Function at 0x1400fded0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x838]
sub rsp, 0x8f8
vmovaps xmmword [rax - 0x58], xmm6
vmovaps xmmword [rax - 0x68], xmm7
vmovaps xmmword [rax - 0x78], xmm8
vmovaps xmmword [rax - 0x88], xmm9
vmovaps xmmword [rax - 0x98], xmm10
vmovaps xmmword [rax - 0xa8], xmm11
vmovaps xmmword [rax - 0xb8], xmm12
vmovaps xmmword [rax - 0xc8], xmm13
vmovaps xmmword [rax - 0xd8], xmm14
vmovaps xmmword [rax - 0xe8], xmm15
vmovsd xmm0, qword [str.cjT_YO_]
vmovsd qword [rsp + 0x40], xmm0
movzx eax, byte [0x1401eb910]
mov byte [rsp + 0x40], 0x55
xor byte [rsp + 0x41], 0x37
xor byte [rsp + 0x42], 0x38
xor byte [rsp + 0x43], 0x39
xor byte [rsp + 0x44], 0x3a
xor byte [rsp + 0x45], 0x3b
xor byte [rsp + 0x46], 0x3c
xor byte [rsp + 0x47], 0x3d
xor al, 0x3e
mov byte [rsp + 0x48], al
lea rcx, [rsp + 0x40]
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBeginUltra]
mov cl, 1
call qword [sym.imp.VMProtectSDK64.dll_VMProtectIsDebuggerPresent]
mov cl, 1
call qword [sym.imp.VMProtectSDK64.dll_VMProtectIsDebuggerPresent]
mov cl, 1
call qword [sym.imp.VMProtectSDK64.dll_VMProtectIsDebuggerPresent]
call qword [sym.imp.VMProtectSDK64.dll_VMProtectIsProtected]
call qword [sym.imp.VMProtectSDK64.dll_VMProtectIsVirtualMachinePresent]
lea rcx, [rsp + 0x78]
call fcn.1401098f0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x1400fdfec
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fdfe7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400fe0f7
call fcn.1401cb090
lea rcx, [rsp + 0x78]
call fcn.140109ad0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x1400fe032
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fe02d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400fe0f7
call fcn.1401cb090
lea rcx, [rsp + 0x78]
call fcn.140101ad0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x1400fe078
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fe073
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400fe0f7
call fcn.1401cb090
lea rcx, [rsp + 0x78]
call fcn.140101cb0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x1400fe0ba
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fe0b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400fe0f7
call fcn.1401cb090
lea rcx, [rsp + 0x78]
call fcn.140109cb0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x1400fe103
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fe0fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400fe0fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401cb090
xor esi, esi
lea r14d, [rsi + 1]
lea r15, str.username
lea r12, str.password
lea r13, [0x1402c2c20]
lea rdi, [0x1402c2d20]
vmovss xmm10, dword [0x1401e2054]
vxorps xmm9, xmm9, xmm9
vmovss xmm7, dword [0x1401e2020]
vmovss xmm11, dword [0x1401e2024]
vmovss xmm12, dword [0x1401e215c]
vmovss xmm13, dword [0x1401ec9fc]
vmovss xmm8, dword [0x1401e2018]
vmovss xmm14, dword [0x1401e202c]
vmovss xmm15, dword [0x1401eca00]
nop word [rax + rax]
xor bl, bl
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x248]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x1400fe1de
lea rcx, [rbp + 0x248]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x248]
call qword [sym.imp.USER32.dll_DispatchMessageA]
movzx ebx, bl
cmp dword [rbp + 0x250], 0x12
cmove ebx, r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x248]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x1400fe190
test bl, bl
jne 0x140100b59
call fcn.1400d81c0
call fcn.1400d9800
call fcn.1400bb780
mov eax, dword [reloc.WS2_32.dll_accept]
cmp eax, 1
jne 0x1400ffdf0
vmovss xmm6, dword [0x1401eca1c]
vmovss dword [rbp + 0x130], xmm6
vmovss xmm0, dword [0x1401e2040]
vmovss dword [rbp + 0x134], xmm0
lea rdx, [rbp + 0x130]
lea ecx, [rax + 3]
call fcn.1400bd360
xor edx, edx
lea r8d, [rdx + 3]
lea rcx, [0x1401eb7a8]
call fcn.1400a55b0
vmovss dword [rbp + 0x138], xmm6
vmovss xmm0, dword [0x1401ec9f4]
vmovss dword [rbp + 0x13c], xmm0
xor r9d, r9d
mov r8b, 1
lea rdx, [rbp + 0x138]
lea rcx, str.TopLine
call fcn.1400a81c0
lea rcx, [rbp + 0x1b8]
call fcn.1400b5040
vmovss xmm6, dword [rax]
vmovss dword [rsp + 0x20], xmm10
xor r9d, r9d
xor r8d, r8d
lea rdx, str.NEMESIS.CC
lea rcx, [rbp + 0x1c8]
call fcn.1400a98d0
vsubss xmm0, xmm6, dword [rax]
vmulss xmm6, xmm0, dword [0x1401e1fac]
call fcn.1400b50b0
vaddss xmm7, xmm0, xmm6
lea rcx, [rbp + 0x1e0]
call fcn.1400b5040
vmovss xmm6, dword [rax + 4]
call fcn.1400b5ac0
vsubss xmm1, xmm6, xmm0
vmulss xmm6, xmm1, dword [0x1401e1fac]
call fcn.1400b50e0
vaddss xmm6, xmm0, xmm6
vmovss dword [rbp + 0x140], xmm7
vmovss dword [rbp + 0x144], xmm6
lea rcx, [rbp + 0x140]
call fcn.1400c0f30
lea rcx, str.NEMESIS.
call fcn.1400e5210
vmovups xmm0, xmmword [0x1401e5ca0]
vmovups xmmword [rsp + 0x58], xmm0
lea rdx, [rsp + 0x58]
xor ecx, ecx
call fcn.1400bd300
vmovaps xmm1, xmm10
vmovaps xmm0, xmm9
call fcn.1400c0760
lea rcx, [0x1401eb994]
call fcn.1400e5210
vmovss xmm0, dword [0x1401eca18]
vmovss dword [rbp + 0x148], xmm0
vmovss dword [rbp + 0x14c], xmm6
lea rcx, [rbp + 0x148]
call fcn.1400c0f30
lea rcx, [0x1401e1f68]
call fcn.1400e5210
xor ecx, ecx
call fcn.1400b6e30
test al, al
jne 0x140100c6c
mov ecx, r14d
call fcn.1400bccd0
call fcn.1400b2da0
call fcn.1400b50e0
vmovss xmm7, dword [0x1401e2020]
vaddss xmm6, xmm0, xmm7
call fcn.1400b50b0
vaddss xmm1, xmm0, xmm7
vmovss dword [rbp + 0x150], xmm1
vmovss dword [rbp + 0x154], xmm6
lea rcx, [rbp + 0x150]
call fcn.1400c0f30
lea rcx, [rbp + 0x1e8]
call fcn.1400b5040
vmovss xmm0, dword [rax + 4]
vsubss xmm6, xmm0, xmm11
lea rcx, [rbp + 0x240]
call fcn.1400b5040
vmovss xmm0, dword [rax]
vsubss xmm1, xmm0, xmm11
vmovss dword [rbp - 0x48], xmm1
vmovss dword [rbp - 0x44], xmm6
xor r9d, r9d
mov r8b, 1
lea rdx, [rbp - 0x48]
lea rcx, str.centerlogin
call fcn.1400a81c0
mov eax, dword [reloc.WS2_32.dll_accept]
cmp eax, 1
jne 0x1400ff0c3
vmovaps xmm0, xmm12
call fcn.1400c11f0
vmovss dword [rbp - 0x40], xmm13
vmovss xmm0, dword [0x1401e2158]
vmovss dword [rbp - 0x3c], xmm0
lea rcx, [rbp - 0x40]
call fcn.1400c0f30
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8d, 0xff
mov rdx, r15
lea rcx, str.Username
call fcn.1400de3e0
vmovaps xmm0, xmm12
call fcn.1400c11f0
call fcn.1400b50e0
vaddss xmm1, xmm0, xmm8
vmovss dword [rbp - 0x38], xmm13
vmovss dword [rbp - 0x34], xmm1
lea rcx, [rbp - 0x38]
call fcn.1400c0f30
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8d, 0xff
mov rdx, r12
lea rcx, str.Password
call fcn.1400de3e0
call fcn.1400b50e0
vaddss xmm0, xmm0, xmm8
call fcn.1400c1000
vmovaps xmm0, xmm13
call fcn.1400c0fb0
vmovss dword [rbp - 0x30], xmm12
vmovss dword [rbp - 0x2c], xmm14
lea rdx, [rbp - 0x30]
lea rcx, str.LOGIN
call fcn.1400dd070
test al, al
je 0x1400ff03c
mov cl, 1
call qword [sym.imp.VMProtectSDK64.dll_VMProtectIsDebuggerPresent]
mov eax, dword [0x1401eb914]
mov dword [rbp + 0x858], eax
movzx eax, word [0x1401eb918]
mov word [rbp + 0x85c], ax
mov byte [rbp + 0x858], Ordinal_79
xor byte [rbp + 0x859], 0x37
xor byte [rbp + 0x85a], 0x38
xor byte [rbp + 0x85b], 0x39
xor al, 0x3a
mov byte [rbp + 0x85c], al
xor byte [rbp + 0x85d], 0x3b
lea rcx, [rbp + 0x858]
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBeginUltra]
call qword [sym.imp.VMProtectSDK64.dll_VMProtectIsProtected]
call qword [sym.imp.VMProtectSDK64.dll_VMProtectIsVirtualMachinePresent]
call fcn.140084e40
lea rax, [rsp + 0x58]
mov qword [rbp + 0x178], rax
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rsi
mov r8, 0xffffffffffffffff
inc r8
cmp byte [r12 + r8], 0
jne 0x1400fe573
mov rdx, r12
lea rcx, [rsp + 0x58]
call fcn.14009dee0
nop
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], rsi
mov r8, 0xffffffffffffffff
inc r8
cmp byte [r15 + r8], 0
jne 0x1400fe5a3
mov rdx, r15
lea rcx, [rbp - 0x68]
call fcn.14009dee0
nop
lea r8, [rsp + 0x58]
lea rdx, [rbp - 0x68]
lea rcx, [0x140318b10]
call fcn.140172360
call fcn.140084e40
cmp byte [0x140318d20], 0
je 0x140100bbf
mov eax, dword [str.ZX_PT_]
mov dword [rbp + 0x850], eax
movzx eax, word [0x1401eb93c]
mov word [rbp + 0x854], ax
mov byte [rbp + 0x850], WSAGetLastError
xor byte [rbp + 0x851], 0x37
xor byte [rbp + 0x852], 0x38
xor byte [rbp + 0x853], 0x39
xor al, 0x3a
mov byte [rbp + 0x854], al
xor byte [rbp + 0x855], 0x3b
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], rsi
lea rax, [rbp + 0x850]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1400fe645
lea rdx, [rbp + 0x850]
lea rcx, [rbp - 0x68]
call fcn.14009dee0
lea r8, [rbp - 0x68]
lea rdx, [rsp + 0x78]
lea rcx, [0x140318b10]
call fcn.140177ad0
nop
cmp qword [rbp - 0x78], 2
jbe 0x1400fefe4
mov r8d, dword [0x1403178f0]
xor edx, edx
lea ecx, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
test rax, rax
je 0x1400fe8ef
mov dword [rbp + 0x2b0], 0x100001
lea rdx, [rbp + 0x280]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rcx, rbx
test eax, eax
je 0x1400fe6ca
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400fe8ef
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400fe766
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400fe766
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400fe761
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400fe740
cmp r8d, 0xcded1a85
je 0x1400fe76b
test r9d, r9d
jne 0x1400fe720
mov rax, qword [rax]
jmp 0x1400fe6f0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400fe816
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400fe816
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400fe811
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400fe7f0
cmp r8d, 0xe80fd3a
je 0x1400fe81b
test r9d, r9d
jne 0x1400fe7d0
mov rax, qword [rax]
jmp 0x1400fe7a0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400fe8c6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400fe8c6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400fe8c1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400fe8a0
cmp r8d, 0xa52bcaf9
je 0x1400fe8cb
test r9d, r9d
jne 0x1400fe880
mov rax, qword [rax]
jmp 0x1400fe850
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov ecx, dword [rcx + rax*4]
add rcx, r10
call rcx
mov dword [0], 0xdead
mov byte [0x1403178e2], 0
call fcn.1401034d0
call fcn.1401043d0
call fcn.140103c50
call fcn.140103ea0
call fcn.140104270
call fcn.140103980
call fcn.140103730
call fcn.1401043b0
cmp byte [0x1403178e2], 0
je 0x1400feb3f
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400fe9b6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400fe9b6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400fe9b1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400fe990
cmp r8d, 0xcded1a85
je 0x1400fe9bb
test r9d, r9d
jne 0x1400fe970
mov rax, qword [rax]
jmp 0x1400fe940
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400fea66
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400fea66
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400fea61
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400fea40
cmp r8d, 0xe80fd3a
je 0x1400fea6b
test r9d, r9d
jne 0x1400fea20
mov rax, qword [rax]
jmp 0x1400fe9f0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400feb16
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400feb16
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400feb11
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400feaf0
cmp r8d, 0xa52bcaf9
je 0x1400feb1b
test r9d, r9d
jne 0x1400fead0
mov rax, qword [rax]
jmp 0x1400feaa0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov ecx, dword [rcx + rax*4]
add rcx, r10
call rcx
mov dword [0], 0xdead
cmp byte [0x140317908], 0
je 0x1400fed5f
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400febd6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400febd6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400febd1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400febb0
cmp r8d, 0xcded1a85
je 0x1400febdb
test r9d, r9d
jne 0x1400feb90
mov rax, qword [rax]
jmp 0x1400feb60
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400fec86
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400fec86
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400fec81
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400fec60
cmp r8d, 0xe80fd3a
je 0x1400fec8b
test r9d, r9d
jne 0x1400fec40
mov rax, qword [rax]
jmp 0x1400fec10
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400fed36
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400fed36
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400fed31
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400fed10
cmp r8d, 0xa52bcaf9
je 0x1400fed3b
test r9d, r9d
jne 0x1400fecf0
mov rax, qword [rax]
jmp 0x1400fecc0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov ecx, dword [rcx + rax*4]
add rcx, r10
call rcx
mov dword [0], 0xdead
mov eax, dword [0x1401eb940]
mov dword [rbp + 0x840], eax
movzx eax, word [0x1401eb944]
mov word [rbp + 0x844], ax
mov byte [rbp + 0x840], reloc.WLDAP32.dll_Ordinal_46
xor byte [rbp + 0x841], 0x37
xor byte [rbp + 0x842], 0x38
xor byte [rbp + 0x843], 0x39
xor byte [rbp + 0x844], 0x3a
xor byte [rbp + 0x845], 0x3b
xor edx, edx
lea rcx, [rbp + 0x840]
call fcn.1400f0b20
test al, al
je 0x1400fefcf
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400fee46
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400fee46
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400fee41
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400fee20
cmp r8d, 0xcded1a85
je 0x1400fee4b
test r9d, r9d
jne 0x1400fee00
mov rax, qword [rax]
jmp 0x1400fedd0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400feef6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400feef6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400feef1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400feed0
cmp r8d, 0xe80fd3a
je 0x1400feefb
test r9d, r9d
jne 0x1400feeb0
mov rax, qword [rax]
jmp 0x1400fee80
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400fefa6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400fefa6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400fefa1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400fef80
cmp r8d, 0xa52bcaf9
je 0x1400fefab
test r9d, r9d
jne 0x1400fef60
mov rax, qword [rax]
jmp 0x1400fef30
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov ecx, dword [rcx + rax*4]
add rcx, r10
call rcx
mov dword [0], 0xdead
mov edx, Ordinal_301
lea ecx, [rdx - 0x32]
call qword [sym.imp.KERNEL32.dll_Beep]
mov dword [reloc.WS2_32.dll_accept], r14d
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x1400ff020
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ff01b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140100bb8
call fcn.1401cb090
lea rcx, [0x140318b10]
call fcn.14016d0d0
call qword [sym.imp.VMProtectSDK64.dll_VMProtectEnd]
mov dword [reloc.WS2_32.dll_accept], 2
vmovss xmm0, dword [0x1401eca14]
vmovss dword [rbp - 0x28], xmm0
vmovss xmm0, dword [0x1401eca08]
vmovss dword [rbp - 0x24], xmm0
lea rcx, [rbp - 0x28]
call fcn.1400c0f30
lea rcx, str.Register
call fcn.1400e5210
vmovups xmm0, xmmword [0x1401e5ca0]
vmovups xmmword [rsp + 0x58], xmm0
lea rdx, [rsp + 0x58]
xor ecx, ecx
call fcn.1400bd300
vmovaps xmm1, xmm10
vmovaps xmm0, xmm9
call fcn.1400c0760
lea rcx, str.Here
call fcn.1400e5210
xor ecx, ecx
call fcn.1400b6e30
test al, al
je 0x1400ff0b5
mov dword [reloc.WS2_32.dll_accept], 2
mov ecx, r14d
call fcn.1400bccd0
mov eax, dword [reloc.WS2_32.dll_accept]
cmp eax, 2
jne 0x1400ffdd1
vmovaps xmm0, xmm12
call fcn.1400c11f0
vmovss dword [rbp - 0x20], xmm13
vmovss xmm0, dword [0x1401ec9f8]
vmovss dword [rbp - 0x1c], xmm0
lea rcx, [rbp - 0x20]
call fcn.1400c0f30
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8d, 0xff
mov rdx, r15
lea rcx, str.Username
call fcn.1400de3e0
vmovaps xmm0, xmm12
call fcn.1400c11f0
call fcn.1400b50e0
vaddss xmm1, xmm0, xmm8
vmovss dword [rbp - 0x18], xmm13
vmovss dword [rbp - 0x14], xmm1
lea rcx, [rbp - 0x18]
call fcn.1400c0f30
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8d, 0xff
mov rdx, r12
lea rcx, str.Password
call fcn.1400de3e0
vmovaps xmm0, xmm12
call fcn.1400c11f0
call fcn.1400b50e0
vaddss xmm1, xmm0, xmm8
vmovss dword [rbp - 0x10], xmm13
vmovss dword [rbp - 0xc], xmm1
lea rcx, [rbp - 0x10]
call fcn.1400c0f30
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8d, 0xff
mov rdx, r13
lea rcx, str.Key
call fcn.1400de3e0
call fcn.1400b50e0
vaddss xmm0, xmm0, xmm8
call fcn.1400c1000
vmovaps xmm0, xmm13
call fcn.1400c0fb0
vmovss dword [rbp - 8], xmm12
vmovss dword [rbp - 4], xmm14
lea rdx, [rbp - 8]
lea rcx, str.REGISTER
call fcn.1400dd070
test al, al
je 0x1400ffdd1
mov cl, 1
call qword [sym.imp.VMProtectSDK64.dll_VMProtectIsDebuggerPresent]
vmovsd xmm0, qword [0x1401eb948]
vmovsd qword [rsp + 0x49], xmm0
movzx eax, byte [0x1401eb950]
mov byte [rsp + 0x49], 0x52
xor byte [rsp + 0x4a], 0x37
xor byte [rsp + 0x4b], 0x38
xor byte [rsp + 0x4c], 0x39
xor byte [rsp + 0x4d], 0x3a
xor byte [rsp + 0x4e], 0x3b
xor byte [rsp + 0x4f], 0x3c
xor byte [rsp + 0x50], 0x3d
xor al, 0x3e
mov byte [rsp + 0x51], al
lea rcx, [rsp + 0x49]
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBeginUltra]
call qword [sym.imp.VMProtectSDK64.dll_VMProtectIsProtected]
call qword [sym.imp.VMProtectSDK64.dll_VMProtectIsVirtualMachinePresent]
call fcn.140084e40
call fcn.140084e40
lea rax, [rbp - 0x68]
mov qword [rbp + 0x128], rax
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x68], 0
lea rax, [rbp + 0x180]
mov qword [rbp + 0x178], rax
vmovups xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], rsi
mov qword [rbp + 0x198], rsi
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [r8 + r13], 0
jne 0x1400ff2a0
mov rdx, r13
lea rcx, [rbp + 0x180]
call fcn.14009dee0
nop
lea rax, [rbp + 0x158]
mov qword [rbp + 0x1c0], rax
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x158], xmm0
mov qword [rbp + 0x168], rsi
mov qword [rbp + 0x170], rsi
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [r12 + r8], 0
jne 0x1400ff2f0
mov rdx, r12
lea rcx, [rbp + 0x158]
call fcn.14009dee0
nop
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], rsi
mov r8, 0xffffffffffffffff
inc r8
cmp byte [r15 + r8], 0
jne 0x1400ff323
mov rdx, r15
lea rcx, [rsp + 0x78]
call fcn.14009dee0
nop
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x180]
lea r8, [rbp + 0x158]
lea rdx, [rsp + 0x78]
lea rcx, [0x140318b10]
call fcn.140174300
call fcn.140084e40
cmp byte [0x140318d20], 0
je 0x140100c63
vmovsd xmm0, qword [str.DR_PIOYO_]
vmovsd qword [rsp + 0x40], xmm0
movzx eax, byte [0x1401eb960]
mov byte [rsp + 0x40], WSAStartup
xor byte [rsp + 0x41], 0x37
xor byte [rsp + 0x42], 0x38
xor byte [rsp + 0x43], 0x39
xor byte [rsp + 0x44], 0x3a
xor byte [rsp + 0x45], 0x3b
xor byte [rsp + 0x46], 0x3c
xor byte [rsp + 0x47], 0x3d
xor al, 0x3e
mov byte [rsp + 0x48], al
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], rsi
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1400ff3d6
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x78]
call fcn.14009dee0
lea r8, [rsp + 0x78]
lea rdx, [rbp + 0x158]
lea rcx, [0x140318b10]
call fcn.140177ad0
nop
cmp qword [rbp + 0x168], 2
jbe 0x1400ffd74
mov r8d, dword [0x1403178f0]
xor edx, edx
lea ecx, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
test rax, rax
je 0x1400ff67f
mov dword [rbp + 0x2b0], 0x100001
lea rdx, [rbp + 0x280]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rcx, rbx
test eax, eax
je 0x1400ff460
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400ff67f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400ff4f6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400ff4f6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400ff4f1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400ff4d0
cmp r8d, 0xcded1a85
je 0x1400ff4fb
test r9d, r9d
jne 0x1400ff4b0
mov rax, qword [rax]
jmp 0x1400ff480
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400ff5a6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400ff5a6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400ff5a1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400ff580
cmp r8d, 0xe80fd3a
je 0x1400ff5ab
test r9d, r9d
jne 0x1400ff560
mov rax, qword [rax]
jmp 0x1400ff530
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400ff656
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400ff656
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400ff651
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400ff630
cmp r8d, 0xa52bcaf9
je 0x1400ff65b
test r9d, r9d
jne 0x1400ff610
mov rax, qword [rax]
jmp 0x1400ff5e0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov ecx, dword [rcx + rax*4]
add rcx, r10
call rcx
mov dword [0], 0xdead
mov byte [0x1403178e2], 0
call fcn.1401034d0
call fcn.1401043d0
call fcn.140103c50
call fcn.140103ea0
call fcn.140104270
call fcn.140103980
call fcn.140103730
call fcn.1401043b0
cmp byte [0x1403178e2], 0
je 0x1400ff8cf
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400ff746
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400ff746
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400ff741
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400ff720
cmp r8d, 0xcded1a85
je 0x1400ff74b
test r9d, r9d
jne 0x1400ff700
mov rax, qword [rax]
jmp 0x1400ff6d0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400ff7f6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400ff7f6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400ff7f1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400ff7d0
cmp r8d, 0xe80fd3a
je 0x1400ff7fb
test r9d, r9d
jne 0x1400ff7b0
mov rax, qword [rax]
jmp 0x1400ff780
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400ff8a6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400ff8a6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400ff8a1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400ff880
cmp r8d, 0xa52bcaf9
je 0x1400ff8ab
test r9d, r9d
jne 0x1400ff860
mov rax, qword [rax]
jmp 0x1400ff830
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov ecx, dword [rcx + rax*4]
add rcx, r10
call rcx
mov dword [0], 0xdead
cmp byte [0x140317908], 0
je 0x1400ffaef
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400ff966
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400ff966
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400ff961
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400ff940
cmp r8d, 0xcded1a85
je 0x1400ff96b
test r9d, r9d
jne 0x1400ff920
mov rax, qword [rax]
jmp 0x1400ff8f0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400ffa16
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400ffa16
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400ffa11
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400ff9f0
cmp r8d, 0xe80fd3a
je 0x1400ffa1b
test r9d, r9d
jne 0x1400ff9d0
mov rax, qword [rax]
jmp 0x1400ff9a0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400ffac6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400ffac6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400ffac1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400ffaa0
cmp r8d, 0xa52bcaf9
je 0x1400ffacb
test r9d, r9d
jne 0x1400ffa80
mov rax, qword [rax]
jmp 0x1400ffa50
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov ecx, dword [rcx + rax*4]
add rcx, r10
call rcx
mov dword [0], 0xdead
mov eax, dword [0x1401eb964]
mov dword [rbp + 0x848], eax
movzx eax, word [0x1401eb968]
mov word [rbp + 0x84c], ax
mov byte [rbp + 0x848], reloc.WLDAP32.dll_Ordinal_46
xor byte [rbp + 0x849], 0x37
xor byte [rbp + 0x84a], 0x38
xor byte [rbp + 0x84b], 0x39
xor byte [rbp + 0x84c], 0x3a
xor byte [rbp + 0x84d], 0x3b
xor edx, edx
lea rcx, [rbp + 0x848]
call fcn.1400f0b20
test al, al
je 0x1400ffd5f
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400ffbd6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400ffbd6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400ffbd1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400ffbb0
cmp r8d, 0xcded1a85
je 0x1400ffbdb
test r9d, r9d
jne 0x1400ffb90
mov rax, qword [rax]
jmp 0x1400ffb60
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400ffc86
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400ffc86
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400ffc81
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400ffc60
cmp r8d, 0xe80fd3a
je 0x1400ffc8b
test r9d, r9d
jne 0x1400ffc40
mov rax, qword [rax]
jmp 0x1400ffc10
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400ffd36
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400ffd36
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400ffd31
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400ffd10
cmp r8d, 0xa52bcaf9
je 0x1400ffd3b
test r9d, r9d
jne 0x1400ffcf0
mov rax, qword [rax]
jmp 0x1400ffcc0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov ecx, dword [rcx + rax*4]
add rcx, r10
call rcx
mov dword [0], 0xdead
mov edx, Ordinal_301
lea ecx, [rdx - 0x32]
call qword [sym.imp.KERNEL32.dll_Beep]
mov dword [reloc.WS2_32.dll_accept], r14d
mov rdx, qword [rbp + 0x170]
cmp rdx, 0xf
jbe 0x1400ffdb5
inc rdx
mov rcx, qword [rbp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ffdb0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140100c5c
call fcn.1401cb090
lea rcx, [0x140318b10]
call fcn.14016d0d0
mov dword [reloc.WS2_32.dll_accept], 2
call qword [sym.imp.VMProtectSDK64.dll_VMProtectEnd]
call fcn.1400b2da0
call fcn.1400b2a30
mov ecx, r14d
call fcn.1400bcd20
mov eax, dword [reloc.WS2_32.dll_accept]
lea rdi, [0x1402c2d20]
cmp eax, 2
jne 0x140100a26
vmovss xmm6, dword [0x1401eca20]
vmovss dword [rbp], xmm6
vmovss xmm0, dword [0x1401e2160]
vmovss dword [rbp + 4], xmm0
lea rdx, [rbp]
lea ecx, [rax + 2]
call fcn.1400bd360
xor edx, edx
lea r8d, [rdx + 3]
lea rcx, str.Nemesis_Menu
call fcn.1400a55b0
mov rcx, qword [0x1403192b0]
call fcn.1400bd030
vmovss dword [rbp + 8], xmm9
vmovss dword [rbp + 0xc], xmm9
lea rcx, [rbp + 8]
call fcn.1400c0f30
vmovss dword [rbp + 0x10], xmm6
vmovss xmm0, dword [0x1401e2154]
vmovss dword [rbp + 0x14], xmm0
xor r9d, r9d
mov r8b, 1
lea rdx, [rbp + 0x10]
lea rcx, str.NavBar
call fcn.1400a81c0
call fcn.1400b50e0
vaddss xmm6, xmm0, xmm7
call fcn.1400b50b0
vaddss xmm1, xmm0, xmm8
vmovss dword [rbp + 0x18], xmm1
vmovss dword [rbp + 0x1c], xmm6
lea rcx, [rbp + 0x18]
call fcn.1400c0f30
lea rcx, str.Nemesis.
call fcn.1400e5210
vmovups xmm0, xmmword [0x1401e5ca0]
vmovups xmmword [rsp + 0x58], xmm0
lea rdx, [rsp + 0x58]
xor ecx, ecx
call fcn.1400bd300
vmovaps xmm1, xmm10
vmovaps xmm0, xmm9
call fcn.1400c0760
lea rcx, [0x1401eba2c]
call fcn.1400e5210
mov ecx, r14d
call fcn.1400bccd0
vmovaps xmm1, xmm10
vmovaps xmm0, xmm9
call fcn.1400c0760
cmp dword [reloc.WS2_32.dll_accept], 1
jne 0x1400fff18
vmovups xmm0, xmmword [0x1401ecc00]
vmovups xmmword [rbp + 0x1f0], xmm0
lea rdx, [rbp + 0x1f0]
jmp 0x1400fff2f
vmovups xmm0, xmmword [0x1401ecc10]
vmovups xmmword [rbp + 0x200], xmm0
lea rdx, [rbp + 0x200]
xor ecx, ecx
call fcn.1400bd300
call fcn.1400b50e0
vmovaps xmm6, xmm0
call fcn.1400b50b0
vaddss xmm1, xmm0, dword [0x1401eca0c]
vmovss dword [rbp + 0x20], xmm1
vmovss dword [rbp + 0x24], xmm6
lea rcx, [rbp + 0x20]
call fcn.1400c0f30
lea rcx, str.Spoofer
call fcn.1400e5210
xor ecx, ecx
call fcn.1400b6e30
test al, al
je 0x1400fff7d
mov dword [reloc.WS2_32.dll_accept], r14d
mov ecx, r14d
call fcn.1400bccd0
vmovaps xmm1, xmm10
vmovaps xmm0, xmm9
call fcn.1400c0760
cmp dword [reloc.WS2_32.dll_accept], 2
jne 0x1400fffb6
vmovups xmm0, xmmword [0x1401ecc00]
vmovups xmmword [rbp + 0x210], xmm0
lea rdx, [rbp + 0x210]
jmp 0x1400fffcd
vmovups xmm0, xmmword [0x1401ecc10]
vmovups xmmword [rbp + 0x220], xmm0
lea rdx, [rbp + 0x220]
xor ecx, ecx
call fcn.1400bd300
call fcn.1400b50e0
vmovaps xmm6, xmm0
call fcn.1400b50b0
vaddss xmm1, xmm0, xmm11
vmovss dword [rbp + 0x28], xmm1
vmovss dword [rbp + 0x2c], xmm6
lea rcx, [rbp + 0x28]
call fcn.1400c0f30
lea rcx, str.Extras
call fcn.1400e5210
xor ecx, ecx
call fcn.1400b6e30
test al, al
je 0x14010001b
mov dword [reloc.WS2_32.dll_accept], 2
mov ecx, r14d
call fcn.1400bccd0
vmovaps xmm1, xmm10
vmovaps xmm0, xmm9
call fcn.1400c0760
cmp dword [reloc.WS2_32.dll_accept], 3
jne 0x140100054
vmovups xmm0, xmmword [0x1401ecc00]
vmovups xmmword [rbp + 0x230], xmm0
lea rdx, [rbp + 0x230]
jmp 0x14010006b
vmovups xmm0, xmmword [0x1401ecc10]
vmovups xmmword [rbp + 0x1a0], xmm0
lea rdx, [rbp + 0x1a0]
xor ecx, ecx
call fcn.1400bd300
call fcn.1400b50e0
vmovaps xmm6, xmm0
call fcn.1400b50b0
vaddss xmm1, xmm0, xmm11
vmovss dword [rbp + 0x30], xmm1
vmovss dword [rbp + 0x34], xmm6
lea rcx, [rbp + 0x30]
call fcn.1400c0f30
lea rcx, str.Exit
call fcn.1400e5210
xor ecx, ecx
call fcn.1400b6e30
test al, al
jne 0x140100c6c
mov ecx, r14d
call fcn.1400bccd0
call fcn.1400b2da0
call fcn.1400b50e0
vaddss xmm0, xmm0, xmm8
call fcn.1400c1000
call fcn.1400b50b0
vaddss xmm0, xmm0, xmm8
call fcn.1400c0fb0
lea rcx, [rbp + 0x1d0]
call fcn.1400b5040
vmovss xmm0, dword [rax + 4]
vsubss xmm1, xmm0, dword [0x1401e214c]
vmovss xmm2, dword [0x1401eca04]
vmovss dword [rbp + 0x38], xmm2
vmovss dword [rbp + 0x3c], xmm1
xor r9d, r9d
mov r8b, 1
lea rdx, [rbp + 0x38]
lea rcx, str.left
call fcn.1400a81c0
cmp dword [reloc.WS2_32.dll_accept], 1
jne 0x1401001cd
call fcn.1400b50e0
vaddss xmm6, xmm0, xmm8
call fcn.1400b50b0
vaddss xmm1, xmm0, xmm8
vmovss dword [rbp + 0x40], xmm1
vmovss dword [rbp + 0x44], xmm6
lea rcx, [rbp + 0x40]
call fcn.1400c0f30
lea rdx, [0x1403178e5]
lea rcx, str.Permanent_Spoof
call fcn.1400dd8d0
call fcn.1400b50e0
vaddss xmm6, xmm0, dword [0x1401eca10]
call fcn.1400b50b0
vaddss xmm1, xmm0, xmm11
vmovss dword [rbp + 0x48], xmm1
vmovss dword [rbp + 0x4c], xmm6
lea rcx, [rbp + 0x48]
call fcn.1400c0f30
vmovss dword [rbp + 0x50], xmm15
vmovss dword [rbp + 0x54], xmm14
lea rdx, [rbp + 0x50]
lea rcx, str.SPOOF
call fcn.1400dd070
test al, al
je 0x1401001cd
mov edx, 0x3e8
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Beep]
call fcn.1400f0e20
call fcn.140109e90
call fcn.14011a7b0
cmp dword [reloc.WS2_32.dll_accept], 2
jne 0x140100225
call fcn.1400b50e0
vaddss xmm6, xmm0, xmm8
call fcn.1400b50b0
vaddss xmm1, xmm0, xmm11
vmovss dword [rbp + 0x58], xmm1
vmovss dword [rbp + 0x5c], xmm6
lea rcx, [rbp + 0x58]
call fcn.1400c0f30
vmovss dword [rbp + 0x60], xmm15
vmovss dword [rbp + 0x64], xmm14
lea rdx, [rbp + 0x60]
lea rcx, str.Cleaner
call fcn.1400dd070
test al, al
je 0x140100225
call fcn.1400ede40
call fcn.140104bd0
call fcn.1400b2da0
vmovaps xmm1, xmm10
vmovaps xmm0, xmm9
call fcn.1400c0760
call fcn.1400b50b0
vaddss xmm0, xmm0, xmm8
call fcn.1400c0fb0
lea rcx, [rbp + 0x1d8]
call fcn.1400b5040
vmovss xmm0, dword [rax + 4]
vsubss xmm1, xmm0, dword [0x1401e214c]
vmovss xmm0, dword [0x1401eca04]
vmovss dword [rbp + 0x68], xmm0
vmovss dword [rbp + 0x6c], xmm1
xor r9d, r9d
mov r8b, 1
lea rdx, [rbp + 0x68]
lea rcx, str.right
call fcn.1400a81c0
mov eax, dword [reloc.WS2_32.dll_accept]
cmp eax, 1
jne 0x1401005f5
call fcn.1400b50e0
vaddss xmm6, xmm0, xmm8
call fcn.1400b50b0
vaddss xmm1, xmm0, xmm8
vmovss dword [rbp + 0x70], xmm1
vmovss dword [rbp + 0x74], xmm6
lea rcx, [rbp + 0x70]
call fcn.1400c0f30
vmovups xmm0, xmmword [0x1401e5ca0]
vmovups xmmword [rsp + 0x58], xmm0
lea rdx, [rsp + 0x58]
xor ecx, ecx
call fcn.1400bd300
lea rcx, str.Disk_Serials:
call fcn.1400e5210
mov ecx, r14d
call fcn.1400bccd0
call fcn.1400b50e0
vaddss xmm6, xmm0, dword [0x1401e1ffc]
call fcn.1400b50b0
vaddss xmm1, xmm0, xmm8
vmovss dword [rbp + 0x78], xmm1
vmovss dword [rbp + 0x7c], xmm6
lea rcx, [rbp + 0x78]
call fcn.1400c0f30
mov rcx, rdi
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rcx, qword [0x1402c2d20]
call fcn.1400e5760
call fcn.1400b50e0
vaddss xmm6, xmm0, dword [0x1401e1ffc]
call fcn.1400b50b0
vaddss xmm1, xmm0, xmm8
vmovss dword [rbp + 0x80], xmm1
vmovss dword [rbp + 0x84], xmm6
lea rcx, [rbp + 0x80]
call fcn.1400c0f30
vmovups xmm0, xmmword [0x1401e5ca0]
vmovups xmmword [rsp + 0x58], xmm0
lea rdx, [rsp + 0x58]
xor ecx, ecx
call fcn.1400bd300
lea rcx, str.BIOS_Serials:
call fcn.1400e5210
mov ecx, r14d
call fcn.1400bccd0
call fcn.1400b50e0
vaddss xmm6, xmm0, dword [0x1401e1ffc]
call fcn.1400b50b0
vaddss xmm1, xmm0, xmm8
vmovss dword [rbp + 0x88], xmm1
vmovss dword [rbp + 0x8c], xmm6
lea rcx, [rbp + 0x88]
call fcn.1400c0f30
lea rcx, [0x1402c2d40]
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rcx, qword [0x1402c2d40]
call fcn.1400e5760
call fcn.1400b50e0
vaddss xmm6, xmm0, dword [0x1401e1ffc]
call fcn.1400b50b0
vaddss xmm1, xmm0, xmm8
vmovss dword [rbp + 0x90], xmm1
vmovss dword [rbp + 0x94], xmm6
lea rcx, [rbp + 0x90]
call fcn.1400c0f30
vmovups xmm0, xmmword [0x1401e5ca0]
vmovups xmmword [rsp + 0x58], xmm0
lea rdx, [rsp + 0x58]
xor ecx, ecx
call fcn.1400bd300
lea rcx, str.MotherBoard:
call fcn.1400e5210
mov ecx, r14d
call fcn.1400bccd0
call fcn.1400b50e0
vaddss xmm6, xmm0, dword [0x1401e1ffc]
call fcn.1400b50b0
vaddss xmm1, xmm0, xmm8
vmovss dword [rbp + 0x98], xmm1
vmovss dword [rbp + 0x9c], xmm6
lea rcx, [rbp + 0x98]
call fcn.1400c0f30
lea rcx, [0x1402c2d80]
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rcx, qword [0x1402c2d80]
call fcn.1400e5760
call fcn.1400b50e0
vaddss xmm6, xmm0, dword [0x1401e1ffc]
call fcn.1400b50b0
vaddss xmm1, xmm0, xmm8
vmovss dword [rbp + 0xa0], xmm1
vmovss dword [rbp + 0xa4], xmm6
lea rcx, [rbp + 0xa0]
call fcn.1400c0f30
vmovups xmm0, xmmword [0x1401e5ca0]
vmovups xmmword [rsp + 0x58], xmm0
lea rdx, [rsp + 0x58]
xor ecx, ecx
call fcn.1400bd300
lea rcx, str.Windows_UUID:
call fcn.1400e5210
mov ecx, r14d
call fcn.1400bccd0
call fcn.1400b50e0
vaddss xmm6, xmm0, dword [0x1401e1ffc]
call fcn.1400b50b0
vaddss xmm1, xmm0, xmm8
vmovss dword [rbp + 0xa8], xmm1
vmovss dword [rbp + 0xac], xmm6
lea rcx, [rbp + 0xa8]
call fcn.1400c0f30
lea rcx, [0x1402c2d60]
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rcx, qword [0x1402c2d60]
call fcn.1400e5760
call fcn.1400b50e0
vaddss xmm6, xmm0, dword [0x1401e200c]
call fcn.1400b50b0
vaddss xmm1, xmm0, xmm8
vmovss dword [rbp + 0xb0], xmm1
vmovss dword [rbp + 0xb4], xmm6
lea rcx, [rbp + 0xb0]
call fcn.1400c0f30
vmovups xmm0, xmmword [0x1401e5ca0]
vmovups xmmword [rsp + 0x58], xmm0
lea rdx, [rsp + 0x58]
xor ecx, ecx
call fcn.1400bd300
lea rcx, str.Windows_Identifier:
call fcn.1400e5210
mov ecx, r14d
call fcn.1400bccd0
call fcn.1400b50e0
vaddss xmm6, xmm0, dword [0x1401e200c]
call fcn.1400b50b0
vaddss xmm1, xmm0, xmm8
vmovss dword [rbp + 0xb8], xmm1
vmovss dword [rbp + 0xbc], xmm6
lea rcx, [rbp + 0xb8]
call fcn.1400c0f30
lea rcx, [0x1402c2da0]
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rcx, qword [0x1402c2da0]
call fcn.1400e5760
mov eax, dword [reloc.WS2_32.dll_accept]
cmp eax, 2
jne 0x140100a0f
call fcn.1400b50e0
vaddss xmm6, xmm0, xmm8
call fcn.1400b50b0
vaddss xmm1, xmm0, xmm11
vmovss dword [rbp + 0xc0], xmm1
vmovss dword [rbp + 0xc4], xmm6
lea rcx, [rbp + 0xc0]
call fcn.1400c0f30
vmovss dword [rbp + 0xc8], xmm15
vmovss dword [rbp + 0xcc], xmm14
lea rdx, [rbp + 0xc8]
lea rcx, str.SERIAL_CHECKER
call fcn.1400dd070
test al, al
je 0x140100667
cmp byte [0x1403192b8], 0
sete al
mov byte [0x1403192b8], al
jmp 0x14010066e
movzx eax, byte [0x1403192b8]
test al, al
je 0x140100a0f
call fcn.1400b50e0
vaddss xmm6, xmm0, xmm8
call fcn.1400b50b0
vaddss xmm1, xmm0, xmm11
vmovss dword [rbp + 0xd0], xmm1
vmovss dword [rbp + 0xd4], xmm6
lea rcx, [rbp + 0xd0]
call fcn.1400c0f30
call fcn.1400b50e0
vaddss xmm6, xmm0, xmm8
call fcn.1400b50b0
vaddss xmm1, xmm0, xmm8
vmovss dword [rbp + 0xd8], xmm1
vmovss dword [rbp + 0xdc], xmm6
lea rcx, [rbp + 0xd8]
call fcn.1400c0f30
vmovups xmm0, xmmword [0x1401e5ca0]
vmovups xmmword [rsp + 0x58], xmm0
lea rdx, [rsp + 0x58]
xor ecx, ecx
call fcn.1400bd300
lea rcx, str.Disk_Serials:
call fcn.1400e5210
mov ecx, r14d
call fcn.1400bccd0
call fcn.1400b50e0
vaddss xmm6, xmm0, dword [0x1401e1ffc]
call fcn.1400b50b0
vaddss xmm1, xmm0, xmm8
vmovss dword [rbp + 0xe0], xmm1
vmovss dword [rbp + 0xe4], xmm6
lea rcx, [rbp + 0xe0]
call fcn.1400c0f30
mov rcx, rdi
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rcx, qword [0x1402c2d20]
call fcn.1400e5760
call fcn.1400b50e0
vaddss xmm6, xmm0, dword [0x1401e1ffc]
call fcn.1400b50b0
vaddss xmm1, xmm0, xmm8
vmovss dword [rbp + 0xe8], xmm1
vmovss dword [rbp + 0xec], xmm6
lea rcx, [rbp + 0xe8]
call fcn.1400c0f30
vmovups xmm0, xmmword [0x1401e5ca0]
vmovups xmmword [rsp + 0x58], xmm0
lea rdx, [rsp + 0x58]
xor ecx, ecx
call fcn.1400bd300
lea rcx, str.BIOS_Serials:
call fcn.1400e5210
mov ecx, r14d
call fcn.1400bccd0
call fcn.1400b50e0
vaddss xmm6, xmm0, dword [0x1401e1ffc]
call fcn.1400b50b0
vaddss xmm1, xmm0, xmm8
vmovss dword [rbp + 0xf0], xmm1
vmovss dword [rbp + 0xf4], xmm6
lea rcx, [rbp + 0xf0]
call fcn.1400c0f30
lea rcx, [0x1402c2d40]
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rcx, qword [0x1402c2d40]
call fcn.1400e5760
call fcn.1400b50e0
vaddss xmm6, xmm0, dword [0x1401e1ffc]
call fcn.1400b50b0
vaddss xmm1, xmm0, xmm8
vmovss dword [rbp + 0xf8], xmm1
vmovss dword [rbp + 0xfc], xmm6
lea rcx, [rbp + 0xf8]
call fcn.1400c0f30
vmovups xmm0, xmmword [0x1401e5ca0]
vmovups xmmword [rsp + 0x58], xmm0
lea rdx, [rsp + 0x58]
xor ecx, ecx
call fcn.1400bd300
lea rcx, str.MotherBoard:
call fcn.1400e5210
mov ecx, r14d
call fcn.1400bccd0
call fcn.1400b50e0
vaddss xmm6, xmm0, dword [0x1401e1ffc]
call fcn.1400b50b0
vaddss xmm1, xmm0, xmm8
vmovss dword [rbp + 0x100], xmm1
vmovss dword [rbp + 0x104], xmm6
lea rcx, [rbp + 0x100]
call fcn.1400c0f30
lea rcx, [0x1402c2d80]
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rcx, qword [0x1402c2d80]
call fcn.1400e5760
call fcn.1400b50e0
vaddss xmm6, xmm0, dword [0x1401e1ffc]
call fcn.1400b50b0
vaddss xmm1, xmm0, xmm8
vmovss dword [rbp + 0x108], xmm1
vmovss dword [rbp + 0x10c], xmm6
lea rcx, [rbp + 0x108]
call fcn.1400c0f30
vmovups xmm0, xmmword [0x1401e5ca0]
vmovups xmmword [rsp + 0x58], xmm0
lea rdx, [rsp + 0x58]
xor ecx, ecx
call fcn.1400bd300
lea rcx, str.Windows_UUID:
call fcn.1400e5210
mov ecx, r14d
call fcn.1400bccd0
call fcn.1400b50e0
vaddss xmm6, xmm0, dword [0x1401e1ffc]
call fcn.1400b50b0
vaddss xmm1, xmm0, xmm8
vmovss dword [rbp + 0x110], xmm1
vmovss dword [rbp + 0x114], xmm6
lea rcx, [rbp + 0x110]
call fcn.1400c0f30
lea rcx, [0x1402c2d60]
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rcx, qword [0x1402c2d60]
call fcn.1400e5760
call fcn.1400b50e0
vaddss xmm6, xmm0, dword [0x1401e200c]
call fcn.1400b50b0
vaddss xmm1, xmm0, xmm8
vmovss dword [rbp + 0x118], xmm1
vmovss dword [rbp + 0x11c], xmm6
lea rcx, [rbp + 0x118]
call fcn.1400c0f30
vmovups xmm0, xmmword [0x1401e5ca0]
vmovups xmmword [rsp + 0x58], xmm0
lea rdx, [rsp + 0x58]
xor ecx, ecx
call fcn.1400bd300
lea rcx, str.Windows_Identifier:
call fcn.1400e5210
mov ecx, r14d
call fcn.1400bccd0
call fcn.1400b50e0
vaddss xmm6, xmm0, dword [0x1401e200c]
call fcn.1400b50b0
vaddss xmm1, xmm0, xmm8
vmovss dword [rbp + 0x120], xmm1
vmovss dword [rbp + 0x124], xmm6
lea rcx, [rbp + 0x120]
call fcn.1400c0f30
lea rcx, [0x1402c2da0]
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rcx, qword [0x1402c2da0]
call fcn.1400e5760
call fcn.1400b2da0
call fcn.1400bcbc0
call fcn.1400b2a30
mov ecx, r14d
call fcn.1400bcd20
call fcn.1400b2f80
mov rcx, qword [0x140319098]
mov rax, qword [rcx]
xor r8d, r8d
lea edx, [r8 + 7]
call qword [rax + 0x1c8]
mov rcx, qword [0x140319098]
mov rax, qword [rcx]
xor r8d, r8d
lea edx, [r8 + 0x1b]
call qword [rax + 0x1c8]
mov rcx, qword [0x140319098]
mov rax, qword [rcx]
xor r8d, r8d
mov edx, 0xae
call qword [rax + 0x1c8]
mov rcx, qword [0x140319098]
mov rax, qword [rcx]
mov dword [rsp + 0x30], esi
vmovss xmm0, dword [0x1401e1fdc]
vmovss dword [rsp + 0x28], xmm0
mov dword [rsp + 0x20], esi
mov r9d, 3
xor r8d, r8d
xor edx, edx
call qword [rax + pe_nt_image_headers64]
mov rcx, qword [0x140319098]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x140100ad8
call fcn.1400bd510
call fcn.1400b5110
mov rcx, rax
call fcn.1400d8250
mov rcx, qword [0x140319098]
mov rax, qword [rcx]
call qword [rax + 0x150]
call fcn.1400b5500
test dword [rax], 0x400
je 0x140100af3
call fcn.1400c3400
xor edx, edx
xor ecx, ecx
call fcn.1400be170
mov rcx, qword [0x140319098]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x1400fe170
mov rcx, qword [0x140319098]
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
cmp eax, 0x88760869
jne 0x1400fe170
call fcn.1400d8090
mov rcx, qword [0x140319098]
mov rax, qword [rcx]
lea rdx, [0x140319210]
call qword [rax + 0x80]
call fcn.1400d7c40
jmp 0x1400fe170
xor al, al
lea r11, [rsp + 0x8f8]
vmovaps xmm6, xmmword [r11 - 0x18]
vmovaps xmm7, xmmword [r11 - 0x28]
vmovaps xmm8, xmmword [r11 - 0x38]
vmovaps xmm9, xmmword [r11 - 0x48]
vmovaps xmm10, xmmword [r11 - 0x58]
vmovaps xmm11, xmmword [r11 - 0x68]
vmovaps xmm12, xmmword [r11 - 0x78]
vmovaps xmm13, xmmword [r11 - 0x88]
vmovaps xmm14, xmmword [r11 - 0x98]
vmovaps xmm15, xmmword [r11 - 0xa8]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x840]
call fcn.1400ed360
movzx edx, byte [rax + 0x16]
test dl, dl
je 0x140100c37
xor byte [rax], 0x36
xor byte [rax + 1], 0x37
xor byte [rax + 2], 0x38
xor byte [rax + 3], 0x39
xor byte [rax + 4], 0x3a
xor byte [rax + 5], 0x3b
xor byte [rax + 6], 0x3c
xor byte [rax + 7], 0x3d
xor byte [rax + 8], 0x3e
xor byte [rax + 9], 0x3f
xor byte [rax + 0xa], 0x40
xor byte [rax + 0xb], 0x41
xor byte [rax + 0xc], 0x42
xor byte [rax + 0xd], 0x43
xor byte [rax + 0xe], 0x44
xor byte [rax + 0xf], 0x45
xor byte [rax + 0x10], 0x46
xor byte [rax + 0x11], 0x47
xor byte [rax + 0x12], 0x48
xor byte [rax + 0x13], 0x49
xor byte [rax + 0x14], 0x4a
xor byte [rax + 0x15], 0x4b
xor dl, 0x4c
mov byte [rax + 0x16], dl
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.14009b6b0
mov rdx, rax
lea rcx, [0x140318b10]
call fcn.140171c90
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3