Function at 0x14000ee00
Capabilities:
Delete file
Encode data using xor
Execute command
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x148]
sub rsp, 0x230
movaps xmmword [rax - 0x28], xmm6
mov rax, qword [0x1400ae0c0]
xor rax, rsp
mov qword [rbp + 0x118], rax
call fcn.140007f40
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov r15, rax
lea rcx, [0x1400af610]
call fcn.14002ed20
cmp byte [0x1400af840], 0
jne 0x14000eed1
mov r8, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x40]
call fcn.14000fd80
movzx ecx, byte [rax + 0xa]
test cl, cl
je 0x14000eea0
xor byte [rax], 0x35
xor byte [rax + 1], 0x36
xor byte [rax + 2], 0x37
xor byte [rax + 3], 0x38
xor byte [rax + 4], 0x39
xor byte [rax + 5], 0x3a
xor byte [rax + 6], 0x3b
xor byte [rax + 7], 0x3c
xor byte [rax + 8], 0x3d
xor byte [rax + 9], 0x3e
xor cl, 0x3f
mov byte [rax + 0xa], cl
mov rdx, rax
mov rcx, r8
call fcn.140013ea0
mov rcx, rax
lea rdx, [0x1400af848]
call fcn.140014380
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movups xmm0, xmmword [str.sDXBTmqF]
movups xmmword [rbp + 0x78], xmm0
movsd xmm0, qword [0x14009d9f0]
movsd qword [rbp + 0x88], xmm0
movzx eax, byte [0x14009d9f8]
mov byte [rbp + 0x90], al
xor ebx, ebx
mov r8d, ebx
movdqa xmm6, xmmword [0x14009dba0]
mov esi, dword [reloc.WS2_32.dll_accept]
cmp esi, 2
jl 0x14000f037
movdqa xmm4, xmmword [0x14009db20]
movdqa xmm3, xmmword [0x14009dbc0]
movdqa xmm5, xmmword [0x14009db40]
movdqa xmm0, xmmword [str.5555555555555555]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rbp + 0x7c]
mov edx, dword [rsp + 0x40]
nop dword [rax]
nop word [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x18
jl 0x14000ef50
cmp r8d, 0x19
jge 0x14000f082
movsxd rax, r8d
lea r9, [rbp + 0x78]
add r9, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul ecx, eax, 0x35
add cl, r8b
xor byte [r9], cl
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x19
jl 0x14000f050
lea r8, [0x1400af4e0]
lea rdx, [rbp + 0x78]
lea rcx, [rbp + 0x38]
call fcn.1400143a0
nop
lea r8, [0x14009b014]
mov rdx, rax
lea rcx, [rbp + 0x18]
call fcn.140014500
nop
lea r8, [0x1400af520]
mov rdx, rax
lea rcx, [rbp + 0xc0]
call fcn.140014570
nop
lea rcx, [rbp + 0x18]
call fcn.1400115e0
nop
lea rcx, [rbp + 0x38]
call fcn.1400115e0
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x30]
call fcn.140002910
mov qword [rbp + 0xb8], rax
lea rdx, [rbp + 0xb8]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
lea r9, [rbp + 0xe0]
lea r8, str._H:_M:_S
mov edx, 9
lea rcx, [rbp + 0x108]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
lea rdx, str.en_US.UTF_8
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_SetConsoleCP]
lea rdx, [0x14009b034]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140013ea0
mov ecx, 9
call fcn.14000b160
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400145e0
lea rdx, [0x1400147b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov ecx, 7
call fcn.14000b160
call fcn.140003000
call fcn.140002a10
call fcn.140003340
call fcn.140002a10
mov ecx, 0x1b58
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str._n___Serials__TPM_State:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140013ea0
cmp byte [0x1400af601], 0
jne 0x14000f224
cmp byte [0x1400af600], 0
jne 0x14000f224
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdi, rax
mov edx, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._n___Unchanged
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140013ea0
call fcn.140003000
call fcn.140002a10
call fcn.140003340
call fcn.140002a10
mov edx, 7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
jmp 0x14000f299
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdi, rax
mov edx, 2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._n___Changed
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140013ea0
call fcn.140003000
call fcn.140002a10
call fcn.140003340
call fcn.140002a10
mov edx, 7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.saved_values.txt
lea rcx, [rbp + 0x58]
call fcn.140011640
nop
lea rcx, [rbp + 0x58]
call fcn.14000aa20
nop
lea rcx, [rbp + 0x58]
call fcn.1400115e0
call fcn.14000abe0
test al, al
je 0x14000f2b5
mov ecx, ntohl
call fcn.14000b160
lea rdx, [0x14009b308]
jmp 0x14000f2c6
mov ecx, 0xa
call fcn.14000b160
lea rdx, str._n___Kali_Crack
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140013ea0
call fcn.140003000
call fcn.140002a10
call fcn.140003340
call fcn.140002a10
lea rdx, [0x14009b034]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140013ea0
mov ecx, 7
call fcn.14000b160
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140003000
call fcn.140002a10
call fcn.140003340
call fcn.140002a10
lea rcx, [rbp + 0x58]
call fcn.1400147f0
nop
lea rcx, [rbp + 0x58]
call fcn.140006200
movzx edi, al
lea rcx, [rbp + 0x58]
call fcn.140005950
test dil, dil
je 0x14000f91a
lea rax, [rbp + 0x58]
mov qword [rsp + 0x30], rax
lea rdx, str.username
lea rcx, [rbp + 0x58]
call fcn.140011640
mov rdi, rax
lea rdx, str.licens.json
lea rcx, [rbp + 0x98]
call fcn.140011640
nop
mov rdx, rdi
mov rcx, rax
call fcn.1400074d0
test al, al
jne 0x14000f615
lea rax, [rbp + 0x98]
mov qword [rsp + 0x38], rax
lea rdx, str.license
lea rcx, [rbp + 0x98]
call fcn.140011640
mov rdi, rax
lea rdx, str.licens.json
lea rcx, [rbp + 0x78]
call fcn.140011640
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x58]
call fcn.140006f60
nop
lea rdx, [rbp + 0x58]
lea rcx, [rsp + 0x40]
call fcn.140011680
mov rdx, rax
lea rcx, [0x1400af610]
call fcn.140030b70
cmp byte [0x1400af840], 0
jne 0x14000f480
lea rcx, str.licens.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x40]
call fcn.14000fd80
movzx edx, byte [rax + 0xa]
test dl, dl
je 0x14000f44d
xor byte [rax], 0x35
xor byte [rax + 1], 0x36
xor byte [rax + 2], 0x37
xor byte [rax + 3], 0x38
xor byte [rax + 4], 0x39
xor byte [rax + 5], 0x3a
xor byte [rax + 6], 0x3b
xor byte [rax + 7], 0x3c
xor byte [rax + 8], 0x3d
xor byte [rax + 9], 0x3e
xor dl, 0x3f
mov byte [rax + 0xa], dl
mov rdx, rax
call fcn.140013ea0
mov rcx, rax
lea rdx, [0x1400af848]
call fcn.140014380
call fcn.140004f50
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movups xmm0, xmmword [0x14009d198]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [str.02_________q]
movups xmmword [rsp + 0x70], xmm1
movsd xmm0, qword [0x14009d1b8]
movsd qword [rbp - 0x80], xmm0
cmp esi, 2
jl 0x14000f5bf
movdqa xmm4, xmmword [0x14009db20]
movdqa xmm3, xmmword [0x14009dbc0]
movdqa xmm5, xmmword [0x14009db40]
movdqa xmm0, xmmword [str.5555555555555555]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x64]
mov edx, dword [rsp + 0x40]
nop dword [rax]
movd xmm2, ebx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [rbx + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add ebx, 8
lea rcx, [rcx + 8]
cmp ebx, 0x28
jl 0x14000f4e0
jmp 0x14000f5fe
lea r8, [rsp + 0x60]
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x4d4873ed
imul ebx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul edx, eax, 0x35
add dl, bl
xor byte [r8], dl
inc ebx
lea r8, [r8 + 1]
cmp ebx, 0x28
jl 0x14000f5d0
lea rdx, [rsp + 0x60]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140013ea0
nop
jmp 0x14000fb99
lea rax, [rbp + 0x78]
mov qword [rsp + 0x38], rax
lea rdx, str.username
lea rcx, [rbp + 0x78]
call fcn.140011640
mov rdi, rax
lea rdx, str.licens.json
lea rcx, [rsp + 0x40]
call fcn.140011640
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x98]
call fcn.140006f60
nop
lea rax, [rbp - 0x48]
mov qword [rsp + 0x38], rax
lea rdx, str.password
lea rcx, [rbp - 0x48]
call fcn.140011640
mov rdi, rax
lea rdx, str.licens.json
lea rcx, [rbp - 0x68]
call fcn.140011640
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x58]
call fcn.140006f60
nop
lea rax, [rbp + 0x78]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x58]
lea rcx, [rbp + 0x78]
call fcn.140011680
mov rdi, rax
lea rdx, [rbp + 0x98]
lea rcx, [rsp + 0x40]
call fcn.140011680
nop
mov r8, rdi
mov rdx, rax
lea rcx, [0x1400af610]
call fcn.140032030
cmp byte [0x1400af840], 0
jne 0x14000f75e
lea rcx, str.licens.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x40]
call fcn.14000fd80
movzx edx, byte [rax + 0xa]
test dl, dl
je 0x14000f730
xor byte [rax], 0x35
xor byte [rax + 1], 0x36
xor byte [rax + 2], 0x37
xor byte [rax + 3], 0x38
xor byte [rax + 4], 0x39
xor byte [rax + 5], 0x3a
xor byte [rax + 6], 0x3b
xor byte [rax + 7], 0x3c
xor byte [rax + 8], 0x3d
xor byte [rax + 9], 0x3e
xor dl, 0x3f
mov byte [rax + 0xa], dl
mov rdx, rax
call fcn.140013ea0
mov rcx, rax
lea rdx, [0x1400af848]
call fcn.140014380
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movups xmm0, xmmword [0x14009d198]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [str.02_________q]
movups xmmword [rsp + 0x70], xmm1
movsd xmm0, qword [0x14009d1b8]
movsd qword [rbp - 0x80], xmm0
cmp esi, 2
jl 0x14000f89f
movdqa xmm4, xmmword [0x14009db20]
movdqa xmm3, xmmword [0x14009dbc0]
movdqa xmm5, xmmword [0x14009db40]
movdqa xmm0, xmmword [str.5555555555555555]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x64]
mov edx, dword [rsp + 0x40]
nop dword [rax + rax]
movd xmm2, ebx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [rbx + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add ebx, 8
lea rcx, [rcx + 8]
cmp ebx, 0x28
jl 0x14000f7c0
jmp 0x14000f8de
lea r8, [rsp + 0x60]
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x4d4873ed
imul ebx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul edx, eax, 0x35
add dl, bl
xor byte [r8], dl
inc ebx
lea r8, [r8 + 1]
cmp ebx, 0x28
jl 0x14000f8b0
lea rdx, [rsp + 0x60]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140013ea0
call fcn.140003000
call fcn.140002a10
call fcn.140003340
call fcn.140002a10
nop
lea rcx, [rbp + 0x58]
call fcn.1400115e0
nop
lea rcx, [rbp + 0x98]
jmp 0x14000fb9d
call fcn.140003000
call fcn.140002a10
call fcn.140003340
call fcn.140002a10
lea rcx, [rbp + 0x58]
call fcn.1400117a0
nop
lea rcx, [rbp + 0x98]
call fcn.1400117a0
nop
lea rcx, [rbp + 0x78]
call fcn.1400117a0
nop
lea rdx, str._n___Please_Enter_your_License:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140013ea0
call fcn.140003000
call fcn.140002a10
call fcn.140003340
call fcn.140002a10
lea rdx, [rbp + 0x78]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140014840
lea rdx, [rbp + 0x78]
lea rcx, [rbp - 0x68]
call fcn.140011680
mov rdx, rax
lea rcx, [0x1400af610]
call fcn.140030b70
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
cmp byte [0x1400af840], 0
je 0x14000fa1f
lea rdx, [rsp + 0x40]
call fcn.14000fd80
movzx edx, byte [rax + 0xa]
test dl, dl
je 0x14000f9f1
xor byte [rax], 0x35
xor byte [rax + 1], 0x36
xor byte [rax + 2], 0x37
xor byte [rax + 3], 0x38
xor byte [rax + 4], 0x39
xor byte [rax + 5], 0x3a
xor byte [rax + 6], 0x3b
xor byte [rax + 7], 0x3c
xor byte [rax + 8], 0x3d
xor byte [rax + 9], 0x3e
xor dl, 0x3f
mov byte [rax + 0xa], dl
mov rdx, rax
call fcn.140013ea0
mov rcx, rax
lea rdx, [0x1400af848]
call fcn.140014380
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str._n___Valid_Licens_Initilizing_Spoofing...
call fcn.140013ea0
mov ecx, 0xbb7
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [rbp + 0x68], 0
je 0x14000fad4
cmp qword [rbp + 0xa8], 0
je 0x14000fad4
lea rax, [rbp - 0x68]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x98]
lea rcx, [rbp - 0x68]
call fcn.140011680
mov r14, rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x30], rax
lea rdx, str.password
lea rcx, [rbp - 0x48]
call fcn.140011640
mov rsi, rax
lea rax, [rbp - 0x28]
mov qword [rbp - 0x78], rax
lea rdx, [rbp + 0x58]
lea rcx, [rbp - 0x28]
call fcn.140011680
mov rdi, rax
lea rax, [rbp - 8]
mov qword [rbp - 0x70], rax
lea rdx, str.username
lea rcx, [rbp - 8]
call fcn.140011640
mov rbx, rax
lea rdx, str.test.json
lea rcx, [rsp + 0x60]
call fcn.140011640
nop
mov r9b, 1
jmp 0x14000fb55
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rdx, [0x14009aab9]
lea rcx, [rsp + 0x60]
call fcn.140011640
mov r14, rax
lea rax, [rbp - 8]
mov qword [rbp - 0x70], rax
lea rdx, [0x14009aab9]
lea rcx, [rbp - 8]
call fcn.140011640
mov rsi, rax
lea rax, [rbp - 0x28]
mov qword [rbp - 0x78], rax
lea rdx, [rbp + 0x78]
lea rcx, [rbp - 0x28]
call fcn.140011680
mov rdi, rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x38], rax
lea rdx, str.license
lea rcx, [rbp - 0x68]
call fcn.140011640
mov rbx, rax
lea rdx, str.test.json
lea rcx, [rbp - 0x48]
call fcn.140011640
nop
xor r9d, r9d
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rsi
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.140007840
call fcn.140003000
call fcn.140002a10
call fcn.140003340
call fcn.140002a10
nop
lea rcx, [rbp + 0x78]
call fcn.1400115e0
nop
lea rcx, [rbp + 0x98]
call fcn.1400115e0
nop
lea rcx, [rbp + 0x58]
call fcn.1400115e0
call fcn.140003000
call fcn.140002a10
call fcn.140003340
call fcn.140002a10
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14009b3c4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, reloc.WS2_32.dll_ioctlsocket
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140013ea0
lea rdx, reloc.WS2_32.dll_ioctlsocket
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140013ea0
lea rdx, str._n_i__initilizing_Permant_Baseboard__UEFI_Changes...__Window_will_close_for_a_few_Seconds_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140013ea0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, r15
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.14000de70
call fcn.14000b360
mov edx, 5
mov rcx, r15
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [0x14009b3c4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._n_i__Saving_Permant_Baseboard__UEFI_Changes...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140013ea0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, r15
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.14000df20
mov edx, 5
mov rcx, r15
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [0x14009b3c4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._n_i__Initilizing_Permant_Mac__Nic_Changes...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140013ea0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, r15
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.14000da60
mov edx, 5
mov rcx, r15
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [0x14009b3c4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._n_i__Saving_Permant_Mac__Nic_Changes...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140013ea0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, reloc.WS2_32.dll_ioctlsocket
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140013ea0
call fcn.140003000
call fcn.140002a10
call fcn.140003340
call fcn.140002a10
lea rdx, str._n___Done_Spoofing_you_can_Restart_your_PC_now_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140013ea0
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rbp + 0xc0]
call fcn.1400115e0
xor eax, eax
mov rcx, qword [rbp + 0x118]
xor rcx, rsp
call fcn.140086b50
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop rbp
ret