Function at 0x140120140
Capabilities:
Reference http user-agent string

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x760]
sub rsp, 0x860
mov rax, qword [0x14026d4b8]
xor rax, rsp
mov qword [rbp + 0x758], rax
mov r15, rdx
mov qword [rbp + 0x3a0], rdx
mov rsi, rcx
mov qword [rbp + 0x600], rdx
xor r12d, r12d
mov dword [rsp + 0x30], r12d
mov r14d, r12d
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x44], r12d
mov rcx, rdx
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_void____ptr64]
mov dword [rsp + 0x30], 1
cmp dword [rsi], r12d
je 0x140124d72
lea edx, [r12 + 0x17]
lea rcx, str.Windows_Update_Disabled
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x158], rax
lea edx, [r12 + 0xc]
lea rcx, str.Antidetect_4
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x150], rax
lea edx, [r12 + 9]
lea rcx, str.logo2.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x148], rax
lea edx, [r12 + 0x15]
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x48], rax
mov dl, 0x20
lea rcx, [rbp + 0x310]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x148]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0x312]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x150]
lea rdx, [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0x314]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x158]
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
lea r8d, [r12 - 1]
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp + 0x28]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x30], 5
mov rdx, rbx
lea rcx, [rbp + 0x28]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
mov dword [rsp + 0x30], 3
lea rcx, [rbp - 0x80]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea r8d, [r12 - 1]
lea rdx, str._MY_VBOX_ADDITIONS_etcwubwub.exe__D__P_
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov r13d, 0xb
mov dword [rsp + 0x30], r13d
lea rdx, [rbp + 0x28]
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
lea r8, str.__timeout_5___nul_r_n
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x3e0]
call fcn.140019700
nop
mov dword [rsp + 0x30], 3
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x28]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x148]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x150]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x158]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea edx, [r12 + 0x44]
lea rcx, str.Now_we_will_make_few_Privacy__Security_improvements_to_your_System.
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x180], rax
lea edx, [r12 + 3]
lea rcx, [0x1401b62f8]
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x178], rax
lea edx, [r12 + 9]
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x170], rax
lea edx, [r12 + 0x15]
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x160], rax
mov dl, 0x20
lea rcx, [rbp + 0x316]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x170]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x160]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x178]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0x3a]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x180]
lea rdx, [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
lea r8d, [r12 - 1]
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp - 0x20]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x30], 0x43
mov rdx, rbx
lea rcx, [rbp - 0x20]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
mov edi, 0x23
mov dword [rsp + 0x30], edi
lea rcx, [rsp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x160]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea edx, [rdi + 0x50]
lea rcx, str.xcopy__e__y__i__MY_VBOX_ADDITIONS_etcWinHard___userprofile_DocumentsWindowsPowerShellmodulesWinHard____nul_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x168], rax
lea rdx, [rbp + 0x168]
lea rcx, [rbp - 0x28]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x30], 0xa3
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x28]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
lea r8, str.__timeout_4___nul__powershell__File___userprofile_DocumentsWindowsPowerShellmodulesWinHardWinHard.ps1___timeout_5___nul_
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x558]
call fcn.140019700
nop
mov dword [rsp + 0x30], edi
lea rcx, [rbp - 0x28]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x168]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x20]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x170]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x178]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x180]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_void____ptr64]
nop
mov edx, 0x1cd
lea rcx, str.title_PLEASE_DONT_CLOSE_THIS_WINDOW__type__MY_VBOX_ADDITIONS__ascii.art__net_accounts__maxpwage:unlimited___nul__powercfg__SETACVALUEINDEX_SCHEME_CURRENT_7516b95f_f776_4464_8c53_06167f40cc99_3c0bc021_c8a8_4e07_a973_6b14cbcb2b7e_0__powercfg__SETDCVALUEINDEX_SCHEME_CURRENT_7516b95f_f776_4464_8c53_06167f40cc99_3c0bc021_c8a8_4e07_a973_6b14cbcb2b7e_0__explorer__MY_VBOX_ADDITIONS_etcqresqres.cmd__powershell__Set_ExecutionPolicy_Bypass__Force___echo._
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x188], rax
lea rdx, [rbp + 0x188]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x188]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, str.powershell__.____ScriptBlock_::Create___IO.StreamReader_::new___IO.Compression.GZipStream_::new__IO.MemoryStream_::new__Convert_::FromBase64String_H4sIAAAAAAAEAKVWa1PaUBDdn5JxbCMqqH34wQ4zpViRqYojPj6AdTAESMtrSOKr9r_37Lk3kAh0xnbuEHJ37753z00gHVmThtzKCKsv19hVxJdI8lIGZYDVkqG0xQHlq0ywRviVxMOZAO9DcKrSxb_SfZ47l0cZ872E_zH0BjjfSkmEOBFi79OC0gLsVEMO65esQqoormzJJTgT8GLI9ULzjyAWsHep4YqZDugbklN6ni68gnSMXg5IqpeI5wyqOWC8t9livp8c0Hv4Ys_MCbRubQhxspQGeA6FU6kJ_gurKO3UfZxnLlN7xVe0wtCrHiEr9ubOWkngL5GTzWUCWRtAewXoASheeGl2P0NUAZ5ahAmR7kJugPntYKnnBzKrva8xWQ3bBVQ0noN7Dx6qVduDnoXxDBMeQbUJzTQ6g4wrVOUNNm6BrfbSyIX4dyDXBDejnCLpC6DiBRBNxOwBH7wItVH7oY0ykelj17WUOn30QNe8a9d44MSUDsFPKqHZ1Whd9s8BO8ED53kumlP6aSKPkCM9fwLtA_bbrPKFFDU_JzXrUFf2oV_tta31S_oak7s9508NnIg2Y5zq24ptsP5P7JcYfZStqFUmU8f_Vvj1Lkvcuyieg40aRSHrEVkpfRNu0Y9qC7tnQKz3eckqfY8NTYQwzV4R6xZF7yebMLGO0qoniPaN52U694dGJmUbhTVHGX2N8ARydq4x9sGQRJ5xxqZXXa58h3d8srEN_OhZHPrzAn2doGqJ2t8iCvxCDkokvc2LubIdqXfLwVWcn5ryl_daeLEHFHpapJ3T8h6me3ZrD_1pWho5qSFXTidCKNPNTwQS0OcD3lSczbmLGRx8_W5XnxHuLwJEp8iTvEd4cL3LhnRdbsW46nFWX1pEdMD7GvsIYxtIeYgx3OwWy6NSqPuW1bPDMoVZxiTjayLCIfcyJbiMwnygw5rSVmZESUn6H_KWTLCyw5zMo8Ym3avOesjx7vQpXX2regRSujmF5G9Zq2d0LOmo_9d3mT8faMcxiRfpPhvEfv3kD_gKiiVfHZwXUizoSdYrDTY05D21sBLZnK9EBbgZ83ePCD_ASYP8K5RYHP3i_JvuniDWeJrZ5H5QS1uQcmxeHOw6eL7NUO7w1Jyo3rGtkdI1a7v27t4hRTXqHVhBFvaBxzXs9q1W4_kVJyyy98zI9kYauZVzxigCRqPdUreI3WYW2_bWMPOiHTzk7WGwYkRq0cbwgOdnzkV3o0zfnF7uewQl30T2Z35CkiQtwSbA_po8jZhpRI821xyUbwPfMHv6RiOxIKAAA____IO.Compression.CompressionMode_Decompress____Text.Encoding_::unicode__.ReadToEnd______r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.reg.exe_add_HKLMSoftwarePoliciesMicrosoftWindowsOneDrive__v_DisableFileSyncNGSC__t_REG_DWORD__d_1__f___nul_2_1__reg.exe_delete_HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun__v_OneDriveSetup__f___nul_2_1_
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.reg_add__HKLMSoftwarePoliciesMicrosoftWindows_NTSystemRestore___v_DisableSR__t_REG_DWORD__d_1__f___nul_2_1_
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str._reg.exe_query_HKCUSoftwarePoliciesMicrosoftWindowsExplorer___nul_2_1__reg.exe_add_HKCUSoftwarePoliciesMicrosoftWindowsExplorer___nul_2_1___reg.exe_add_HKCUSoftwarePoliciesMicrosoftWindowsExplorer__v_DisableSearchBoxSuggestions__t_REG_DWORD__d_1__f___nul_2_1_
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.setx__m_MESA_GL_VERSION_OVERRIDE_4.6_nul__setx__m_MESA_GLES_VERSION_OVERRIDE_3.1_nul__setx__m_MESA_GLSL_VERSION_OVERRIDE_460_nul_
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, [rsi + 0x20]
lea rcx, [rbp + 0x240]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
nop
mov rax, qword [rbp + 0x240]
cmp dword [rax + 4], r12d
je 0x1401207b0
lea r8d, [r12 - 1]
lea rdx, str.setx__m_MESA_RENDERER__
lea rcx, [rbp - 0x10]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x30], 0x223
lea rdx, [rbp + 0x240]
lea rcx, [rbp - 0x10]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x18]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x30], 0x623
lea r8d, [r12 - 1]
lea rdx, [0x1401b6e88]
lea rcx, [rbp + 0x270]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp - 0x18]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x270]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp - 0x18]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x18]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov dword [rsp + 0x30], edi
lea rcx, [rbp - 0x10]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea r8d, [r12 - 1]
lea rdx, str.set_MESA_RENDERER
lea rcx, [rbp]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x30], 0x823
lea rdx, [rbp + 0x240]
lea rcx, [rbp]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp]
lea rcx, [rbp - 8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x30], 0x1823
lea r8d, [r12 - 1]
lea rdx, [0x1401b6eb0]
lea rcx, [rbp + 0x268]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp - 8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x268]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp - 8]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp - 8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov dword [rsp + 0x30], edi
lea rcx, [rbp]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 0xa], 0
je 0x140120906
lea rdx, str.echo_Installing_FakeGPS_r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.pushd__MY_VBOX_ADDITIONS_etcFakeGPS____setlocal_enabledelayedexpansion__devcon_install_bcmgnssd_bcmgnssd.inf_root_bcmgnssd___nul____for__f___i_in__devcon_find_root_bcmgnssd__find__ROOT___do__set_GNSSREGPATH_HKLMSYSTEMCurrentControlSetEnum__iDevice_Parameters__
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
mov edx, 0x3b
lea rcx, str.reg_add__GNSSREGPATH___v_Lat__t_REG_DWORD__d__1__f___nul_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x190], rax
mov dl, 0x20
lea rcx, [rbp + 0x3c]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov r8d, dword [rsi + 0x60]
xor r8d, 0x5f3759df
mov word [rsp + 0x28], ax
mov dword [rsp + 0x20], 0xa
xor r9d, r9d
lea rdx, [rbp + 0x260]
lea rcx, [rbp + 0x190]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_unsigned_int__int__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x260]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x190]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov edx, 0x3c
lea rcx, str.reg_add__GNSSREGPATH___v_Long__t_REG_DWORD__d__1__f___nul_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x198], rax
mov dl, 0x20
lea rcx, [rbp + 0x3e]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov r8d, dword [rsi + 0x64]
xor r8d, 0x5f3759df
mov word [rsp + 0x28], ax
mov dword [rsp + 0x20], 0xa
xor r9d, r9d
lea rdx, [rbp + 0x258]
lea rcx, [rbp + 0x198]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_unsigned_int__int__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x258]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x198]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, str.reg_add_HKLMSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStorelocation__v_Value__t_REG_SZ__d_Allow__f___nul__reg_add_HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStorelocation__v_Value__t_REG_SZ__d_Allow__f___nul
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.____endlocal___popd_r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
mov edx, 0x8b
lea rcx, str.xcopy__e__y__i__MY_VBOX_ADDITIONS_etcBurntToast___userprofile_DocumentsWindowsPowerShellmodulesBurntToast____nul__timeout_2___nul_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1a0], rax
lea rdx, [rbp + 0x1a0]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 0xd], 0
je 0x140120969
lea rdx, str.pushd__MY_VBOX_ADDITIONS_etcFonts__powershell__encodedCommand_QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwANAAoARgBvAHIARQBhAGMAaAAoACQAZgBvAG4AdABkAGkAcgAgAGkAbgAgAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAtAEQAaQByAGUAYwB0AG8AcgB5ACkADQAKAHsADQAKACAAIAAgACAAJABmAG8AbgB0AHMAIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACIAJABmAG8AbgB0AGQAaQByAFwAKgAiACAALQBJAG4AYwBsAHUAZABlACAAJwAqAC4AdAB0AGYAJwAsACcAKgAuAG8AdABmACcAIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAAewBHAGUAdAAtAFIAYQBuAGQAbwBtAH0AIAB8ACAAUwBlAGwAZQBjAHQAIAAtAEYAaQByAHMAdAAgACgARwBlAHQALQBSAGEAbgBkAG8AbQAgACAALQBNAGkAbgAgADEAMAAgAC0ATQBhAHgAIAAyADAAKQANAAoAIAAgACAAIABGAG8AcgBFAGEAYwBoACgAJABmAG8AbgB0AGYAaQBsAGUAIABpAG4AIAAkAGYAbwBuAHQAcwApAA0ACgAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGYAbwBuAHQAQwBvAGwAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBUAGUAeAB0AC4AUAByAGkAdgBhAHQAZQBGAG8AbgB0AEMAbwBsAGwAZQBjAHQAaQBvAG4AXQA6ADoAbgBlAHcAKAApAA0ACgAgACAAIAAgACAAIAAgACAAJABmAG8AbgB0AEMAbwBsAC4AQQBkAGQARgBvAG4AdABGAGkAbABlACgAJABmAG8AbgB0AGYAaQBsAGUAKQANAAoAIAAgACAAIAAgACAAIAAgACQAZgBvAG4AdABuAGEAbQBlACAAPQAgAFsAUwB0AHIAaQBuAGcAWwBdAF0AJABmAG8AbgB0AEMAbwBsAC4ARgBhAG0AaQBsAGkAZQBzAC4ATgBhAG0AZQANAAoAIAAgACAAIAAgACAAIAAgACQAZgBvAG4AdABDAG8AbAAuAEQAaQBzAHAAbwBzAGUAKAApAA0ACgAgACAAIAAgACAAIAAgACAAaQBmACgAJABmAG8AbgB0AG4AYQBtAGUAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGYAbwBuAHQAZgBpAGwAZQAyACAAPQAgACQAZgBvAG4AdABmAGkAbABlAC4ATgBhAG0AZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYwBtAGQAcwB0AHIAIAA9ACAAIgBjAG8AcAB5ACAALwB5ACAAIgAiACQAZgBvAG4AdABmAGkAbABlACIAIgAgACUAVwBJAE4ARABJAFIAJQBcAEYAbwBuAHQAcwAgAD4AIABuAHUAbAAgADIAPgAmADEAIAAmACYAIAByAGUAZwAgAGEAZABkACAAIgAiAEgASwBMAE0AXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABOAFQAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABGAG8AbgB0AHMAIgAiACAALwB2ACAAIgAiACQAZgBvAG4AdABuAGEAbQBlACAAKABUAHIAdQBlAFQAeQBwAGUAKQAiACIAIAAvAHQAIABSAEUARwBfAFMAWgAgAC8AZAAgACIAIgAkAGYAbwBuAHQAZgBpAGwAZQAyACIAIgAgAC8AZgAgAD4AIABuAHUAbAAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAJABjAG0AZABzAHQAcgAgAHwAIABjAG0AZAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQANAAoAfQANAAoA___nul__popd_r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.pushd__MY_VBOX_ADDITIONS_etcFonts__cd_Glyphs__powershell__encodedCommand_JABmAG8AbgB0AHMAIAA9ACAAQAAoACkAOwAgAEYAbwByAEUAYQBjAGgAKAAkAGYAbwBuAHQAZABpAHIAIABpAG4AIABHAGUAdAAtAEMAaABpAGwAZABJAHQAZQBtACAALQBEAGkAcgBlAGMAdABvAHIAeQApACAAewAgACQAZgBvAG4AdABzACAAKwA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACIAJABmAG8AbgB0AGQAaQByAFwAKgAiACAAfAAgACUAewAkAF8ALgBGAHUAbABsAE4AYQBtAGUAfQAgAH0ADQAKACQAZgBvAG4AdABzACAAPQAgACQAZgBvAG4AdABzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAdAAgAHsARwBlAHQALQBSAGEAbgBkAG8AbQB9ACAAfAAgAFMAZQBsAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAoAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAgAC0ATQBpAG4AIAAwACAALQBNAGEAeAAgACgAJABmAG8AbgB0AHMALgBMAGUAbgBnAHQAaAArADEAKQApAA0ACgBGAG8AcgBFAGEAYwBoACgAJABmAG8AbgB0ACAAaQBuACAAJABmAG8AbgB0AHMAKQANAAoAewANAAoACQAkAGYAbwBuAHQAZgBpAGwAZQAgAD0AIABTAHAAbABpAHQALQBQAGEAdABoACAAJABmAG8AbgB0ACAALQBsAGUAYQBmAA0ACgAJACQAYwBtAGQAcwB0AHIAIAA9ACAAIgB0AGEAawBlAG8AdwBuACAALwBGACAAIgAiACUAdwBpAG4AZABpAHIAJQBcAEYAbwBuAHQAcwBcACQAZgBvAG4AdABmAGkAbABlACIAIgAgAD4AIABuAHUAbAAgADIAPgAmADEAIAAmACYAIABpAGMAYQBjAGwAcwAgACIAIgAlAHcAaQBuAGQAaQByACUAXABGAG8AbgB0AHMAXAAkAGYAbwBuAHQAZgBpAGwAZQAiACIAIAAvAGcAcgBhAG4AdAAgACIAIgAlAHUAcwBlAHIAbgBhAG0AZQAlACIAIgA6AEYAIAAACAAbgB1AGwAIAAyAD4AJgAxACAAJgAmACAAYwBvAHAAeQAgAC8AeQAgACIAIgAkAGYAbwBuAHQAIgAiACAAJQB3AGkAbgBkAGkAcgAlAFwARgBvAG4AdABzAFwAIAAACAAbgB1AGwAIAAyAD4AJgAxACIADQAKAAkAJABjAG0AZABzAHQAcgAgAHwAIABjAG0AZAANAAoAfQA___nul__popd_r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
cmp byte [rsi + 0xb], 0
je 0x140120a1d
movdqa xmm0, xmmword [0x1401cc680]
movdqu xmmword [rbp + 0x710], xmm0
mov dword [rbp + 0x720], 0x2b110
mov edx, 4
xor ecx, ecx
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov eax, eax
mov ebx, dword [rbp + rax*4 + 0x710]
mov edx, 0x62
lea rcx, str._MY_VBOX_ADDITIONS_etcSoundVolumeViewSoundVolumeView.exe__SetDefaultFormat__Speakers__16__1_2_r_n
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1a8], rax
mov dl, 0x20
lea rcx, [rbp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x28], ax
mov dword [rsp + 0x20], 0xa
xor r9d, r9d
mov r8d, ebx
lea rdx, [rbp + 0x250]
lea rcx, [rbp + 0x1a8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_int__int__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x250]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1a8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 0xe], 0
je 0x140120b44
mov edx, 0x639c956b
mov ecx, 0x615c59c1
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov ebx, eax
mov edx, 0x68
lea rcx, str.reg_ADD__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersion___v_InstallDate__t_REG_DWORD__d__1__f___nul_r_n
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1f0], rax
mov dl, 0x20
lea rcx, [rbp + 0x10]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x28], ax
mov dword [rsp + 0x20], 0xa
xor r9d, r9d
mov r8d, ebx
lea rdx, [rbp + 0x248]
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_unsigned_int__int__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x248]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
movabs rax, 0x2b6109100
add rax, rbx
imul rbx, rax, 0x989680
mov edx, 0x68
lea rcx, str.reg_ADD__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersion___v_InstallTime__t_REG_QWORD__d__1__f___nul_r_n
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1b8], rax
mov dl, 0x20
lea rcx, [rbp + 0xa8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x28], ax
mov dword [rsp + 0x20], 0xa
xor r9d, r9d
mov r8, rbx
lea rdx, [rbp + 0x2c0]
lea rcx, [rbp + 0x1b8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_unsigned_long_long_unsigned___int64___int__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1b8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, str.call__MY_VBOX_ADDITIONS_etc_network_test.cmd_
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
