Function at 0x1400c0780
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create process on windows
Download url
Execute shellcode via indirect call
Persist via windows service
Query or enumerate registry value
Receive data
Self delete

Disassembly:
push rbp
push rbx
push r13
lea rbp, [rsp - 0x2e60]
mov eax, 0x2f60
call fcn.140275540
sub rsp, rax
mov rax, qword [0x1403985c0]
xor rax, rsp
mov qword [rbp + 0x2da0], rax
lea rdx, [0x1400c06a0]
lea rcx, [rbp + 0x2690]
call fcn.1400d1360
lea rcx, [rbp + 0x2690]
call fcn.1400aada0
lea rcx, [0x1403d5400]
call fcn.1400b0ce0
movzx edx, byte [rsp + 0x60]
lea rcx, [rbp + 0x1450]
call fcn.1400cc8e0
mov r8d, 7
lea rdx, str.key.txt
lea rcx, [rbp + 0x1450]
call fcn.1400cc900
lea rcx, [rbp + 0x1450]
call fcn.1400be2f0
lea rax, [0x1400c4e80]
mov dword [rbp + 0x2400], 0x50
xor r13d, r13d
mov qword [rbp + 0x2408], rax
xor ecx, ecx
mov dword [rbp + 0x2404], 0x40
mov qword [rbp + 0x2410], r13
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xorps xmm0, xmm0
mov qword [rbp + 0x2448], r13
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x2420], xmm0
lea rbx, str._________________________________________________1994
movdqa xmmword [rbp + 0x2430], xmm1
lea rcx, [rbp + 0x2400]
mov qword [rbp + 0x2418], rax
mov qword [rbp + 0x2440], rbx
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov rax, qword [rbp + 0x2418]
mov r9d, 0x80000000
mov rdx, qword [rbp + 0x2440]
mov r8, rbx
mov qword [rsp + 0x58], r13
xor ecx, ecx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], 0x230
mov dword [rsp + 0x30], Ordinal_301
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor edx, edx
lea rcx, [rbp + 0x2450]
mov r8d, 0x210
mov qword [0x1403a4048], rax
mov rbx, rax
call fcn.1402ba800
xor r9d, r9d
mov dword [rsp + 0x28], 0x8010
lea r8d, [r13 + 1]
mov dword [rbp + 0x2450], 0x210
lea rdx, str.C:WindowsGanjas.ico
mov qword [rbp + 0x2458], rbx
xor ecx, ecx
mov dword [rbp + 0x2464], gethostname
mov dword [rsp + 0x20], r13d
call qword [sym.imp.USER32.dll_LoadImageA]
mov rcx, qword [0x1403a4048]
mov qword [rbp + 0x2470], rax
call fcn.1400aade0
test al, al
jne 0x1400c096e
call fcn.1400aaeb0
mov rdx, qword [rbp + 0x2418]
mov rcx, qword [rbp + 0x2440]
call qword [sym.imp.USER32.dll_UnregisterClassA]
cmp dword [rbp + 0x2698], r13d
jne 0x1400c4591
lea eax, [r13 + 1]
jmp 0x1400c4576
mov rcx, qword [0x1403a4048]
xor edx, edx
mov qword [rsp + 0x2f88], rdi
mov qword [rsp + 0x2f90], r12
mov qword [rsp + 0x2f50], r15
movaps xmmword [rsp + 0x2f40], xmm6
movaps xmmword [rsp + 0x2f30], xmm7
movaps xmmword [rsp + 0x2f20], xmm8
movaps xmmword [rsp + 0x2f10], xmm9
movaps xmmword [rsp + 0x2f00], xmm10
movaps xmmword [rsp + 0x2ef0], xmm11
movaps xmmword [rsp + 0x2ee0], xmm12
movaps xmmword [rsp + 0x2ed0], xmm13
movaps xmmword [rsp + 0x2ec0], xmm14
movaps xmmword [rsp + 0x2eb0], xmm15
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1403a4048]
call qword [sym.imp.USER32.dll_UpdateWindow]
xor ecx, ecx
call fcn.140066aa0
mov r15, qword [0x1403a4010]
lea rax, str.imgui_impl_win32
movzx edx, byte [rsp + 0x60]
lea rcx, [rbp + 0x1168]
or dword [r15 + 0xc], 0xc06
mov qword [r15 + 0xe0], rax
mov qword [r15 + 0x20], r13
or dword [r15 + 8], 0x400
mov dword [r15 + 0x1644], 0x41400000
mov dword [r15 + 0x1660], 0x41400000
mov dword [r15 + 0x1678], 0x41400000
mov dword [r15 + 0x1668], 0x41400000
mov dword [r15 + 0x16b4], 0x41400000
mov dword [r15 + 0x16ac], 0x41400000
mov dword [r15 + 0x16bc], 0x41400000
call fcn.1400cc8e0
mov r8d, Ordinal_45
lea rdx, str.C:WindowsSysWOW64driversdarklord.png
lea rcx, [rbp + 0x1168]
call fcn.1400cc900
lea rcx, [rbp + 0x1168]
call fcn.1400be2b0
lea rcx, [rbp + 0x1168]
movzx ebx, al
call fcn.1400622b0
test bl, bl
jne 0x1400c0ae0
lea rdx, str.C:WindowsSysWOW64driversdarklord.png
lea rcx, [rbp + 0x1800]
call fcn.1400c75d0
mov rcx, rax
mov edx, WSASetLastError
call fcn.1400b5ab0
mov rcx, qword [0x1403a40a0]
lea r8, [rbp + 0x23c0]
lea rdx, str.C:_Windows_SysWOW64_drivers_darklord.png
mov r12, r13
call qword [sym.imp.d3dx9_43.dll_D3DXCreateTextureFromFileA]
test eax, eax
jne 0x1400c0b22
mov rcx, qword [rbp + 0x23c0]
lea r8, [rbp + 0x29e8]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x88]
mov r12, qword [rbp + 0x23c0]
mov rcx, qword [0x1403a4048]
call fcn.140097060
mov rcx, qword [0x1403a40a0]
call fcn.1400968f0
lea rcx, [rbp + 0x2a10]
call fcn.140090730
movss xmm2, dword [0x140365ec0]
lea rdx, str.C:WindowsFontscalibrii.ttf
mov byte [rbp + 0x2a1c], r13b
xor r9d, r9d
mov rcx, qword [r15 + 0xa8]
mov qword [rsp + 0x20], r13
call fcn.140090f70
mov qword [r15 + 0x20], r13
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rbp + 0x2978]
call qword [sym.imp.USER32.dll_GetWindowRect]
movss xmm7, dword [0x140365f10]
lea rdi, str._.3f
movss xmm9, dword [0x140365f14]
xorps xmm0, xmm0
movss xmm8, dword [0x140365ed8]
movss xmm11, dword [0x140365f20]
movss xmm12, dword [0x140365f08]
movss xmm6, dword [0x140365f64]
movss xmm15, dword [0x140365efc]
movss xmm10, dword [0x140365ef8]
movss xmm13, dword [0x140365e1c]
movss xmm14, dword [0x140365f04]
mov qword [rsp + 0x2f80], rsi
movups xmmword [rbp + 0x2700], xmm0
mov qword [rsp + 0x2f58], r14
movups xmmword [rbp + 0x2710], xmm0
movups xmmword [rbp + 0x2720], xmm0
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rbp + 0x2700]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x1400c0c51
lea rcx, [rbp + 0x2700]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x2700]
call qword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x1400c4498
cmp qword [0x1403d9c18], r13
jne 0x1400c0c71
cmp qword [0x1403d9c28], r13
je 0x1400c0c71
call fcn.1400969c0
test al, al
je 0x1400c0c71
call fcn.140096ff0
call fcn.140097c70
call fcn.140068120
mov rax, qword [0x1403a4010]
or dword [rax + 0x1dc0], 2
mov dword [rax + 0x1de4], 0x43960000
mov dword [rax + 0x1de8], 0x440c0000
mov dword [rax + 0x1dc8], 1
cmp byte [reloc.WS2_32.dll_accept], r13b
je 0x1400c4597
mov r8d, Ordinal_301
lea rdx, reloc.WS2_32.dll_accept
lea rcx, str.___________________________1944_Bypass
call fcn.14006e700
test al, al
je 0x1400c43cf
cmp dword [0x1403a4038], r13d
jne 0x1400c0ce3
call fcn.1400b4cd0
mov ecx, dword [0x1403d5578]
test ecx, ecx
je 0x1400c41d3
cmp ecx, 1
jne 0x1400c43cf
movaps xmm2, xmm7
lea rcx, [rbp + 0x1150]
movaps xmm1, xmm9
call fcn.140062310
mov rdx, rax
lea rcx, str.Bypass
xor r9d, r9d
mov r8b, 1
call fcn.14006ba00
lea rcx, str.ByPass
call fcn.14009ab50
lea rcx, str._Select_Emulator
call fcn.14009ab50
movaps xmm0, xmm7
call fcn.140072a50
mov r9d, 0xffffffff
lea r8, str.Gameloop_64Bit
lea rdx, [0x1403d9c90]
lea rcx, [0x140362d00]
call fcn.14009eff0
lea rcx, str._Game_Version
call fcn.14009ab50
movaps xmm0, xmm7
call fcn.140072a50
mov r9d, 0xffffffff
lea r8, str.GLOBAL
lea rdx, [0x1403d557c]
lea rcx, [0x1403641b8]
call fcn.14009eff0
movaps xmm2, xmm8
lea rcx, [rbp + 0x668]
movaps xmm1, xmm7
call fcn.140062310
lea rdx, [rbp + 0x668]
lea rcx, str.Open_Emulator
call fcn.14009b970
test al, al
je 0x1400c1675
mov eax, dword [0x1403d9c90]
test eax, eax
jne 0x1400c1105
lea rdx, str.C:Windows_adb.exe
lea rcx, [rbp + 0x1470]
call fcn.1400c75d0
lea rcx, [rbp + 0x1470]
call fcn.1400be2b0
lea rcx, [rbp + 0x1470]
movzx ebx, al
call fcn.1400622b0
test bl, bl
jne 0x1400c0e24
lea rdx, str.C:Windows_adb.exe
lea rcx, [rbp + 0x1820]
call fcn.1400c75d0
mov rcx, rax
mov edx, 0x3f3
call fcn.1400b5ab0
lea rdx, str.C:WindowsAdbWinApi.dll
lea rcx, [rbp + 0x1490]
call fcn.1400c75d0
lea rcx, [rbp + 0x1490]
call fcn.1400be2b0
lea rcx, [rbp + 0x1490]
call fcn.1400622b0
lea rdx, str.C:WindowsAdbWinApi.dll
lea rcx, [rbp + 0x1840]
call fcn.1400c75d0
mov rcx, rax
mov edx, 0x66
call fcn.1400b5ab0
lea rdx, str.Starting_Gameloop_64BIT.
lea rcx, [0x1403d53a0]
call fcn.1400c7550
lea rdx, str.SOFTWAREWOW6432NodeTencentMobileGamePC_
lea rcx, [rbp + 0x27b0]
call fcn.1400c75d0
lea rcx, [rbp + 0x2988]
call fcn.1400c7730
mov edx, Ordinal_27
lea rcx, [rbp + 0x27e8]
call fcn.1400b5fd0
lea rcx, [rbp + 0x27e8]
call fcn.1400c64d0
lea rcx, [rbp + 0x27b0]
call fcn.1400622a0
mov rdx, rax
mov r9d, 0x20019
lea rax, [rbp + 0x23e8]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400c10bf
lea r8, [0x140364254]
mov dword [rbp + 0x2668], r13d
lea rdx, [rbp + 0x27b0]
lea rcx, [rbp + 0x2838]
call fcn.1400cb030
lea rcx, [rbp + 0x2838]
call fcn.1400622a0
mov rdx, rax
lea r8, [rbp + 0x23c8]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1400c1086
xor edx, edx
mov dword [rbp + 0x2668], 0xff
mov r8d, 0xff
lea rcx, [rbp + 0x2aa0]
call fcn.1402ba800
mov rcx, qword [rbp + 0x23c8]
lea rax, [rbp + 0x2668]
mov qword [rsp + 0x28], rax
lea rdx, str.InstallPath
lea rax, [rbp + 0x2aa0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c1079
lea rdx, [rbp + 0x2aa0]
lea rcx, [rbp + 0x28b8]
call fcn.1400c75d0
lea r8, str.AndroidEmulatorEx.exe
lea rdx, [rbp + 0x28b8]
lea rcx, [rbp + 0x2750]
call fcn.1400cb030
xor edx, edx
lea rcx, [rbp + 0x2750]
mov r9b, Ordinal_35
lea r8d, [rdx + 1]
call fcn.1400c7400
lea rdx, str..exe_
lea rcx, [rbp + 0x1860]
call fcn.1400c75d0
lea rdx, str..exe
mov rbx, rax
lea rcx, [rbp + 0x1880]
call fcn.1400c75d0
mov r8, rbx
lea rcx, [rbp + 0x2750]
mov rdx, rax
call fcn.1400be180
lea r8, str.__vm_100
lea rdx, [rbp + 0x2750]
lea rcx, [rbp + 0x28f8]
call fcn.1400cb030
lea rcx, [rbp + 0x28f8]
call fcn.1400622a0
mov rdx, rax
lea rcx, [rbp + 0x18a0]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400b5480
lea rcx, [rbp + 0x28f8]
call fcn.1400622b0
lea rcx, [rbp + 0x2750]
call fcn.1400622b0
lea rcx, [rbp + 0x28b8]
call fcn.1400622b0
mov rcx, qword [rbp + 0x23c8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [0x1400c03e0]
lea rcx, [rbp + 0x26a0]
call fcn.1400cc140
lea rcx, [rbp + 0x26a0]
call fcn.1400aada0
lea rcx, [rbp + 0x26a0]
call fcn.14005ba60
lea rcx, [rbp + 0x2838]
call fcn.1400622b0
jmp 0x1400c10d4
xor r9d, r9d
lea rdx, str.Your_Choice_Of_Emulator_Isnt_Installed
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [rbp + 0x23e8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rbp + 0x27e8]
call fcn.1400c6460
lea rcx, [rbp + 0x2988]
call fcn.1400622b0
lea rcx, [rbp + 0x27b0]
jmp 0x1400c1670
cmp eax, 1
jne 0x1400c1441
lea rdx, str.C:Windows_adb.exe
lea rcx, [rbp + 0x1510]
call fcn.1400c75d0
lea rcx, [rbp + 0x1510]
call fcn.1400be2b0
lea rcx, [rbp + 0x1510]
movzx ebx, al
call fcn.1400622b0
test bl, bl
jne 0x1400c1160
lea rdx, str.C:Windows_adb.exe
lea rcx, [rbp + 0x18c0]
call fcn.1400c75d0
mov rcx, rax
mov edx, 0x3f3
call fcn.1400b5ab0
lea rdx, str.C:WindowsAdbWinApi.dll
lea rcx, [rbp + 0x1530]
call fcn.1400c75d0
lea rcx, [rbp + 0x1530]
call fcn.1400be2b0
lea rcx, [rbp + 0x1530]
call fcn.1400622b0
lea rdx, str.C:WindowsAdbWinApi.dll
lea rcx, [rbp + 0x17c0]
call fcn.1400c75d0
mov rcx, rax
mov edx, 0x66
call fcn.1400b5ab0
lea rdx, str.Starting_Gameloop_32BIT.
lea rcx, [0x1403d53a0]
call fcn.1400c7550
lea rdx, str.SOFTWAREWOW6432NodeTencentMobileGamePC_
lea rcx, [rbp + 0x2800]
call fcn.1400c75d0
lea rcx, [rbp + 0x29a8]
call fcn.1400c7730
mov edx, Ordinal_27
lea rcx, [rbp + 0x2820]
call fcn.1400b5fd0
lea rcx, [rbp + 0x2820]
call fcn.1400c64d0
lea rcx, [rbp + 0x2800]
call fcn.1400622a0
mov rdx, rax
mov r9d, 0x20019
lea rax, [rbp + 0x23f0]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400c13fb
lea r8, [0x140364254]
mov dword [rbp + 0x2660], r13d
lea rdx, [rbp + 0x2800]
lea rcx, [rbp + 0x2858]
call fcn.1400cb030
lea rcx, [rbp + 0x2858]
call fcn.1400622a0
mov rdx, rax
lea r8, [rbp + 0x23d0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1400c13c2
xor edx, edx
mov dword [rbp + 0x2660], 0xff
mov r8d, 0xff
lea rcx, [rbp + 0x2ba0]
call fcn.1402ba800
mov rcx, qword [rbp + 0x23d0]
lea rax, [rbp + 0x2660]
mov qword [rsp + 0x28], rax
lea rdx, str.InstallPath
lea rax, [rbp + 0x2ba0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c13b5
lea rdx, [rbp + 0x2ba0]
lea rcx, [rbp + 0x2958]
call fcn.1400c75d0
lea r8, str.AndroidEmulatorEx.exe
lea rdx, [rbp + 0x2958]
lea rcx, [rbp + 0x2770]
call fcn.1400cb030
xor edx, edx
lea rcx, [rbp + 0x2770]
mov r9b, Ordinal_35
lea r8d, [rdx + 1]
call fcn.1400c7400
lea rdx, str..exe_
lea rcx, [rbp + 0x17a0]
call fcn.1400c75d0
lea rdx, str..exe
mov rbx, rax
lea rcx, [rbp + 0x1780]
call fcn.1400c75d0
mov r8, rbx
lea rcx, [rbp + 0x2770]
mov rdx, rax
call fcn.1400be180
lea r8, str.__vm_100
lea rdx, [rbp + 0x2770]
lea rcx, [rbp + 0x2938]
call fcn.1400cb030
lea rcx, [rbp + 0x2938]
call fcn.1400622a0
mov rdx, rax
lea rcx, [rbp + 0x1760]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400b5480
lea rcx, [rbp + 0x2938]
call fcn.1400622b0
lea rcx, [rbp + 0x2770]
call fcn.1400622b0
lea rcx, [rbp + 0x2958]
call fcn.1400622b0
mov rcx, qword [rbp + 0x23d0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [0x1400c0540]
lea rcx, [rbp + 0x26f0]
call fcn.1400cc140
lea rcx, [rbp + 0x26f0]
call fcn.1400aada0
lea rcx, [rbp + 0x26f0]
call fcn.14005ba60
lea rcx, [rbp + 0x2858]
call fcn.1400622b0
jmp 0x1400c1410
xor r9d, r9d
lea rdx, str.Your_Choice_Of_Emulator_Isnt_Installed
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [rbp + 0x23f0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rbp + 0x2820]
call fcn.1400c6460
lea rcx, [rbp + 0x29a8]
call fcn.1400622b0
lea rcx, [rbp + 0x2800]
jmp 0x1400c1670
cmp eax, 2
jne 0x1400c1675
lea rdx, str.SOFTWAREWOW6432NodeSmartGaGaProjectTitan_
lea rcx, [rbp + 0x2790]
call fcn.1400c75d0
lea rcx, [rbp + 0x29c8]
call fcn.1400c7730
mov edx, Ordinal_27
lea rcx, [rbp + 0x27d0]
call fcn.1400b5fd0
lea rcx, [rbp + 0x27d0]
call fcn.1400c64d0
lea rcx, [rbp + 0x2790]
call fcn.1400622a0
mov rdx, rax
mov r9d, 0x20019
lea rax, [rbp + 0x23e0]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400c162f
lea rdx, [rbp + 0x2790]
mov dword [rbp + 0x2664], r13d
lea rcx, [rbp + 0x28d8]
call fcn.1400c7610
lea rcx, [rbp + 0x28d8]
call fcn.1400622a0
mov rdx, rax
lea r8, [rbp + 0x23d8]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1400c1621
xor edx, edx
mov dword [rbp + 0x2664], 0xff
mov r8d, 0xff
lea rcx, [rbp + 0x2ca0]
call fcn.1402ba800
mov rcx, qword [rbp + 0x23d8]
lea rax, [rbp + 0x2664]
mov qword [rsp + 0x28], rax
lea rdx, str.InstallDir
lea rax, [rbp + 0x2ca0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c1614
lea rdx, [rbp + 0x2ca0]
lea rcx, [rbp + 0x2878]
call fcn.1400c75d0
lea r8, str.EngineProjectTitan.exe
lea rdx, [rbp + 0x2878]
lea rcx, [rbp + 0x2730]
call fcn.1400cb030
xor edx, edx
lea rcx, [rbp + 0x2730]
mov r9b, Ordinal_35
lea r8d, [rdx + 1]
call fcn.1400c7400
lea rdx, str..exe_
lea rcx, [rbp + 0x1740]
call fcn.1400c75d0
lea rdx, str..exe
mov rbx, rax
lea rcx, [rbp + 0x1720]
call fcn.1400c75d0
mov r8, rbx
lea rcx, [rbp + 0x2730]
mov rdx, rax
call fcn.1400be180
lea rcx, [rbp + 0x2730]
call fcn.1400622a0
mov rdx, rax
lea rcx, [rbp + 0x1700]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400b5480
lea rcx, [rbp + 0x2730]
call fcn.1400622b0
lea rcx, [rbp + 0x2878]
call fcn.1400622b0
mov rcx, qword [rbp + 0x23d8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rbp + 0x28d8]
call fcn.1400622b0
jmp 0x1400c1644
xor r9d, r9d
lea rdx, str.Your_Choice_Of_Emulator_Isnt_Installed
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [rbp + 0x23e0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rbp + 0x27d0]
call fcn.1400c6460
lea rcx, [rbp + 0x29c8]
call fcn.1400622b0
lea rcx, [rbp + 0x2790]
call fcn.1400622b0
movaps xmm2, xmm8
lea rcx, [rbp + 0x660]
movaps xmm1, xmm7
call fcn.140062310
lea rdx, [rbp + 0x660]
lea rcx, str.Start_Bypass
call fcn.14009b970
test al, al
je 0x1400c3311
lea rdx, str.Starting_Game.
lea rcx, [0x1403d53a0]
call fcn.1400c7550
lea rdx, str.C:WindowsSysWOW64drivers_a3.bin
lea rcx, [rbp + 0x1550]
call fcn.1400c75d0
lea rcx, [rbp + 0x1550]
call fcn.1400be2b0
lea rcx, [rbp + 0x1550]
movzx ebx, al
call fcn.1400622b0
test bl, bl
jne 0x1400c1708
lea rdx, str.C:WindowsSysWOW64drivers_a3.bin
lea rcx, [rbp + 0x16c0]
call fcn.1400c75d0
mov rcx, rax
mov edx, WSAGetLastError
call fcn.1400b5ab0
lea rdx, str.C:WindowsSysWOW64drivershookdrv.sys
lea rcx, [rbp + 0x1570]
call fcn.1400c75d0
lea rcx, [rbp + 0x1570]
call fcn.1400be2b0
lea rcx, [rbp + 0x1570]
movzx ebx, al
call fcn.1400622b0
test bl, bl
jne 0x1400c175a
lea rdx, str.C:WindowsSysWOW64drivershookdrv.sys
lea rcx, [rbp + 0x16a0]
call fcn.1400c75d0
mov rcx, rax
mov edx, 0x3ff
call fcn.1400b5ab0
lea rdx, str.sc_create_xander_binPath_C:WindowsSysWOW64drivershookdrv.sys__typekernel
lea rcx, [rbp + 0x1680]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400b5480
lea rdx, str.sc_start_xander
lea rcx, [rbp + 0x1660]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400b5480
lea rdx, str.Starting_Game.
lea rcx, [0x1403d53a0]
call fcn.1400c7550
mov eax, dword [0x1403d557c]
test eax, eax
jne 0x1400c1dca
movdqa xmm0, xmmword [0x1403661a0]
lea rcx, [rbp + 0x8b0]
movdqa xmm1, xmmword [0x1403665c0]
movdqu xmmword [rbp + 0x8b0], xmm0
mov dword [rbp + 0x8e0], 0x5d464245
movdqa xmm0, xmmword [0x1403663b0]
movdqu xmmword [rbp + 0x8d0], xmm0
mov dword [rbp + 0x8e4], 0x4b4204
movdqu xmmword [rbp + 0x8c0], xmm1
mov byte [rbp + 0x8e8], 1
call fcn.1400c4940
mov rdx, rax
lea rcx, [rbp + 0x1640]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400b5480
lea rdx, str.Status_:_Global_Starting
lea rcx, [0x1403d53a0]
call fcn.1400c7550
lea rdx, str.C:WindowsSysWOW64drivers_a1.bin
lea rcx, [rbp + 0x13d0]
call fcn.1400c75d0
lea rcx, [rbp + 0x13d0]
call fcn.1400be2b0
lea rcx, [rbp + 0x13d0]
movzx ebx, al
call fcn.1400622b0
test bl, bl
jne 0x1400c1884
lea rdx, str.C:WindowsSysWOW64drivers_a1.bin
lea rcx, [rbp + 0x1620]
call fcn.1400c75d0
mov rcx, rax
mov edx, WSASetLastError
call fcn.1400b5ab0
lea rdx, str.C:WindowsSysWOW64drivers_a2.bin
lea rcx, [rbp + 0x1410]
call fcn.1400c75d0
lea rcx, [rbp + 0x1410]
call fcn.1400be2b0
lea rcx, [rbp + 0x1410]
movzx ebx, al
call fcn.1400622b0
test bl, bl
jne 0x1400c18d6
lea rdx, str.C:WindowsSysWOW64drivers_a2.bin
lea rcx, [rbp + 0x1600]
call fcn.1400c75d0
mov rcx, rax
mov edx, 0x3fe
call fcn.1400b5ab0
movdqa xmm0, xmmword [0x1403660b0]
lea rcx, [rbp + 0xe98]
movdqu xmmword [rbp + 0xe98], xmm0
mov byte [rbp + 0xea8], 1
call fcn.1400c4970
mov rdx, rax
lea rcx, [rbp + 0x15e0]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
lea rcx, [rbp - 0x60]
mov dword [rbp - 0x60], 0xd99a9397
mov dword [rbp - 0x5c], 0x948a9e9e
mov dword [rbp - 0x58], 0x739a9d
mov byte [rbp - 0x54], 1
call fcn.1400b1e50
mov rdx, rax
lea rcx, [rbp + 0x23a0]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x140366550]
lea rcx, [rbp + 0xd0]
movdqa xmm1, xmmword [0x140366590]
movdqu xmmword [rbp + 0xd0], xmm0
mov dword [rbp + 0x100], 0x404a4e4a
movdqa xmm0, xmmword [0x1403660e0]
movdqu xmmword [rbp + 0xf0], xmm0
mov dword [rbp + 0x104], 0x4c44584d
movdqu xmmword [rbp + 0xe0], xmm1
mov dword [rbp + 0x108], 0x421e4a5c
mov word [rbp + 0x10c], 0x5d
mov byte [rbp + 0x10e], 1
call fcn.1400c48b0
mov rdx, rax
lea rcx, [rbp + 0x2380]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x140366550]
lea rcx, [rbp + 0x10]
movdqa xmm1, xmmword [0x140366590]
movdqa xmmword [rbp + 0x10], xmm0
movdqa xmm0, xmmword [0x1403660e0]
movdqa xmmword [rbp + 0x30], xmm0
movdqa xmmword [rbp + 0x20], xmm1
mov dword [rbp + 0x40], 0x4d4a4e4a
mov dword [rbp + 0x44], 0x4147594b
mov dword [rbp + 0x48], 0x1f545d41
mov dword [rbp + 0x4c], 0x1005c41
call fcn.1400c48e0
mov rdx, rax
lea rcx, [rbp + 0x2360]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x1403664b0]
lea rcx, [rbp + 0xaa0]
movdqa xmm1, xmmword [0x1403665e0]
movdqa xmmword [rbp + 0xaa0], xmm0
movdqa xmm0, xmmword [0x1403663e0]
movdqa xmmword [rbp + 0xac0], xmm0
movdqa xmm0, xmmword [0x1403661b0]
movdqa xmmword [rbp + 0xab0], xmm1
movdqa xmm1, xmmword [0x140366470]
movdqa xmmword [rbp + 0xae0], xmm0
movdqa xmmword [rbp + 0xad0], xmm1
mov dword [rbp + 0xaf0], 0x2e21252f
mov dword [rbp + 0xaf4], 0x3f2d2339
mov dword [rbp + 0xaf8], 0x3e23612b
mov word [rbp + 0xafc], 0x100
call fcn.1400c49a0
mov rdx, rax
lea rcx, [rbp + 0x2340]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x1403664b0]
movdqa xmm1, xmmword [0x1403665e0]
movdqa xmmword [rbp + 0x8f0], xmm0
movdqa xmmword [rbp + 0x900], xmm1
movdqa xmm0, xmmword [0x1403663f0]
lea rcx, [rbp + 0x8f0]
movdqa xmm1, xmmword [0x140366470]
movdqa xmmword [rbp + 0x910], xmm0
movdqa xmm0, xmmword [0x1403661b0]
movdqa xmmword [rbp + 0x930], xmm0
movdqa xmmword [rbp + 0x920], xmm1
mov dword [rbp + 0x940], 0x282c252f
mov dword [rbp + 0x944], 0x22202038
mov dword [rbp + 0x948], 0x227e2b3c
mov word [rbp + 0x94c], 0x3d
mov byte [rbp + 0x94e], 1
call fcn.1400c49d0
mov rdx, rax
lea rcx, [rbp + 0x2320]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x1403664b0]
lea rcx, [rbp + 0xff0]
movdqa xmm1, xmmword [0x1403665e0]
movdqa xmmword [rbp + 0xff0], xmm0
movdqa xmm0, xmmword [0x140366400]
movdqa xmmword [rbp + 0x1000], xmm1
movdqa xmm1, xmmword [0x140366480]
movdqa xmmword [rbp + 0x1010], xmm0
movdqa xmmword [rbp + 0x1020], xmm1
mov dword [rbp + 0x1030], 0x4d404318
mov word [rbp + 0x1034], 0x100
call fcn.1400c0750
mov rdx, rax
lea rcx, [rbp + 0x2300]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x140366510]
lea rcx, [rbp + 0xeb0]
movdqa xmm1, xmmword [0x1403665d0]
movdqa xmmword [rbp + 0xeb0], xmm0
movdqa xmm0, xmmword [0x140366350]
movdqa xmmword [rbp + 0xec0], xmm1
movdqa xmm1, xmmword [0x140366270]
movdqa xmmword [rbp + 0xed0], xmm0
movdqa xmmword [rbp + 0xee0], xmm1
mov dword [rbp + 0xef0], 0x4d51415f
mov word [rbp + 0xef4], 0x43
mov byte [rbp + 0xef6], 1
call fcn.1400c4a00
mov rdx, rax
lea rcx, [rbp + 0x22e0]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x140366170]
lea rcx, [rbp + 0xd60]
movdqa xmm1, xmmword [0x1403664c0]
movdqu xmmword [rbp + 0xd60], xmm0
mov dword [rbp + 0xd90], 0x4b414b09
movdqa xmm0, xmmword [0x1403662a0]
movdqu xmmword [rbp + 0xd80], xmm0
mov word [rbp + 0xd94], 0x100
movdqu xmmword [rbp + 0xd70], xmm1
call fcn.1400c4a30
mov rdx, rax
lea rcx, [rbp + 0x22c0]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x140366170]
lea rcx, [rbp + 0x9b0]
movdqa xmm1, xmmword [0x1403664c0]
movdqu xmmword [rbp + 0x9b0], xmm0
mov dword [rbp + 0x9e0], 0x45414109
movdqa xmm0, xmmword [0x1403662a0]
movdqu xmmword [rbp + 0x9d0], xmm0
mov dword [rbp + 0x9e4], 0x100584f
movdqu xmmword [rbp + 0x9c0], xmm1
call fcn.1400c4a60
mov rdx, rax
lea rcx, [rbp + 0x22a0]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x140366170]
lea rcx, [rbp + 0x978]
movdqa xmm1, xmmword [0x1403664c0]
movdqu xmmword [rbp + 0x978], xmm0
mov dword [rbp + 0x9a8], 0x4a494409
movdqa xmm0, xmmword [0x1403662a0]
movdqu xmmword [rbp + 0x998], xmm0
mov dword [rbp + 0x9ac], 0x1004e42
movdqu xmmword [rbp + 0x988], xmm1
call fcn.1400c4a60
mov rdx, rax
lea rcx, [rbp + 0x2280]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1400beb80]
lea rcx, [rbp + 0x26e0]
call fcn.1400cc140
lea rcx, [rbp + 0x26e0]
call fcn.1400aada0
lea rcx, [rbp + 0x26e0]
call fcn.14005ba60
jmp 0x1400c43cf
cmp eax, 1
jne 0x1400c260a
movdqa xmm0, xmmword [0x1403661a0]
lea rcx, [rbp + 0x488]
movdqa xmm1, xmmword [0x1403665c0]
movdqu xmmword [rbp + 0x488], xmm0
mov dword [rbp + 0x4b8], 0x5b430941
movdqa xmm0, xmmword [0x140366340]
movdqu xmmword [rbp + 0x4a8], xmm0
mov dword [rbp + 0x4bc], 0x444e4447
movdqu xmmword [rbp + 0x498], xmm1
mov dword [rbp + 0x4c0], 0x1004a42
call fcn.1400c4910
mov rdx, rax
lea rcx, [rbp + 0x2260]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400b5480
lea rdx, str.Status_:_KR_Starting
lea rcx, [0x1403d53a0]
call fcn.1400c7550
lea rdx, str.C:WindowsSysWOW64drivers_a1.bin
lea rcx, [rbp + 0x13f0]
call fcn.1400c75d0
lea rcx, [rbp + 0x13f0]
call fcn.1400be2b0
lea rcx, [rbp + 0x13f0]
movzx ebx, al
call fcn.1400622b0
test bl, bl
jne 0x1400c1ea9
lea rdx, str.C:WindowsSysWOW64drivers_a1.bin
lea rcx, [rbp + 0x2240]
call fcn.1400c75d0
mov rcx, rax
mov edx, WSASetLastError
call fcn.1400b5ab0
lea rdx, str.C:WindowsSysWOW64drivers_a2.bin
lea rcx, [rbp + 0x13b0]
call fcn.1400c75d0
lea rcx, [rbp + 0x13b0]
call fcn.1400be2b0
lea rcx, [rbp + 0x13b0]
movzx ebx, al
call fcn.1400622b0
test bl, bl
jne 0x1400c1efb
lea rdx, str.C:WindowsSysWOW64drivers_a2.bin
lea rcx, [rbp + 0x1c40]
call fcn.1400c75d0
mov rcx, rax
mov edx, 0x400
call fcn.1400b5ab0
lea rdx, str._C:UserCustom.ini
lea rcx, [rbp + 0x1390]
call fcn.1400c75d0
lea rcx, [rbp + 0x1390]
call fcn.1400be2b0
lea rcx, [rbp + 0x1390]
movzx ebx, al
call fcn.1400622b0
test bl, bl
jne 0x1400c1f4d
lea rdx, str._C:UserCustom.ini
lea rcx, [rbp + 0x2220]
call fcn.1400c75d0
mov rcx, rax
mov edx, 0x401
call fcn.1400b5ab0
movdqa xmm0, xmmword [0x1403660b0]
lea rcx, [rbp + 0xe80]
movdqu xmmword [rbp + 0xe80], xmm0
mov byte [rbp + 0xe90], 1
call fcn.1400c4970
mov rdx, rax
lea rcx, [rbp + 0x2200]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
lea rcx, [rbp - 0x70]
mov dword [rbp - 0x70], 0xd99a9397
mov dword [rbp - 0x6c], 0x948a9e9e
mov dword [rbp - 0x68], 0x739a9d
mov byte [rbp - 0x64], 1
call fcn.1400b1e50
mov rdx, rax
lea rcx, [rbp + 0x21e0]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x140366550]
lea rcx, [rbp + 0x1300]
movdqa xmm1, xmmword [0x140366590]
movdqa xmmword [rbp + 0x1300], xmm0
movdqa xmm0, xmmword [0x140366360]
movdqa xmmword [rbp + 0x1310], xmm1
movdqa xmm1, xmmword [0x140366450]
movdqa xmmword [rbp + 0x1320], xmm0
movdqa xmmword [rbp + 0x1330], xmm1
mov word [rbp + 0x1340], 0x100
call fcn.1400c4a90
mov rdx, rax
lea rcx, [rbp + 0x21c0]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x140366550]
lea rcx, [rbp + 0x1200]
movdqa xmm1, xmmword [0x140366590]
movdqa xmmword [rbp + 0x1200], xmm0
movdqa xmm0, xmmword [0x140366360]
movdqa xmmword [rbp + 0x1210], xmm1
movdqa xmm1, xmmword [0x1403662f0]
movdqa xmmword [rbp + 0x1220], xmm0
movdqa xmmword [rbp + 0x1230], xmm1
mov word [rbp + 0x1240], 0x59
mov byte [rbp + 0x1242], 1
call fcn.1400c4ac0
mov rdx, rax
lea rcx, [rbp + 0x21a0]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x1403664b0]
lea rcx, [rbp + 0xc50]
movdqa xmm1, xmmword [0x1403665e0]
movdqa xmmword [rbp + 0xc50], xmm0
movdqa xmm0, xmmword [0x1403663e0]
movdqa xmmword [rbp + 0xc70], xmm0
movdqa xmm0, xmmword [0x140366180]
movdqa xmmword [rbp + 0xc60], xmm1
movdqa xmm1, xmmword [0x140366130]
movdqa xmmword [rbp + 0xc90], xmm0
movdqa xmmword [rbp + 0xc80], xmm1
mov dword [rbp + 0xca0], 0x213b202f
mov dword [rbp + 0xca4], 0x6329392b
mov dword [rbp + 0xca8], 0x100203d
call fcn.1400c4af0
mov rdx, rax
lea rcx, [rbp + 0x2180]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x1403664b0]
movdqa xmm1, xmmword [0x1403665e0]
movdqa xmmword [rbp + 0xb00], xmm0
movdqa xmm0, xmmword [0x1403663f0]
movdqa xmmword [rbp + 0xb10], xmm1
movdqa xmm1, xmmword [0x140366130]
movdqa xmmword [rbp + 0xb20], xmm0
movdqa xmm0, xmmword [0x140366180]
lea rcx, [rbp + 0xb00]
movdqa xmmword [rbp + 0xb40], xmm0
movdqa xmmword [rbp + 0xb30], xmm1
mov dword [rbp + 0xb50], 0x223a2622
mov dword [rbp + 0xb54], 0x293e2426
mov dword [rbp + 0xb58], 0x3f3c60
mov byte [rbp + 0xb5c], 1
call fcn.1400c4b20
mov rdx, rax
lea rcx, [rbp + 0x2160]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x1403664b0]
lea rcx, [rbp + 0xfa0]
movdqa xmm1, xmmword [0x1403665e0]
movdqa xmmword [rbp + 0xfa0], xmm0
movdqa xmm0, xmmword [0x140366400]
movdqa xmmword [rbp + 0xfb0], xmm1
movdqa xmm1, xmmword [0x140366480]
movdqa xmmword [rbp + 0xfc0], xmm0
movdqa xmmword [rbp + 0xfd0], xmm1
mov dword [rbp + 0xfe0], 0x4d404318
mov word [rbp + 0xfe4], 0x100
call fcn.1400c0750
mov rdx, rax
lea rcx, [rbp + 0x2140]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x1403664e0]
lea rcx, [rbp + 0x1040]
movdqa xmm1, xmmword [0x1403664d0]
movdqa xmmword [rbp + 0x1040], xmm0
movdqa xmm0, xmmword [0x140366410]
movdqa xmmword [rbp + 0x1060], xmm0
movdqa xmm0, xmmword [0x140366190]
movdqa xmmword [rbp + 0x1050], xmm1
movdqa xmm1, xmmword [0x140366440]
movdqa xmmword [rbp + 0x1080], xmm0
movdqa xmm0, xmmword [0x1403660f0]
movdqa xmmword [rbp + 0x1070], xmm1
movdqa xmm1, xmmword [str.he__:]
movdqa xmmword [rbp + 0x10a0], xmm0
movdqa xmm0, xmmword [0x140366640]
movdqa xmmword [rbp + 0x1090], xmm1
movdqa xmm1, xmmword [0x140366110]
movdqa xmmword [rbp + 0x10c0], xmm0
movdqa xmmword [rbp + 0x10b0], xmm1
mov dword [rbp + 0x10d0], 0xfafdc4f4
mov dword [rbp + 0x10d4], 0xa3e1e4fe
mov dword [rbp + 0x10d8], 0xf9e1e7
mov byte [rbp + 0x10dc], 1
call fcn.1400c4b50
mov rdx, rax
lea rcx, [rbp + 0x2120]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x140366580]
movdqa xmm1, xmmword [0x140366540]
movdqa xmmword [rbp + 0x1250], xmm0
movdqa xmm0, xmmword [0x1403664f0]
movdqa xmmword [rbp + 0x1260], xmm1
movdqa xmm1, xmmword [0x140366140]
movdqa xmmword [rbp + 0x1270], xmm0
movdqa xmm0, xmmword [0x1403661d0]
movdqa xmmword [rbp + 0x1280], xmm1
movdqa xmm1, xmmword [0x1403661f0]
movdqa xmmword [rbp + 0x1290], xmm0
movdqa xmm0, xmmword [0x140366200]
movdqa xmmword [rbp + 0x12a0], xmm1
movdqa xmm1, xmmword [0x1403660c0]
movdqa xmmword [rbp + 0x12b0], xmm0
movdqa xmm0, xmmword [0x140366630]
movdqa xmmword [rbp + 0x12c0], xmm1
movdqa xmm1, xmmword [0x140366650]
movdqa xmmword [rbp + 0x12d0], xmm0
movdqa xmmword [rbp + 0x12e0], xmm1
mov dword [rbp + 0x12f0], 0xf7f1b9fb
lea rcx, [rbp + 0x1250]
mov word [rbp + 0x12f4], 0xf3
mov byte [rbp + 0x12f6], 1
call fcn.1400c4b80
mov rdx, rax
lea rcx, [rbp + 0x16e0]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x140366170]
lea rcx, [rbp + 0x870]
movdqa xmm1, xmmword [0x1403664c0]
movdqu xmmword [rbp + 0x870], xmm0
mov dword [rbp + 0x8a0], 0x64d4b4f
movdqa xmm0, xmmword [0x140366320]
movdqu xmmword [rbp + 0x890], xmm0
mov dword [rbp + 0x8a4], 0x4e4246
movdqu xmmword [rbp + 0x880], xmm1
mov byte [rbp + 0x8a8], 1
call fcn.1400c4940
mov rdx, rax
lea rcx, [rbp + 0x18e0]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x140366170]
lea rcx, [rbp + 0x620]
movdqa xmm1, xmmword [0x1403664c0]
movdqu xmmword [rbp + 0x620], xmm0
mov dword [rbp + 0x650], 0x64d4b4f
movdqa xmm0, xmmword [0x140366320]
movdqu xmmword [rbp + 0x640], xmm0
mov dword [rbp + 0x654], 0x4840424c
movdqu xmmword [rbp + 0x630], xmm1
mov word [rbp + 0x658], 0x5d
mov byte [rbp + 0x65a], 1
call fcn.1400c4bb0
mov rdx, rax
lea rcx, [rbp + 0x1900]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x140366170]
lea rcx, [rbp + 0x5e0]
movdqa xmm1, xmmword [0x1403664c0]
movdqu xmmword [rbp + 0x5e0], xmm0
mov dword [rbp + 0x610], 0x64d4b4f
movdqa xmm0, xmmword [0x140366320]
movdqu xmmword [rbp + 0x600], xmm0
mov dword [rbp + 0x614], 0x454f4a49
movdqu xmmword [rbp + 0x5f0], xmm1
mov word [rbp + 0x618], Ordinal_79
mov byte [rbp + 0x61a], 1
call fcn.1400c4bb0
mov rdx, rax
lea rcx, [rbp + 0x1920]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x140366510]
lea rcx, [rbp + 0xbc0]
movdqa xmm1, xmmword [0x1403665f0]
movdqa xmmword [rbp + 0xbc0], xmm0
movdqa xmm0, xmmword [0x140366300]
movdqa xmmword [rbp + 0xbd0], xmm1
movdqa xmm1, xmmword [0x140366490]
movdqa xmmword [rbp + 0xbe0], xmm0
movdqa xmmword [rbp + 0xbf0], xmm1
mov dword [rbp + 0xc00], 0x504c5477
mov dword [rbp + 0xc04], 0x4448524c
mov word [rbp + 0xc08], 0x100
call fcn.1400c4be0
mov rdx, rax
lea rcx, [rbp + 0x1940]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1400bf750]
lea rcx, [rbp + 0x26b0]
call fcn.1400cc140
lea rcx, [rbp + 0x26b0]
call fcn.1400aada0
lea rcx, [rbp + 0x26b0]
call fcn.14005ba60
jmp 0x1400c43cf
cmp eax, 2
jne 0x1400c2c51
movdqa xmm0, xmmword [0x1403661a0]
lea rcx, [rbp + 0x310]
movdqa xmm1, xmmword [0x1403665c0]
movdqu xmmword [rbp + 0x310], xmm0
mov dword [rbp + 0x340], 0x4b5d5708
movdqa xmm0, xmmword [0x140366290]
movdqu xmmword [rbp + 0x330], xmm0
mov dword [rbp + 0x344], 0x4f43464d
movdqu xmmword [rbp + 0x320], xmm1
mov dword [rbp + 0x348], 0x554347
mov byte [rbp + 0x34c], 1
call fcn.1400c4c10
mov rdx, rax
lea rcx, [rbp + 0x1960]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400b5480
lea rdx, str.Status_:_VNG_Starting
lea rcx, [0x1403d53a0]
call fcn.1400c7550
lea rdx, str.C:WindowsSysWOW64drivers_a1.bin
lea rcx, [rbp + 0x1370]
call fcn.1400c75d0
lea rcx, [rbp + 0x1370]
call fcn.1400be2b0
lea rcx, [rbp + 0x1370]
movzx ebx, al
call fcn.1400622b0
test bl, bl
jne 0x1400c26f0
lea rdx, str.C:WindowsSysWOW64drivers_a1.bin
lea rcx, [rbp + 0x1980]
call fcn.1400c75d0
mov rcx, rax
mov edx, WSASetLastError
call fcn.1400b5ab0
lea rdx, str.C:WindowsSysWOW64drivers_a2.bin
lea rcx, [rbp + 0x1350]
call fcn.1400c75d0
lea rcx, [rbp + 0x1350]
call fcn.1400be2b0
lea rcx, [rbp + 0x1350]
movzx ebx, al
call fcn.1400622b0
test bl, bl
jne 0x1400c2742
lea rdx, str.C:WindowsSysWOW64drivers_a2.bin
lea rcx, [rbp + 0x19a0]
call fcn.1400c75d0
mov rcx, rax
mov edx, 0x3fe
call fcn.1400b5ab0
movdqa xmm0, xmmword [0x1403660b0]
lea rcx, [rbp + 0xe68]
movdqu xmmword [rbp + 0xe68], xmm0
mov byte [rbp + 0xe78], 1
call fcn.1400c4970
mov rdx, rax
lea rcx, [rbp + 0x19c0]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0xd99a9397
mov dword [rbp - 0x2c], 0x948a9e9e
mov dword [rbp - 0x28], 0x739a9d
mov byte [rbp - 0x24], 1
call fcn.1400b1e50
mov rdx, rax
lea rcx, [rbp + 0x19e0]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x140366550]
lea rcx, [rbp + 0x11b0]
movdqa xmm1, xmmword [0x140366590]
movdqa xmmword [rbp + 0x11b0], xmm0
movdqa xmm0, xmmword [0x1403660d0]
movdqa xmmword [rbp + 0x11c0], xmm1
movdqa xmm1, xmmword [0x1403662e0]
movdqa xmmword [rbp + 0x11d0], xmm0
movdqa xmmword [rbp + 0x11e0], xmm1
mov word [rbp + 0x11f0], 0x59
mov byte [rbp + 0x11f2], 1
call fcn.1400c4ac0
mov rdx, rax
lea rcx, [rbp + 0x1a00]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x140366550]
lea rcx, [rbp + 0x10e0]
movdqa xmm1, xmmword [0x140366590]
movdqa xmmword [rbp + 0x10e0], xmm0
movdqa xmm0, xmmword [0x1403660d0]
movdqa xmmword [rbp + 0x10f0], xmm1
movdqa xmm1, xmmword [0x140366120]
movdqa xmmword [rbp + 0x1100], xmm0
movdqa xmmword [rbp + 0x1110], xmm1
mov dword [rbp + 0x1120], 0x1005845
call fcn.1400c4c40
mov rdx, rax
lea rcx, [rbp + 0x1a20]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x1403664b0]
lea rcx, [rbp + 0xb60]
movdqa xmm1, xmmword [0x1403665e0]
movdqa xmmword [rbp + 0xb60], xmm0
movdqa xmm0, xmmword [0x1403663e0]
movdqa xmmword [rbp + 0xb80], xmm0
movdqa xmm0, xmmword [0x1403661e0]
movdqa xmmword [rbp + 0xb70], xmm1
movdqa xmm1, xmmword [0x1403662d0]
movdqa xmmword [rbp + 0xba0], xmm0
movdqa xmmword [rbp + 0xb90], xmm1
mov dword [rbp + 0xbb0], 0x3a2f2e24
mov dword [rbp + 0xbb4], 0x283e2a22
mov dword [rbp + 0xbb8], 0x3f3c60
mov byte [rbp + 0xbbc], 1
call fcn.1400c4b20
mov rdx, rax
lea rcx, [rbp + 0x1a40]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x1403664b0]
movdqa xmm1, xmmword [0x1403665e0]
movdqa xmmword [rbp + 0xa40], xmm0
movdqa xmm0, xmmword [0x1403663f0]
movdqa xmmword [rbp + 0xa60], xmm0
movdqa xmmword [rbp + 0xa50], xmm1
movdqa xmm1, xmmword [0x1403662d0]
lea rcx, [rbp + 0xa40]
movdqa xmm0, xmmword [0x1403661e0]
movdqa xmmword [rbp + 0xa70], xmm1
movdqa xmmword [rbp + 0xa80], xmm0
mov dword [rbp + 0xa90], 0x3b292324
mov dword [rbp + 0xa94], 0x3f232721
mov dword [rbp + 0xa98], 0x3e23612a
mov word [rbp + 0xa9c], 0x100
call fcn.1400c49a0
mov rdx, rax
lea rcx, [rbp + 0x1a60]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x1403664b0]
lea rcx, [rbp + 0xf50]
movdqa xmm1, xmmword [0x1403665e0]
movdqa xmmword [rbp + 0xf50], xmm0
movdqa xmm0, xmmword [0x140366400]
movdqa xmmword [rbp + 0xf60], xmm1
movdqa xmm1, xmmword [0x140366480]
movdqa xmmword [rbp + 0xf70], xmm0
movdqa xmmword [rbp + 0xf80], xmm1
mov dword [rbp + 0xf90], 0x4d404318
mov word [rbp + 0xf94], 0x100
call fcn.1400c0750
mov rdx, rax
lea rcx, [rbp + 0x1a80]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x140366170]
lea rcx, [rbp + 0x670]
movdqa xmm1, xmmword [0x1403664c0]
movdqu xmmword [rbp + 0x670], xmm0
mov dword [rbp + 0x6a0], 0x4c444e44
movdqa xmm0, xmmword [0x140366390]
movdqu xmmword [rbp + 0x690], xmm0
mov dword [rbp + 0x6a4], 0x4f454705
movdqu xmmword [rbp + 0x680], xmm1
mov word [rbp + 0x6a8], 0x100
call fcn.1400c4c70
mov rdx, rax
lea rcx, [rbp + 0x1aa0]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x140366170]
lea rcx, [rbp + 0x448]
movdqa xmm1, xmmword [0x1403664c0]
movdqu xmmword [rbp + 0x448], xmm0
mov dword [rbp + 0x478], 0x4c444e44
movdqa xmm0, xmmword [0x140366390]
movdqu xmmword [rbp + 0x468], xmm0
mov dword [rbp + 0x47c], 0x41454d05
movdqu xmmword [rbp + 0x458], xmm1
mov dword [rbp + 0x480], 0x1005c4b
call fcn.1400c4910
mov rdx, rax
lea rcx, [rbp + 0x1ac0]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x140366170]
lea rcx, [rbp + 0x408]
movdqa xmm1, xmmword [0x1403664c0]
movdqu xmmword [rbp + 0x408], xmm0
mov dword [rbp + 0x438], 0x4c444e44
movdqa xmm0, xmmword [0x140366390]
movdqu xmmword [rbp + 0x428], xmm0
mov dword [rbp + 0x43c], 0x4e4d4805
movdqu xmmword [rbp + 0x418], xmm1
mov dword [rbp + 0x440], 0x1004a46
call fcn.1400c4910
mov rdx, rax
lea rcx, [rbp + 0x1ae0]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x140366510]
movdqa xmm1, xmmword [0x1403664a0]
lea rcx, [rbp + 0x9f0]
movdqa xmmword [rbp + 0xa00], xmm1
movdqa xmm1, xmmword [0x140366310]
movdqa xmmword [rbp + 0x9f0], xmm0
movdqa xmm0, xmmword [0x1403663c0]
movdqa xmmword [rbp + 0xa20], xmm1
movdqa xmmword [rbp + 0xa10], xmm0
mov dword [rbp + 0xa30], 0x4d5b765e
mov dword [rbp + 0xa34], 0x49554d53
mov word [rbp + 0xa38], Ordinal_79
mov byte [rbp + 0xa3a], 1
call fcn.1400c4ca0
mov rdx, rax
lea rcx, [rbp + 0x1b00]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1400beb80]
lea rcx, [rbp + 0x26c0]
call fcn.1400cc140
lea rcx, [rbp + 0x26c0]
call fcn.1400aada0
lea rcx, [rbp + 0x26c0]
call fcn.14005ba60
jmp 0x1400c43cf
cmp eax, 3
jne 0x1400c3311
movdqa xmm0, xmmword [0x1403661a0]
lea rcx, [rbp + 0x730]
movdqa xmm1, xmmword [0x1403665c0]
movdqu xmmword [rbp + 0x730], xmm0
mov dword [rbp + 0x760], 0x59064849
movdqa xmm0, xmmword [0x1403663d0]
movdqu xmmword [rbp + 0x750], xmm0
mov dword [rbp + 0x764], 0x404b495f
movdqu xmmword [rbp + 0x740], xmm1
mov word [rbp + 0x768], 0x100
call fcn.1400c4c70
mov rdx, rax
lea rcx, [rbp + 0x1b20]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400b5480
lea rdx, str.Status_:_TW_Starting
lea rcx, [0x1403d53a0]
call fcn.1400c7550
lea rdx, [rbp + 0x1b40]
mov dword [rbp - 0x40], 0xb1abb0bf
lea rcx, [rbp - 0x40]
mov dword [rbp - 0x3c], 0xd0b9a9bb
mov dword [rbp - 0x38], 0x42b6b2
mov byte [rbp - 0x34], 1
call fcn.1400c5cc0
mov r8, rax
lea rdx, [rbp + 0x2918]
lea rcx, [0x1403d5400]
call fcn.1400b33d0
movdqa xmm0, xmmword [0x1403663a0]
lea rcx, [rbp + 0xcd8]
movdqa xmm1, xmmword [0x140366570]
movdqu xmmword [rbp + 0xcd8], xmm0
mov dword [rbp + 0xcf8], 0x100797f
movdqu xmmword [rbp + 0xce8], xmm1
call fcn.1400c4cd0
lea rcx, [rbp + 0x2918]
mov rbx, rax
call fcn.1400622a0
xor r9d, r9d
mov qword [rsp + 0x20], r13
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, [rbp + 0x1b60]
mov dword [rsp + 0x78], 0xb5d5a0a2
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x7c], 0x100b9b3
call fcn.1400c5d00
mov r8, rax
lea rdx, [rbp + 0x2898]
lea rcx, [0x1403d5400]
call fcn.1400b33d0
movdqa xmm0, xmmword [0x1403663a0]
lea rcx, [rbp + 0xcb0]
movdqa xmm1, xmmword [0x140366560]
movdqu xmmword [rbp + 0xcb0], xmm0
mov dword [rbp + 0xcd0], 0x100797f
movdqu xmmword [rbp + 0xcc0], xmm1
call fcn.1400c4cd0
lea rcx, [rbp + 0x2898]
mov rbx, rax
call fcn.1400622a0
xor r9d, r9d
mov qword [rsp + 0x20], r13
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movdqa xmm0, xmmword [0x1403660b0]
lea rcx, [rbp + 0xe50]
movdqu xmmword [rbp + 0xe50], xmm0
mov byte [rbp + 0xe60], 1
call fcn.1400c4970
mov rdx, rax
lea rcx, [rbp + 0x1b80]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
lea rcx, [rbp - 0x50]
mov dword [rbp - 0x50], 0xd99a9397
mov dword [rbp - 0x4c], 0x948a9e9e
mov dword [rbp - 0x48], 0x739a9d
mov byte [rbp - 0x44], 1
call fcn.1400b1e50
mov rdx, rax
lea rcx, [rbp + 0x1ba0]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x140366550]
lea rcx, [rbp + 0x90]
movdqa xmm1, xmmword [0x140366590]
movdqa xmmword [rbp + 0x90], xmm0
movdqa xmm0, xmmword [0x140366330]
movdqa xmmword [rbp + 0xb0], xmm0
movdqa xmmword [rbp + 0xa0], xmm1
mov dword [rbp + 0xc0], 0x4b414b09
mov dword [rbp + 0xc4], 0x455f4c43
mov dword [rbp + 0xc8], 0x1f555d4f
mov dword [rbp + 0xcc], 0x1005c41
call fcn.1400c48e0
mov rdx, rax
lea rcx, [rbp + 0x1bc0]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x140366550]
lea rcx, [rbp + 0x1590]
movdqa xmm1, xmmword [0x140366590]
movdqa xmmword [rbp + 0x1590], xmm0
movdqa xmm0, xmmword [0x140366330]
movdqa xmmword [rbp + 0x15a0], xmm1
movdqa xmm1, xmmword [str._tKAKNJFB_BU]
movdqa xmmword [rbp + 0x15b0], xmm0
movdqa xmmword [rbp + 0x15c0], xmm1
mov byte [rbp + 0x15d0], 1
call fcn.1400c4d00
mov rdx, rax
lea rcx, [rbp + 0x1be0]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x1403664b0]
lea rcx, [rbp + 0xdf0]
movdqa xmm1, xmmword [0x1403665e0]
movdqa xmmword [rbp + 0xdf0], xmm0
movdqa xmm0, xmmword [0x1403663e0]
movdqa xmmword [rbp + 0xe10], xmm0
movdqa xmm0, xmmword [0x140366150]
movdqa xmmword [rbp + 0xe00], xmm1
movdqa xmm1, xmmword [0x140366460]
movdqa xmmword [rbp + 0xe30], xmm0
movdqa xmmword [rbp + 0xe20], xmm1
mov dword [rbp + 0xe40], 0x3b292f35
mov dword [rbp + 0xe44], 0x223f652f
mov word [rbp + 0xe48], 0x100
call fcn.1400c4d30
mov rdx, rax
lea rcx, [rbp + 0x1c00]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x1403664b0]
lea rcx, [rbp + 0xd00]
movdqa xmm1, xmmword [0x1403665e0]
movdqa xmmword [rbp + 0xd00], xmm0
movdqa xmm0, xmmword [0x1403663f0]
movdqa xmmword [rbp + 0xd20], xmm0
movdqa xmm0, xmmword [0x140366160]
movdqa xmmword [rbp + 0xd10], xmm1
movdqa xmm1, xmmword [0x140366460]
movdqa xmmword [rbp + 0xd40], xmm0
movdqa xmmword [rbp + 0xd30], xmm1
mov dword [rbp + 0xd50], 0x26242c34
mov dword [rbp + 0xd54], 0x3e622f38
mov word [rbp + 0xd58], reloc.WLDAP32.dll_Ordinal_33
mov byte [rbp + 0xd5a], 1
call fcn.1400c4d60
mov rdx, rax
