Function at 0x14005bd90
Capabilities:
Delete file
Execute command
Terminate process

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x1402533c0]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea rcx, [0x140253c90]
call fcn.140067990
lea rcx, [0x1400e8a88]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._n_Kali_Fn___Berrys_FN_Cracked___n_n_Key__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140048c90
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movdqa xmm1, xmmword [0x1400e8d80]
movdqu xmmword [rsp + 0x58], xmm1
mov byte [rsp + 0x48], 0
lea rdx, [rsp + 0x48]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140048a40
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x20]
call fcn.14004a700
mov rdx, rax
lea rcx, [0x140253c90]
call fcn.1400692e0
lea rcx, [0x1400e8a88]
cmp byte [0x140253ea0], 0
jne 0x14005bfe7
mov rbx, qword [0x140253f78]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.color_6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_26
lea rdx, str.C:WindowsSystem32dr.sys
lea rcx, [rsp + 0x20]
call fcn.140048ef0
nop
mov r9d, 0x3de0
lea r8, [0x14024ef90]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14004c560
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x14005becd
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005bec8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005bec8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bdc7c
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_26
lea rdx, str.C:WindowsSystem32mp.exe
lea rcx, [rsp + 0x20]
call fcn.140048ef0
nop
mov r9d, 0x94a00
lea r8, [0x1401ba590]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14004c560
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x14005bf51
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005bf4c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005bf4c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bdc7c
lea rcx, str.C:WindowsSystem32mp.exe_C:WindowsSystem32dr.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem32dr.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:WindowsSystem32mp.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [0x1400e8a88]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [0x140253f78]
call fcn.14004ed80
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x14005bfd2
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005bfcd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005bfcd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bdc7c
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400bdd90
add rsp, 0x70
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
lea rcx, str.color_4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._n_Invalid_Key._Get_the_key_in_the_discord._n_n_Discord____discord.gg_berrys
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140048c90
mov ecx, 0x1f40
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3