cmp byte [rsi + 0x13], 0
je 0x140120b6e
lea rdx, str.powershell__encodedCommand_JABzAGUAcgB2AGUAcgBzACAAPQAgAEAAKAApADsAIAB0AHIAeQAgAHsAIAAkAHMAZQByAHYAZQByAHMAIAA9ACAAKABjAHUAcgBsACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AYQBuAHQAaQBkAGUAdABlAGMAdAAvAGwAaQBzAHQALwBtAGEAaQBuAC8AdABtAHgALQBkAG8AbQBhAGkAbgBzACkALgBDAG8AbgB0AGUAbgB0AC4AUwBwAGwAaQB0ACgAWwBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoATgBlAHcATABpAG4AZQAsACAAWwBTAHkAcwB0AGUAbQAuAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkAIAB9ACAAYwBhAHQAYwBoACAAewBXAHIAaQB0AGUALQBIAG8AcwB0ACAAJwBGAGEAaQBsAGUAZAAgAHQAbwAgAGQAbwB3AG4AbABvAGEAZAAgAFQAaAByAGUAYQB0AE0AZQB0AHIAaQB4ACAAcwBlAHIAdgBlAHIAcwAgAGwAaQBzAHQAJwA7ACAARQB4AGkAdAB9ADsAIAAkAHMAdAByACAAPQAgACcAJwA7ACAAZgBvAHIAZQBhAGMAaAAoACQAcwBlAHIAdgBlAHIAIABpAG4AIAAkAHMAZQByAHYAZQByAHMAKQAgAHsAJABzAHQAcgAgACsAPQAgACIAMAAuADAALgAwAC4AMAAgACQAcwBlAHIAdgBlAHIAYAByAGAAbgAiAH0AOwAgAEEAZABkAC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgB3AGkAbgBkAGkAcgBcAHMAeQBzAHQAZQBtADMAMgBcAGQAcgBpAHYAZQByAHMAXABlAHQAYwBcAGgAbwBzAHQAcwAgAC0AVgBhAGwAdQBlACAAJABzAHQAcgA7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACcAQgBsAG8AYwBrAGUAZAAnACAAJABzAGUAcgB2AGUAcgBzAC4ATABlAG4AZwB0AGgAIAAnAFQAaAByAGUAYQB0AE0AZQB0AHIAaQB4ACAAZABvAG0AYQBpAG4AcwAnAA_r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
cmp byte [rsi + 0x1c], 0
je 0x140120dcd
mov edx, 0x2f
lea rcx, str.All_network_protocols_except_TCP__UDP_Blocked_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x218], rax
mov edx, 0xc
lea rcx, str.Antidetect_4
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1d0], rax
mov edx, 9
lea rcx, str.logo2.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1c8], rax
mov edx, 0x15
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1c0], rax
mov dl, 0x20
lea rcx, [rbp + 0xb8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x1c8]
lea rdx, [rbp + 0x2a8]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0xba]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x1d0]
lea rdx, [rbp + 0x2b0]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0xbc]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x218]
lea rdx, [rbp + 0x2b8]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp + 0x30]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x30], 0x4023
mov rdx, rbx
lea rcx, [rbp + 0x30]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
mov edi, 0x2023
mov dword [rsp + 0x30], edi
lea rcx, [rbp + 0x2b8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x2a8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov r8d, 0xffffffff
lea rdx, str.netsh_advfirewall_firewall_delete_rule_all___nul__timeout_2___nul__netsh_advfirewall_set_allprofiles_firewallpolicy_blockinbound_blockoutbound___nul__netsh_advfirewall_firewall_add_rule_name_Allow_DNS_Outbound_TCP__dirout_actionallow_protocolTCP_remoteport53___nul__netsh_advfirewall_firewall_add_rule_name_Allow_DNS_Outbound_UDP__dirout_actionallow_protocolUDP_remoteport53___nul__netsh_advfirewall_firewall_add_rule_name_Allow_DNS_Inbound_TCP__dirin_actionallow_protocolTCP_remoteport53___nul__netsh_advfirewall_firewall_add_rule_name_Allow_DNS_Inbound_UDP__dirin_actionallow_protocolUDP_remoteport53___nul__netsh_advfirewall_firewall_add_rule_name_Allow_All_Outbound_TCP__dirout_actionallow_protocolTCP_localport0_65535_remoteport0_65535___nul__netsh_advfirewall_firewall_add_rule_name_Allow_All_Outbound_UDP__dirout_actionallow_protocolUDP_localport0_65535_remoteport0_65535___nul__netsh_advfirewall_firewall_add_rule_name_Allow_All_Inbound_TCP__dirin_actionallow_protocolTCP_localport0_65535_remoteport0_65535___nul__netsh_advfirewall_firewall_add_rule_name_Allow_All_Inbound_UDP__dirin_actionallow_protocolUDP_localport0_65535_remoteport0_65535___nul__netsh_advfirewall_firewall_add_rule_name_Block_Inbound_Local_Subnet__dirin_actionblock_remoteip192.168.0.0_16___nul__netsh_advfirewall_firewall_add_rule_name_Block_Outbound_Local_Subnet__dirout_actionblock_remoteip192.168.0.0_16___nul__netsh_advfirewall_firewall_add_rule_name_Allow_NTP_Outbound__dirout_actionallow_protocolUDP_remoteport123___nul__netsh_advfirewall_firewall_add_rule_name_Block_8.8.8.8__dirout_interfaceany_actionblock_remoteip8.8.8.8___nul__netsh_advfirewall_firewall_add_rule_name_Block_8.8.4.4__dirout_interfaceany_actionblock_remoteip8.8.4.4___nul__netsh_advfirewall_firewall_add_rule_name_Block_Local_Network_10.x.x.x__dirout_interfaceany_actionblock_remoteip10.0.0.0_10.255.255.255___nul__netsh_advfirewall_firewall_add_rule_name_Block_Multicast_Network_224.x.x.x__dirout_interfaceany_actionblock_remoteip224.0.0.0_224.255.255.255___nul__netsh_advfirewall_firewall_add_rule_name_Block_Multicast_Network_239.x.x.x__dirout_interfaceany_actionblock_remoteip239.0.0.0_239.255.255.255___nul__netsh_advfirewall_firewall_add_rule_name_Block_IPv6_Link_local_Inbound__dirin_actionblock_protocolany_remoteipfe80::_10___nul__netsh_advfirewall_firewall_add_rule_name_Block_IPv6_Link_local_Outbound__dirout_actionblock_protocolany_remoteipfe80::_10___nul__netsh_advfirewall_firewall_add_rule_name_Block_IPv6_Multicast_Inbound__dirin_actionblock_protocolany_remoteipff02::_16___nul__netsh_advfirewall_firewall_add_rule_name_Block_IPv6_Multicast_Outbound__dirout_actionblock_protocolany_remoteipff02::_16___nul_
lea rcx, [rbp + 0xb0]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x30], 0xa023
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x18]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x30], 0x1a023
mov r8d, 0xffffffff
lea rdx, str.__timeout_5___nul_r_n
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x18]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0x18]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x18]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov dword [rsp + 0x30], edi
lea rcx, [rbp + 0xb0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x30]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1c8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x218]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 0x1b], 0
je 0x140120de5
lea rdx, str.echo_Installing_FakeWebRTC_xcopy__e__y__i__MY_VBOX_ADDITIONS_etcFakeWebRTC___programfiles_FakeWebRTC____nul__call___programfiles_FakeWebRTCdnscrypt_proxy_service_install.bat____nul_2_1__powershell__function_setRunAsAdmin__lnk__bytes___System.IO.File_::ReadAllBytes__lnk____bytes_0x15____bytes_0x15___bor_0x20___System.IO.File_::WriteAllBytes__lnk___bytes____start_userprofile_DesktopStart_FakeWebRTC.lnk___s_New_Object__COM_WScript.Shell_.CreateShortcut__start___s.TargetPathpowershell__s.Arguments_File____char_34___programfiles_FakeWebRTC_fake_webrtc_start.ps1___char_34__s.Save____setRunAsAdmin__start____stop_userprofile_DesktopStop_FakeWebRTC.lnk___s_New_Object__COM_WScript.Shell_.CreateShortcut__stop___s.TargetPathpowershell__s.Arguments_File____char_34___programfiles_FakeWebRTC_fake_webrtc_stop.ps1___char_34__s.Save____setRunAsAdmin__stop___r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.powershell__encodedCommand_JABsAGkAcwB0ACAAPQAgACgAYwB1AHIAbAAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAIABoAHQAdABwAHMAOgAvAC8AcgBhAHcALgBnAGkAdABoAHUAYgB1AHMAZQByAGMAbwBuAHQAZQBuAHQALgBjAG8AbQAvAGEAbgB0AGkAZABlAHQAZQBjAHQALwBsAGkAcwB0AC8AbQBhAGkAbgAvAHQAZQBzAHQAMgApAC4AQwBvAG4AdABlAG4AdAAuAFMAcABsAGkAdAAoAFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AE4AZQB3AEwAaQBuAGUALAAgAFsAUwB5AHMAdABlAG0ALgBTAHQAcgBpAG4AZwBTAHAAbABpAHQATwBwAHQAaQBvAG4AcwBdADoAOgBSAGUAbQBvAHYAZQBFAG0AcAB0AHkARQBuAHQAcgBpAGUAcwApADsAIAAkAHAAYQByAGEAbQBzACAAPQAgACIAYQBkAHYAZgBpAHIAZQB3AGEAbABsACAAZgBpAHIAZQB3AGEAbABsACAAYQBkAGQAIAByAHUAbABlACAAbgBhAG0AZQA9AEcAZQBuAGUAcgBpAGMAQgBsAG8AYwBrACAAZABpAHIAPQBvAHUAdAAgAGEAYwB0AGkAbwBuAD0AYgBsAG8AYwBrACAAcgBlAG0AbwB0AGUAaQBwAD0AIgAgACsAIABbAHMAeQBzAHQAZQBtAC4AUwB0AHIAaQBuAGcAXQA6ADoASgBvAGkAbgAoACIALAAiACwAIAAkAGwAaQBzAHQAKQA7ACAAJgAgACIAbgBlAHQAcwBoAC4AZQB4AGUAIgAgACQAcABhAHIAYQBtAHMALgBTAHAAbABpAHQAKAAiACAAIgApAA___nul_r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
cmp byte [rsi + 0xf], 0
je 0x140121053
mov edx, 0x11
lea rcx, str.IPv6_leak_Blocked
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0xe8], rax
mov edx, 0xc
lea rcx, str.Antidetect_4
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x230], rax
mov edx, 9
lea rcx, str.logo2.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x228], rax
mov edx, 0x15
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x220], rax
mov dl, 0x20
lea rcx, [rbp + 0xbe]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x228]
lea rdx, [rbp + 0x288]
lea rcx, [rbp + 0x220]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0xc0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x230]
lea rdx, [rbp + 0x290]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0xc2]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0xe8]
lea rdx, [rbp + 0x298]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp + 8]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts edi, 0x12
mov dword [rsp + 0x30], edi
mov rdx, rbx
lea rcx, [rbp + 8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr edi, 0x12
bts edi, 0x11
mov dword [rsp + 0x30], edi
lea rcx, [rbp + 0x298]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x290]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x288]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x220]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov r8d, 0xffffffff
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_41__actionblock_protocol41_dirout___nul__netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_43__actionblock_protocol43_dirout___nul__netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_44__actionblock_protocol44_dirout___nul__netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_58__actionblock_protocol58_dirout___nul__netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_59__actionblock_protocol59_dirout___nul__netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_60__actionblock_protocol60_dirout___nul__netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_41__actionblock_protocol41_dirin___nul__netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_43__actionblock_protocol43_dirin___nul__netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_44__actionblock_protocol44_dirin___nul__netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_58__actionblock_protocol58_dirin___nul__netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_59__actionblock_protocol59_dirin___nul__netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_60__actionblock_protocol60_dirin___nul_
lea rcx, [rbp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts edi, 0x13
mov dword [rsp + 0x30], edi
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x40]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
bts edi, 0x14
mov dword [rsp + 0x30], edi
mov r8d, 0xffffffff
lea rdx, str.__timeout_5___nul_r_n
lea rcx, [rbp + 0x280]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x40]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x280]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr edi, 0x14
lea rcx, [rbp + 0x40]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
btr edi, 0x13
mov dword [rsp + 0x30], edi
lea rcx, [rbp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x228]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x230]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xe8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 0x10], 0
je 0x14012106b
lea rdx, [rbp + 0x3e0]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
cmp byte [rsi + 0x11], 0
je 0x1401212e5
mov edx, 0x1a
lea rcx, str.DNS_over_QUIC_Leak_Blocked
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x130], rax
mov edx, 0xc
lea rcx, str.Antidetect_4
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x108], rax
mov edx, 9
lea rcx, str.logo2.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x100], rax
mov edx, 0x15
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0xf0], rax
mov dl, 0x20
lea rcx, [rbp + 0xc4]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x100]
lea rdx, [rbp + 0x330]
lea rcx, [rbp + 0xf0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0xc6]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x108]
lea rdx, [rbp + 0x328]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x40]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x130]
lea rdx, [rbp + 0x320]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts edi, 0x16
mov dword [rsp + 0x30], edi
mov rdx, rbx
lea rcx, [rbp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr edi, 0x16
bts edi, 0x15
mov dword [rsp + 0x30], edi
lea rcx, [rbp + 0x320]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x328]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x330]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xf0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov edx, 0xf3
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_DNS_QUIC_UDP_Block__protocoludp_remoteport80_443_dirout_actionblock___nul__netsh_advfirewall_firewall_add_rule_name_DNS_QUIC_UDP_Block__protocoludp_remoteport80_443_dirin_actionblock___nul_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0xf8], rax
lea rdx, [rbp + 0xf8]
lea rcx, [rbp + 0x20]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
bts edi, 0x17
mov dword [rsp + 0x30], edi
lea rdx, [rbp + 0x58]
lea rcx, [rbp + 0x20]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
bts edi, 0x18
mov dword [rsp + 0x30], edi
mov r8d, 0xffffffff
lea rdx, str.__timeout_5___nul_r_n
lea rcx, [rbp + 0x338]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x338]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr edi, 0x18
lea rcx, [rbp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
btr edi, 0x17
mov dword [rsp + 0x30], edi
lea rcx, [rbp + 0x20]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xf8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x100]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x108]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x130]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 0x14], 0
je 0x140121544
mov edx, 0x1e
lea rcx, str.Windows_Telemetry_leak_Blocked
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x118], rax
mov edx, 0xc
lea rcx, str.Antidetect_4
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x110], rax
mov edx, 9
lea rcx, str.logo2.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x208], rax
mov edx, 0x15
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1b0], rax
mov dl, 0x20
lea rcx, [rbp - 0x3e]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x208]
lea rdx, [rbp + 0x350]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x3c]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x110]
lea rdx, [rbp + 0x348]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x3a]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x118]
lea rdx, [rbp + 0x340]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts edi, 0x1a
mov dword [rsp + 0x30], edi
mov rdx, rbx
lea rcx, [rbp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr edi, 0x1a
bts edi, 0x19
mov dword [rsp + 0x30], edi
lea rcx, [rbp + 0x340]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x348]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x350]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov r8d, 0xffffffff
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_telemetry_vortex.data.microsoft.com__dirout_actionblock_remoteip191.232.139.254_enableyes___nul___netsh_advfirewall_firewall_add_rule_name_telemetry_telecommand.telemetry.microsoft.com__dirout_actionblock_remoteip65.55.252.92_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_oca.telemetry.microsoft.com__dirout_actionblock_remoteip65.55.252.63_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_sqm.telemetry.microsoft.com__dirout_actionblock_remoteip65.55.252.93_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_watson.telemetry.microsoft.com__dirout_actionblock_remoteip65.55.252.43_65.52.108.29_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_redir.metaservices.microsoft.com__dirout_actionblock_remoteip194.44.4.200_194.44.4.208_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_choice.microsoft.com__dirout_actionblock_remoteip157.56.91.77_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_df.telemetry.microsoft.com__dirout_actionblock_remoteip65.52.100.7_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_reports.wes.df.telemetry.microsoft.com__dirout_actionblock_remoteip65.52.100.91_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_wes.df.telemetry.microsoft.com__dirout_actionblock_remoteip65.52.100.93_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_services.wes.df.telemetry.microsoft.com__dirout_actionblock_remoteip65.52.100.92_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_sqm.df.telemetry.microsoft.com__dirout_actionblock_remoteip65.52.100.94_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_telemetry.microsoft.com__dirout_actionblock_remoteip65.52.100.9_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_watson.ppe.telemetry.microsoft.com__dirout_actionblock_remoteip65.52.100.11_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_telemetry.appex.bing.net__dirout_actionblock_remoteip168.63.108.233_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_telemetry.urs.microsoft.com__dirout_actionblock_remoteip157.56.74.250_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_settings_sandbox.data.microsoft.com__dirout_actionblock_remoteip111.221.29.177_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_vortex_sandbox.data.microsoft.com__dirout_actionblock_remoteip64.4.54.32_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_survey.watson.microsoft.com__dirout_actionblock_remoteip207.68.166.254_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_watson.live.com__dirout_actionblock_remoteip207.46.223.94_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_watson.microsoft.com__dirout_actionblock_remoteip65.55.252.71_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_statsfe2.ws.microsoft.com__dirout_actionblock_remoteip64.4.54.22_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_corpext.msitadfs.glbdns2.microsoft.com__dirout_actionblock_remoteip131.107.113.238_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_compatexchange.cloudapp.net__dirout_actionblock_remoteip23.99.10.11_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_cs1.wpc.v0cdn.net__dirout_actionblock_remoteip68.232.34.200_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_a_0001.a_msedge.net__dirout_actionblock_remoteip204.79.197.200_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_statsfe2.update.microsoft.com.akadns.net__dirout_actionblock_remoteip64.4.54.22_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_sls.update.microsoft.com.akadns.net__dirout_actionblock_remoteip157.56.77.139_enableyes___nul__netsh_advfirew