lea rcx, [rbp + 0x1c20]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x1403664b0]
lea rcx, [rbp + 0xf00]
movdqa xmm1, xmmword [0x1403665e0]
movdqa xmmword [rbp + 0xf00], xmm0
movdqa xmm0, xmmword [0x140366400]
movdqa xmmword [rbp + 0xf10], xmm1
movdqa xmm1, xmmword [0x140366480]
movdqa xmmword [rbp + 0xf20], xmm0
movdqa xmmword [rbp + 0xf30], xmm1
mov dword [rbp + 0xf40], 0x4d404318
mov word [rbp + 0xf44], 0x100
call fcn.1400c0750
mov rdx, rax
lea rcx, [rbp + 0x17e0]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x140366170]
lea rcx, [rbp + 0xc10]
movdqa xmm1, xmmword [0x1403664c0]
movdqu xmmword [rbp + 0xc10], xmm0
mov dword [rbp + 0xc40], 0x4044084b
movdqa xmm0, xmmword [0x140366280]
movdqu xmmword [rbp + 0xc30], xmm0
mov word [rbp + 0xc44], Ordinal_79
movdqu xmmword [rbp + 0xc20], xmm1
mov byte [rbp + 0xc46], 1
call fcn.1400c4d90
mov rdx, rax
lea rcx, [rbp + 0x1c60]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x140366170]
lea rcx, [rbp + 0x830]
movdqa xmm1, xmmword [0x1403664c0]
movdqu xmmword [rbp + 0x830], xmm0
mov dword [rbp + 0x860], 0x404e084b
movdqa xmm0, xmmword [0x140366280]
movdqu xmmword [rbp + 0x850], xmm0
mov dword [rbp + 0x864], 0x5f4e46
movdqu xmmword [rbp + 0x840], xmm1
mov byte [rbp + 0x868], 1
call fcn.1400c4940
mov rdx, rax
lea rcx, [rbp + 0x1c80]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x140366170]
lea rcx, [rbp + 0x7f0]
movdqa xmm1, xmmword [0x1403664c0]
movdqu xmmword [rbp + 0x7f0], xmm0
mov dword [rbp + 0x820], 0x484b084b
movdqa xmm0, xmmword [0x140366280]
movdqu xmmword [rbp + 0x810], xmm0
mov dword [rbp + 0x824], 0x494349
movdqu xmmword [rbp + 0x800], xmm1
mov byte [rbp + 0x828], 1
call fcn.1400c4940
mov rdx, rax
lea rcx, [rbp + 0x1ca0]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
movdqa xmm0, xmmword [0x140366510]
lea rcx, [rbp + 0xda0]
movdqa xmm1, xmmword [0x140366220]
movdqa xmmword [rbp + 0xda0], xmm0
movdqa xmm0, xmmword [0x1403662c0]
movdqa xmmword [rbp + 0xdb0], xmm1
movdqa xmm1, xmmword [0x140366430]
movdqa xmmword [rbp + 0xdc0], xmm0
movdqa xmmword [rbp + 0xdd0], xmm1
mov dword [rbp + 0xde0], 0x504e5e42
mov dword [rbp + 0xde4], 0x100424e
call fcn.1400c4dc0
mov rdx, rax
lea rcx, [rbp + 0x1cc0]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400bdfc0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1400bf750]
lea rcx, [rbp + 0x26d0]
call fcn.1400cc140
lea rcx, [rbp + 0x26d0]
call fcn.1400aada0
lea rcx, [rbp + 0x26d0]
call fcn.14005ba60
lea rcx, [rbp + 0x2898]
call fcn.1400622b0
lea rcx, [rbp + 0x2918]
call fcn.1400622b0
jmp 0x1400c43cf
mov dword [rsp + 0x28], r13d
lea rdx, [0x14039aa74]
movaps xmm3, xmm11
mov qword [rsp + 0x20], rdi
movaps xmm2, xmm12
lea rcx, str.Ipad_Slide
call fcn.14009f6f0
test al, al
je 0x1400c3395
mov eax, dword [0x1403a4054]
mov r9d, 0x40
mov rcx, qword [0x1403a4058]
add eax, 0x40897e4
movsxd rbx, eax
lea rax, [rbp + 0x2680]
mov rdx, rbx
mov qword [rsp + 0x20], rax
lea r8d, [r9 - 0x3c]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [0x1403a4058]
lea r8, [0x14039aa74]
mov r9d, 4
mov qword [rsp + 0x20], r13
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x1400c43cf
lea rcx, str.Status_:
call fcn.14009ab50
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1400729a0
lea rcx, [0x1403d53a0]
call fcn.1400622a0
mov rcx, rax
call fcn.14009ab50
lea rcx, [0x1403d54a0]
call fcn.1400aa3d0
lea rcx, [rbp + 0x2688]
mov qword [rbp + 0x2688], rax
call fcn.1400aa3c0
mov rcx, rax
call fcn.1402943ac
lea rcx, [rbp - 0x80]
mov dword [rbp - 0x80], 0x90888fb3
mov rbx, rax
mov dword [rbp - 0x7c], 0xddc68288
mov dword [rbp - 0x78], 0x1008cdb
call fcn.1400b1e20
mov rdx, rbx
mov rcx, rax
call fcn.14009ab50
lea rcx, str.Version_:_1.0.0
call fcn.14009ab50
call fcn.14006ba90
movaps xmm2, xmm15
lea rcx, [rbp + 0x1188]
movaps xmm1, xmm9
call fcn.140062310
mov rdx, rax
lea rcx, str.tools
xor r9d, r9d
mov r8b, 1
call fcn.14006ba00
xor edx, edx
lea rcx, str.Auth
call fcn.1400a5e60
xor r8d, r8d
lea rcx, str.Guest_Reset
xor edx, edx
call fcn.1400a7a80
test al, al
je 0x1400c37cc
movaps xmm2, xmm8
lea rcx, [rbp + 0x2670]
movaps xmm1, xmm10
call fcn.140062310
lea rdx, [rbp + 0x2670]
lea rcx, str.GL_RESET
call fcn.14009b970
test al, al
je 0x1400c352e
lea rdx, str.C:WindowsSysWOW64driversGL.bat
lea rcx, [rbp + 0x14f0]
call fcn.1400c75d0
lea rcx, [rbp + 0x14f0]
call fcn.1400be2b0
lea rcx, [rbp + 0x14f0]
movzx ebx, al
call fcn.1400622b0
test bl, bl
jne 0x1400c34f5
lea rdx, str.C:WindowsSysWOW64driversGL.bat
lea rcx, [rbp + 0x1ce0]
call fcn.1400c75d0
mov rcx, rax
mov edx, 0x67
call fcn.1400b5ab0
mov dword [rsp + 0x28], 0xa
lea r8, str.C:WindowsSysWOW64driversGL.bat
xor r9d, r9d
mov qword [rsp + 0x20], r13
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.GL_Reset_Done
lea rcx, [0x1403d53a0]
call fcn.1400c7550
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1400729a0
lea rdx, [rbp + 0x2670]
lea rcx, str.VNG_RESET
call fcn.14009b970
test al, al
je 0x1400c3630
lea rdx, str.C:WindowsSysWOW64driversVNG.bat
lea rcx, [rbp + 0x14d0]
call fcn.1400c75d0
lea rcx, [rbp + 0x14d0]
call fcn.1400be2b0
lea rcx, [rbp + 0x14d0]
movzx ebx, al
call fcn.1400622b0
test bl, bl
jne 0x1400c35a6
lea rdx, str.C:WindowsSysWOW64driversVNG.bat
lea rcx, [rbp + 0x1d00]
call fcn.1400c75d0
mov rcx, rax
mov edx, 0x68
call fcn.1400b5ab0
movdqa xmm0, xmmword [0x1403663a0]
lea rcx, [rbp + 0x950]
movdqa xmm1, xmmword [0x140366210]
movdqu xmmword [rbp + 0x950], xmm0
mov dword [rbp + 0x970], 0x6c7674
movdqu xmmword [rbp + 0x960], xmm1
mov byte [rbp + 0x974], 1
call fcn.1400c4df0
lea rcx, [rsp + 0x64]
mov dword [rsp + 0x64], 0x979d8799
mov rbx, rax
mov word [rsp + 0x68], 0x100
call fcn.1400b1df0
xor r9d, r9d
mov dword [rsp + 0x28], 1
mov r8, rbx
mov qword [rsp + 0x20], r13
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.VNG_Reset_Done
lea rcx, [0x1403d53a0]
call fcn.1400c7550
lea rdx, [rbp + 0x2670]
lea rcx, str.KR_RESET
call fcn.14009b970
test al, al
je 0x1400c3716
lea rdx, str.C:WindowsSysWOW64driversKR.bat
lea rcx, [rbp + 0x14b0]
call fcn.1400c75d0
lea rcx, [rbp + 0x14b0]
call fcn.1400be2b0
lea rcx, [rbp + 0x14b0]
movzx ebx, al
call fcn.1400622b0
test bl, bl
jne 0x1400c369d
lea rdx, str.C:WindowsKR.bat
lea rcx, [rbp + 0x1d20]
call fcn.1400c75d0
mov rcx, rax
mov edx, 0x69
call fcn.1400b5ab0
movdqa xmm0, xmmword [0x140366500]
lea rcx, [rbp + 0x4c8]
movdqu xmmword [rbp + 0x4c8], xmm0
mov word [rbp + 0x4d8], WSACleanup
mov byte [rbp + 0x4da], 1
call fcn.1400c4e20
lea rcx, [rsp + 0x6c]
mov dword [rsp + 0x6c], 0x979d8799
mov rbx, rax
mov word [rsp + 0x70], 0x100
call fcn.1400b1df0
xor r9d, r9d
mov dword [rsp + 0x28], 1
mov r8, rbx
mov qword [rsp + 0x20], r13
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.KR_Reset_Done
lea rcx, [0x1403d53a0]
call fcn.1400c7550
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1400729a0
lea rdx, [rbp + 0x2670]
lea rcx, str.TW_RESET
call fcn.14009b970
test al, al
je 0x1400c37c7
lea rdx, str.C:WindowsSysWOW64driversTW.bat
lea rcx, [rbp + 0x1430]
call fcn.1400c75d0
lea rcx, [rbp + 0x1430]
call fcn.1400be2b0
lea rcx, [rbp + 0x1430]
movzx ebx, al
call fcn.1400622b0
test bl, bl
jne 0x1400c378e
lea rdx, str.C:WindowsSysWOW64driversTW.bat
lea rcx, [rbp + 0x1d40]
call fcn.1400c75d0
mov rcx, rax
mov edx, 0x6a
call fcn.1400b5ab0
mov dword [rsp + 0x28], 1
lea r8, str.C:WindowsSysWOW64driversTW.bat
xor r9d, r9d
mov qword [rsp + 0x20], r13
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.TW_Reset_done
lea rcx, [0x1403d53a0]
call fcn.1400c7550
call fcn.1400a7b50
xor r8d, r8d
lea rcx, str.Tools
xor edx, edx
call fcn.1400a7a80
test al, al
je 0x1400c4010
movaps xmm2, xmm8
lea rcx, [rbp + 0x2678]
movaps xmm1, xmm10
call fcn.140062310
lea rdx, [rbp + 0x2678]
lea rcx, str.Firewal_Reset
call fcn.14009b970
test al, al
je 0x1400c382f
lea rcx, str.netsh_advfirewal_reset
call fcn.140296d44
lea rdx, str.Firewall_Resetted
lea rcx, [0x1403d53a0]
call fcn.1400c7550
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1400729a0
lea rdx, [rbp + 0x2678]
lea rcx, str.Clear_Temp
call fcn.14009b970
test al, al
je 0x1400c387c
lea rcx, str.rd__temp___s__q
call fcn.140296d44
lea rcx, str.md__temp_
call fcn.140296d44
lea rdx, str.Temp_Cleared
lea rcx, [0x1403d53a0]
call fcn.1400c7550
lea rdx, [rbp + 0x2678]
lea rcx, str.ClearPrefetch
call fcn.14009b970
test al, al
je 0x1400c38ca
lea rcx, str.del__s__f__q_C:Windows_temp.
