]
mov qword [rbp + 0x178], Ordinal_45
mov r8d, Ordinal_45
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__IV
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x140028209
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__IV
mov edx, Ordinal_41
lea rcx, [rbp + 0x168]
call fcn.14001dea0
lea rcx, [rsp + 0x38]
call fcn.140022890
mov rbx, rax
lea rax, [rbp + 0x188]
cmp rax, rbx
je 0x140028283
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 0x10
jb 0x14002825f
inc rdx
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002825a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400282b7
call fcn.1400b5358
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x188], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x198], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x1400282c3
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400282be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400282be
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b5358
lea rdx, [rbp + 0x188]
cmp qword [rbp + 0x1a0], 0x10
cmovae rdx, qword [rbp + 0x188]
mov r8, qword [rbp + 0x198]
lea rcx, [rbp + 0x168]
call fcn.140043460
lea rcx, [rbp + 0x168]
cmp qword [rbp + 0x180], 0x10
cmovae rcx, qword [rbp + 0x168]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0x180]
cmp rax, 0x28
jb 0x140028350
lea rbx, [rbp + 0x168]
cmp rax, 0x10
cmovae rbx, qword [rbp + 0x168]
mov qword [rbp + 0x178], Ordinal_45
mov r8d, Ordinal_45
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__ID
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x140028368
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__ID
mov edx, Ordinal_41
lea rcx, [rbp + 0x168]
call fcn.14001dea0
lea rcx, [rsp + 0x38]
call fcn.140022890
mov rbx, rax
lea rax, [rbp + 0x188]
cmp rax, rbx
je 0x1400283e2
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 0x10
jb 0x1400283be
inc rdx
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400283b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140028416
call fcn.1400b5358
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x188], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x198], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140028422
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002841d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002841d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b5358
lea rdx, [rbp + 0x188]
cmp qword [rbp + 0x1a0], 0x10
cmovae rdx, qword [rbp + 0x188]
mov r8, qword [rbp + 0x198]
lea rcx, [rbp + 0x168]
call fcn.140043460
lea rcx, [rbp + 0x168]
cmp qword [rbp + 0x180], 0x10
cmovae rcx, qword [rbp + 0x168]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0x180]
cmp rax, 0x28
jb 0x1400284af
lea rbx, [rbp + 0x168]
cmp rax, 0x10
cmovae rbx, qword [rbp + 0x168]
mov qword [rbp + 0x178], Ordinal_45
mov r8d, Ordinal_45
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__SP
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x1400284c7
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__SP
mov edx, Ordinal_41
lea rcx, [rbp + 0x168]
call fcn.14001dea0
lea rcx, [rsp + 0x38]
call fcn.140022890
mov rbx, rax
lea rax, [rbp + 0x188]
cmp rax, rbx
je 0x140028541
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 0x10
jb 0x14002851d
inc rdx
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028518
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140028575
call fcn.1400b5358
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x188], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x198], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140028581