lea rcx, [rbp + 0xc8]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts edi, 0x1b
mov dword [rsp + 0x30], edi
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0xc8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0xc8]
lea rcx, [rbp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
bts edi, 0x1c
mov dword [rsp + 0x30], edi
mov r8d, 0xffffffff
lea rdx, str.__timeout_5___nul_r_n
lea rcx, [rbp + 0x358]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x358]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr edi, 0x1c
lea rcx, [rbp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
btr edi, 0x1b
mov dword [rsp + 0x30], edi
lea rcx, [rbp + 0xc8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x208]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x110]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x118]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 0x12], 0
je 0x1401217d6
mov edx, 0xe
lea rcx, str.Akamai_Blocked
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x140], rax
mov edx, 0xc
lea rcx, str.Antidetect_4
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x138], rax
mov edx, 9
lea rcx, str.logo2.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x210], rax
mov edx, 0x15
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x120], rax
mov dl, 0x20
lea rcx, [rbp - 0x38]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x210]
lea rdx, [rbp + 0x370]
lea rcx, [rbp + 0x120]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x36]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x138]
lea rdx, [rbp + 0x368]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x34]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x140]
lea rdx, [rbp + 0x360]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp + 0x88]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts edi, 0x1e
mov dword [rsp + 0x30], edi
mov rdx, rbx
lea rcx, [rbp + 0x88]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr edi, 0x1e
bts edi, 0x1d
mov dword [rsp + 0x30], edi
lea rcx, [rbp + 0x360]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x368]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x370]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x120]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov edx, 0x51
lea rcx, str.type__MY_VBOX_ADDITIONS_etc_akamai.txt_____windir__system32driversetchosts_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x128], rax
lea rdx, [rbp + 0x128]
lea rcx, [rbp + 0x80]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
or edi, 0x80000000
mov dword [rsp + 0x30], edi
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x80]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x40], 1
mov r8d, 0xffffffff
lea rdx, str.__timeout_1___nul_r_n
lea rcx, [rbp + 0x378]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x378]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0x78]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
mov r14d, r12d
mov dword [rsp + 0x40], r12d
lea rcx, [rbp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
btr edi, 0x1f
mov dword [rsp + 0x30], edi
lea rcx, [rbp + 0x80]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x128]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x88]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x210]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x138]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x140]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 0x15], 0
je 0x140121a4a
mov edx, 0x14
lea rcx, str.NetBios_Leak_Blocked
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1e8], rax
mov edx, 0xc
lea rcx, str.Antidetect_4
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1e0], rax
mov edx, 9
lea rcx, str.logo2.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1d8], rax
mov edx, 0x15
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x238], rax
mov dl, 0x20
lea rcx, [rbp - 0x32]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x1d8]
lea rdx, [rbp + 0x390]
lea rcx, [rbp + 0x238]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x30]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x1e0]
lea rdx, [rbp + 0x388]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x2e]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x1e8]
lea rdx, [rbp + 0x380]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp + 0xa0]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x40], 4
mov rdx, rbx
lea rcx, [rbp + 0xa0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
mov dword [rsp + 0x40], 2
lea rcx, [rbp + 0x380]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x388]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x390]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x238]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov r8d, 0xffffffff
lea rdx, str.net_stop_lmhosts___nul__timeout_5___nul__net_stop_netbt___nul__timeout_5___nul__sc_config_netbt_start_disabled___nul__sc_config_lmhosts_start_disabled___nul_
lea rcx, [rbp + 0x98]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x40], 0xa
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x98]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x98]
lea rcx, [rbp + 0x90]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x40], 0x1a
mov r8d, 0xffffffff
lea rdx, str.__timeout_5___nul_r_n
lea rcx, [rbp + 0x398]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x90]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x398]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0x90]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x90]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov r14d, 2
mov dword [rsp + 0x40], r14d
lea rcx, [rbp + 0x98]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xa0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1d8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1e8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 0x16], 0
je 0x140121b8d
lea rcx, [rbp - 0x70]
call fcn.1401254c0
nop
mov edx, 7
lea ecx, [rdx - 4]
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov r14d, eax
mov edi, r12d
lea rcx, [rbp - 0x70]
call qword [sym.imp.Qt5Core.dll_public:_int___cdecl_QListData::size_void_const___ptr64]
cmp r14d, eax
jg 0x140121a86
mov eax, r14d
jmp 0x140121a90
lea rcx, [rbp - 0x70]
call qword [sym.imp.Qt5Core.dll_public:_int___cdecl_QListData::size_void_const___ptr64]
cmp edi, eax
jge 0x140121b5f
mov edx, 0x7c
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_Antidetect_OpenLocalPort__1__protocoltcp_localport_1_dirin_actionallow___nul_r_n
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x410], rax
mov dl, 0x20
lea rcx, [rbp + 0x318]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov rax, qword [rbp - 0x70]
mov ecx, dword [rax]
cmp ecx, 1
jbe 0x140121ade
mov rax, qword [rbp - 0x70]
mov edx, dword [rax + 4]
lea rcx, [rbp - 0x70]
call fcn.14001ec20
mov edx, edi
lea rcx, [rbp - 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void____ptr64____ptr64___cdecl_QListData::at_int_const___ptr64]
mov r8d, 0xa
mov edx, dword [rax]
lea rcx, [rbp + 0x540]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::number_int__int_]
nop
mov word [rsp + 0x20], bx
xor r9d, r9d
mov r8, rax
lea rdx, [rbp + 0x538]
lea rcx, [rbp + 0x410]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x538]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x540]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x410]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
inc edi
jmp 0x140121a72
mov rax, qword [rbp - 0x70]
mov ecx, dword [rax]
test ecx, ecx
je 0x140121b7d
cmp ecx, 0xffffffff
je 0x140121b88
mov rax, qword [rbp - 0x70]
lock add dword [rax], 0xffffffff
setne al
test al, al
jne 0x140121b88
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.Qt5Core.dll_public:_static_void___cdecl_QListData::dispose_struct_QListData::Data____ptr64_]
nop
mov r14d, dword [rsp + 0x40]
lea rdx, [rsi + 0x28]
lea rcx, [rbp + 0x200]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
nop
mov rax, qword [rbp + 0x200]
cmp dword [rax + 4], 0
je 0x140121d43
mov r8d, 0xffffffff
lea rdx, str._for__f__tokens1_2_3____i_in__netsh_int_show_interface__do___r_n___netsh_int_ipv4_set_dns_name___l__static
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
or r14d, 0x20
mov dword [rsp + 0x40], r14d
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x2e0]
lea rcx, [rbp + 0x2d8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
or r14d, 0x40
mov dword [rsp + 0x40], r14d
mov r8d, 0xffffffff
lea rdx, str._primary_validateno_nul_r_n_____ipconfig__flushdns_
lea rcx, [rbp + 0x548]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x2d8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x548]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0x2d8]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
and r14d, 0xffffffbf
lea rcx, [rbp + 0x2d8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
and r14d, 0xffffffdf
mov dword [rsp + 0x40], r14d
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov r8d, 0xffffffff
lea rdx, str.___userprofile_DesktopCheckWebRTC.cmd____echo__echo_off_r_necho_powershell___Invoke_WebRequest__UseBasicParsing_http:__
lea rcx, [rbp + 0x2f0]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts r14d, 7
mov dword [rsp + 0x40], r14d
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0x2f0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x2f0]
lea rcx, [rbp + 0x2e8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
bts r14d, 8
mov dword [rsp + 0x40], r14d
mov r8d, 0xffffffff
lea rdx, str._rtc.php_.Content__r_necho_timeout_10___
lea rcx, [rbp + 0x550]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x2e8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x550]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0x2e8]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr r14d, 8
lea rcx, [rbp + 0x2e8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
btr r14d, 7
mov dword [rsp + 0x40], r14d
lea rcx, [rbp + 0x2f0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rsi + 0x30]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rsi + 0x38]
lea rcx, [rbp + 0xd8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rsi + 0x40]
lea rcx, [rbp + 0x278]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rsi + 0x48]
lea rcx, [rbp + 0xd0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rsi + 0x50]
lea rcx, [rbp + 0x1f8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
nop
mov rax, qword [rbp + 0x278]
cmp dword [rax + 4], 0
je 0x1401220d2
mov edx, 0x1a
lea rcx, str._programfiles_OpenVPN_bin
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x2f8], rax
mov edx, 0xe1
lea rcx, str.echo_Installing_VPN...__cd__d__MY_VBOX_ADDITIONS___for__r___i_in__OpenVPN__amd64.msi__do___start__wait_msiexec.exe__i____i___passive___mkdir___userprofile_OpenVPNconfig____nul__cd__d___userprofile_OpenVPNconfig__
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x418], rax
lea rdx, [rbp + 0x418]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x418]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov rax, qword [rbp + 0xd0]
cmp dword [rax + 4], 0
je 0x140121edd
mov rax, qword [rbp + 0x1f8]
cmp dword [rax + 4], 0
je 0x140121edd
mov edx, 0x28
lea rcx, str.__auth.txt_echo__1__auth.txt_echo__2
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x3b0], rax
mov dl, 0x20
lea rcx, [rbp + 0x2d0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0xd0]
lea rdx, [rbp + 0x428]
lea rcx, [rbp + 0x3b0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0x3a8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x1f8]
lea rdx, [rbp + 0x420]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x420]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x428]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x3b0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov edx, 0xf1
lea rcx, str.powershell___s_New_Object__COM_WScript.Shell_.CreateShortcut__appdata_MicrosoftWindowsStart_MenuProgramsStartupopenvpn.lnk___s.TargetPath_1openvpn_gui.exe__s.Arguments__connect_0001.ovpn__s.WorkingDirectory_1__s.Save____
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x3b8], rax
mov dl, 0x20
lea rcx, [rbp + 0x3aa]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x2f8]
lea rdx, [rbp + 0x430]
lea rcx, [rbp + 0x3b8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x430]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x3b8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov edx, 8
lea rcx, str.https:__
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x3c0], rax
mov r8d, 1
lea rdx, [rbp + 0x3c0]
lea rcx, [rbp + 0x278]
call qword [sym.imp.Qt5Core.dll_public:_bool___cdecl_QString::startsWith_class_QString_const____ptr64__enum_Qt::CaseSensitivity_const___ptr64]
movzx ebx, al
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov edx, 0x38
test bl, bl
je 0x140122012
lea rcx, str.powershell__Invoke_WebRequest__1__OutFile_0001.ovpn___
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x3c8], rax
mov dl, 0x20
lea rcx, [rbp + 0x3ac]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x278]
lea rdx, [rbp + 0x438]
lea rcx, [rbp + 0x3c8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x438]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x3c8]
jmp 0x140122040
lea rcx, str.copy__MY_VBOX_ADDITIONS_.._vpn_config.ovpn_0001.ovpn_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x3d0], rax
lea rdx, [rbp + 0x3d0]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov edx, 0x4a
lea rcx, str.start__VPN____1openvpn_gui.exe____connect_0001.ovpn__timeout_15___nul_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x3d8], rax
mov dl, 0x20
lea rcx, [rbp + 0x3ae]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x2f8]
lea rdx, [rbp + 0x440]
lea rcx, [rbp + 0x3d8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x440]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x3d8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x2f8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
jmp 0x140122550
mov rax, qword [rbp + 0xe0]
cmp dword [rax + 4], 0
je 0x140122508
mov rax, qword [rbp + 0xd8]
cmp dword [rax + 4], 0
je 0x140122508
lea rdx, [rbp + 0x200]
lea rcx, [rbp - 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
nop
mov rax, qword [rbp - 0x68]
cmp dword [rax + 4], 0
jne 0x140122139
lea rdx, [rsi + 0x58]
lea rcx, [rbp - 0x68]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::operator_class_QString_const____ptr64____ptr64]
mov rax, qword [rbp - 0x68]
cmp dword [rax + 4], 0
jne 0x140122139
lea rdx, str.1.1.1.1_1.0.0.1
lea rcx, [rbp - 0x68]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::operator_char_const____ptr64____ptr64]
lea rdx, str.xcopy__e__y__i__MY_VBOX_ADDITIONS_Tools_tun2socks___userprofile_Desktop_tun2socks____nul__timeout_2___nul_r_npushd___userprofile_Desktop_tun2socks__r_ndel__f__q_start.bat___nul_r_n__start.bat_echo__echo_off__start.bat_echo_pushd____dp0__r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
mov rax, qword [rbp + 0xd0]
cmp dword [rax + 4], 0
jne 0x1401222d9
mov edx, 0x83
lea rcx, str.__start.bat_echo_tun2socks.exe___dns_addresses_3___product_modeno___proxyserver_1___proxyport_2___proxyuser___proxypassword_r_n
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x3f0], rax
movsxd rbx, dword [rax + 4]
lea rcx, [rbp + 0x3f0]
call qword [sym.imp.Qt5Core.dll_public:_class_QChar_const____ptr64___cdecl_QString::data_void_const___ptr64]
mov qword [rbp + 0x590], rbx
mov qword [rbp + 0x598], rax
mov rax, qword [rbp - 0x68]
movsxd rbx, dword [rax + 4]
lea rcx, [rbp - 0x68]
call qword [sym.imp.Qt5Core.dll_public:_class_QChar_const____ptr64___cdecl_QString::data_void_const___ptr64]
mov qword [rbp + 0x560], rbx
mov qword [rbp + 0x568], rax
mov byte [rbp + 0x660], 2
movups xmm0, xmmword [rbp + 0x560]
movups xmmword [rbp + 0x668], xmm0
mov rax, qword [rbp + 0xd8]
movsxd rbx, dword [rax + 4]
lea rcx, [rbp + 0xd8]
call qword [sym.imp.Qt5Core.dll_public:_class_QChar_const____ptr64___cdecl_QString::data_void_const___ptr64]
mov qword [rbp + 0x570], rbx
mov qword [rbp + 0x578], rax
mov byte [rbp + 0x648], 2
movups xmm0, xmmword [rbp + 0x570]
movups xmmword [rbp + 0x650], xmm0
mov rax, qword [rbp + 0xe0]
movsxd rbx, dword [rax + 4]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.Qt5Core.dll_public:_class_QChar_const____ptr64___cdecl_QString::data_void_const___ptr64]
mov qword [rbp + 0x580], rbx
mov qword [rbp + 0x588], rax
mov byte [rbp + 0x630], 2
movups xmm0, xmmword [rbp + 0x580]
movups xmmword [rbp + 0x638], xmm0
lea rax, [rbp + 0x630]
mov qword [rbp + 0x6f0], rax
lea rax, [rbp + 0x648]
mov qword [rbp + 0x6f8], rax
lea rax, [rbp + 0x660]
mov qword [rbp + 0x700], rax
mov qword [rbp + 0x708], r12
movaps xmm0, xmmword [rbp + 0x590]
movdqa xmmword [rbp + 0x610], xmm0
lea r9, [rbp + 0x6f0]
mov r8d, 3
lea rdx, [rbp + 0x610]
lea rcx, [rbp + 0x3e8]
call qword [sym.imp.Qt5Core.dll_class_QString___cdecl_QtPrivate::argToQString_class_QStringView__unsigned_long_long_unsigned___int64___struct_QtPrivate::ArgBase_const____ptr64____ptr64_]
or r14d, 0xe00
mov dword [rsp + 0x40], r14d
lea rdx, [rbp + 0x3e8]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x3e8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x3f0]
jmp 0x1401224e3
mov edx, 0x87
lea rcx, str.__start.bat_echo_tun2socks.exe___dns_addresses_5___product_modeno___proxyserver_1___proxyport_2___proxyuser_3___proxypassword_4_r_n
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x400], rax
movsxd rbx, dword [rax + 4]
lea rcx, [rbp + 0x400]
call qword [sym.imp.Qt5Core.dll_public:_class_QChar_const____ptr64___cdecl_QString::data_void_const___ptr64]
mov qword [rbp + 0x5f0], rbx
mov qword [rbp + 0x5f8], rax
mov rax, qword [rbp - 0x68]
movsxd rbx, dword [rax + 4]
lea rcx, [rbp - 0x68]
call qword [sym.imp.Qt5Core.dll_public:_class_QChar_const____ptr64___cdecl_QString::data_void_const___ptr64]
mov qword [rbp + 0x5a0], rbx
mov qword [rbp + 0x5a8], rax
mov byte [rbp + 0x6d8], 2
movups xmm0, xmmword [rbp + 0x5a0]
movups xmmword [rbp + 0x6e0], xmm0
mov rax, qword [rbp + 0x1f8]
movsxd rbx, dword [rax + 4]
lea rcx, [rbp + 0x1f8]
call qword [sym.imp.Qt5Core.dll_public:_class_QChar_const____ptr64___cdecl_QString::data_void_const___ptr64]
mov qword [rbp + 0x5b0], rbx
mov qword [rbp + 0x5b8], rax
mov byte [rbp + 0x6c0], 2
movups xmm0, xmmword [rbp + 0x5b0]
movups xmmword [rbp + 0x6c8], xmm0
mov rax, qword [rbp + 0xd0]
movsxd rbx, dword [rax + 4]
lea rcx, [rbp + 0xd0]
call qword [sym.imp.Qt5Core.dll_public:_class_QChar_const____ptr64___cdecl_QString::data_void_const___ptr64]
mov qword [rbp + 0x5c0], rbx
mov qword [rbp + 0x5c8], rax
mov byte [rbp + 0x6a8], 2
movups xmm0, xmmword [rbp + 0x5c0]
movups xmmword [rbp + 0x6b0], xmm0
mov rax, qword [rbp + 0xd8]
movsxd rbx, dword [rax + 4]
lea rcx, [rbp + 0xd8]
call qword [sym.imp.Qt5Core.dll_public:_class_QChar_const____ptr64___cdecl_QString::data_void_const___ptr64]
mov qword [rbp + 0x5d0], rbx
mov qword [rbp + 0x5d8], rax
mov byte [rbp + 0x690], 2
movups xmm0, xmmword [rbp + 0x5d0]
movups xmmword [rbp + 0x698], xmm0
mov rax, qword [rbp + 0xe0]
movsxd rbx, dword [rax + 4]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.Qt5Core.dll_public:_class_QChar_const____ptr64___cdecl_QString::data_void_const___ptr64]
mov qword [rbp + 0x5e0], rbx
mov qword [rbp + 0x5e8], rax
mov byte [rbp + 0x678], 2
movups xmm0, xmmword [rbp + 0x5e0]
movups xmmword [rbp + 0x680], xmm0
lea rax, [rbp + 0x678]
mov qword [rbp + 0x728], rax
lea rax, [rbp + 0x690]
mov qword [rbp + 0x730], rax
lea rax, [rbp + 0x6a8]
mov qword [rbp + 0x738], rax
lea rax, [rbp + 0x6c0]
mov qword [rbp + 0x740], rax
lea rax, [rbp + 0x6d8]
mov qword [rbp + 0x748], rax
mov qword [rbp + 0x750], r12
movaps xmm0, xmmword [rbp + 0x5f0]
movdqa xmmword [rbp + 0x620], xmm0
lea r9, [rbp + 0x728]
mov r8d, 5
lea rdx, [rbp + 0x620]
lea rcx, [rbp + 0x3f8]
call qword [sym.imp.Qt5Core.dll_class_QString___cdecl_QtPrivate::argToQString_class_QStringView__unsigned_long_long_unsigned___int64___struct_QtPrivate::ArgBase_const____ptr64____ptr64_]
or r14d, 0x7000
mov dword [rsp + 0x40], r14d
lea rdx, [rbp + 0x3f8]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x3f8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x400]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, str.__start.bat_echo_popd_r_nstart____start.bat_r_npopd_r_necho_Waiting_for_tun2socks_to_start..._r_n:loop_r_ntimeout__t_1___nul_r_ntasklist__v__fi__imagename_eq_cmd.exe__find__VEthernet__tun2socks____nul__goto_:exitloop_r_ngoto_:loop_r_n:exitloop_r_necho_Waiting_for_tun2socks_to_connect..._r_ntimeout_10___nul_r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
jmp 0x140122550
lea rdx, str.echo_Installing_VC__r_nstart__MY_VBOX_ADDITIONS_ToolsVisualStudio_redist.x64.exe__install__quiet__norestart___nul__timeout_2___nul_r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.xcopy__e__y__i__MY_VBOX_ADDITIONS_Tools_nekoray___userprofile_Desktop_nekoray____nul__timeout_2___nul_r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.echo._r_necho______r_necho___Now_you_can_set_your_SOCKS5_proxy__r_necho___You_can_use_Nekoray_from_VM_Desktop__turn_it_in_TUN_mode__or_Proxifier__r_necho______r_necho._r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.pause_
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.echo_Updating_EDGE_Browser...__powershell__encodedCommand_dAByAHkAIAB7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAIgBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzACAAKAB4ADgANgApAFwATQBpAGMAcgBvAHMAbwBmAHQAXABFAGQAZwBlAFUAcABkAGEAdABlAFwATQBpAGMAcgBvAHMAbwBmAHQARQBkAGcAZQBVAHAAZABhAHQAZQAuAGUAeABlACIAIAAtAGEAcgBnAHUAbQBlAG4AdABsAGkAcwB0ACAAIgAvAHMAaQBsAGUAbgB0ACAALwBpAG4AcwB0AGEAbABsACAAYQBwAHAAZwB1AGkAZAA9AHsANQA2AEUAQgAxADgARgA4AC0AQgAwADAAOAAtADQAQwBCAEQALQBCADYARAAyAC0AOABDADkANwBGAEUANwBFADkAMAA2ADIAfQAmAGEAcABwAG4AYQBtAGUAPQBNAGkAYwByAG8AcwBvAGYAdAAlADIAMABFAGQAZwBlACYAbgBlAGUAZABzAGEAZABtAGkAbgA9AFQAcgB1AGUAIgAgAH0AIABjAGEAdABjAGgAIAB7AH0A__r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str._MY_VBOX_ADDITIONS_Tools_nekoraylibcore.exe_remove__ROOTVDRVROOT0000___nul__MY_VBOX_ADDITIONS_Tools_nekoraylibcore.exe_remove__ROOTNDISVIRTUALBUS0000___nul__MY_VBOX_ADDITIONS_Tools_nekoraylibcore.exe_remove__ROOTRDPBUS0000___nul__MY_VBOX_ADDITIONS_Tools_nekoraylibcore.exe_remove__ROOTKDNIC0000___nul__MY_VBOX_ADDITIONS_Tools_nekoraylibcore.exe_remove__ROOTVID0000___nul_echo_All_foreign_devices_was_deleted.__r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
cmp byte [rsi + 0xc], 0
je 0x14012258c
lea rdx, str.echo_Activating_Windows_call___MY_VBOX_ADDITIONS_etcWinHardFiles.Net_Configuration_Files_secure.machine_v4.cmd___HWID_
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
cmp byte [rsi + 0x17], 0
je 0x14012347c
lea rdx, str.pushd__tmp___echo_Installing_Chrome_and_randomizing_Client_IDs...__powershell___ProgressPreference__SilentlyContinue___uri__https:__dl.google.com_chrome_install_latest_chrome_installer.exe___ua__Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_113.0.0.0_Safari_537.36_Edg_113.0.1774.42___res__Invoke_WebRequest__UseBasicParsing__Method_Head__useragent__ua__uri__uri___StatusCode___res.StatusCode__if___StatusCode__eq_200___Write_Host__NoNewLine_Downloading_installer___res.Headers_Content_Length__1024.0_1024.0_.ToString_.___MB...___curl.exe__L__uri__A__ua____o_ChromeSetup.exe___start__Installing_Chrome___wait_ChromeSetup.exe__install__powershell___ins__Get_ItemProperty_HKLM:SoftwareMicrosoftWindowsCurrentVersionUninstall___Select_Object_DisplayName__DisplayVersion__Publisher__InstallDate___ins__Get_ItemProperty_HKLM:SoftwareWow6432NodeMicrosoftWindowsCurrentVersionUninstall__Select_Object_DisplayName_DisplayVersion___ins______.DisplayName__match_chrome___Foreach_Object__Write_Host_Installed___.DisplayName_version___.DisplayVersion___r_npopd_r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.echo_Setting_Chrome_as_default_browser...___MY_VBOX_ADDITIONS_etcSetDefaultBrowserSetDefaultBrowser.exe_HKLM__Google_Chrome__
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
cmp byte [rsi + 0x1a], 0
je 0x14012278c
lea rdx, str.echo_Installing_random_Chrome_extensions..._
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
mov edx, 5
lea ecx, [rdx - 2]
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov r15d, eax
lea rcx, [rbp - 0x60]
call fcn.140124da0
nop
mov edi, r12d
lea rcx, [rbp - 0x60]
call qword [sym.imp.Qt5Core.dll_public:_int___cdecl_QListData::size_void_const___ptr64]
cmp r15d, eax
jg 0x140122608
mov eax, r15d
jmp 0x140122612
lea rcx, [rbp - 0x60]
call qword [sym.imp.Qt5Core.dll_public:_int___cdecl_QListData::size_void_const___ptr64]
cmp edi, eax
jge 0x140122722
mov edx, 0x6d
lea rcx, str.reg_add__HKLMSOFTWAREPoliciesGoogleChromeExtensionInstallForcelist___v___1___t_REG_SZ__d___2___f___nul_r_n
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x408], rax
mov dl, 0x20
lea rcx, [rbp + 0x2c8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov r8d, 0xa
lea edx, [rdi + 1]
lea rcx, [rbp + 0x458]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::number_int__int_]
nop
mov word [rsp + 0x20], bx
xor r9d, r9d
mov r8, rax
lea rdx, [rbp + 0x450]
lea rcx, [rbp + 0x408]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov r12, rax
mov dl, 0x20
lea rcx, [rbp + 0x2ca]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov rcx, qword [rbp - 0x60]
mov r8d, dword [rcx]
cmp r8d, 1
jbe 0x1401226ad
mov rcx, qword [rbp - 0x60]
mov edx, dword [rcx + 4]
lea rcx, [rbp - 0x60]
call fcn.140011c80
mov edx, edi
lea rcx, [rbp - 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void____ptr64____ptr64___cdecl_QListData::at_int_const___ptr64]
mov word [rsp + 0x20], bx
xor r9d, r9d
mov r8, rax
lea rdx, [rbp + 0x448]
mov rcx, r12
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x448]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x450]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x458]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x408]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
inc edi
jmp 0x1401225f4
mov rax, qword [rbp - 0x60]
mov ecx, dword [rax]
test ecx, ecx
je 0x140122740
cmp ecx, 0xffffffff
je 0x14012277d
mov rax, qword [rbp - 0x60]
lock add dword [rax], 0xffffffff
setne al
test al, al
jne 0x14012277d
mov r14, qword [rbp - 0x60]
movsxd rdi, dword [r14 + 8]
add rdi, 2
lea rdi, [r14 + rdi*8]
movsxd rbx, dword [r14 + 0xc]
add rbx, 2
lea rbx, [r14 + rbx*8]
cmp rbx, rdi
je 0x140122773
sub rbx, 8
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp rbx, rdi
jne 0x140122761
mov rcx, r14
call qword [sym.imp.Qt5Core.dll_public:_static_void___cdecl_QListData::dispose_struct_QListData::Data____ptr64_]
nop
mov r14d, dword [rsp + 0x40]
mov r15, qword [rbp + 0x3a0]
xor r12d, r12d
cmp byte [rsi + 0x18], 0
je 0x1401230eb
mov edx, 0x24
lea rcx, str.Browser_Hardening._Stage_1_Finished
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x128], rax
mov edx, 3
lea rcx, [0x1401b62f8]
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x210], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x138], rax
mov edx, 0x15
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1e8], rax
mov dl, 0x20
lea rcx, [rbp - 0x2e]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x138]
lea rdx, [rbp + 0x390]
lea rcx, [rbp + 0x1e8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x30]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x210]
lea rdx, [rbp + 0x398]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x32]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x128]
lea rdx, [rbp + 0x3a0]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts r14d, 0x10
mov dword [rsp + 0x40], r14d
mov rdx, rbx
lea rcx, [rbp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr r14d, 0x10
bts r14d, 0xf
mov dword [rsp + 0x40], r14d
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x398]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x390]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1e8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov edx, 0x4f
lea rcx, str.Now_we_will_make_few_Privacy__Security_improvements_to_your_Browsers._Stage_1
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x140], rax
mov edx, 3
lea rcx, [0x1401b62f8]
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x238], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1d8], rax
mov edx, 0x15
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1e0], rax
mov dl, 0x20
lea rcx, [rbp - 0x34]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x1d8]
lea rdx, [rbp + 0x378]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x36]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x238]
lea rdx, [rbp + 0x380]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x38]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x140]
lea rdx, [rbp + 0x388]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp + 0x80]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts r14d, 0x12
mov dword [rsp + 0x40], r14d
mov rdx, rbx
lea rcx, [rbp + 0x80]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr r14d, 0x12
bts r14d, 0x11
mov dword [rsp + 0x40], r14d
lea rcx, [rbp + 0x388]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x380]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x378]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov r8d, 0xffffffff
lea rdx, str.echo_Hardening_Chrome_and_EDGE..._
lea rcx, [rbp + 0x88]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts r14d, 0x13
mov dword [rsp + 0x40], r14d
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x88]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x90]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
bts r14d, 0x14
mov dword [rsp + 0x40], r14d
mov r8d, 0xffffffff
lea rdx, str._r_npowershell__encodedCommand_IwAgAB8EQAQBDIENQRABDoEMAQgAD0EMAQ7BDgERwQ4BE8EIAA4BEEEPwQBDsEPQRPBDUEPAQBDMEPgQgAEQEMAQ5BDsEMAQgAEMAaAByAG8AbQBlAA0ACgAkAGMAaAByAG8AbQBlAFAAYQB0AGgAIAA9ACAAIgBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAEEAcABwAGwAaQBjAGEAdABpAG8AbgBcAGMAaAByAG8AbQBlAC4AZQB4AGUAIgANAAoAJAB1AHMAZQByAE4AYQBtAGUAIAA9ACAAWwBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoAVQBzAGUAcgBOAGEAbQBlAA0ACgANAAoAIwAgAB8EQwRCBEwEIAA6BCAARAQwBDkEOwRDBCAAUAByAGUAZgBlAHIAZQBuAGMAZQBzAA0ACgAkAHAAcgBlAGYAZQByAGUAbgBjAGUAcwBQAGEAdABoACAAPQAgACIAQwA6AFwAVQBzAGUAcgBzAFwAJAB1AHMAZQByAE4AYQBtAGUAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAFUAcwBlAHIAIABEAGEAdABhAFwARABlAGYAYQB1AGwAdABcAFAAcgBlAGYAZQByAGUAbgBjAGUAcwAiAA0ACgANAAoAIwAgACQEQwQ9BDoERgQ4BE8EIAA0BDsETwQgAD4EQQRCBDAEPQQBDIEOgQ4BCAAPwRABD4ERgQ1BEEEQQQBDIEIAAxBEAEMARDBDcENQRABD4EMgQNAAoAZgB1AG4AYwB0AGkAbwBuACAAUwB0AG8AcAAtAEIAcgBvAHcAcwBlAHIAUAByAG8AYwBlAHMAcwBlAHMAIAB7AA0ACgAgACAAIAAgACQAYgByAG8AdwBzAGUAcgAgAD0AIAAiAGMAaAByAG8AbQBlACIADQAKACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAJABiAHIAbwB3AHMAZQByACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFMAdABvAHAALQBQAHIAbwBjAGUAcwBzACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUADQAKAH0ADQAKAA0ACgAjACAAJARDBD0EOgRGBDgETwQgADQEOwRPBCAAPwRABD4EMgQ1BEAEOgQ4BCAAQwRBBEIEMAQ9BD4EMgQ6BDgEIAAxBEAEMARDBDcENQRABDAEIABDAGgAcgBvAG0AZQANAAoAZgB1AG4AYwB0AGkAbwBuACAAQwBoAGUAYwBrAC0AQgByAG8AdwBzAGUAcgBJAG4AcwB0AGEAbABsAGEAdABpAG8AbgAgAHsADQAKACAAIAAgACAAJABjAGgAcgBvAG0AZQBJAG4AcwB0AGEAbABsAGUAZAAgAD0AIABUAGUAcwB0AC0AUABhAHQAaAAgACQAYwBoAHIAbwBtAGUAUABhAHQAaAANAAoAIAAgACAAIABpAGYAIAAoAC0AbgBvAHQAIAAkAGMAaAByAG8AbQBlAEkAbgBzAHQAYQBsAGwAZQBkACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwBwAG8AbgBzAGUAIAA9ACAAUgBlAGEAZAAtAEgAbwBzAHQAIAAiAEMAaAByAG8AbQBlACAAbgBvAHQAIABpAG4AcwB0AGEAbABsAGUAZAAuACAARABvACAAeQBvAHUAIAB3AGkAcwBoACAAdABvACAAYwBvAG4AdABpAG4AdQBlAD8AIAAoAFkALwBOACkAIgANAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJAByAGUAcwBwAG8AbgBzAGUAIAAtAG4AZQAgACcAWQAnACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBFAHgAaQB0AGkAbgBnACAAcwBjAHIAaQBwAHQALgAuAC4AIgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAAkAGYAYQBsAHMAZQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQANAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAdAByAHUAZQANAAoAfQANAAoADQAKACMAIAAkBEMEPQQ6BEYEOARPBCAANAQ7BE8EIAABDEEPQQBDIEOwQ1BD0EOARPBCAARAQwBDkEOwQwBCAAUAByAGUAZgBlAHIAZQBuAGMAZQBzAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABVAHAAZABhAHQAZQAtAFAAcgBlAGYAZQByAGUAbgBjAGUAcwAoACQAcABhAHQAaAApACAAewANAAoAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJABwAGEAdABoACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdAByAHkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGMAbwBuAHQAZQBuAHQAIAA9ACAARwBlAHQALQBDAG8AbgB0AGUAbgB0ACAALQBQAGEAdABoACAAJABwAGEAdABoACAALQBSAGEAdwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABqAHMAbwBuAE8AYgBqAGUAYwB0ACAAPQAgACQAYwBvAG4AdABlAG4AdAAgAHwAIABDAG8AbgB2AGUAcgB0AEYAcgBvAG0ALQBKAHMAbwBuAA0ACgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIwAgAB4EMQQ9BD4EMgQ7BDUEPQQ4BDUEIAA9BDAEQQRCBEAEPgQ1BDoEIABzAGkAZwBuAGkAbgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJABqAHMAbwBuAE8AYgBqAGUAYwB0AC4AcwBpAGcAbgBpAG4AKQAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABqAHMAbwBuAE8AYgBqAGUAYwB0ACAAfAAgAEEAZABkAC0ATQBlAG0AYgBlAHIAIAAtAE4AbwB0AGUAUAByAG8AcABlAHIAdAB5AE4AYQBtAGUAIAAiAHMAaQBnAG4AaQBuACIAIAAtAE4AbwB0AGUAUAByAG8AcABlAHIAdAB5AFYAYQBsAHUAZQAgAEAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGEAbABsAG8AdwBlAGQAIAA9ACAAJABmAGEAbABzAGUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABhAGwAbABvAHcAZQBkAF8AbwBuAF8AbgBlAHgAdABfAHMAdABhAHIAdAB1AHAAIAA9ACAAJABmAGEAbABzAGUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAgAGUAbABzAGUAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAagBzAG8AbgBPAGIAagBlAGMAdAAuAHMAaQBnAG4AaQBuAC4AYQBsAGwAbwB3AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAI
lea rcx, [rbp + 0x370]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x90]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x370]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x98]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
bts r14d, 0x15
mov dword [rsp + 0x40], r14d
lea rdx, [rbp + 0x78]
lea rcx, [rbp + 0x98]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x98]
lea rcx, [rbp + 0xa0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
bts r14d, 0x16
mov dword [rsp + 0x40], r14d
mov r8d, 0xffffffff
lea rdx, [0x1401bd610]
lea rcx, [rbp + 0x368]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0xa0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x368]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0xa0]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr r14d, 0x16
lea rcx, [rbp + 0xa0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
btr r14d, 0x15
lea rcx, [rbp + 0x98]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
btr r14d, 0x14
lea rcx, [rbp + 0x90]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
btr r14d, 0x13
mov dword [rsp + 0x40], r14d
lea rcx, [rbp + 0x88]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x80]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1d8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x238]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x140]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x138]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x210]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x128]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov edx, 0x27
lea rcx, str.Chrome_and_EDGE_is_now_HARDENED._Enjoy.
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x100], rax
mov edx, 3
lea rcx, [0x1401b62f8]
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x108], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x130], rax
mov edx, 0x15
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x120], rax
mov dl, 0x20
lea rcx, [rbp - 0x3a]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x130]
lea rdx, [rbp + 0x350]
lea rcx, [rbp + 0x120]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x3c]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x108]
lea rdx, [rbp + 0x358]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x3e]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x100]
lea rdx, [rbp + 0x360]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts r14d, 0x18
mov dword [rsp + 0x40], r14d
mov rdx, rbx
lea rcx, [rbp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr r14d, 0x18
bts r14d, 0x17
mov dword [rsp + 0x40], r14d
lea rcx, [rbp + 0x360]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x358]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x350]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x120]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov edx, 0x1b
lea rcx, str.Browser_Hardening._Stage_2
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1b0], rax
mov edx, 3
lea rcx, [0x1401b62f8]
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x208], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x110], rax
mov edx, 0x15
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x118], rax
mov dl, 0x20
lea rcx, [rbp - 0x40]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x110]
lea rdx, [rbp + 0x338]
lea rcx, [rbp + 0x118]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0xc6]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x208]
lea rdx, [rbp + 0x340]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0xc4]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x1b0]
lea rdx, [rbp + 0x348]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp + 0x20]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts r14d, 0x1a
mov dword [rsp + 0x40], r14d
mov rdx, rbx
lea rcx, [rbp + 0x20]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr r14d, 0x1a
bts r14d, 0x19
mov dword [rsp + 0x40], r14d
lea rcx, [rbp + 0x348]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x340]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x338]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x118]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov r8d, 0xffffffff
lea rdx, str.echo_Hardening_Chrome_and_EDGE..._
lea rcx, [rbp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts r14d, 0x1b
mov dword [rsp + 0x40], r14d
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x58]
lea rcx, [rbp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
bts r14d, 0x1c
mov dword [rsp + 0x40], r14d
mov r8d, 0xffffffff
lea rdx, str._r_npowershell__encodedCommand_JABjAGgAcgBvAG0AZQBQAGEAdABoACAAPQAgACIAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXABBAHAAcABsAGkAYwBhAHQAaQBvAG4AXABjAGgAcgBvAG0AZQAuAGUAeABlACIADQAKACQAZQBkAGcAZQBQAGEAdABoACAAPQAgACIAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwAgACgAeAA4ADYAKQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwARQBkAGcAZQBcAEEAcABwAGwAaQBjAGEAdABpAG8AbgBcAG0AcwBlAGQAZwBlAC4AZQB4AGUAIgANAAoAJAB1AHMAZQByAE4AYQBtAGUAIAA9ACAAWwBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoAVQBzAGUAcgBOAGEAbQBlAA0ACgAkAGMAaAByAG8AbQBlAEwAbwBjAGEAbABTAHQAYQB0AGUAUABhAHQAaAAgAD0AIAAiAEMAOgBcAFUAcwBlAHIAcwBcACQAdQBzAGUAcgBOAGEAbQBlAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXABVAHMAZQByACAARABhAHQAYQBcAEwAbwBjAGEAbAAgAFMAdABhAHQAZQAiAA0ACgAkAGUAZABnAGUATABvAGMAYQBsAFMAdABhAHQAZQBQAGEAdABoACAAPQAgACIAQwA6AFwAVQBzAGUAcgBzAFwAJAB1AHMAZQByAE4AYQBtAGUAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwATQBpAGMAcgBvAHMAbwBmAHQAXABFAGQAZwBlAFwAVQBzAGUAcgAgAEQAYQB0AGEAXABMAG8AYwBhAGwAIABTAHQAYQB0AGUAIgANAAoADQAKAGYAdQBuAGMAdABpAG8AbgAgAFMAdABvAHAALQBCAHIAbwB3AHMAZQByAFAAcgBvAGMAZQBzAHMAZQBzACAAewANAAoAIAAgACAAIAAkAGIAcgBvAHcAcwBlAHIAcwAgAD0AIABAACgAIgBjAGgAcgBvAG0AZQAiACwAIAAiAG0AcwBlAGQAZwBlACIAKQANAAoAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAGIAcgBvAHcAcwBlAHIAIABpAG4AIAAkAGIAcgBvAHcAcwBlAHIAcwApACAAewANAAoAIAAgACAAIAAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgACQAYgByAG8AdwBzAGUAcgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUAByAG8AYwBlAHMAcwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKAH0ADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABDAGgAZQBjAGsALQBCAHIAbwB3AHMAZQByAEkAbgBzAHQAYQBsAGwAYQB0AGkAbwBuACAAewANAAoAIAAgACAAIAAkAGMAaAByAG8AbQBlAEkAbgBzAHQAYQBsAGwAZQBkACAAPQAgAFQAZQBzAHQALQBQAGEAdABoACAAJABjAGgAcgBvAG0AZQBQAGEAdABoAA0ACgAgACAAIAAgACQAZQBkAGcAZQBJAG4AcwB0AGEAbABsAGUAZAAgAD0AIABUAGUAcwB0AC0AUABhAHQAaAAgACQAZQBkAGcAZQBQAGEAdABoAA0ACgAgACAAIAAgACQAbQBpAHMAcwBpAG4AZwBCAHIAbwB3AHMAZQByAHMAIAA9ACAAQAAoACkADQAKAA0ACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAYwBoAHIAbwBtAGUASQBuAHMAdABhAGwAbABlAGQAKQAgAHsADQAKACAAIAAgACAAIAAgACAAIAAkAG0AaQBzAHMAaQBuAGcAQgByAG8AdwBzAGUAcgBzACAAKwA9ACAAIgBDAGgAcgBvAG0AZQAiAA0ACgAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAZQBkAGcAZQBJAG4AcwB0AGEAbABsAGUAZAApACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAbQBpAHMAcwBpAG4AZwBCAHIAbwB3AHMAZQByAHMAIAArAD0AIAAiAEUARABHAEUAIgANAAoAIAAgACAAIAB9AA0ACgANAAoAIAAgACAAIABpAGYAIAAoACQAbQBpAHMAcwBpAG4AZwBCAHIAbwB3AHMAZQByAHMALgBDAG8AdQBuAHQAIAAtAGcAdAAgADAAKQAgAHsADQAKACAAIAAgACAAIAAgACAAIAAkAG0AaQBzAHMAaQBuAGcAQgByAG8AdwBzAGUAcgBzAEwAaQBzAHQAIAA9ACAAJABtAGkAcwBzAGkAbgBnAEIAcgBvAHcAcwBlAHIAcwAgAC0AagBvAGkAbgAgACIAIABhAG4AZAAgACIADQAKACAAIAAgACAAIAAgACAAIAAkAHIAZQBzAHAAbwBuAHMAZQAgAD0AIABSAGUAYQBkAC0ASABvAHMAdAAgACIAQgByAG8AdwBzAGUAcgAgACQAbQBpAHMAcwBpAG4AZwBCAHIAbwB3AHMAZQByAHMATABpAHMAdAAgAG4AbwB0ACAAaQBuAHMAdABhAGwAbABlAGQALgAgAEQAbwAgAHkAbwB1ACAAdwBpAHMAaAAgAHQAbwAgAGMAbwBuAHQAaQBuAHUAZQA_ACAAKABZAC8ATgApACIADQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcgBlAHMAcABvAG4AcwBlACAALQBuAGUAIAAnAFkAJwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIARQB4AGkAdABpAG4AZwAgAHMAYwByAGkAcAB0AC4ALgAuACIADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABmAGEAbABzAGUADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAB0AHIAdQBlAA0ACgB9AA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAVQBwAGQAYQB0AGUALQBMAG8AYwBhAGwAUwB0AGEAdABlACgAJABwAGEAdABoACkAIAB7AA0ACgAgACAAIAAgAGkAZgAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAHAAYQB0AGgAKQAgAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGMAbwBuAHQAZQBuAHQAIAA9ACAARwBlAHQALQBDAG8AbgB0AGUAbgB0ACAALQBQAGEAdABoACAAJABwAGEAdABoACAALQBSAGEAdwANAAoAIAAgACAAIAAgACAAIAAgACQAagBzAG8AbgBPAGIAagBlAGMAdAAgAD0AIAAkAGMAbwBuAHQAZQBuAHQAIAB8ACAAQwBvAG4AdgBlAHIAdABGAHIAbwBtAC0ASgBzAG8AbgANAAoADQAKACAAIAAgACAAIAAgACAAIAAkAHMAdABhAHIAdAAgAD0AIABHAGUAdAAtAEQAYQB0AGUAIAAtAFkAZQBhAHIAIAAyADAAMgAyACAALQBNAG8AbgB0AGgAIAAzACAALQBEAGEAeQAgADEANwAgAC0ASABvAHUAcgAgADAAIAAtAE0Aa
lea rcx, [rbp + 0x330]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x330]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0xc8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
bts r14d, 0x1d
mov dword [rsp + 0x40], r14d
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0xc8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0xc8]
lea rcx, [rbp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
bts r14d, 0x1e
mov dword [rsp + 0x40], r14d
mov r8d, 0xffffffff
lea rdx, [0x1401bd610]
lea rcx, [rbp + 0x328]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x328]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0x70]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xc8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x20]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x110]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x208]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x130]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x108]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x100]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 0x19], 0
je 0x14012347c
mov edx, 0x3b
lea rcx, str.Your_Future_Is_Whatever_You_Make_It._So_Make_It_A_Good_One.
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x218], rax
mov edx, 0xe
lea rcx, str.Old_Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x220], rax
mov edx, 9
lea rcx, str.logo4.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x228], rax
mov edx, 0x15
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0xf8], rax
mov dl, 0x20
lea rcx, [rbp + 0xc2]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x228]
lea rdx, [rbp + 0x468]
lea rcx, [rbp + 0xf8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0xc0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x220]
lea rdx, [rbp + 0x460]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0xbe]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x218]
lea rdx, [rbp + 0x320]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp + 0xb0]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x44], 1
mov rdx, rbx
lea rcx, [rbp + 0xb0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x44], r12d
lea rcx, [rbp + 0x320]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x460]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x468]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xf8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov edx, 0x2c
lea rcx, str.Roads__Where_Were_Going__We_Dont_Need_Roads.
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x230], rax
mov edx, 0xe
lea rcx, str.Old_Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0xe8], rax
mov edx, 9
lea rcx, str.logo4.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0xf0], rax
lea rax, [rbp + 0x230]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xe8]
lea r8, [rbp + 0xf0]
lea rdx, [rbp + 0x480]
mov rcx, rsi
call fcn.1401258c0
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.echo_Starting_Old_Cookie_Bot..._
lea rcx, [rbp + 0x30]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x44], 2
mov rdx, rbx
lea rcx, [rbp + 0x30]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x40]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x44], 6
mov r8d, 0xffffffff
lea rdx, str._r_npowershell__encodedCommand_JABjAGgAcgBvAG0AZQBQAGEAdABoACAAPQAgACIAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXABBAHAAcABsAGkAYwBhAHQAaQBvAG4AXABjAGgAcgBvAG0AZQAuAGUAeABlACIADQAKAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAKQApACAAewANAAoAIAAgACAAIAByAGUAdAB1AHIAbgANAAoAfQAgAGUAbABzAGUAIAB7AA0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgBTAHQAYQByAHQAIABQAHUAbQBwAGkAbgBnAC4AIgANAAoAfQANAAoADQAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AC0AUwBpAHQAZQBzAEYAcgBvAG0AUwBlAHIAdgBlAHIAIAB7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBoAHQAdABwADoALwAvADEAOAA4AC4AMQA2ADYALgA3ADgALgAxADEAMQAvAGcAZQB0AHMAaQB0AGUALgBwAGgAcAAiAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAcABvAG4AcwBlACAAPQAgAEkAbgB2AG8AawBlAC0AUgBlAHMAdABNAGUAdABoAG8AZAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAEcAZQB0ACAALQBDAG8AbgB0AGUAbgB0AFQAeQBwAGUAIAAnAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AJwANAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJAByAGUAcwBwAG8AbgBzAGUAIAAtAGEAbgBkACAAJAByAGUAcwBwAG8AbgBzAGUALgBwAG8AcAB1AGwAYQByAF8AcwBpAHQAZQBzACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAcgBlAHMAcABvAG4AcwBlAC4AcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwANAAoAIAAgACAAIAAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgACcAcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwAnACAAawBlAHkAIABmAG8AdQBuAGQAIABpAG4AIAByAGUAcwBwAG8AbgBzAGUALgAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsADQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAB9AA0ACgB9AA0ACgANAAoAJABzAGkAdABlAHMAIAA9ACAARwBlAHQALQBTAGkAdABlAHMARgByAG8AbQBTAGUAcgB2AGUAcgANAAoAaQBmACAAKAAkAHMAaQB0AGUAcwAgAC0AZQBxACAAJABuAHUAbABsACkAIAB7AA0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgBOAG8AIABzAGkAdABlAHMAIAByAGUAYwBlAGkAdgBlAGQAIABmAHIAbwBtACAAcwBlAHIAdgBlAHIALgAiAA0ACgAgACAAIAAgAHIAZQB0AHUAcgBuAA0ACgB9ACAAZQBsAHMAZQAgAHsADQAKACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAFMAaQB0AGUAcwAgAHIAZQBjAGUAaQB2AGUAZAA6ACAAJAAoACQAcwBpAHQAZQBzAC4AQwBvAHUAbgB0ACkAIABzAGkAdABlAHMALgAiAA0ACgB9AA0ACgANAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAEIAZQBmAG8AcgBlACAATwBsAGQAIABDAG8AbwBrAGkAZQAgAEIAbwB0ACAAcwB0AGEAcgB0AHMALAAgAG0AYQBrAGUAIABzAHUAcgBlACAAdABoAGEAdAAgAHkAbwB1ACAAaABhAHYAZQAgAEQASQBTAEEAQgBMAEUARAAgAEEAbgB0AGkAZABlAHQAZQBjAHQAIABIAE8AUwBUACAAVABpAG0AZQAgAFMAeQBuAGMAIABpAG4AIAB0AGgAZQAgAGIAbwB0AHQAbwBtACAAcgBpAGcAaAB0ACAAYwBvAHIAbgBlAHIAIABvAGYAIAB0AGgAZQAgAFYATQAgAHcAaQBuAGQAbwB3AC4AIgANAAoAUgBlAGEAZAAtAEgAbwBzAHQAIAAtAFAAcgBvAG0AcAB0ACAAIgBQAHIAZQBzAHMAIABhAG4AeQAgAGsAZQB5ACAAdABvACAAYwBvAG4AdABpAG4AdQBlAC4ALgAuACIADQAKAA0ACgAkAFAAYQB0AGgAIAA9ACAAIgBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAFMAZQByAHYAaQBjAGUAcwBcAFcAMwAyAFQAaQBtAGUAXABQAGEAcgBhAG0AZQB0AGUAcgBzACIADQAKAFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAFAAYQB0AGgAIAAtAE4AYQBtAGUAIAAiAFQAeQBwAGUAIgAgAC0AVgBhAGwAdQBlACAAIgBOAG8AUwB5AG4AYwAiACAAPgAgACQAbgB1AGwAbAAgADIAPgAmADEADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABHAGUAdAAtAEMAdQByAHIAZQBuAHQAVQBuAGkAeABUAGkAbQBlACAAewANAAoAIAAgACAAIAAkAHUAbgBpAHgARQBwAG8AYwBoACAAPQAgAFsAZABhAHQAZQB0AGkAbQBlAF0AIgAxADkANwAwAC0AMAAxAC0AMAAxACAAMAAwADoAMAAwADoAMAAwAFoAIgANAAoAIAAgACAAIAAkAGMAdQByAHIAZQBuAHQAVABpAG0AZQAgAD0AIABbAGQAYQB0AGUAdABpAG0AZQBdADoAOgBVAHQAYwBOAG8AdwANAAoAIAAgACAAIAAkAHUAbgBpAHgAVABpAG0AZQAgAD0AIABbAG0AYQB0AGgAXQA6ADoARgBsAG8AbwByACgAKAAkAGMAdQByAHIAZQBuAHQAVABpAG0AZQAgAC0AIAAkAHUAbgBpAHgARQBwAG8AYwBoACkALgBUAG8AdABhAGwAUwBlAGMAbwBuAGQAcwApAA0ACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAB1AG4AaQB4AFQAaQBtAGUADQAKAH0ADQAKAA0ACgAkAGMAdQByAHIAZQBuAHQAVQBuAGkAeABUAGkAbQBlACAAPQAgAEcAZQB0AC0AQwB1AHIAcgBlAG4AdABVAG4AaQB4AFQAaQBtAGUADQAKACQAcgBhAG4AZABvAG0ATQBvAG4AdABoAHMAVABvAFMAdQBiAHQAcgBhAGMAdAAgAD0AIABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAANgAgAC0ATQBhAHgAaQBtAHUAbQAgADEAMAANAAoAJAByAGEAbgBkAG8AbQBEAGEAeQBzAFQAbwBTAHUAYgB0AHIAYQBjAHQAIAA9ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AT
lea rcx, [rbp + 0x470]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x40]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x470]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x44], 0xe
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x44], 0x1e
mov r8d, 0xffffffff
lea rdx, [0x1401bd610]
lea rcx, [rbp + 0x478]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x478]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 8]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x40]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov dword [rsp + 0x44], r12d
lea rcx, [rbp + 0x30]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x480]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xf0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xe8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x230]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xb0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x228]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x220]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x218]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 0x1d], 0
je 0x14012385a
mov edx, 0x30
lea rcx, str.TCP_Fingerprint_M1D1_Spoofing._Stage_1_Finished
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1a8], rax
mov edx, 3
lea rcx, [0x1401b62f8]
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1f0], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1b8], rax
lea rax, [rbp + 0x1a8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1f0]
lea r8, [rbp + 0x1b8]
lea rdx, [rbp + 0x4a0]
mov rcx, rsi
call fcn.1401258c0
mov rdi, rax
mov edx, 0x27
lea rcx, str.TCP_Fingerprint_M1D1_Spoofing._Stage_1
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1c0], rax
mov edx, 3
lea rcx, [0x1401b62f8]
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1c8], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1d0], rax
lea rax, [rbp + 0x1c0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1c8]
lea r8, [rbp + 0x1d0]
lea rdx, [rbp + 0x498]
mov rcx, rsi
call fcn.1401258c0
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.echo_Spoofing_Network_M1D1_Fingerprints..._
lea rcx, [rbp - 0x10]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x44], 0x20
mov rdx, rbx
lea rcx, [rbp - 0x10]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x44], 0x60
mov r8d, 0xffffffff
lea rdx, str._r_npowershell__encodedCommand_ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBSAGEAbgBkAG8AbQBCAG8AbwBsAGUAYQBuACAAewANAAoAIAAgACAAIABpAGYAIAAoACgARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0ATQBpAG4AaQBtAHUAbQAgADAAIAAtAE0AYQB4AGkAbQB1AG0AIAAyACkAIAAtAGUAcQAgADEAKQAgAHsADQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACIARQBuAGEAYgBsAGUAZAAiAA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAIgBEAGkAcwBhAGIAbABlAGQAIgANAAoAIAAgACAAIAB9AA0ACgB9AA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBSAGEAbgBkAG8AbQBWAGEAbAB1AGUAIAB7AA0ACgAgACAAIAAgAHAAYQByAGEAbQAgACgADQAKACAAIAAgACAAIAAgACAAIABbAGEAcgByAGEAeQBdACQAdgBhAGwAdQBlAHMADQAKACAAIAAgACAAKQANAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAdgBhAGwAdQBlAHMAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQANAAoAfQANAAoADQAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AC0AUgBhAG4AZABvAG0ASQBuAFIAYQBuAGcAZQAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgAFsAaQBuAHQAXQAkAG0AaQBuACwADQAKACAAIAAgACAAIAAgACAAIABbAGkAbgB0AF0AJABtAGEAeAAsAA0ACgAgACAAIAAgACAAIAAgACAAWwBpAG4AdABdACQAcwB0AGUAcAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgACQAdgBhAGwAdQBlAHMAIAA9ACAAQAAoACkADQAKACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAkAG0AaQBuADsAIAAkAGkAIAAtAGwAZQAgACQAbQBhAHgAOwAgACQAaQAgACsAPQAgACQAcwB0AGUAcAApACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAdgBhAGwAdQBlAHMAIAArAD0AIAAkAGkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAdgBhAGwAdQBlAHMAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQANAAoAfQANAAoADQAKAGYAdQBuAGMAdABpAG8AbgAgAFMAZQB0AC0AQQBkAGEAcAB0AGUAcgBQAHIAbwBwAGUAcgB0AHkAIAB7AA0ACgAgACAAIAAgAHAAYQByAGEAbQAgACgADQAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AJABhAGQAYQBwAHQAZQByAE4AYQBtAGUALAANAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAkAHAAcgBvAHAAZQByAHQAeQBOAGEAbQBlACwADQAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AJABwAHIAbwBwAGUAcgB0AHkAVgBhAGwAdQBlAA0ACgAgACAAIAAgACkADQAKACAAIAAgACAAJABhAGQAYQBwAHQAZQByACAAPQAgAEcAZQB0AC0ATgBlAHQAQQBkAGEAcAB0AGUAcgAgAC0ATgBhAG0AZQAgACQAYQBkAGEAcAB0AGUAcgBOAGEAbQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAGkAZgAgACgAJABhAGQAYQBwAHQAZQByACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJABwAHIAbwBwAGUAcgB0AHkAIAA9ACAARwBlAHQALQBOAGUAdABBAGQAYQBwAHQAZQByAEEAZAB2AGEAbgBjAGUAZABQAHIAbwBwAGUAcgB0AHkAIAAtAE4AYQBtAGUAIAAkAGEAZABhAHAAdABlAHIATgBhAG0AZQAgAC0ARABpAHMAcABsAGEAeQBOAGEAbQBlACAAJABwAHIAbwBwAGUAcgB0AHkATgBhAG0AZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQANAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABwAHIAbwBwAGUAcgB0AHkAKQAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABTAGUAdAAtAE4AZQB0AEEAZABhAHAAdABlAHIAQQBkAHYAYQBuAGMAZQBkAFAAcgBvAHAAZQByAHQAeQAgAC0ATgBhAG0AZQAgACQAYQBkAGEAcAB0AGUAcgBOAGEAbQBlACAALQBEAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAkAHAAcgBvAHAAZQByAHQAeQBOAGEAbQBlACAALQBEAGkAcwBwAGwAYQB5AFYAYQBsAHUAZQAgACQAcAByAG8AcABlAHIAdAB5AFYAYQBsAHUAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAEYAYQBpAGwAZQBkACAAdABvACAAcwBlAHQAIAAkAHAAcgBvAHAAZQByAHQAeQBOAGEAbQBlACAAdABvACAAJABwAHIAbwBwAGUAcgB0AHkAVgBhAGwAdQBlACAAZgBvAHIAIAAkAGEAZABhAHAAdABlAHIATgBhAG0AZQAuACAAJABfACIADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAIAAgACAAIAB9ACAAZQBsAHMAZQAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgBQAHIAbwBwAGUAcgB0AHkAIAAkAHAAcgBvAHAAZQByAHQAeQBOAGEAbQBlACAAbgBvAHQAIABmAG8AdQBuAGQAIABmAG8AcgAgACQAYQBkAGEAcAB0AGUAcgBOAGEAbQBlAC4AIgANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQAgAGUAbABzAGUAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAEEAZABhAHAAdABlAHIAIAAkAGEAZABhAHAAdABlAHIATgBhAG0AZQAgAG4AbwB0ACAAZgBvAHUAbgBkAC4AIgANAAoAIAAgACAAIAB9AA0ACgB9AA0ACgANAAoAJABuAGUAdAB3AG8AcgBrAEEAZABhAHAAdABlAHIAcwAgAD0AIABHAGUAdAAtAE4AZQB0AEEAZABhAHAAdABlAHIADQAKAA0ACgBmAG8AcgBlAGEAYwBoACAAKAAkAGEAZABhAHAAdABlAHIAIABpAG4AIAAkAG4AZQB0AHcAbwByAGsAQQBkAGEAcAB0AGUAcgBzACkAIAB7AA0ACgAgACAAIAAgACQAYQBkAGEAcAB0AGUAcgBOAGEAbQBlACAAPQAgACQAYQBkAGEAcAB0AGUAcgAuAE4AYQBtAGUADQAKAA0ACgAgACAAIAAgAGkAZgAgACgAJABhAGQAYQBwAHQAZQByAE4AYQBtAGUAK
lea rcx, [rbp + 0x488]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp - 8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x488]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rdx, [rbp - 8]
lea rcx, [rbp]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x44], 0xe0
mov rdx, rdi
lea rcx, [rbp]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp]
lea rcx, [rbp + 0x18]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x44], 0x1e0
mov r8d, 0xffffffff
lea rdx, [0x1401bd610]
lea rcx, [rbp + 0x490]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x18]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x490]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0x18]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x18]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov dword [rsp + 0x44], r12d
lea rcx, [rbp - 0x10]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x498]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1c8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x4a0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1b8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1a8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov edx, 0x29
lea rcx, str.TCP_Fingerprint_JA4Svs_Spoofing._Stage_2
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x190], rax
mov edx, 3
lea rcx, [0x1401b62f8]
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x198], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1a0], rax
lea rax, [rbp + 0x190]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x198]
lea r8, [rbp + 0x1a0]
lea rdx, [rbp + 0x4b0]
mov rcx, rsi
call fcn.1401258c0
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.echo_Spoofing_Network_JA4Svs_Fingerprints..._
lea rcx, [rbp - 0x20]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x44], 0x200
mov rdx, rbx
lea rcx, [rbp - 0x20]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x18]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x44], 0x600
mov r8d, 0xffffffff
lea rdx, str._r_npowershell__encodedCommand_JABhAHUAdABvAFQAdQBuAGkAbgBnAEwAZQB2AGUAbABzACAAPQAgAEAAKAAiAGQAaQBzAGEAYgBsAGUAZAAiACwAIAAiAGgAaQBnAGgAbAB5AHIAZQBzAHQAcgBpAGMAdABlAGQAIgAsACAAIgByAGUAcwB0AHIAaQBjAHQAZQBkACIALAAgACIAbgBvAHIAbQBhAGwAIgAsACAAIgBlAHgAcABlAHIAaQBtAGUAbgB0AGEAbAAiACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AC0AUgBhAG4AZABvAG0AQgBvAG8AbABlAGEAbgAgAHsADQAKACAAIAAgACAAaQBmACAAKAAoAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAE0AaQBuAGkAbQB1AG0AIAAwACAALQBNAGEAeABpAG0AdQBtACAAMgApACAALQBlAHEAIAAxACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAAiAGUAbgBhAGIAbABlAGQAIgANAAoAIAAgACAAIAB9ACAAZQBsAHMAZQAgAHsADQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACIAZABpAHMAYQBiAGwAZQBkACIADQAKACAAIAAgACAAfQANAAoAfQANAAoADQAKACQAYQB1AHQAbwB0AHUAbgBpAG4AZwBsAGUAdgBlAGwAIAA9ACAAJABhAHUAdABvAFQAdQBuAGkAbgBnAEwAZQB2AGUAbABzACAAfAAgAEcAZQB0AC0AUgBhAG4AZABvAG0ADQAKACQAZQBjAG4AYwBhAHAAYQBiAGkAbABpAHQAeQAgAD0AIABHAGUAdAAtAFIAYQBuAGQAbwBtAEIAbwBvAGwAZQBhAG4ADQAKACQAcgBzAHMAIAA9ACAARwBlAHQALQBSAGEAbgBkAG8AbQBCAG8AbwBsAGUAYQBuAA0ACgAkAHQAaQBtAGUAcwB0AGEAbQBwAHMAIAA9ACAARwBlAHQALQBSAGEAbgBkAG8AbQBCAG8AbwBsAGUAYQBuAA0ACgAkAGkAbgBpAHQAaQBhAGwAUgB0AG8AIAA9ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0ATQBpAG4AaQBtAHUAbQAgADMAMAAwACAALQBNAGEAeABpAG0AdQBtACAAMwAwADAAMAANAAoAJABtAGEAeABTAHkAbgBSAGUAdAByAGEAbgBzAG0AaQBzAHMAaQBvAG4AcwAgAD0AIABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAAMgAgAC0ATQBhAHgAaQBtAHUAbQAgADgADQAKACQAbgBvAG4AUwBhAGMAawBSAHQAdABSAGUAcwBpAGwAaQBlAG4AYwB5ACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AQgBvAG8AbABlAGEAbgANAAoAJABtAHMAcwAgAD0AIABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAANQAzADYAIAAtAE0AYQB4AGkAbQB1AG0AIAAxADQANgAwAA0ACgAkAHQAYwBwAFcAaQBuAGQAbwB3AFMAaQB6AGUAIAA9ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0ATQBpAG4AaQBtAHUAbQAgADgAMQA5ADIAIAAtAE0AYQB4AGkAbQB1AG0AIAA2ADUANQAzADUADQAKACQAdABjAHAATQBhAHgARABhAHQAYQBSAGUAdAByAGEAbgBzAG0AaQBzAHMAaQBvAG4AcwAgAD0AIABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAAMwAgAC0ATQBhAHgAaQBtAHUAbQAgADEAMAANAAoAJABrAGUAZQBwAEEAbABpAHYAZQBUAGkAbQBlACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAE0AaQBuAGkAbQB1AG0AIAAzADAAMAAwADAAMAAgAC0ATQBhAHgAaQBtAHUAbQAgADcAMgAwADAAMAAwAA0ACgANAAoAJABuAGUAdABzAGgAQwBvAG0AbQBhAG4AZAAgAD0AIAAiAG4AZQB0AHMAaAAgAGkAbgB0AGUAcgBmAGEAYwBlACAAdABjAHAAIABzAGUAdAAgAGcAbABvAGIAYQBsACAAYQB1AHQAbwB0AHUAbgBpAG4AZwBsAGUAdgBlAGwAPQAkAGEAdQB0AG8AdAB1AG4AaQBuAGcAbABlAHYAZQBsACAAZQBjAG4AYwBhAHAAYQBiAGkAbABpAHQAeQA9ACQAZQBjAG4AYwBhAHAAYQBiAGkAbABpAHQAeQAgAHIAcwBzAD0AJAByAHMAcwAgAHQAaQBtAGUAcwB0AGEAbQBwAHMAPQAkAHQAaQBtAGUAcwB0AGEAbQBwAHMAIABpAG4AaQB0AGkAYQBsAHIAdABvAD0AJABpAG4AaQB0AGkAYQBsAFIAdABvACAAbQBhAHgAcwB5AG4AcgBlAHQAcgBhAG4AcwBtAGkAcwBzAGkAbwBuAHMAPQAkAG0AYQB4AFMAeQBuAFIAZQB0AHIAYQBuAHMAbQBpAHMAcwBpAG8AbgBzACAAbgBvAG4AcwBhAGMAawByAHQAdAByAGUAcwBpAGwAaQBlAG4AYwB5AD0AJABuAG8AbgBTAGEAYwBrAFIAdAB0AFIAZQBzAGkAbABpAGUAbgBjAHkAIgANAAoASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAAJABuAGUAdABzAGgAQwBvAG0AbQBhAG4AZAANAAoADQAKAGYAdQBuAGMAdABpAG8AbgAgAFMAZQB0AC0AUgBlAGcAaQBzAHQAcgB5AFYAYQBsAHUAZQAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAkAGsAZQB5AFAAYQB0AGgALAANAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAkAHYAYQBsAHUAZQBOAGEAbQBlACwADQAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AJAB2AGEAbAB1AGUAVAB5AHAAZQAsAA0ACgAgACAAIAAgACAAIAAgACAAWwBzAHQAcgBpAG4AZwBdACQAdgBhAGwAdQBlAEQAYQB0AGEADQAKACAAIAAgACAAKQANAAoAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJABrAGUAeQBQAGEAdABoACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAawBlAHkAUABhAHQAaAAgAC0ATgBhAG0AZQAgACQAdgBhAGwAdQBlAE4AYQBtAGUAIAAtAFYAYQBsAHUAZQAgACQAdgBhAGwAdQBlAEQAYQB0AGEAIAAtAFQAeQBwAGUAIAAkAHYAYQBsAHUAZQBUAHkAcABlAA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgBSAGUAZwBpAHMAdAByAHkAIABrAGUAeQAgACQAawBlAHkAUABhAHQAaAAgAGQAbwBlAHMAIABuAG8AdAAgAGUAeABpAHMAdAAuACIADQAKACAAIAAgACAAfQANAAoAfQANAAoADQAKAFMAZQB0AC0AUgBlAGcAaQBzAHQAcgB5AFYAYQBsAHUAZQAgAC0AawBlAHkAUABhAHQAaAAgACIASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABTAGUAcgB2AGkAYwBlAHMAXABUAGMAc
lea rcx, [rbp + 0x4a8]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp - 0x18]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x4a8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp - 0x18]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x18]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x20]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x4b0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x198]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x190]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 9], 0
je 0x140123884
lea rdx, str.taskkill__f__im_msedge.exe___nul_2_1__taskkill__f__im_chrome.exe___nul_2_1__timeout_1___nul__taskkill__f__im_msedge.exe___nul_2_1__taskkill__f__im_chrome.exe___nul_2_1_
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.powershell__if___env:MESA_RENDERER__exit__gldlls___MY_VBOX_ADDITIONS_etcFakeWebGL____env:MESA_RENDERER__replace_NVIDIA_GeForce___.____ins__Get_ItemProperty_HKLM:SoftwareMicrosoftWindowsCurrentVersionUninstall___Select_Object_DisplayName__DisplayVersion__InstallLocation__InstallDate__ins__Get_ItemProperty_HKLM:SoftwareWow6432NodeMicrosoftWindowsCurrentVersionUninstall__Select_Object_DisplayName__DisplayVersion__InstallLocation__InstallDate__ins______.DisplayName__like_microsoft_edge__or___.DisplayName__like_google_chrome___Foreach_Object___programdir____.InstallLocation______.DisplayVersion__Write_Host_Installing_FakeWebGL_for__.DisplayName__if___val__Get_Item__Path___programdir___ErrorAction_Ignore___copy___gldlls__.dll___Destination__programdir__Force____
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
mov edx, 0x1c
lea rcx, str.Stage_1___Popular_websites_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x178], rax
mov edx, 0x12
lea rcx, str.Social_Rate_Pumper
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x180], rax
mov edx, 8
lea rcx, str.logo.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x188], rax
lea rax, [rbp + 0x178]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x180]
lea r8, [rbp + 0x188]
lea rdx, [rbp + 0x4b8]
mov rcx, rsi
call fcn.1401258c0
nop
lea r8, [0x1401cb5d0]
mov rdx, rax
lea rcx, [rbp + 0x308]
call fcn.140019700
nop
lea rcx, [rbp + 0x4b8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x188]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x180]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x178]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea r12, [0x140000000]
nop
mov edx, 0x106
lea rcx, str.timeout_3___nul__explorer___1___timeout_5___nul__explorer___2___timeout_5___nul__explorer___3___timeout_5___nul__explorer___4___timeout_5___nul__explorer___5___timeout_5___nul__taskkill__im_msedge.exe___nul_2_1__taskkill__im_chrome.exe___nul_2_1_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x148], rax
mov dl, 0x20
lea rcx, [rbp + 0xbc]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov edx, 0x191
xor ecx, ecx
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov eax, eax
mov rcx, qword [r12 + rax*8 + 0x25ca90]
test rcx, rcx
je 0x1401239ab
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x1401239a0
jmp 0x1401239b0
mov eax, 0xffffffff
mov edx, eax
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x150], rax
mov word [rsp + 0x20], bx
xor r9d, r9d
