Function at 0x7ff7e1aaf1b0
Capabilities:
Create process on windows
Create thread
Download url
Get session user name
Log keystrokes via polling
Receive data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x598]
sub rsp, 0x670
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
mov rax, qword [0x7ff7e1d8f600]
xor rax, rsp
mov qword [rbp + 0x500], rax
xor ecx, ecx
call fcn.7ff7e1c79150
mov rcx, rax
call fcn.7ff7e1c827b8
mov ebx, 1
call fcn.7ff7e1c83c48
cmp dword [rax], ebx
jle 0x7ff7e1aaf255
lea edi, [rbx + 7]
call fcn.7ff7e1c83c50
mov rcx, qword [rax]
lea rdx, [0x7ff7e1d5beb0]
mov rcx, qword [rdi + rcx]
call fcn.7ff7e1c84700
test eax, eax
je 0x7ff7e1aaf6b9
inc ebx
add rdi, 8
call fcn.7ff7e1c83c48
cmp ebx, dword [rax]
jl 0x7ff7e1aaf226
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x1b0]
call fcn.7ff7e1c67c50
lea rdx, [0x7ff7e1d5be68]
lea rcx, [rbp + 0x1b0]
call fcn.7ff7e1ab1390
xor r14d, r14d
mov qword [rbp + 0xe0], r14
lea r15d, [r14 + 2]
cmp qword [rbp + 0x240], r14
je 0x7ff7e1aaf2e4
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x1b0]
call fcn.7ff7e1ab8870
lea rcx, [rbp + 0x1c0]
call fcn.7ff7e1ab4ca0
test rax, rax
jne 0x7ff7e1aaf2e4
mov rax, qword [rbp + 0x1b0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x1b0]
add rcx, rax
mov edx, 6
cmp qword [rcx + 0x48], r14
cmovne edx, r15d
or edx, dword [rcx + 0x10]
xor r8d, r8d
call fcn.7ff7e1a9e900
mov rbx, qword [rbp + 0xe0]
mov rax, qword [rbp + 0x1b0]
movsxd rcx, dword [rax + 4]
lea rax, [0x7ff7e1d5a2f0]
mov qword [rbp + rcx + 0x1b0], rax
mov rax, qword [rbp + 0x1b0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x1ac], edx
lea rcx, [rbp + 0x1c0]
call fcn.7ff7e1ab12e0
mov rax, qword [rbp + 0x1b0]
movsxd rcx, dword [rax + 4]
lea rax, [0x7ff7e1d5a210]
mov qword [rbp + rcx + 0x1b0], rax
mov rax, qword [rbp + 0x1b0]
movsxd rcx, dword [rax + 4]
lea r8d, [rcx - 0x18]
mov dword [rbp + rcx + 0x1ac], r8d
lea rax, [0x7ff7e1d38f58]
mov qword [rbp + 0x260], rax
lea rcx, [rbp + 0x260]
call fcn.7ff7e1c63ce4
nop
lea rcx, [rbp + 0x120]
call fcn.7ff7e1c79150
mov rdx, rbx
mov rcx, qword [rbp + 0x120]
call fcn.7ff7e1c825f4
divsd xmm0, qword [0x7ff7e1d5de70]
comisd xmm0, xmmword [0x7ff7e1d5de40]
jb 0x7ff7e1aaf3a7
call fcn.7ff7e1aaea80
mov ecx, 8
call fcn.7ff7e1c64f38
lea rcx, [0x7ff7e1aaef10]
mov qword [rax], rcx
lea rcx, [rbp + 0x108]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x7ff7e1ac60f0]
xor edx, edx
xor ecx, ecx
call fcn.7ff7e1c78d28
mov qword [rbp + 0x100], rax
test rax, rax
je 0x7ff7e1ab0256
cmp dword [rbp + 0x108], 0
je 0x7ff7e1ab0245
movaps xmm0, xmmword [rbp + 0x100]
movdqa xmmword [rbp + 0x3d0], xmm0
lea rcx, [rbp + 0x3d0]
call fcn.7ff7e1c62fe0
test eax, eax
jne 0x7ff7e1ab0268
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x100], xmm0
