Function at 0x1401202d0
Capabilities:
Reference http user-agent string

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x730]
sub rsp, 0x830
mov rax, qword [0x14026f4b8]
xor rax, rsp
mov qword [rbp + 0x728], rax
mov r15, rdx
mov qword [rbp + 0x390], rdx
mov rsi, rcx
mov qword [rbp + 0x5d0], rdx
xor r12d, r12d
mov dword [rsp + 0x30], r12d
mov r14d, r12d
mov dword [rsp + 0x34], r12d
mov dword [rsp + 0x40], r12d
mov rcx, rdx
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_void____ptr64]
mov dword [rsp + 0x30], 1
cmp dword [rsi], r12d
je 0x1401251b9
lea edx, [r12 + 0x17]
lea rcx, str.Windows_Update_Disabled
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x160], rax
lea edx, [r12 + 0xc]
lea rcx, str.Antidetect_4
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x158], rax
lea edx, [r12 + 9]
lea rcx, str.logo2.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x150], rax
lea edx, [r12 + 0x15]
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x148], rax
mov dl, 0x20
lea rcx, [rbp + 0x2f8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x150]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x148]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0x2fa]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x158]
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0x398]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x160]
lea rdx, [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
lea r8d, [r12 - 1]
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x30], 5
mov rdx, rbx
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
mov dword [rsp + 0x30], 3
lea rcx, [rsp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x148]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea r8d, [r12 - 1]
lea rdx, str._MY_VBOX_ADDITIONS_etcwubwub.exe__D__P_
lea rcx, [rbp - 0x80]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov r13d, 0xb
mov dword [rsp + 0x30], r13d
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x80]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
lea r8, str.__timeout_5___nul_r_n
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x3c0]
call fcn.140019700
nop
mov dword [rsp + 0x30], 3
lea rcx, [rbp - 0x80]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x150]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x158]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x160]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea edx, [r12 + 0x44]
lea rcx, str.Now_we_will_make_few_Privacy__Security_improvements_to_your_System.
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x188], rax
lea edx, [r12 + 3]
lea rcx, [0x1401b7328]
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x180], rax
lea edx, [r12 + 9]
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x178], rax
lea edx, [r12 + 0x15]
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x168], rax
mov dl, 0x20
lea rcx, [rbp + 0x39a]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x178]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x168]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0x39c]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x180]
lea rdx, [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0x39e]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x188]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
lea r8d, [r12 - 1]
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp - 0x20]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x30], 0x43
mov rdx, rbx
lea rcx, [rbp - 0x20]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
mov edi, 0x23
mov dword [rsp + 0x30], edi
lea rcx, [rsp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x168]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea edx, [rdi + 0x50]
lea rcx, str.xcopy__e__y__i__MY_VBOX_ADDITIONS_etcWinHard___userprofile_DocumentsWindowsPowerShellmodulesWinHard____nul_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x170], rax
lea rdx, [rbp + 0x170]
lea rcx, [rbp - 0x28]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x30], 0xa3
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x28]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
lea r8, str.__timeout_4___nul__powershell__File___userprofile_DocumentsWindowsPowerShellmodulesWinHardWinHard.ps1___timeout_5___nul_
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x528]
call fcn.140019700
nop
mov dword [rsp + 0x30], edi
lea rcx, [rbp - 0x28]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x170]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x20]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x178]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x180]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x188]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_void____ptr64]
nop
mov edx, 0x1cd
lea rcx, str.title_PLEASE_DONT_CLOSE_THIS_WINDOW__type__MY_VBOX_ADDITIONS__ascii.art__net_accounts__maxpwage:unlimited___nul__powercfg__SETACVALUEINDEX_SCHEME_CURRENT_7516b95f_f776_4464_8c53_06167f40cc99_3c0bc021_c8a8_4e07_a973_6b14cbcb2b7e_0__powercfg__SETDCVALUEINDEX_SCHEME_CURRENT_7516b95f_f776_4464_8c53_06167f40cc99_3c0bc021_c8a8_4e07_a973_6b14cbcb2b7e_0__explorer__MY_VBOX_ADDITIONS_etcqresqres.cmd__powershell__Set_ExecutionPolicy_Bypass__Force___echo._
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x190], rax
lea rdx, [rbp + 0x190]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x190]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, str.powershell__.____ScriptBlock_::Create___IO.StreamReader_::new___IO.Compression.GZipStream_::new__IO.MemoryStream_::new__Convert_::FromBase64String_H4sIAAAAAAAEAKVWa1PaUBDdn5JxbCMqqH34wQ4zpViRqYojPj6AdTAESMtrSOKr9r_37Lk3kAh0xnbuEHJ37753z00gHVmThtzKCKsv19hVxJdI8lIGZYDVkqG0xQHlq0ywRviVxMOZAO9DcKrSxb_SfZ47l0cZ872E_zH0BjjfSkmEOBFi79OC0gLsVEMO65esQqoormzJJTgT8GLI9ULzjyAWsHep4YqZDugbklN6ni68gnSMXg5IqpeI5wyqOWC8t9livp8c0Hv4Ys_MCbRubQhxspQGeA6FU6kJ_gurKO3UfZxnLlN7xVe0wtCrHiEr9ubOWkngL5GTzWUCWRtAewXoASheeGl2P0NUAZ5ahAmR7kJugPntYKnnBzKrva8xWQ3bBVQ0noN7Dx6qVduDnoXxDBMeQbUJzTQ6g4wrVOUNNm6BrfbSyIX4dyDXBDejnCLpC6DiBRBNxOwBH7wItVH7oY0ykelj17WUOn30QNe8a9d44MSUDsFPKqHZ1Whd9s8BO8ED53kumlP6aSKPkCM9fwLtA_bbrPKFFDU_JzXrUFf2oV_tta31S_oak7s9508NnIg2Y5zq24ptsP5P7JcYfZStqFUmU8f_Vvj1Lkvcuyieg40aRSHrEVkpfRNu0Y9qC7tnQKz3eckqfY8NTYQwzV4R6xZF7yebMLGO0qoniPaN52U694dGJmUbhTVHGX2N8ARydq4x9sGQRJ5xxqZXXa58h3d8srEN_OhZHPrzAn2doGqJ2t8iCvxCDkokvc2LubIdqXfLwVWcn5ryl_daeLEHFHpapJ3T8h6me3ZrD_1pWho5qSFXTidCKNPNTwQS0OcD3lSczbmLGRx8_W5XnxHuLwJEp8iTvEd4cL3LhnRdbsW46nFWX1pEdMD7GvsIYxtIeYgx3OwWy6NSqPuW1bPDMoVZxiTjayLCIfcyJbiMwnygw5rSVmZESUn6H_KWTLCyw5zMo8Ym3avOesjx7vQpXX2regRSujmF5G9Zq2d0LOmo_9d3mT8faMcxiRfpPhvEfv3kD_gKiiVfHZwXUizoSdYrDTY05D21sBLZnK9EBbgZ83ePCD_ASYP8K5RYHP3i_JvuniDWeJrZ5H5QS1uQcmxeHOw6eL7NUO7w1Jyo3rGtkdI1a7v27t4hRTXqHVhBFvaBxzXs9q1W4_kVJyyy98zI9kYauZVzxigCRqPdUreI3WYW2_bWMPOiHTzk7WGwYkRq0cbwgOdnzkV3o0zfnF7uewQl30T2Z35CkiQtwSbA_po8jZhpRI821xyUbwPfMHv6RiOxIKAAA____IO.Compression.CompressionMode_Decompress____Text.Encoding_::unicode__.ReadToEnd______r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.reg.exe_add_HKLMSoftwarePoliciesMicrosoftWindowsOneDrive__v_DisableFileSyncNGSC__t_REG_DWORD__d_1__f___nul_2_1__reg.exe_delete_HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun__v_OneDriveSetup__f___nul_2_1_
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.reg_add__HKLMSoftwarePoliciesMicrosoftWindows_NTSystemRestore___v_DisableSR__t_REG_DWORD__d_1__f___nul_2_1_
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str._reg.exe_query_HKCUSoftwarePoliciesMicrosoftWindowsExplorer___nul_2_1__reg.exe_add_HKCUSoftwarePoliciesMicrosoftWindowsExplorer___nul_2_1___reg.exe_add_HKCUSoftwarePoliciesMicrosoftWindowsExplorer__v_DisableSearchBoxSuggestions__t_REG_DWORD__d_1__f___nul_2_1_
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.setx__m_MESA_GL_VERSION_OVERRIDE_4.6_nul__setx__m_MESA_GLES_VERSION_OVERRIDE_3.1_nul__setx__m_MESA_GLSL_VERSION_OVERRIDE_460_nul_
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, [rsi + 0x20]
lea rcx, [rbp + 0x298]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
nop
mov rax, qword [rbp + 0x298]
cmp dword [rax + 4], r12d
je 0x14012094e
lea r8d, [r12 - 1]
lea rdx, str.setx__m_MESA_RENDERER__
lea rcx, [rbp + 0x20]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x30], 0x223
lea rdx, [rbp + 0x298]
lea rcx, [rbp + 0x20]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x18]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x30], 0x623
lea r8d, [r12 - 1]
lea rdx, [0x1401b7eb8]
lea rcx, [rbp + 0x250]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp - 0x18]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x250]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp - 0x18]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x18]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov dword [rsp + 0x30], edi
lea rcx, [rbp + 0x20]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea r8d, [r12 - 1]
lea rdx, str.set_MESA_RENDERER
lea rcx, [rbp]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x30], 0x823
lea rdx, [rbp + 0x298]
lea rcx, [rbp]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp]
lea rcx, [rbp - 8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x30], 0x1823
lea r8d, [r12 - 1]
lea rdx, [0x1401b7ee0]
lea rcx, [rbp + 0x248]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp - 8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x248]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp - 8]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp - 8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov dword [rsp + 0x30], edi
lea rcx, [rbp]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 0xa], 0
je 0x140120aaa
lea rdx, str.echo_Installing_FakeGPS_r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.pushd__MY_VBOX_ADDITIONS_etcFakeGPS____setlocal_enabledelayedexpansion__devcon_install_bcmgnssd_bcmgnssd.inf_root_bcmgnssd___nul____for__f___i_in__devcon_find_root_bcmgnssd__find__ROOT___do__set_GNSSREGPATH_HKLMSYSTEMCurrentControlSetEnum__iDevice_Parameters__
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
mov edx, 0x3b
lea rcx, str.reg_add__GNSSREGPATH___v_Lat__t_REG_DWORD__d__1__f___nul_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x198], rax
mov dl, 0x20
lea rcx, [rbp + 0x2a8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov r8d, dword [rsi + 0x60]
xor r8d, 0x5f3759df
mov word [rsp + 0x28], ax
mov dword [rsp + 0x20], 0xa
xor r9d, r9d
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0x198]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_unsigned_int__int__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x240]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x198]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov edx, 0x3c
lea rcx, str.reg_add__GNSSREGPATH___v_Long__t_REG_DWORD__d__1__f___nul_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1e0], rax
mov dl, 0x20
lea rcx, [rbp + 0x98]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov r8d, dword [rsi + 0x64]
xor r8d, 0x5f3759df
mov word [rsp + 0x28], ax
mov dword [rsp + 0x20], 0xa
xor r9d, r9d
lea rdx, [rbp + 0x238]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_unsigned_int__int__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x238]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, str.reg_add_HKLMSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStorelocation__v_Value__t_REG_SZ__d_Allow__f___nul__reg_add_HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStorelocation__v_Value__t_REG_SZ__d_Allow__f___nul
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.____endlocal___popd_r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
mov edx, 0x8b
lea rcx, str.xcopy__e__y__i__MY_VBOX_ADDITIONS_etcBurntToast___userprofile_DocumentsWindowsPowerShellmodulesBurntToast____nul__timeout_2___nul_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1a8], rax
lea rdx, [rbp + 0x1a8]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x1a8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 0xe], 0
je 0x140120b0d
lea rdx, str.pushd__MY_VBOX_ADDITIONS_etcFonts__powershell__encodedCommand_QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwANAAoARgBvAHIARQBhAGMAaAAoACQAZgBvAG4AdABkAGkAcgAgAGkAbgAgAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAtAEQAaQByAGUAYwB0AG8AcgB5ACkADQAKAHsADQAKACAAIAAgACAAJABmAG8AbgB0AHMAIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACIAJABmAG8AbgB0AGQAaQByAFwAKgAiACAALQBJAG4AYwBsAHUAZABlACAAJwAqAC4AdAB0AGYAJwAsACcAKgAuAG8AdABmACcAIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAAewBHAGUAdAAtAFIAYQBuAGQAbwBtAH0AIAB8ACAAUwBlAGwAZQBjAHQAIAAtAEYAaQByAHMAdAAgACgARwBlAHQALQBSAGEAbgBkAG8AbQAgACAALQBNAGkAbgAgADEAMAAgAC0ATQBhAHgAIAAyADAAKQANAAoAIAAgACAAIABGAG8AcgBFAGEAYwBoACgAJABmAG8AbgB0AGYAaQBsAGUAIABpAG4AIAAkAGYAbwBuAHQAcwApAA0ACgAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGYAbwBuAHQAQwBvAGwAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBUAGUAeAB0AC4AUAByAGkAdgBhAHQAZQBGAG8AbgB0AEMAbwBsAGwAZQBjAHQAaQBvAG4AXQA6ADoAbgBlAHcAKAApAA0ACgAgACAAIAAgACAAIAAgACAAJABmAG8AbgB0AEMAbwBsAC4AQQBkAGQARgBvAG4AdABGAGkAbABlACgAJABmAG8AbgB0AGYAaQBsAGUAKQANAAoAIAAgACAAIAAgACAAIAAgACQAZgBvAG4AdABuAGEAbQBlACAAPQAgAFsAUwB0AHIAaQBuAGcAWwBdAF0AJABmAG8AbgB0AEMAbwBsAC4ARgBhAG0AaQBsAGkAZQBzAC4ATgBhAG0AZQANAAoAIAAgACAAIAAgACAAIAAgACQAZgBvAG4AdABDAG8AbAAuAEQAaQBzAHAAbwBzAGUAKAApAA0ACgAgACAAIAAgACAAIAAgACAAaQBmACgAJABmAG8AbgB0AG4AYQBtAGUAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGYAbwBuAHQAZgBpAGwAZQAyACAAPQAgACQAZgBvAG4AdABmAGkAbABlAC4ATgBhAG0AZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYwBtAGQAcwB0AHIAIAA9ACAAIgBjAG8AcAB5ACAALwB5ACAAIgAiACQAZgBvAG4AdABmAGkAbABlACIAIgAgACUAVwBJAE4ARABJAFIAJQBcAEYAbwBuAHQAcwAgAD4AIABuAHUAbAAgADIAPgAmADEAIAAmACYAIAByAGUAZwAgAGEAZABkACAAIgAiAEgASwBMAE0AXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABOAFQAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABGAG8AbgB0AHMAIgAiACAALwB2ACAAIgAiACQAZgBvAG4AdABuAGEAbQBlACAAKABUAHIAdQBlAFQAeQBwAGUAKQAiACIAIAAvAHQAIABSAEUARwBfAFMAWgAgAC8AZAAgACIAIgAkAGYAbwBuAHQAZgBpAGwAZQAyACIAIgAgAC8AZgAgAD4AIABuAHUAbAAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAJABjAG0AZABzAHQAcgAgAHwAIABjAG0AZAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQANAAoAfQANAAoA___nul__popd_r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.pushd__MY_VBOX_ADDITIONS_etcFonts__cd_Glyphs__powershell__encodedCommand_JABmAG8AbgB0AHMAIAA9ACAAQAAoACkAOwAgAEYAbwByAEUAYQBjAGgAKAAkAGYAbwBuAHQAZABpAHIAIABpAG4AIABHAGUAdAAtAEMAaABpAGwAZABJAHQAZQBtACAALQBEAGkAcgBlAGMAdABvAHIAeQApACAAewAgACQAZgBvAG4AdABzACAAKwA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACIAJABmAG8AbgB0AGQAaQByAFwAKgAiACAAfAAgACUAewAkAF8ALgBGAHUAbABsAE4AYQBtAGUAfQAgAH0ADQAKACQAZgBvAG4AdABzACAAPQAgACQAZgBvAG4AdABzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAdAAgAHsARwBlAHQALQBSAGEAbgBkAG8AbQB9ACAAfAAgAFMAZQBsAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAoAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAgAC0ATQBpAG4AIAAwACAALQBNAGEAeAAgACgAJABmAG8AbgB0AHMALgBMAGUAbgBnAHQAaAArADEAKQApAA0ACgBGAG8AcgBFAGEAYwBoACgAJABmAG8AbgB0ACAAaQBuACAAJABmAG8AbgB0AHMAKQANAAoAewANAAoACQAkAGYAbwBuAHQAZgBpAGwAZQAgAD0AIABTAHAAbABpAHQALQBQAGEAdABoACAAJABmAG8AbgB0ACAALQBsAGUAYQBmAA0ACgAJACQAYwBtAGQAcwB0AHIAIAA9ACAAIgB0AGEAawBlAG8AdwBuACAALwBGACAAIgAiACUAdwBpAG4AZABpAHIAJQBcAEYAbwBuAHQAcwBcACQAZgBvAG4AdABmAGkAbABlACIAIgAgAD4AIABuAHUAbAAgADIAPgAmADEAIAAmACYAIABpAGMAYQBjAGwAcwAgACIAIgAlAHcAaQBuAGQAaQByACUAXABGAG8AbgB0AHMAXAAkAGYAbwBuAHQAZgBpAGwAZQAiACIAIAAvAGcAcgBhAG4AdAAgACIAIgAlAHUAcwBlAHIAbgBhAG0AZQAlACIAIgA6AEYAIAAACAAbgB1AGwAIAAyAD4AJgAxACAAJgAmACAAYwBvAHAAeQAgAC8AeQAgACIAIgAkAGYAbwBuAHQAIgAiACAAJQB3AGkAbgBkAGkAcgAlAFwARgBvAG4AdABzAFwAIAAACAAbgB1AGwAIAAyAD4AJgAxACIADQAKAAkAJABjAG0AZABzAHQAcgAgAHwAIABjAG0AZAANAAoAfQA___nul__popd_r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
cmp byte [rsi + 0xb], 0
je 0x140120bc1
movdqa xmm0, xmmword [0x1401ce810]
movdqu xmmword [rbp + 0x6e0], xmm0
mov dword [rbp + 0x6f0], 0x2b110
mov edx, 4
xor ecx, ecx
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov eax, eax
mov ebx, dword [rbp + rax*4 + 0x6e0]
mov edx, 0x62
lea rcx, str._MY_VBOX_ADDITIONS_etcSoundVolumeViewSoundVolumeView.exe__SetDefaultFormat__Speakers__16__1_2_r_n
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1b0], rax
mov dl, 0x20
lea rcx, [rbp - 0x10]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x28], ax
mov dword [rsp + 0x20], 0xa
xor r9d, r9d
mov r8d, ebx
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_int__int__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x230]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 0xf], 0
je 0x140120ceb
mov edx, 0x639c956b
mov ecx, 0x615c59c1
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov ebx, eax
mov edx, 0x68
lea rcx, str.reg_ADD__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersion___v_InstallDate__t_REG_DWORD__d__1__f___nul_r_n
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x210], rax
mov dl, 0x20
lea rcx, [rbp + 0x9c]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x28], ax
mov dword [rsp + 0x20], 0xa
xor r9d, r9d
mov r8d, ebx
lea rdx, [rbp + 0x2a0]
lea rcx, [rbp + 0x210]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_unsigned_int__int__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x210]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
movabs rax, 0x2b6109100
add rax, rbx
imul rbx, rax, 0x989680
mov edx, 0x68
lea rcx, str.reg_ADD__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersion___v_InstallTime__t_REG_QWORD__d__1__f___nul_r_n
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x218], rax
mov dl, 0x20
lea rcx, [rbp + 0x9e]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x28], ax
mov dword [rsp + 0x20], 0xa
xor r9d, r9d
mov r8, rbx
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 0x218]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_unsigned_long_long_unsigned___int64___int__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x290]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x218]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, str.call__MY_VBOX_ADDITIONS_etc_network_test.cmd_
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
cmp byte [rsi + 0x14], 0
je 0x140120d15
lea rdx, str.powershell__encodedCommand_JABzAGUAcgB2AGUAcgBzACAAPQAgAEAAKAApADsAIAB0AHIAeQAgAHsAIAAkAHMAZQByAHYAZQByAHMAIAA9ACAAKABjAHUAcgBsACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AYQBuAHQAaQBkAGUAdABlAGMAdAAvAGwAaQBzAHQALwBtAGEAaQBuAC8AdABtAHgALQBkAG8AbQBhAGkAbgBzACkALgBDAG8AbgB0AGUAbgB0AC4AUwBwAGwAaQB0ACgAWwBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoATgBlAHcATABpAG4AZQAsACAAWwBTAHkAcwB0AGUAbQAuAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkAIAB9ACAAYwBhAHQAYwBoACAAewBXAHIAaQB0AGUALQBIAG8AcwB0ACAAJwBGAGEAaQBsAGUAZAAgAHQAbwAgAGQAbwB3AG4AbABvAGEAZAAgAFQAaAByAGUAYQB0AE0AZQB0AHIAaQB4ACAAcwBlAHIAdgBlAHIAcwAgAGwAaQBzAHQAJwA7ACAARQB4AGkAdAB9ADsAIAAkAHMAdAByACAAPQAgACcAJwA7ACAAZgBvAHIAZQBhAGMAaAAoACQAcwBlAHIAdgBlAHIAIABpAG4AIAAkAHMAZQByAHYAZQByAHMAKQAgAHsAJABzAHQAcgAgACsAPQAgACIAMAAuADAALgAwAC4AMAAgACQAcwBlAHIAdgBlAHIAYAByAGAAbgAiAH0AOwAgAEEAZABkAC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgB3AGkAbgBkAGkAcgBcAHMAeQBzAHQAZQBtADMAMgBcAGQAcgBpAHYAZQByAHMAXABlAHQAYwBcAGgAbwBzAHQAcwAgAC0AVgBhAGwAdQBlACAAJABzAHQAcgA7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACcAQgBsAG8AYwBrAGUAZAAnACAAJABzAGUAcgB2AGUAcgBzAC4ATABlAG4AZwB0AGgAIAAnAFQAaAByAGUAYQB0AE0AZQB0AHIAaQB4ACAAZABvAG0AYQBpAG4AcwAnAA_r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
cmp byte [rsi + 0x1d], 0
je 0x140120f68
mov edx, 0x2f
lea rcx, str.All_network_protocols_except_TCP__UDP_Blocked_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0xd8], rax
mov edx, 0xc
lea rcx, str.Antidetect_4
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0xd0], rax
mov edx, 9
lea rcx, str.logo2.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x228], rax
mov edx, 0x15
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x220], rax
mov dl, 0x20
lea rcx, [rbp + 0xa0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x228]
lea rdx, [rbp + 0x278]
lea rcx, [rbp + 0x220]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0xa2]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0xd0]
lea rdx, [rbp + 0x280]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0xa4]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0xd8]
lea rdx, [rbp + 0x288]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp + 0x10]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x30], 0x4023
mov rdx, rbx
lea rcx, [rbp + 0x10]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
mov edi, 0x2023
mov dword [rsp + 0x30], edi
lea rcx, [rbp + 0x288]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x280]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x278]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x220]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov r8d, 0xffffffff
lea rdx, str.netsh_advfirewall_firewall_delete_rule_all___nul__timeout_2___nul__netsh_advfirewall_set_allprofiles_firewallpolicy_blockinbound_blockoutbound___nul__netsh_advfirewall_firewall_add_rule_name_Allow_DNS_Outbound_TCP__dirout_actionallow_protocolTCP_remoteport53___nul__netsh_advfirewall_firewall_add_rule_name_Allow_DNS_Outbound_UDP__dirout_actionallow_protocolUDP_remoteport53___nul__netsh_advfirewall_firewall_add_rule_name_Allow_DNS_Inbound_TCP__dirin_actionallow_protocolTCP_remoteport53___nul__netsh_advfirewall_firewall_add_rule_name_Allow_DNS_Inbound_UDP__dirin_actionallow_protocolUDP_remoteport53___nul__netsh_advfirewall_firewall_add_rule_name_Allow_All_Outbound_TCP__dirout_actionallow_protocolTCP_localport0_65535_remoteport0_65535___nul__netsh_advfirewall_firewall_add_rule_name_Allow_All_Outbound_UDP__dirout_actionallow_protocolUDP_localport0_65535_remoteport0_65535___nul__netsh_advfirewall_firewall_add_rule_name_Allow_All_Inbound_TCP__dirin_actionallow_protocolTCP_localport0_65535_remoteport0_65535___nul__netsh_advfirewall_firewall_add_rule_name_Allow_All_Inbound_UDP__dirin_actionallow_protocolUDP_localport0_65535_remoteport0_65535___nul__netsh_advfirewall_firewall_add_rule_name_Block_Inbound_Local_Subnet__dirin_actionblock_remoteip192.168.0.0_16___nul__netsh_advfirewall_firewall_add_rule_name_Block_Outbound_Local_Subnet__dirout_actionblock_remoteip192.168.0.0_16___nul__netsh_advfirewall_firewall_add_rule_name_Allow_NTP_Outbound__dirout_actionallow_protocolUDP_remoteport123___nul__netsh_advfirewall_firewall_add_rule_name_Block_8.8.8.8__dirout_interfaceany_actionblock_remoteip8.8.8.8___nul__netsh_advfirewall_firewall_add_rule_name_Block_8.8.4.4__dirout_interfaceany_actionblock_remoteip8.8.4.4___nul__netsh_advfirewall_firewall_add_rule_name_Block_Local_Network_10.x.x.x__dirout_interfaceany_actionblock_remoteip10.0.0.0_10.255.255.255___nul__netsh_advfirewall_firewall_add_rule_name_Block_Multicast_Network_224.x.x.x__dirout_interfaceany_actionblock_remoteip224.0.0.0_224.255.255.255___nul__netsh_advfirewall_firewall_add_rule_name_Block_Multicast_Network_239.x.x.x__dirout_interfaceany_actionblock_remoteip239.0.0.0_239.255.255.255___nul__netsh_advfirewall_firewall_add_rule_name_Block_IPv6_Link_local_Inbound__dirin_actionblock_protocolany_remoteipfe80::_10___nul__netsh_advfirewall_firewall_add_rule_name_Block_IPv6_Link_local_Outbound__dirout_actionblock_protocolany_remoteipfe80::_10___nul__netsh_advfirewall_firewall_add_rule_name_Block_IPv6_Multicast_Inbound__dirin_actionblock_protocolany_remoteipff02::_16___nul__netsh_advfirewall_firewall_add_rule_name_Block_IPv6_Multicast_Outbound__dirout_actionblock_protocolany_remoteipff02::_16___nul_
lea rcx, [rbp + 0x28]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x30], 0xa023
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x28]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x30], 0x1a023
mov r8d, 0xffffffff
lea rdx, str.__timeout_5___nul_r_n
lea rcx, [rbp + 0x270]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x270]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 8]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov dword [rsp + 0x30], edi
lea rcx, [rbp + 0x28]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x10]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x228]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xd0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xd8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 0x1c], 0
je 0x140120f80
lea rdx, str.echo_Installing_FakeWebRTC_xcopy__e__y__i__MY_VBOX_ADDITIONS_etcFakeWebRTC___programfiles_FakeWebRTC____nul__call___programfiles_FakeWebRTCdnscrypt_proxy_service_install.bat____nul_2_1__powershell__function_setRunAsAdmin__lnk__bytes___System.IO.File_::ReadAllBytes__lnk____bytes_0x15____bytes_0x15___bor_0x20___System.IO.File_::WriteAllBytes__lnk___bytes____start_userprofile_DesktopStart_FakeWebRTC.lnk___s_New_Object__COM_WScript.Shell_.CreateShortcut__start___s.TargetPathpowershell__s.Arguments_File____char_34___programfiles_FakeWebRTC_fake_webrtc_start.ps1___char_34__s.Save____setRunAsAdmin__start____stop_userprofile_DesktopStop_FakeWebRTC.lnk___s_New_Object__COM_WScript.Shell_.CreateShortcut__stop___s.TargetPathpowershell__s.Arguments_File____char_34___programfiles_FakeWebRTC_fake_webrtc_stop.ps1___char_34__s.Save____setRunAsAdmin__stop___r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.powershell__encodedCommand_JABsAGkAcwB0ACAAPQAgACgAYwB1AHIAbAAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAIABoAHQAdABwAHMAOgAvAC8AcgBhAHcALgBnAGkAdABoAHUAYgB1AHMAZQByAGMAbwBuAHQAZQBuAHQALgBjAG8AbQAvAGEAbgB0AGkAZABlAHQAZQBjAHQALwBsAGkAcwB0AC8AbQBhAGkAbgAvAHQAZQBzAHQAMgApAC4AQwBvAG4AdABlAG4AdAAuAFMAcABsAGkAdAAoAFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AE4AZQB3AEwAaQBuAGUALAAgAFsAUwB5AHMAdABlAG0ALgBTAHQAcgBpAG4AZwBTAHAAbABpAHQATwBwAHQAaQBvAG4AcwBdADoAOgBSAGUAbQBvAHYAZQBFAG0AcAB0AHkARQBuAHQAcgBpAGUAcwApADsAIAAkAHAAYQByAGEAbQBzACAAPQAgACIAYQBkAHYAZgBpAHIAZQB3AGEAbABsACAAZgBpAHIAZQB3AGEAbABsACAAYQBkAGQAIAByAHUAbABlACAAbgBhAG0AZQA9AEcAZQBuAGUAcgBpAGMAQgBsAG8AYwBrACAAZABpAHIAPQBvAHUAdAAgAGEAYwB0AGkAbwBuAD0AYgBsAG8AYwBrACAAcgBlAG0AbwB0AGUAaQBwAD0AIgAgACsAIABbAHMAeQBzAHQAZQBtAC4AUwB0AHIAaQBuAGcAXQA6ADoASgBvAGkAbgAoACIALAAiACwAIAAkAGwAaQBzAHQAKQA7ACAAJgAgACIAbgBlAHQAcwBoAC4AZQB4AGUAIgAgACQAcABhAHIAYQBtAHMALgBTAHAAbABpAHQAKAAiACAAIgApAA___nul_r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
cmp byte [rsi + 0x10], 0
je 0x1401211eb
mov edx, 0x11
lea rcx, str.IPv6_leak_Blocked
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x100], rax
mov edx, 0xc
lea rcx, str.Antidetect_4
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0xf8], rax
mov edx, 9
lea rcx, str.logo2.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0xf0], rax
mov edx, 0x15
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0xe0], rax
mov dl, 0x20
lea rcx, [rbp + 0xa6]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0xf0]
lea rdx, [rbp + 0x300]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0xa8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0xf8]
lea rdx, [rbp + 0x260]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x40]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x100]
lea rdx, [rbp + 0x268]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp + 0x30]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts edi, 0x12
mov dword [rsp + 0x30], edi
mov rdx, rbx
lea rcx, [rbp + 0x30]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr edi, 0x12
bts edi, 0x11
mov dword [rsp + 0x30], edi
lea rcx, [rbp + 0x268]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x260]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x300]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xe0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov r8d, 0xffffffff
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_41__actionblock_protocol41_dirout___nul__netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_43__actionblock_protocol43_dirout___nul__netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_44__actionblock_protocol44_dirout___nul__netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_58__actionblock_protocol58_dirout___nul__netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_59__actionblock_protocol59_dirout___nul__netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_60__actionblock_protocol60_dirout___nul__netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_41__actionblock_protocol41_dirin___nul__netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_43__actionblock_protocol43_dirin___nul__netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_44__actionblock_protocol44_dirin___nul__netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_58__actionblock_protocol58_dirin___nul__netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_59__actionblock_protocol59_dirin___nul__netsh_advfirewall_firewall_add_rule_name_IPv6_protocol_60__actionblock_protocol60_dirin___nul_
lea rcx, [rbp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts edi, 0x13
mov dword [rsp + 0x30], edi
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x18]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
bts edi, 0x14
mov dword [rsp + 0x30], edi
mov r8d, 0xffffffff
lea rdx, str.__timeout_5___nul_r_n
lea rcx, [rbp + 0x308]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x18]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x308]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0x18]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr edi, 0x14
lea rcx, [rbp + 0x18]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
btr edi, 0x13
mov dword [rsp + 0x30], edi
lea rcx, [rbp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x30]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xf0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xf8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x100]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 0x11], 0
je 0x140121203
lea rdx, [rbp + 0x3c0]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
cmp byte [rsi + 0x12], 0
je 0x140121477
mov edx, 0x1a
lea rcx, str.DNS_over_QUIC_Leak_Blocked
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x200], rax
mov edx, 0xc
lea rcx, str.Antidetect_4
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1f0], rax
mov edx, 9
lea rcx, str.logo2.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1e8], rax
mov edx, 0x15
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x108], rax
mov dl, 0x20
lea rcx, [rbp - 0x3e]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x1e8]
lea rdx, [rbp + 0x320]
lea rcx, [rbp + 0x108]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x3c]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x1f0]
lea rdx, [rbp + 0x318]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x3a]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x200]
lea rdx, [rbp + 0x310]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts edi, 0x16
mov dword [rsp + 0x30], edi
mov rdx, rbx
lea rcx, [rbp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr edi, 0x16
bts edi, 0x15
mov dword [rsp + 0x30], edi
lea rcx, [rbp + 0x310]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x318]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x320]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x108]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov edx, 0xf3
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_DNS_QUIC_UDP_Block__protocoludp_remoteport80_443_dirout_actionblock___nul__netsh_advfirewall_firewall_add_rule_name_DNS_QUIC_UDP_Block__protocoludp_remoteport80_443_dirin_actionblock___nul_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1a0], rax
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x40]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
bts edi, 0x17
mov dword [rsp + 0x30], edi
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x40]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
bts edi, 0x18
mov dword [rsp + 0x30], edi
mov r8d, 0xffffffff
lea rdx, str.__timeout_5___nul_r_n
lea rcx, [rbp + 0x328]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x328]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0x38]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr edi, 0x18
lea rcx, [rbp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
btr edi, 0x17
mov dword [rsp + 0x30], edi
lea rcx, [rbp + 0x40]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1e8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x200]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 0x15], 0
je 0x1401216d6
mov edx, 0x1e
lea rcx, str.Windows_Telemetry_leak_Blocked
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x128], rax
mov edx, 0xc
lea rcx, str.Antidetect_4
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x120], rax
mov edx, 9
lea rcx, str.logo2.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x118], rax
mov edx, 0x15
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x110], rax
mov dl, 0x20
lea rcx, [rbp - 0x38]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x118]
lea rdx, [rbp + 0x340]
lea rcx, [rbp + 0x110]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x36]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x120]
lea rdx, [rbp + 0x338]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x34]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x128]
lea rdx, [rbp + 0x330]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp + 0xb0]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts edi, 0x1a
mov dword [rsp + 0x30], edi
mov rdx, rbx
lea rcx, [rbp + 0xb0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr edi, 0x1a
bts edi, 0x19
mov dword [rsp + 0x30], edi
lea rcx, [rbp + 0x330]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x338]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x340]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x110]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov r8d, 0xffffffff
lea rdx, str.netsh_advfirewall_firewall_add_rule_name_telemetry_vortex.data.microsoft.com__dirout_actionblock_remoteip191.232.139.254_enableyes___nul___netsh_advfirewall_firewall_add_rule_name_telemetry_telecommand.telemetry.microsoft.com__dirout_actionblock_remoteip65.55.252.92_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_oca.telemetry.microsoft.com__dirout_actionblock_remoteip65.55.252.63_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_sqm.telemetry.microsoft.com__dirout_actionblock_remoteip65.55.252.93_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_watson.telemetry.microsoft.com__dirout_actionblock_remoteip65.55.252.43_65.52.108.29_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_redir.metaservices.microsoft.com__dirout_actionblock_remoteip194.44.4.200_194.44.4.208_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_choice.microsoft.com__dirout_actionblock_remoteip157.56.91.77_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_df.telemetry.microsoft.com__dirout_actionblock_remoteip65.52.100.7_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_reports.wes.df.telemetry.microsoft.com__dirout_actionblock_remoteip65.52.100.91_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_wes.df.telemetry.microsoft.com__dirout_actionblock_remoteip65.52.100.93_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_services.wes.df.telemetry.microsoft.com__dirout_actionblock_remoteip65.52.100.92_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_sqm.df.telemetry.microsoft.com__dirout_actionblock_remoteip65.52.100.94_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_telemetry.microsoft.com__dirout_actionblock_remoteip65.52.100.9_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_watson.ppe.telemetry.microsoft.com__dirout_actionblock_remoteip65.52.100.11_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_telemetry.appex.bing.net__dirout_actionblock_remoteip168.63.108.233_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_telemetry.urs.microsoft.com__dirout_actionblock_remoteip157.56.74.250_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_settings_sandbox.data.microsoft.com__dirout_actionblock_remoteip111.221.29.177_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_vortex_sandbox.data.microsoft.com__dirout_actionblock_remoteip64.4.54.32_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_survey.watson.microsoft.com__dirout_actionblock_remoteip207.68.166.254_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_watson.live.com__dirout_actionblock_remoteip207.46.223.94_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_watson.microsoft.com__dirout_actionblock_remoteip65.55.252.71_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_statsfe2.ws.microsoft.com__dirout_actionblock_remoteip64.4.54.22_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_corpext.msitadfs.glbdns2.microsoft.com__dirout_actionblock_remoteip131.107.113.238_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_compatexchange.cloudapp.net__dirout_actionblock_remoteip23.99.10.11_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_cs1.wpc.v0cdn.net__dirout_actionblock_remoteip68.232.34.200_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_a_0001.a_msedge.net__dirout_actionblock_remoteip204.79.197.200_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_statsfe2.update.microsoft.com.akadns.net__dirout_actionblock_remoteip64.4.54.22_enableyes___nul__netsh_advfirewall_firewall_add_rule_name_telemetry_sls.update.microsoft.com.akadns.net__dirout_actionblock_remoteip157.56.77.139_enableyes___nul__netsh_advfirew
lea rcx, [rbp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts edi, 0x1b
mov dword [rsp + 0x30], edi
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x58]
lea rcx, [rbp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
bts edi, 0x1c
mov dword [rsp + 0x30], edi
mov r8d, 0xffffffff
lea rdx, str.__timeout_5___nul_r_n
lea rcx, [rbp + 0x348]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x348]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr edi, 0x1c
