Function at 0x1400036c0
Capabilities:
Get mac address on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x690]
sub rsp, 0x790
mov rax, qword [0x1400374d0]
xor rax, rsp
mov qword [rbp + 0x680], rax
movsd xmm0, qword [str.phnd1011:]
xor edi, edi
movzx eax, word [0x14002a590]
mov esi, edi
movsd qword [rsp + 0x58], xmm0
movsd xmm0, qword [str.rknd1011:]
mov word [rsp + 0x60], ax
movzx eax, word [0x14002a5a0]
movsd qword [rsp + 0x68], xmm0
movups xmm0, xmmword [str.00:00:00:00:00:00]
mov word [rsp + 0x70], ax
movzx eax, word [0x14002a5b8]
movups xmmword [rbp - 0x58], xmm0
mov word [rbp - 0x48], ax
movups xmm0, xmmword [str.ff:ff:ff:ff:ff:ff]
movzx eax, word [0x14002a5d0]
mov qword [rbp - 0x80], rdx
lea rdx, [rsp + 0x54]
mov dword [rsp + 0x78], ecx
xor ecx, ecx
movups xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x60], ax
mov dword [rsp + 0x54], edi
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
mov ecx, dword [rsp + 0x54]
mov r15d, 1
mov edx, r15d
call fcn.14000fc44
lea rdx, [rsp + 0x54]
mov rcx, rax
mov r14, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
mov rbx, r14
test r14, r14
je 0x140003874
nop
movzx ecx, byte [rbx + 0x19d]
movzx edx, byte [rbx + 0x19c]
movzx r8d, byte [rbx + 0x19a]
movzx eax, byte [rbx + 0x19b]
movzx r10d, byte [rbx + 0x199]
movzx r9d, byte [rbx + 0x198]
mov dword [rsp + 0x40], ecx
lea rcx, [rbp - 0x40]
mov dword [rsp + 0x38], edx
mov edx, 0x12
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r8d
lea r8, str._02x:_02x:_02x:_02x:_02x:_02x
mov dword [rsp + 0x20], r10d
call fcn.140003f20
lea rax, [rbp - 0x40]
lea r8, [rbp - 0x58]
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140003816
inc rax
test ecx, ecx
jne 0x140003803
test edx, edx
je 0x140003847
lea rax, [rbp - 0x40]
lea r8, [rbp - 0x70]
sub r8, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140003843
inc rax
test ecx, ecx
jne 0x140003830
test edx, edx
jne 0x140003855
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400037a0
jmp 0x140003874
mov byte [rbp - 0x58], sil
mov rcx, rdi
nop dword [rax]
movzx eax, byte [rbp + rcx - 0x40]
mov byte [rbp + rcx - 0x58], al
lea rcx, [rcx + 1]
test al, al
jne 0x140003860
mov esi, r15d
mov rcx, r14
call fcn.14000fc4c
or r13, 0xffffffffffffffff
test esi, esi
jne 0x140003a54
mov rdx, r15
mov ecx, 0x100000
call fcn.14000fc44
lea rdx, [0x1400297bc]
mov rsi, rax
lea rcx, str.wmic_path_win32_physicalmedia_get_SerialNumber
call fcn.14000b9c8
mov rbx, rax
test rax, rax
je 0x14000391e
mov r8, rax
lea edx, [r13 + 0x41]
lea rcx, [rbp + 0x40]
call fcn.14000a96c
test rax, rax
je 0x140003916
nop dword [rax + rax]
lea rcx, [rsi - 1]
cmp byte [rcx + 1], dil
lea rcx, [rcx + 1]
jne 0x1400038d4
lea r8, [rbp + 0x40]
xor edx, edx
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400038f0
mov r8, rbx
lea rcx, [rbp + 0x40]
mov edx, 0x40
call fcn.14000a96c
test rax, rax
jne 0x1400038d0
mov rcx, rbx
call fcn.14000b8f0
mov eax, 0xa
lea rdx, [rsp + 0x50]
mov rcx, rsi
mov word [rsp + 0x50], ax
call fcn.14000fc14
test rax, rax
je 0x14000396e
lea rdx, [rsp + 0x50]
xor ecx, ecx
call fcn.14000fc14
test rax, rax
je 0x14000396e
lea rdx, [rbp + 0x280]
sub rdx, rax
nop word [rax + rax]
movzx ecx, byte [rax]
mov byte [rax + rdx], cl
lea rax, [rax + 1]
test cl, cl
jne 0x140003960
mov r8d, edi
lea rcx, [rbp + 0x280]
mov rax, r13
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], dil
jne 0x140003980
test rax, rax
je 0x140003a13
mov rdx, rdi
cmp byte [rbp + rdx + 0x280], 0x20
jne 0x1400039b4
cmp rdx, 0x400
jae 0x140003f08
mov byte [rbp + rdx + 0x280], dil
cmp byte [rbp + rdx + 0x280], 0xa
jne 0x1400039d3
cmp rdx, 0x400
jae 0x140003f0e
mov byte [rbp + rdx + 0x280], dil
cmp byte [rbp + rdx + 0x280], 0xd
jne 0x1400039f2
cmp rdx, 0x400
jae 0x140003f14
mov byte [rbp + rdx + 0x280], dil
inc r8d
lea rax, [rbp + 0x280]
inc rdx
mov rcx, r13
inc rcx
cmp byte [rax + rcx], dil
jne 0x140003a02
movsxd rax, r8d
cmp rax, rcx
jb 0x140003995
mov rcx, rsi
call fcn.14000fc4c
lea rcx, [rbp + 0x280]
mov rax, r13
inc rax
cmp byte [rcx + rax], dil
jne 0x140003a25
cmp rax, 8
jbe 0x140003e87
mov byte [rbp - 0x58], dil
nop dword [rax]
movzx eax, byte [rbp + rdi + 0x280]
mov byte [rbp + rdi - 0x58], al
lea rdi, [rdi + 1]
test al, al
jne 0x140003a40
mov rdx, r15
mov qword [rsp + 0x7c0], r12
mov ecx, 0x40
call fcn.14000fc44
mov rdx, r15
mov ecx, 0x40
mov r12, rax
call fcn.14000fc44
mov r14, rax
mov rdi, r13
lea rax, [rsp + 0x58]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140003a84
lea rcx, [rbp - 0x58]
mov rax, r13
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x140003a94
lea rcx, [rax + 1]
mov rdx, r15
add rcx, rdi
call fcn.14000fc44
cmp byte [rbp - 0x58], 0
lea rbx, [rbp - 0x58]
mov rsi, rax
mov qword [rbp - 0x78], rax
je 0x140003ad3
nop
movsx ecx, byte [rbx]
call fcn.1400116c0
mov byte [rbx], al
lea rbx, [rbx + 1]
cmp byte [rbx], 0
jne 0x140003ac0
mov byte [rsi], 0
lea rcx, [rsi - 1]
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140003ae0
lea r8, [rsp + 0x58]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140003b00
mov byte [rdi + rsi], al
lea rcx, [rsi - 1]
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140003b20
lea r8, [rbp - 0x58]
xor edx, edx
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140003b30
lea rax, [rbp - 0x58]
mov rcx, r13
inc rcx
cmp byte [rax + rcx], 0
jne 0x140003b47
lea rax, [rdi + rcx]
mov rdx, r15
inc rcx
mov byte [rax + rsi], 0
call fcn.14000fc44
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x58], rax
mov r8, rax
lea rdx, [rbp - 0x58]
sub r8, rcx
mov byte [rax], 0
nop dword [rax]
movzx ecx, byte [rdx]
mov byte [rdx + r8], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x140003b80
lea rdx, [rbp - 0x28]
mov rcx, rsi
call fcn.1400045f0
mov r15d, 0x10
lea rbx, [rbp - 0x28]
mov esi, r15d
mov rdi, r12
nop dword [rax + rax]
movzx r8d, byte [rbx]
lea rdx, str._02x
mov rcx, rdi
call fcn.140003f80
add rdi, 2
lea rbx, [rbx + 1]
sub rsi, 1
jne 0x140003bb0
mov rbx, r12
cmp byte [r12], sil
je 0x140003bf3
nop word [rax + rax]
movsx ecx, byte [rbx]
call fcn.1400116c0
mov byte [rbx], al
lea rbx, [rbx + 1]
cmp byte [rbx], 0
jne 0x140003be0
lea rax, [rsp + 0x68]
mov rbx, r13
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140003c00
mov rax, r13
nop dword [rax]
cmp byte [r12 + rax + 1], 0
lea rax, [rax + 1]
jne 0x140003c10
lea rcx, [rax + 1]
mov edx, 1
add rcx, rbx
call fcn.14000fc44
mov rsi, rax
mov byte [rax], 0
lea rcx, [rax - 1]
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140003c40
lea r8, [rsp + 0x68]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140003c60
mov byte [rbx + rsi], al
lea rcx, [rsi - 1]
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140003c80
xor edx, edx
nop dword [rax]
movzx eax, byte [r12 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140003c90
inc r13
cmp byte [r12 + r13], 0
jne 0x140003ca0
add r13, rbx
lea rdx, [rbp - 0x18]
mov rcx, rsi
mov byte [rsi + r13], 0
call fcn.1400045f0
lea rbx, [rbp - 0x18]
mov rdi, r14
nop word [rax + rax]
movzx r8d, byte [rbx]
lea rdx, str._02x
mov rcx, rdi
call fcn.140003f80
add rdi, 2
lea rbx, [rbx + 1]
sub r15, 1
jne 0x140003cd0
mov rbx, r14
cmp byte [r14], r15b
je 0x140003d13
nop dword [rax]
movsx ecx, byte [rbx]
call fcn.1400116c0
mov byte [rbx], al
lea rbx, [rbx + 1]
cmp byte [rbx], 0
jne 0x140003d00
xor edx, edx
lea rcx, [rbp + 0x80]
mov r8d, 0x1f4
call fcn.140009600
mov eax, dword [0x140029de8]
mov r15d, 1
movsd xmm0, qword [str.phphidden.dat]
mov edx, r15d
mov dword [rsp + 0x70], eax
mov ecx, 0x1f4
movzx eax, word [0x140029dec]
mov word [rsp + 0x74], ax
movsd qword [rsp + 0x68], xmm0
call fcn.14000fc44
mov r8d, 0x1f4
lea rdx, [rbp + 0x80]
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x140003e01
lea rcx, [rbp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea rcx, [rbp + 0x80]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140003d95
movzx eax, word [0x140029734]
mov rdx, rdi
mov word [rcx], ax
lea rax, [rbp + 0x80]
sub rdx, rax
lea rcx, [rbp + 0x80]
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rcx + rdx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140003dc0
lea rcx, [rdi - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140003dd2
lea r9, [rsp + 0x68]
xor r8d, r8d
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r9 + r8]
mov byte [rcx + r8], al
lea r8, [r8 + 1]
test al, al
jne 0x140003df0
lea rdx, [0x1400297bc]
mov byte [rbp], 0
mov rcx, rdi
call fcn.14000aa30
mov rbx, rax
test rax, rax
je 0x140003e66
mov r8, rax
lea rcx, [rbp]
mov edx, 0x40
call fcn.14000a96c
mov rcx, rbx
mov byte [rbp + 0x20], 0
call fcn.14000a44c
lea rdx, [rbp]
sub rdx, r14
movzx ecx, byte [r14]
movzx eax, byte [r14 + rdx]
sub ecx, eax
jne 0x140003e54
inc r14
test eax, eax
jne 0x140003e40
mov eax, dword [0x14003803c]
test ecx, ecx
cmove eax, r15d
mov dword [0x14003803c], eax
mov rcx, rdi
call fcn.14000fc4c
cmp dword [rsp + 0x78], r15d
jne 0x140003eba
cmp dword [0x14003803c], r15d
jne 0x140003e9b
lea rcx, str.FULL_VERSION_nThank_you_for_registration__n
jmp 0x140003eb5
inc dword [0x14003804c]
lea rcx, str.Error:_unsupported_device__can_not_generate_registration_code.
call fcn.1400034a0
jmp 0x140003edd
mov r8, qword [rbp - 0x80]
lea rcx, str.Your_Serial_Number_is:__s_n_nPlease_use_this_serial_number_to_obtain_your_registration_code_and_then_enter_registration_code_like_this:_n_n_s___regREGISTRATION_CODE_n_n
mov rdx, r12
call fcn.1400034a0
lea rcx, str._nThese_options_are_not_available_in_unregistered_version:_n___php____cli____dom____ip____mac____var_nUnregistered_version_can_not_encoder_more_than_10_files_in_directory_nmode__can_not_encode_files_other_than__php__extension__can_not_encode_nfiles_larger_than_10_KB_and_encoded_files_locked_to_expires_in_7_days._n_n
call fcn.1400034a0
mov rcx, qword [rsp + 0x58]
call fcn.14000fc4c
mov rcx, qword [rbp - 0x78]
call fcn.14000fc4c
mov rcx, rsi
call fcn.14000fc4c
mov r12, qword [rsp + 0x7c0]
mov rcx, qword [rbp + 0x680]
xor rcx, rsp
call fcn.1400083a0
lea r11, [rsp + 0x790]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
call fcn.140008104
int3
call fcn.140008104
int3
call fcn.140008104
int3