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002857c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002857c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b5358
lea rdx, [rbp + 0x188]
lea rcx, [rbp + 0x168]
call fcn.1400420c0
lea rcx, [rbp + 0x168]
call fcn.14001d130
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__SV
lea rcx, [rbp + 0x168]
call fcn.14001dd20
lea rcx, [rsp + 0x38]
call fcn.140022890
mov rdx, rax
lea rcx, [rbp + 0x188]
call fcn.14001dda0
lea rcx, [rsp + 0x38]
call fcn.14001d140
lea rdx, [rbp + 0x188]
lea rcx, [rbp + 0x168]
call fcn.1400420c0
lea rcx, [rbp + 0x168]
call fcn.14001d130
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__SU_auto
lea rcx, [rbp + 0x168]
call fcn.14001dd20
lea rcx, [rbp + 0x168]
call fcn.14001d130
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__SF
lea rcx, [rbp + 0x168]
call fcn.14001dd20
lea rcx, [rsp + 0x38]
call fcn.140022890
mov rdx, rax
lea rcx, [rbp + 0x188]
call fcn.14001dda0
lea rcx, [rsp + 0x38]
call fcn.14001d140
lea rdx, [rbp + 0x188]
lea rcx, [rbp + 0x168]
call fcn.1400420c0
lea rcx, [rbp + 0x168]
call fcn.14001d130
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__BP
lea rcx, [rbp + 0x168]
call fcn.14001dd20
lea rcx, [rbp - 0x70]
call fcn.140022890
mov rdx, rax
lea rcx, [rbp + 0x188]
call fcn.14001dda0
lea rcx, [rbp - 0x70]
call fcn.14001d140
lea rdx, [rbp + 0x188]
lea rcx, [rbp + 0x168]
call fcn.1400420c0
lea rcx, [rbp + 0x168]
call fcn.14001d130
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__CV
lea rcx, [rbp + 0x168]
call fcn.14001dd20
lea rcx, [rbp + 0x68]
call fcn.140022890
mov rdx, rax
lea rcx, [rbp + 0x188]
call fcn.14001dda0
lea rcx, [rbp + 0x68]
call fcn.14001d140
lea rdx, [rbp + 0x188]
lea rcx, [rbp + 0x168]
call fcn.1400420c0
lea rcx, [rbp + 0x168]
call fcn.14001d130
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__OS_1
lea rcx, [rbp + 0x168]
call fcn.14001dd20
lea rcx, [rbp + 0x88]
call fcn.140022890
mov rdx, rax
lea rcx, [rbp + 0x188]
call fcn.14001dda0
lea rcx, [rbp + 0x88]
call fcn.14001d140
lea rdx, [rbp + 0x188]
lea rcx, [rbp + 0x168]
call fcn.1400420c0
lea rcx, [rbp + 0x168]
call fcn.14001d130
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__OS_2
lea rcx, [rbp + 0x168]
call fcn.14001dd20
lea rcx, [rbp + 0xa8]
call fcn.140022890
mov rdx, rax
lea rcx, [rbp + 0x188]
call fcn.14001dda0
lea rcx, [rbp + 0xa8]
call fcn.14001d140
lea rdx, [rbp + 0x188]
lea rcx, [rbp + 0x168]
call fcn.1400420c0
lea rcx, [rbp + 0x168]
call fcn.14001d130
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__OS_3
lea rcx, [rbp + 0x168]
call fcn.14001dd20
lea rcx, [rbp + 0xc8]
call fcn.140022890
mov rdx, rax
lea rcx, [rbp + 0x188]
call fcn.14001dda0
lea rcx, [rbp + 0xc8]
call fcn.14001d140
lea rdx, [rbp + 0x188]
lea rcx, [rbp + 0x168]
call fcn.1400420c0
lea rcx, [rbp + 0x168]
call fcn.14001d130
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__OS_4
lea rcx, [rbp + 0x168]
call fcn.14001dd20
lea rcx, [rbp + 0xe8]
call fcn.140022890
mov rdx, rax
lea rcx, [rbp + 0x188]
call fcn.14001dda0
lea rcx, [rbp + 0xe8]
call fcn.14001d140
lea rdx, [rbp + 0x188]
lea rcx, [rbp + 0x168]
call fcn.1400420c0
lea rcx, [rbp + 0x168]
call fcn.14001d130
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__OS_5
lea rcx, [rbp + 0x168]
call fcn.14001dd20
lea rcx, [rbp + 0x108]
call fcn.140022890
mov rdx, rax
lea rcx, [rbp + 0x188]
call fcn.14001dda0
lea rcx, [rbp + 0x108]
call fcn.14001d140
lea rdx, [rbp + 0x188]
lea rcx, [rbp + 0x168]
call fcn.1400420c0
lea rcx, [rbp + 0x168]
call fcn.14001d130
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__OS_6
lea rcx, [rbp + 0x168]
call fcn.14001dd20
lea rcx, [rbp + 0x128]
call fcn.140022890
mov rdx, rax
lea rcx, [rbp + 0x188]
call fcn.14001dda0
lea rcx, [rbp + 0x128]
call fcn.14001d140
lea rdx, [rbp + 0x188]
lea rcx, [rbp + 0x168]
call fcn.1400420c0
lea rcx, [rbp + 0x168]
call fcn.14001d130
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__OS_7
lea rcx, [rbp + 0x168]
call fcn.14001dd20
lea rcx, [rbp + 0x148]
call fcn.140022890
mov rdx, rax
lea rcx, [rbp + 0x188]
call fcn.14001dda0
lea rcx, [rbp + 0x148]
call fcn.14001d140
lea rdx, [rbp + 0x188]
lea rcx, [rbp + 0x168]
call fcn.1400420c0
lea rcx, [rbp + 0x168]
call fcn.14001d130
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__OS_8
lea rcx, [rbp + 0x168]
call fcn.14001dd20
lea rcx, [rbp + 0x30]
call fcn.140022890
mov rdx, rax
lea rcx, [rbp + 0x188]
call fcn.14001dda0
lea rcx, [rbp + 0x30]
call fcn.14001d140
lea rdx, [rbp + 0x188]
lea rcx, [rbp + 0x168]
call fcn.1400420c0
lea rcx, [rbp + 0x168]
call fcn.14001d130
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rbp + 0x30]
call fcn.140028cb0
mov rcx, rax
call fcn.140041a10
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rbp + 0x30]
call fcn.140028d10
mov rcx, rax
call fcn.140041a10
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, str.C:WindowsSystem32Volumeid.exe
lea rdx, str.https:__github.com_Modztw_spoofer_raw_main_Volumeid.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, str.C:WindowsSystem32Volumeid64.exe
lea rdx, str.https:__github.com_Modztw_spoofer_raw_main_Volumeid64.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
lea rcx, [rbp - 0x50]
call fcn.140022680
nop
mov r8, rax
lea rdx, str.C:WindowsSystem32VolumeID.exe_C:
lea rcx, [rbp + 0x30]
call fcn.1400443a0
mov rcx, rax
call fcn.14001d130
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x30]
call fcn.14001d140
nop
lea rcx, [rbp - 0x50]
call fcn.14001d140
lea rcx, [rbp - 0x30]
call fcn.140022680
nop
mov r8, rax
lea rdx, str.C:WindowsSystem32VolumeID.exe_D:
lea rcx, [rbp - 0x50]
call fcn.1400443a0
mov rcx, rax
call fcn.14001d130
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x50]
call fcn.14001d140
nop
lea rcx, [rbp - 0x30]
call fcn.14001d140
lea rcx, [rbp - 0x10]
call fcn.140022680
nop
mov r8, rax
lea rdx, str.C:WindowsSystem32VolumeID.exe_E:
lea rcx, [rbp - 0x30]
call fcn.1400443a0
mov rcx, rax
call fcn.14001d130
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x30]
call fcn.14001d140
nop
lea rcx, [rbp - 0x10]
call fcn.14001d140
lea rcx, [rbp + 0x10]
call fcn.140022680
nop
mov r8, rax
lea rdx, str.C:WindowsSystem32VolumeID.exe_F:
lea rcx, [rbp - 0x10]
call fcn.1400443a0
mov rcx, rax
call fcn.14001d130
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x10]
call fcn.14001d140
nop
lea rcx, [rbp + 0x10]
call fcn.14001d140
lea rcx, [rsp + 0x58]
call fcn.140022680
nop
mov r8, rax
lea rdx, str.C:WindowsSystem32VolumeID.exe_G:
lea rcx, [rbp + 0x10]
call fcn.1400443a0
mov rcx, rax
call fcn.14001d130
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x10]
call fcn.14001d140
nop
lea rcx, [rsp + 0x58]
call fcn.14001d140
lea rdx, [rsp + 0x58]
call fcn.140028d80
mov rcx, rax
call fcn.140041a10
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rsp + 0x58]
call fcn.140028de0
mov rcx, rax
call fcn.140041a10
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Beep]
nop
lea rcx, [rbp + 0x188]
call fcn.14001d140
nop
lea rcx, [rbp + 0x168]
call fcn.14001d140
mov rcx, qword [rbp + 0x1a8]
xor rcx, rsp
call fcn.1400b4d80
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret