Function at 0x1400074b0
Capabilities:
Delete file
Execute command
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x140011040]
xor rax, rsp
mov qword [rbp + 0x1c8], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, str.C:ProgramDatacounter1.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:ProgramDatacounter2.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:ProgramData_front.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:ProgramData_back.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:ProgramData_right.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:ProgramDataleft.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:ProgramData_frontvar.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:ProgramData5555.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea rcx, [0x14000d9e0]
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x1400092dc
mov dword [rbp + 0x78], 0xbe8db292
mov dword [rbp + 0x7c], 0xe014a647
xor r14d, r14d
nop word [rax + rax]
lea rcx, str.C:ProgramDatacounter2.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:ProgramData_front.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:ProgramData_back.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:ProgramData_right.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:ProgramDataleft.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:ProgramData_frontvar.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:ProgramData_screen.txt
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:ProgramData_frontvar51.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.screen.txt
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [0x14000d9f4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x14000d9f4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r9d, 0x30
lea r8, [0x14000d9f8]
lea rdx, str._n_Eng___n_n_Press_ok_to_downloading______n_n__Thai___n_n
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x88], xmm1
mov rdi, r14
mov qword [rbp - 0x40], r14
mov qword [rbp + 0x98], r14
lea rcx, [rsp + 0x30]
call fcn.140001b40
lea rcx, [rbp + 0x88]
cmp rcx, rax
je 0x1400076bb
mov rsi, qword [rax]
mov qword [rbp + 0x88], rsi
mov r13, qword [rax + 8]
mov qword [rbp + 0x90], r13
mov rdi, qword [rax + 0x10]
mov qword [rbp - 0x40], rdi
mov qword [rbp + 0x98], rdi
mov qword [rax], r14
mov qword [rax + 8], r14
mov qword [rax + 0x10], r14
jmp 0x1400076c9
mov r13, qword [rbp + 0x90]
mov rsi, qword [rbp + 0x88]
mov qword [rbp - 0x48], rsi
mov qword [rbp], r13
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140007719
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007714
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000939d
call fcn.14000b4bc
cmp rsi, r13
jne 0x14000786f
call fcn.140001530
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9, rax
mov r8d, 8
lea rdx, [rbp + 0x78]
lea rcx, [rsp + 0x30]
call fcn.1400012b0
mov rbx, rax
lea rax, [rbp + 0x88]
cmp rax, rbx
je 0x1400077c9
test rsi, rsi
je 0x14000779e
sub rdi, rsi
sar rdi, 3
lea rdx, [rdi*8]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140007796
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400093a4
mov rcx, rsi
call fcn.14000b4bc
mov rax, qword [rbx]
mov qword [rbp + 0x88], rax
mov rax, qword [rbx + 8]
mov qword [rbp + 0x90], rax
mov rax, qword [rbx + 0x10]
mov qword [rbp + 0x98], rax
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140007811
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000780c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400093a4
call fcn.14000b4bc
lea rcx, [rbp + 0x88]
call fcn.140001800
lea rcx, str.attrib_h_s_C:ProgramDatacounter1.json
call fcn.1400073d0
lea rdx, [0x14000d5e1]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000ad80
mov rcx, rax
lea rdx, [0x14000af60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdi, qword [rbp + 0x98]
mov qword [rbp - 0x40], rdi
mov r13, qword [rbp + 0x90]
mov qword [rbp], r13
mov rsi, qword [rbp + 0x88]
mov qword [rbp - 0x48], rsi
jmp 0x140007892
lea rdx, [0x14000d5e1]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000ad80
mov rcx, rax
lea rdx, [0x14000af60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r12, rsi
mov qword [rbp + 0x60], rsi
cmp rsi, r13
je 0x140009288
mov dword [rbp + 0x80], 0x5f8c2ff2
mov dword [rbp + 0x84], 0xe014a647
nop word [rax + rax]
mov rdi, qword [r12]
mov dword [rbp + 0x1b4], 0
call fcn.140001530
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140007909
mov qword [rsp + 0x20], r14
mov r9d, 4
lea r8, [rbp + 0x1b4]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp + 0x178], 0x3f800000
lea rdx, [0x14000d9dc]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000ad80
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], r14
mov r9d, 4
lea r8, [rbp + 0x178]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa0], xmm1
mov rsi, r14
mov qword [rbp - 0x50], r14
mov qword [rbp + 0xb0], r14
lea rcx, [rsp + 0x30]
call fcn.1400021e0
lea rcx, [rbp + 0xa0]
cmp rcx, rax
je 0x1400079af
mov rdi, qword [rax]
mov qword [rbp + 0xa0], rdi
mov r15, qword [rax + 8]
mov qword [rbp + 0xa8], r15
mov rsi, qword [rax + 0x10]
mov qword [rbp - 0x50], rsi
mov qword [rbp + 0xb0], rsi
mov qword [rax], r14
mov qword [rax + 8], r14
mov qword [rax + 0x10], r14
jmp 0x1400079bd
mov r15, qword [rbp + 0xa8]
mov rdi, qword [rbp + 0xa0]
mov qword [rbp - 0x58], rdi
mov qword [rbp + 8], r15
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140007a0d
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007a08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400093ab
call fcn.14000b4bc
cmp rdi, r15
jne 0x140007b66
call fcn.140001530
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9, rax
mov r8d, 8
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x30]
call fcn.1400012b0
mov rbx, rax
lea rax, [rbp + 0xa0]
cmp rax, rbx
je 0x140007ac0
test rdi, rdi
je 0x140007a95
sub rsi, rdi
sar rsi, 3
lea rdx, [rsi*8]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140007a8d
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400093b2
mov rcx, rdi
call fcn.14000b4bc
mov rax, qword [rbx]
mov qword [rbp + 0xa0], rax
mov rax, qword [rbx + 8]
mov qword [rbp + 0xa8], rax
mov rax, qword [rbx + 0x10]
mov qword [rbp + 0xb0], rax
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140007b08
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007b03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400093b2
call fcn.14000b4bc
lea rcx, [rbp + 0xa0]
call fcn.140001f60
lea rcx, str.attrib_h_s_C:ProgramDatacounter2.json
call fcn.1400073d0
lea rdx, [0x14000d5e1]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000ad80
mov rcx, rax
lea rdx, [0x14000af60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rsi, qword [rbp + 0xb0]
mov qword [rbp - 0x50], rsi
mov r15, qword [rbp + 0xa8]
mov qword [rbp + 8], r15
mov rdi, qword [rbp + 0xa0]
mov qword [rbp - 0x58], rdi
jmp 0x140007b89
lea rdx, [0x14000d5e1]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000ad80
mov rcx, rax
lea rdx, [0x14000af60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r14, rdi
mov qword [rbp + 0x58], rdi
cmp rdi, r15
je 0x140009228
mov dword [rbp + 0x70], 0xae21ede8
mov dword [rbp + 0x74], 0xe014a647
nop word [rax + rax]
mov rdi, qword [r14]
mov dword [rbp + 0x17c], 0
call fcn.140001530
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
xor r12d, r12d
test rax, rax
je 0x140007bfb
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x17c]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp + 0x180], 0x40000000
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x180]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x148], xmm1
mov rsi, r12
mov qword [rbp - 0x60], r12
mov qword [rbp + 0x158], r12
lea rcx, [rsp + 0x30]
call fcn.1400027c0
lea rcx, [rbp + 0x148]
cmp rcx, rax
je 0x140007c8e
mov rdi, qword [rax]
mov qword [rbp + 0x148], rdi
mov r13, qword [rax + 8]
mov qword [rbp + 0x150], r13
mov rsi, qword [rax + 0x10]
mov qword [rbp - 0x60], rsi
mov qword [rbp + 0x158], rsi
mov qword [rax], r12
mov qword [rax + 8], r12
mov qword [rax + 0x10], r12
jmp 0x140007c9c
mov r13, qword [rbp + 0x150]
mov rdi, qword [rbp + 0x148]
mov qword [rbp - 0x68], rdi
mov qword [rbp + 0x10], r13
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140007cec
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007ce7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400093b9
call fcn.14000b4bc
cmp rdi, r13
jne 0x140007e42
call fcn.140001530
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9, rax
mov r8d, 8
lea rdx, [rbp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.1400012b0
mov rbx, rax
lea rax, [rbp + 0x148]
cmp rax, rbx
je 0x140007d9c
test rdi, rdi
je 0x140007d71
sub rsi, rdi
sar rsi, 3
lea rdx, [rsi*8]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140007d69
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400093c0
mov rcx, rdi
call fcn.14000b4bc
mov rax, qword [rbx]
mov qword [rbp + 0x148], rax
mov rax, qword [rbx + 8]
mov qword [rbp + 0x150], rax
mov rax, qword [rbx + 0x10]
mov qword [rbp + 0x158], rax
mov qword [rbx], r12
mov qword [rbx + 8], r12
mov qword [rbx + 0x10], r12
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140007de4
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007ddf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400093c0
call fcn.14000b4bc
lea rcx, [rbp + 0x148]
call fcn.140002540
lea rcx, str.attrib_h_s_C:ProgramData_front.json
call fcn.1400073d0
lea rdx, [0x14000d5e1]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000ad80
mov rcx, rax
lea rdx, [0x14000af60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rsi, qword [rbp + 0x158]
mov qword [rbp - 0x60], rsi
mov r13, qword [rbp + 0x150]
mov qword [rbp + 0x10], r13
mov rdi, qword [rbp + 0x148]
mov qword [rbp - 0x68], rdi
jmp 0x140007e65
lea rdx, [0x14000d5e1]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000ad80
mov rcx, rax
lea rdx, [0x14000af60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r12, rdi
mov qword [rbp + 0x50], rdi
cmp rdi, r13
je 0x1400091c6
mov dword [rsp + 0x48], 0xabf9c15c
mov dword [rsp + 0x4c], 0xe014a647
nop word [rax + rax]
mov rdi, qword [r12]
mov dword [rbp + 0x184], 0
call fcn.140001530
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
xor r14d, r14d
test rax, rax
je 0x140007edc
mov qword [rsp + 0x20], r14
mov r9d, 4
lea r8, [rbp + 0x184]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp + 0x1b0], 0x40400000
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], r14
mov r9d, 4
lea r8, [rbp + 0x1b0]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xb8], xmm1
mov rsi, r14
mov qword [rbp - 0x70], r14
mov qword [rbp + 0xc8], r14
lea rcx, [rsp + 0x30]
call fcn.140002da0
lea rcx, [rbp + 0xb8]
cmp rcx, rax
je 0x140007f6f
mov rdi, qword [rax]
mov qword [rbp + 0xb8], rdi
mov r15, qword [rax + 8]
mov qword [rbp + 0xc0], r15
mov rsi, qword [rax + 0x10]
mov qword [rbp - 0x70], rsi
mov qword [rbp + 0xc8], rsi
mov qword [rax], r14
mov qword [rax + 8], r14
mov qword [rax + 0x10], r14
jmp 0x140007f7d
mov r15, qword [rbp + 0xc0]
mov rdi, qword [rbp + 0xb8]
mov qword [rbp - 8], rdi
mov qword [rbp + 0x18], r15
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140007fcd
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007fc8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400093c7
call fcn.14000b4bc
cmp rdi, r15
jne 0x140008124
call fcn.140001530
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9, rax
mov r8d, 8
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x30]
call fcn.1400012b0
mov rbx, rax
lea rax, [rbp + 0xb8]
cmp rax, rbx
je 0x14000807e
test rdi, rdi
je 0x140008053
sub rsi, rdi
sar rsi, 3
lea rdx, [rsi*8]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14000804b
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400093ce
mov rcx, rdi
call fcn.14000b4bc
mov rax, qword [rbx]
mov qword [rbp + 0xb8], rax
mov rax, qword [rbx + 8]
mov qword [rbp + 0xc0], rax
mov rax, qword [rbx + 0x10]
mov qword [rbp + 0xc8], rax
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400080c6
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400080c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400093ce
call fcn.14000b4bc
lea rcx, [rbp + 0xb8]
call fcn.140002b20
lea rcx, str.attrib_h_s_C:ProgramData_back.json
call fcn.1400073d0
lea rdx, [0x14000d5e1]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000ad80
mov rcx, rax
lea rdx, [0x14000af60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rsi, qword [rbp + 0xc8]
mov qword [rbp - 0x70], rsi
mov r15, qword [rbp + 0xc0]
mov qword [rbp + 0x18], r15
mov rdi, qword [rbp + 0xb8]
mov qword [rbp - 8], rdi
jmp 0x140008147
lea rdx, [0x14000d5e1]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000ad80
mov rcx, rax
lea rdx, [0x14000af60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r14, rdi
mov qword [rbp + 0x48], rdi
cmp rdi, r15
je 0x140009164
mov dword [rbp - 0x80], 0x6c9f5742
mov dword [rbp - 0x7c], 0x7c5324ce
mov dword [rbp - 0x78], 0xdf91ab39
nop dword [rax]
mov rdi, qword [r14]
mov dword [rbp + 0x1ac], 0
call fcn.140001530
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
xor r12d, r12d
test rax, rax
je 0x1400081bb
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x1ac]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp + 0x1a8], 0x40800000
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x1a8]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xd0], xmm1
mov rsi, r12
mov qword [rbp - 0x10], r12
mov qword [rbp + 0xe0], r12
lea rcx, [rsp + 0x30]
call fcn.1400036e0
lea rcx, [rbp + 0xd0]
cmp rcx, rax
je 0x14000824e
mov rdi, qword [rax]
mov qword [rbp + 0xd0], rdi
mov r13, qword [rax + 8]
mov qword [rbp + 0xd8], r13
mov rsi, qword [rax + 0x10]
mov qword [rbp - 0x10], rsi
mov qword [rbp + 0xe0], rsi
mov qword [rax], r12
mov qword [rax + 8], r12
mov qword [rax + 0x10], r12
jmp 0x14000825c
mov r13, qword [rbp + 0xd8]
mov rdi, qword [rbp + 0xd0]
mov qword [rbp - 0x18], rdi
mov qword [rbp + 0x20], r13
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400082ac