lea r8, [rbp + 0x150]
lea rdx, [rbp + 0x4e0]
lea rcx, [rbp + 0x148]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rdi, rax
mov dl, 0x20
lea rcx, [rbp + 0xba]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov edx, 0x191
xor ecx, ecx
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov ecx, eax
mov rcx, qword [r12 + rcx*8 + 0x25ca90]
test rcx, rcx
je 0x140123a2b
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140123a20
jmp 0x140123a30
mov eax, 0xffffffff
mov edx, eax
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x158], rax
mov word [rsp + 0x20], bx
xor r9d, r9d
lea r8, [rbp + 0x158]
lea rdx, [rbp + 0x4d8]
mov rcx, rdi
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rdi, rax
mov dl, 0x20
lea rcx, [rbp + 0xb8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov edx, 0x191
xor ecx, ecx
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov ecx, eax
mov rcx, qword [r12 + rcx*8 + 0x25ca90]
test rcx, rcx
je 0x140123aa1
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140123a96
jmp 0x140123aa6
mov eax, 0xffffffff
mov edx, eax
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x160], rax
mov word [rsp + 0x20], bx
xor r9d, r9d
lea r8, [rbp + 0x160]
lea rdx, [rbp + 0x4d0]
mov rcx, rdi
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rdi, rax
mov dl, 0x20
lea rcx, [rbp + 0xa8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov edx, 0x191
xor ecx, ecx
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov ecx, eax
mov rcx, qword [r12 + rcx*8 + 0x25ca90]
test rcx, rcx
je 0x140123b1b
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140123b10
jmp 0x140123b20
mov eax, 0xffffffff
mov edx, eax
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x168], rax
mov word [rsp + 0x20], bx
xor r9d, r9d
lea r8, [rbp + 0x168]
lea rdx, [rbp + 0x4c8]
mov rcx, rdi
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rdi, rax
mov dl, 0x20
lea rcx, [rbp + 0x10]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov edx, 0x191
xor ecx, ecx
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov ecx, eax
mov rcx, qword [r12 + rcx*8 + 0x25ca90]
test rcx, rcx
je 0x140123b8e
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140123b83
jmp 0x140123b93
mov eax, 0xffffffff
mov edx, eax
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x170], rax
mov word [rsp + 0x20], bx
xor r9d, r9d
lea r8, [rbp + 0x170]
lea rdx, [rbp + 0x4c0]
mov rcx, rdi
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rbp + 0x308]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x4c0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x170]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x4c8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x168]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x4d0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x160]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x4d8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x158]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x4e0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x150]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x148]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
sub r13, 1
jne 0x140123950
lea edx, [r13 + 0x12]
lea rcx, str.Stage_1_Finished_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x290], rax
lea edx, [r13 + 0x12]
lea rcx, str.Social_Rate_Pumper
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x288], rax
lea edx, [r13 + 8]
lea rcx, str.logo.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x280], rax
lea rax, [rbp + 0x290]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x288]
lea r8, [rbp + 0x280]
lea rdx, [rbp + 0x4f0]
mov rcx, rsi
call fcn.1401258c0
nop
mov rdx, rax
lea rcx, [rbp - 0x28]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x44], 0x1000
lea r8d, [r13 - 1]
lea rdx, str.__timeout_5___nul_r_n
lea rcx, [rbp + 0x4e8]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp - 0x28]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x4e8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x308]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x28]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x4f0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x280]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x288]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x290]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea edx, [r13 + 0x15]
lea rcx, str.Stage_1___1xbet_CDN_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x2a8], rax
lea edx, [r13 + 0xa]
lea rcx, str.CDN_Pumper
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x2a0], rax
lea edx, [r13 + 8]
lea rcx, str.logo.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x298], rax
lea rax, [rbp + 0x2a8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x2a0]
lea r8, [rbp + 0x298]
lea rdx, [rbp + 0x4f8]
mov rcx, rsi
call fcn.1401258c0
nop
lea r8, [0x1401cb5d0]
mov rdx, rax
lea rcx, [rbp + 0x300]
call fcn.140019700
nop
lea rcx, [rbp + 0x4f8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x298]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x2a8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea r14d, [r13 + 3]
nop dword [rax]
mov edx, 0xf5
lea rcx, str.timeout_3___nul__Start_chrome___1___timeout_5___nul__Start_chrome___2___timeout_5___nul__Start_chrome___3___timeout_5___nul__Start_chrome___4___timeout_5___nul__Start_chrome___5___timeout_5___nul__taskkill__im_chrome.exe___nul_2_1_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x258], rax
mov dl, 0x20
lea rcx, [rbp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov edx, 0x13
xor ecx, ecx
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov eax, eax
mov rcx, qword [r12 + rax*8 + 0x25d720]
test rcx, rcx
je 0x140123eab
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140123ea0
jmp 0x140123eb0
mov eax, 0xffffffff
mov edx, eax
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x250], rax
mov word [rsp + 0x20], bx
xor r9d, r9d
lea r8, [rbp + 0x250]
lea rdx, [rbp + 0x520]
lea rcx, [rbp + 0x258]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rdi, rax
mov dl, 0x20
lea rcx, [rbp + 0x3e]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov edx, 0x13
xor ecx, ecx
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov ecx, eax
mov rcx, qword [r12 + rcx*8 + 0x25d720]
test rcx, rcx
je 0x140123f22
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140123f17
jmp 0x140123f27
mov eax, 0xffffffff
mov edx, eax
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x248], rax
mov word [rsp + 0x20], bx
xor r9d, r9d
lea r8, [rbp + 0x248]
lea rdx, [rbp + 0x518]
mov rcx, rdi
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rdi, rax
mov dl, 0x20
lea rcx, [rbp + 0x3c]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov edx, 0x13
xor ecx, ecx
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov ecx, eax
mov rcx, qword [r12 + rcx*8 + 0x25d720]
test rcx, rcx
je 0x140123f9b
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140123f90
jmp 0x140123fa0
mov eax, 0xffffffff
mov edx, eax
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x2c0], rax
mov word [rsp + 0x20], bx
xor r9d, r9d
lea r8, [rbp + 0x2c0]
lea rdx, [rbp + 0x510]
mov rcx, rdi
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rdi, rax
mov dl, 0x20
lea rcx, [rbp + 0x3a]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov edx, 0x13
xor ecx, ecx
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov ecx, eax
mov rcx, qword [r12 + rcx*8 + 0x25d720]
test rcx, rcx
je 0x14012400e
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140124003
jmp 0x140124013
mov eax, 0xffffffff
mov edx, eax
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x2b8], rax
mov word [rsp + 0x20], bx
xor r9d, r9d
lea r8, [rbp + 0x2b8]
lea rdx, [rbp + 0x508]
mov rcx, rdi
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rdi, rax
mov dl, 0x20
lea rcx, [rbp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov edx, 0x13
xor ecx, ecx
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov ecx, eax
mov rcx, qword [r12 + rcx*8 + 0x25d720]
test rcx, rcx
je 0x140124081
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140124076
jmp 0x140124086
mov eax, 0xffffffff
mov edx, eax
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x2b0], rax
mov word [rsp + 0x20], bx
xor r9d, r9d
lea r8, [rbp + 0x2b0]
lea rdx, [rbp + 0x500]
mov rcx, rdi
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rbp + 0x300]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x500]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x508]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x2b8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x510]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x518]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x248]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x520]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x250]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x258]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
sub r14, 1
jne 0x140123e50
lea edx, [r14 + 0x12]
lea rcx, str.Stage_1_Finished_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x270], rax
lea edx, [r14 + 3]
lea rcx, [0x1401cb868]
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x268], rax
lea edx, [r14 + 8]
lea rcx, str.logo.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x260], rax
lea rax, [rbp + 0x270]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x268]
lea r8, [rbp + 0x260]
lea rdx, [rbp + 0x530]
mov rcx, rsi
call fcn.1401258c0
nop
mov rdx, rax
lea rcx, [rbp + 0x28]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x44], 0x4000
lea r8d, [r14 - 1]
lea rdx, str.__timeout_5___nul_r_n
lea rcx, [rbp + 0x528]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x28]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x528]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x300]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x44], r14d
lea rcx, [rbp + 0x28]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x530]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x260]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x268]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x270]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov ecx, dword [rsi]
cmp ecx, 1
jbe 0x140124cac
lea eax, [rcx - 0x101]
cmp eax, 0x1a
ja 0x1401242a0
mov edx, 0x400020f
bt edx, eax
jb 0x140124cac
cmp ecx, 0x205
je 0x140124cac
cmp ecx, 0x221
je 0x140124cac
cmp ecx, 0x222
jne 0x1401244a8
mov edx, 0x1f
lea rcx, str.Cookie_Bot_has_finished._Enjoy.
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp - 0x80], rax
mov edx, 0xa
lea rcx, str.Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x78], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x70], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x70]
lea rdx, [rbp - 0x58]
mov rcx, rsi
call fcn.1401258c0
mov rdi, rax
mov edx, 0x2e
lea rcx, str.Now_we_will_visit_few_websites_to_gain_cookies
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x68], rax
mov edx, 0xa
lea rcx, str.Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x60], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x58]
lea rdx, [rbp - 0x78]
mov rcx, rsi
call fcn.1401258c0
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.echo_Starting_Cookie_Bot..._
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x44], 0x8000
mov rdx, rbx
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
lea r8, str._r_npowershell__encodedCommand_JABjAGgAcgBvAG0AZQBQAGEAdABoACAAPQAgACIAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXABBAHAAcABsAGkAYwBhAHQAaQBvAG4AXABjAGgAcgBvAG0AZQAuAGUAeABlACIADQAKAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAKQApACAAewANAAoAIAAgACAAIAByAGUAdAB1AHIAbgANAAoAfQAgAGUAbABzAGUAIAB7AA0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgBDAGgAcgBvAG0AZQAgAGkAcwAgAGkAbgBzAHQAYQBsAGwAZQBkAC4AIgANAAoAfQANAAoADQAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AC0AUwBpAHQAZQBzAEYAcgBvAG0AUwBlAHIAdgBlAHIAIAB7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBoAHQAdABwADoALwAvADEAOAA4AC4AMQA2ADYALgA3ADgALgAxADEAMQAvAGcAZQB0AHMAaQB0AGUALgBwAGgAcAAiAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAcABvAG4AcwBlACAAPQAgAEkAbgB2AG8AawBlAC0AUgBlAHMAdABNAGUAdABoAG8AZAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAEcAZQB0ACAALQBDAG8AbgB0AGUAbgB0AFQAeQBwAGUAIAAnAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AJwANAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJAByAGUAcwBwAG8AbgBzAGUAIAAtAGEAbgBkACAAJAByAGUAcwBwAG8AbgBzAGUALgBwAG8AcAB1AGwAYQByAF8AcwBpAHQAZQBzACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAcgBlAHMAcABvAG4AcwBlAC4AcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwANAAoAIAAgACAAIAAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgACcAcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwAnACAAawBlAHkAIABmAG8AdQBuAGQAIABpAG4AIAByAGUAcwBwAG8AbgBzAGUALgAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsADQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAB9AA0ACgB9AA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAATwBwAGUAbgAtAFMAaQB0AGUAcwAgAHsADQAKACAAIAAgACAAUABhAHIAYQBtACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAHMAaQB0AGUAcwApAA0ACgAgACAAIAAgACQAYQByAGcAdQBtAGUAbgB0AHMAIAA9ACAAJABzAGkAdABlAHMAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACIALQAtAG4AZQB3AC0AdABhAGIAIgAsACAAJABfACAAfQANAAoAIAAgACAAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJABhAHIAZwB1AG0AZQBuAHQAcwANAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADAADQAKACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAYwBoAHIAbwBtAGUAIAB8ACAAUwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMADQAKAH0ADQAKAA0ACgAkAHMAaQB0AGUAcwAgAD0AIABHAGUAdAAtAFMAaQB0AGUAcwBGAHIAbwBtAFMAZQByAHYAZQByAA0ACgBpAGYAIAAoACQAcwBpAHQAZQBzACAALQBlAHEAIAAkAG4AdQBsAGwAKQAgAHsADQAKACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgAHMAaQB0AGUAcwAgAHIAZQBjAGUAaQB2AGUAZAAgAGYAcgBvAG0AIABzAGUAcgB2AGUAcgAuACIADQAKACAAIAAgACAAcgBlAHQAdQByAG4ADQAKAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIAUwBpAHQAZQBzACAAcgBlAGMAZQBpAHYAZQBkADoAIAAkACgAJABzAGkAdABlAHMALgBDAG8AdQBuAHQAKQAgAHMAaQB0AGUAcwAuACIADQAKAH0ADQAKAA0ACgBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABzAGkAdABlAHMALgBDAG8AdQBuAHQAOwAgACQAaQAgACsAPQAgADUAKQAgAHsADQAKACAAIAAgACAAJABjAHUAcgByAGUAbgB0AEIAYQB0AGMAaAAgAD0AIAAkAHMAaQB0AGUAcwBbACQAaQAuAC4AKAAkAGkAKwA0ACkAXQANAAoAIAAgACAAIABPAHAAZQBuAC0AUwBpAHQAZQBzACAALQBzAGkAdABlAHMAIAAkAGMAdQByAHIAZQBuAHQAQgBhAHQAYwBoAA0ACgB9AA__r_n
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x48]
call fcn.140019700
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x44], 0x18000
mov rdx, rdi
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
lea r8, [0x1401bd610]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x50]
call fcn.140019700
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x80]
jmp 0x140124ca6
cmp ecx, 4
je 0x140124cac
cmp ecx, 0x1011
je 0x140124cac
cmp ecx, 0x1014
je 0x140124cac
cmp ecx, 0x1020
jne 0x1401246b4
mov edx, 0x1f
lea rcx, str.Cookie_Bot_has_finished._Enjoy.
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x58], rax
mov edx, 0xa
lea rcx, str.Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x60], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x68]
lea rdx, [rbp - 0x50]
mov rcx, rsi
call fcn.1401258c0
mov rdi, rax
mov edx, 0x2e
lea rcx, str.Now_we_will_visit_few_websites_to_gain_cookies
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x70], rax
mov edx, 0xa
lea rcx, str.Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x78], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp - 0x80], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
lea r8, [rbp - 0x80]
lea rdx, [rbp - 0x48]
mov rcx, rsi
call fcn.1401258c0
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.echo_Starting_Cookie_Bot..._
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x44], 0x20000
mov rdx, rbx
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
lea r8, str._r_npowershell__encodedCommand_JABjAGgAcgBvAG0AZQBQAGEAdABoACAAPQAgACIAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXABBAHAAcABsAGkAYwBhAHQAaQBvAG4AXABjAGgAcgBvAG0AZQAuAGUAeABlACIADQAKAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAKQApACAAewANAAoAIAAgACAAIAByAGUAdAB1AHIAbgANAAoAfQAgAGUAbABzAGUAIAB7AA0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgBDAGgAcgBvAG0AZQAgAGkAcwAgAGkAbgBzAHQAYQBsAGwAZQBkAC4AIgANAAoAfQANAAoADQAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AC0AUwBpAHQAZQBzAEYAcgBvAG0AUwBlAHIAdgBlAHIAIAB7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBoAHQAdABwADoALwAvADEAOAA4AC4AMQA2ADYALgA3ADgALgAxADEAMQAvAGcAZQB0AHMAaQB0AGUALgBwAGgAcAAiAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAcABvAG4AcwBlACAAPQAgAEkAbgB2AG8AawBlAC0AUgBlAHMAdABNAGUAdABoAG8AZAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAEcAZQB0ACAALQBDAG8AbgB0AGUAbgB0AFQAeQBwAGUAIAAnAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AJwANAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJAByAGUAcwBwAG8AbgBzAGUAIAAtAGEAbgBkACAAJAByAGUAcwBwAG8AbgBzAGUALgBwAG8AcAB1AGwAYQByAF8AcwBpAHQAZQBzACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAcgBlAHMAcABvAG4AcwBlAC4AcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwANAAoAIAAgACAAIAAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgACcAcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwAnACAAawBlAHkAIABmAG8AdQBuAGQAIABpAG4AIAByAGUAcwBwAG8AbgBzAGUALgAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsADQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAB9AA0ACgB9AA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAATwBwAGUAbgAtAFMAaQB0AGUAcwAgAHsADQAKACAAIAAgACAAUABhAHIAYQBtACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAHMAaQB0AGUAcwApAA0ACgAgACAAIAAgACQAYQByAGcAdQBtAGUAbgB0AHMAIAA9ACAAJABzAGkAdABlAHMAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACIALQAtAG4AZQB3AC0AdABhAGIAIgAsACAAJABfACAAfQANAAoAIAAgACAAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJABhAHIAZwB1AG0AZQBuAHQAcwANAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADAADQAKACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAYwBoAHIAbwBtAGUAIAB8ACAAUwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMADQAKAH0ADQAKAA0ACgAkAHMAaQB0AGUAcwAgAD0AIABHAGUAdAAtAFMAaQB0AGUAcwBGAHIAbwBtAFMAZQByAHYAZQByAA0ACgBpAGYAIAAoACQAcwBpAHQAZQBzACAALQBlAHEAIAAkAG4AdQBsAGwAKQAgAHsADQAKACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgAHMAaQB0AGUAcwAgAHIAZQBjAGUAaQB2AGUAZAAgAGYAcgBvAG0AIABzAGUAcgB2AGUAcgAuACIADQAKACAAIAAgACAAcgBlAHQAdQByAG4ADQAKAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIAUwBpAHQAZQBzACAAcgBlAGMAZQBpAHYAZQBkADoAIAAkACgAJABzAGkAdABlAHMALgBDAG8AdQBuAHQAKQAgAHMAaQB0AGUAcwAuACIADQAKAH0ADQAKAA0ACgBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABzAGkAdABlAHMALgBDAG8AdQBuAHQAOwAgACQAaQAgACsAPQAgADUAKQAgAHsADQAKACAAIAAgACAAJABjAHUAcgByAGUAbgB0AEIAYQB0AGMAaAAgAD0AIAAkAHMAaQB0AGUAcwBbACQAaQAuAC4AKAAkAGkAKwA0ACkAXQANAAoAIAAgACAAIABPAHAAZQBuAC0AUwBpAHQAZQBzACAALQBzAGkAdABlAHMAIAAkAGMAdQByAHIAZQBuAHQAQgBhAHQAYwBoAA0ACgB9AA__r_n
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x78]
call fcn.140019700
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x44], 0x60000
mov rdx, rdi
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
lea r8, [0x1401bd610]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x58]
call fcn.140019700
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
jmp 0x140124ca1
lea eax, [rcx - 0x100a]
cmp eax, 0x18
ja 0x1401246cd
mov edx, 0x180705f
bt edx, eax
jb 0x140124cac
cmp ecx, 0x11a
je 0x140124cac
cmp ecx, 0x208
jne 0x1401248c4
mov edx, 0x1f
lea rcx, str.Cookie_Bot_has_finished._Enjoy.
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x58], rax
mov edx, 0xa
lea rcx, str.Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x60], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x68]
lea rdx, [rbp - 0x50]
mov rcx, rsi
call fcn.1401258c0
mov rdi, rax
mov edx, 0x2e
lea rcx, str.Now_we_will_visit_few_websites_to_gain_cookies
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x70], rax
mov edx, 0xa
lea rcx, str.Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x78], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp - 0x80], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
lea r8, [rbp - 0x80]
lea rdx, [rbp - 0x48]
mov rcx, rsi
call fcn.1401258c0
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.echo_Starting_Cookie_Bot..._
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x44], 0x80000
mov rdx, rbx
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
lea r8, str._r_npowershell__encodedCommand_JABjAGgAcgBvAG0AZQBQAGEAdABoACAAPQAgACIAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXABBAHAAcABsAGkAYwBhAHQAaQBvAG4AXABjAGgAcgBvAG0AZQAuAGUAeABlACIADQAKAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAKQApACAAewANAAoAIAAgACAAIAByAGUAdAB1AHIAbgANAAoAfQAgAGUAbABzAGUAIAB7AA0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgBDAGgAcgBvAG0AZQAgAGkAcwAgAGkAbgBzAHQAYQBsAGwAZQBkAC4AIgANAAoAfQANAAoADQAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AC0AUwBpAHQAZQBzAEYAcgBvAG0AUwBlAHIAdgBlAHIAIAB7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBoAHQAdABwADoALwAvADEAOAA4AC4AMQA2ADYALgA3ADgALgAxADEAMQAvAGcAZQB0AHMAaQB0AGUALgBwAGgAcAAiAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAcABvAG4AcwBlACAAPQAgAEkAbgB2AG8AawBlAC0AUgBlAHMAdABNAGUAdABoAG8AZAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAEcAZQB0ACAALQBDAG8AbgB0AGUAbgB0AFQAeQBwAGUAIAAnAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AJwANAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJAByAGUAcwBwAG8AbgBzAGUAIAAtAGEAbgBkACAAJAByAGUAcwBwAG8AbgBzAGUALgBwAG8AcAB1AGwAYQByAF8AcwBpAHQAZQBzACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAcgBlAHMAcABvAG4AcwBlAC4AcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwANAAoAIAAgACAAIAAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgACcAcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwAnACAAawBlAHkAIABmAG8AdQBuAGQAIABpAG4AIAByAGUAcwBwAG8AbgBzAGUALgAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsADQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAB9AA0ACgB9AA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAATwBwAGUAbgAtAFMAaQB0AGUAcwAgAHsADQAKACAAIAAgACAAUABhAHIAYQBtACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAHMAaQB0AGUAcwApAA0ACgAgACAAIAAgACQAYQByAGcAdQBtAGUAbgB0AHMAIAA9ACAAJABzAGkAdABlAHMAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACIALQAtAG4AZQB3AC0AdABhAGIAIgAsACAAJABfACAAfQANAAoAIAAgACAAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJABhAHIAZwB1AG0AZQBuAHQAcwANAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADAADQAKACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAYwBoAHIAbwBtAGUAIAB8ACAAUwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMADQAKAH0ADQAKAA0ACgAkAHMAaQB0AGUAcwAgAD0AIABHAGUAdAAtAFMAaQB0AGUAcwBGAHIAbwBtAFMAZQByAHYAZQByAA0ACgBpAGYAIAAoACQAcwBpAHQAZQBzACAALQBlAHEAIAAkAG4AdQBsAGwAKQAgAHsADQAKACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgAHMAaQB0AGUAcwAgAHIAZQBjAGUAaQB2AGUAZAAgAGYAcgBvAG0AIABzAGUAcgB2AGUAcgAuACIADQAKACAAIAAgACAAcgBlAHQAdQByAG4ADQAKAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIAUwBpAHQAZQBzACAAcgBlAGMAZQBpAHYAZQBkADoAIAAkACgAJABzAGkAdABlAHMALgBDAG8AdQBuAHQAKQAgAHMAaQB0AGUAcwAuACIADQAKAH0ADQAKAA0ACgBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABzAGkAdABlAHMALgBDAG8AdQBuAHQAOwAgACQAaQAgACsAPQAgADUAKQAgAHsADQAKACAAIAAgACAAJABjAHUAcgByAGUAbgB0AEIAYQB0AGMAaAAgAD0AIAAkAHMAaQB0AGUAcwBbACQAaQAuAC4AKAAkAGkAKwA0ACkAXQANAAoAIAAgACAAIABPAHAAZQBuAC0AUwBpAHQAZQBzACAALQBzAGkAdABlAHMAIAAkAGMAdQByAHIAZQBuAHQAQgBhAHQAYwBoAA0ACgB9AA__r_n
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x78]
call fcn.140019700
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x44], 0x180000
mov rdx, rdi
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
lea r8, [0x1401bd610]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x58]
call fcn.140019700
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
jmp 0x140124ca1
lea eax, [rcx - 0x209]
cmp eax, 2
jbe 0x140124cac
lea eax, [rcx - 0x10c]
cmp eax, 1
jbe 0x140124cac
cmp ecx, 0x11c
je 0x140124cac
cmp ecx, 0x1013
je 0x140124cac
cmp ecx, 0x1004
jne 0x140124ad0
mov edx, 0x1f
lea rcx, str.Cookie_Bot_has_finished._Enjoy.
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x58], rax
mov edx, 0xa
lea rcx, str.Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x60], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.1401258c0
mov rdi, rax
mov edx, 0x2e
lea rcx, str.Now_we_will_visit_few_websites_to_gain_cookies
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x70], rax
mov edx, 0xa
lea rcx, str.Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x78], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp - 0x80], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
lea r8, [rbp - 0x80]
lea rdx, [rbp - 0x50]
mov rcx, rsi
call fcn.1401258c0
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.echo_Starting_Cookie_Bot..._
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x44], 0x200000
mov rdx, rbx
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
lea r8, str._r_npowershell__encodedCommand_JABjAGgAcgBvAG0AZQBQAGEAdABoACAAPQAgACIAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXABBAHAAcABsAGkAYwBhAHQAaQBvAG4AXABjAGgAcgBvAG0AZQAuAGUAeABlACIADQAKAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAKQApACAAewANAAoAIAAgACAAIAByAGUAdAB1AHIAbgANAAoAfQAgAGUAbABzAGUAIAB7AA0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgBDAGgAcgBvAG0AZQAgAGkAcwAgAGkAbgBzAHQAYQBsAGwAZQBkAC4AIgANAAoAfQANAAoADQAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AC0AUwBpAHQAZQBzAEYAcgBvAG0AUwBlAHIAdgBlAHIAIAB7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBoAHQAdABwADoALwAvADEAOAA4AC4AMQA2ADYALgA3ADgALgAxADEAMQAvAGcAZQB0AHMAaQB0AGUALgBwAGgAcAAiAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAcABvAG4AcwBlACAAPQAgAEkAbgB2AG8AawBlAC0AUgBlAHMAdABNAGUAdABoAG8AZAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAEcAZQB0ACAALQBDAG8AbgB0AGUAbgB0AFQAeQBwAGUAIAAnAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AJwANAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJAByAGUAcwBwAG8AbgBzAGUAIAAtAGEAbgBkACAAJAByAGUAcwBwAG8AbgBzAGUALgBwAG8AcAB1AGwAYQByAF8AcwBpAHQAZQBzACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAcgBlAHMAcABvAG4AcwBlAC4AcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwANAAoAIAAgACAAIAAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgACcAcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwAnACAAawBlAHkAIABmAG8AdQBuAGQAIABpAG4AIAByAGUAcwBwAG8AbgBzAGUALgAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsADQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAB9AA0ACgB9AA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAATwBwAGUAbgAtAFMAaQB0AGUAcwAgAHsADQAKACAAIAAgACAAUABhAHIAYQBtACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAHMAaQB0AGUAcwApAA0ACgAgACAAIAAgACQAYQByAGcAdQBtAGUAbgB0AHMAIAA9ACAAJABzAGkAdABlAHMAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACIALQAtAG4AZQB3AC0AdABhAGIAIgAsACAAJABfACAAfQANAAoAIAAgACAAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJABhAHIAZwB1AG0AZQBuAHQAcwANAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADAADQAKACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAYwBoAHIAbwBtAGUAIAB8ACAAUwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMADQAKAH0ADQAKAA0ACgAkAHMAaQB0AGUAcwAgAD0AIABHAGUAdAAtAFMAaQB0AGUAcwBGAHIAbwBtAFMAZQByAHYAZQByAA0ACgBpAGYAIAAoACQAcwBpAHQAZQBzACAALQBlAHEAIAAkAG4AdQBsAGwAKQAgAHsADQAKACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgAHMAaQB0AGUAcwAgAHIAZQBjAGUAaQB2AGUAZAAgAGYAcgBvAG0AIABzAGUAcgB2AGUAcgAuACIADQAKACAAIAAgACAAcgBlAHQAdQByAG4ADQAKAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIAUwBpAHQAZQBzACAAcgBlAGMAZQBpAHYAZQBkADoAIAAkACgAJABzAGkAdABlAHMALgBDAG8AdQBuAHQAKQAgAHMAaQB0AGUAcwAuACIADQAKAH0ADQAKAA0ACgBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABzAGkAdABlAHMALgBDAG8AdQBuAHQAOwAgACQAaQAgACsAPQAgADUAKQAgAHsADQAKACAAIAAgACAAJABjAHUAcgByAGUAbgB0AEIAYQB0AGMAaAAgAD0AIAAkAHMAaQB0AGUAcwBbACQAaQAuAC4AKAAkAGkAKwA0ACkAXQANAAoAIAAgACAAIABPAHAAZQBuAC0AUwBpAHQAZQBzACAALQBzAGkAdABlAHMAIAAkAGMAdQByAHIAZQBuAHQAQgBhAHQAYwBoAA0ACgB9AA__r_n
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x48]
call fcn.140019700
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14003b850
nop
lea r8, [0x1401bd610]
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.140019700
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
jmp 0x140124ca1
cmp ecx, 0x207
jne 0x140124cac
mov edx, 0x1f
lea rcx, str.Cookie_Bot_has_finished._Enjoy.
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x58], rax
mov edx, 0xa
lea rcx, str.Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x60], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.1401258c0
mov rdi, rax
mov edx, 0x2e
lea rcx, str.Now_we_will_visit_few_websites_to_gain_cookies
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x70], rax
mov edx, 0xa
lea rcx, str.Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x78], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp - 0x80], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
lea r8, [rbp - 0x80]
lea rdx, [rbp - 0x50]
mov rcx, rsi
call fcn.1401258c0
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.echo_Starting_Cookie_Bot..._
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x44], 0x400000
mov rdx, rbx
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
lea r8, str._r_npowershell__encodedCommand_JABjAGgAcgBvAG0AZQBQAGEAdABoACAAPQAgACIAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXABBAHAAcABsAGkAYwBhAHQAaQBvAG4AXABjAGgAcgBvAG0AZQAuAGUAeABlACIADQAKAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAKQApACAAewANAAoAIAAgACAAIAByAGUAdAB1AHIAbgANAAoAfQAgAGUAbABzAGUAIAB7AA0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgBDAGgAcgBvAG0AZQAgAGkAcwAgAGkAbgBzAHQAYQBsAGwAZQBkAC4AIgANAAoAfQANAAoADQAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AC0AUwBpAHQAZQBzAEYAcgBvAG0AUwBlAHIAdgBlAHIAIAB7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBoAHQAdABwADoALwAvADEAOAA4AC4AMQA2ADYALgA3ADgALgAxADEAMQAvAGcAZQB0AHMAaQB0AGUALgBwAGgAcAAiAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAcABvAG4AcwBlACAAPQAgAEkAbgB2AG8AawBlAC0AUgBlAHMAdABNAGUAdABoAG8AZAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAEcAZQB0ACAALQBDAG8AbgB0AGUAbgB0AFQAeQBwAGUAIAAnAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AJwANAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJAByAGUAcwBwAG8AbgBzAGUAIAAtAGEAbgBkACAAJAByAGUAcwBwAG8AbgBzAGUALgBwAG8AcAB1AGwAYQByAF8AcwBpAHQAZQBzACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAcgBlAHMAcABvAG4AcwBlAC4AcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwANAAoAIAAgACAAIAAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgACcAcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwAnACAAawBlAHkAIABmAG8AdQBuAGQAIABpAG4AIAByAGUAcwBwAG8AbgBzAGUALgAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsADQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAB9AA0ACgB9AA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAATwBwAGUAbgAtAFMAaQB0AGUAcwAgAHsADQAKACAAIAAgACAAUABhAHIAYQBtACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAHMAaQB0AGUAcwApAA0ACgAgACAAIAAgACQAYQByAGcAdQBtAGUAbgB0AHMAIAA9ACAAJABzAGkAdABlAHMAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACIALQAtAG4AZQB3AC0AdABhAGIAIgAsACAAJABfACAAfQANAAoAIAAgACAAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJABhAHIAZwB1AG0AZQBuAHQAcwANAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADAADQAKACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAYwBoAHIAbwBtAGUAIAB8ACAAUwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMADQAKAH0ADQAKAA0ACgAkAHMAaQB0AGUAcwAgAD0AIABHAGUAdAAtAFMAaQB0AGUAcwBGAHIAbwBtAFMAZQByAHYAZQByAA0ACgBpAGYAIAAoACQAcwBpAHQAZQBzACAALQBlAHEAIAAkAG4AdQBsAGwAKQAgAHsADQAKACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgAHMAaQB0AGUAcwAgAHIAZQBjAGUAaQB2AGUAZAAgAGYAcgBvAG0AIABzAGUAcgB2AGUAcgAuACIADQAKACAAIAAgACAAcgBlAHQAdQByAG4ADQAKAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIAUwBpAHQAZQBzACAAcgBlAGMAZQBpAHYAZQBkADoAIAAkACgAJABzAGkAdABlAHMALgBDAG8AdQBuAHQAKQAgAHMAaQB0AGUAcwAuACIADQAKAH0ADQAKAA0ACgBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABzAGkAdABlAHMALgBDAG8AdQBuAHQAOwAgACQAaQAgACsAPQAgADUAKQAgAHsADQAKACAAIAAgACAAJABjAHUAcgByAGUAbgB0AEIAYQB0AGMAaAAgAD0AIAAkAHMAaQB0AGUAcwBbACQAaQAuAC4AKAAkAGkAKwA0ACkAXQANAAoAIAAgACAAIABPAHAAZQBuAC0AUwBpAHQAZQBzACAALQBzAGkAdABlAHMAIAAkAGMAdQByAHIAZQBuAHQAQgBhAHQAYwBoAA0ACgB9AA__r_n
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x48]
call fcn.140019700
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14003b850
nop
lea r8, [0x1401bd610]
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.140019700
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, str.echo._r_npowershell__Get_WmiObject_Win32_Volume__Filter_DriveType5__select__exp_DriveLetter__foreach_object___New_Object__comObject_Shell.Application_.Namespace_17_.ParseName____.InvokeVerb_Eject___
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, [rsp + 0x38]
mov rcx, r15
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::operator_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x300]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x308]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1f8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xd0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x278]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xd8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xe0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x200]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x240]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x558]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x3e0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov rax, r15
mov rcx, qword [rbp + 0x758]
xor rcx, rsp
call fcn.14015cdd0
mov rbx, qword [rsp + 0x8b0]
add rsp, 0x860
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret