Function at 0x1400018f0
Capabilities:
Check if file exists
Execute command
Set console window title

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x438
lea rdi, [0x140006630]
cmp ecx, 1
mov qword [rsp + 0x20], rdi
mov ecx, 0xa
sbb eax, eax
xor r8d, r8d
xor edx, edx
xor ax, ax
lea r9d, [rax + 0x20000]
call qword [sym.imp.CRYPT32.dll_CertOpenStore]
mov rsi, rax
test rax, rax
je 0x1400017f0
mov rdi, qword [sym.imp.CRYPT32.dll_CertEnumCertificatesInStore]
mov rbp, qword [sym.imp.CRYPT32.dll_CryptFindCertificateKeyProvInfo]
xor r14d, r14d
xor ebx, ebx
mov r12, qword [sym.imp.CRYPT32.dll_CertGetNameStringW]
lea r15, str._Failed_to_get_certificate_name
nop dword [rax + rax]
mov rdx, rbx
mov rcx, rsi
call rdi
mov rbx, rax
test rax, rax
je 0x140001760
xor r8d, r8d
mov edx, 0x10000
mov rcx, rbx
call rbp
test eax, eax
je 0x1400016f0
lea r13, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov edx, 5
mov dword [rsp + 0x28], 0x200
mov rcx, rbx
mov qword [rsp + 0x20], r13
call r12
test eax, eax
je 0x1400017a0
mov rdx, r13
lea rcx, [0x140006682]
mov r14d, 1
call fcn.140001490
mov rdx, rbx
mov rcx, rsi
call rdi
mov rbx, rax
test rax, rax
jne 0x140001700
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80092004
je 0x140001772
cmp eax, 0x12
jne 0x1400017b8
xor edx, edx
mov rcx, rsi
call qword [sym.imp.CRYPT32.dll_CertCloseStore]
test r14d, r14d
je 0x1400017dc
xor eax, eax
add rsp, 0x438
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r15
mov edx, eax
call fcn.1400036c0
jmp 0x1400016f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1400066d0]
mov edx, eax
call fcn.1400036c0
xor edx, edx
mov rcx, rsi
call qword [sym.imp.CRYPT32.dll_CertCloseStore]
test r14d, r14d
jne 0x140001782
lea rcx, str.___No_certificates_available___n
call fcn.140001490
jmp 0x140001782
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140006658]
mov edx, eax
add rsp, 0x438
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400036c0
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
lea rax, [rsp + 0x30]
mov rdi, r8
mov rbp, r9
mov r8d, ecx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
mov rcx, rdi
mov esi, edx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call fcn.140002d70
mov ebx, eax
test eax, eax
jne 0x1400018d6
test esi, esi
lea rax, [0x140006758]
mov r8, qword [rsp + 0x38]
mov rcx, rbp
lea rdx, [0x140006630]
cmovne rdx, rax
call fcn.140003330
mov rcx, qword [rsp + 0x38]
mov r12, qword [rsp + 0x30]
mov ebx, eax
test rcx, rcx
je 0x14000189c
call qword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
test r12, r12
je 0x1400018ac
xor edx, edx
mov rcx, r12
call qword [sym.imp.CRYPT32.dll_CertCloseStore]
test ebx, ebx
jne 0x1400018d6
test esi, esi
lea r8, [0x140006796]
mov r9, rbp
mov rdx, rdi
lea rax, str._Certificate_Authority
lea rcx, str._Installed__s_s_into__s_n
cmovne r8, rax
call fcn.140001490
mov eax, ebx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rax, qword [rdx]
mov qword [0x14000a030], rax
mov rsi, rdx
mov edi, ecx
lea rcx, str.SubZero_Signing_Tool__Made_By_Payson_Holmes__github.com_paysonism
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rcx, section..rdata
call sub.api_ms_win_crt_runtime_l1_1_0.dll_system
lea rcx, str.start_https:__github.com_paysonism
call sub.api_ms_win_crt_runtime_l1_1_0.dll_system
lea rcx, str.color_6
call sub.api_ms_win_crt_runtime_l1_1_0.dll_system
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, str._n_SubZero_Signing_Tool__DigiSigner_n
mov rcx, rax
call fcn.140001450
mov ecx, 2
call rbx
lea rdx, str._Created_by_Payson_Holmes_n
mov rcx, rax
call fcn.140001450
mov ecx, 2
call rbx
lea rdx, str._This_program_is_a_paid_tool._Do_not_share_or_redistribute_it._n
mov rcx, rax
call fcn.140001450
mov ecx, 2
call rbx
lea rdx, str._Purchase_Price:__750_Lifetime_n
mov rcx, rax
call fcn.140001450
mov ecx, 2
call rbx
lea rdx, str._This_tool_allows_you_to_create_valid_code_signing_certificates_that_mimic_DigiCert_Certificates_for_maximum_security._n_n
mov rcx, rax
call fcn.140001450
cmp edi, 1
je 0x140001b88
mov rbp, qword [rsi + 8]
movzx eax, word [rbp]
and eax, 0xfffffffd
cmp ax, 0x2d
jne 0x140001b88
movzx ecx, word [rbp + 2]
mov r14d, 0x6c
lea r13, [rbp + 2]
xor ebx, ebx
mov r12, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
lea r15, str.list
cmp cx, r14w
je 0x140001a30
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, r14w
je 0x140001a30
mov rdx, qword [r15 + rbx*8]
mov rcx, r13
call r12
test eax, eax
je 0x140001a37
add rbx, 1
cmp rbx, 5
je 0x140001b88
mov rax, qword [r15 + rbx*8]
movzx ecx, word [rbp + 2]
movzx r14d, word [rax]
cmp cx, r14w
jne 0x1400019f7
cmp word [rbp + 4], 0
jne 0x140001a02
lea ebp, [rdi - 2]
test ebp, ebp
jle 0x140001a54
mov r12, qword [rsi + 0x10]
movzx eax, word [r12]
and eax, 0xfffffffd
cmp ax, 0x2d
je 0x140001ba0
add rsi, 0x10
xor edi, edi
mov eax, ebx
lea rdx, [0x140006d50]
movsxd rbx, ebx
cmp dword [rdx + rbx*4], ebp
jg 0x140001b88
lea rdx, [0x140006d30]
mov edx, dword [rdx + rbx*4]
cmp edx, ebp
jge 0x140001a85
test edx, edx
jns 0x140001b88
cmp eax, 3
je 0x140001ce0
cmp eax, 4
je 0x140001c98
cmp eax, 1
je 0x140001c10
cmp eax, 2
jne 0x140001bf8
call fcn.140002f40
test eax, eax
je 0x140001e69
cmp edi, 1
lea rbx, [0x140006630]
mov ecx, 0xa
sbb eax, eax
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ax, ax
lea r9d, [rax + 0x20000]
call qword [sym.imp.CRYPT32.dll_CertOpenStore]
mov r12, rax
test rax, rax
je 0x140001d90
mov rbx, qword [rsi]
mov r8, rax
mov edx, 1
mov rcx, rbx
call fcn.140002be0
mov r13, rax
test rax, rax
je 0x140001e7d
cmp ebp, 1
jle 0x140001db8
lea eax, [rbp - 2]
lea rbx, [rsi + 8]
lea rdi, [rsi + rax*8 + 0x10]
lea r15, str._Signed__s_n
mov rsi, qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea r14, str._Failed_to_sign__s
lea rbp, str._File__s_does_not_exist
jmp 0x140001b58
mov rdx, qword [rbx]
mov rcx, rbp
call fcn.1400037a0
add rbx, 8
cmp rdi, rbx
je 0x140001db8
mov rcx, qword [rbx]
call rsi
test eax, eax
je 0x140001b40
mov rcx, qword [rbx]
mov rdx, r13
mov r8, r12
call fcn.140002fd0
mov rdx, qword [rbx]
test eax, eax
jne 0x140001da8
mov rcx, r14
call fcn.1400037a0
jmp 0x140001b4b
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400014e0
movzx ecx, word [r12 + 2]
cmp cx, 0x6d
je 0x140001be8
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6d
je 0x140001be8
lea rcx, [r12 + 2]
lea rdx, str.machine
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140001a54
lea ebp, [rdi - 3]
add rsi, 0x18
mov edi, 1
jmp 0x140001a5a
cmp word [r12 + 4], 0
jne 0x140001bb7
jmp 0x140001bd1
mov ecx, edi
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x140001680
cmp edi, 1
lea rbx, [0x140006630]
mov ecx, 0xa
sbb eax, eax
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ax, ax
lea r9d, [rax + 0x20000]
call qword [sym.imp.CRYPT32.dll_CertOpenStore]
mov rbx, rax
test rax, rax
je 0x140001d90
mov rcx, qword [rsi]
mov r8, rax
mov edx, edi
call fcn.140002000
mov rcx, rax
test rax, rax
je 0x140001d6c
call qword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.CRYPT32.dll_CertCloseStore]
mov rdx, qword [rsi]
lea rcx, str._Created_a_valid_code_signing_certificate__s_n
call fcn.140001490
xor ebx, ebx
mov eax, ebx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call fcn.140003240
test eax, eax
je 0x140001d20
mov r9, qword [rsi + 8]
mov r8, qword [rsi]
mov edx, 1
mov ecx, edi
call 0x140001820
mov ebx, eax
test eax, eax
jne 0x140001c82
mov r9, qword [rsi + 8]
mov r8, qword [rsi]
xor edx, edx
mov ecx, edi
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x140001820
mov qword [rsp + 0x30], 0
mov rdx, qword [rsi]
mov qword [rsp + 0x38], 0
movzx eax, word [rdx]
and eax, 0xfffffffd
cmp ax, 0x2d
je 0x140001d48
xor r12d, r12d
cmp ebp, 2
je 0x140001dd8
call fcn.1400014e0
mov ebx, eax
jmp 0x140001c82
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._Failed_to_enable_take_ownership__backup__and_restore_privileges
mov edx, eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400036c0
lea rcx, [rdx + 2]
lea rdx, [0x140006c5e]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140001d01
sub ebp, 1
add rsi, 8
mov r12d, 1
jmp 0x140001d04
mov rdx, rbx
lea rcx, str.Failed_to_create_certificate
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400037e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140006658]
mov edx, eax
jmp 0x140001d2f
mov rcx, r15
call fcn.140001490
jmp 0x140001b4b
mov rcx, r13
call qword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
xor edx, edx
mov rcx, r12
call qword [sym.imp.CRYPT32.dll_CertCloseStore]
jmp 0x140001c80
lea rax, [rsp + 0x30]
mov rcx, qword [rsi]
lea r9, [rsp + 0x38]
mov r8d, edi
mov qword [rsp + 0x20], rax
mov edx, r12d
call fcn.140002d70
mov ebx, eax
test eax, eax
jne 0x140001c82
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsi + 8]
call fcn.140003180
mov rcx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
mov ebx, eax
test rcx, rcx
je 0x140001e24
call qword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
test rdi, rdi
je 0x140001e34
xor edx, edx
mov rcx, rdi
call qword [sym.imp.CRYPT32.dll_CertCloseStore]
test ebx, ebx
jne 0x140001c82
test r12d, r12d
lea r8, [0x140006796]
mov rdx, qword [rsi]
mov r9, qword [rsi + 8]
lea rax, str._Certificate_Authority
lea rcx, str._Exported__s_s_to__s_n
cmovne r8, rax
call fcn.140001490
jmp 0x140001c82
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Failed_to_load_the_signing_functions
mov edx, eax
jmp 0x140001d2f
mov r8, r12
mov edx, edi
mov rcx, rbx
call fcn.140002000
mov r13, rax
test rax, rax
jne 0x140001b0c
mov rdx, r12
lea rcx, str.Failed_to_find_or_create_certificate
jmp 0x140001d76