Function at 0x140001520
Capabilities:
Download url
Execute command
Receive data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rbp + 0x80], rax
xor edi, edi
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [rdi + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Welcome_to_Sigma_Spoofer_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002520
lea rdx, [0x1400026f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Select_an_option:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002520
lea rdx, [0x1400026f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.1._Spoof
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002520
lea rdx, [0x1400026f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.2._Check_Serials
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002520
lea rdx, [0x1400026f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rbp + 0x40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov ecx, dword [rbp + 0x40]
sub ecx, 1
je 0x140001745
cmp ecx, 1
je 0x14000164a
lea rdx, str.Invalid_choice._Exiting_program.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140002520
lea rdx, [0x1400026f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea eax, [rdi + 1]
jmp 0x140002140
lea rcx, [0x140005b08]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo_OFF
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.TITLE_HWID_Checker
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Color_0F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.wmic_diskdrive_get_model__serialnumber
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ECHO_CPU
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.wmic_cpu_get_serialnumber
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ECHO_BIOS
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.wmic_bios_get_serialnumber
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ECHO_Motherboard
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.wmic_baseboard_get_serialnumber
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ECHO_smBIOS_UUID
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.wmic_path_win32_computersystemproduct_get_uuid
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.getmac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3a98
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor eax, eax
jmp 0x140002140
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], rax
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x70], xmm1
lea r8d, [rax + 0x34]
lea rdx, str.1189595820933263360_1209456470358495272_AMIDEWIN.bat
lea rcx, [rbp - 0x80]
call fcn.140002b20
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x50], xmm1
mov r8d, 0x36
lea rdx, str.1152639309380321340_1191764995533459527_amifldrv64.sys
lea rcx, [rbp - 0x60]
call fcn.140002b20
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x30], xmm1
mov r8d, 0x37
lea rdx, str.1152639309380321340_1191765135862268075_AMIDEWINx64.EXE
lea rcx, [rbp - 0x40]
call fcn.140002b20
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x10], xmm1
mov r8d, 0x31
lea rdx, str.1204507785547743242_1213517002908639262_RUNME.BAT
lea rcx, [rbp - 0x20]
call fcn.140002b20
nop
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x10], xmm1
mov r8d, 0x36
lea rdx, str.1148981373772767307_1213533200014512148_mac_change.bat
lea rcx, [rbp]
call fcn.140002b20
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], rdi
mov ecx, 0xa0
call fcn.1400034a0
mov r8, rax
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x50], rax
add rax, 0xa0
mov qword [rbp + 0x58], rax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x70], rax
lea r9, [rbp + 0x48]
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x80]
call fcn.1400030f0
mov qword [rbp + 0x50], rax
lea r9, [0x1400021f0]
mov edx, 0x20
lea r8d, [rdx - 0x1b]
lea rcx, [rbp - 0x80]
call fcn.1400034dc
mov r14, qword [rbp + 0x48]
mov r13, qword [rbp + 0x50]
cmp r14, r13
je 0x140001c4d
lea r12, str.C:Windows_
nop word [rax + rax]
mov r8, r14
lea rcx, [rsp + 0x30]
call fcn.140002390
mov rbx, rax
mov rsi, qword [0x140008780]
lea r9, [0x140008770]
cmp qword [0x140008788], 7
cmova r9, qword [0x140008770]
mov r15, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rax, rcx
sub rax, r15
cmp rsi, rax
ja 0x140001907
lea rax, [r15 + rsi]
mov qword [rbx + 0x10], rax
mov r12, rbx
cmp rcx, 7
jbe 0x1400018e5
mov r12, qword [rbx]
lea rcx, [r12 + r15*2]
lea r8, [rsi + rsi]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [rsi + r15]
mov word [r12 + rax*2], di
lea r12, str.C:Windows_
jmp 0x14000191a
mov qword [rsp + 0x20], rsi
mov rdx, rsi
mov rcx, rbx
call fcn.140002950
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0x38], rdi
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140001989
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001984
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001d58
call fcn.1400037ec
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], di
mov r8, qword [r14 + 0x10]
mov rdx, r14
mov r9, qword [r14 + 0x18]
cmp r9, 7
jbe 0x1400019b0
mov rdx, qword [r14]
test r8, r8
je 0x1400019e8
lea rcx, [r8 - 1]
mov rax, 0xffffffffffffffff
cmp rcx, rax
cmovb rax, rcx
lea rax, [rdx + rax*2]
cmp word [rax], 0x2f
je 0x1400019e0
cmp rax, rdx
je 0x1400019e8
sub rax, 2
cmp word [rax], 0x2f
jne 0x1400019d1
sub rax, rdx
sar rax, 1
jmp 0x1400019ef
mov rax, 0xffffffffffffffff
inc rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
cmp r8, rax
jb 0x140002170
sub r8, rax
mov rcx, 0xffffffffffffffff
cmp r8, rcx
cmovb rcx, r8
mov rdx, r14
cmp r9, 7
jbe 0x140001a2a
mov rdx, qword [r14]
lea rdx, [rdx + rax*2]
mov r8, rcx
lea rcx, [rsp + 0x50]
call fcn.140002b20
nop
mov r8, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
sub rax, r8
cmp rax, 0xb
jb 0x140001ae2
lea rax, [r8 + 0xb]
mov qword [rsp + 0x60], rax
lea rsi, [rsp + 0x50]
cmp rcx, 7
cmova rsi, qword [rsp + 0x50]
lea rax, [0x140005886]
cmp rax, rsi
jbe 0x140001a98
lea rax, [rsi + r8*2]
cmp r12, rax
ja 0x140001a98
cmp rsi, r12
ja 0x140001a8d
mov rbx, rdi
jmp 0x140001a9d
mov rbx, rsi
sub rbx, r12
sar rbx, 1
jmp 0x140001a9d
mov ebx, 0xb
lea rcx, [rsi + 0x16]
lea r8, [r8*2 + 2]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memmove
add rbx, rbx
mov r8, rbx
mov rdx, r12
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rsi]
mov r8d, 0x16
sub r8, rbx
lea rdx, [rbx + 0x16]
add rdx, r12
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x50]
jmp 0x140001afa
mov qword [rsp + 0x28], 0xb
mov edx, 0xb
lea rcx, [rsp + 0x50]
call fcn.1400032b0
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], rdi
mov qword [rbp + 0x78], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x70], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x140001b69
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001b64
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001d5f
call fcn.1400037ec
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], di
lea r8, [rbp + 0x60]
cmp qword [rbp + 0x78], 7
cmova r8, qword [rbp + 0x60]
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 7
cmova rdx, qword [rbp + 0x20]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
js 0x140001d66
mov rdx, qword [rbp + 0x78]
cmp rdx, 7
jbe 0x140001bf0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001beb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001ddb
call fcn.1400037ec
mov qword [rbp + 0x70], rdi
mov qword [rbp + 0x78], 7
mov word [rbp + 0x60], di
mov rdx, qword [rbp + 0x38]
cmp rdx, 7
jbe 0x140001c40
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c3b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001e2e
call fcn.1400037ec
add r14, 0x20
cmp r14, r13
jne 0x140001890
lea rdx, str.Spoof_files_downloaded_successfully_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140002730
lea rdx, [0x140002910]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.SPOOFING__If_you_want_to_unban_from_Fortnite_or_other_games__fully_reset_your_PC_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140002730
lea rdx, [0x140002910]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_wchar_t__struct_std::char_traits_wchar_t___std::wcin]
call qword [sym.imp.MSVCP140.dll_public:_unsigned_short_int___cdecl_std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__::get_void____ptr64]
mov edx, 0x12c
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Beep]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, 0xa
lea rdx, str.C:Windows
lea rcx, [rsp + 0x30]
call fcn.140002b20
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x30], xmm1
mov r8d, 0x17
lea rdx, str.C:WindowsAMIDEWIN.bat
lea rcx, [rbp + 0x20]
call fcn.140002b20
nop
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x20]
call fcn.140001220
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 7
jbe 0x140001e62
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e5d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e5d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rdx, str.Error_downloading_spoof_file_from
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140002730
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 7
cmova rdx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x30]
mov rcx, rax
call fcn.140002f20
lea rdx, [0x140002910]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 7
jbe 0x140001de7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001de2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001de2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400037ec
mov qword [rbp + 0x70], rdi
mov qword [rbp + 0x78], 7
mov word [rbp + 0x60], di
mov rdx, qword [rbp + 0x38]
cmp rdx, 7
jbe 0x140001e3a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e35
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e35
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400037ec
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edi, 1
jmp 0x1400020f0
call fcn.1400037ec
movdqa xmm0, xmmword [0x140005cc0]
movdqu xmmword [rbp + 0x30], xmm0
mov word [rbp + 0x20], di
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140001eb8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001eb3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001eb3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400037ec
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, 0xa
lea rdx, str.C:Windows
lea rcx, [rsp + 0x30]
call fcn.140002b20
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x30], xmm1
mov r8d, 0x14
lea rdx, str.C:WindowsRUNME.bat
lea rcx, [rbp + 0x20]
call fcn.140002b20
nop
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x20]
call fcn.140001220
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 7
jbe 0x140001f59
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001f54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001f54
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400037ec
movdqa xmm0, xmmword [0x140005cc0]
movdqu xmmword [rbp + 0x30], xmm0
mov word [rbp + 0x20], di
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140001faf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001faa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001faa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400037ec
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, 0xa
lea rdx, str.C:Windows
lea rcx, [rsp + 0x30]
call fcn.140002b20
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x30], xmm1
mov r8d, 0x19
lea rdx, str.C:WindowsMAC_CHANGE.bat
lea rcx, [rbp + 0x20]
call fcn.140002b20
nop
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x20]
call fcn.140001220
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 7
jbe 0x140002050
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000204b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000204b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400037ec
movdqa xmm0, xmmword [0x140005cc0]
movdqu xmmword [rbp + 0x30], xmm0
mov word [rbp + 0x20], di
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x1400020a6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400020a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400020a1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400037ec
lea rdx, str.PLEASE_RESTART_PC___AND_CHECK_SERIALS__PRESS_ENTER_TO_CLOSE
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140002730
lea rdx, [0x140002910]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_wchar_t__struct_std::char_traits_wchar_t___std::wcin]
call qword [sym.imp.MSVCP140.dll_public:_unsigned_short_int___cdecl_std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__::get_void____ptr64]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14000213e
mov rdx, qword [rbp + 0x50]
call fcn.140002c60
mov rdx, qword [rbp + 0x58]
mov rcx, qword [rbp + 0x48]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002139
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002139
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400037ec
mov eax, edi
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140003480
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140002330
nop
int3