call fcn.140296d44
lea rcx, str.del__s__f__q_C:WindowsSystem32_temp.
call fcn.140296d44
lea rcx, str.del__s__f__q__USERPROFILE__appdatalocal_temp.
call fcn.140296d44
lea rdx, str.PreFetch_Cleared
lea rcx, [0x1403d53a0]
call fcn.1400c7550
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1400729a0
lea rdx, [rbp + 0x2678]
lea rcx, str.98_stuck_fix
call fcn.14009b970
test al, al
je 0x1400c400b
movdqa xmm0, xmmword [0x1403662b0]
lea rcx, [rbp + 0x7b0]
movdqa xmm1, xmmword [0x140366530]
movdqu xmmword [rbp + 0x7b0], xmm0
mov dword [rbp + 0x7e0], 0x75181717
movdqa xmm0, xmmword [0x1403665a0]
movdqu xmmword [rbp + 0x7d0], xmm0
mov dword [rbp + 0x7e4], 0x1c771a
movdqu xmmword [rbp + 0x7c0], xmm1
mov byte [rbp + 0x7e8], 1
call fcn.1400c4940
mov rdx, rax
lea rcx, [rbp + 0x1d60]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400b5480
movdqa xmm0, xmmword [0x1403662b0]
lea rcx, [rbp + 0x5a0]
movdqa xmm1, xmmword [0x140366530]
movdqu xmmword [rbp + 0x5a0], xmm0
mov dword [rbp + 0x5d0], 0x75181717
movdqa xmm0, xmmword [0x1403665a0]
movdqu xmmword [rbp + 0x5c0], xmm0
mov dword [rbp + 0x5d4], 0x1b1f771a
movdqu xmmword [rbp + 0x5b0], xmm1
mov word [rbp + 0x5d8], Ordinal_27
mov byte [rbp + 0x5da], 1
call fcn.1400c4bb0
mov rdx, rax
lea rcx, [rbp + 0x1d80]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400b5480
movdqa xmm0, xmmword [0x1403662b0]
lea rcx, [rbp + 0x210]
movdqa xmm1, xmmword [0x140366530]
movdqu xmmword [rbp + 0x210], xmm0
mov dword [rbp + 0x240], 0x75181717
movdqa xmm0, xmmword [0x1403665a0]
movdqu xmmword [rbp + 0x230], xmm0
mov dword [rbp + 0x244], 0x1b1f771a
movdqu xmmword [rbp + 0x220], xmm1
mov dword [rbp + 0x248], 0x5f590119
mov word [rbp + 0x24c], 0x5b
mov byte [rbp + 0x24e], 1
call fcn.1400c48b0
mov rdx, rax
lea rcx, [rbp + 0x1da0]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400b5480
movdqa xmm0, xmmword [0x1403662b0]
lea rcx, [rbp + 0x6f0]
movdqa xmm1, xmmword [0x140366530]
movdqu xmmword [rbp + 0x6f0], xmm0
mov dword [rbp + 0x720], 0x75181717
movdqa xmm0, xmmword [0x1403665a0]
movdqu xmmword [rbp + 0x710], xmm0
mov dword [rbp + 0x724], 0x1d1f771a
movdqu xmmword [rbp + 0x700], xmm1
mov word [rbp + 0x728], 0x100
call fcn.1400c4c70
mov rdx, rax
lea rcx, [rbp + 0x1dc0]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400b5480
movdqa xmm0, xmmword [0x1403662b0]
lea rcx, [rbp + 0x290]
movdqa xmm1, xmmword [0x140366530]
movdqu xmmword [rbp + 0x290], xmm0
mov dword [rbp + 0x2c0], 0x75181717
movdqa xmm0, xmmword [0x1403665a0]
movdqu xmmword [rbp + 0x2b0], xmm0
mov dword [rbp + 0x2c4], 0x1d1f771a
movdqu xmmword [rbp + 0x2a0], xmm1
mov dword [rbp + 0x2c8], 0x585e4600
mov word [rbp + 0x2cc], 0x100
call fcn.1400c4e50
mov rdx, rax
lea rcx, [rbp + 0x1de0]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400b5480
movdqa xmm0, xmmword [0x1403662b0]
lea rcx, [rbp + 0x560]
movdqa xmm1, xmmword [0x140366530]
movdqu xmmword [rbp + 0x560], xmm0
mov dword [rbp + 0x590], 0x75181717
movdqa xmm0, xmmword [0x1403665a0]
movdqu xmmword [rbp + 0x580], xmm0
mov dword [rbp + 0x594], 0x151d771a
movdqu xmmword [rbp + 0x570], xmm1
mov word [rbp + 0x598], reloc.WS2_32.dll_shutdown
mov byte [rbp + 0x59a], 1
call fcn.1400c4bb0
mov rdx, rax
lea rcx, [rbp + 0x1e00]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400b5480
movdqa xmm0, xmmword [0x1403662b0]
lea rcx, [rbp + 0x110]
movdqa xmm1, xmmword [0x140366530]
movdqu xmmword [rbp + 0x110], xmm0
mov dword [rbp + 0x140], 0x75181717
movdqa xmm0, xmmword [0x1403665a0]
movdqu xmmword [rbp + 0x130], xmm0
mov dword [rbp + 0x144], 0x151d771a
movdqu xmmword [rbp + 0x120], xmm1
mov dword [rbp + 0x148], 0x5f590116
mov word [rbp + 0x14c], 0x5b
mov byte [rbp + 0x14e], 1
call fcn.1400c48b0
mov rdx, rax
lea rcx, [rbp + 0x1e20]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400b5480
movdqa xmm0, xmmword [0x1403662b0]
lea rcx, [rbp + 0x520]
movdqa xmm1, xmmword [0x140366530]
movdqu xmmword [rbp + 0x520], xmm0
mov dword [rbp + 0x550], 0x75181717
movdqa xmm0, xmmword [0x1403665a0]
movdqu xmmword [rbp + 0x540], xmm0
mov dword [rbp + 0x554], 0x151d771a
movdqu xmmword [rbp + 0x530], xmm1
mov word [rbp + 0x558], reloc.WS2_32.dll_socket
mov byte [rbp + 0x55a], 1
call fcn.1400c4bb0
mov rdx, rax
lea rcx, [rbp + 0x1e40]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400b5480
movdqa xmm0, xmmword [0x1403662b0]
lea rcx, [rbp + 0x1d0]
movdqa xmm1, xmmword [0x140366530]
movdqu xmmword [rbp + 0x1d0], xmm0
mov dword [rbp + 0x200], 0x75181717
movdqa xmm0, xmmword [0x1403665a0]
movdqu xmmword [rbp + 0x1f0], xmm0
mov dword [rbp + 0x204], 0x151d771a
movdqu xmmword [rbp + 0x1e0], xmm1
mov dword [rbp + 0x208], 0x5f590117
mov word [rbp + 0x20c], 0x5b
mov byte [rbp + 0x20e], 1
call fcn.1400c48b0
mov rdx, rax
lea rcx, [rbp + 0x1e60]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400b5480
movdqa xmm0, xmmword [0x1403662b0]
movdqa xmm1, xmmword [0x140366530]
movdqu xmmword [rbp + 0x770], xmm0
mov dword [rbp + 0x7a0], 0x75181717
movdqa xmm0, xmmword [0x1403665a0]
movdqu xmmword [rbp + 0x790], xmm0
mov dword [rbp + 0x7a4], 0x18771a
movdqu xmmword [rbp + 0x780], xmm1
lea rcx, [rbp + 0x770]
mov byte [rbp + 0x7a8], 1
call fcn.1400c4940
mov rdx, rax
lea rcx, [rbp + 0x1e80]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400b5480
movdqa xmm0, xmmword [0x1403662b0]
lea rcx, [rbp + 0x2d0]
movdqa xmm1, xmmword [0x140366530]
movdqu xmmword [rbp + 0x2d0], xmm0
mov dword [rbp + 0x300], 0x75181717
movdqa xmm0, xmmword [0x1403665a0]
movdqu xmmword [rbp + 0x2f0], xmm0
mov dword [rbp + 0x304], 0x318771a
movdqu xmmword [rbp + 0x2e0], xmm1
mov dword [rbp + 0x308], 0x594147
mov byte [rbp + 0x30c], 1
call fcn.1400c4c10
mov rdx, rax
lea rcx, [rbp + 0x1ea0]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400b5480
movdqa xmm0, xmmword [0x1403662b0]
lea rcx, [rbp + 0x4e0]
movdqa xmm1, xmmword [0x140366530]
movdqu xmmword [rbp + 0x4e0], xmm0
mov dword [rbp + 0x510], 0x75181717
movdqa xmm0, xmmword [0x1403665a0]
movdqu xmmword [rbp + 0x500], xmm0
mov dword [rbp + 0x514], 0x1b1f771a
movdqu xmmword [rbp + 0x4f0], xmm1
mov word [rbp + 0x518], reloc.WS2_32.dll_shutdown
mov byte [rbp + 0x51a], 1
call fcn.1400c4bb0
mov rdx, rax
lea rcx, [rbp + 0x1ec0]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400b5480
movdqa xmm0, xmmword [0x1403662b0]
lea rcx, [rbp + 0x190]
movdqa xmm1, xmmword [0x140366530]
movdqu xmmword [rbp + 0x190], xmm0
mov dword [rbp + 0x1c0], 0x75181717
movdqa xmm0, xmmword [0x1403665a0]
movdqu xmmword [rbp + 0x1b0], xmm0
mov dword [rbp + 0x1c4], 0x1b1f771a
movdqu xmmword [rbp + 0x1a0], xmm1
mov dword [rbp + 0x1c8], 0x5f590116
mov word [rbp + 0x1cc], 0x5b
mov byte [rbp + 0x1ce], 1
call fcn.1400c48b0
mov rdx, rax
lea rcx, [rbp + 0x1ee0]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400b5480
movdqa xmm0, xmmword [0x1403662b0]
lea rcx, [rbp + 0x6b0]
movdqa xmm1, xmmword [0x140366530]
movdqu xmmword [rbp + 0x6b0], xmm0
mov dword [rbp + 0x6e0], 0x75181717
movdqa xmm0, xmmword [0x1403665a0]
movdqu xmmword [rbp + 0x6d0], xmm0
mov dword [rbp + 0x6e4], 0x4e1a771a
movdqu xmmword [rbp + 0x6c0], xmm1
mov word [rbp + 0x6e8], 0x100
call fcn.1400c4c70
mov rdx, rax
lea rcx, [rbp + 0x1f00]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400b5480
movdqa xmm0, xmmword [0x1403662b0]
movdqa xmm1, xmmword [0x140366530]
movdqu xmmword [rbp + 0x250], xmm0
movdqa xmm0, xmmword [0x1403665a0]
movdqu xmmword [rbp + 0x260], xmm1
lea rcx, [rbp + 0x250]
mov dword [rbp + 0x280], 0x75181717
movdqu xmmword [rbp + 0x270], xmm0
mov dword [rbp + 0x284], 0x4e1a771a
mov dword [rbp + 0x288], 0x585e4600
mov word [rbp + 0x28c], 0x100
call fcn.1400c4e50
mov rdx, rax
lea rcx, [rbp + 0x1f20]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400b5480
lea rdx, str.98_stuck_fixed
lea rcx, [0x1403d53a0]
call fcn.1400c7550
call fcn.1400a7b50
call fcn.14006ba90
movss xmm2, dword [0x140365f00]
lea rcx, [rbp + 0x1190]
movaps xmm1, xmm9
call fcn.140062310
mov rdx, rax
lea rcx, str.Memory
xor r9d, r9d
mov r8b, 1
call fcn.14006ba00
lea rcx, str.Memory_Risky_
call fcn.14009ab50
call fcn.14009dc50
lea rdx, [0x1403a516a]
lea rcx, str.Night_Mode
call fcn.14009cfd0
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1400729a0
movss xmm1, dword [0x140365ecc]
lea rcx, [rbp + 0x1198]
xorps xmm2, xmm2
call fcn.140062310
mov rcx, rax
call fcn.14009d6c0
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1400729a0
lea rdx, [0x1403a510e]
lea rcx, str.90FPSUltraHD
call fcn.14009cfd0