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400082a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400093d5
call fcn.14000b4bc
cmp rdi, r13
jne 0x140008402
call fcn.140001530
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9, rax
mov r8d, 0xc
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x30]
call fcn.1400012b0
mov rbx, rax
lea rax, [rbp + 0xd0]
cmp rax, rbx
je 0x14000835c
test rdi, rdi
je 0x140008331
sub rsi, rdi
sar rsi, 3
lea rdx, [rsi*8]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140008329
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400093dc
mov rcx, rdi
call fcn.14000b4bc
mov rax, qword [rbx]
mov qword [rbp + 0xd0], rax
mov rax, qword [rbx + 8]
mov qword [rbp + 0xd8], rax
mov rax, qword [rbx + 0x10]
mov qword [rbp + 0xe0], rax
mov qword [rbx], r12
mov qword [rbx + 8], r12
mov qword [rbx + 0x10], r12
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400083a4
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000839f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400093dc
call fcn.14000b4bc
lea rcx, [rbp + 0xd0]
call fcn.140003100
lea rcx, str.attrib_h_s_C:ProgramData_right.json
call fcn.1400073d0
lea rdx, [0x14000d5e1]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000ad80
mov rcx, rax
lea rdx, [0x14000af60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rsi, qword [rbp + 0xe0]
mov qword [rbp - 0x10], rsi
mov r13, qword [rbp + 0xd8]
mov qword [rbp + 0x20], r13
mov rdi, qword [rbp + 0xd0]
mov qword [rbp - 0x18], rdi
jmp 0x140008425
lea rdx, [0x14000d5e1]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000ad80
mov rcx, rax
lea rdx, [0x14000af60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r12, rdi
mov qword [rbp + 0x40], rdi
cmp rdi, r13
je 0x140009102
mov qword [rsp + 0x70], 0x492c3089
mov dword [rsp + 0x78], 0xdf91ab39
nop word [rax + rax]
mov rdi, qword [r12]
mov dword [rbp + 0x190], 0
call fcn.140001530
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
xor r14d, r14d
test rax, rax
je 0x14000849c
mov qword [rsp + 0x20], r14
mov r9d, 4
lea r8, [rbp + 0x190]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp + 0x1a4], 0x40a00000
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], r14
mov r9d, 4
lea r8, [rbp + 0x1a4]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xe8], xmm1
mov rsi, r14
mov qword [rbp - 0x20], r14
mov qword [rbp + 0xf8], r14
lea rcx, [rsp + 0x30]
call fcn.140004380
lea rcx, [rbp + 0xe8]
cmp rcx, rax
je 0x14000852f
mov rdi, qword [rax]
mov qword [rbp + 0xe8], rdi
mov r15, qword [rax + 8]
mov qword [rbp + 0xf0], r15
mov rsi, qword [rax + 0x10]
mov qword [rbp - 0x20], rsi
mov qword [rbp + 0xf8], rsi
mov qword [rax], r14
mov qword [rax + 8], r14
mov qword [rax + 0x10], r14
jmp 0x14000853d
mov r15, qword [rbp + 0xf0]
mov rdi, qword [rbp + 0xe8]
mov qword [rbp - 0x28], rdi
mov qword [rbp + 0x28], r15
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000858d
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008588
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400093e3
call fcn.14000b4bc
cmp rdi, r15
jne 0x1400086e4
call fcn.140001530
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9, rax
mov r8d, 0xc
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.1400012b0
mov rbx, rax
lea rax, [rbp + 0xe8]
cmp rax, rbx
je 0x14000863e
test rdi, rdi
je 0x140008613
sub rsi, rdi
sar rsi, 3
lea rdx, [rsi*8]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14000860b
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400093ea
mov rcx, rdi
call fcn.14000b4bc
mov rax, qword [rbx]
mov qword [rbp + 0xe8], rax
mov rax, qword [rbx + 8]
mov qword [rbp + 0xf0], rax
mov rax, qword [rbx + 0x10]
mov qword [rbp + 0xf8], rax
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140008686
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008681
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400093ea
call fcn.14000b4bc
lea rcx, [rbp + 0xe8]
call fcn.140003a40
lea rcx, str.attrib_h_s_C:ProgramDataleft.json
call fcn.1400073d0
lea rdx, [0x14000d5e1]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000ad80
mov rcx, rax
lea rdx, [0x14000af60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rsi, qword [rbp + 0xf8]
mov qword [rbp - 0x20], rsi
mov r15, qword [rbp + 0xf0]
mov qword [rbp + 0x28], r15
mov rdi, qword [rbp + 0xe8]
mov qword [rbp - 0x28], rdi
jmp 0x140008707
lea rdx, [0x14000d5e1]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000ad80
mov rcx, rax
lea rdx, [0x14000af60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r14, rdi
mov qword [rbp + 0x38], rdi
cmp rdi, r15
je 0x1400090a0
mov dword [rsp + 0x60], 0x2e9813c7
mov dword [rsp + 0x64], 0x7c5324ce
mov dword [rsp + 0x68], 0x96dd58da
nop
mov rdi, qword [r14]
mov dword [rbp + 0x1a0], 0
call fcn.140001530
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
xor r12d, r12d
test rax, rax
je 0x14000877b
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x1a0]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp + 0x18c], 0x40c00000
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x18c]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x100], xmm1
mov rsi, r12
mov qword [rbp - 0x30], r12
mov qword [rbp + 0x110], r12
lea rcx, [rsp + 0x30]
call fcn.140004be0
lea rcx, [rbp + 0x100]
cmp rcx, rax
je 0x14000880e
mov rdi, qword [rax]
mov qword [rbp + 0x100], rdi
mov rbx, qword [rax + 8]
mov qword [rbp + 0x108], rbx
mov rsi, qword [rax + 0x10]
mov qword [rbp - 0x30], rsi
mov qword [rbp + 0x110], rsi
mov qword [rax], r12
mov qword [rax + 8], r12
mov qword [rax + 0x10], r12
jmp 0x14000881c
mov rbx, qword [rbp + 0x108]
mov rdi, qword [rbp + 0x100]
mov qword [rbp - 0x38], rdi
mov qword [rbp + 0x30], rbx
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000886c
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008867
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400093f1
call fcn.14000b4bc
cmp rdi, rbx
jne 0x1400089c3
call fcn.140001530
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9, rax
mov r8d, 0xc
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.1400012b0
mov rbx, rax
lea rax, [rbp + 0x100]
cmp rax, rbx
je 0x14000891d
test rdi, rdi
je 0x1400088f2
sub rsi, rdi
sar rsi, 3
lea rdx, [rsi*8]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400088ea
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400093f8
mov rcx, rdi
call fcn.14000b4bc
mov rax, qword [rbx]
mov qword [rbp + 0x100], rax
mov rax, qword [rbx + 8]
mov qword [rbp + 0x108], rax
mov rax, qword [rbx + 0x10]
mov qword [rbp + 0x110], rax
mov qword [rbx], r12
mov qword [rbx + 8], r12
mov qword [rbx + 0x10], r12
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140008965
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008960
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400093f8
call fcn.14000b4bc
lea rcx, [rbp + 0x100]
call fcn.140004960
lea rcx, str.attrib_h_s_C:ProgramData_frontvar.json
call fcn.1400073d0
lea rdx, [0x14000d5e1]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000ad80
mov rcx, rax
lea rdx, [0x14000af60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rsi, qword [rbp + 0x110]
mov qword [rbp - 0x30], rsi
mov rbx, qword [rbp + 0x108]
mov qword [rbp + 0x30], rbx
mov rdi, qword [rbp + 0x100]
mov qword [rbp - 0x38], rdi
jmp 0x1400089e6
lea rdx, [0x14000d5e1]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000ad80
mov rcx, rax
lea rdx, [0x14000af60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, rdi
mov qword [rbp + 0x68], rax
cmp rdi, rbx
je 0x14000903e
mov dword [rsp + 0x50], 0x2e9813c7
mov dword [rsp + 0x54], 0x7c5324ce
mov dword [rsp + 0x58], 0x56e6cdf8
nop
mov rdi, qword [rax]
mov dword [rbp + 0x188], 0
call fcn.140001530
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
xor esi, esi
test rax, rax
je 0x140008a5a
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rbp + 0x188]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp + 0x19c], 0x40e00000
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rbp + 0x19c]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x118], xmm1
mov r13, rsi
mov qword [rbp + 0x128], rsi
lea rcx, [rsp + 0x30]
call fcn.140003cc0
lea rcx, [rbp + 0x118]
cmp rcx, rax
je 0x140008ae5
mov r12, qword [rax]
mov qword [rbp + 0x118], r12
mov r15, qword [rax + 8]
mov qword [rbp + 0x120], r15
mov r13, qword [rax + 0x10]
mov qword [rbp + 0x128], r13
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
jmp 0x140008af3
mov r15, qword [rbp + 0x120]
mov r12, qword [rbp + 0x118]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140008b3b
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008b36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400093ff
call fcn.14000b4bc
cmp r12, r15
jne 0x140008c87
call fcn.140001530
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9, rax
mov r8d, 0xc
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.1400012b0
mov rbx, rax
lea rax, [rbp + 0x118]
cmp rax, rbx
je 0x140008bed
test r12, r12
je 0x140008bc2
sub r13, r12
sar r13, 3
lea rdx, [r13*8]
mov rax, r12
cmp rdx, 0x1000
jb 0x140008bba
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009406
mov rcx, r12
call fcn.14000b4bc
mov rax, qword [rbx]
mov qword [rbp + 0x118], rax
mov rax, qword [rbx + 8]
mov qword [rbp + 0x120], rax
mov rax, qword [rbx + 0x10]
mov qword [rbp + 0x128], rax
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], rsi
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140008c35
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008c30
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009406
call fcn.14000b4bc
lea rcx, [rbp + 0x118]
call fcn.140004960
lea rcx, str.attrib_h_s_C:ProgramData_frontvar.json
call fcn.1400073d0
lea rdx, [0x14000d5e1]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000ad80
mov rcx, rax
lea rdx, [0x14000af60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r13, qword [rbp + 0x128]
mov r15, qword [rbp + 0x120]
mov r12, qword [rbp + 0x118]
jmp 0x140008caa
lea rdx, [0x14000d5e1]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000ad80
mov rcx, rax
lea rdx, [0x14000af60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r14, r12
cmp r12, r15
je 0x140008fd6
mov dword [rbp + 0x1b8], 0x2e9813c7
mov dword [rbp + 0x1bc], 0x7c5324ce
mov dword [rbp + 0x1c0], 0x38e71fc7
jmp 0x140008ce2
xor esi, esi
mov rdi, qword [r14]
mov dword [rbp + 0x198], 0
call fcn.140001530
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140008d2a
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rbp + 0x198]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp + 0x194], 0x41000000
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rbp + 0x194]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x130], xmm1
mov rdi, rsi
mov qword [rbp + 0x140], rsi
lea rcx, [rsp + 0x30]
call fcn.140004020
lea rcx, [rbp + 0x130]
cmp rcx, rax
je 0x140008db7
mov rbx, qword [rax]
mov qword [rbp + 0x130], rbx
mov rsi, qword [rax + 8]
mov qword [rbp + 0x138], rsi
mov rdi, qword [rax + 0x10]
mov qword [rbp + 0x140], rdi
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
jmp 0x140008dc5
mov rsi, qword [rbp + 0x138]
mov rbx, qword [rbp + 0x130]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140008e0d
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008e08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000940d
call fcn.14000b4bc
cmp rbx, rsi
jne 0x140008f5c
call fcn.140001530
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9, rax
mov r8d, 0xc
lea rdx, [rbp + 0x1b8]
lea rcx, [rsp + 0x30]
call fcn.1400012b0
mov rsi, rax
lea rax, [rbp + 0x130]
cmp rax, rsi
je 0x140008ec2
test rbx, rbx
je 0x140008e95
sub rdi, rbx
sar rdi, 3
lea rdx, [rdi*8]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140008e8d
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009414
mov rcx, rbx
call fcn.14000b4bc
mov rax, qword [rsi]
mov qword [rbp + 0x130], rax
mov rax, qword [rsi + 8]
mov qword [rbp + 0x138], rax
mov rax, qword [rsi + 0x10]
mov qword [rbp + 0x140], rax
xor eax, eax
mov qword [rsi], rax
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140008f0a
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008f05
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009414
call fcn.14000b4bc
lea rcx, [rbp + 0x130]
call fcn.140004960
lea rcx, str.attrib_h_s_C:ProgramData_frontvar.json
call fcn.1400073d0
lea rdx, [0x14000d5e1]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000ad80
mov rcx, rax
lea rdx, [0x14000af60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdi, qword [rbp + 0x140]
mov rsi, qword [rbp + 0x138]
mov rbx, qword [rbp + 0x130]
jmp 0x140008f7f
lea rdx, [0x14000d5e1]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000ad80
mov rcx, rax
lea rdx, [0x14000af60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp rbx, rsi
jne 0x140009422
test rbx, rbx
je 0x140008fc9
sub rdi, rbx
sar rdi, 3
lea rdx, [rdi*8]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140008fc1
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000941b
mov rcx, rbx
call fcn.14000b4bc
add r14, 8
cmp r14, r15
jne 0x140008ce0
test r12, r12
je 0x140009018
sub r13, r12
sar r13, 3
lea rdx, [r13*8]
mov rax, r12
cmp rdx, 0x1000
jb 0x140009010
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009a8d
mov rcx, r12
call fcn.14000b4bc
mov rax, qword [rbp + 0x68]
add rax, 8
mov qword [rbp + 0x68], rax
cmp rax, qword [rbp + 0x30]
jne 0x140008a10
mov rdi, qword [rbp - 0x38]
mov rsi, qword [rbp - 0x30]
mov r14, qword [rbp + 0x38]
mov r15, qword [rbp + 0x28]
test rdi, rdi
je 0x14000907f
sub rsi, rdi
sar rsi, 3
lea rdx, [rsi*8]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140009077
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009a94
mov rcx, rdi
call fcn.14000b4bc
add r14, 8
mov qword [rbp + 0x38], r14
cmp r14, r15
jne 0x140008730
mov rdi, qword [rbp - 0x28]
mov rsi, qword [rbp - 0x20]
mov r12, qword [rbp + 0x40]
mov r13, qword [rbp + 0x20]
test rdi, rdi
je 0x1400090e1
sub rsi, rdi
sar rsi, 3
lea rdx, [rsi*8]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400090d9
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009a9b
mov rcx, rdi
call fcn.14000b4bc
add r12, 8
mov qword [rbp + 0x40], r12
cmp r12, r13
jne 0x140008450
mov rdi, qword [rbp - 0x18]
mov rsi, qword [rbp - 0x10]
mov r14, qword [rbp + 0x48]
mov r15, qword [rbp + 0x18]
test rdi, rdi
je 0x140009143
sub rsi, rdi
sar rsi, 3
lea rdx, [rsi*8]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14000913b
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009aa2
mov rcx, rdi
call fcn.14000b4bc
add r14, 8
mov qword [rbp + 0x48], r14
cmp r14, r15
jne 0x140008170
mov rdi, qword [rbp - 8]
mov rsi, qword [rbp - 0x70]
mov r12, qword [rbp + 0x50]
mov r13, qword [rbp + 0x10]
test rdi, rdi
je 0x1400091a5
sub rsi, rdi
sar rsi, 3
lea rdx, [rsi*8]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14000919d
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009aa9
mov rcx, rdi
call fcn.14000b4bc
add r12, 8
mov qword [rbp + 0x50], r12
cmp r12, r13
jne 0x140007e90
mov rdi, qword [rbp - 0x68]
mov rsi, qword [rbp - 0x60]
mov r14, qword [rbp + 0x58]
mov r15, qword [rbp + 8]
test rdi, rdi
je 0x140009207
sub rsi, rdi
sar rsi, 3
lea rdx, [rsi*8]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400091ff
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009ab0
mov rcx, rdi
call fcn.14000b4bc
add r14, 8
mov qword [rbp + 0x58], r14
cmp r14, r15
jne 0x140007bb0
mov rdi, qword [rbp - 0x58]
mov rsi, qword [rbp - 0x50]
mov r12, qword [rbp + 0x60]
mov r13, qword [rbp]
test rdi, rdi
je 0x140009269
sub rsi, rdi
sar rsi, 3
lea rdx, [rsi*8]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140009261
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009ab7
mov rcx, rdi
call fcn.14000b4bc
add r12, 8
mov qword [rbp + 0x60], r12
cmp r12, r13
mov r14d, 0
jne 0x1400078c0
mov rdi, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x48]
test rsi, rsi
je 0x1400092c4
sub rdi, rsi
and rdi, 0xfffffffffffffff8
mov rax, rsi
cmp rdi, 0x1000
jb 0x1400092b9
add rdi, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009abe
mov rdx, rdi
mov rcx, rsi
call fcn.14000b4bc
xor edx, edx
lea rcx, [0x14000d9e0]
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x1400075b0
lea rcx, [0x14000d9f4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:ProgramDatacounter1.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:ProgramDatacounter2.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:ProgramData_front.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:ProgramData_back.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:ProgramData_right.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:ProgramDataleft.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:ProgramData_frontvar.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov r9d, 0x10
lea r8, [0x14000d9f8]
lea rdx, [0x14000da00]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov rcx, qword [rbp + 0x1c8]
xor rcx, rsp
call fcn.14000b460
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r14, qword [rbx]
mov dword [rbp + 0x70], 0
call fcn.140001530
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140009468
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x70]
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp + 0x80], 0x41100000
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x80]
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rbp + 0x1b8], 0x8600100
mov dword [rbp + 0x1c0], 0
mov word [rbp + 0x1c4], 0xea68
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x160], xmm1
xor r14d, r14d
mov qword [rbp + 0x170], r14
lea rcx, [rsp + 0x30]
call fcn.140003380
xor edx, edx
mov r15d, edx
mov esi, edx
lea rcx, [rbp + 0x160]
cmp rcx, rax
je 0x14000951a
mov rsi, qword [rax]
mov qword [rbp + 0x160], rsi
mov r15, qword [rax + 8]
mov qword [rbp + 0x168], r15
mov r14, qword [rax + 0x10]
mov qword [rbp + 0x170], r14
mov qword [rax], rdx
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rdx
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140009565
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009560
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009560
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b4bc
cmp rsi, r15
jne 0x1400098ca
call fcn.140001530
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
jne 0x140009882
lea rdx, [0x14000d5e1]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ad80
mov rcx, rax
lea rdx, [0x14000af60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
test rsi, rsi
je 0x1400095ee
sub r14, rsi
sar r14, 3
lea rdx, [r14*8]
cmp rdx, 0x1000
jb 0x1400095e5
add rdx, 0x27
mov rcx, qword [rsi - 8]
sub rsi, rcx
lea rax, [rsi - 8]
cmp rax, 0x1f
ja 0x140009625
mov rsi, rcx
mov rcx, rsi
call fcn.14000b4bc
nop
sub rdi, rbx
sar rdi, 3
lea rdx, [rdi*8]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000962c
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000962c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, rbx
call fcn.14000b4bc
nop
test r12, r12
je 0x14000967b
sub r13, r12
sar r13, 3
lea rdx, [r13*8]
mov rax, r12
cmp rdx, 0x1000
jb 0x140009672
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009672
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r12
call fcn.14000b4bc
nop
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x1400096c5
mov rdx, qword [rbp - 0x30]
sub rdx, rcx
sar rdx, 3
lea rdx, [rdx*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400096bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400096bf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b4bc
nop
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x14000970f
mov rdx, qword [rbp - 0x20]
sub rdx, rcx
sar rdx, 3
lea rdx, [rdx*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009709
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009709
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b4bc
nop
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140009759
mov rdx, qword [rbp - 0x10]
sub rdx, rcx
sar rdx, 3
lea rdx, [rdx*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009753
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009753
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b4bc
nop
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x1400097a3
mov rdx, qword [rbp - 0x70]
sub rdx, rcx
sar rdx, 3
lea rdx, [rdx*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000979d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000979d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b4bc
nop
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400097ed
mov rdx, qword [rbp - 0x60]
sub rdx, rcx
sar rdx, 3
lea rdx, [rdx*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400097e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400097e7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b4bc
nop
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x140009837
mov rdx, qword [rbp - 0x50]
sub rdx, rcx
sar rdx, 3
lea rdx, [rdx*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009831
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009831
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b4bc
nop
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x140009878
mov rdx, qword [rbp - 0x40]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009873
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009873
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b4bc
mov eax, 1
jmp 0x14000936d
mov r9, rax
mov r8d, 0xe
lea rdx, [rbp + 0x1b8]
lea rcx, [rsp + 0x30]
call fcn.1400012b0
mov rdx, rax
lea rcx, [rbp + 0x160]
call fcn.14000a810
lea rcx, [rsp + 0x30]
call fcn.14000a7b0
lea rcx, [rbp + 0x160]
call fcn.1400046e0
lea rdx, [0x14000d5e1]
jmp 0x1400098d1
lea rdx, str.Please_wait_for_the_script_to_install
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000ad80
lea rdx, [0x14000af60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r14b, 1
xor r15d, r15d
mov edi, r15d
lea rcx, [rbp + 0x160]
call fcn.14000a7a0
test rax, rax
je 0x140009a21
nop dword [rax + rax]
mov dword [rbp + 0x78], r15d
call fcn.140001530
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
jne 0x140009959
lea rdx, [0x14000d5e1]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ad80
mov rcx, rax
lea rdx, [0x14000af60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400099e6
mov rdx, rdi
lea rcx, [rbp + 0x160]
call fcn.14000a790
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp + 0x78]
mov rdx, qword [rax]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [rbp + 0x1b8], 0x1304100
mov dword [rbp + 0x1c0], r15d
mov word [rbp + 0x1c4], 0xea68
mov rdx, rdi
lea rcx, [rbp + 0x160]
call fcn.14000a790
mov qword [rsp + 0x20], r15
mov r9d, 0xe
lea r8, [rbp + 0x1b8]
mov rdx, qword [rax]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, r15d
movzx ecx, r14b
test ebx, ebx
cmovne edx, ecx
movzx r14d, dl
inc rdi
lea rcx, [rbp + 0x160]
call fcn.14000a7a0
cmp rdi, rax
jb 0x140009910
test r14b, r14b
jne 0x140009a21
mov r9d, 0x10
lea r8, str.Notification
lea rdx, str.Failed_to_complete_Install_Step__________________.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140009a2e
lea rcx, [0x14000d9f4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x3e8
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
call fcn.140004f40
call fcn.140005350
call fcn.140005760
call fcn.140005b70
call fcn.140005f80
call fcn.140006390
call fcn.1400067a0
call fcn.140006bb0
call fcn.140006fc0
mov r9d, 0x20
lea r8, [0x14000d9f8]
lea rdx, str._n_Eng___n_n_Success______n_n__Thai___n_n
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3