Function at 0x14000c520
Capabilities:
Create thread
Delete file
Encode data using xor
Enumerate processes
Execute command
Hide graphical window

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x1401440c0]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
xor esi, esi
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x1401f5280], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x1401f5284], eax
mov r9d, 0x40
lea r8, str.Atlantic
lea rdx, str.Press_Okay_In_Lobby
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
mov r8d, 3
lea rcx, str..partmgr
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1401f4dc8], rax
test rax, rax
je 0x14000c16b
cmp rax, 0xffffffffffffffff
jne 0x14000c18e
lea rdx, [0x1400d8500]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000fe20
lea rdx, [0x14000fde0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rbp - 0x80], 0x238
lea rdx, [rbp - 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000c1ea
nop word [rax + rax]
lea rdx, str.FortniteClient_Win64_Shipping.exe
lea rcx, [rbp - 0x54]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov rcx, rbx
test eax, eax
je 0x14000c403
lea rdx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000c1c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov dword [0x1401f4dd0], eax
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x40], 0x83b1657
mov dword [rsp + 0x44], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rsp + 0x40]
mov edx, 0x2251d4
mov rcx, qword [0x1401f4dc8]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rax, qword [rsp + 0x50]
mov qword [0x1401f4d68], rax
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x74], esi
mov eax, dword [0x1401f4dd0]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rsp + 0x70]
mov edx, 0x2251dc
mov rcx, qword [0x1401f4dc8]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rax, qword [rsp + 0x60]
mov qword [0x1401f4d30], rax
mov rbx, rsi
mov edi, Ordinal_26
mov rcx, qword [0x1401f4d68]
nop word [rax + rax]
add rcx, 0x250
add rcx, rbx
call fcn.14000f7a0
mov rcx, qword [0x1401f4d68]
add rbx, 0x1000
cmp eax, 0x260e020b
jne 0x14000c2ef
lea rax, [rbx + rcx]
mov qword [0x1401f4d50], rax
sub rdi, 1
jne 0x14000c2c0
lea rdx, str.Entry___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000fe20
mov rdx, qword [0x1401f4d68]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [0x14000fde0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Cr3___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000fe20
mov rdx, qword [0x1401f4d30]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [0x14000fde0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 1
call fcn.1400c41b0
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140012760]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14000c4fb
cmp dword [rsp + 0x58], edi
je 0x14000c4ef
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14000c4ef
lea rdx, str.NVIDIA_GeForce_Overlay
lea rcx, str.CEF_OSC_WIDGET
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x1401f4ca0], rax
test rax, rax
jne 0x14000c411
mov r9d, 0x40
lea r8, [0x1400d84fe]
lea rdx, str.__Overlay_Failed.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14000c4bd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp - 0x78]
jmp 0x14000c1f5
mov dword [rsp + 0x30], 0x40
mov dword [rsp + 0x28], 0x438
mov dword [rsp + 0x20], 0x780
xor r9d, r9d
xor r8d, r8d
mov rdx, 0xffffffffffffffff
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowPos]
mov r9d, 2
mov r8b, 0xff
xor edx, edx
mov rcx, qword [0x1401f4ca0]
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov edx, 0xffffffec
mov r8d, 0x80020
mov rcx, qword [0x1401f4ca0]
call qword [sym.imp.USER32.dll_SetWindowLongA]
movdqa xmm0, xmmword [0x140130910]
movdqu xmmword [rsp + 0x70], xmm0
lea rdx, [rsp + 0x70]
mov rcx, qword [0x1401f4ca0]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov edx, 5
mov rcx, qword [0x1401f4ca0]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1401f4ca0]
call qword [sym.imp.USER32.dll_UpdateWindow]
xor edx, edx
mov rcx, qword [0x1401f4ca0]
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.14000a0d0
call fcn.14000abe0
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.1400c4190
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x58], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov rax, rsp
mov qword [rax + 0x10], rbx
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
movups xmm3, xmmword [0x14012e6f8]
xor r8d, r8d
movzx eax, byte [0x14012e710]
movsd xmm0, qword [0x14012e708]
mov ebx, dword [reloc.WS2_32.dll_accept]
movdqa xmm7, xmmword [0x140130ad0]
movsd qword [rbp - 0x19], xmm0
mov byte [rbp - 0x11], al
movups xmmword [rbp - 0x29], xmm3
cmp ebx, 2
jl 0x14000c7ef
movdqa xmm4, xmmword [0x140130ea0]
movdqa xmm2, xmmword [0x1401309b0]
movdqa xmm5, xmmword [str.8888HKRC_NGO]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
movdqa xmm6, xmmword [0x140130b10]
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
movd eax, xmm3
movdqa xmm3, xmmword [0x140130a30]
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, eax
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm6
xorps xmm2, xmm0
movd dword [rbp - 0x29], xmm2
movdqa xmm2, xmmword [0x140130a00]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmulld xmm0, xmm5
psubd xmm2, xmm0
pmuldq xmm1, xmm4
movd xmm0, dword [rbp - 0x25]
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm6
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rbp - 0x25], xmm2
movdqa xmm2, xmmword [0x140130a70]
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm2
pmulld xmm0, xmm5
psubd xmm3, xmm0
punpckldq xmm1, xmm2
movd xmm0, dword [rbp - 0x21]
andps xmm3, xmm7
packuswb xmm3, xmm3
pmuldq xmm1, xmm4
packuswb xmm3, xmm3
paddb xmm3, xmm6
xorps xmm3, xmm0
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
movd dword [rbp - 0x21], xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
movdqa xmm3, xmmword [0x140130a80]
mov r8d, Ordinal_26
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm3
pmulld xmm0, xmm5
psubd xmm2, xmm0
punpckldq xmm1, xmm3
movd xmm0, dword [rbp - 0x1d]
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
pmuldq xmm1, xmm4
paddb xmm2, xmm6
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rbp - 0x1d], xmm2
movdqa xmm2, xmmword [0x140130a90]
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm2
pmulld xmm0, xmm5
psubd xmm3, xmm0
punpckldq xmm1, xmm2
movd xmm0, dword [rbp - 0x19]
andps xmm3, xmm7
packuswb xmm3, xmm3
pmuldq xmm1, xmm4
packuswb xmm3, xmm3
paddb xmm3, xmm6
xorps xmm3, xmm0
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
movd dword [rbp - 0x19], xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, dword [rbp - 0x15]
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm6
xorps xmm2, xmm0
movd dword [rbp - 0x15], xmm2
mov eax, r8d
lea r9, [rbp - 0x29]
add r9, rax
nop dword [rax]
mov eax, 0x92492493
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x38
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x30
xor byte [r9 - 1], al
cmp r8d, 0x19
jl 0x14000c800
lea rcx, [rbp - 0x29]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp byte [0x1400d9cc5], 0
movups xmm6, xmmword [str.s_vnw_BX_WXH_SHR_o1:7E]
movzx eax, word [0x1400d9cc4]
mov edx, dword [0x1400d9cc0]
movups xmmword [rbp - 0x29], xmm6
mov dword [rbp - 0x19], edx
mov word [rbp - 0x15], ax
je 0x14000cad4
xor r8d, r8d
cmp ebx, 2
jl 0x14000ca8d
movdqa xmm4, xmmword [0x140130ea0]
movdqa xmm3, xmmword [0x1401309b0]
movdqa xmm2, xmmword [0x140130a00]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
movdqa xmm5, xmmword [str.8888HKRC_NGO]
mov ecx, dword [0x140130b10]
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
movd eax, xmm6
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmulld xmm0, xmm5
psubd xmm3, xmm0
pmuldq xmm1, xmm4
andps xmm3, xmm7
movd xmm0, ecx
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmm0
movd xmm0, eax
xorps xmm3, xmm0
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
movd dword [rbp - 0x29], xmm3
movdqa xmm3, xmmword [0x140130a30]
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movd xmm1, dword [rbp - 0x25]
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, ecx
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
xorps xmm2, xmm1
pmuldq xmm0, xmm4
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd dword [rbp - 0x25], xmm2
movdqa xmm2, xmmword [0x140130a70]
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movd xmm1, dword [rbp - 0x21]
pmulld xmm0, xmm5
psubd xmm3, xmm0
movd xmm0, ecx
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmm0
movdqa xmm0, xmm2
xorps xmm3, xmm1
punpckhdq xmm0, xmm2
movdqa xmm1, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movd dword [rbp - 0x21], xmm3
shufps xmm1, xmm0, 0xdd
movdqa xmm3, xmmword [0x140130a80]
paddd xmm1, xmm2
psrad xmm1, 5
mov r8d, reloc.WS2_32.dll_sendto
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movd xmm1, dword [rbp - 0x1d]
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, ecx
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
xorps xmm2, xmm1
movdqa xmm1, xmm3
pmuldq xmm0, xmm4
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd dword [rbp - 0x1d], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movd xmm1, edx
pmulld xmm0, xmm5
psubd xmm3, xmm0
movd xmm0, ecx
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmm0
xorps xmm3, xmm1
movd dword [rbp - 0x19], xmm3
mov eax, r8d
lea r9, [rbp - 0x29]
add r9, rax
nop word [rax + rax]
mov eax, 0x92492493
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x38
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x30
xor byte [r9 - 1], al
cmp r8d, 0x16
jl 0x14000caa0
lea rcx, [rbp - 0x29]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [str.s_vnd__RXOJfsYQNc_b_.3]
movzx eax, word [0x1400d9d08]
xor r8d, r8d
mov word [rbp + 0x27], ax
movzx eax, byte [0x1400d9d0a]
mov byte [rbp + 0x29], al
movups xmm1, xmmword [0x1400d9ce8]
movups xmmword [rbp - 9], xmm0
movups xmm0, xmmword [0x1400d9cf8]
movups xmmword [rbp + 7], xmm1
movups xmmword [rbp + 0x17], xmm0
cmp ebx, 2
jl 0x14000cc41
movdqa xmm0, xmmword [0x140130b10]
lea rcx, [rbp - 5]
movdqa xmm4, xmmword [0x1401309b0]
movdqa xmm3, xmmword [0x140130ea0]
movdqa xmm5, xmmword [str.8888HKRC_NGO]
movdqa xmmword [rbp - 0x29], xmm0
mov edx, dword [rbp - 0x29]
nop dword [rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm4
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movd dword [rcx - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp r8d, 0x30
jl 0x14000cb50
cmp r8d, 0x33
jge 0x14000cc84
movsxd rax, r8d
lea r9, [rbp - 9]
add r9, rax
nop dword [rax + rax]
mov eax, 0x92492493
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x38
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x30
xor byte [r9 - 1], al
cmp r8d, 0x33
jl 0x14000cc50
lea rcx, [rbp - 9]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov eax, dword [0x1400d9ca0]
xor ecx, ecx
mov dword [rbp + 0x17], eax
movzx eax, word [0x1400d9ca4]
mov word [rbp + 0x1b], ax
movups xmm0, xmmword [0x1400d9c80]
movups xmm1, xmmword [0x1400d9c90]
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm1
cmp ebx, 2
jl 0x14000cdde
movdqa xmm0, xmmword [0x140130b10]
lea rdx, [rbp - 5]
movdqa xmm4, xmmword [0x1401309b0]
movdqa xmm3, xmmword [0x140130ea0]
movdqa xmm5, xmmword [str.8888HKRC_NGO]
movdqa xmmword [rbp - 0x29], xmm0
mov r8d, dword [rbp - 0x29]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm4
add ecx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r8d
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movd dword [rdx - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r8d
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x20
jl 0x14000ccf0
cmp ecx, 0x26
jge 0x14000ce1f
movsxd rax, ecx
lea r8, [rbp - 9]
add r8, rax
nop dword [rax + rax]
mov eax, 0x92492493
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x38
movzx eax, cl
inc ecx
sub al, dl
add al, 0x30
xor byte [r8 - 1], al
cmp ecx, 0x26
jl 0x14000cdf0
lea rcx, [rbp - 9]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
xorps xmm0, xmm0
mov qword [rbp - 0x19], 0
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov qword [rbp - 0x11], 0
lea rdx, str.Loaded_Driver_Sucessfully_
lea rcx, [rbp - 0x29]
movups xmmword [rbp - 0x29], xmm0
call fcn.14000aa30
lea rcx, [rbp - 0x29]
call fcn.14000bb40
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop rbp
jmp 0x14000c0c0