lea rdx, [0x1403a5169]
lea rcx, str.NoHeadShot
call fcn.14009cfd0
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1400729a0
movss xmm1, dword [0x140365ec4]
lea rcx, [rbp + 0x11a0]
xorps xmm2, xmm2
call fcn.140062310
mov rcx, rax
call fcn.14009d6c0
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1400729a0
lea rdx, [0x1403a5168]
lea rcx, str.Instant_HIT
call fcn.14009cfd0
lea rdx, [0x1403a40af]
lea rcx, str.Less_Recoil
call fcn.14009cfd0
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1400729a0
movss xmm1, dword [0x140365ed4]
lea rcx, [rbp + 0x11a8]
xorps xmm2, xmm2
call fcn.140062310
mov rcx, rax
call fcn.14009d6c0
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1400729a0
lea rdx, [0x1403a510d]
lea rcx, str.Small_Cross
call fcn.14009cfd0
lea rdx, [0x1403a510f]
lea rcx, str.NO_Grass
call fcn.14009cfd0
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1400729a0
movss xmm1, dword [0x140365edc]
lea rcx, [rbp + 0x1130]
xorps xmm2, xmm2
call fcn.140062310
mov rcx, rax
call fcn.14009d6c0
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1400729a0
lea rdx, [0x1403a510c]
lea rcx, str.NO_Trees
call fcn.14009cfd0
call fcn.14006ba90
call fcn.1400a62d0
call fcn.140071770
jmp 0x1400c43cf
movaps xmm1, xmmword [0x140366250]
lea rax, [rbp + 0x1140]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x18]
lea rax, [rbp + 0x1158]
mov dword [rbp - 0x18], 0x3f800000
xorps xmm0, xmm0
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x10]
mov dword [rbp - 0x14], 0x3f800000
lea rdx, [rbp - 8]
mov qword [rbp - 0x10], r13
mov rcx, r12
mov dword [rbp - 8], 0x438c0000
movups xmmword [rbp + 0x1140], xmm0
mov dword [rbp - 4], 0x438c0000
movups xmmword [rbp + 0x1158], xmm1
call fcn.14009cbc0
call fcn.14009d670
call fcn.14009d670
call fcn.14009d670
call fcn.14009d670
mov qword [rsp + 0x38], r13
lea rax, [rbp]
mov qword [rsp + 0x30], r13
lea r8, [0x1403993e0]
mov dword [rsp + 0x28], r13d
lea rdx, [0x1403640e0]
mov r9d, 0xff
mov qword [rsp + 0x20], rax
lea rcx, [0x1403640e8]
mov qword [rbp], r13
call fcn.1400a1ad0
call fcn.14009d670
xor r8d, r8d
mov dword [rbp - 0x20], 0x43480000
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x41f00000
lea rcx, str.Login
call fcn.14009b610
test al, al
je 0x1400c4307
lea rdx, [0x1403993e0]
lea rcx, [rbp + 0x1f40]
call fcn.1400c75d0
mov rdx, rax
lea rcx, [0x1403d5400]
call fcn.1400b1e80
test al, al
je 0x1400c42e1
mov dword [0x1403d5578], 1
lea rdx, [rbp + 0x2450]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
call fcn.1402a0438
lea rdx, [rbp + 0x2450]
mov ecx, 2
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1400729a0
lea rdx, [0x1403a516b]
lea rcx, str.Save_Key
call fcn.14009cfd0
cmp byte [0x1403a516b], r13b
lea r14, str.key.txt
lea rdx, [0x1403993e0]
je 0x1400c434f
mov dil, 1
lea rsi, [rbp + 0x1f60]
lea rcx, [rbp + 0x1f80]
jmp 0x1400c4360
xor dil, dil
lea rsi, [rbp + 0x1fa0]
lea rcx, [rbp + 0x1fc0]
call fcn.1400c75d0
mov rdx, r14
mov rcx, rsi
mov rbx, rax
call fcn.1400c75d0
mov rcx, rax
movzx r8d, dil
mov rdx, rbx
call fcn.1400be6d0
movaps xmm2, xmm14
lea rcx, [rbp + 0x1138]
movaps xmm1, xmm9
call fcn.140062310
mov rdx, rax
lea rcx, [0x14036410c]
xor r9d, r9d
mov r8b, 1
call fcn.14006ba00
lea rcx, str.Version_:_1.0.0
call fcn.14009ab50
lea rcx, str.ByPass_By_LuciferDarklord8724
call fcn.14009ab50
call fcn.14006ba90
lea rdi, str._.3f
call fcn.14006a840
mov rcx, qword [0x1403a40a0]
mov r9d, 3
mov dword [rsp + 0x30], r13d
xor r8d, r8d
movss dword [rsp + 0x28], xmm13
xor edx, edx
mov dword [rsp + 0x20], r13d
mov rax, qword [rcx]
call qword [rax + 0x158]
mov rcx, qword [0x1403a40a0]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x1400c4436
call fcn.14006ad10
call fcn.140066b80
mov rcx, rax
call fcn.1400962f0
mov rcx, qword [0x1403a40a0]
mov rax, qword [rcx]
call qword [rax + 0x150]
test dword [r15 + 8], 0x400
je 0x1400c444e
call fcn.14007aa60
xor edx, edx
xor ecx, ecx
call fcn.14007ae90
mov rcx, qword [0x1403a40a0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r13
xor edx, edx
mov rax, qword [rcx]
mov r10, qword [rax + 0x88]
call r10
cmp eax, 0x88760868
jne 0x1400c448f
mov rcx, qword [0x1403a40a0]
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
cmp eax, 0x88760869
jne 0x1400c448f
call fcn.1400aaf00
cmp byte [reloc.WS2_32.dll_accept], r13b
je 0x1400c44a7
cmp dword [rbp + 0x2708], 0x12
jne 0x1400c0c11
jmp 0x1400c44b1
mov dword [rbp + 0x2708], reloc.WS2_32.dll_select
call fcn.140096990
call fcn.140097460
xor ecx, ecx
call fcn.140066b20
call fcn.1400aaeb0
mov rcx, qword [0x1403a4048]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0x2418]
mov rcx, qword [rbp + 0x2440]
call qword [sym.imp.USER32.dll_UnregisterClassA]
lea rcx, [rbp + 0x2690]
call fcn.14005ba60
mov r14, qword [rsp + 0x2f58]
xor eax, eax
mov rsi, qword [rsp + 0x2f80]
movaps xmm12, xmmword [rsp + 0x2ee0]
movaps xmm11, xmmword [rsp + 0x2ef0]
movaps xmm10, xmmword [rsp + 0x2f00]
movaps xmm9, xmmword [rsp + 0x2f10]
movaps xmm8, xmmword [rsp + 0x2f20]
movaps xmm7, xmmword [rsp + 0x2f30]
movaps xmm6, xmmword [rsp + 0x2f40]
mov r15, qword [rsp + 0x2f50]
movaps xmm13, xmmword [rsp + 0x2ed0]
mov r12, qword [rsp + 0x2f90]
mov rdi, qword [rsp + 0x2f88]
movaps xmm14, xmmword [rsp + 0x2ec0]
movaps xmm15, xmmword [rsp + 0x2eb0]
mov rcx, qword [rbp + 0x2da0]
xor rcx, rsp
call fcn.140274850
add rsp, 0x2f60
pop r13
pop rbx
pop rbp
ret
call fcn.14028b754
int3
lea rdx, str.TaskKill__f__im_AndroidEmulatorEx.exe
lea rcx, [rbp + 0x1fe0]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400b5480
lea rdx, str.TaskKill__f__im_ProjectTitan.exe
lea rcx, [rbp + 0x2000]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400b5480
lea rdx, str.sc_stop_xander__sc_delete_xander
lea rcx, [rbp + 0x2020]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400b5480
movdqa xmm0, xmmword [0x140366420]
lea rcx, [rbp + 0x350]
movdqa xmm1, xmmword [0x140366370]
movdqu xmmword [rbp + 0x350], xmm0
mov dword [rbp + 0x370], 0x7b362677
movdqu xmmword [rbp + 0x360], xmm1
mov dword [rbp + 0x374], 0x1007573
call fcn.1400c4880
mov rdx, rax
lea rcx, [rbp + 0x2040]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400b5480
movdqa xmm0, xmmword [0x140366420]
lea rcx, [rbp + 0x378]
movdqa xmm1, xmmword [0x140366370]
movdqu xmmword [rbp + 0x378], xmm0
mov dword [rbp + 0x398], 0x7b362577
movdqu xmmword [rbp + 0x388], xmm1
mov dword [rbp + 0x39c], 0x1007573
call fcn.1400c4880
mov rdx, rax
lea rcx, [rbp + 0x2060]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400b5480
movdqa xmm0, xmmword [0x140366420]
lea rcx, [rbp + 0x3a0]
movdqa xmm1, xmmword [0x140366370]
movdqu xmmword [rbp + 0x3a0], xmm0
mov dword [rbp + 0x3c0], 0x7b362477
movdqu xmmword [rbp + 0x3b0], xmm1
mov dword [rbp + 0x3c4], 0x1007573
call fcn.1400c4880
mov rdx, rax
lea rcx, [rbp + 0x2080]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400b5480
movdqa xmm0, xmmword [0x140366550]
lea rcx, [rbp + 0x150]
movdqa xmm1, xmmword [0x140366590]
movdqu xmmword [rbp + 0x150], xmm0
mov dword [rbp + 0x180], 0x404a4e4a
movdqa xmm0, xmmword [0x1403660e0]
movdqu xmmword [rbp + 0x170], xmm0
mov dword [rbp + 0x184], 0x4c44584d
movdqu xmmword [rbp + 0x160], xmm1
mov dword [rbp + 0x188], 0x421e4a5c
mov word [rbp + 0x18c], 0x5d
mov byte [rbp + 0x18e], 1
call fcn.1400c48b0
mov rdx, rax
lea rcx, [rbp + 0x20a0]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400b5480
movdqa xmm0, xmmword [0x140366550]
movdqa xmm1, xmmword [0x140366590]
movdqa xmmword [rbp + 0x50], xmm0
movdqa xmm0, xmmword [0x1403660e0]
movdqa xmmword [rbp + 0x70], xmm0
movdqa xmmword [rbp + 0x60], xmm1
mov dword [rbp + 0x80], 0x4d4a4e4a
mov dword [rbp + 0x84], 0x4147594b
mov dword [rbp + 0x88], 0x1f545d41
lea rcx, [rbp + 0x50]
mov dword [rbp + 0x8c], 0x1005c41
call fcn.1400c48e0
mov rdx, rax
lea rcx, [rbp + 0x20c0]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400b5480
movdqa xmm0, xmmword [0x140366550]
lea rcx, [rbp + 0x3c8]
movdqa xmm1, xmmword [0x140366590]
movdqu xmmword [rbp + 0x3c8], xmm0
mov dword [rbp + 0x3f8], 0x184a4e4a
movdqa xmm0, xmmword [0x1403660e0]
movdqu xmmword [rbp + 0x3e8], xmm0
mov dword [rbp + 0x3fc], 0x3181213
movdqu xmmword [rbp + 0x3d8], xmm1
mov dword [rbp + 0x400], 0x100405d
call fcn.1400c4910
mov rdx, rax
lea rcx, [rbp + 0x20e0]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400b5480
lea rdx, str.del_C:hookdrv.sys
lea rcx, [rbp + 0x2100]
call fcn.1400c75d0
mov rcx, rax
call fcn.1400b5480
xor ecx, ecx
call fcn.140294108
int3