Function at 0x140005ad0
Capabilities:
Create thread
Encode data using xor
Execute command
Hide graphical window
Log keystrokes via polling
Set console window title

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1a8]
sub rsp, 0x270
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
movaps xmmword [rax - 0x88], xmm10
movaps xmmword [rax - 0x98], xmm11
movaps xmmword [rax - 0xa8], xmm12
movaps xmmword [rax - 0xb8], xmm13
movaps xmmword [rax - 0xc8], xmm14
movaps xmmword [rax - 0xd8], xmm15
xor r14d, r14d
mov dword [rbp + 0x1b0], r14d
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rax, qword [0x14000b860]
mov qword [rbp + 0x1b8], rax
movdqa xmm8, xmmword [0x14000bce0]
movdqa xmm10, xmmword [0x14000bd00]
movdqa xmm9, xmmword [0x14000bcd0]
movdqa xmm6, xmmword [0x14000bd10]
movdqa xmm7, xmmword [0x14000bcb0]
mov r13d, dword [0x14000e090]
cmp byte [0x14000b867], r14b
je 0x140005cb0
cmp r13d, 2
jl 0x140005c71
movdqa xmm1, xmm7
punpckldq xmm1, xmm7
pmuldq xmm1, xmm6
movdqa xmm0, xmm7
punpckhdq xmm0, xmm7
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
movdqa xmm1, xmm7
psubd xmm1, xmm0
andps xmm1, xmm8
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm10
movd xmm0, dword [rbp + 0x1b8]
xorps xmm1, xmm0
movd dword [rbp + 0x1b8], xmm1
movdqa xmm2, xmmword [0x14000bcc0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm10
movd xmm0, dword [rbp + 0x1bc]
xorps xmm2, xmm0
movd dword [rbp + 0x1bc], xmm2
jmp 0x140005cb0
lea r9, [rbp + 0x1b8]
xor r8d, r8d
nop dword [rax + rax]
mov eax, 0x4ec4ec4f
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x34
movzx eax, r8b
sub al, cl
add al, 0x39
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 8
jl 0x140005c80
lea rcx, [rbp + 0x1b8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [str.m_HP_]
movups xmmword [rsp + 0x40], xmm0
mov ecx, dword [0x14000b990]
mov dword [rsp + 0x50], ecx
movzx eax, word [0x14000b994]
mov edx, 0x54
mov word [rsp + 0x40], dx
xor word [rsp + 0x42], 0x3a
xor word [rsp + 0x44], 0x3b
xor word [rsp + 0x46], 0x3c
xor word [rsp + 0x48], 0x3d
xor word [rsp + 0x4a], 0x3e
xor word [rsp + 0x4c], 0x3f
xor word [rsp + 0x4e], 0x40
xor cx, 0x41
mov word [rsp + 0x50], cx
xor word [rsp + 0x52], 0x42
xor ax, 0x43
mov word [rsp + 0x54], ax
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x140005ab0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rax, [rbp - 0x80]
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x58]
mov qword [rbp - 8], rax
lea rax, [rbp - 0x80]
mov qword [rbp], rax
lea rax, [rbp - 0x58]
mov qword [rbp + 8], rax
lea rax, [rbp - 0x80]
mov qword [rbp + 0x10], rax
lea rax, [rbp - 0x58]
mov qword [rbp + 0x18], rax
lea rax, [rbp - 0x80]
mov qword [rbp + 0x20], rax
lea rax, [rbp - 0x58]
mov qword [rbp + 0x28], rax
lea rax, [rbp - 0x80]
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x58]
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x80]
mov qword [rbp - 0x30], rax
lea rax, [rbp - 0x58]
mov qword [rbp - 0x28], rax
movaps xmm11, xmmword [rsp + 0x30]
movaps xmm12, xmmword [rbp - 0x30]
movaps xmm13, xmmword [rbp - 0x20]
movaps xmm14, xmmword [rbp - 0x10]
movaps xmm15, xmmword [rbp]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [str.ZVH_]
mov dword [rbp + 0x1b8], eax
cmp byte [0x14000b633], 0
je 0x140005eb0
cmp r13d, 2
jl 0x140005e73
movdqa xmm1, xmm7
punpckldq xmm1, xmm7
pmuldq xmm1, xmm6
movdqa xmm0, xmm7
punpckhdq xmm0, xmm7
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
movdqa xmm1, xmm7
psubd xmm1, xmm0
andps xmm1, xmm8
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm10
movd xmm0, eax
xorps xmm1, xmm0
movd dword [rbp + 0x1b8], xmm1
jmp 0x140005eb0
lea r9, [rbp + 0x1b8]
xor r8d, r8d
nop dword [rax]
mov eax, 0x4ec4ec4f
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x34
movzx eax, r8b
sub al, cl
add al, 0x39
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x140005e80
lea rcx, [rbp + 0x1b8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
lea rax, [rbp - 0x58]
mov qword [rbp + 0x1b8], rax
lea rdx, [0x14000b4ac]
lea rcx, [rbp - 0x58]
call fcn.140006e30
mov rbx, rax
lea rdx, str._n____Tesla
lea rcx, [rsp + 0x58]
call fcn.140006e30
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1400079f0
nop
movdqa xmmword [rsp + 0x30], xmm14
lea rdx, [rsp + 0x30]
lea rcx, [rbp]
call fcn.140007850
bts r14d, 7
mov dword [rbp + 0x1b0], r14d
lea r9, [0x140001e40]
mov edx, 0x28
mov r8d, 1
lea rcx, [rbp - 0x80]
call fcn.14000894c
lea rdx, [rbp]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400076e0
btr r14d, 7
mov dword [rbp + 0x1b0], r14d
lea rcx, [rbp]
call fcn.140006d10
nop
lea rax, [rsp + 0x58]
mov qword [rbp + 0x1b8], rax
lea rdx, [0x14000b4ac]
lea rcx, [rsp + 0x58]
call fcn.140006e30
mov rbx, rax
lea rdx, str._n____Vouch_please
lea rcx, [rbp - 0x58]
call fcn.140006e30
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1400079f0
nop
movdqa xmmword [rsp + 0x30], xmm15
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x10]
call fcn.140007850
bts r14d, 8
mov dword [rbp + 0x1b0], r14d
lea r9, [0x140001e40]
mov edx, 0x28
mov r8d, 1
lea rcx, [rbp - 0x80]
call fcn.14000894c
lea rdx, [rbp - 0x10]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400076e0
btr r14d, 8
mov dword [rbp + 0x1b0], r14d
lea rcx, [rbp - 0x10]
call fcn.140006d10
nop
lea rax, [rsp + 0x58]
mov qword [rbp + 0x1b8], rax
lea rdx, [0x14000b468]
lea rcx, [rsp + 0x58]
call fcn.140006e30
mov rbx, rax
lea rdx, [0x14000b554]
lea rcx, [rbp - 0x58]
call fcn.140006e30
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1400079f0
nop
movaps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x20]
call fcn.140007850
bts r14d, 9
mov dword [rbp + 0x1b0], r14d
lea r9, [0x140001e40]
mov edx, 0x28
mov r8d, 1
lea rcx, [rbp - 0x80]
call fcn.14000894c
lea rdx, [rbp - 0x20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400076e0
btr r14d, 9
mov dword [rbp + 0x1b0], r14d
lea rcx, [rbp - 0x20]
call fcn.140006d10
nop
lea rax, [rsp + 0x58]
mov qword [rbp + 0x1b8], rax
lea rdx, [0x14000b47c]
lea rcx, [rsp + 0x58]
call fcn.140006e30
mov rbx, rax
lea rdx, str._n__F1__Perm_spoof
lea rcx, [rbp - 0x58]
call fcn.140006e30
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1400079f0
nop
movaps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x30]
call fcn.140007850
bts r14d, 0xa
mov dword [rbp + 0x1b0], r14d
lea r9, [0x140001e40]
mov edx, 0x28
mov r8d, 1
lea rcx, [rbp - 0x80]
call fcn.14000894c
lea rdx, [rbp - 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400076e0
btr r14d, 0xa
mov dword [rbp + 0x1b0], r14d
lea rcx, [rbp - 0x30]
call fcn.140006d10
nop
lea rax, [rsp + 0x58]
mov qword [rbp + 0x1b8], rax
lea rdx, [0x14000b47c]
lea rcx, [rsp + 0x58]
call fcn.140006e30
mov rbx, rax
lea rdx, str._n__F2__Check_serials
lea rcx, [rbp - 0x58]
call fcn.140006e30
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1400079f0
nop
movdqa xmmword [rsp + 0x30], xmm13
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x30]
call fcn.140007850
or r14d, 0x40
mov dword [rbp + 0x1b0], r14d
lea r9, [0x140001e40]
mov edx, 0x28
mov r8d, 1
lea rcx, [rbp - 0x80]
call fcn.14000894c
lea rdx, [rbp + 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400076e0
and r14d, 0xffffffbf
mov dword [rbp + 0x1b0], r14d
lea rcx, [rbp + 0x30]
call fcn.140006d10
nop
lea rax, [rsp + 0x58]
mov qword [rbp + 0x1b8], rax
lea rdx, [0x14000b468]
lea rcx, [rsp + 0x58]
call fcn.140006e30
mov rbx, rax
lea rdx, [0x14000b554]
lea rcx, [rbp - 0x58]
call fcn.140006e30
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1400079f0
nop
movdqa xmmword [rsp + 0x30], xmm11
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x40]
call fcn.140007850
or r14d, 0x10
mov dword [rbp + 0x1b0], r14d
lea r9, [0x140001e40]
mov edx, 0x28
mov r8d, 1
lea rcx, [rbp - 0x80]
call fcn.14000894c
lea rdx, [rbp + 0x40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400076e0
and r14d, 0xffffffef
mov dword [rbp + 0x1b0], r14d
lea rcx, [rbp + 0x40]
call fcn.140006d10
nop
lea rax, [rsp + 0x58]
mov qword [rbp + 0x1b8], rax
lea rdx, [0x14000b47c]
lea rcx, [rsp + 0x58]
call fcn.140006e30
mov rbx, rax
lea rdx, str._n____Option__:
lea rcx, [rbp - 0x58]
call fcn.140006e30
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1400079f0
nop
movdqa xmmword [rsp + 0x30], xmm12
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x50]
call fcn.140007850
or r14d, 0x20
mov dword [rbp + 0x1b0], r14d
lea r9, [0x140001e40]
mov edx, 0x28
mov r8d, 1
lea rcx, [rbp - 0x80]
call fcn.14000894c
lea rdx, [rbp + 0x50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400076e0
and r14d, 0xffffffdf
mov dword [rbp + 0x1b0], r14d
lea rcx, [rbp + 0x50]
call fcn.140006d10
mov ecx, 0x70
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14000674e
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
call fcn.1400034d0
movups xmm0, xmmword [str.JNZNI]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [0x14000b658]
movups xmmword [rsp + 0x68], xmm1
mov eax, dword [0x14000b668]
mov dword [rsp + 0x78], eax
xor r8d, r8d
cmp r13d, 2
jl 0x14000648b
movdqa xmmword [rsp + 0x30], xmm10
lea rcx, [rsp + 0x5c]
mov edx, dword [rsp + 0x30]
nop word [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm7
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm7
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x20
jl 0x1400063a0
cmp r8d, 0x24
jge 0x1400064d0
movsxd rax, r8d
lea r9, [rsp + 0x58]
add r9, rax
nop word [rax + rax]
mov eax, 0x4ec4ec4f
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x34
movzx eax, r8b
sub al, cl
add al, 0x39
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x24
jl 0x1400064a0
lea rcx, [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
lea rax, [rsp + 0x58]
mov qword [rbp + 0x1b8], rax
lea rdx, [0x14000b47c]
lea rcx, [rsp + 0x58]
call fcn.140006e30
mov rbx, rax
lea rdx, str._n_Your_PC_Will_Auto_Restart_in_10_Seconds___DONT_PANIC
lea rcx, [rbp - 0x58]
call fcn.140006e30
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1400079f0
nop
lea rax, [rbp - 0x80]
mov qword [rbp + 0x60], rax
lea rax, [rbp - 0x58]
mov qword [rbp + 0x68], rax
movaps xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x70]
call fcn.140007850
or r14d, 1
mov dword [rbp + 0x1b0], r14d
lea r9, [0x140001e40]
mov edx, 0x28
mov r8d, 1
lea rcx, [rbp - 0x80]
call fcn.14000894c
mov r12, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rdi, qword [rbp + 0x70]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x1400065f7
mov r13d, 7
nop dword [rax]
nop dword [rax + rax]
mov r15d, dword [rbx + 0x30]
cmp r15d, 0xff
ja 0x1400065b5
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r15w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rbx + 0x10]
cmp qword [rbx + 0x28], 0xf
jbe 0x1400065c4
mov rdx, qword [rbx + 0x10]
mov r8, qword [rbx + 0x20]
mov rcx, r12
call fcn.140008720
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r13w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140006590
mov r13d, dword [0x14000e090]
and r14d, 0xfffffffe
mov dword [rbp + 0x1b0], r14d
lea rcx, [rbp + 0x70]
call fcn.140006d10
nop
lea rax, [rsp + 0x58]
mov qword [rbp + 0x1b8], rax
lea rdx, [0x14000b47c]
lea rcx, [rsp + 0x58]
call fcn.140006e30
mov rbx, rax
lea rdx, str._n_DONT_CLICK_ANYTHING
lea rcx, [rbp - 0x58]
call fcn.140006e30
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1400079f0
nop
lea rax, [rbp - 0x80]
mov qword [rbp + 0x80], rax
lea rax, [rbp - 0x58]
mov qword [rbp + 0x88], rax
movaps xmm0, xmmword [rbp + 0x80]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x90]
call fcn.140007850
or r14d, 2
mov dword [rbp + 0x1b0], r14d
lea r9, [0x140001e40]
mov edx, 0x28
mov r8d, 1
lea rcx, [rbp - 0x80]
call fcn.14000894c
mov r12, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rdi, qword [rbp + 0x90]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000672a
mov r13d, 7
mov r15d, dword [rbx + 0x30]
cmp r15d, 0xff
ja 0x1400066e8
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r15w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rbx + 0x10]
cmp qword [rbx + 0x28], 0xf
jbe 0x1400066f7
mov rdx, qword [rbx + 0x10]
mov r8, qword [rbx + 0x20]
mov rcx, r12
call fcn.140008720
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r13w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x1400066c3
mov r13d, dword [0x14000e090]
and r14d, 0xfffffffd
mov dword [rbp + 0x1b0], r14d
lea rcx, [rbp + 0x90]
call fcn.140006d10
lea rcx, str.C:WindowsSystem32_shutdown__r__t_10
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x74
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140006b5b
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
call fcn.1400021c0
movups xmm0, xmmword [str.JNZNI]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [0x14000b658]
movups xmmword [rsp + 0x68], xmm1
mov eax, dword [0x14000b668]
mov dword [rsp + 0x78], eax
xor ecx, ecx
cmp r13d, 2
jl 0x14000689a
movdqa xmmword [rsp + 0x30], xmm10
lea rdx, [rsp + 0x5c]
mov r8d, dword [rsp + 0x30]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm7
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm7
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
xorps xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x20
jl 0x1400067b2
cmp ecx, 0x24
jge 0x1400068dc
movsxd rax, ecx
lea r8, [rsp + 0x58]
add r8, rax
nop word [rax + rax]
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x34
movzx eax, cl
sub al, dl
add al, 0x39
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x24
jl 0x1400068b0
lea rcx, [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
lea rax, [rsp + 0x58]
mov qword [rbp + 0x1b8], rax
lea rdx, [0x14000b47c]
lea rcx, [rsp + 0x58]
call fcn.140006e30
mov rbx, rax
lea rdx, str._n_Your_PC_Will_Auto_Restart_in_10_Seconds___DONT_PANIC
lea rcx, [rbp - 0x58]
call fcn.140006e30
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1400079f0
nop
lea rax, [rbp - 0x80]
mov qword [rbp + 0xa0], rax
lea rax, [rbp - 0x58]
mov qword [rbp + 0xa8], rax
movaps xmm0, xmmword [rbp + 0xa0]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0xb0]
call fcn.140007850
or r14d, 4
mov dword [rbp + 0x1b0], r14d
lea r9, [0x140001e40]
mov edx, 0x28
mov r8d, 1
lea rcx, [rbp - 0x80]
call fcn.14000894c
mov r12, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rdi, qword [rbp + 0xb0]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x140006a07
mov r13d, 7
nop
mov r15d, dword [rbx + 0x30]
cmp r15d, 0xff
ja 0x1400069c5
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r15w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rbx + 0x10]
cmp qword [rbx + 0x28], 0xf
jbe 0x1400069d4
mov rdx, qword [rbx + 0x10]
mov r8, qword [rbx + 0x20]
mov rcx, r12
call fcn.140008720
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r13w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x1400069a0
mov r13d, dword [0x14000e090]
and r14d, 0xfffffffb
mov dword [rbp + 0x1b0], r14d
lea rcx, [rbp + 0xb0]
call fcn.140006d10
nop
lea rax, [rsp + 0x58]
mov qword [rbp + 0x1b8], rax
lea rdx, [0x14000b47c]
lea rcx, [rsp + 0x58]
call fcn.140006e30
mov rbx, rax
lea rdx, str._n_DONT_CLICK_ANYTHING
lea rcx, [rbp - 0x58]
call fcn.140006e30
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1400079f0
nop
lea rax, [rbp - 0x80]
mov qword [rbp + 0xc0], rax
lea rax, [rbp - 0x58]
mov qword [rbp + 0xc8], rax
movaps xmm0, xmmword [rbp + 0xc0]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140007850
or r14d, 8
mov dword [rbp + 0x1b0], r14d
lea r9, [0x140001e40]
mov edx, 0x28
mov r8d, 1
lea rcx, [rbp - 0x80]
call fcn.14000894c
mov r12, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x140006b39
mov r13d, 7
mov r15d, dword [rbx + 0x30]
cmp r15d, 0xff
ja 0x140006af7
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r15w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rbx + 0x10]
cmp qword [rbx + 0x28], 0xf
jbe 0x140006b06
mov rdx, qword [rbx + 0x10]
mov r8, qword [rbx + 0x20]
mov rcx, r12
call fcn.140008720
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r13w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140006ad2
mov r13d, dword [0x14000e090]
and r14d, 0xfffffff7
mov dword [rbp + 0x1b0], r14d
lea rcx, [rsp + 0x40]
call fcn.140006d10
lea rcx, str.C:WindowsSystem32_shutdown__r__t_10
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x71
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140006331
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
call fcn.1400047e0
movups xmm0, xmmword [str.JNZNI]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [0x14000b658]
movups xmmword [rsp + 0x68], xmm1
mov eax, dword [0x14000b668]
mov dword [rsp + 0x78], eax
xor r8d, r8d
cmp r13d, 2
jl 0x140006cab
movdqa xmmword [rsp + 0x30], xmm10
lea rcx, [rsp + 0x5c]
mov edx, dword [rsp + 0x30]
nop
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm7
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm7
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x20
jl 0x140006bc0
cmp r8d, 0x24
jge 0x140006cf0
movsxd rax, r8d
lea r9, [rsp + 0x58]
add r9, rax
nop word [rax + rax]
mov eax, 0x4ec4ec4f
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x34
movzx eax, r8b
sub al, cl
add al, 0x39
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x24
jl 0x140006cc0
lea rcx, [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x140005de0