lea rcx, [rbp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
btr edi, 0x1b
mov dword [rsp + 0x30], edi
lea rcx, [rbp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xb0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x118]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x120]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x128]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 0x13], 0
je 0x140121950
mov edx, 0xe
lea rcx, str.Akamai_Blocked
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1b8], rax
mov edx, 0xc
lea rcx, str.Antidetect_4
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0xe8], rax
mov edx, 9
lea rcx, str.logo2.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x140], rax
mov edx, 0x15
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x130], rax
mov dl, 0x20
lea rcx, [rbp - 0x32]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x140]
lea rdx, [rbp + 0x360]
lea rcx, [rbp + 0x130]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x30]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0xe8]
lea rdx, [rbp + 0x358]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x2e]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x1b8]
lea rdx, [rbp + 0x350]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts edi, 0x1e
mov dword [rsp + 0x30], edi
mov rdx, rbx
lea rcx, [rbp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr edi, 0x1e
bts edi, 0x1d
mov dword [rsp + 0x30], edi
lea rcx, [rbp + 0x350]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x358]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x360]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x130]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov edx, 0x51
lea rcx, str.type__MY_VBOX_ADDITIONS_etc_akamai.txt_____windir__system32driversetchosts_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x138], rax
lea rdx, [rbp + 0x138]
lea rcx, [rbp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
or edi, 0x80000000
mov dword [rsp + 0x30], edi
lea rdx, [rbp + 0x78]
lea rcx, [rbp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x34], 1
mov r8d, 0xffffffff
lea rdx, str.__timeout_1___nul_r_n
lea rcx, [rbp + 0x368]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x368]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0x68]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
mov r14d, r12d
mov dword [rsp + 0x34], r12d
lea rcx, [rbp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
btr edi, 0x1f
mov dword [rsp + 0x30], edi
lea rcx, [rbp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x138]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x140]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xe8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1b8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 0x16], 0
je 0x140121bc0
mov edx, 0x14
lea rcx, str.NetBios_Leak_Blocked
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1d8], rax
mov edx, 0xc
lea rcx, str.Antidetect_4
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1d0], rax
mov edx, 9
lea rcx, str.logo2.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1c8], rax
mov edx, 0x15
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1c0], rax
mov dl, 0x20
lea rcx, [rbp + 0x9a]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x1c8]
lea rdx, [rbp + 0x380]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x2c]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x1d0]
lea rdx, [rbp + 0x378]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x2a]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x1d8]
lea rdx, [rbp + 0x370]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp + 0x90]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x34], 4
mov rdx, rbx
lea rcx, [rbp + 0x90]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
mov r14d, 2
mov dword [rsp + 0x34], r14d
lea rcx, [rbp + 0x370]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x378]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x380]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea r8d, [r14 - 3]
lea rdx, str.net_stop_lmhosts___nul__timeout_5___nul__net_stop_netbt___nul__timeout_5___nul__sc_config_netbt_start_disabled___nul__sc_config_lmhosts_start_disabled___nul_
lea rcx, [rbp + 0x88]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x34], 0xa
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x88]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x80]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x34], 0x1a
lea r8d, [r14 - 3]
lea rdx, str.__timeout_5___nul_r_n
lea rcx, [rbp + 0x388]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x80]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x388]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x80]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov dword [rsp + 0x34], r14d
lea rcx, [rbp + 0x88]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x90]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1c8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1d8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 0x17], 0
je 0x140121d0b
lea rcx, [rbp - 0x58]
call fcn.140125910
nop
mov edx, 7
lea ecx, [rdx - 4]
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov r14d, eax
mov edi, r12d
nop dword [rax + rax]
lea rcx, [rbp - 0x58]
call qword [sym.imp.Qt5Core.dll_public:_int___cdecl_QListData::size_void_const___ptr64]
cmp r14d, eax
jg 0x140121c04
mov eax, r14d
jmp 0x140121c0e
lea rcx, [rbp - 0x58]
call qword [sym.imp.Qt5Core.dll_public:_int___cdecl_QListData::size_void_const___ptr64]
cmp edi, eax
jge 0x140121cdd
mov edx, 0x7c
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_Antidetect_OpenLocalPort__1__protocoltcp_localport_1_dirin_actionallow___nul_r_n
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x400], rax
mov dl, 0x20
lea rcx, [rbp + 0x2aa]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov rax, qword [rbp - 0x58]
mov ecx, dword [rax]
cmp ecx, 1
jbe 0x140121c5c
mov rax, qword [rbp - 0x58]
mov edx, dword [rax + 4]
lea rcx, [rbp - 0x58]
call fcn.14001ec20
mov edx, edi
lea rcx, [rbp - 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void____ptr64____ptr64___cdecl_QListData::at_int_const___ptr64]
mov r8d, 0xa
mov edx, dword [rax]
lea rcx, [rbp + 0x518]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::number_int__int_]
nop
mov word [rsp + 0x20], bx
xor r9d, r9d
mov r8, rax
lea rdx, [rbp + 0x508]
lea rcx, [rbp + 0x400]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x508]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x518]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x400]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
inc edi
jmp 0x140121bf0
mov rax, qword [rbp - 0x58]
mov ecx, dword [rax]
test ecx, ecx
je 0x140121cfb
cmp ecx, 0xffffffff
je 0x140121d06
mov rax, qword [rbp - 0x58]
lock add dword [rax], 0xffffffff
setne al
test al, al
jne 0x140121d06
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.Qt5Core.dll_public:_static_void___cdecl_QListData::dispose_struct_QListData::Data____ptr64_]
nop
mov r14d, dword [rsp + 0x34]
lea rdx, [rsi + 0x28]
lea rcx, [rbp + 0x1f8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
nop
mov rax, qword [rbp + 0x1f8]
cmp dword [rax + 4], 0
je 0x140121ec1
mov r8d, 0xffffffff
lea rdx, str._for__f__tokens1_2_3____i_in__netsh_int_show_interface__do___r_n___netsh_int_ipv4_set_dns_name___l__static
lea rcx, [rbp + 0x2c8]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
or r14d, 0x20
mov dword [rsp + 0x34], r14d
lea rdx, [rbp + 0x1f8]
lea rcx, [rbp + 0x2c8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x2c8]
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
or r14d, 0x40
mov dword [rsp + 0x34], r14d
mov r8d, 0xffffffff
lea rdx, str._primary_validateno_nul_r_n_____ipconfig__flushdns_
lea rcx, [rbp + 0x520]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x520]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0x2c0]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
and r14d, 0xffffffbf
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
and r14d, 0xffffffdf
mov dword [rsp + 0x34], r14d
lea rcx, [rbp + 0x2c8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov r8d, 0xffffffff
lea rdx, str.___userprofile_DesktopCheckWebRTC.cmd____echo__echo_off_r_necho_powershell___Invoke_WebRequest__UseBasicParsing_http:__
lea rcx, [rbp + 0x2d8]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts r14d, 7
mov dword [rsp + 0x34], r14d
lea rdx, [rbp + 0x1f8]
lea rcx, [rbp + 0x2d8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x2d8]
lea rcx, [rbp + 0x2d0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
bts r14d, 8
mov dword [rsp + 0x34], r14d
mov r8d, 0xffffffff
lea rdx, str._rtc.php_.Content__r_necho_timeout_10___
lea rcx, [rbp + 0x410]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x2d0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x410]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0x2d0]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr r14d, 8
lea rcx, [rbp + 0x2d0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
btr r14d, 7
mov dword [rsp + 0x34], r14d
lea rcx, [rbp + 0x2d8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rsi + 0x30]
lea rcx, [rbp + 0xc8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rsi + 0x38]
lea rcx, [rbp + 0xb8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rsi + 0x40]
lea rcx, [rbp + 0x258]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rsi + 0x48]
lea rcx, [rbp + 0xc0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rsi + 0x50]
lea rcx, [rbp + 0x208]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
nop
mov rax, qword [rbp + 0x258]
cmp dword [rax + 4], 0
je 0x140122250
mov edx, 0x1a
lea rcx, str._programfiles_OpenVPN_bin
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x2e0], rax
mov edx, 0xe1
lea rcx, str.echo_Installing_VPN...__cd__d__MY_VBOX_ADDITIONS___for__r___i_in__OpenVPN__amd64.msi__do___start__wait_msiexec.exe__i____i___passive___mkdir___userprofile_OpenVPNconfig____nul__cd__d___userprofile_OpenVPNconfig__
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x408], rax
lea rdx, [rbp + 0x408]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x408]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov rax, qword [rbp + 0xc0]
cmp dword [rax + 4], 0
je 0x14012205b
mov rax, qword [rbp + 0x208]
cmp dword [rax + 4], 0
je 0x14012205b
mov edx, 0x28
lea rcx, str.__auth.txt_echo__1__auth.txt_echo__2
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x3a0], rax
mov dl, 0x20
lea rcx, [rbp + 0x2bc]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0xc0]
lea rdx, [rbp + 0x420]
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0x2ac]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x208]
lea rdx, [rbp + 0x418]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x418]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x420]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov edx, 0xf1
lea rcx, str.powershell___s_New_Object__COM_WScript.Shell_.CreateShortcut__appdata_MicrosoftWindowsStart_MenuProgramsStartupopenvpn.lnk___s.TargetPath_1openvpn_gui.exe__s.Arguments__connect_0001.ovpn__s.WorkingDirectory_1__s.Save____
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x3a8], rax
mov dl, 0x20
lea rcx, [rbp + 0x2ae]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x2e0]
lea rdx, [rbp + 0x428]
lea rcx, [rbp + 0x3a8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x428]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x3a8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov edx, 8
lea rcx, str.https:__
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x3b0], rax
mov r8d, 1
lea rdx, [rbp + 0x3b0]
lea rcx, [rbp + 0x258]
call qword [sym.imp.Qt5Core.dll_public:_bool___cdecl_QString::startsWith_class_QString_const____ptr64__enum_Qt::CaseSensitivity_const___ptr64]
movzx ebx, al
lea rcx, [rbp + 0x3b0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov edx, 0x38
test bl, bl
je 0x140122190
lea rcx, str.powershell__Invoke_WebRequest__1__OutFile_0001.ovpn___
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x3b8], rax
mov dl, 0x20
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x258]
lea rdx, [rbp + 0x430]
lea rcx, [rbp + 0x3b8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x430]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x3b8]
jmp 0x1401221be
lea rcx, str.copy__MY_VBOX_ADDITIONS_.._vpn_config.ovpn_0001.ovpn_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x3c8], rax
lea rdx, [rbp + 0x3c8]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x3c8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov edx, 0x4a
lea rcx, str.start__VPN____1openvpn_gui.exe____connect_0001.ovpn__timeout_15___nul_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x3d0], rax
mov dl, 0x20
lea rcx, [rbp + 0x2b2]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x2e0]
lea rdx, [rbp + 0x438]
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x438]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
jmp 0x1401226ce
mov rax, qword [rbp + 0xc8]
cmp dword [rax + 4], 0
je 0x140122686
mov rax, qword [rbp + 0xb8]
cmp dword [rax + 4], 0
je 0x140122686
lea rdx, [rbp + 0x1f8]
lea rcx, [rbp - 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
nop
mov rax, qword [rbp - 0x50]
cmp dword [rax + 4], 0
jne 0x1401222b7
lea rdx, [rsi + 0x58]
lea rcx, [rbp - 0x50]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::operator_class_QString_const____ptr64____ptr64]
mov rax, qword [rbp - 0x50]
cmp dword [rax + 4], 0
jne 0x1401222b7
lea rdx, str.1.1.1.1_1.0.0.1
lea rcx, [rbp - 0x50]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::operator_char_const____ptr64____ptr64]
lea rdx, str.xcopy__e__y__i__MY_VBOX_ADDITIONS_Tools_tun2socks___userprofile_Desktop_tun2socks____nul__timeout_2___nul_r_npushd___userprofile_Desktop_tun2socks__r_ndel__f__q_start.bat___nul_r_n__start.bat_echo__echo_off__start.bat_echo_pushd____dp0__r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
mov rax, qword [rbp + 0xc0]
cmp dword [rax + 4], 0
jne 0x140122457
mov edx, 0x83
lea rcx, str.__start.bat_echo_tun2socks.exe___dns_addresses_3___product_modeno___proxyserver_1___proxyport_2___proxyuser___proxypassword_r_n
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x3e0], rax
movsxd rbx, dword [rax + 4]
lea rcx, [rbp + 0x3e0]
call qword [sym.imp.Qt5Core.dll_public:_class_QChar_const____ptr64___cdecl_QString::data_void_const___ptr64]
mov qword [rbp + 0x560], rbx
mov qword [rbp + 0x568], rax
mov rax, qword [rbp - 0x50]
movsxd rbx, dword [rax + 4]
lea rcx, [rbp - 0x50]
call qword [sym.imp.Qt5Core.dll_public:_class_QChar_const____ptr64___cdecl_QString::data_void_const___ptr64]
mov qword [rbp + 0x530], rbx
mov qword [rbp + 0x538], rax
mov byte [rbp + 0x630], 2
movups xmm0, xmmword [rbp + 0x530]
movups xmmword [rbp + 0x638], xmm0
mov rax, qword [rbp + 0xb8]
movsxd rbx, dword [rax + 4]
lea rcx, [rbp + 0xb8]
call qword [sym.imp.Qt5Core.dll_public:_class_QChar_const____ptr64___cdecl_QString::data_void_const___ptr64]
mov qword [rbp + 0x540], rbx
mov qword [rbp + 0x548], rax
mov byte [rbp + 0x618], 2
movups xmm0, xmmword [rbp + 0x540]
movups xmmword [rbp + 0x620], xmm0
mov rax, qword [rbp + 0xc8]
movsxd rbx, dword [rax + 4]
lea rcx, [rbp + 0xc8]
call qword [sym.imp.Qt5Core.dll_public:_class_QChar_const____ptr64___cdecl_QString::data_void_const___ptr64]
mov qword [rbp + 0x550], rbx
mov qword [rbp + 0x558], rax
mov byte [rbp + 0x600], 2
movups xmm0, xmmword [rbp + 0x550]
movups xmmword [rbp + 0x608], xmm0
lea rax, [rbp + 0x600]
mov qword [rbp + 0x6c0], rax
lea rax, [rbp + 0x618]
mov qword [rbp + 0x6c8], rax
lea rax, [rbp + 0x630]
mov qword [rbp + 0x6d0], rax
mov qword [rbp + 0x6d8], r12
movaps xmm0, xmmword [rbp + 0x560]
movdqa xmmword [rbp + 0x5e0], xmm0
lea r9, [rbp + 0x6c0]
mov r8d, 3
lea rdx, [rbp + 0x5e0]
lea rcx, [rbp + 0x3d8]
call qword [sym.imp.Qt5Core.dll_class_QString___cdecl_QtPrivate::argToQString_class_QStringView__unsigned_long_long_unsigned___int64___struct_QtPrivate::ArgBase_const____ptr64____ptr64_]
or r14d, 0xe00
mov dword [rsp + 0x34], r14d
lea rdx, [rbp + 0x3d8]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x3d8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x3e0]
jmp 0x140122661
mov edx, 0x87
lea rcx, str.__start.bat_echo_tun2socks.exe___dns_addresses_5___product_modeno___proxyserver_1___proxyport_2___proxyuser_3___proxypassword_4_r_n
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x3f8], rax
movsxd rbx, dword [rax + 4]
lea rcx, [rbp + 0x3f8]
call qword [sym.imp.Qt5Core.dll_public:_class_QChar_const____ptr64___cdecl_QString::data_void_const___ptr64]
mov qword [rbp + 0x5c0], rbx
mov qword [rbp + 0x5c8], rax
mov rax, qword [rbp - 0x50]
movsxd rbx, dword [rax + 4]
lea rcx, [rbp - 0x50]
call qword [sym.imp.Qt5Core.dll_public:_class_QChar_const____ptr64___cdecl_QString::data_void_const___ptr64]
mov qword [rbp + 0x570], rbx
mov qword [rbp + 0x578], rax
mov byte [rbp + 0x6a8], 2
movups xmm0, xmmword [rbp + 0x570]
movups xmmword [rbp + 0x6b0], xmm0
mov rax, qword [rbp + 0x208]
movsxd rbx, dword [rax + 4]
lea rcx, [rbp + 0x208]
call qword [sym.imp.Qt5Core.dll_public:_class_QChar_const____ptr64___cdecl_QString::data_void_const___ptr64]
mov qword [rbp + 0x580], rbx
mov qword [rbp + 0x588], rax
mov byte [rbp + 0x690], 2
movups xmm0, xmmword [rbp + 0x580]
movups xmmword [rbp + 0x698], xmm0
mov rax, qword [rbp + 0xc0]
movsxd rbx, dword [rax + 4]
lea rcx, [rbp + 0xc0]
call qword [sym.imp.Qt5Core.dll_public:_class_QChar_const____ptr64___cdecl_QString::data_void_const___ptr64]
mov qword [rbp + 0x590], rbx
mov qword [rbp + 0x598], rax
mov byte [rbp + 0x678], 2
movups xmm0, xmmword [rbp + 0x590]
movups xmmword [rbp + 0x680], xmm0
mov rax, qword [rbp + 0xb8]
movsxd rbx, dword [rax + 4]
lea rcx, [rbp + 0xb8]
call qword [sym.imp.Qt5Core.dll_public:_class_QChar_const____ptr64___cdecl_QString::data_void_const___ptr64]
mov qword [rbp + 0x5a0], rbx
mov qword [rbp + 0x5a8], rax
mov byte [rbp + 0x660], 2
movups xmm0, xmmword [rbp + 0x5a0]
movups xmmword [rbp + 0x668], xmm0
mov rax, qword [rbp + 0xc8]
movsxd rbx, dword [rax + 4]
lea rcx, [rbp + 0xc8]
call qword [sym.imp.Qt5Core.dll_public:_class_QChar_const____ptr64___cdecl_QString::data_void_const___ptr64]
mov qword [rbp + 0x5b0], rbx
mov qword [rbp + 0x5b8], rax
mov byte [rbp + 0x648], 2
movups xmm0, xmmword [rbp + 0x5b0]
movups xmmword [rbp + 0x650], xmm0
lea rax, [rbp + 0x648]
mov qword [rbp + 0x6f8], rax
lea rax, [rbp + 0x660]
mov qword [rbp + 0x700], rax
lea rax, [rbp + 0x678]
mov qword [rbp + 0x708], rax
lea rax, [rbp + 0x690]
mov qword [rbp + 0x710], rax
lea rax, [rbp + 0x6a8]
mov qword [rbp + 0x718], rax
mov qword [rbp + 0x720], r12
movaps xmm0, xmmword [rbp + 0x5c0]
movdqa xmmword [rbp + 0x5f0], xmm0
lea r9, [rbp + 0x6f8]
mov r8d, 5
lea rdx, [rbp + 0x5f0]
lea rcx, [rbp + 0x3e8]
call qword [sym.imp.Qt5Core.dll_class_QString___cdecl_QtPrivate::argToQString_class_QStringView__unsigned_long_long_unsigned___int64___struct_QtPrivate::ArgBase_const____ptr64____ptr64_]
or r14d, 0x7000
mov dword [rsp + 0x34], r14d
lea rdx, [rbp + 0x3e8]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x3e8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x3f8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, str.__start.bat_echo_popd_r_nstart____start.bat_r_npopd_r_necho_Waiting_for_tun2socks_to_start..._r_n:loop_r_ntimeout__t_1___nul_r_ntasklist__v__fi__imagename_eq_cmd.exe__find__VEthernet__tun2socks____nul__goto_:exitloop_r_ngoto_:loop_r_n:exitloop_r_necho_Waiting_for_tun2socks_to_connect..._r_ntimeout_10___nul_r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
nop
lea rcx, [rbp - 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
jmp 0x1401226ce
lea rdx, str.echo_Installing_VC__r_nstart__MY_VBOX_ADDITIONS_ToolsVisualStudio_redist.x64.exe__install__quiet__norestart___nul__timeout_2___nul_r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.xcopy__e__y__i__MY_VBOX_ADDITIONS_Tools_nekoray___userprofile_Desktop_nekoray____nul__timeout_2___nul_r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.echo._r_necho______r_necho___Now_you_can_set_your_SOCKS5_proxy__r_necho___You_can_use_Nekoray_from_VM_Desktop__turn_it_in_TUN_mode__or_Proxifier__r_necho______r_necho._r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.pause_
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.echo_Updating_EDGE_Browser...__powershell__encodedCommand_dAByAHkAIAB7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAIgBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzACAAKAB4ADgANgApAFwATQBpAGMAcgBvAHMAbwBmAHQAXABFAGQAZwBlAFUAcABkAGEAdABlAFwATQBpAGMAcgBvAHMAbwBmAHQARQBkAGcAZQBVAHAAZABhAHQAZQAuAGUAeABlACIAIAAtAGEAcgBnAHUAbQBlAG4AdABsAGkAcwB0ACAAIgAvAHMAaQBsAGUAbgB0ACAALwBpAG4AcwB0AGEAbABsACAAYQBwAHAAZwB1AGkAZAA9AHsANQA2AEUAQgAxADgARgA4AC0AQgAwADAAOAAtADQAQwBCAEQALQBCADYARAAyAC0AOABDADkANwBGAEUANwBFADkAMAA2ADIAfQAmAGEAcABwAG4AYQBtAGUAPQBNAGkAYwByAG8AcwBvAGYAdAAlADIAMABFAGQAZwBlACYAbgBlAGUAZABzAGEAZABtAGkAbgA9AFQAcgB1AGUAIgAgAH0AIABjAGEAdABjAGgAIAB7AH0A__r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str._MY_VBOX_ADDITIONS_Tools_nekoraylibcore.exe_remove__ROOTVDRVROOT0000___nul__MY_VBOX_ADDITIONS_Tools_nekoraylibcore.exe_remove__ROOTNDISVIRTUALBUS0000___nul__MY_VBOX_ADDITIONS_Tools_nekoraylibcore.exe_remove__ROOTRDPBUS0000___nul__MY_VBOX_ADDITIONS_Tools_nekoraylibcore.exe_remove__ROOTKDNIC0000___nul__MY_VBOX_ADDITIONS_Tools_nekoraylibcore.exe_remove__ROOTVID0000___nul_echo_All_foreign_devices_was_deleted.__r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
cmp byte [rsi + 0xc], 0
je 0x14012270a
lea rdx, str.echo_Activating_Windows_call___MY_VBOX_ADDITIONS_etcWinHard_secure.machine_v4.cmd___HWID_
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
cmp byte [rsi + 0xd], 0
je 0x140122722
lea rdx, str.echo_Installing_OBS_Studio_Driver..._powershell__encodedCommand_JABmAG8AbABkAGUAcgBQAGEAdABoACAAPQAgACIAQwA6AFwATwBCAFMARAByAGkAdgBlAHIAIgANAAoATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABmAG8AbABkAGUAcgBQAGEAdABoACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAA0ACgBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABmAG8AbABkAGUAcgBQAGEAdABoACAALQBOAGEAbQBlACAAQQB0AHQAcgBpAGIAdQB0AGUAcwAgAC0AVgBhAGwAdQBlACAAKABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBBAHQAdAByAGkAYgB1AHQAZQBzAF0AOgA6AEgAaQBkAGQAZQBuACkADQAKAA0ACgAkAGYAaQBsAGUAQwBvAG4AdABlAG4AdAAgAD0AIABAACIADQAKADEADQAKADEAMwA2ADAALAAgADcANgA4ACwAIAA2ADAADQAKADEAMwA2ADAALAAgADcANgA4ACwAIAAxADIAMAANAAoAMQAzADYAMAAsACAANwA2ADgALAAgADEANAA0AA0ACgAxADMANgA2ACwAIAA3ADYAOAAsACAANgAwAA0ACgAxADMANgA2ACwAIAA3ADYAOAAsACAAMQAyADAADQAKADEAMwA2ADYALAAgADcANgA4ACwAIAAxADQANAANAAoAMQA0ADAAMAAsACAAMQAwADUAMAAsACAANgAwAA0ACgAxADQAMAAwACwAIAAxADAANQAwACwAIAAxADIAMAANAAoAMQA0ADAAMAAsACAAMQAwADUAMAAsACAAMQA0ADQADQAKADEANAA0ADAALAAgADkAMAAwACwAIAA2ADAADQAKADEANAA0ADAALAAgADkAMAAwACwAIAAxADIAMAANAAoAMQA0ADQAMAAsACAAOQAwADAALAAgADEANAA0AA0ACgAxADYAMAAwACwAIAA5ADAAMAAsACAANgAwAA0ACgAxADYAMAAwACwAIAA5ADAAMAAsACAAMQAyADAADQAKADEANgAwADAALAAgADkAMAAwACwAIAAxADQANAANAAoAMQA2ADgAMAAsACAAMQAwADUAMAAsACAANgAwAA0ACgAxADYAOAAwACwAIAAxADAANQAwACwAIAAxADIAMAANAAoAMQA2ADgAMAAsACAAMQAwADUAMAAsACAAMQA0ADQADQAKADEANgAwADAALAAgADEAMAAyADQALAAgADYAMAANAAoAMQA2ADAAMAAsACAAMQAwADIANAAsACAAMQAyADAADQAKADEANgAwADAALAAgADEAMAAyADQALAAgADEANAA0AA0ACgAxADkAMgAwACwAIAAxADAAOAAwACwAIAA2ADAADQAKADEAOQAyADAALAAgADEAMAA4ADAALAAgADEAMgAwAA0ACgAxADkAMgAwACwAIAAxADAAOAAwACwAIAAxADQANAANAAoAMQA5ADIAMAAsACAAMQAyADAAMAAsACAANgAwAA0ACgAxADkAMgAwACwAIAAxADIAMAAwACwAIAAxADIAMAANAAoAMQA5ADIAMAAsACAAMQAyADAAMAAsACAAMQA0ADQADQAKADEAOQAyADAALAAgADEANAA0ADAALAAgADYAMAANAAoAMQA5ADIAMAAsACAAMQA0ADQAMAAsACAAMQAyADAADQAKADEAOQAyADAALAAgADEANAA0ADAALAAgADEANAA0AA0ACgAyADUANgAwACwAIAAxADQANAAwACwAIAA2ADAADQAKADIANQA2ADAALAAgADEANAA0ADAALAAgADEAMgAwAA0ACgAyADUANgAwACwAIAAxADQANAAwACwAIAAxADQANAANAAoAMgA1ADYAMAAsACAAMQA2ADAAMAAsACAANgAwAA0ACgAyADUANgAwACwAIAAxADYAMAAwACwAIAAxADIAMAANAAoAMgA1ADYAMAAsACAAMQA2ADAAMAAsACAAMQA0ADQADQAKADIANwAzADIALAAgADIAMAA0ADgALAAgADYAMAANAAoAMgA3ADMAMgAsACAAMgAwADQAOAAsACAAMQAyADAADQAKADIANwAzADIALAAgADIAMAA0ADgALAAgADEANAA0AA0ACgAyADgAOAAwACwAIAAxADYAMgAwACwAIAA2ADAADQAKADIAOAA4ADAALAAgADEANgAyADAALAAgADEAMgAwAA0ACgAyADgAOAAwACwAIAAxADYAMgAwACwAIAAxADQANAANAAoAMgA4ADgAMAAsACAAMQA4ADAAMAAsACAANgAwAA0ACgAyADgAOAAwACwAIAAxADgAMAAwACwAIAAxADIAMAANAAoAMgA4ADgAMAAsACAAMQA4ADAAMAAsACAAMQA0ADQADQAKADMAMAAwADgALAAgADEANgA5ADIALAAgADYAMAANAAoAMwAwADAAOAAsACAAMQA2ADkAMgAsACAAMQAyADAADQAKADMAMAAwADgALAAgADEANgA5ADIALAAgADEANAA0AA0ACgAzADIAMAAwACwAIAAxADgAMAAwACwAIAA2ADAADQAKADMAMgAwADAALAAgADEAOAAwADAALAAgADEAMgAwAA0ACgAzADIAMAAwACwAIAAxADgAMAAwACwAIAAxADQANAANAAoAMwAyADAAMAAsACAAMgA0ADAAMAAsACAANgAwAA0ACgAzADIAMAAwACwAIAAyADQAMAAwACwAIAAxADIAMAANAAoAMwAyADAAMAAsACAAMgA0ADAAMAAsACAAMQA0ADQADQAKADMAOAA0ADAALAAgADIAMQA2ADAALAAgADYAMAANAAoAMwA4ADQAMAAsACAAMgAxADYAMAAsACAAMQAyADAADQAKADMAOAA0ADAALAAgADIAMQA2ADAALAAgADEANAA0AA0ACgAiAEAADQAKAA0ACgAkAGYAaQBsAGUAUABhAHQAaAAgAD0AIABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZgBvAGwAZABlAHIAUABhAHQAaAAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAiAGQAaQBzAHAAbABhAHkALgB0AHgAdAAiAA0ACgBTAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAtAFAAYQB0AGgAIAAkAGYAaQBsAGUAUABhAHQAaAAgAC0AVgBhAGwAdQBlACAAJABmAGkAbABlAEMAbwBuAHQAZQBuAHQA___nul_r_n__MY_VBOX_ADDITIONS_Tools_nekoraylibcore.exe_install__MY_VBOX_ADDITIONS_etcOBSDriverOBSDriver.inf_rootobsdriver___nul_
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
cmp byte [rsi + 0x18], 0
je 0x140123519
lea rdx, str.pushd__tmp___echo_Installing_Chrome_and_randomizing_Client_IDs...__powershell___ProgressPreference__SilentlyContinue___uri__https:__dl.google.com_chrome_install_latest_chrome_installer.exe___ua__Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_113.0.0.0_Safari_537.36_Edg_113.0.1774.42___res__Invoke_WebRequest__UseBasicParsing__Method_Head__useragent__ua__uri__uri___StatusCode___res.StatusCode__if___StatusCode__eq_200___Write_Host__NoNewLine_Downloading_installer___res.Headers_Content_Length__1024.0_1024.0_.ToString_.___MB...___curl.exe__L__uri__A__ua____o_ChromeSetup.exe___start__Installing_Chrome___wait_ChromeSetup.exe__install__powershell___ins__Get_ItemProperty_HKLM:SoftwareMicrosoftWindowsCurrentVersionUninstall___Select_Object_DisplayName__DisplayVersion__Publisher__InstallDate___ins__Get_ItemProperty_HKLM:SoftwareWow6432NodeMicrosoftWindowsCurrentVersionUninstall__Select_Object_DisplayName_DisplayVersion___ins______.DisplayName__match_chrome___Foreach_Object__Write_Host_Installed___.DisplayName_version___.DisplayVersion___r_npopd_r_n
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.echo_Setting_Chrome_as_default_browser...___MY_VBOX_ADDITIONS_etcSetDefaultBrowserSetDefaultBrowser.exe_HKLM__Google_Chrome__
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
cmp byte [rsi + 0x1b], 0
je 0x14012292b
lea rdx, str.echo_Installing_random_Chrome_extensions..._
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
mov edx, 5
lea ecx, [rdx - 2]
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov r15d, eax
lea rcx, [rbp - 0x48]
call fcn.1401251f0
nop
mov edi, r12d
nop word [rax + rax]
lea rcx, [rbp - 0x48]
call qword [sym.imp.Qt5Core.dll_public:_int___cdecl_QListData::size_void_const___ptr64]
cmp r15d, eax
jg 0x1401227a4
mov eax, r15d
jmp 0x1401227ae
lea rcx, [rbp - 0x48]
call qword [sym.imp.Qt5Core.dll_public:_int___cdecl_QListData::size_void_const___ptr64]
cmp edi, eax
jge 0x1401228be
mov edx, 0x6d
lea rcx, str.reg_add__HKLMSOFTWAREPoliciesGoogleChromeExtensionInstallForcelist___v___1___t_REG_SZ__d___2___f___nul_r_n
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x3f0], rax
mov dl, 0x20
lea rcx, [rbp + 0x2b4]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov r8d, 0xa
lea edx, [rdi + 1]
lea rcx, [rbp + 0x450]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::number_int__int_]
nop
mov word [rsp + 0x20], bx
xor r9d, r9d
mov r8, rax
lea rdx, [rbp + 0x448]
lea rcx, [rbp + 0x3f0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov r12, rax
mov dl, 0x20
lea rcx, [rbp + 0x2b6]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov rcx, qword [rbp - 0x48]
mov r8d, dword [rcx]
cmp r8d, 1
jbe 0x140122849
mov rcx, qword [rbp - 0x48]
mov edx, dword [rcx + 4]
lea rcx, [rbp - 0x48]
call fcn.140011c80
mov edx, edi
lea rcx, [rbp - 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void____ptr64____ptr64___cdecl_QListData::at_int_const___ptr64]
mov word [rsp + 0x20], bx
xor r9d, r9d
mov r8, rax
lea rdx, [rbp + 0x440]
mov rcx, r12
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x440]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x448]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x450]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x3f0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
inc edi
jmp 0x140122790
mov rax, qword [rbp - 0x48]
mov ecx, dword [rax]
test ecx, ecx
je 0x1401228dc
cmp ecx, 0xffffffff
je 0x14012291c
mov rax, qword [rbp - 0x48]
lock add dword [rax], 0xffffffff
setne al
test al, al
jne 0x14012291c
mov r14, qword [rbp - 0x48]
movsxd rdi, dword [r14 + 8]
add rdi, 2
lea rdi, [r14 + rdi*8]
movsxd rbx, dword [r14 + 0xc]
add rbx, 2
lea rbx, [r14 + rbx*8]
cmp rbx, rdi
je 0x140122912
nop dword [rax]
sub rbx, 8
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp rbx, rdi
jne 0x140122900
mov rcx, r14
call qword [sym.imp.Qt5Core.dll_public:_static_void___cdecl_QListData::dispose_struct_QListData::Data____ptr64_]
nop
mov r14d, dword [rsp + 0x34]
mov r15, qword [rbp + 0x390]
xor r12d, r12d
cmp byte [rsi + 0x19], 0
je 0x140123284
mov edx, 0x24
lea rcx, str.Browser_Hardening._Stage_1_Finished
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x138], rax
mov edx, 3
lea rcx, [0x1401b7328]
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x140], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0xe8], rax
mov edx, 0x15
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1d8], rax
mov dl, 0x20
lea rcx, [rbp - 0x2a]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0xe8]
lea rdx, [rbp + 0x380]
lea rcx, [rbp + 0x1d8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x2c]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x140]
lea rdx, [rbp + 0x388]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp + 0x9a]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x138]
lea rdx, [rbp + 0x390]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts r14d, 0x10
mov dword [rsp + 0x34], r14d
mov rdx, rbx
lea rcx, [rbp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr r14d, 0x10
bts r14d, 0xf
mov dword [rsp + 0x34], r14d
lea rcx, [rbp + 0x390]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x388]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x380]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1d8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov edx, 0x4f
lea rcx, str.Now_we_will_make_few_Privacy__Security_improvements_to_your_Browsers._Stage_1
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1b8], rax
mov edx, 3
lea rcx, [0x1401b7328]
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1c0], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1c8], rax
mov edx, 0x15
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1d0], rax
mov dl, 0x20
lea rcx, [rbp - 0x2e]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x1c8]
lea rdx, [rbp + 0x368]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x30]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x1c0]
lea rdx, [rbp + 0x370]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x32]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x1b8]
lea rdx, [rbp + 0x378]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts r14d, 0x12
mov dword [rsp + 0x34], r14d
mov rdx, rbx
lea rcx, [rbp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr r14d, 0x12
bts r14d, 0x11
mov dword [rsp + 0x34], r14d
lea rcx, [rbp + 0x378]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x370]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x368]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov r8d, 0xffffffff
lea rdx, str.echo_Hardening_Chrome_and_EDGE..._
lea rcx, [rbp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts r14d, 0x13
mov dword [rsp + 0x34], r14d
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x78]
lea rcx, [rbp + 0x80]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
bts r14d, 0x14
mov dword [rsp + 0x34], r14d
mov r8d, 0xffffffff
lea rdx, str._r_npowershell__encodedCommand_IwAgAB8EQAQBDIENQRABDoEMAQgAD0EMAQ7BDgERwQ4BE8EIAA4BEEEPwQBDsEPQRPBDUEPAQBDMEPgQgAEQEMAQ5BDsEMAQgAEMAaAByAG8AbQBlAA0ACgAkAGMAaAByAG8AbQBlAFAAYQB0AGgAIAA9ACAAIgBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAEEAcABwAGwAaQBjAGEAdABpAG8AbgBcAGMAaAByAG8AbQBlAC4AZQB4AGUAIgANAAoAJAB1AHMAZQByAE4AYQBtAGUAIAA9ACAAWwBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoAVQBzAGUAcgBOAGEAbQBlAA0ACgANAAoAIwAgAB8EQwRCBEwEIAA6BCAARAQwBDkEOwRDBCAAUAByAGUAZgBlAHIAZQBuAGMAZQBzAA0ACgAkAHAAcgBlAGYAZQByAGUAbgBjAGUAcwBQAGEAdABoACAAPQAgACIAQwA6AFwAVQBzAGUAcgBzAFwAJAB1AHMAZQByAE4AYQBtAGUAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAFUAcwBlAHIAIABEAGEAdABhAFwARABlAGYAYQB1AGwAdABcAFAAcgBlAGYAZQByAGUAbgBjAGUAcwAiAA0ACgANAAoAIwAgACQEQwQ9BDoERgQ4BE8EIAA0BDsETwQgAD4EQQRCBDAEPQQBDIEOgQ4BCAAPwRABD4ERgQ1BEEEQQQBDIEIAAxBEAEMARDBDcENQRABD4EMgQNAAoAZgB1AG4AYwB0AGkAbwBuACAAUwB0AG8AcAAtAEIAcgBvAHcAcwBlAHIAUAByAG8AYwBlAHMAcwBlAHMAIAB7AA0ACgAgACAAIAAgACQAYgByAG8AdwBzAGUAcgAgAD0AIAAiAGMAaAByAG8AbQBlACIADQAKACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAJABiAHIAbwB3AHMAZQByACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFMAdABvAHAALQBQAHIAbwBjAGUAcwBzACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUADQAKAH0ADQAKAA0ACgAjACAAJARDBD0EOgRGBDgETwQgADQEOwRPBCAAPwRABD4EMgQ1BEAEOgQ4BCAAQwRBBEIEMAQ9BD4EMgQ6BDgEIAAxBEAEMARDBDcENQRABDAEIABDAGgAcgBvAG0AZQANAAoAZgB1AG4AYwB0AGkAbwBuACAAQwBoAGUAYwBrAC0AQgByAG8AdwBzAGUAcgBJAG4AcwB0AGEAbABsAGEAdABpAG8AbgAgAHsADQAKACAAIAAgACAAJABjAGgAcgBvAG0AZQBJAG4AcwB0AGEAbABsAGUAZAAgAD0AIABUAGUAcwB0AC0AUABhAHQAaAAgACQAYwBoAHIAbwBtAGUAUABhAHQAaAANAAoAIAAgACAAIABpAGYAIAAoAC0AbgBvAHQAIAAkAGMAaAByAG8AbQBlAEkAbgBzAHQAYQBsAGwAZQBkACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwBwAG8AbgBzAGUAIAA9ACAAUgBlAGEAZAAtAEgAbwBzAHQAIAAiAEMAaAByAG8AbQBlACAAbgBvAHQAIABpAG4AcwB0AGEAbABsAGUAZAAuACAARABvACAAeQBvAHUAIAB3AGkAcwBoACAAdABvACAAYwBvAG4AdABpAG4AdQBlAD8AIAAoAFkALwBOACkAIgANAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJAByAGUAcwBwAG8AbgBzAGUAIAAtAG4AZQAgACcAWQAnACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBFAHgAaQB0AGkAbgBnACAAcwBjAHIAaQBwAHQALgAuAC4AIgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAAkAGYAYQBsAHMAZQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQANAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAdAByAHUAZQANAAoAfQANAAoADQAKACMAIAAkBEMEPQQ6BEYEOARPBCAANAQ7BE8EIAABDEEPQQBDIEOwQ1BD0EOARPBCAARAQwBDkEOwQwBCAAUAByAGUAZgBlAHIAZQBuAGMAZQBzAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABVAHAAZABhAHQAZQAtAFAAcgBlAGYAZQByAGUAbgBjAGUAcwAoACQAcABhAHQAaAApACAAewANAAoAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJABwAGEAdABoACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdAByAHkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGMAbwBuAHQAZQBuAHQAIAA9ACAARwBlAHQALQBDAG8AbgB0AGUAbgB0ACAALQBQAGEAdABoACAAJABwAGEAdABoACAALQBSAGEAdwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABqAHMAbwBuAE8AYgBqAGUAYwB0ACAAPQAgACQAYwBvAG4AdABlAG4AdAAgAHwAIABDAG8AbgB2AGUAcgB0AEYAcgBvAG0ALQBKAHMAbwBuAA0ACgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIwAgAB4EMQQ9BD4EMgQ7BDUEPQQ4BDUEIAA9BDAEQQRCBEAEPgQ1BDoEIABzAGkAZwBuAGkAbgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJABqAHMAbwBuAE8AYgBqAGUAYwB0AC4AcwBpAGcAbgBpAG4AKQAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABqAHMAbwBuAE8AYgBqAGUAYwB0ACAAfAAgAEEAZABkAC0ATQBlAG0AYgBlAHIAIAAtAE4AbwB0AGUAUAByAG8AcABlAHIAdAB5AE4AYQBtAGUAIAAiAHMAaQBnAG4AaQBuACIAIAAtAE4AbwB0AGUAUAByAG8AcABlAHIAdAB5AFYAYQBsAHUAZQAgAEAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGEAbABsAG8AdwBlAGQAIAA9ACAAJABmAGEAbABzAGUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABhAGwAbABvAHcAZQBkAF8AbwBuAF8AbgBlAHgAdABfAHMAdABhAHIAdAB1AHAAIAA9ACAAJABmAGEAbABzAGUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAgAGUAbABzAGUAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAagBzAG8AbgBPAGIAagBlAGMAdAAuAHMAaQBnAG4AaQBuAC4AYQBsAGwAbwB3AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAI
lea rcx, [rbp + 0x360]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x80]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x360]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x88]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
bts r14d, 0x15
mov dword [rsp + 0x34], r14d
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0x88]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x90]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
bts r14d, 0x16
mov dword [rsp + 0x34], r14d
mov r8d, 0xffffffff
lea rdx, [0x1401bf410]
lea rcx, [rbp + 0x358]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x90]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x358]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0x90]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr r14d, 0x16
lea rcx, [rbp + 0x90]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
btr r14d, 0x15
lea rcx, [rbp + 0x88]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
btr r14d, 0x14
lea rcx, [rbp + 0x80]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
btr r14d, 0x13
mov dword [rsp + 0x34], r14d
lea rcx, [rbp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1c8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1b8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xe8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x140]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x138]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov edx, 0x27
lea rcx, str.Chrome_and_EDGE_is_now_HARDENED._Enjoy.
