Function at 0x14003a090
Capabilities:
Contain obfuscated stackstrings
Delete file
Encode data using xor
Execute command
Set registry value
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0xf18]
mov eax, 0x1018
call fcn.1400b2a80
sub rsp, rax
movaps xmmword [rsp + 0x1000], xmm6
mov dword [rsp + 0x31], 0x697f6a4d
mov dword [rsp + 0x35], 0x79716f4c
mov dword [rsp + 0x39], 0x10474d49
mov dword [rsp + 0x3d], 0x100114d
lea rcx, [rsp + 0x31]
call fcn.140043d70
lea rcx, [rsp + 0x31]
call qword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
test ax, ax
je 0x14003a122
lea rdx, str.You_have_already_used_the_spoofer._Please_restart_your_device_and_try_again.
lea rcx, [rbp + 0xa48]
call fcn.1400450b0
nop
lea rcx, [rbp + 0xa48]
call fcn.1400320c0
nop
lea rcx, [rbp + 0xa48]
call fcn.140044fc0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140038090
mov rsi, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
xor eax, eax
mov byte [rbp + 0xf40], al
lea rdx, [rbp + 0xda2]
lea rcx, [rbp + 0xf40]
call fcn.14003be20
mov r10, rax
xor ebx, ebx
mov edi, dword [reloc.WS2_32.dll_accept]
cmp byte [rax + 0x20], bl
je 0x14003a2f3
mov r8d, ebx
cmp edi, 2
jl 0x14003a2ad
movdqa xmm5, xmmword [0x140133480]
movdqa xmm4, xmmword [0x140133b10]
movdqa xmm6, xmmword [0x1401334a0]
movdqa xmm0, xmmword [0x1401337b0]
movdqa xmmword [rsp + 0x50], xmm0
mov rcx, rax
mov edx, dword [rsp + 0x50]
nop word [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1401334d0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1401334d0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm2, xmm0
movd dword [rcx + 4], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x20
jl 0x14003a1a0
cmp r8d, 0x21
jge 0x14003a2f3
movsxd r9, r8d
add r9, r10
nop dword [rax]
nop word [rax + rax]
mov eax, 0x8fb823ef
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x39
movzx eax, r8b
sub al, cl
add al, 0x36
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x21
jl 0x14003a2c0
mov rdx, r10
lea rcx, [rbp + 0xcc8]
call fcn.1400450b0
nop
mov rcx, rax
call fcn.140044eb0
mov rdx, rax
mov rcx, rsi
call fcn.140045c80
lea rdx, [0x140045e50]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0xcc8]
call fcn.140044fc0
lea rdx, [0x1400394b0]
lea rcx, [rbp + 0x7a0]
call fcn.140045eb0
nop
lea rdx, str.C:_logo.png
lea rcx, [rbp + 0xca8]
call fcn.1400450b0
mov rdx, rax
lea rcx, str.calmlogopasto
call fcn.140039520
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.C:_ProgramData_SpaceProject_NormalGui.exe
lea rcx, [rbp + 0xc88]
call fcn.1400450b0
mov rdx, rax
lea rcx, str.lolcommomexeforspoof
call fcn.140039520
movdqa xmm0, xmmword [0x140133970]
movdqu xmmword [rbp + 0x5e3], xmm0
movdqa xmm1, xmmword [0x1401339a0]
movdqu xmmword [rbp + 0x5f3], xmm1
movdqa xmm0, xmmword [0x140133a20]
movdqu xmmword [rbp + 0x603], xmm0
movdqa xmm1, xmmword [0x140133720]
movdqu xmmword [rbp + 0x613], xmm1
mov dword [rbp + 0x623], 0x283c3f
mov byte [rbp + 0x627], 1
lea rcx, [rbp + 0x5e3]
call fcn.14003be50
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [reloc.WS2_32.dll_accept], 0
cmp byte [0x1401a4619], 0
je 0x14003a423
lea rcx, str.CommonNullSpoof
call fcn.140039c60
cmp byte [0x1401a4662], 0
je 0x14003a438
lea rcx, str.CommonRandomSpoof
call fcn.140039c60
cmp byte [0x1401a461d], 0
je 0x14003a446
call fcn.140001930
cmp byte [0x1401a461a], 0
je 0x14003a45b