mov ecx, 8
call fcn.7ff7e1c64f38
lea rcx, [0x7ff7e1aae680]
mov qword [rax], rcx
lea rcx, [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x7ff7e1ac60f0]
xor edx, edx
xor ecx, ecx
call fcn.7ff7e1c78d28
mov qword [rbp + 0xf0], rax
test rax, rax
je 0x7ff7e1ab02fe
cmp dword [rbp + 0xf8], 0
je 0x7ff7e1ab0245
movaps xmm0, xmmword [rbp + 0xf0]
movdqa xmmword [rbp + 0x3d0], xmm0
lea rcx, [rbp + 0x3d0]
call fcn.7ff7e1c62fe0
test eax, eax
jne 0x7ff7e1ab0270
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xf0], xmm0
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x7ff7e1aab630]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.kernel32.dll_CloseHandle]
lea rcx, [0x7ff7e1dcc5e0]
call fcn.7ff7e1aa4470
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x2c0]
call fcn.7ff7e1c67c50
lea rdx, [0x7ff7e1d5bec0]
lea rcx, [rbp + 0x2c0]
call fcn.7ff7e1ab1390
mov rax, qword [rbp + 0x2c0]
movsxd rcx, dword [rax + 4]
mov rax, qword [rbp + rcx + 0x300]
mov rcx, qword [rax + 8]
mov qword [rbp + 0x118], rcx
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, [rbp + 0x110]
call fcn.7ff7e1ab7570
mov rcx, rax
mov rax, qword [rax]
mov dl, 0xa
call qword [rax + 0x40]
movzx ebx, al
mov rcx, qword [rbp + 0x118]
test rcx, rcx
je 0x7ff7e1aaf56a
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test rax, rax
je 0x7ff7e1aaf56a
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
movzx r8d, bl
lea rcx, [rbp + 0x2c0]
call fcn.7ff7e1ac18a0
lea rcx, [0x7ff7e1d91990]
call fcn.7ff7e1a9d3e0
mov rdx, rax
call fcn.7ff7e1ab85d0
mov dword [rbp + 0x90], 0x50
mov r12d, 0x40
mov dword [rbp + 0x94], r12d
lea rax, [0x7ff7e1ab0310]
mov qword [rbp + 0x98], rax
mov qword [rbp + 0xa0], r14
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
mov qword [rbp + 0xa8], rax
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xb0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xc0], xmm1
lea rcx, [0x7ff7e1dcc5b8]
call fcn.7ff7e1a9d3e0
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xd8], r14
lea rcx, [rbp + 0x90]
call qword [sym.imp.user32.dll_RegisterClassExA]
lea rcx, [0x7ff7e1dcc5b8]
call fcn.7ff7e1a9d3e0
mov r8, rax
mov qword [rsp + 0x58], r14
mov rax, qword [rbp + 0xa8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], 5
mov dword [rsp + 0x30], 5
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov r9d, 0x80000000
mov rdx, qword [rbp + 0xd0]
xor ecx, ecx
call qword [sym.imp.user32.dll_CreateWindowExA]
mov qword [0x7ff7e1d9b318], rax
call fcn.7ff7e1aa9d80
test al, al
jne 0x7ff7e1aaf709
call fcn.7ff7e1aa9e60
mov rdx, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0xd0]
call qword [sym.imp.user32.dll_UnregisterClassA]
lea rcx, [rbp + 0x2c0]
call fcn.7ff7e1aae480
cmp dword [rbp + 0xf8], 0
jne 0x7ff7e1ab0250
cmp dword [rbp + 0x108], 0
jne 0x7ff7e1ab0250
lea eax, [r12 - 0x3f]
jmp 0x7ff7e1aaf6bb
xor eax, eax
mov rcx, qword [rbp + 0x500]
xor rcx, rsp
call fcn.7ff7e1c64cb0
lea r11, [rsp + 0x670]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor edx, edx
mov rcx, qword [0x7ff7e1d9b318]
call qword [sym.imp.user32.dll_ShowWindow]
mov rcx, qword [0x7ff7e1d9b318]
call qword [sym.imp.user32.dll_UpdateWindow]
call fcn.7ff7e1a571f0
call fcn.7ff7e1a573f0
mov rdi, rax
mov qword [rax + 0x18], r14
or dword [rax], 0x400
xor ecx, ecx
call fcn.7ff7e1a812c0
xor ecx, ecx
call fcn.7ff7e1a81820
call fcn.7ff7e1a54eb0
test dword [rdi], 0x400
je 0x7ff7e1aaf765
mov dword [rax + 0xc], r14d
mov dword [rax + 0xe8], 0x3f800000
lea rdx, [0x7ff7e1d5bed8]
lea rcx, [rbp]
call fcn.7ff7e1a9d1b0
lea rcx, [rbp]
call fcn.7ff7e1aab680
movzx ebx, al
lea rcx, [rbp]
call fcn.7ff7e1a9d3f0
test bl, bl
jne 0x7ff7e1aaf7db
nop
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, [0x7ff7e1d5bed8]
lea rdx, [0x7ff7e1d5bef0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
jns 0x7ff7e1aaf7db
lea rdx, [0x7ff7e1d5bed8]
lea rcx, [rbp]
call fcn.7ff7e1a9d1b0
lea rcx, [rbp]
call fcn.7ff7e1aab680
movzx ebx, al
lea rcx, [rbp]
call fcn.7ff7e1a9d3f0
test bl, bl
je 0x7ff7e1aaf790
call fcn.7ff7e1aa9f00
test al, al
jne 0x7ff7e1aaf7fd
mov r8d, 0xad0
lea rdx, [0x7ff7e1d5bf20]
lea rcx, [0x7ff7e1d5bf68]
call fcn.7ff7e1c744f8
call fcn.7ff7e1a8ce60
call fcn.7ff7e1a8c540
call fcn.7ff7e1aaa5d0
lea rbx, [0x7ff7e1d585b8]
mov qword [rsp + 0x20], rbx
movss xmm2, dword [0x7ff7e1d5dea4]
mov rcx, qword [rdi + 0xa0]
call fcn.7ff7e1a86280
mov qword [rsp + 0x20], rbx
movss xmm2, dword [0x7ff7e1d5deac]
mov rcx, qword [rdi + 0xa0]
call fcn.7ff7e1a86280
mov rsi, rax
call qword [sym.imp.user32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rbp + 0x148]
call qword [sym.imp.user32.dll_GetWindowRect]
mov ecx, dword [rbp + 0x150]
add ecx, 0xfffffed4
movd xmm9, ecx
cvtdq2ps xmm9, xmm9
mulss xmm9, dword [0x7ff7e1d5ddd0]
mov ecx, dword [rbp + 0x154]
add ecx, 0xfffffe1b
movd xmm10, ecx
cvtdq2ps xmm10, xmm10
mulss xmm10, dword [0x7ff7e1d5ddd0]
xorps xmm0, xmm0
movups xmmword [rbp + 0x178], xmm0
movups xmmword [rbp + 0x188], xmm0
movups xmmword [rbp + 0x198], xmm0
lea r13, [0x7ff7e1d5bfd8]
lea rbx, [0x7ff7e1d5bff8]
xorps xmm6, xmm6
movss xmm11, dword [0x7ff7e1d5de9c]
movss xmm7, dword [0x7ff7e1d5de10]
movss xmm8, dword [0x7ff7e1d5df30]
nop dword [rax]
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x178]
call qword [sym.imp.user32.dll_PeekMessageA]
test eax, eax
je 0x7ff7e1aaf920
lea rcx, [rbp + 0x178]
call qword [sym.imp.user32.dll_TranslateMessage]
lea rcx, [rbp + 0x178]
call qword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x7ff7e1ab01d5
cmp qword [0x7ff7e1dd0dc8], 0
jne 0x7ff7e1aaf92f
call fcn.7ff7e1a8c660
call fcn.7ff7e1a8d740
call fcn.7ff7e1a4b7e0
call fcn.7ff7e1a58d60
mov qword [rsp + 0x68], 0
movss dword [rsp + 0x70], xmm9
movss dword [rsp + 0x74], xmm10
lea r8, [rsp + 0x68]
mov edx, r15d
lea rcx, [rsp + 0x70]
call fcn.7ff7e1a635a0
lea rdx, [0x7ff7e1d5bf98]
lea rcx, [0x7ff7e1d91b30]
call fcn.7ff7e1ab7ca0
xor edx, edx
test al, al
je 0x7ff7e1aaf9e2
mov dword [rsp + 0x78], 0x43960000
mov dword [rsp + 0x7c], 0x43f28000
lea rcx, [rsp + 0x78]
call fcn.7ff7e1a63640
movzx eax, byte [0x7ff7e1d9b29a]
cmp al, 1
jne 0x7ff7e1aaf9c5
mov dword [rbp - 0x80], 0x43960000
mov dword [rbp - 0x7c], 0x44098000
xor edx, edx
lea rcx, [rbp - 0x80]
call fcn.7ff7e1a63640
movzx eax, byte [0x7ff7e1d9b29a]
test al, al
jne 0x7ff7e1aaf9f9
mov dword [rsp + 0x60], 0x43960000
mov dword [rsp + 0x64], 0x43f28000
xor edx, edx
lea rcx, [rsp + 0x60]
jmp 0x7ff7e1aaf9f4
mov dword [rbp - 0x70], 0x43960000
mov dword [rbp - 0x6c], 0x43af0000
lea rcx, [rbp - 0x70]
call fcn.7ff7e1a63640
mov rax, qword [0x7ff7e1d9b2a0]
or dword [rax + 0x1c40], r12d
mov dword [rax + 0x1ca0], 0x3f800000
lea rcx, [0x7ff7e1dcc5b8]
call fcn.7ff7e1a9d3e0
mov rcx, rax
mov r8d, 0x12a
lea rdx, [0x7ff7e1d90358]
call fcn.7ff7e1a5f6e0
mov ecx, 0x23
call qword [sym.imp.user32.dll_GetKeyState]
lea rdx, [0x7ff7e1d5bf98]
lea rcx, [0x7ff7e1d91b30]
call fcn.7ff7e1ab7ca0
test al, al
je 0x7ff7e1aafea7
cmp dword [0x7ff7e1d9b2f0], 0
jne 0x7ff7e1aafaee
lea rdx, [0x7ff7e1d5bfa8]
lea rcx, [rbp + 0x20]
call fcn.7ff7e1a9d1b0
mov r8, rax
lea rdx, [rbp + 0x128]
lea rcx, [0x7ff7e1dcc5e0]
call fcn.7ff7e1aa75d0
lea rdx, [0x7ff7e1d5bfb0]
lea rcx, [rbp + 0x128]
call fcn.7ff7e1ab7ca0
test al, al
je 0x7ff7e1ab0280
lea rdx, [0x7ff7e1d5bfc8]
lea rcx, [0x7ff7e1dcc6a8]
call fcn.7ff7e1ab7ca0
test al, al
jne 0x7ff7e1aafad8
lea rdx, [0x7ff7e1d56f28]
lea rcx, [0x7ff7e1dcc6a8]
call fcn.7ff7e1ab7ca0
test al, al
je 0x7ff7e1ab0278
mov dword [0x7ff7e1d9b2f0], 1
lea rcx, [rbp + 0x128]
call fcn.7ff7e1a9d3f0
mov rax, qword [0x7ff7e1d9b2a0]
mov rcx, qword [rax + 0x1b90]
movss xmm0, dword [rcx + 0x118]
subss xmm0, dword [rcx + 0x48]
addss xmm0, dword [rcx + 0x8c]
addss xmm0, xmm11
call fcn.7ff7e1a64890
movss dword [rsp + 0x20], xmm6
movaps xmm3, xmm6
movaps xmm2, xmm6
movaps xmm1, xmm6
lea rcx, [rbp + 0x40]
call fcn.7ff7e1a52970
mov rdx, rax
movss dword [rsp + 0x20], xmm7
movaps xmm3, xmm7
movaps xmm2, xmm7
movaps xmm1, xmm7
lea rcx, [rbp + 0x50]
call fcn.7ff7e1a52970
mov dword [rbp - 0x68], 0x3f800000
mov dword [rbp - 0x64], 0x3f800000
mov qword [rbp - 0x60], 0
mov dword [rbp - 0x58], 0x43820000
mov dword [rbp - 0x54], 0x43340000
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x68]
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x58]
mov rcx, qword [0x7ff7e1d9b308]
call fcn.7ff7e1a91860
mov qword [rbp + 0x3e0], r13
mov r9d, 1
lea r8, [rbp + 0x3e0]
lea rdx, [0x7ff7e1d9b2f4]
lea rcx, [0x7ff7e1d5bfe8]
call fcn.7ff7e1a93a40
mov qword [rbp + 0x3f0], rbx
lea rax, [0x7ff7e1d5c008]
mov qword [rbp + 0x3f8], rax
mov r9d, r15d
lea r8, [rbp + 0x3f0]
lea rdx, [0x7ff7e1d90350]
lea rcx, [0x7ff7e1d5c018]
call fcn.7ff7e1a93a40
lea rax, [0x7ff7e1d5c020]
mov qword [rbp + 0x3d0], rax
lea rax, [0x7ff7e1d5c040]
mov qword [rbp + 0x3d8], rax
mov r9d, r15d
lea r8, [rbp + 0x3d0]
lea rdx, [0x7ff7e1d90354]
lea rcx, [0x7ff7e1d5c058]
call fcn.7ff7e1a93a40
lea rax, [0x7ff7e1d5c068]
mov qword [rbp + 0x3e8], rax
mov r9d, 1
lea r8, [rbp + 0x3e8]
lea rdx, [0x7ff7e1d9b2fc]
lea rcx, [0x7ff7e1d5c080]
call fcn.7ff7e1a93a40
lea rcx, [0x7ff7e1d5c090]
call fcn.7ff7e1a8f780
xor r8d, r8d
lea rcx, [0x7ff7e1d56fb8]
call fcn.7ff7e1a923d0
movaps xmm1, xmm8
movaps xmm0, xmm6
call fcn.7ff7e1a64760
mov r8d, 1
lea rcx, [0x7ff7e1d56fb4]
call fcn.7ff7e1a923d0
call fcn.7ff7e1a92400
mov dword [rbp - 0x78], 0x438ec000
mov dword [rbp - 0x74], 0x41cc0000
lea rdx, [rbp - 0x78]
lea rcx, [0x7ff7e1d5c0a8]
call fcn.7ff7e1a90470
test al, al
je 0x7ff7e1aafcdb
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x7ff7e1aabc20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.kernel32.dll_CloseHandle]
mov dword [rbp - 0x50], 0x438ec000
mov dword [rbp - 0x4c], 0x41cc0000
lea rdx, [rbp - 0x50]
lea rcx, [0x7ff7e1d5c0b8]
call fcn.7ff7e1a90470
test al, al
je 0x7ff7e1aafdcc
mov byte [0x7ff7e1d9b299], 0
cmp dword [0x7ff7e1d9b2fc], 0
jne 0x7ff7e1aafd6a
call fcn.7ff7e1aadfb0
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x7ff7e1aabfe0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [0x7ff7e1d90354]
test eax, eax
jne 0x7ff7e1aafd59
lea rdx, [0x7ff7e1d5c0c8]
call fcn.7ff7e1a4b810
mov eax, dword [0x7ff7e1d90354]
cmp eax, 1
jne 0x7ff7e1aafd6a
lea rdx, [0x7ff7e1d5c0e0]
call fcn.7ff7e1a4b810
cmp dword [0x7ff7e1d9b2fc], 1
jne 0x7ff7e1aafdcc
call fcn.7ff7e1aadfb0
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x7ff7e1aacfd0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [0x7ff7e1d90354]
test eax, eax
jne 0x7ff7e1aafdbb
lea rdx, [0x7ff7e1d5c100]
call fcn.7ff7e1a4b810
mov eax, dword [0x7ff7e1d90354]
cmp eax, 1
jne 0x7ff7e1aafdcc
lea rdx, [0x7ff7e1d5c118]
call fcn.7ff7e1a4b810
mov dword [rbp - 0x48], 0x438ec000
mov dword [rbp - 0x44], 0x41cc0000
lea rdx, [rbp - 0x48]
lea rcx, [0x7ff7e1d5c138]
call fcn.7ff7e1a90470
test al, al
jne 0x7ff7e1ab028b
call fcn.7ff7e1aaa5d0
mov ecx, 0xf
call qword [sym.imp.kernel32.dll_Sleep]
mov dword [rbp - 0x40], 0x40a00000
mov dword [rbp - 0x3c], 0x40000000
lea rcx, [rbp - 0x40]
call fcn.7ff7e1a92450
lea rcx, [0x7ff7e1d91af0]
call fcn.7ff7e1a9d3e0
mov rcx, rax
call fcn.7ff7e1a8f780
lea rcx, [0x7ff7e1dcc680]
call fcn.7ff7e1c8350c
mov qword [rbp + 0x110], rax
lea rcx, [rbp + 0x110]
call fcn.7ff7e1c82eb8
mov rbx, rax
lea rcx, [0x7ff7e1d5c148]
call fcn.7ff7e1a8f780
movaps xmm1, xmm8
movaps xmm0, xmm6
call fcn.7ff7e1a64760
mov rcx, rbx
call fcn.7ff7e1c82430
mov rcx, rax
call fcn.7ff7e1a8f780
lea rcx, [0x7ff7e1d5c158]
call fcn.7ff7e1a8f780
movaps xmm1, xmm8
movaps xmm0, xmm6
call fcn.7ff7e1a64760
lea rcx, [0x7ff7e1d5a904]
call fcn.7ff7e1a8f780
lea rbx, [0x7ff7e1d5bff8]
jmp 0x7ff7e1ab0112
movss dword [rsp + 0x20], xmm6
movaps xmm3, xmm6
movaps xmm2, xmm6
movaps xmm1, xmm6
lea rcx, [rbp + 0x60]
call fcn.7ff7e1a52970
mov rdx, rax
movss dword [rsp + 0x20], xmm7
movaps xmm3, xmm7
movaps xmm2, xmm7
movaps xmm1, xmm7
lea rcx, [rbp]
call fcn.7ff7e1a52970
mov dword [rbp - 0x38], 0x3f800000
mov dword [rbp - 0x34], 0x3f800000
mov qword [rbp - 0x30], 0
mov dword [rbp - 0x28], 0x43910000
mov dword [rbp - 0x24], 0x43660000
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x28]
mov rcx, qword [0x7ff7e1d9b308]
call fcn.7ff7e1a91860
mov rcx, rsi
call fcn.7ff7e1a63120
mov dword [rbp - 0x20], 0x43964000
mov dword [rbp - 0x1c], 0x41a00000
lea r9, [rbp - 0x20]
call fcn.7ff7e1a93a60
call fcn.7ff7e1a631e0
mov dword [rbp - 0x18], 0x43978000
mov dword [rbp - 0x14], 0x41cc0000
lea rdx, [rbp - 0x18]
lea rcx, [0x7ff7e1d5c164]
call fcn.7ff7e1a90470
test al, al
je 0x7ff7e1ab00ca
mov dword [rbp + 0xe0], 0x100
mov dword [rbp - 0x10], 0x42f80000
mov dword [rbp - 0xc], 0x42480000
lea rcx, [rbp - 0x10]
call fcn.7ff7e1a64810
lea rdx, [0x7ff7e1dd0e00]
lea rcx, [rbp + 0x158]
call fcn.7ff7e1a9d1b0
lea rdx, [rbp + 0x158]
lea rcx, [rbp + 0x20]
call fcn.7ff7e1ab2f90
mov r8, rax
lea rdx, [rbp + 0x128]
lea rcx, [0x7ff7e1dcc5e0]
call fcn.7ff7e1aa5620
lea rdx, [0x7ff7e1d5a708]
lea rcx, [rbp + 0x128]
call fcn.7ff7e1ab7ca0
test al, al
je 0x7ff7e1ab0291
lea rcx, [rbp + 0x1b0]
call fcn.7ff7e1aaea70
lea rcx, [rbp + 0x1b0]
call fcn.7ff7e1ab0600
lea rcx, [rbp + 0x1b0]
call fcn.7ff7e1ab0460
lea rdx, [0x7ff7e1dd0e00]
lea rcx, [rbp + 0x1b0]
call fcn.7ff7e1ab7cf0
lea rcx, [rbp + 0x1b0]
call fcn.7ff7e1ab0410
lea rdx, [0x7ff7e1d5bf98]
lea rcx, [0x7ff7e1d91b30]
call fcn.7ff7e1a9d1f0
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x400]
call qword [sym.imp.advapi32.dll_GetUserNameA]
test eax, eax
je 0x7ff7e1ab0093
lea rdx, [rbp + 0x400]
lea rcx, [rbp + 0x20]
call fcn.7ff7e1a9d1b0
mov r8, rax
lea rdx, [0x7ff7e1d5c170]
lea rcx, [rbp + 0x70]
call fcn.7ff7e1ab7880
mov rdx, rax
lea rcx, [0x7ff7e1d91af0]
call fcn.7ff7e1a9d450
lea rcx, [rbp + 0x70]
call fcn.7ff7e1a9d3f0
lea rcx, [rbp + 0x20]
call fcn.7ff7e1a9d3f0
jmp 0x7ff7e1ab00a6
lea rdx, [0x7ff7e1d5c188]
lea rcx, [0x7ff7e1d91af0]
call fcn.7ff7e1a9d1f0
lea rcx, [rbp + 0x1b0]
call fcn.7ff7e1aae9d0
lea rcx, [rbp + 0x128]
call fcn.7ff7e1a9d3f0
lea rcx, [rbp + 0x158]
call fcn.7ff7e1a9d3f0
mov dword [rbp - 8], 0x43978000
mov dword [rbp - 4], 0x41cc0000
lea rdx, [rbp - 8]
lea rcx, [0x7ff7e1d5c1a8]
call fcn.7ff7e1a90470
test al, al
je 0x7ff7e1ab0112
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, [0x7ff7e1d5c1b0]
lea rdx, [0x7ff7e1d5a6f4]
xor ecx, ecx
call qword [sym.imp.shell32.dll_ShellExecuteA]
call fcn.7ff7e1a62790
call fcn.7ff7e1a5b220
mov rcx, qword [0x7ff7e1d9b2a8]
mov rax, qword [rcx]
mov dword [rsp + 0x30], r14d
movss dword [rsp + 0x28], xmm7
mov dword [rsp + 0x20], r14d
mov r9d, 3
xor r8d, r8d
xor edx, edx
call qword [rax + 0x158]
mov rcx, qword [0x7ff7e1d9b2a8]
mov rax, qword [rcx]
call qword [rax + pe_nt_image_headers64]
test eax, eax
js 0x7ff7e1ab017d
call fcn.7ff7e1a5b6a0
call fcn.7ff7e1a57430
mov rcx, rax
call fcn.7ff7e1a8bf30
mov rcx, qword [0x7ff7e1d9b2a8]
mov rax, qword [rcx]
call qword [rax + 0x150]
test dword [rdi], 0x400
je 0x7ff7e1ab018f
call fcn.7ff7e1a6e0d0
call fcn.7ff7e1a6e530
mov rcx, qword [0x7ff7e1d9b2a8]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x7ff7e1ab01cc
mov rcx, qword [0x7ff7e1d9b2a8]
mov rax, qword [rcx]
call qword [rax + 0x18]
cmp eax, 0x88760869
jne 0x7ff7e1ab01cc
call fcn.7ff7e1aa9eb0
cmp byte [0x7ff7e1d90358], 0
je 0x7ff7e1ab01e3
cmp dword [rbp + 0x180], 0x12
je 0x7ff7e1ab01ed
jmp 0x7ff7e1aaf8e0
mov dword [rbp + 0x180], 0x12
call fcn.7ff7e1a8c630
call fcn.7ff7e1a8cff0
call fcn.7ff7e1a57270
call fcn.7ff7e1aa9e60
mov rcx, qword [0x7ff7e1d9b318]
call qword [sym.imp.user32.dll_DestroyWindow]
mov rdx, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0xd0]
call qword [sym.imp.user32.dll_UnregisterClassA]
lea rcx, [rbp + 0x2c0]
call fcn.7ff7e1aae480
cmp dword [rbp + 0xf8], 0
jne 0x7ff7e1ab0250
cmp dword [rbp + 0x108], 0
jne 0x7ff7e1ab0250
jmp 0x7ff7e1aaf6b9
mov ecx, 1
call fcn.7ff7e1c62edc
int3
call fcn.7ff7e1c79130
int3
mov dword [rbp + 0x108], r14d
mov ecx, 6
call fcn.7ff7e1c62edc
int3
mov ecx, eax
call fcn.7ff7e1c62ea0
int3
mov ecx, eax
call fcn.7ff7e1c62ea0
int3
xor ecx, ecx
call fcn.7ff7e1c8213c
int3
mov ecx, 0x2b
call fcn.7ff7e1c8213c
int3
call fcn.7ff7e1aaa2d0
int3
lea rdx, [0x7ff7e1d5bec0]
lea rcx, [rbp + 0x158]
call fcn.7ff7e1a9d1b0
lea rcx, [rbp + 0x158]
call fcn.7ff7e1aab680
movzx ebx, al
lea rcx, [rbp + 0x158]
call fcn.7ff7e1a9d3f0
test bl, bl
je 0x7ff7e1ab02cf
lea rcx, [0x7ff7e1d5bec0]
call fcn.7ff7e1c83080
lea rcx, [rbp + 0x128]
call fcn.7ff7e1a9d3e0
mov rdx, rax
mov word [rsp + 0x20], r12w
xor r9d, r9d
lea r8, [0x7ff7e1d5c19c]
xor ecx, ecx
call qword [sym.imp.user32.dll_MessageBoxExA]
xor ecx, ecx
call fcn.7ff7e1c8213c
int3
mov dword [rbp + 0xf8], r14d
mov ecx, 6
call fcn.7ff7e1c62edc
int3