Function at 0x140061d50
Capabilities:
Create thread
Delete registry value
Get token membership
Manipulate console buffer
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [0x1401a7b78], rax
mov edx, 0xb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
mov ecx, eax
mov edx, 0x20000
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__setmode]
lea rdx, [0x14010fe40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400677d0
lea rdx, [0x1400679b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [0x14010fec0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400677d0
lea rdx, [0x1400679b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [0x14010ff40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400677d0
lea rdx, [0x1400679b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [0x14010ffc0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400677d0
lea rdx, [0x1400679b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [0x140110040]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400677d0
lea rdx, [0x1400679b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [0x1401100c0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400677d0
lea rdx, [0x1400679b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
mov ecx, eax
mov edx, 0x4000
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__setmode]
xor r13d, r13d
mov dword [rbp + 0xc0], r13d
mov dword [rbp + 0xc8], r13d
mov word [rbp + 0xcc], 0x500
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
mov r9d, 0x220
lea r8d, [r13 + 0x20]
mov dl, 2
lea rcx, [rbp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140061f2f
lea r8, [rbp + 0xc0]
mov rdx, qword [rbp + 0xd0]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x140061f22
mov dword [rbp + 0xc0], r13d
mov rcx, qword [rbp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
cmp dword [rbp + 0xc0], r13d
jne 0x140061fe4
lea rdx, str.Need_administrator_privileges__Please_open_as_admin.
call fcn.1400675e0
lea rdx, [0x1400679f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rdi, 0x989680
jne 0x140061f7d
imul rax, rax, 0x64
jmp 0x140061f9b
cqo
idiv rdi
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
imul rcx, rcx, 0x3b9aca00
add rax, rcx
movabs rcx, 0x7fffffff4d2fa1fe
cmp rax, rcx
jg 0x140061fbb
mov ecx, 0xb2d05e00
add rcx, rax
mov qword [rbp + 0xc0], rcx
jmp 0x140061fcc
movabs rax, 0x7fffffffffffffff
mov qword [rbp + 0xc0], rax
lea rcx, [rbp + 0xc0]
call fcn.14004d5b0
mov byte [0x1401a5630], r13b
jmp 0x1400633e7
lea rdx, str.Loading...
call fcn.1400675e0
lea rdx, [0x1400679f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140110180]
lea rcx, [rbp - 0x40]
call fcn.1400673a0
lea rdx, str.SOFTWARESLTOOLS
lea rcx, [rbp - 0x80]
call fcn.1400673a0
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x80]
lea rcx, [rbp + 0x60]
call fcn.140069900
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x14006206d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062068
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400620b5
call fcn.1400dfa20
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r13w
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x1400620c1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400620bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400620bc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400dfa20
lea rdx, str.Username
lea rcx, [rbp - 0x40]
call fcn.1400673a0
lea rdx, str.SOFTWARESLTOOLS
lea rcx, [rbp - 0x80]
call fcn.1400673a0
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x80]
lea rcx, [rbp + 0x20]
call fcn.140069900
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x14006212e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062129
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062176
call fcn.1400dfa20
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r13w
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x140062182
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006217d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006217d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400dfa20
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov r14, r13
mov qword [rbp + 0x10], r13
mov esi, 0xf
mov qword [rbp + 0x18], rsi
mov byte [rbp], r13b
call fcn.140061940
cmp qword [rbp + 0x70], r13
je 0x14006224b
cmp qword [rbp + 0x30], r13
je 0x14006224b
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x40]
call fcn.140068760
lea rcx, [rbp]
cmp rcx, rax
je 0x1400621fd
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], rsi
mov byte [rax], r13b
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rsi, xmm0
movq r14, xmm1
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x14006223b
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062236
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140062236
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400dfa20
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], 0xf
mov byte [rbp + 0x40], r13b
lea rcx, [rbp]
cmp rsi, 0x10
setae r12b
mov rbx, qword [rbp]
cmovae rcx, rbx
mov r15d, 6
cmp r14, 4
jne 0x140062282
mov r8, r14
lea rdx, str.true
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140062d21
mov dword [rbp + 0xc0], 0x60000
mov edx, dword [rbp + 0xc0]
mov rcx, qword [0x1401a7b78]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea rdx, [0x14010fd60]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400675e0
lea rdx, [0x1400677b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, dword [rbp + 0xc0]
mov rcx, qword [0x1401a7b78]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea rdx, str.Please_enter_your_activation_Key:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400675e0
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], r13b
lea rdx, [rbp - 0x20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140067a30
mov dword [rbp + 0xc0], 0x60000
mov edx, dword [rbp + 0xc0]
mov rcx, qword [0x1401a7b78]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea rdx, [0x14010fd60]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400675e0
lea rdx, [0x1400677b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, dword [rbp + 0xc0]
mov rcx, qword [0x1401a7b78]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea rdx, str.Please_enter_your_username:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400675e0
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], r13b
lea rdx, [rbp - 0x60]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140067a30
mov dword [rbp + 0xc0], 0x60000
mov edx, dword [rbp + 0xc0]
mov rcx, qword [0x1401a7b78]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea rdx, [0x14010fd60]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400675e0
lea rdx, [0x1400677b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, dword [rbp + 0xc0]
mov rcx, qword [0x1401a7b78]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea rdx, str.Loading...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400675e0
lea rdx, [0x1400679f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140110180]
lea rcx, [rbp - 0x40]
call fcn.1400673a0
lea rdx, str.SOFTWARESLTOOLS
lea rcx, [rbp - 0x80]
call fcn.1400673a0
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400624b2
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
mov qword [rsp + 0x40], r13
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14006255c
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r13
mov edx, 7
mov qword [rsp + 0x78], rdx
mov word [rsp + 0x60], r13w
cmp qword [rbp - 0x10], r13
je 0x1400626ba
lea r8, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae r8, qword [rbp - 0x20]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor edx, edx
mov ecx, 0xfde9
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd r15, eax
test eax, eax
jne 0x1400625f3
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14006255c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062557
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006274e
call fcn.1400dfa20
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140062598
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062593
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400625ec
call fcn.1400dfa20
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r13w
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x14006275a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062755
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140062755
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r15
mov r8, qword [rsp + 0x70]
cmp r15, r8
ja 0x14006261d
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rax, qword [rsp + 0x60]
mov qword [rsp + 0x70], rdx
mov word [rax + r15*2], r13w
jmp 0x140062673
sub rdx, r8
mov rcx, qword [rsp + 0x78]
mov rax, rcx
sub rax, r8
cmp rdx, rax
ja 0x140062666
lea rax, [r8 + rdx]
mov qword [rsp + 0x70], rax
lea r9, [rsp + 0x60]
cmp rcx, 8
cmovae r9, qword [rsp + 0x60]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x14006265b
movzx eax, r13w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], r13w
jmp 0x140062673
mov r9, rdx
lea rcx, [rsp + 0x60]
call fcn.14006acf0
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rax, qword [rsp + 0x60]
lea r8, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae r8, qword [rbp - 0x20]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x14006250d
mov rdx, qword [rsp + 0x78]
mov eax, dword [rsp + 0x70]
add eax, eax
lea rcx, [rsp + 0x60]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x60]
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rdx, qword [rbp - 0x40]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14006255c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062557
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140062557
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400dfa20
lea rdx, str.Username
lea rcx, [rbp - 0x40]
call fcn.1400673a0
lea rdx, str.SOFTWARESLTOOLS
lea rcx, [rbp - 0x80]
call fcn.1400673a0
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400627fa
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
mov qword [rsp + 0x40], r13
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400628a4
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r13
mov edx, 7
mov qword [rsp + 0x78], rdx
mov word [rsp + 0x60], r13w
cmp qword [rbp - 0x50], r13
je 0x140062a02
lea r8, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae r8, qword [rbp - 0x60]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor edx, edx
mov ecx, 0xfde9
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd r15, eax
test eax, eax
jne 0x14006293b
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x1400628a4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006289f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062a96
call fcn.1400dfa20
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x1400628e0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400628db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062934
call fcn.1400dfa20
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r13w
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x140062aa2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062a9d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140062a9d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r15
mov r8, qword [rsp + 0x70]
cmp r15, r8
ja 0x140062965
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rax, qword [rsp + 0x60]
mov qword [rsp + 0x70], rdx
mov word [rax + r15*2], r13w
jmp 0x1400629bb
sub rdx, r8
mov rcx, qword [rsp + 0x78]
mov rax, rcx
sub rax, r8
cmp rdx, rax
ja 0x1400629ae
lea rax, [r8 + rdx]
mov qword [rsp + 0x70], rax
lea r9, [rsp + 0x60]
cmp rcx, 8
cmovae r9, qword [rsp + 0x60]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x1400629a3
movzx eax, r13w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], r13w
jmp 0x1400629bb
mov r9, rdx
lea rcx, [rsp + 0x60]
call fcn.14006acf0
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rax, qword [rsp + 0x60]
lea r8, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae r8, qword [rbp - 0x60]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x140062855
mov rdx, qword [rsp + 0x78]
mov eax, dword [rsp + 0x70]
add eax, eax
lea rcx, [rsp + 0x60]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x60]
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rdx, qword [rbp - 0x40]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x1400628a4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006289f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006289f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400dfa20
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x40]
call fcn.140068760
mov rdi, rax
lea rax, [rbp]
cmp rax, rdi
je 0x140062b27
test r12b, r12b
je 0x140062af1
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140062ae9
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062b59
mov rcx, rbx
call fcn.1400dfa20
movups xmm2, xmmword [rdi]
movups xmmword [rbp], xmm2
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 0xf
mov byte [rdi], r13b
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rsi, xmm0
movq r14, xmm1
movq rbx, xmm2
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x140062b65
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062b60
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140062b60
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400dfa20
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], r13b
lea rcx, [rbp]
cmp rsi, 0x10
setae r15b
cmovae rcx, rbx
cmp r14, 8
jne 0x140062c86
mov r8, r14
lea rdx, str.mismatch
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140062c86
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x20]
call fcn.140069230
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x80]
call fcn.140068760
mov rdi, rax
lea rax, [rbp]
cmp rax, rdi
je 0x140062c38
test r15b, r15b
je 0x140062c02
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140062bfa
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062c6a
mov rcx, rbx
call fcn.1400dfa20
movups xmm2, xmmword [rdi]
movups xmmword [rbp], xmm2
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 0xf
mov byte [rdi], r13b
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rsi, xmm0
movq r14, xmm1
movq rbx, xmm2
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x140062c76
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062c71
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140062c71
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400dfa20
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], r13b
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140062cbd
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062cb8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062cff
call fcn.1400dfa20
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], r13b
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140062d0b
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062d06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140062d06
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400dfa20
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], r13b
mov r15d, 6
lea rcx, [rbp]
cmp rsi, 0x10
cmovae rcx, rbx
cmp r14, 4
jne 0x1400634d2
mov r8, r14
lea rdx, str.true
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400634d2
lea rdx, str.Username
lea rcx, [rbp + 0x40]
call fcn.1400673a0
lea rdx, str.SOFTWARESLTOOLS
lea rcx, [rbp - 0x80]
call fcn.1400673a0
lea r9, [rbp + 0x40]
lea r8, [rbp - 0x80]
lea rcx, [rbp - 0x40]
call fcn.140069900
mov rdi, rax
lea r14, [0x1401a5958]
cmp r14, rax
je 0x140062e0c
mov rdx, qword [0x1401a5970]
cmp rdx, 0x10
jb 0x140062dcf
mov rcx, qword [0x1401a5958]
inc rdx
cmp rdx, 0x1000
jb 0x140062dca
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140062edb
mov rcx, r8
call fcn.1400dfa20
mov qword [0x1401a5968], r13
mov qword [0x1401a5970], 0xf
mov byte [0x1401a5958], r13b
movups xmm0, xmmword [rdi]
movups xmmword [0x1401a5958], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [0x1401a5968], xmm1
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 0xf
mov byte [rdi], r13b
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x140062e47
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062e42
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062edb
call fcn.1400dfa20
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], r13b
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140062e93
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062e8e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062edb
call fcn.1400dfa20
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r13w
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x140062ee7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062ee2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140062ee2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400dfa20
lea rdx, str.Welcome_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400675e0
cmp qword [0x1401a5970], 0x10
cmovae r14, qword [0x1401a5958]
mov r8, qword [0x1401a5968]
mov rdx, r14
mov rcx, rax
call fcn.140067d30
lea rdx, [0x140110234]
mov rcx, rax
call fcn.1400675e0
lea rdx, [0x1400679f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rdi, 0x989680
jne 0x140062f59
imul rax, rax, 0x64
jmp 0x140062f74
cqo
idiv rdi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
add rax, rcx
movabs rcx, 0x7fffffffa697d0ff
cmp rax, rcx
jge 0x140062f8b
add rax, 0x59682f00
jmp 0x140062f95
movabs rax, 0x7fffffffffffffff
mov qword [rbp + 0xc0], rax
lea rcx, [rbp + 0xc0]
call fcn.14004d5b0
mov byte [0x1401a7460], 1
mov ecx, 8
call fcn.1400df6bc
lea rcx, [0x1400640f0]
mov qword [rax], rcx
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x1400682a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x60], rax
test rax, rax
je 0x1400634c4
cmp dword [rbp - 0x58], r13d
je 0x1400634b8
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400634b8
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x60], xmm0
lea ecx, [rax + 8]
call fcn.1400df6bc
lea rcx, [0x140064780]
mov qword [rax], rcx
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x1400682a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x60], rax
test rax, rax
je 0x1400634aa
cmp dword [rbp - 0x58], r13d
je 0x14006349e
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14006349e
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x60], xmm0
lea ecx, [rax + 8]
call fcn.1400df6bc
lea rcx, [0x140065150]
mov qword [rax], rcx
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x1400682a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x60], rax
test rax, rax
je 0x140063490
cmp dword [rbp - 0x58], r13d
je 0x140063484
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140063484
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x60], xmm0
lea ecx, [rax + 8]
call fcn.1400df6bc
lea rcx, [0x140065320]
mov qword [rax], rcx
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x1400682a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x60], rax
test rax, rax
je 0x140063476
cmp dword [rbp - 0x58], r13d
je 0x14006346a
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14006346a
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x60], xmm0
lea ecx, [rax + 8]
call fcn.1400df6bc
lea rcx, [0x140066770]
mov qword [rax], rcx
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x1400682a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x60], rax
test rax, rax
je 0x14006345c
cmp dword [rbp - 0x58], r13d
je 0x140063450
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140063450
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x60], xmm0
lea ecx, [rax + 8]
call fcn.1400df6bc
lea rcx, [0x140066ae0]
mov qword [rax], rcx
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x1400682a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x60], rax
test rax, rax
je 0x140063442
cmp dword [rbp - 0x58], r13d
je 0x140063436
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140063436
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x60], xmm0
lea ecx, [rax + 8]
call fcn.1400df6bc
lea rcx, [0x140066df0]
mov qword [rax], rcx
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x1400682a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x60], rax
test rax, rax
je 0x140063428
cmp dword [rbp - 0x58], r13d
je 0x14006341c
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14006341c
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x60], xmm0
lea ecx, [rax + 8]
call fcn.1400df6bc
lea rcx, [0x140066fe0]
mov qword [rax], rcx
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x1400682a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x60], rax
test rax, rax
je 0x14006340e
cmp dword [rbp - 0x58], r13d
je 0x140063402
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140063402
cmp rsi, 0x10
jb 0x140063360
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140063358
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006389c
mov rcx, rbx
call fcn.1400dfa20
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x14006339b
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140063396
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006389c
call fcn.1400dfa20
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 0xf
mov byte [rbp + 0x20], r13b
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x1400633e7
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400633e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006389c
call fcn.1400dfa20
nop
mov rbx, qword [rsp + 0x1d8]
add rsp, 0x180
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp - 0x58], r13d
mov ecx, r15d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp - 0x58], r13d
mov ecx, r15d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp - 0x58], r13d
mov ecx, r15d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp - 0x58], r13d
mov ecx, r15d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp - 0x58], r13d
mov ecx, r15d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp - 0x58], r13d
mov ecx, r15d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp - 0x58], r13d
mov ecx, r15d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp - 0x58], r13d
mov ecx, r15d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp + 0xc0], 0x60000
mov edx, dword [rbp + 0xc0]
mov rcx, qword [0x1401a7b78]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea rdx, [0x14010fd60]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400675e0
lea rdx, [0x1400677b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, dword [rbp + 0xc0]
mov rcx, qword [0x1401a7b78]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea rdx, str.Invalid_license_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400675e0
lea rdx, [0x1400679f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rdi, 0x989680
jne 0x140063566
imul rax, rax, 0x64
jmp 0x140063584
cqo
idiv rdi
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
imul rcx, rcx, 0x3b9aca00
add rax, rcx
movabs rcx, 0x7fffffff4d2fa1fe
cmp rax, rcx
jg 0x1400635a4
mov ecx, 0xb2d05e00
add rcx, rax
mov qword [rbp + 0xc0], rcx
jmp 0x1400635b5
movabs rax, 0x7fffffffffffffff
mov qword [rbp + 0xc0], rax
lea rcx, [rbp + 0xc0]
call fcn.14004d5b0
lea rdx, [0x140110180]
lea rcx, [rbp - 0x40]
call fcn.1400673a0
lea rdx, str.SOFTWARESLTOOLS
lea rcx, [rbp - 0x80]
call fcn.1400673a0
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006363d
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rdx, qword [rbp - 0x40]
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140063679
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140063674
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400636c1
call fcn.1400dfa20
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r13w
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x1400636cd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400636c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400636c8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400dfa20
lea rdx, str.Username
lea rcx, [rbp - 0x40]
call fcn.1400673a0
lea rdx, str.SOFTWARESLTOOLS
lea rcx, [rbp - 0x80]
call fcn.1400673a0
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140063749
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rdx, qword [rbp - 0x40]
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140063785
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140063780
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400637cd
call fcn.1400dfa20
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r13w
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x1400637d9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400637d4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400637d4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400dfa20
mov byte [0x1401a5630], r13b
cmp rsi, 0x10
jb 0x140063817
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14006380f
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006389c
mov rcx, rbx
call fcn.1400dfa20
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x14006384e
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140063849
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006389c
call fcn.1400dfa20
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 0xf
mov byte [rbp + 0x20], r13b
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x1400633e7
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400633e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400633e1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3