lea rcx, str.UnCommonRandomSpoof
call fcn.140039c60
cmp byte [0x1401a461c], 0
je 0x14003a506
lea rdx, str.C:_ProgramData_SpaceProject_Macpoof.bat
lea rcx, [rbp + 0xc68]
call fcn.1400450b0
mov rdx, rax
lea rcx, str.CommonMacSpoof
call fcn.140039520
movdqa xmm0, xmmword [0x140133a50]
movdqu xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x140133960]
movdqu xmmword [rbp - 0x50], xmm1
mov dword [rbp - 0x40], 0x155c5657
mov dword [rbp - 0x3c], 0x4a5c5e
mov byte [rbp - 0x38], 1
lea rcx, [rbp - 0x60]
call fcn.14003be80
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140133a50]
movdqu xmmword [rbp - 0x37], xmm0
movdqa xmm1, xmmword [0x140133960]
movdqu xmmword [rbp - 0x27], xmm1
mov dword [rbp - 0x17], 0x155c5657
mov dword [rbp - 0x13], 0x4a5c5e
mov byte [rbp - 0xf], 1
lea rcx, [rbp - 0x37]
call fcn.14003be80
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
cmp byte [0x1401a461b], 0
je 0x14003b50d
xor ecx, ecx
call fcn.140031b90
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
movdqa xmm0, xmmword [0x140133a60]
movdqu xmmword [rbp + 0x569], xmm0
movdqa xmm1, xmmword [0x1401338f0]
movdqu xmmword [rbp + 0x579], xmm1
movdqa xmm0, xmmword [0x1401336e0]
movdqu xmmword [rbp + 0x589], xmm0
movdqa xmm1, xmmword [0x140133680]
movdqu xmmword [rbp + 0x599], xmm1
movdqa xmm0, xmmword [0x140133620]
movdqu xmmword [rbp + 0x5a9], xmm0
movdqa xmm1, xmmword [0x1401336c0]
movdqu xmmword [rbp + 0x5b9], xmm1
movdqa xmm0, xmmword [0x140133bd0]
movdqu xmmword [rbp + 0x5c9], xmm0
mov dword [rbp + 0x5d9], 0xe6e5ede6
mov dword [rbp + 0x5dd], 0xe9a1ada9
mov word [rbp + 0x5e1], 0x100
lea rcx, [rbp + 0x569]
call fcn.14003beb0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140133a60]
movdqu xmmword [rbp + 0x224], xmm0
movdqa xmm1, xmmword [0x1401338f0]
movdqu xmmword [rbp + 0x234], xmm1
movdqa xmm0, xmmword [0x1401336e0]
movdqu xmmword [rbp + 0x244], xmm0
movdqa xmm1, xmmword [str._9____]
movdqu xmmword [rbp + 0x254], xmm1
movdqa xmm0, xmmword [0x1401335f0]
movdqu xmmword [rbp + 0x264], xmm0
movdqa xmm1, xmmword [0x140133530]
movdqu xmmword [rbp + 0x274], xmm1
movdqa xmm0, xmmword [str.X__.__]
movdqu xmmword [rbp + 0x284], xmm0
mov dword [rbp + 0x294], 0xaea7cad8
mov dword [rbp + 0x298], 0xebe0ecfe
mov dword [rbp + 0x29c], 0xb3b7fcff
mov dword [rbp + 0x2a0], 0x100f3bb
lea rcx, [rbp + 0x224]
call fcn.14003bee0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140133a60]
movdqu xmmword [rbp + 0x1b6], xmm0
movdqa xmm1, xmmword [0x1401338f0]
movdqu xmmword [rbp + 0x1c6], xmm1
movdqa xmm0, xmmword [str.WUiHamZ27__6]
movdqu xmmword [rbp + 0x1d6], xmm0
movdqa xmm1, xmmword [0x140133aa0]
movdqu xmmword [rbp + 0x1e6], xmm1
movdqa xmm0, xmmword [0x140133790]
movdqu xmmword [rbp + 0x1f6], xmm0
movdqa xmm1, xmmword [0x140133770]
movdqu xmmword [rbp + 0x206], xmm1
mov dword [rbp + 0x216], 0x1a085c55
mov dword [rbp + 0x21a], 0x12111912
mov dword [rbp + 0x21e], 0xe5ada1a5
mov word [rbp + 0x222], 0x100
lea rcx, [rbp + 0x1b6]
call fcn.14003bf10
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140133a60]
movdqu xmmword [rbp + 0x2ff], xmm0
movdqa xmm1, xmmword [0x140133990]
movdqu xmmword [rbp + 0x30f], xmm1
movdqa xmm0, xmmword [0x1401336f0]
movdqu xmmword [rbp + 0x31f], xmm0
movdqa xmm1, xmmword [0x140133ab0]
movdqu xmmword [rbp + 0x32f], xmm1
mov dword [rbp + 0x33f], 0x7b69793c
mov dword [rbp + 0x343], 0x1003b73
lea rcx, [rbp + 0x2ff]
call fcn.14003bf40
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140133a60]
movdqu xmmword [rbp + 0x347], xmm0
movdqa xmm1, xmmword [0x140133990]
movdqu xmmword [rbp + 0x357], xmm1
movdqa xmm0, xmmword [0x1401336d0]
movdqu xmmword [rbp + 0x367], xmm0
movdqa xmm1, xmmword [0x140133ac0]
movdqu xmmword [rbp + 0x377], xmm1
movdqa xmm0, xmmword [0x140133580]
movdqu xmmword [rbp + 0x387], xmm0
mov dword [rbp + 0x397], 0x4e07060c
mov dword [rbp + 0x39b], 0x8424c
mov byte [rbp + 0x39f], 1
lea rcx, [rbp + 0x347]
call fcn.14003bf70
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140133a70]
movdqu xmmword [rbp + 0x463], xmm0
movdqa xmm1, xmmword [0x140133ae0]
movdqu xmmword [rbp + 0x473], xmm1
movdqa xmm0, xmmword [0x140133750]
movdqu xmmword [rbp + 0x483], xmm0
movdqa xmm1, xmmword [0x1401336b0]
movdqu xmmword [rbp + 0x493], xmm1
movdqa xmm0, xmmword [0x140133500]
movdqu xmmword [rbp + 0x4a3], xmm0
mov dword [rbp + 0x4b3], 0x4b4f0407
mov dword [rbp + 0x4b7], 0x1000b43
lea rcx, [rbp + 0x463]
call fcn.14003bfa0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140133a00]
movdqu xmmword [rbp + 0xad6], xmm0
movdqa xmm1, xmmword [0x140133a40]
movdqu xmmword [rbp + 0xae6], xmm1
movdqa xmm0, xmmword [str.oPT_SJMc]
movdqu xmmword [rbp + 0xaf6], xmm0
movdqa xmm1, xmmword [0x140133810]
movdqu xmmword [rbp + 0xb06], xmm1
movdqa xmm0, xmmword [0x140133980]
movdqu xmmword [rbp + 0xb16], xmm0
movdqa xmm1, xmmword [0x140133910]
movdqu xmmword [rbp + 0xb26], xmm1
movdqa xmm0, xmmword [str.KMOMKE]
movdqu xmmword [rbp + 0xb36], xmm0
movdqa xmm1, xmmword [0x140133b60]
movdqu xmmword [rbp + 0xb46], xmm1
movdqa xmm0, xmmword [0x1401334c0]
movdqu xmmword [rbp + 0xb56], xmm0
mov byte [rbp + 0xb66], 1
lea rcx, [rbp + 0xad6]
call fcn.14003bfd0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140133a00]
movdqu xmmword [rbp + 0x8eb], xmm0
movdqa xmm1, xmmword [0x140133a40]
movdqu xmmword [rbp + 0x8fb], xmm1
movdqa xmm0, xmmword [str.oPT_SJMc]
movdqu xmmword [rbp + 0x90b], xmm0
movdqa xmm1, xmmword [0x140133810]
movdqu xmmword [rbp + 0x91b], xmm1
movdqa xmm0, xmmword [0x140133980]
movdqu xmmword [rbp + 0x92b], xmm0
movdqa xmm1, xmmword [0x140133910]
movdqu xmmword [rbp + 0x93b], xmm1
movdqa xmm0, xmmword [0x140133bc0]
movdqu xmmword [rbp + 0x94b], xmm0
movdqa xmm1, xmmword [0x140133b70]
movdqu xmmword [rbp + 0x95b], xmm1
movdqa xmm0, xmmword [0x140133b80]
movdqu xmmword [rbp + 0x96b], xmm0
movdqa xmm1, xmmword [0x140133b50]
movdqu xmmword [rbp + 0x97b], xmm1
mov dword [rbp + 0x98b], 0xdd9599c8
mov word [rbp + 0x98f], 0x100
lea rcx, [rbp + 0x8eb]
call fcn.14003c000
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140133a70]
movdqu xmmword [rbp + 0x9f4], xmm0
movdqa xmm1, xmmword [0x140133ae0]
movdqu xmmword [rbp + 0xa04], xmm1
movdqa xmm0, xmmword [0x140133730]
movdqu xmmword [rbp + 0xa14], xmm0
movdqa xmm1, xmmword [0x140133a90]
movdqu xmmword [rbp + 0xa24], xmm1
movdqa xmm0, xmmword [0x1401334e0]
movdqu xmmword [rbp + 0xa34], xmm0
mov word [rbp + 0xa44], 0x100
lea rcx, [rbp + 0x9f4]
call fcn.14003c030
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140133a70]
movdqu xmmword [rbp + 0x2a4], xmm0
movdqa xmm1, xmmword [0x140133ae0]
movdqu xmmword [rbp + 0x2b4], xmm1
movdqa xmm0, xmmword [0x140133730]
movdqu xmmword [rbp + 0x2c4], xmm0
movdqa xmm1, xmmword [0x1401336a0]
movdqu xmmword [rbp + 0x2d4], xmm1
movdqa xmm0, xmmword [0x140133650]
movdqu xmmword [rbp + 0x2e4], xmm0
mov dword [rbp + 0x2f4], 0x40e0709
mov dword [rbp + 0x2f8], 0x404e4801
mov word [rbp + 0x2fc], reloc.WLDAP32.dll_Ordinal_22
mov byte [rbp + 0x2fe], 1
lea rcx, [rbp + 0x2a4]
call fcn.14003c060
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140133a70]
movdqu xmmword [rbp + 0x41], xmm0
movdqa xmm1, xmmword [0x140133ae0]
movdqu xmmword [rbp + 0x51], xmm1
movdqa xmm0, xmmword [0x140133730]
movdqu xmmword [rbp + 0x61], xmm0
movdqa xmm1, xmmword [0x140133670]
movdqu xmmword [rbp + 0x71], xmm1
movdqa xmm0, xmmword [str.__s__r_0_EI]
movdqu xmmword [rbp + 0x81], xmm0
mov dword [rbp + 0x91], 0x70f2d48
mov dword [rbp + 0x95], 0x1274d00
mov dword [rbp + 0x99], 0x5c525f13
mov word [rbp + 0x9d], reloc.WS2_32.dll_select
mov byte [rbp + 0x9f], 1
lea rcx, [rbp + 0x41]
call fcn.14003c090
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140133a70]
movdqu xmmword [rbp + 0x40b], xmm0
movdqa xmm1, xmmword [0x140133ae0]
movdqu xmmword [rbp + 0x41b], xmm1
movdqa xmm0, xmmword [0x140133730]
movdqu xmmword [rbp + 0x42b], xmm0
movdqa xmm1, xmmword [0x140133610]
movdqu xmmword [rbp + 0x43b], xmm1
movdqa xmm0, xmmword [0x140133510]
movdqu xmmword [rbp + 0x44b], xmm0
mov dword [rbp + 0x45b], 0x4b4f0407
mov dword [rbp + 0x45f], 0x1000b43
lea rcx, [rbp + 0x40b]
call fcn.14003bfa0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140133a70]
movdqu xmmword [rbp + 0xfd], xmm0
movdqa xmm1, xmmword [0x140133ae0]
movdqu xmmword [rbp + 0x10d], xmm1
movdqa xmm0, xmmword [0x140133730]
movdqu xmmword [rbp + 0x11d], xmm0
movdqa xmm1, xmmword [0x140133ad0]
movdqu xmmword [rbp + reloc.WLDAP32.dll_Ordinal_301], xmm1
movdqa xmm0, xmmword [0x1401334f0]
movdqu xmmword [rbp + 0x13d], xmm0
mov dword [rbp + 0x14d], 0x4183959
mov dword [rbp + 0x151], 0x1b0d1808
mov dword [rbp + 0x155], 0x145e50
mov byte [rbp + 0x159], 1
lea rcx, [rbp + 0xfd]
call fcn.14003c0c0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140133a70]
movdqu xmmword [rbp + 0xa68], xmm0
movdqa xmm1, xmmword [0x140133ae0]
movdqu xmmword [rbp + 0xa78], xmm1
movdqa xmm0, xmmword [0x140133730]
movdqu xmmword [rbp + 0xa88], xmm0
movdqa xmm1, xmmword [0x1401337a0]
movdqu xmmword [rbp + 0xa98], xmm1
movdqa xmm0, xmmword [0x140133820]
movdqu xmmword [rbp + 0xaa8], xmm0
movdqa xmm1, xmmword [0x140133600]
movdqu xmmword [rbp + 0xab8], xmm1
mov word [rbp + 0xac8], 0x100
lea rcx, [rbp + 0xa68]
call fcn.14003c0f0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140133a70]
movdqu xmmword [rbp + 0x15a], xmm0
movdqa xmm1, xmmword [0x140133ae0]
movdqu xmmword [rbp + 0x16a], xmm1
movdqa xmm0, xmmword [0x140133730]
movdqu xmmword [rbp + 0x17a], xmm0
movdqa xmm1, xmmword [0x140133760]
movdqu xmmword [rbp + 0x18a], xmm1
movdqa xmm0, xmmword [0x140133880]
movdqu xmmword [rbp + 0x19a], xmm0
mov dword [rbp + 0x1aa], 0x534a3a38
mov dword [rbp + 0x1ae], 0x4f5e5d5f
mov dword [rbp + 0x1b2], 0x100175f
lea rcx, [rbp + 0x15a]
call fcn.14003c120
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140133a70]
movdqu xmmword [rbp + 0x512], xmm0
movdqa xmm1, xmmword [0x140133ae0]
movdqu xmmword [rbp + 0x522], xmm1
movdqa xmm0, xmmword [0x140133730]
movdqu xmmword [rbp + 0x532], xmm0
movdqa xmm1, xmmword [0x1401337f0]
movdqu xmmword [rbp + 0x542], xmm1
movdqa xmm0, xmmword [0x1401339b0]
movdqu xmmword [rbp + 0x552], xmm0
mov dword [rbp + 0x562], 0x444a5f46
mov word [rbp + 0x566], 0xa
mov byte [rbp + 0x568], 1
lea rcx, [rbp + 0x512]
call fcn.14003c150
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140133a70]
movdqu xmmword [rbp + 0x628], xmm0
movdqa xmm1, xmmword [0x140133ae0]
movdqu xmmword [rbp + 0x638], xmm1
movdqa xmm0, xmmword [0x140133a30]
movdqu xmmword [rbp + 0x648], xmm0
movdqa xmm1, xmmword [0x140133800]
movdqu xmmword [rbp + 0x658], xmm1
movdqa xmm0, xmmword [0x140133710]
movdqu xmmword [rbp + 0x668], xmm0
movdqa xmm1, xmmword [0x140133930]
movdqu xmmword [rbp + 0x678], xmm1
mov dword [rbp + 0x688], 0x545a4d40
mov word [rbp + 0x68c], reloc.WLDAP32.dll_Ordinal_26
mov byte [rbp + 0x68e], 1
lea rcx, [rbp + 0x628]
call fcn.14003c180
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140133a70]
movdqu xmmword [rbp + 0xa0], xmm0
movdqa xmm1, xmmword [0x140133ae0]
movdqu xmmword [rbp + 0xb0], xmm1
movdqa xmm0, xmmword [0x140133a30]
movdqu xmmword [rbp + 0xc0], xmm0
movdqa xmm1, xmmword [0x140133780]
movdqu xmmword [rbp + 0xd0], xmm1
movdqa xmm0, xmmword [0x140133940]
movdqu xmmword [rbp + 0xe0], xmm0
mov dword [rbp + 0xf0], 0x3827283a
mov dword [rbp + 0xf4], 0x5e1a0200
mov dword [rbp + 0xf8], 0x145e50
mov byte [rbp + 0xfc], 1
lea rcx, [rbp + 0xa0]
call fcn.14003c0c0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x7b0]
call fcn.140039fa0
nop
lea r8, [rbp + 0x7b0]
lea rdx, str.REG_ADD_HKLMSYSTEMCurrentControlSetEnumDISPLAY_
lea rcx, [rbp + 0xc28]
call fcn.140045f20
nop
lea r8, str.Device_Parameters__v_MonitorName__t_REG_SZ__d_Monitor1__f
mov rdx, rax
lea rcx, [rbp + 0xc48]
call fcn.140046070
mov rcx, rax
call fcn.140044eb0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0xc48]
call fcn.140044fc0
nop
lea rcx, [rbp + 0xc28]
call fcn.140044fc0
lea r8, [rbp + 0x7b0]
lea rdx, str.REG_ADD_HKLMSYSTEMCurrentControlSetEnumDISPLAY_
lea rcx, [rbp + 0xce8]
call fcn.140045f20
nop
lea r8, str.Device_Parameters__v_MonitorType__t_REG_SZ__d_LCD__f
mov rdx, rax
lea rcx, [rbp + 0xc08]
call fcn.140046070
mov rcx, rax
call fcn.140044eb0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0xc08]
call fcn.140044fc0
nop
lea rcx, [rbp + 0xce8]
call fcn.140044fc0
lea rcx, [rbp + 0x7d0]
call fcn.140039fa0
nop
lea r8, [rbp + 0x7d0]
lea rdx, str.REG_ADD_HKLMSYSTEMCurrentControlSetEnumDISPLAY_
lea rcx, [rbp + 0xbc8]
call fcn.140045f20
nop
lea r8, str.Device_Parameters__v_GPUName__t_REG_SZ__d_GeForce_GTX_1080__f
mov rdx, rax
lea rcx, [rbp + 0xbe8]
call fcn.140046070
mov rcx, rax
call fcn.140044eb0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0xbe8]
call fcn.140044fc0
nop
lea rcx, [rbp + 0xbc8]
call fcn.140044fc0
lea r8, [rbp + 0x7d0]
lea rdx, str.REG_ADD_HKLMSYSTEMCurrentControlSetEnumDISPLAY_
lea rcx, [rbp + 0xb68]
call fcn.140045f20
nop
lea r8, str.Device_Parameters__v_GPUType__t_REG_SZ__d_Dedicated__f
mov rdx, rax
lea rcx, [rbp + 0xb88]
call fcn.140046070
mov rcx, rax
call fcn.140044eb0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0xb88]
call fcn.140044fc0
nop
lea rcx, [rbp + 0xb68]
call fcn.140044fc0
movdqa xmm0, xmmword [0x140133a70]
movdqu xmmword [rbp + 0x68f], xmm0
movdqa xmm1, xmmword [0x140133ae0]
movdqu xmmword [rbp + 0x69f], xmm1
movdqa xmm0, xmmword [0x140133700]
movdqu xmmword [rbp + 0x6af], xmm0
movdqa xmm1, xmmword [0x140133560]
movdqu xmmword [rbp + 0x6bf], xmm1
movdqa xmm0, xmmword [str.69__.1_.]
movdqu xmmword [rbp + 0x6cf], xmm0
movdqa xmm1, xmmword [0x1401339c0]
movdqu xmmword [rbp + 0x6df], xmm1
movdqa xmm0, xmmword [0x140133b30]
movdqu xmmword [rbp + 0x6ef], xmm0
mov dword [rbp + 0x6ff], 0xabc1b9b8
mov dword [rbp + 0x703], 0x100eba3
lea rcx, [rbp + 0x68f]
call fcn.14003c1b0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140133a70]
movdqu xmmword [rbp + 0x7f0], xmm0
movdqa xmm1, xmmword [0x140133ae0]
movdqu xmmword [rbp + 0x800], xmm1
movdqa xmm0, xmmword [0x140133700]
movdqu xmmword [rbp + 0x810], xmm0
movdqa xmm1, xmmword [0x140133560]
movdqu xmmword [rbp + 0x820], xmm1
movdqa xmm0, xmmword [0x1401335a0]
movdqu xmmword [rbp + 0x830], xmm0
movdqa xmm1, xmmword [0x1401339d0]
movdqu xmmword [rbp + 0x840], xmm1
movdqa xmm0, xmmword [0x140133bb0]
movdqu xmmword [rbp + 0x850], xmm0
movdqa xmm1, xmmword [0x140133b40]
movdqu xmmword [rbp + 0x860], xmm1
mov dword [rbp + 0x870], 0xb4baa9a9
mov word [rbp + 0x874], 0xfa
mov byte [rbp + 0x876], 1
lea rcx, [rbp + 0x7f0]
call fcn.14003c1e0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140133a60]
movdqu xmmword [rbp + 0x707], xmm0
movdqa xmm1, xmmword [0x1401338f0]
movdqu xmmword [rbp + 0x717], xmm1
movdqa xmm0, xmmword [str.WUiHamZ27__6]
movdqu xmmword [rbp + 0x727], xmm0
movdqa xmm1, xmmword [0x140133aa0]
movdqu xmmword [rbp + 0x737], xmm1
movdqa xmm0, xmmword [0x140133950]
movdqu xmmword [rbp + 0x747], xmm0
movdqa xmm1, xmmword [0x1401338e0]
movdqu xmmword [rbp + 0x757], xmm1
movdqa xmm0, xmmword [str._W__t]
movdqu xmmword [rbp + 0x767], xmm0
mov dword [rbp + 0x777], 0xabafe4e7
mov dword [rbp + 0x77b], 0x100eba3
lea rcx, [rbp + 0x707]
call fcn.14003c1b0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140133a60]
movdqu xmmword [rbp + 0x877], xmm0
movdqa xmm1, xmmword [0x1401338f0]
movdqu xmmword [rbp + 0x887], xmm1
movdqa xmm0, xmmword [str.WUiHamZ27__6]
movdqu xmmword [rbp + 0x897], xmm0
movdqa xmm1, xmmword [0x140133aa0]
movdqu xmmword [rbp + 0x8a7], xmm1
movdqa xmm0, xmmword [str.w_z_b__0:]
movdqu xmmword [rbp + 0x8b7], xmm0
movdqa xmm1, xmmword [0x140133920]
movdqu xmmword [rbp + 0x8c7], xmm1
movdqa xmm0, xmmword [str.MLTIIHPZ]
movdqu xmmword [rbp + 0x8d7], xmm0
mov dword [rbp + 0x8e7], 0x100efa7
lea rcx, [rbp + 0x877]
call fcn.14003c210
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140133a70]
movdqu xmmword [rbp + 0x4bb], xmm0
movdqa xmm1, xmmword [0x140133ae0]
movdqu xmmword [rbp + 0x4cb], xmm1
movdqa xmm0, xmmword [0x140133740]
movdqu xmmword [rbp + 0x4db], xmm0
movdqa xmm1, xmmword [0x1401335c0]
movdqu xmmword [rbp + 0x4eb], xmm1
movdqa xmm0, xmmword [0x140133570]
movdqu xmmword [rbp + 0x4fb], xmm0
mov dword [rbp + 0x50b], 0x444a4c05
mov word [rbp + 0x50f], 0xa
mov byte [rbp + 0x511], 1
lea rcx, [rbp + 0x4bb]
call fcn.14003c150
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140133a70]
movdqu xmmword [rbp - 0xe], xmm0
movdqa xmm1, xmmword [0x140133ae0]
movdqu xmmword [rbp + 2], xmm1
movdqa xmm0, xmmword [0x140133740]
movdqu xmmword [rbp + 0x12], xmm0
movdqa xmm1, xmmword [str.h_r8]
movdqu xmmword [rbp + 0x22], xmm1
mov dword [rbp + 0x32], 0x7b000a07
mov dword [rbp + 0x36], 0xc7e3973
mov dword [rbp + 0x3a], 0x4c422533
mov word [rbp + 0x3e], 2
mov byte [rbp + 0x40], 1
lea rcx, [rbp - 0xe]
call fcn.14003c240
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140133a00]
movdqu xmmword [rbp + 0x3a0], xmm0
movdqa xmm1, xmmword [0x140133a40]
movdqu xmmword [rbp + 0x3b0], xmm1
movdqa xmm0, xmmword [0x140133690]
movdqu xmmword [rbp + 0x3c0], xmm0
movdqa xmm1, xmmword [0x1401337e0]
movdqu xmmword [rbp + 0x3d0], xmm1
movdqa xmm0, xmmword [0x1401337d0]
movdqu xmmword [rbp + 0x3e0], xmm0
movdqa xmm1, xmmword [str._3JD_bM9]
movdqu xmmword [rbp + 0x3f0], xmm1
mov dword [rbp + 0x400], 0x141e1719
mov dword [rbp + 0x404], 0x505e5811
mov word [rbp + 0x408], 0xe6
mov byte [rbp + 0x40a], 1
lea rcx, [rbp + 0x3a0]
call fcn.14003c270
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140133a00]
movdqu xmmword [rbp + 0x991], xmm0
movdqa xmm1, xmmword [0x140133a40]
movdqu xmmword [rbp + 0x9a1], xmm1
movdqa xmm0, xmmword [0x140133690]
movdqu xmmword [rbp + 0x9b1], xmm0
movdqa xmm1, xmmword [0x140133850]
movdqu xmmword [rbp + 0x9c1], xmm1
movdqa xmm0, xmmword [0x1401337c0]
movdqu xmmword [rbp + 0x9d1], xmm0
movdqa xmm1, xmmword [0x1401339e0]
movdqu xmmword [rbp + 0x9e1], xmm1
mov word [rbp + 0x9f1], reloc.WLDAP32.dll_Ordinal_30
mov byte [rbp + 0x9f3], 1
lea rcx, [rbp + 0x991]
call fcn.14003c2a0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
lea rcx, [rbp + 0x7d0]
call fcn.140044fc0
nop
lea rcx, [rbp + 0x7b0]
call fcn.140044fc0
movdqa xmm0, xmmword [str.hvmnnvzLM_fF_]
movdqu xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x1401339f0]
movdqu xmmword [rbp - 0x80], xmm1
mov dword [rbp - 0x70], 0x111a524b
mov dword [rbp - 0x6c], 0x4a50031c
mov dword [rbp - 0x68], 0x7d70612c
mov dword [rbp - 0x64], 0x1007462
lea rcx, [rsp + 0x70]
call fcn.14003c2d0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp byte [0x1401a461b], 0
je 0x14003b595
cmp byte [0x1401a461c], 0
je 0x14003b57f
mov dword [rsp + 0x60], recv
lea rcx, [rbp + 0x780]
lea rdx, [rsp + 0x60]
jmp 0x14003b5c8
mov dword [rsp + 0x64], reloc.WS2_32.dll_setsockopt
lea rcx, [rbp + 0x788]
lea rdx, [rsp + 0x64]
jmp 0x14003b5c8
cmp byte [0x1401a461c], 0
je 0x14003b5b4
mov dword [rsp + 0x68], reloc.WS2_32.dll_ntohl
lea rcx, [rbp + 0x790]
lea rdx, [rsp + 0x68]
jmp 0x14003b5c8
mov dword [rsp + 0x6c], reloc.WLDAP32.dll_Ordinal_22
lea rcx, [rbp + 0x798]
lea rdx, [rsp + 0x6c]
call fcn.1400460e0
mov rcx, rax
call fcn.1400460f0
xor eax, eax
mov byte [rbp + 0xf48], al
lea rdx, [rbp + 0xd68]
lea rcx, [rbp + 0xf48]
call fcn.14003c300
mov r10, rax
cmp byte [rax + 0x1b], 0
je 0x14003b793
mov r8d, ebx
cmp edi, 2
jl 0x14003b74d
movdqa xmm5, xmmword [0x140133480]
movdqa xmm4, xmmword [0x140133b10]
movdqa xmm6, xmmword [0x1401334a0]
movdqa xmm0, xmmword [0x1401337b0]
movdqa xmmword [rsp + 0x50], xmm0
mov rcx, rax
mov edx, dword [rsp + 0x50]
nop word [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1401334d0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1401334d0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm2, xmm0
movd dword [rcx + 4], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x18
jl 0x14003b640
cmp r8d, 0x1c
jge 0x14003b793
movsxd r9, r8d
add r9, r10
nop dword [rax]
nop word [rax + rax]
mov eax, 0x8fb823ef
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x39
movzx eax, r8b
sub al, cl
add al, 0x36
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x1c
jl 0x14003b760
mov rdx, r10
lea rcx, [rbp + 0xd48]
call fcn.1400450b0
mov rcx, rax
call fcn.140044eb0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0xd48]
call fcn.140044fc0
xor eax, eax
mov byte [rbp + 0xf50], al
lea rdx, [rbp + 0xaca]
lea rcx, [rbp + 0xf50]
call fcn.14003c330
mov r10, rax
cmp byte [rax + 0xb], 0
je 0x14003b933
mov r8d, ebx
cmp edi, 2
jl 0x14003b8f9
movdqa xmm4, xmmword [0x140133b10]
movdqa xmm2, xmmword [0x140133480]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1401334a0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1401334d0]
packuswb xmm2, xmm2
mov eax, dword [0x1401337b0]
movd xmm0, eax
paddb xmm2, xmm0
movd xmm0, dword [r10]
xorps xmm2, xmm0
movd dword [r10], xmm2
movdqa xmm3, xmmword [0x140133490]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1401334a0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1401334d0]
packuswb xmm2, xmm2
movd xmm0, eax
paddb xmm2, xmm0
movd xmm0, dword [r10 + 4]
xorps xmm2, xmm0
movd dword [r10 + 4], xmm2
mov r8d, 8
movsxd r9, r8d
add r9, r10
nop
mov eax, 0x8fb823ef
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x39
movzx eax, r8b
sub al, cl
add al, 0x36
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xc
jl 0x14003b900
mov rdx, r10
lea rcx, [rbp + 0xd28]
call fcn.1400450b0
mov rcx, rax
call fcn.140044eb0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [rbp + 0xd28]
call fcn.140044fc0
xor eax, eax
mov byte [rbp + 0xf58], al
lea rdx, [rbp + 0xd84]
lea rcx, [rbp + 0xf58]
call fcn.14003c350
mov r10, rax
cmp byte [rax + 0x1d], 0
je 0x14003bb13
mov r8d, ebx
cmp edi, 2
jl 0x14003bacd
movdqa xmm5, xmmword [0x140133480]
movdqa xmm4, xmmword [0x140133b10]
movdqa xmm6, xmmword [0x1401334a0]
movdqa xmm0, xmmword [0x1401337b0]
movdqa xmmword [rsp + 0x50], xmm0
mov rcx, rax
mov edx, dword [rsp + 0x50]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1401334d0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1401334d0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm2, xmm0
movd dword [rcx + 4], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x18
jl 0x14003b9c0
cmp r8d, 0x1e
jge 0x14003bb13
movsxd r9, r8d
add r9, r10
nop dword [rax]
nop word [rax + rax]
mov eax, 0x8fb823ef
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x39
movzx eax, r8b
sub al, cl
add al, 0x36
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x1e
jl 0x14003bae0
mov rdx, r10
lea rcx, [rbp + 0xd08]
call fcn.1400450b0
mov rcx, rax
call fcn.140044eb0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0xd08]
call fcn.140044fc0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov byte [rsp + 0x30], al
lea rdx, [rbp + 0xdc3]
lea rcx, [rsp + 0x30]
call fcn.14003c380
mov r9, rax
cmp byte [rax + 0x29], 0
je 0x14003bcee
cmp edi, 2
jl 0x14003bcb8
movdqa xmm5, xmmword [0x140133480]
movdqa xmm4, xmmword [0x140133b10]
movdqa xmm6, xmmword [0x1401334a0]
movdqa xmm0, xmmword [0x1401337b0]
movdqa xmmword [rsp + 0x50], xmm0
mov rcx, rax
mov edx, dword [rsp + 0x50]
nop dword [rax]
nop dword [rax + rax]
movd xmm2, ebx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1401334d0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [rbx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1401334d0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm2, xmm0
movd dword [rcx + 4], xmm2
add ebx, 8
lea rcx, [rcx + 8]
cmp ebx, 0x28
jl 0x14003bbb0
cmp ebx, 0x2a
jge 0x14003bcee
movsxd r8, ebx
add r8, r9
nop
mov eax, 0x8fb823ef
imul ebx
add edx, ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x39
movzx eax, bl
sub al, cl
add al, 0x36
xor byte [r8], al
inc ebx
lea r8, [r8 + 1]
cmp ebx, 0x2a
jl 0x14003bcc0
mov rdx, r9
lea rcx, [rbp + 0xba8]
call fcn.1400450b0
mov rcx, rax
call fcn.140044eb0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [rbp + 0xba8]
call fcn.140044fc0
mov dword [rsp + 0x20], 1
mov r9d, 0x40
lea r8d, [r9 - 0x3e]
lea rdx, str.message.vbs
lea rcx, [rbp + 0xdf0]
call fcn.140044be0
nop
lea rcx, [rbp + 0xdf0]
call fcn.140044bd0
test al, al
jne 0x14003bd73
lea rdx, str.Error_creating_VBScript_file.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140045c80
lea rdx, [0x140045e50]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0xdf0]
cmp byte [0x1401a461e], 0
je 0x14003bd91
lea rdx, str.MsgBox__The_spoofing_process_encountered_issues._Please_verify_if_there_have_been_any_changes_to_your_disk_drive.___64___Warning_
call fcn.140045c80
jmp 0x14003bdd4
lea rdx, str.MsgBox__Spoofing_process_completed._It_is_recommended_to_verify_the_changes_manually.___64___Success_
call fcn.140045c80
mov dword [rsp + 0x41], 0x697f6a4d
mov dword [rsp + 0x45], 0x79716f4c
mov dword [rsp + 0x49], 0x10474d49
mov word [rsp + 0x4d], reloc.WS2_32.dll_recv
mov byte [rsp + 0x4f], 1
lea rcx, [rsp + 0x41]
call fcn.14003c3c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
lea rcx, [rbp + 0xdf0]
call fcn.140044b90
lea rcx, str.start_wscript_message.vbs
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.message.vbs
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [rbp + 0x7a0]
call fcn.140038740
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3