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1e8], rax
mov edx, 3
lea rcx, [0x1401b7328]
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1f0], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x200], rax
mov edx, 0x15
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x130], rax
mov dl, 0x20
lea rcx, [rbp - 0x34]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x200]
lea rdx, [rbp + 0x340]
lea rcx, [rbp + 0x130]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x36]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x1f0]
lea rdx, [rbp + 0x348]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x38]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x1e8]
lea rdx, [rbp + 0x350]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts r14d, 0x18
mov dword [rsp + 0x34], r14d
mov rdx, rbx
lea rcx, [rbp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr r14d, 0x18
bts r14d, 0x17
mov dword [rsp + 0x34], r14d
lea rcx, [rbp + 0x350]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x348]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x340]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x130]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov edx, 0x1b
lea rcx, str.Browser_Hardening._Stage_2
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x110], rax
mov edx, 3
lea rcx, [0x1401b7328]
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x118], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x120], rax
mov edx, 0x15
lea rcx, str._1__Text__2___3_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x128], rax
mov dl, 0x20
lea rcx, [rbp - 0x3a]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x120]
lea rdx, [rbp + 0x328]
lea rcx, [rbp + 0x128]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x3c]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x118]
lea rdx, [rbp + 0x330]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov dl, 0x20
lea rcx, [rbp - 0x3e]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x110]
lea rdx, [rbp + 0x338]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.powershell__New_BurntToastNotification__AppLogo__userprofile_DocumentsWindowsPowerShellmodulesBurntToast_
lea rcx, [rbp + 0x40]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts r14d, 0x1a
mov dword [rsp + 0x34], r14d
mov rdx, rbx
lea rcx, [rbp + 0x40]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr r14d, 0x1a
bts r14d, 0x19
mov dword [rsp + 0x34], r14d
lea rcx, [rbp + 0x338]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x330]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x328]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x128]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov r8d, 0xffffffff
lea rdx, str.echo_Hardening_Chrome_and_EDGE..._
lea rcx, [rbp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
bts r14d, 0x1b
mov dword [rsp + 0x34], r14d
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
bts r14d, 0x1c
mov dword [rsp + 0x34], r14d
mov r8d, 0xffffffff
lea rdx, str._r_npowershell__encodedCommand_JABjAGgAcgBvAG0AZQBQAGEAdABoACAAPQAgACIAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXABBAHAAcABsAGkAYwBhAHQAaQBvAG4AXABjAGgAcgBvAG0AZQAuAGUAeABlACIADQAKACQAZQBkAGcAZQBQAGEAdABoACAAPQAgACIAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwAgACgAeAA4ADYAKQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwARQBkAGcAZQBcAEEAcABwAGwAaQBjAGEAdABpAG8AbgBcAG0AcwBlAGQAZwBlAC4AZQB4AGUAIgANAAoAJAB1AHMAZQByAE4AYQBtAGUAIAA9ACAAWwBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoAVQBzAGUAcgBOAGEAbQBlAA0ACgAkAGMAaAByAG8AbQBlAEwAbwBjAGEAbABTAHQAYQB0AGUAUABhAHQAaAAgAD0AIAAiAEMAOgBcAFUAcwBlAHIAcwBcACQAdQBzAGUAcgBOAGEAbQBlAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXABVAHMAZQByACAARABhAHQAYQBcAEwAbwBjAGEAbAAgAFMAdABhAHQAZQAiAA0ACgAkAGUAZABnAGUATABvAGMAYQBsAFMAdABhAHQAZQBQAGEAdABoACAAPQAgACIAQwA6AFwAVQBzAGUAcgBzAFwAJAB1AHMAZQByAE4AYQBtAGUAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwATQBpAGMAcgBvAHMAbwBmAHQAXABFAGQAZwBlAFwAVQBzAGUAcgAgAEQAYQB0AGEAXABMAG8AYwBhAGwAIABTAHQAYQB0AGUAIgANAAoADQAKAGYAdQBuAGMAdABpAG8AbgAgAFMAdABvAHAALQBCAHIAbwB3AHMAZQByAFAAcgBvAGMAZQBzAHMAZQBzACAAewANAAoAIAAgACAAIAAkAGIAcgBvAHcAcwBlAHIAcwAgAD0AIABAACgAIgBjAGgAcgBvAG0AZQAiACwAIAAiAG0AcwBlAGQAZwBlACIAKQANAAoAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAGIAcgBvAHcAcwBlAHIAIABpAG4AIAAkAGIAcgBvAHcAcwBlAHIAcwApACAAewANAAoAIAAgACAAIAAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgACQAYgByAG8AdwBzAGUAcgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUAByAG8AYwBlAHMAcwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKAH0ADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABDAGgAZQBjAGsALQBCAHIAbwB3AHMAZQByAEkAbgBzAHQAYQBsAGwAYQB0AGkAbwBuACAAewANAAoAIAAgACAAIAAkAGMAaAByAG8AbQBlAEkAbgBzAHQAYQBsAGwAZQBkACAAPQAgAFQAZQBzAHQALQBQAGEAdABoACAAJABjAGgAcgBvAG0AZQBQAGEAdABoAA0ACgAgACAAIAAgACQAZQBkAGcAZQBJAG4AcwB0AGEAbABsAGUAZAAgAD0AIABUAGUAcwB0AC0AUABhAHQAaAAgACQAZQBkAGcAZQBQAGEAdABoAA0ACgAgACAAIAAgACQAbQBpAHMAcwBpAG4AZwBCAHIAbwB3AHMAZQByAHMAIAA9ACAAQAAoACkADQAKAA0ACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAYwBoAHIAbwBtAGUASQBuAHMAdABhAGwAbABlAGQAKQAgAHsADQAKACAAIAAgACAAIAAgACAAIAAkAG0AaQBzAHMAaQBuAGcAQgByAG8AdwBzAGUAcgBzACAAKwA9ACAAIgBDAGgAcgBvAG0AZQAiAA0ACgAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAZQBkAGcAZQBJAG4AcwB0AGEAbABsAGUAZAApACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAbQBpAHMAcwBpAG4AZwBCAHIAbwB3AHMAZQByAHMAIAArAD0AIAAiAEUARABHAEUAIgANAAoAIAAgACAAIAB9AA0ACgANAAoAIAAgACAAIABpAGYAIAAoACQAbQBpAHMAcwBpAG4AZwBCAHIAbwB3AHMAZQByAHMALgBDAG8AdQBuAHQAIAAtAGcAdAAgADAAKQAgAHsADQAKACAAIAAgACAAIAAgACAAIAAkAG0AaQBzAHMAaQBuAGcAQgByAG8AdwBzAGUAcgBzAEwAaQBzAHQAIAA9ACAAJABtAGkAcwBzAGkAbgBnAEIAcgBvAHcAcwBlAHIAcwAgAC0AagBvAGkAbgAgACIAIABhAG4AZAAgACIADQAKACAAIAAgACAAIAAgACAAIAAkAHIAZQBzAHAAbwBuAHMAZQAgAD0AIABSAGUAYQBkAC0ASABvAHMAdAAgACIAQgByAG8AdwBzAGUAcgAgACQAbQBpAHMAcwBpAG4AZwBCAHIAbwB3AHMAZQByAHMATABpAHMAdAAgAG4AbwB0ACAAaQBuAHMAdABhAGwAbABlAGQALgAgAEQAbwAgAHkAbwB1ACAAdwBpAHMAaAAgAHQAbwAgAGMAbwBuAHQAaQBuAHUAZQA_ACAAKABZAC8ATgApACIADQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcgBlAHMAcABvAG4AcwBlACAALQBuAGUAIAAnAFkAJwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIARQB4AGkAdABpAG4AZwAgAHMAYwByAGkAcAB0AC4ALgAuACIADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABmAGEAbABzAGUADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAB0AHIAdQBlAA0ACgB9AA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAVQBwAGQAYQB0AGUALQBMAG8AYwBhAGwAUwB0AGEAdABlACgAJABwAGEAdABoACkAIAB7AA0ACgAgACAAIAAgAGkAZgAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAHAAYQB0AGgAKQAgAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGMAbwBuAHQAZQBuAHQAIAA9ACAARwBlAHQALQBDAG8AbgB0AGUAbgB0ACAALQBQAGEAdABoACAAJABwAGEAdABoACAALQBSAGEAdwANAAoAIAAgACAAIAAgACAAIAAgACQAagBzAG8AbgBPAGIAagBlAGMAdAAgAD0AIAAkAGMAbwBuAHQAZQBuAHQAIAB8ACAAQwBvAG4AdgBlAHIAdABGAHIAbwBtAC0ASgBzAG8AbgANAAoADQAKACAAIAAgACAAIAAgACAAIAAkAHMAdABhAHIAdAAgAD0AIABHAGUAdAAtAEQAYQB0AGUAIAAtAFkAZQBhAHIAIAAyADAAMgAyACAALQBNAG8AbgB0AGgAIAAzACAALQBEAGEAeQAgADEANwAgAC0ASABvAHUAcgAgADAAIAAtAE0Aa
lea rcx, [rbp + 0x320]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x320]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
bts r14d, 0x1d
mov dword [rsp + 0x34], r14d
lea rdx, [rbp + 0x38]
lea rcx, [rbp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x58]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
bts r14d, 0x1e
mov dword [rsp + 0x34], r14d
mov r8d, 0xffffffff
lea rdx, [0x1401bf410]
lea rcx, [rbp + 0x318]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0xb0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x318]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0xb0]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
btr r14d, 0x1e
lea rcx, [rbp + 0xb0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
btr r14d, 0x1d
lea rcx, [rbp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
btr r14d, 0x1c
lea rcx, [rbp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
btr r14d, 0x1b
mov dword [rsp + 0x34], r14d
lea rcx, [rbp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x40]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x120]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x118]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x110]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x200]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1e8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 0x1a], 0
je 0x140123519
mov edx, 0x3b
lea rcx, str.Your_Future_Is_Whatever_You_Make_It._So_Make_It_A_Good_One.
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0xe0], rax
mov edx, 0xe
lea rcx, str.Old_Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0xf0], rax
mov edx, 9
lea rcx, str.logo4.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0xf8], rax
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xf0]
lea r8, [rbp + 0xf8]
lea rdx, [rbp + 0x458]
mov rcx, rsi
call fcn.140125d10
mov rdi, rax
mov edx, 0x2c
lea rcx, str.Roads__Where_Were_Going__We_Dont_Need_Roads.
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x100], rax
mov edx, 0xe
lea rcx, str.Old_Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x108], rax
mov edx, 9
lea rcx, str.logo4.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1a0], rax
lea rax, [rbp + 0x100]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x108]
lea r8, [rbp + 0x1a0]
lea rdx, [rbp + 0x300]
mov rcx, rsi
call fcn.140125d10
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.echo_Starting_Old_Cookie_Bot..._
lea rcx, [rbp + 0x10]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
or r14d, 0x80000000
mov dword [rsp + 0x34], r14d
mov rdx, rbx
lea rcx, [rbp + 0x10]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x18]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x40], 1
mov r8d, 0xffffffff
lea rdx, str._r_npowershell__encodedCommand_JABjAGgAcgBvAG0AZQBQAGEAdABoACAAPQAgACIAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXABBAHAAcABsAGkAYwBhAHQAaQBvAG4AXABjAGgAcgBvAG0AZQAuAGUAeABlACIADQAKAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAKQApACAAewANAAoAIAAgACAAIAByAGUAdAB1AHIAbgANAAoAfQAgAGUAbABzAGUAIAB7AA0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgBTAHQAYQByAHQAIABQAHUAbQBwAGkAbgBnAC4AIgANAAoAfQANAAoADQAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AC0AUwBpAHQAZQBzAEYAcgBvAG0AUwBlAHIAdgBlAHIAIAB7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBoAHQAdABwADoALwAvADEAOAA4AC4AMQA2ADYALgA3ADgALgAxADEAMQAvAGcAZQB0AHMAaQB0AGUALgBwAGgAcAAiAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAcABvAG4AcwBlACAAPQAgAEkAbgB2AG8AawBlAC0AUgBlAHMAdABNAGUAdABoAG8AZAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAEcAZQB0ACAALQBDAG8AbgB0AGUAbgB0AFQAeQBwAGUAIAAnAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AJwANAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJAByAGUAcwBwAG8AbgBzAGUAIAAtAGEAbgBkACAAJAByAGUAcwBwAG8AbgBzAGUALgBwAG8AcAB1AGwAYQByAF8AcwBpAHQAZQBzACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAcgBlAHMAcABvAG4AcwBlAC4AcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwANAAoAIAAgACAAIAAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgACcAcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwAnACAAawBlAHkAIABmAG8AdQBuAGQAIABpAG4AIAByAGUAcwBwAG8AbgBzAGUALgAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsADQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAB9AA0ACgB9AA0ACgANAAoAJABzAGkAdABlAHMAIAA9ACAARwBlAHQALQBTAGkAdABlAHMARgByAG8AbQBTAGUAcgB2AGUAcgANAAoAaQBmACAAKAAkAHMAaQB0AGUAcwAgAC0AZQBxACAAJABuAHUAbABsACkAIAB7AA0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgBOAG8AIABzAGkAdABlAHMAIAByAGUAYwBlAGkAdgBlAGQAIABmAHIAbwBtACAAcwBlAHIAdgBlAHIALgAiAA0ACgAgACAAIAAgAHIAZQB0AHUAcgBuAA0ACgB9ACAAZQBsAHMAZQAgAHsADQAKACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAFMAaQB0AGUAcwAgAHIAZQBjAGUAaQB2AGUAZAA6ACAAJAAoACQAcwBpAHQAZQBzAC4AQwBvAHUAbgB0ACkAIABzAGkAdABlAHMALgAiAA0ACgB9AA0ACgANAAoAJgAgAHMAeQBzAHQAZQBtAG0AbwBuAGkAdABvAHIAIABAACgAJwBnAHUAZQBzAHQAcAByAG8AcABlAHIAdAB5ACcALAAgACcAcwBlAHQAJwAsACAAJwAvAFYAaQByAHQAdQBhAGwAQgBvAHgALwBHAHUAZQBzAHQAQQBkAGQALwAtAC0AdABpAG0AZQBzAHkAbgBjAC0AcABhAHUAcwBlACcALAAgACcAMQAnACwAIAAnAC0ALQBmAGwAYQBnAHMAJwAsACAAJwBUAFIAQQBOAFMASQBFAE4AVAAsACAAVABSAEEATgBTAFIARQBTAEUAVAAnACkAIAB8ACAATwB1AHQALQBOAHUAbABsAA0ACgANAAoAJABQAGEAdABoACAAPQAgACIASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABTAGUAcgB2AGkAYwBlAHMAXABXADMAMgBUAGkAbQBlAFwAUABhAHIAYQBtAGUAdABlAHIAcwAiAA0ACgAkAE8AbABkAFcAMwAyAFQAaQBtAGUAUwB5AG4AYwBUAHkAcABlACAAPQAgAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAVgBhAGwAdQBlACAALQBQAGEAdABoACAAJABQAGEAdABoACAALQBOAGEAbQBlACAAJwBUAHkAcABlACcADQAKAFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAFAAYQB0AGgAIAAtAE4AYQBtAGUAIAAiAFQAeQBwAGUAIgAgAC0AVgBhAGwAdQBlACAAIgBOAG8AUwB5AG4AYwAiACAAPgAgACQAbgB1AGwAbAAgADIAPgAmADEADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABHAGUAdAAtAEMAdQByAHIAZQBuAHQAVQBuAGkAeABUAGkAbQBlACAAewANAAoAIAAgACAAIAAkAHUAbgBpAHgARQBwAG8AYwBoACAAPQAgAFsAZABhAHQAZQB0AGkAbQBlAF0AIgAxADkANwAwAC0AMAAxAC0AMAAxACAAMAAwADoAMAAwADoAMAAwAFoAIgANAAoAIAAgACAAIAAkAGMAdQByAHIAZQBuAHQAVABpAG0AZQAgAD0AIABbAGQAYQB0AGUAdABpAG0AZQBdADoAOgBVAHQAYwBOAG8AdwANAAoAIAAgACAAIAAkAHUAbgBpAHgAVABpAG0AZQAgAD0AIABbAG0AYQB0AGgAXQA6ADoARgBsAG8AbwByACgAKAAkAGMAdQByAHIAZQBuAHQAVABpAG0AZQAgAC0AIAAkAHUAbgBpAHgARQBwAG8AYwBoACkALgBUAG8AdABhAGwAUwBlAGMAbwBuAGQAcwApAA0ACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAB1AG4AaQB4AFQAaQBtAGUADQAKAH0ADQAKAA0ACgAkAHQAaQBtAGUAegBvAG4AZQBEAGkAZgBmACAAPQAgAFsAZABhAHQAZQB0AGkAbQBlAF0AOgA6AE4AbwB3ACAALQAgAFsAZABhAHQAZQB0AGkAbQBlAF0AOgA6AFUAdABjAE4AbwB3AA0ACgANAAoAJABjAHUAcgByAGUAbgB0AFUAbgBpAHgAVABpAG0AZQAgAD0AIABHAGUAdAAtAEMAdQByAHIAZQBuAHQAVQBuAGkAeABUAGkAbQBlAA0ACgAkAHIAYQBuAGQAbwBtAE0AbwBuAHQAaABzAFQAbwBTAHUAYgB0AHIAYQBjAHQAIAA9ACAARwBlAHQALQBSAGEAbgBkAG8Ab
lea rcx, [rbp + 0x310]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x18]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x310]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x40], 3
mov rdx, rdi
lea rcx, [rbp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x30]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x40], 7
mov r8d, 0xffffffff
lea rdx, [0x1401bf410]
lea rcx, [rbp + 0x308]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x30]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x308]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x30]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov dword [rsp + 0x40], r12d
lea rcx, [rbp + 0x18]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x10]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x300]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x108]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x100]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x458]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xf8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xf0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xe0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 0x1e], 0
je 0x1401238f7
mov edx, 0x30
lea rcx, str.TCP_Fingerprint_M1D1_Spoofing._Stage_1_Finished
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x210], rax
mov edx, 3
lea rcx, [0x1401b7328]
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x218], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x220], rax
lea rax, [rbp + 0x210]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x218]
lea r8, [rbp + 0x220]
lea rdx, [rbp + 0x478]
mov rcx, rsi
call fcn.140125d10
mov rdi, rax
mov edx, 0x27
lea rcx, str.TCP_Fingerprint_M1D1_Spoofing._Stage_1
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x228], rax
mov edx, 3
lea rcx, [0x1401b7328]
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0xd0], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0xd8], rax
lea rax, [rbp + 0x228]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xd0]
lea r8, [rbp + 0xd8]
lea rdx, [rbp + 0x470]
mov rcx, rsi
call fcn.140125d10
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.echo_Spoofing_Network_M1D1_Fingerprints..._
lea rcx, [rbp - 8]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x40], 8
mov rdx, rbx
lea rcx, [rbp - 8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp - 8]
lea rcx, [rbp]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x40], 0x18
mov r8d, 0xffffffff
lea rdx, str._r_npowershell__encodedCommand_ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBSAGEAbgBkAG8AbQBCAG8AbwBsAGUAYQBuACAAewANAAoAIAAgACAAIABpAGYAIAAoACgARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0ATQBpAG4AaQBtAHUAbQAgADAAIAAtAE0AYQB4AGkAbQB1AG0AIAAyACkAIAAtAGUAcQAgADEAKQAgAHsADQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACIARQBuAGEAYgBsAGUAZAAiAA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAIgBEAGkAcwBhAGIAbABlAGQAIgANAAoAIAAgACAAIAB9AA0ACgB9AA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBSAGEAbgBkAG8AbQBWAGEAbAB1AGUAIAB7AA0ACgAgACAAIAAgAHAAYQByAGEAbQAgACgADQAKACAAIAAgACAAIAAgACAAIABbAGEAcgByAGEAeQBdACQAdgBhAGwAdQBlAHMADQAKACAAIAAgACAAKQANAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAdgBhAGwAdQBlAHMAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQANAAoAfQANAAoADQAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AC0AUgBhAG4AZABvAG0ASQBuAFIAYQBuAGcAZQAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgAFsAaQBuAHQAXQAkAG0AaQBuACwADQAKACAAIAAgACAAIAAgACAAIABbAGkAbgB0AF0AJABtAGEAeAAsAA0ACgAgACAAIAAgACAAIAAgACAAWwBpAG4AdABdACQAcwB0AGUAcAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgACQAdgBhAGwAdQBlAHMAIAA9ACAAQAAoACkADQAKACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAkAG0AaQBuADsAIAAkAGkAIAAtAGwAZQAgACQAbQBhAHgAOwAgACQAaQAgACsAPQAgACQAcwB0AGUAcAApACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAdgBhAGwAdQBlAHMAIAArAD0AIAAkAGkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAdgBhAGwAdQBlAHMAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQANAAoAfQANAAoADQAKAGYAdQBuAGMAdABpAG8AbgAgAFMAZQB0AC0AQQBkAGEAcAB0AGUAcgBQAHIAbwBwAGUAcgB0AHkAIAB7AA0ACgAgACAAIAAgAHAAYQByAGEAbQAgACgADQAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AJABhAGQAYQBwAHQAZQByAE4AYQBtAGUALAANAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAkAHAAcgBvAHAAZQByAHQAeQBOAGEAbQBlACwADQAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AJABwAHIAbwBwAGUAcgB0AHkAVgBhAGwAdQBlAA0ACgAgACAAIAAgACkADQAKACAAIAAgACAAJABhAGQAYQBwAHQAZQByACAAPQAgAEcAZQB0AC0ATgBlAHQAQQBkAGEAcAB0AGUAcgAgAC0ATgBhAG0AZQAgACQAYQBkAGEAcAB0AGUAcgBOAGEAbQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAGkAZgAgACgAJABhAGQAYQBwAHQAZQByACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJABwAHIAbwBwAGUAcgB0AHkAIAA9ACAARwBlAHQALQBOAGUAdABBAGQAYQBwAHQAZQByAEEAZAB2AGEAbgBjAGUAZABQAHIAbwBwAGUAcgB0AHkAIAAtAE4AYQBtAGUAIAAkAGEAZABhAHAAdABlAHIATgBhAG0AZQAgAC0ARABpAHMAcABsAGEAeQBOAGEAbQBlACAAJABwAHIAbwBwAGUAcgB0AHkATgBhAG0AZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQANAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABwAHIAbwBwAGUAcgB0AHkAKQAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABTAGUAdAAtAE4AZQB0AEEAZABhAHAAdABlAHIAQQBkAHYAYQBuAGMAZQBkAFAAcgBvAHAAZQByAHQAeQAgAC0ATgBhAG0AZQAgACQAYQBkAGEAcAB0AGUAcgBOAGEAbQBlACAALQBEAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAkAHAAcgBvAHAAZQByAHQAeQBOAGEAbQBlACAALQBEAGkAcwBwAGwAYQB5AFYAYQBsAHUAZQAgACQAcAByAG8AcABlAHIAdAB5AFYAYQBsAHUAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAEYAYQBpAGwAZQBkACAAdABvACAAcwBlAHQAIAAkAHAAcgBvAHAAZQByAHQAeQBOAGEAbQBlACAAdABvACAAJABwAHIAbwBwAGUAcgB0AHkAVgBhAGwAdQBlACAAZgBvAHIAIAAkAGEAZABhAHAAdABlAHIATgBhAG0AZQAuACAAJABfACIADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAIAAgACAAIAB9ACAAZQBsAHMAZQAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgBQAHIAbwBwAGUAcgB0AHkAIAAkAHAAcgBvAHAAZQByAHQAeQBOAGEAbQBlACAAbgBvAHQAIABmAG8AdQBuAGQAIABmAG8AcgAgACQAYQBkAGEAcAB0AGUAcgBOAGEAbQBlAC4AIgANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQAgAGUAbABzAGUAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAEEAZABhAHAAdABlAHIAIAAkAGEAZABhAHAAdABlAHIATgBhAG0AZQAgAG4AbwB0ACAAZgBvAHUAbgBkAC4AIgANAAoAIAAgACAAIAB9AA0ACgB9AA0ACgANAAoAJABuAGUAdAB3AG8AcgBrAEEAZABhAHAAdABlAHIAcwAgAD0AIABHAGUAdAAtAE4AZQB0AEEAZABhAHAAdABlAHIADQAKAA0ACgBmAG8AcgBlAGEAYwBoACAAKAAkAGEAZABhAHAAdABlAHIAIABpAG4AIAAkAG4AZQB0AHcAbwByAGsAQQBkAGEAcAB0AGUAcgBzACkAIAB7AA0ACgAgACAAIAAgACQAYQBkAGEAcAB0AGUAcgBOAGEAbQBlACAAPQAgACQAYQBkAGEAcAB0AGUAcgAuAE4AYQBtAGUADQAKAA0ACgAgACAAIAAgAGkAZgAgACgAJABhAGQAYQBwAHQAZQByAE4AYQBtAGUAK
lea rcx, [rbp + 0x460]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x460]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rdx, [rbp]
lea rcx, [rbp + 8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x40], 0x38
mov rdx, rdi
lea rcx, [rbp + 8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x28]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x40], 0x78
mov r8d, 0xffffffff
lea rdx, [0x1401bf410]
lea rcx, [rbp + 0x468]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x28]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x468]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0x28]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x28]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov dword [rsp + 0x40], r12d
lea rcx, [rbp - 8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x470]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xd8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xd0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x228]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x478]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x220]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x218]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x210]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov edx, 0x29
lea rcx, str.TCP_Fingerprint_JA4Svs_Spoofing._Stage_2
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1e0], rax
mov edx, 3
lea rcx, [0x1401b7328]
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1a8], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x1b0], rax
lea rax, [rbp + 0x1e0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1a8]
lea r8, [rbp + 0x1b0]
lea rdx, [rbp + 0x4c8]
mov rcx, rsi
call fcn.140125d10
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.echo_Spoofing_Network_JA4Svs_Fingerprints..._
lea rcx, [rbp - 0x18]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x40], 0x80
mov rdx, rbx
lea rcx, [rbp - 0x18]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x20]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x40], 0x180
mov r8d, 0xffffffff
lea rdx, str._r_npowershell__encodedCommand_JABhAHUAdABvAFQAdQBuAGkAbgBnAEwAZQB2AGUAbABzACAAPQAgAEAAKAAiAGQAaQBzAGEAYgBsAGUAZAAiACwAIAAiAGgAaQBnAGgAbAB5AHIAZQBzAHQAcgBpAGMAdABlAGQAIgAsACAAIgByAGUAcwB0AHIAaQBjAHQAZQBkACIALAAgACIAbgBvAHIAbQBhAGwAIgAsACAAIgBlAHgAcABlAHIAaQBtAGUAbgB0AGEAbAAiACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AC0AUgBhAG4AZABvAG0AQgBvAG8AbABlAGEAbgAgAHsADQAKACAAIAAgACAAaQBmACAAKAAoAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAE0AaQBuAGkAbQB1AG0AIAAwACAALQBNAGEAeABpAG0AdQBtACAAMgApACAALQBlAHEAIAAxACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAAiAGUAbgBhAGIAbABlAGQAIgANAAoAIAAgACAAIAB9ACAAZQBsAHMAZQAgAHsADQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACIAZABpAHMAYQBiAGwAZQBkACIADQAKACAAIAAgACAAfQANAAoAfQANAAoADQAKACQAYQB1AHQAbwB0AHUAbgBpAG4AZwBsAGUAdgBlAGwAIAA9ACAAJABhAHUAdABvAFQAdQBuAGkAbgBnAEwAZQB2AGUAbABzACAAfAAgAEcAZQB0AC0AUgBhAG4AZABvAG0ADQAKACQAZQBjAG4AYwBhAHAAYQBiAGkAbABpAHQAeQAgAD0AIABHAGUAdAAtAFIAYQBuAGQAbwBtAEIAbwBvAGwAZQBhAG4ADQAKACQAcgBzAHMAIAA9ACAARwBlAHQALQBSAGEAbgBkAG8AbQBCAG8AbwBsAGUAYQBuAA0ACgAkAHQAaQBtAGUAcwB0AGEAbQBwAHMAIAA9ACAARwBlAHQALQBSAGEAbgBkAG8AbQBCAG8AbwBsAGUAYQBuAA0ACgAkAGkAbgBpAHQAaQBhAGwAUgB0AG8AIAA9ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0ATQBpAG4AaQBtAHUAbQAgADMAMAAwACAALQBNAGEAeABpAG0AdQBtACAAMwAwADAAMAANAAoAJABtAGEAeABTAHkAbgBSAGUAdAByAGEAbgBzAG0AaQBzAHMAaQBvAG4AcwAgAD0AIABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAAMgAgAC0ATQBhAHgAaQBtAHUAbQAgADgADQAKACQAbgBvAG4AUwBhAGMAawBSAHQAdABSAGUAcwBpAGwAaQBlAG4AYwB5ACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AQgBvAG8AbABlAGEAbgANAAoAJABtAHMAcwAgAD0AIABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAANQAzADYAIAAtAE0AYQB4AGkAbQB1AG0AIAAxADQANgAwAA0ACgAkAHQAYwBwAFcAaQBuAGQAbwB3AFMAaQB6AGUAIAA9ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0ATQBpAG4AaQBtAHUAbQAgADgAMQA5ADIAIAAtAE0AYQB4AGkAbQB1AG0AIAA2ADUANQAzADUADQAKACQAdABjAHAATQBhAHgARABhAHQAYQBSAGUAdAByAGEAbgBzAG0AaQBzAHMAaQBvAG4AcwAgAD0AIABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAAMwAgAC0ATQBhAHgAaQBtAHUAbQAgADEAMAANAAoAJABrAGUAZQBwAEEAbABpAHYAZQBUAGkAbQBlACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAE0AaQBuAGkAbQB1AG0AIAAzADAAMAAwADAAMAAgAC0ATQBhAHgAaQBtAHUAbQAgADcAMgAwADAAMAAwAA0ACgANAAoAJABuAGUAdABzAGgAQwBvAG0AbQBhAG4AZAAgAD0AIAAiAG4AZQB0AHMAaAAgAGkAbgB0AGUAcgBmAGEAYwBlACAAdABjAHAAIABzAGUAdAAgAGcAbABvAGIAYQBsACAAYQB1AHQAbwB0AHUAbgBpAG4AZwBsAGUAdgBlAGwAPQAkAGEAdQB0AG8AdAB1AG4AaQBuAGcAbABlAHYAZQBsACAAZQBjAG4AYwBhAHAAYQBiAGkAbABpAHQAeQA9ACQAZQBjAG4AYwBhAHAAYQBiAGkAbABpAHQAeQAgAHIAcwBzAD0AJAByAHMAcwAgAHQAaQBtAGUAcwB0AGEAbQBwAHMAPQAkAHQAaQBtAGUAcwB0AGEAbQBwAHMAIABpAG4AaQB0AGkAYQBsAHIAdABvAD0AJABpAG4AaQB0AGkAYQBsAFIAdABvACAAbQBhAHgAcwB5AG4AcgBlAHQAcgBhAG4AcwBtAGkAcwBzAGkAbwBuAHMAPQAkAG0AYQB4AFMAeQBuAFIAZQB0AHIAYQBuAHMAbQBpAHMAcwBpAG8AbgBzACAAbgBvAG4AcwBhAGMAawByAHQAdAByAGUAcwBpAGwAaQBlAG4AYwB5AD0AJABuAG8AbgBTAGEAYwBrAFIAdAB0AFIAZQBzAGkAbABpAGUAbgBjAHkAIgANAAoASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAAJABuAGUAdABzAGgAQwBvAG0AbQBhAG4AZAANAAoADQAKAGYAdQBuAGMAdABpAG8AbgAgAFMAZQB0AC0AUgBlAGcAaQBzAHQAcgB5AFYAYQBsAHUAZQAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAkAGsAZQB5AFAAYQB0AGgALAANAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAkAHYAYQBsAHUAZQBOAGEAbQBlACwADQAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AJAB2AGEAbAB1AGUAVAB5AHAAZQAsAA0ACgAgACAAIAAgACAAIAAgACAAWwBzAHQAcgBpAG4AZwBdACQAdgBhAGwAdQBlAEQAYQB0AGEADQAKACAAIAAgACAAKQANAAoAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJABrAGUAeQBQAGEAdABoACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAawBlAHkAUABhAHQAaAAgAC0ATgBhAG0AZQAgACQAdgBhAGwAdQBlAE4AYQBtAGUAIAAtAFYAYQBsAHUAZQAgACQAdgBhAGwAdQBlAEQAYQB0AGEAIAAtAFQAeQBwAGUAIAAkAHYAYQBsAHUAZQBUAHkAcABlAA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgBSAGUAZwBpAHMAdAByAHkAIABrAGUAeQAgACQAawBlAHkAUABhAHQAaAAgAGQAbwBlAHMAIABuAG8AdAAgAGUAeABpAHMAdAAuACIADQAKACAAIAAgACAAfQANAAoAfQANAAoADQAKAFMAZQB0AC0AUgBlAGcAaQBzAHQAcgB5AFYAYQBsAHUAZQAgAC0AawBlAHkAUABhAHQAaAAgACIASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABTAGUAcgB2AGkAYwBlAHMAXABUAGMAc
lea rcx, [rbp + 0x480]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x20]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x480]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x20]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x18]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x4c8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1a8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp byte [rsi + 9], 0
je 0x140123921
lea rdx, str.taskkill__f__im_msedge.exe___nul_2_1__taskkill__f__im_chrome.exe___nul_2_1__timeout_1___nul__taskkill__f__im_msedge.exe___nul_2_1__taskkill__f__im_chrome.exe___nul_2_1_
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, str.powershell__if___env:MESA_RENDERER__exit__gldlls___MY_VBOX_ADDITIONS_etcFakeWebGL____env:MESA_RENDERER__replace_NVIDIA_GeForce___.____ins__Get_ItemProperty_HKLM:SoftwareMicrosoftWindowsCurrentVersionUninstall___Select_Object_DisplayName__DisplayVersion__InstallLocation__InstallDate__ins__Get_ItemProperty_HKLM:SoftwareWow6432NodeMicrosoftWindowsCurrentVersionUninstall__Select_Object_DisplayName__DisplayVersion__InstallLocation__InstallDate__ins______.DisplayName__like_microsoft_edge__or___.DisplayName__like_google_chrome___Foreach_Object___programdir____.InstallLocation______.DisplayVersion__Write_Host_Installing_FakeWebGL_for__.DisplayName__if___val__Get_Item__Path___programdir___ErrorAction_Ignore___copy___gldlls__.dll___Destination__programdir__Force____
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
mov edx, 0x1c
lea rcx, str.Stage_1___Popular_websites_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x188], rax
mov edx, 0x12
lea rcx, str.Social_Rate_Pumper
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x190], rax
mov edx, 8
lea rcx, str.logo.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x198], rax
lea rax, [rbp + 0x188]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x190]
lea r8, [rbp + 0x198]
lea rdx, [rbp + 0x488]
mov rcx, rsi
call fcn.140125d10
nop
lea r8, [0x1401cd760]
mov rdx, rax
lea rcx, [rbp + 0x2f0]
call fcn.140019700
nop
lea rcx, [rbp + 0x488]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x198]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x190]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x188]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea r12, [0x140000000]
nop dword [rax + rax]
mov edx, 0x106
lea rcx, str.timeout_3___nul__explorer___1___timeout_5___nul__explorer___2___timeout_5___nul__explorer___3___timeout_5___nul__explorer___4___timeout_5___nul__explorer___5___timeout_5___nul__taskkill__im_msedge.exe___nul_2_1__taskkill__im_chrome.exe___nul_2_1_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x158], rax
mov dl, 0x20
lea rcx, [rbp - 0x40]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov edx, 0x191
xor ecx, ecx
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov eax, eax
mov rcx, qword [r12 + rax*8 + 0x25ea90]
test rcx, rcx
je 0x140123a4b
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140123a40
jmp 0x140123a50
mov eax, 0xffffffff
mov edx, eax
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x160], rax
mov word [rsp + 0x20], bx
xor r9d, r9d
lea r8, [rbp + 0x160]
lea rdx, [rbp + 0x4b0]
lea rcx, [rbp + 0x158]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rdi, rax
mov dl, 0x20
lea rcx, [rbp + 0xa8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov edx, 0x191
xor ecx, ecx
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov ecx, eax
mov rcx, qword [r12 + rcx*8 + 0x25ea90]
test rcx, rcx
je 0x140123acb
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140123ac0
jmp 0x140123ad0
mov eax, 0xffffffff
mov edx, eax
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x168], rax
mov word [rsp + 0x20], bx
xor r9d, r9d
lea r8, [rbp + 0x168]
lea rdx, [rbp + 0x4a8]
mov rcx, rdi
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rdi, rax
mov dl, 0x20
lea rcx, [rbp + 0xa6]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov edx, 0x191
xor ecx, ecx
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov ecx, eax
mov rcx, qword [r12 + rcx*8 + 0x25ea90]
test rcx, rcx
je 0x140123b41
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140123b36
jmp 0x140123b46
mov eax, 0xffffffff
mov edx, eax
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x170], rax
mov word [rsp + 0x20], bx
xor r9d, r9d
lea r8, [rbp + 0x170]
lea rdx, [rbp + 0x4a0]
mov rcx, rdi
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rdi, rax
mov dl, 0x20
lea rcx, [rbp + 0xa4]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov edx, 0x191
xor ecx, ecx
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov ecx, eax
mov rcx, qword [r12 + rcx*8 + 0x25ea90]
test rcx, rcx
je 0x140123bbb
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140123bb0
jmp 0x140123bc0
mov eax, 0xffffffff
mov edx, eax
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x178], rax
mov word [rsp + 0x20], bx
xor r9d, r9d
lea r8, [rbp + 0x178]
lea rdx, [rbp + 0x498]
mov rcx, rdi
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rdi, rax
mov dl, 0x20
lea rcx, [rbp + 0xa2]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov edx, 0x191
xor ecx, ecx
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov ecx, eax
mov rcx, qword [r12 + rcx*8 + 0x25ea90]
test rcx, rcx
je 0x140123c31
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140123c26
jmp 0x140123c36
mov eax, 0xffffffff
mov edx, eax
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x180], rax
mov word [rsp + 0x20], bx
xor r9d, r9d
lea r8, [rbp + 0x180]
lea rdx, [rbp + 0x490]
mov rcx, rdi
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rbp + 0x2f0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x490]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x180]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x498]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x178]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x4a0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x170]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x4a8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x168]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x4b0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x160]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x158]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
sub r13, 1
jne 0x1401239f0
lea edx, [r13 + 0x12]
lea rcx, str.Stage_1_Finished_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x260], rax
lea edx, [r13 + 0x12]
lea rcx, str.Social_Rate_Pumper
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x148], rax
lea edx, [r13 + 8]
lea rcx, str.logo.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x150], rax
lea rax, [rbp + 0x260]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x148]
lea r8, [rbp + 0x150]
lea rdx, [rbp + 0x4c0]
mov rcx, rsi
call fcn.140125d10
nop
mov rdx, rax
lea rcx, [rbp - 0x20]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x40], 0x400
lea r8d, [r13 - 1]
lea rdx, str.__timeout_5___nul_r_n
lea rcx, [rbp + 0x4b8]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp - 0x20]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x4b8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x2f0]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x20]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x4c0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x150]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x148]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x260]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea edx, [r13 + 0x15]
lea rcx, str.Stage_1___1xbet_CDN_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x278], rax
lea edx, [r13 + 0xa]
lea rcx, str.CDN_Pumper
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x270], rax
lea edx, [r13 + 8]
lea rcx, str.logo.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x268], rax
lea rax, [rbp + 0x278]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x270]
lea r8, [rbp + 0x268]
lea rdx, [rbp + 0x510]
mov rcx, rsi
call fcn.140125d10
nop
lea r8, [0x1401cd760]
mov rdx, rax
lea rcx, [rbp + 0x2e8]
call fcn.140019700
nop
lea rcx, [rbp + 0x510]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x268]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x270]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x278]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea r14d, [r13 + 3]
nop dword [rax]
mov edx, 0xf5
lea rcx, str.timeout_3___nul__Start_chrome___1___timeout_5___nul__Start_chrome___2___timeout_5___nul__Start_chrome___3___timeout_5___nul__Start_chrome___4___timeout_5___nul__Start_chrome___5___timeout_5___nul__taskkill__im_chrome.exe___nul_2_1_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x238], rax
mov dl, 0x20
lea rcx, [rbp + 0xa0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov edx, 0x13
xor ecx, ecx
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov eax, eax
mov rcx, qword [r12 + rax*8 + 0x25f720]
test rcx, rcx
je 0x140123f4b
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x140123f40
jmp 0x140123f50
mov eax, 0xffffffff
mov edx, eax
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x230], rax
mov word [rsp + 0x20], bx
xor r9d, r9d
lea r8, [rbp + 0x230]
lea rdx, [rbp + 0x4f0]
lea rcx, [rbp + 0x238]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rdi, rax
mov dl, 0x20
lea rcx, [rbp + 0x9e]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov edx, 0x13
xor ecx, ecx
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov ecx, eax
mov rcx, qword [r12 + rcx*8 + 0x25f720]
test rcx, rcx
je 0x140123fcb
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140123fc0
jmp 0x140123fd0
mov eax, 0xffffffff
mov edx, eax
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x2a0], rax
mov word [rsp + 0x20], bx
xor r9d, r9d
lea r8, [rbp + 0x2a0]
lea rdx, [rbp + 0x4e8]
mov rcx, rdi
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rdi, rax
mov dl, 0x20
lea rcx, [rbp + 0x9c]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov edx, 0x13
xor ecx, ecx
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov ecx, eax
mov rcx, qword [r12 + rcx*8 + 0x25f720]
test rcx, rcx
je 0x140124041
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140124036
jmp 0x140124046
mov eax, 0xffffffff
mov edx, eax
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x290], rax
mov word [rsp + 0x20], bx
xor r9d, r9d
lea r8, [rbp + 0x290]
lea rdx, [rbp + 0x4e0]
mov rcx, rdi
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rdi, rax
mov dl, 0x20
lea rcx, [rbp - 0x10]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov edx, 0x13
xor ecx, ecx
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov ecx, eax
mov rcx, qword [r12 + rcx*8 + 0x25f720]
test rcx, rcx
je 0x1401240bb
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1401240b0
jmp 0x1401240c0
mov eax, 0xffffffff
mov edx, eax
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x288], rax
mov word [rsp + 0x20], bx
xor r9d, r9d
lea r8, [rbp + 0x288]
lea rdx, [rbp + 0x4d8]
mov rcx, rdi
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rdi, rax
mov dl, 0x20
lea rcx, [rbp + 0x98]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ebx, word [rax]
mov edx, 0x13
xor ecx, ecx
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov ecx, eax
mov rcx, qword [r12 + rcx*8 + 0x25f720]
test rcx, rcx
je 0x140124131
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140124126
jmp 0x140124136
mov eax, 0xffffffff
mov edx, eax
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x280], rax
mov word [rsp + 0x20], bx
xor r9d, r9d
lea r8, [rbp + 0x280]
lea rdx, [rbp + 0x4d0]
mov rcx, rdi
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
nop
mov rdx, rax
lea rcx, [rbp + 0x2e8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x4d0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x280]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x4d8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x288]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x4e0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x290]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x4e8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x4f0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x230]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x238]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
sub r14, 1
jne 0x140123ef0
lea edx, [r14 + 0x12]
lea rcx, str.Stage_1_Finished_
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x250], rax
lea edx, [r14 + 3]
lea rcx, [0x1401cd9f8]
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x248], rax
lea edx, [r14 + 8]
lea rcx, str.logo.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp + 0x240], rax
lea rax, [rbp + 0x250]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x248]
lea r8, [rbp + 0x240]
lea rdx, [rbp + 0x500]
mov rcx, rsi
call fcn.140125d10
nop
mov rdx, rax
lea rcx, [rbp - 0x28]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x40], 0x1000
lea r8d, [r14 - 1]
lea rdx, str.__timeout_5___nul_r_n
lea rcx, [rbp + 0x4f8]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp - 0x28]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x4f8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x2e8]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x40], r14d
lea rcx, [rbp - 0x28]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x500]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x240]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x248]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x250]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov ecx, dword [rsi]
cmp ecx, 1
jbe 0x1401250f3
lea eax, [rcx - 0x101]
cmp eax, 0x1a
ja 0x140124350
mov edx, 0x400020f
bt edx, eax
jb 0x1401250f3
cmp ecx, 0x205
je 0x1401250f3
cmp ecx, 0x221
je 0x1401250f3
cmp ecx, 0x100f
jne 0x140124557
mov edx, 0x1f
lea rcx, str.Cookie_Bot_has_finished._Enjoy.
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x78], rax
mov edx, 0xa
lea rcx, str.Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x70], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x68]
lea rdx, [rbp - 0x70]
mov rcx, rsi
call fcn.140125d10
mov rdi, rax
mov edx, 0x2e
lea rcx, str.Now_we_will_visit_few_websites_to_gain_cookies
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x60], rax
mov edx, 0xa
lea rcx, str.Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x58], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x78]
mov rcx, rsi
call fcn.140125d10
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.echo_Starting_Cookie_Bot..._
lea rcx, [rbp - 0x80]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x40], 0x2000
mov rdx, rbx
lea rcx, [rbp - 0x80]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
lea r8, str._r_npowershell__encodedCommand_JABjAGgAcgBvAG0AZQBQAGEAdABoACAAPQAgACIAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXABBAHAAcABsAGkAYwBhAHQAaQBvAG4AXABjAGgAcgBvAG0AZQAuAGUAeABlACIADQAKAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAKQApACAAewANAAoAIAAgACAAIAByAGUAdAB1AHIAbgANAAoAfQAgAGUAbABzAGUAIAB7AA0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgBDAGgAcgBvAG0AZQAgAGkAcwAgAGkAbgBzAHQAYQBsAGwAZQBkAC4AIgANAAoAfQANAAoADQAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AC0AUwBpAHQAZQBzAEYAcgBvAG0AUwBlAHIAdgBlAHIAIAB7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBoAHQAdABwADoALwAvADEAOAA4AC4AMQA2ADYALgA3ADgALgAxADEAMQAvAGcAZQB0AHMAaQB0AGUALgBwAGgAcAAiAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAcABvAG4AcwBlACAAPQAgAEkAbgB2AG8AawBlAC0AUgBlAHMAdABNAGUAdABoAG8AZAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAEcAZQB0ACAALQBDAG8AbgB0AGUAbgB0AFQAeQBwAGUAIAAnAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AJwANAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJAByAGUAcwBwAG8AbgBzAGUAIAAtAGEAbgBkACAAJAByAGUAcwBwAG8AbgBzAGUALgBwAG8AcAB1AGwAYQByAF8AcwBpAHQAZQBzACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAcgBlAHMAcABvAG4AcwBlAC4AcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwANAAoAIAAgACAAIAAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgACcAcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwAnACAAawBlAHkAIABmAG8AdQBuAGQAIABpAG4AIAByAGUAcwBwAG8AbgBzAGUALgAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsADQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAB9AA0ACgB9AA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAATwBwAGUAbgAtAFMAaQB0AGUAcwAgAHsADQAKACAAIAAgACAAUABhAHIAYQBtACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAHMAaQB0AGUAcwApAA0ACgAgACAAIAAgACQAYQByAGcAdQBtAGUAbgB0AHMAIAA9ACAAJABzAGkAdABlAHMAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACIALQAtAG4AZQB3AC0AdABhAGIAIgAsACAAJABfACAAfQANAAoAIAAgACAAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJABhAHIAZwB1AG0AZQBuAHQAcwANAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADAADQAKACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAYwBoAHIAbwBtAGUAIAB8ACAAUwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMADQAKAH0ADQAKAA0ACgAkAHMAaQB0AGUAcwAgAD0AIABHAGUAdAAtAFMAaQB0AGUAcwBGAHIAbwBtAFMAZQByAHYAZQByAA0ACgBpAGYAIAAoACQAcwBpAHQAZQBzACAALQBlAHEAIAAkAG4AdQBsAGwAKQAgAHsADQAKACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgAHMAaQB0AGUAcwAgAHIAZQBjAGUAaQB2AGUAZAAgAGYAcgBvAG0AIABzAGUAcgB2AGUAcgAuACIADQAKACAAIAAgACAAcgBlAHQAdQByAG4ADQAKAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIAUwBpAHQAZQBzACAAcgBlAGMAZQBpAHYAZQBkADoAIAAkACgAJABzAGkAdABlAHMALgBDAG8AdQBuAHQAKQAgAHMAaQB0AGUAcwAuACIADQAKAH0ADQAKAA0ACgBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABzAGkAdABlAHMALgBDAG8AdQBuAHQAOwAgACQAaQAgACsAPQAgADUAKQAgAHsADQAKACAAIAAgACAAJABjAHUAcgByAGUAbgB0AEIAYQB0AGMAaAAgAD0AIAAkAHMAaQB0AGUAcwBbACQAaQAuAC4AKAAkAGkAKwA0ACkAXQANAAoAIAAgACAAIABPAHAAZQBuAC0AUwBpAHQAZQBzACAALQBzAGkAdABlAHMAIAAkAGMAdQByAHIAZQBuAHQAQgBhAHQAYwBoAA0ACgB9AA__r_n
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x60]
call fcn.140019700
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rsp + 0x40], 0x6000
mov rdx, rdi
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
lea r8, [0x1401bf410]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x68]
call fcn.140019700
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x78]
jmp 0x1401250ed
cmp ecx, 0x222
jne 0x14012472e
mov edx, 0x1f
lea rcx, str.Cookie_Bot_has_finished._Enjoy.
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x50], rax
mov edx, 0xa
lea rcx, str.Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x58], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x80]
mov rcx, rsi
call fcn.140125d10
mov rdi, rax
mov edx, 0x2e
lea rcx, str.Now_we_will_visit_few_websites_to_gain_cookies
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x68], rax
mov edx, 0xa
lea rcx, str.Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x70], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x78]
lea rdx, [rbp - 0x68]
mov rcx, rsi
call fcn.140125d10
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.echo_Starting_Cookie_Bot..._
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x40], 0x8000
mov rdx, rbx
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
lea r8, str._r_npowershell__encodedCommand_JABjAGgAcgBvAG0AZQBQAGEAdABoACAAPQAgACIAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXABBAHAAcABsAGkAYwBhAHQAaQBvAG4AXABjAGgAcgBvAG0AZQAuAGUAeABlACIADQAKAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAKQApACAAewANAAoAIAAgACAAIAByAGUAdAB1AHIAbgANAAoAfQAgAGUAbABzAGUAIAB7AA0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgBDAGgAcgBvAG0AZQAgAGkAcwAgAGkAbgBzAHQAYQBsAGwAZQBkAC4AIgANAAoAfQANAAoADQAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AC0AUwBpAHQAZQBzAEYAcgBvAG0AUwBlAHIAdgBlAHIAIAB7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBoAHQAdABwADoALwAvADEAOAA4AC4AMQA2ADYALgA3ADgALgAxADEAMQAvAGcAZQB0AHMAaQB0AGUALgBwAGgAcAAiAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAcABvAG4AcwBlACAAPQAgAEkAbgB2AG8AawBlAC0AUgBlAHMAdABNAGUAdABoAG8AZAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAEcAZQB0ACAALQBDAG8AbgB0AGUAbgB0AFQAeQBwAGUAIAAnAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AJwANAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJAByAGUAcwBwAG8AbgBzAGUAIAAtAGEAbgBkACAAJAByAGUAcwBwAG8AbgBzAGUALgBwAG8AcAB1AGwAYQByAF8AcwBpAHQAZQBzACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAcgBlAHMAcABvAG4AcwBlAC4AcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwANAAoAIAAgACAAIAAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgACcAcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwAnACAAawBlAHkAIABmAG8AdQBuAGQAIABpAG4AIAByAGUAcwBwAG8AbgBzAGUALgAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsADQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAB9AA0ACgB9AA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAATwBwAGUAbgAtAFMAaQB0AGUAcwAgAHsADQAKACAAIAAgACAAUABhAHIAYQBtACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAHMAaQB0AGUAcwApAA0ACgAgACAAIAAgACQAYQByAGcAdQBtAGUAbgB0AHMAIAA9ACAAJABzAGkAdABlAHMAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACIALQAtAG4AZQB3AC0AdABhAGIAIgAsACAAJABfACAAfQANAAoAIAAgACAAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJABhAHIAZwB1AG0AZQBuAHQAcwANAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADAADQAKACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAYwBoAHIAbwBtAGUAIAB8ACAAUwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMADQAKAH0ADQAKAA0ACgAkAHMAaQB0AGUAcwAgAD0AIABHAGUAdAAtAFMAaQB0AGUAcwBGAHIAbwBtAFMAZQByAHYAZQByAA0ACgBpAGYAIAAoACQAcwBpAHQAZQBzACAALQBlAHEAIAAkAG4AdQBsAGwAKQAgAHsADQAKACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgAHMAaQB0AGUAcwAgAHIAZQBjAGUAaQB2AGUAZAAgAGYAcgBvAG0AIABzAGUAcgB2AGUAcgAuACIADQAKACAAIAAgACAAcgBlAHQAdQByAG4ADQAKAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIAUwBpAHQAZQBzACAAcgBlAGMAZQBpAHYAZQBkADoAIAAkACgAJABzAGkAdABlAHMALgBDAG8AdQBuAHQAKQAgAHMAaQB0AGUAcwAuACIADQAKAH0ADQAKAA0ACgBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABzAGkAdABlAHMALgBDAG8AdQBuAHQAOwAgACQAaQAgACsAPQAgADUAKQAgAHsADQAKACAAIAAgACAAJABjAHUAcgByAGUAbgB0AEIAYQB0AGMAaAAgAD0AIAAkAHMAaQB0AGUAcwBbACQAaQAuAC4AKAAkAGkAKwA0ACkAXQANAAoAIAAgACAAIABPAHAAZQBuAC0AUwBpAHQAZQBzACAALQBzAGkAdABlAHMAIAAkAGMAdQByAHIAZQBuAHQAQgBhAHQAYwBoAA0ACgB9AA__r_n
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x60]
call fcn.140019700
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14003b850
nop
lea r8, [0x1401bf410]
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.140019700
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
jmp 0x1401250e8
cmp ecx, 4
je 0x1401250f3
lea eax, [rcx - 0x1006]
cmp eax, 0xe
ja 0x140124750
mov edx, 0x4801
bt edx, eax
jb 0x1401250f3
cmp ecx, 0x1020
jne 0x140124927
mov edx, 0x1f
lea rcx, str.Cookie_Bot_has_finished._Enjoy.
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x50], rax
mov edx, 0xa
lea rcx, str.Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x58], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x80]
mov rcx, rsi
call fcn.140125d10
mov rdi, rax
mov edx, 0x2e
lea rcx, str.Now_we_will_visit_few_websites_to_gain_cookies
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x68], rax
mov edx, 0xa
lea rcx, str.Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x70], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x78]
lea rdx, [rbp - 0x68]
mov rcx, rsi
call fcn.140125d10
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.echo_Starting_Cookie_Bot..._
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x40], 0x10000
mov rdx, rbx
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
lea r8, str._r_npowershell__encodedCommand_JABjAGgAcgBvAG0AZQBQAGEAdABoACAAPQAgACIAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXABBAHAAcABsAGkAYwBhAHQAaQBvAG4AXABjAGgAcgBvAG0AZQAuAGUAeABlACIADQAKAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAKQApACAAewANAAoAIAAgACAAIAByAGUAdAB1AHIAbgANAAoAfQAgAGUAbABzAGUAIAB7AA0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgBDAGgAcgBvAG0AZQAgAGkAcwAgAGkAbgBzAHQAYQBsAGwAZQBkAC4AIgANAAoAfQANAAoADQAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AC0AUwBpAHQAZQBzAEYAcgBvAG0AUwBlAHIAdgBlAHIAIAB7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBoAHQAdABwADoALwAvADEAOAA4AC4AMQA2ADYALgA3ADgALgAxADEAMQAvAGcAZQB0AHMAaQB0AGUALgBwAGgAcAAiAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAcABvAG4AcwBlACAAPQAgAEkAbgB2AG8AawBlAC0AUgBlAHMAdABNAGUAdABoAG8AZAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAEcAZQB0ACAALQBDAG8AbgB0AGUAbgB0AFQAeQBwAGUAIAAnAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AJwANAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJAByAGUAcwBwAG8AbgBzAGUAIAAtAGEAbgBkACAAJAByAGUAcwBwAG8AbgBzAGUALgBwAG8AcAB1AGwAYQByAF8AcwBpAHQAZQBzACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAcgBlAHMAcABvAG4AcwBlAC4AcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwANAAoAIAAgACAAIAAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgACcAcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwAnACAAawBlAHkAIABmAG8AdQBuAGQAIABpAG4AIAByAGUAcwBwAG8AbgBzAGUALgAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsADQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAB9AA0ACgB9AA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAATwBwAGUAbgAtAFMAaQB0AGUAcwAgAHsADQAKACAAIAAgACAAUABhAHIAYQBtACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAHMAaQB0AGUAcwApAA0ACgAgACAAIAAgACQAYQByAGcAdQBtAGUAbgB0AHMAIAA9ACAAJABzAGkAdABlAHMAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACIALQAtAG4AZQB3AC0AdABhAGIAIgAsACAAJABfACAAfQANAAoAIAAgACAAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJABhAHIAZwB1AG0AZQBuAHQAcwANAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADAADQAKACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAYwBoAHIAbwBtAGUAIAB8ACAAUwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMADQAKAH0ADQAKAA0ACgAkAHMAaQB0AGUAcwAgAD0AIABHAGUAdAAtAFMAaQB0AGUAcwBGAHIAbwBtAFMAZQByAHYAZQByAA0ACgBpAGYAIAAoACQAcwBpAHQAZQBzACAALQBlAHEAIAAkAG4AdQBsAGwAKQAgAHsADQAKACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgAHMAaQB0AGUAcwAgAHIAZQBjAGUAaQB2AGUAZAAgAGYAcgBvAG0AIABzAGUAcgB2AGUAcgAuACIADQAKACAAIAAgACAAcgBlAHQAdQByAG4ADQAKAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIAUwBpAHQAZQBzACAAcgBlAGMAZQBpAHYAZQBkADoAIAAkACgAJABzAGkAdABlAHMALgBDAG8AdQBuAHQAKQAgAHMAaQB0AGUAcwAuACIADQAKAH0ADQAKAA0ACgBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABzAGkAdABlAHMALgBDAG8AdQBuAHQAOwAgACQAaQAgACsAPQAgADUAKQAgAHsADQAKACAAIAAgACAAJABjAHUAcgByAGUAbgB0AEIAYQB0AGMAaAAgAD0AIAAkAHMAaQB0AGUAcwBbACQAaQAuAC4AKAAkAGkAKwA0ACkAXQANAAoAIAAgACAAIABPAHAAZQBuAC0AUwBpAHQAZQBzACAALQBzAGkAdABlAHMAIAAkAGMAdQByAHIAZQBuAHQAQgBhAHQAYwBoAA0ACgB9AA__r_n
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x60]
call fcn.140019700
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14003b850
nop
lea r8, [0x1401bf410]
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.140019700
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
jmp 0x1401250e8
lea eax, [rcx - 0x100a]
cmp eax, 0x18
ja 0x140124940
mov edx, 0x1b8705f
bt edx, eax
jb 0x1401250f3
lea eax, [rcx - 0x21f]
cmp eax, 1
jbe 0x1401250f3
cmp ecx, 0x11a
je 0x1401250f3
cmp ecx, 0x1019
jne 0x140124b32
mov edx, 0x1f
lea rcx, str.Cookie_Bot_has_finished._Enjoy.
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x50], rax
mov edx, 0xa
lea rcx, str.Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x58], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x80]
mov rcx, rsi
call fcn.140125d10
mov rdi, rax
mov edx, 0x2e
lea rcx, str.Now_we_will_visit_few_websites_to_gain_cookies
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x68], rax
mov edx, 0xa
lea rcx, str.Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x70], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x78]
lea rdx, [rbp - 0x68]
mov rcx, rsi
call fcn.140125d10
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.echo_Starting_Cookie_Bot..._
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x40], 0x20000
mov rdx, rbx
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
lea r8, str._r_npowershell__encodedCommand_JABjAGgAcgBvAG0AZQBQAGEAdABoACAAPQAgACIAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXABBAHAAcABsAGkAYwBhAHQAaQBvAG4AXABjAGgAcgBvAG0AZQAuAGUAeABlACIADQAKAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAKQApACAAewANAAoAIAAgACAAIAByAGUAdAB1AHIAbgANAAoAfQAgAGUAbABzAGUAIAB7AA0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgBDAGgAcgBvAG0AZQAgAGkAcwAgAGkAbgBzAHQAYQBsAGwAZQBkAC4AIgANAAoAfQANAAoADQAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AC0AUwBpAHQAZQBzAEYAcgBvAG0AUwBlAHIAdgBlAHIAIAB7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBoAHQAdABwADoALwAvADEAOAA4AC4AMQA2ADYALgA3ADgALgAxADEAMQAvAGcAZQB0AHMAaQB0AGUALgBwAGgAcAAiAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAcABvAG4AcwBlACAAPQAgAEkAbgB2AG8AawBlAC0AUgBlAHMAdABNAGUAdABoAG8AZAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAEcAZQB0ACAALQBDAG8AbgB0AGUAbgB0AFQAeQBwAGUAIAAnAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AJwANAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJAByAGUAcwBwAG8AbgBzAGUAIAAtAGEAbgBkACAAJAByAGUAcwBwAG8AbgBzAGUALgBwAG8AcAB1AGwAYQByAF8AcwBpAHQAZQBzACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAcgBlAHMAcABvAG4AcwBlAC4AcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwANAAoAIAAgACAAIAAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgACcAcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwAnACAAawBlAHkAIABmAG8AdQBuAGQAIABpAG4AIAByAGUAcwBwAG8AbgBzAGUALgAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsADQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAB9AA0ACgB9AA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAATwBwAGUAbgAtAFMAaQB0AGUAcwAgAHsADQAKACAAIAAgACAAUABhAHIAYQBtACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAHMAaQB0AGUAcwApAA0ACgAgACAAIAAgACQAYQByAGcAdQBtAGUAbgB0AHMAIAA9ACAAJABzAGkAdABlAHMAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACIALQAtAG4AZQB3AC0AdABhAGIAIgAsACAAJABfACAAfQANAAoAIAAgACAAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJABhAHIAZwB1AG0AZQBuAHQAcwANAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADAADQAKACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAYwBoAHIAbwBtAGUAIAB8ACAAUwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMADQAKAH0ADQAKAA0ACgAkAHMAaQB0AGUAcwAgAD0AIABHAGUAdAAtAFMAaQB0AGUAcwBGAHIAbwBtAFMAZQByAHYAZQByAA0ACgBpAGYAIAAoACQAcwBpAHQAZQBzACAALQBlAHEAIAAkAG4AdQBsAGwAKQAgAHsADQAKACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgAHMAaQB0AGUAcwAgAHIAZQBjAGUAaQB2AGUAZAAgAGYAcgBvAG0AIABzAGUAcgB2AGUAcgAuACIADQAKACAAIAAgACAAcgBlAHQAdQByAG4ADQAKAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIAUwBpAHQAZQBzACAAcgBlAGMAZQBpAHYAZQBkADoAIAAkACgAJABzAGkAdABlAHMALgBDAG8AdQBuAHQAKQAgAHMAaQB0AGUAcwAuACIADQAKAH0ADQAKAA0ACgBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABzAGkAdABlAHMALgBDAG8AdQBuAHQAOwAgACQAaQAgACsAPQAgADUAKQAgAHsADQAKACAAIAAgACAAJABjAHUAcgByAGUAbgB0AEIAYQB0AGMAaAAgAD0AIAAkAHMAaQB0AGUAcwBbACQAaQAuAC4AKAAkAGkAKwA0ACkAXQANAAoAIAAgACAAIABPAHAAZQBuAC0AUwBpAHQAZQBzACAALQBzAGkAdABlAHMAIAAkAGMAdQByAHIAZQBuAHQAQgBhAHQAYwBoAA0ACgB9AA__r_n
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x60]
call fcn.140019700
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14003b850
nop
lea r8, [0x1401bf410]
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.140019700
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
jmp 0x1401250e8
cmp ecx, 0x208
jne 0x140124d09
mov edx, 0x1f
lea rcx, str.Cookie_Bot_has_finished._Enjoy.
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x50], rax
mov edx, 0xa
lea rcx, str.Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x58], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x80]
mov rcx, rsi
call fcn.140125d10
mov rdi, rax
mov edx, 0x2e
lea rcx, str.Now_we_will_visit_few_websites_to_gain_cookies
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x68], rax
mov edx, 0xa
lea rcx, str.Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x70], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x78]
lea rdx, [rbp - 0x68]
mov rcx, rsi
call fcn.140125d10
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.echo_Starting_Cookie_Bot..._
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x40], 0x40000
mov rdx, rbx
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
lea r8, str._r_npowershell__encodedCommand_JABjAGgAcgBvAG0AZQBQAGEAdABoACAAPQAgACIAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXABBAHAAcABsAGkAYwBhAHQAaQBvAG4AXABjAGgAcgBvAG0AZQAuAGUAeABlACIADQAKAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAKQApACAAewANAAoAIAAgACAAIAByAGUAdAB1AHIAbgANAAoAfQAgAGUAbABzAGUAIAB7AA0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgBDAGgAcgBvAG0AZQAgAGkAcwAgAGkAbgBzAHQAYQBsAGwAZQBkAC4AIgANAAoAfQANAAoADQAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AC0AUwBpAHQAZQBzAEYAcgBvAG0AUwBlAHIAdgBlAHIAIAB7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBoAHQAdABwADoALwAvADEAOAA4AC4AMQA2ADYALgA3ADgALgAxADEAMQAvAGcAZQB0AHMAaQB0AGUALgBwAGgAcAAiAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAcABvAG4AcwBlACAAPQAgAEkAbgB2AG8AawBlAC0AUgBlAHMAdABNAGUAdABoAG8AZAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAEcAZQB0ACAALQBDAG8AbgB0AGUAbgB0AFQAeQBwAGUAIAAnAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AJwANAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJAByAGUAcwBwAG8AbgBzAGUAIAAtAGEAbgBkACAAJAByAGUAcwBwAG8AbgBzAGUALgBwAG8AcAB1AGwAYQByAF8AcwBpAHQAZQBzACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAcgBlAHMAcABvAG4AcwBlAC4AcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwANAAoAIAAgACAAIAAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgACcAcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwAnACAAawBlAHkAIABmAG8AdQBuAGQAIABpAG4AIAByAGUAcwBwAG8AbgBzAGUALgAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsADQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAB9AA0ACgB9AA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAATwBwAGUAbgAtAFMAaQB0AGUAcwAgAHsADQAKACAAIAAgACAAUABhAHIAYQBtACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAHMAaQB0AGUAcwApAA0ACgAgACAAIAAgACQAYQByAGcAdQBtAGUAbgB0AHMAIAA9ACAAJABzAGkAdABlAHMAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACIALQAtAG4AZQB3AC0AdABhAGIAIgAsACAAJABfACAAfQANAAoAIAAgACAAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJABhAHIAZwB1AG0AZQBuAHQAcwANAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADAADQAKACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAYwBoAHIAbwBtAGUAIAB8ACAAUwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMADQAKAH0ADQAKAA0ACgAkAHMAaQB0AGUAcwAgAD0AIABHAGUAdAAtAFMAaQB0AGUAcwBGAHIAbwBtAFMAZQByAHYAZQByAA0ACgBpAGYAIAAoACQAcwBpAHQAZQBzACAALQBlAHEAIAAkAG4AdQBsAGwAKQAgAHsADQAKACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgAHMAaQB0AGUAcwAgAHIAZQBjAGUAaQB2AGUAZAAgAGYAcgBvAG0AIABzAGUAcgB2AGUAcgAuACIADQAKACAAIAAgACAAcgBlAHQAdQByAG4ADQAKAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIAUwBpAHQAZQBzACAAcgBlAGMAZQBpAHYAZQBkADoAIAAkACgAJABzAGkAdABlAHMALgBDAG8AdQBuAHQAKQAgAHMAaQB0AGUAcwAuACIADQAKAH0ADQAKAA0ACgBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABzAGkAdABlAHMALgBDAG8AdQBuAHQAOwAgACQAaQAgACsAPQAgADUAKQAgAHsADQAKACAAIAAgACAAJABjAHUAcgByAGUAbgB0AEIAYQB0AGMAaAAgAD0AIAAkAHMAaQB0AGUAcwBbACQAaQAuAC4AKAAkAGkAKwA0ACkAXQANAAoAIAAgACAAIABPAHAAZQBuAC0AUwBpAHQAZQBzACAALQBzAGkAdABlAHMAIAAkAGMAdQByAHIAZQBuAHQAQgBhAHQAYwBoAA0ACgB9AA__r_n
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x60]
call fcn.140019700
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14003b850
nop
lea r8, [0x1401bf410]
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.140019700
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
jmp 0x1401250e8
lea eax, [rcx - 0x209]
cmp eax, 2
jbe 0x1401250f3
lea eax, [rcx - 0x10c]
cmp eax, 1
jbe 0x1401250f3
cmp ecx, 0x11c
je 0x1401250f3
cmp ecx, 0x1013
je 0x1401250f3
cmp ecx, 0x1004
jne 0x140124f16
mov edx, 0x1f
lea rcx, str.Cookie_Bot_has_finished._Enjoy.
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x50], rax
mov edx, 0xa
lea rcx, str.Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x58], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x80]
mov rcx, rsi
call fcn.140125d10
mov rdi, rax
mov edx, 0x2e
lea rcx, str.Now_we_will_visit_few_websites_to_gain_cookies
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x68], rax
mov edx, 0xa
lea rcx, str.Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x70], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x78]
lea rdx, [rbp - 0x68]
mov rcx, rsi
call fcn.140125d10
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.echo_Starting_Cookie_Bot..._
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x40], 0x80000
mov rdx, rbx
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
lea r8, str._r_npowershell__encodedCommand_JABjAGgAcgBvAG0AZQBQAGEAdABoACAAPQAgACIAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXABBAHAAcABsAGkAYwBhAHQAaQBvAG4AXABjAGgAcgBvAG0AZQAuAGUAeABlACIADQAKAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAKQApACAAewANAAoAIAAgACAAIAByAGUAdAB1AHIAbgANAAoAfQAgAGUAbABzAGUAIAB7AA0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgBDAGgAcgBvAG0AZQAgAGkAcwAgAGkAbgBzAHQAYQBsAGwAZQBkAC4AIgANAAoAfQANAAoADQAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AC0AUwBpAHQAZQBzAEYAcgBvAG0AUwBlAHIAdgBlAHIAIAB7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBoAHQAdABwADoALwAvADEAOAA4AC4AMQA2ADYALgA3ADgALgAxADEAMQAvAGcAZQB0AHMAaQB0AGUALgBwAGgAcAAiAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAcABvAG4AcwBlACAAPQAgAEkAbgB2AG8AawBlAC0AUgBlAHMAdABNAGUAdABoAG8AZAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAEcAZQB0ACAALQBDAG8AbgB0AGUAbgB0AFQAeQBwAGUAIAAnAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AJwANAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJAByAGUAcwBwAG8AbgBzAGUAIAAtAGEAbgBkACAAJAByAGUAcwBwAG8AbgBzAGUALgBwAG8AcAB1AGwAYQByAF8AcwBpAHQAZQBzACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAcgBlAHMAcABvAG4AcwBlAC4AcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwANAAoAIAAgACAAIAAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgACcAcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwAnACAAawBlAHkAIABmAG8AdQBuAGQAIABpAG4AIAByAGUAcwBwAG8AbgBzAGUALgAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsADQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAB9AA0ACgB9AA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAATwBwAGUAbgAtAFMAaQB0AGUAcwAgAHsADQAKACAAIAAgACAAUABhAHIAYQBtACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAHMAaQB0AGUAcwApAA0ACgAgACAAIAAgACQAYQByAGcAdQBtAGUAbgB0AHMAIAA9ACAAJABzAGkAdABlAHMAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACIALQAtAG4AZQB3AC0AdABhAGIAIgAsACAAJABfACAAfQANAAoAIAAgACAAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJABhAHIAZwB1AG0AZQBuAHQAcwANAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADAADQAKACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAYwBoAHIAbwBtAGUAIAB8ACAAUwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMADQAKAH0ADQAKAA0ACgAkAHMAaQB0AGUAcwAgAD0AIABHAGUAdAAtAFMAaQB0AGUAcwBGAHIAbwBtAFMAZQByAHYAZQByAA0ACgBpAGYAIAAoACQAcwBpAHQAZQBzACAALQBlAHEAIAAkAG4AdQBsAGwAKQAgAHsADQAKACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgAHMAaQB0AGUAcwAgAHIAZQBjAGUAaQB2AGUAZAAgAGYAcgBvAG0AIABzAGUAcgB2AGUAcgAuACIADQAKACAAIAAgACAAcgBlAHQAdQByAG4ADQAKAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIAUwBpAHQAZQBzACAAcgBlAGMAZQBpAHYAZQBkADoAIAAkACgAJABzAGkAdABlAHMALgBDAG8AdQBuAHQAKQAgAHMAaQB0AGUAcwAuACIADQAKAH0ADQAKAA0ACgBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABzAGkAdABlAHMALgBDAG8AdQBuAHQAOwAgACQAaQAgACsAPQAgADUAKQAgAHsADQAKACAAIAAgACAAJABjAHUAcgByAGUAbgB0AEIAYQB0AGMAaAAgAD0AIAAkAHMAaQB0AGUAcwBbACQAaQAuAC4AKAAkAGkAKwA0ACkAXQANAAoAIAAgACAAIABPAHAAZQBuAC0AUwBpAHQAZQBzACAALQBzAGkAdABlAHMAIAAkAGMAdQByAHIAZQBuAHQAQgBhAHQAYwBoAA0ACgB9AA__r_n
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x60]
call fcn.140019700
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14003b850
nop
lea r8, [0x1401bf410]
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.140019700
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
jmp 0x1401250e8
cmp ecx, 0x207
jne 0x1401250f3
mov edx, 0x1f
lea rcx, str.Cookie_Bot_has_finished._Enjoy.
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x50], rax
mov edx, 0xa
lea rcx, str.Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x58], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x80]
mov rcx, rsi
call fcn.140125d10
mov rdi, rax
mov edx, 0x2e
lea rcx, str.Now_we_will_visit_few_websites_to_gain_cookies
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x68], rax
mov edx, 0xa
lea rcx, str.Cookie_Bot
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x70], rax
mov edx, 9
lea rcx, str.logo3.png
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x78]
lea rdx, [rbp - 0x68]
mov rcx, rsi
call fcn.140125d10
mov rbx, rax
mov r8d, 0xffffffff
lea rdx, str.echo_Starting_Cookie_Bot..._
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
mov dword [rsp + 0x40], 0x100000
mov rdx, rbx
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
lea r8, str._r_npowershell__encodedCommand_JABjAGgAcgBvAG0AZQBQAGEAdABoACAAPQAgACIAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXABBAHAAcABsAGkAYwBhAHQAaQBvAG4AXABjAGgAcgBvAG0AZQAuAGUAeABlACIADQAKAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAKQApACAAewANAAoAIAAgACAAIAByAGUAdAB1AHIAbgANAAoAfQAgAGUAbABzAGUAIAB7AA0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgBDAGgAcgBvAG0AZQAgAGkAcwAgAGkAbgBzAHQAYQBsAGwAZQBkAC4AIgANAAoAfQANAAoADQAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AC0AUwBpAHQAZQBzAEYAcgBvAG0AUwBlAHIAdgBlAHIAIAB7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBoAHQAdABwADoALwAvADEAOAA4AC4AMQA2ADYALgA3ADgALgAxADEAMQAvAGcAZQB0AHMAaQB0AGUALgBwAGgAcAAiAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAcABvAG4AcwBlACAAPQAgAEkAbgB2AG8AawBlAC0AUgBlAHMAdABNAGUAdABoAG8AZAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAEcAZQB0ACAALQBDAG8AbgB0AGUAbgB0AFQAeQBwAGUAIAAnAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AJwANAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJAByAGUAcwBwAG8AbgBzAGUAIAAtAGEAbgBkACAAJAByAGUAcwBwAG8AbgBzAGUALgBwAG8AcAB1AGwAYQByAF8AcwBpAHQAZQBzACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAcgBlAHMAcABvAG4AcwBlAC4AcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwANAAoAIAAgACAAIAAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgACcAcABvAHAAdQBsAGEAcgBfAHMAaQB0AGUAcwAnACAAawBlAHkAIABmAG8AdQBuAGQAIABpAG4AIAByAGUAcwBwAG8AbgBzAGUALgAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsADQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAANAAoAIAAgACAAIAB9AA0ACgB9AA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAATwBwAGUAbgAtAFMAaQB0AGUAcwAgAHsADQAKACAAIAAgACAAUABhAHIAYQBtACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAHMAaQB0AGUAcwApAA0ACgAgACAAIAAgACQAYQByAGcAdQBtAGUAbgB0AHMAIAA9ACAAJABzAGkAdABlAHMAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACIALQAtAG4AZQB3AC0AdABhAGIAIgAsACAAJABfACAAfQANAAoAIAAgACAAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAGMAaAByAG8AbQBlAFAAYQB0AGgAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJABhAHIAZwB1AG0AZQBuAHQAcwANAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADAADQAKACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAYwBoAHIAbwBtAGUAIAB8ACAAUwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMADQAKAH0ADQAKAA0ACgAkAHMAaQB0AGUAcwAgAD0AIABHAGUAdAAtAFMAaQB0AGUAcwBGAHIAbwBtAFMAZQByAHYAZQByAA0ACgBpAGYAIAAoACQAcwBpAHQAZQBzACAALQBlAHEAIAAkAG4AdQBsAGwAKQAgAHsADQAKACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAE4AbwAgAHMAaQB0AGUAcwAgAHIAZQBjAGUAaQB2AGUAZAAgAGYAcgBvAG0AIABzAGUAcgB2AGUAcgAuACIADQAKACAAIAAgACAAcgBlAHQAdQByAG4ADQAKAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIAUwBpAHQAZQBzACAAcgBlAGMAZQBpAHYAZQBkADoAIAAkACgAJABzAGkAdABlAHMALgBDAG8AdQBuAHQAKQAgAHMAaQB0AGUAcwAuACIADQAKAH0ADQAKAA0ACgBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABzAGkAdABlAHMALgBDAG8AdQBuAHQAOwAgACQAaQAgACsAPQAgADUAKQAgAHsADQAKACAAIAAgACAAJABjAHUAcgByAGUAbgB0AEIAYQB0AGMAaAAgAD0AIAAkAHMAaQB0AGUAcwBbACQAaQAuAC4AKAAkAGkAKwA0ACkAXQANAAoAIAAgACAAIABPAHAAZQBuAC0AUwBpAHQAZQBzACAALQBzAGkAdABlAHMAIAAkAGMAdQByAHIAZQBuAHQAQgBhAHQAYwBoAA0ACgB9AA__r_n
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x60]
call fcn.140019700
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14003b850
nop
lea r8, [0x1401bf410]
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.140019700
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, str.echo._r_npowershell__Get_WmiObject_Win32_Volume__Filter_DriveType5__select__exp_DriveLetter__foreach_object___New_Object__comObject_Shell.Application_.Namespace_17_.ParseName____.InvokeVerb_Eject___
lea rcx, [rsp + 0x38]
call qword [reloc.Qt5Core.dll___YQString__QEAAAEAV0_PEBD_Z]
lea rdx, [rsp + 0x38]
mov rcx, r15
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::operator_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x2e8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x2f0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x208]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xc0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x258]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xb8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xc8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1f8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x298]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x528]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov rax, r15
mov rcx, qword [rbp + 0x728]
xor rcx, rsp
call fcn.14015d220
mov rbx, qword [rsp + 0x880]
add rsp, 0x830
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret