Function at 0x14008f7f0
Capabilities:
Create thread
Delete registry value
Get token membership
Manipulate console buffer
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [0x1401f9b30], rax
mov edx, 0xb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
mov ecx, eax
mov edx, 0x20000
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__setmode]
lea rdx, [0x140141c70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140095800
lea rdx, [0x1400959d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [0x140141cf0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140095800
lea rdx, [0x1400959d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [0x140141d70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140095800
lea rdx, [0x1400959d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [0x140141df0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140095800
lea rdx, [0x1400959d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [0x140141e70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140095800
lea rdx, [0x1400959d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [0x140141ef0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140095800
lea rdx, [0x1400959d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
mov ecx, eax
mov edx, 0x4000
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__setmode]
xor r13d, r13d
mov dword [rbp + 0x160], r13d
mov dword [rbp + 0x168], r13d
mov word [rbp + 0x16c], 0x500
lea rax, [rbp + 0x170]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
mov r9d, 0x220
lea r8d, [r13 + 0x20]
mov dl, 2
lea rcx, [rbp + 0x168]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14008f9d2
lea r8, [rbp + 0x160]
mov rdx, qword [rbp + 0x170]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x14008f9c5
mov dword [rbp + 0x160], r13d
mov rcx, qword [rbp + 0x170]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
cmp dword [rbp + 0x160], r13d
jne 0x14008fa5a
lea rdx, str.Need_administrator_privileges__Please_open_as_admin.
call fcn.140095610
lea rdx, [0x140087990]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x160]
call fcn.1400647a0
movabs rcx, 0x7fffffff4d2fa1fe
mov rax, qword [rbp + 0x160]
cmp rax, rcx
jg 0x14008fa31
mov ecx, 0xb2d05e00
add rcx, rax
mov qword [rbp + 0x160], rcx
jmp 0x14008fa42
movabs rax, 0x7fffffffffffffff
mov qword [rbp + 0x160], rax
lea rcx, [rbp + 0x160]
call fcn.140066e60
mov byte [0x1401f74ec], r13b
jmp 0x140090fa4
lea rdx, str.Loading...
call fcn.140095610
lea rdx, [0x140087990]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x1401f74a0]
lea rcx, [rbp + 0x20]
call fcn.1400539a0
lea rax, [rbp + 0x20]
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x14008faa3
mov r9, rcx
mov rax, rcx
mov rdi, rcx
jmp 0x14008faaa
mov rdi, rax
lea r9, [rbp + 0x20]
mov r8, qword [rbp + 0x30]
lea rbx, [r9 + r8]
cmp rax, rbx
je 0x14008fad6
movsx ecx, byte [rdi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov byte [rdi], al
inc rdi
cmp rdi, rbx
jne 0x14008fab7
mov rdx, qword [rbp + 0x38]
mov r8, qword [rbp + 0x30]
mov rcx, qword [rbp + 0x20]
mov rax, rdx
sub rax, r8
mov r14d, 0x11
lea rsi, str.SOFTWARESLTOOLS_
cmp rax, r14
jb 0x14008fb65
lea rax, [r8 + 0x11]
mov qword [rbp + 0x30], rax
lea rdi, [rbp + 0x20]
cmp rdx, 0xf
cmova rdi, rcx
lea rax, [0x140141fc1]
cmp rax, rdi
jbe 0x14008fb29
lea rax, [rdi + r8]
cmp rsi, rax
ja 0x14008fb29
cmp rdi, rsi
ja 0x14008fb21
mov rbx, r13
jmp 0x14008fb2c
mov rbx, rdi
sub rbx, rsi
jmp 0x14008fb2c
mov rbx, r14
inc r8
lea rcx, [rdi + 0x11]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
sub r14, rbx
lea rdx, [rsi + 0x11]
add rdx, rbx
lea rcx, [rdi + rbx]
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x20]
jmp 0x14008fb7e
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov rdx, r14
lea rcx, [rbp + 0x20]
call fcn.14004ea70
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], r13
mov qword [rbp + 0x98], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x90], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], r13b
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x14008fbf8
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008fbf3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008fbf3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010bacc
lea rcx, [rbp + 0xa0]
call fcn.14009ab90
lea r8, [rbp + 0x80]
cmp qword [rbp + 0x98], 0xf
cmova r8, qword [rbp + 0x80]
mov r9, qword [rbp + 0x90]
add r9, r8
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0xa0]
call fcn.14009ae20
lea rcx, [rbp + 0xa0]
call fcn.14009aaa0
lea rdx, [0x140141fc8]
lea rcx, [rbp - 0x60]
call fcn.140094f90
lea r9, [rbp - 0x60]
lea r8, [rbp - 0x40]
lea rcx, [rbp + 0x60]
call fcn.140098ad0
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x14008fca5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008fca0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008fca0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010bacc
lea rdx, str.Username
lea rcx, [rsp + 0x60]
call fcn.140094f90
lea r9, [rsp + 0x60]
lea r8, [rbp - 0x40]
lea rcx, [rbp + 0x40]
call fcn.140098ad0
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14008fd0d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008fd08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008fd08
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010bacc
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r13w
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov r14, r13
mov qword [rbp + 0x10], r13
mov esi, 0xf
mov qword [rbp + 0x18], rsi
mov byte [rbp], r13b
cmp qword [rbp + 0x70], r13
je 0x14008fde5
cmp qword [rbp + 0x50], r13
je 0x14008fde5
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x60]
lea rcx, [rbp - 0x60]
call fcn.140097bf0
lea rcx, [rbp]
cmp rcx, rax
je 0x14008fd97
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], rsi
mov byte [rax], r13b
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rsi, xmm0
movq r14, xmm1
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x14008fdd5
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008fdd0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008fdd0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010bacc
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], r13b
lea rcx, [rbp]
cmp rsi, 0xf
seta r12b
mov rbx, qword [rbp]
cmova rcx, rbx
mov r15d, 6
cmp r14, 4
jne 0x14008fe1c
mov r8, r14
lea rdx, str.true
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400907d8
mov dword [rbp + 0x160], 0x60000
mov edx, dword [rbp + 0x160]
mov rcx, qword [0x1401f9b30]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea rdx, [0x140141b90]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140095610
lea rdx, [0x1400957e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, dword [rbp + 0x160]
mov rcx, qword [0x1401f9b30]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
nop
lea rdx, str.Please_enter_your_activation_Key:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140095610
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], 0
lea rdx, [rbp - 0x20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140095a10
nop
mov dword [rbp + 0x160], 0x60000
mov edx, dword [rbp + 0x160]
mov rcx, qword [0x1401f9b30]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea rdx, [0x140141b90]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140095610
lea rdx, [0x1400957e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, dword [rbp + 0x160]
mov rcx, qword [0x1401f9b30]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
nop
lea rdx, str.Please_enter_your_username:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140095610
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
lea rdx, [rbp - 0x80]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140095a10
nop
mov dword [rbp + 0x160], 0x60000
mov edx, dword [rbp + 0x160]
mov rcx, qword [0x1401f9b30]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea rdx, [0x140141b90]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140095610
lea rdx, [0x1400957e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, dword [rbp + 0x160]
mov rcx, qword [0x1401f9b30]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
nop
lea rdx, str.Loading...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140095610
lea rdx, [0x140087990]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140141fc8]
lea rcx, [rbp - 0x60]
call fcn.140094f90
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 7
cmova rdx, qword [rbp - 0x40]
lea rax, [rbp + 0x160]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140090041
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 7
cmova rdx, qword [rbp - 0x40]
mov qword [rsp + 0x40], r13
lea rax, [rbp + 0x160]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400900ec
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r13
mov edx, 7
mov qword [rsp + 0x78], rdx
mov word [rsp + 0x60], r13w
cmp qword [rbp - 0x10], 0
je 0x1400901fd
lea r8, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova r8, qword [rbp - 0x20]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor edx, edx
mov ecx, 0xfde9
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd r15, eax
test eax, eax
jne 0x140090136
mov rcx, qword [rbp + 0x160]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x1400900ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400900e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140090291
call fcn.14010bacc
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x14009029d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140090298
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140090298
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r15
mov r8, qword [rsp + 0x70]
cmp r15, r8
ja 0x140090160
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rax, qword [rsp + 0x60]
mov qword [rsp + 0x70], rdx
mov word [rax + r15*2], r13w
jmp 0x1400901b6
sub rdx, r8
mov rcx, qword [rsp + 0x78]
mov rax, rcx
sub rax, r8
cmp rdx, rax
ja 0x1400901a9
lea rax, [r8 + rdx]
mov qword [rsp + 0x70], rax
lea r9, [rsp + 0x60]
cmp rcx, 7
cmova r9, qword [rsp + 0x60]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x14009019e
movzx eax, r13w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], r13w
jmp 0x1400901b6
mov r9, rdx
lea rcx, [rsp + 0x60]
call fcn.140096080
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rax, qword [rsp + 0x60]
lea r8, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova r8, qword [rbp - 0x20]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x14009009d
mov rdx, qword [rsp + 0x78]
mov eax, dword [rsp + 0x70]
add eax, eax
lea rcx, [rsp + 0x60]
cmp rdx, 7
cmova rcx, qword [rsp + 0x60]
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova rdx, qword [rbp - 0x60]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rbp + 0x160]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x160]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x1400900ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400900e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400900e7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010bacc
lea rdx, str.Username
lea rcx, [rbp - 0x60]
call fcn.140094f90
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 7
cmova rdx, qword [rbp - 0x40]
lea rax, [rbp + 0x160]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14009032d
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 7
cmova rdx, qword [rbp - 0x40]
mov qword [rsp + 0x40], r13
lea rax, [rbp + 0x160]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400903d8
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r13
mov edx, 7
mov qword [rsp + 0x78], rdx
mov word [rsp + 0x60], r13w
cmp qword [rbp - 0x70], 0
je 0x1400904e9
lea r8, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova r8, qword [rbp - 0x80]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor edx, edx
mov ecx, 0xfde9
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd r15, eax
test eax, eax
jne 0x140090422
mov rcx, qword [rbp + 0x160]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x1400903d8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400903d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009057d
call fcn.14010bacc
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x140090589
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140090584
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140090584
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r15
mov r8, qword [rsp + 0x70]
cmp r15, r8
ja 0x14009044c
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rax, qword [rsp + 0x60]
mov qword [rsp + 0x70], rdx
mov word [rax + r15*2], r13w
jmp 0x1400904a2
sub rdx, r8
mov rcx, qword [rsp + 0x78]
mov rax, rcx
sub rax, r8
cmp rdx, rax
ja 0x140090495
lea rax, [r8 + rdx]
mov qword [rsp + 0x70], rax
lea r9, [rsp + 0x60]
cmp rcx, 7
cmova r9, qword [rsp + 0x60]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x14009048a
movzx eax, r13w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], r13w
jmp 0x1400904a2
mov r9, rdx
lea rcx, [rsp + 0x60]
call fcn.140096080
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rax, qword [rsp + 0x60]
lea r8, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova r8, qword [rbp - 0x80]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x140090389
mov rdx, qword [rsp + 0x78]
mov eax, dword [rsp + 0x70]
add eax, eax
lea rcx, [rsp + 0x60]
cmp rdx, 7
cmova rcx, qword [rsp + 0x60]
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova rdx, qword [rbp - 0x60]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rbp + 0x160]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x160]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x1400903d8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400903d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400903d3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010bacc
lea r8, [rbp - 0x80]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x60]
call fcn.140097bf0
mov rdi, rax
lea rax, [rbp]
cmp rax, rdi
je 0x14009060e
test r12b, r12b
je 0x1400905d8
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400905d0
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140090640
mov rcx, rbx
call fcn.14010bacc
movups xmm2, xmmword [rdi]
movups xmmword [rbp], xmm2
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rsi, xmm0
movq r14, xmm1
movq rbx, xmm2
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x14009064c
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140090647
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140090647
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010bacc
lea rcx, [rbp]
cmp rsi, 0xf
seta r15b
cmova rcx, rbx
cmp r14, 8
jne 0x14009074d
mov r8, r14
lea rdx, str.mismatch
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14009074d
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x20]
call fcn.1400984b0
lea r8, [rbp - 0x80]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x60]
call fcn.140097bf0
mov rdi, rax
lea rax, [rbp]
cmp rax, rdi
je 0x14009070f
test r15b, r15b
je 0x1400906d9
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400906d1
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140090741
mov rcx, rbx
call fcn.14010bacc
movups xmm2, xmmword [rdi]
movups xmmword [rbp], xmm2
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rsi, xmm0
movq r14, xmm1
movq rbx, xmm2
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x14009074d
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140090748
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140090748
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010bacc
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140090784
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009077f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400907c6
call fcn.14010bacc
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x1400907d2
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400907cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400907cd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010bacc
mov r15d, 6
call fcn.14008f3d0
lea rcx, [rbp]
cmp rsi, 0xf
cmova rcx, rbx
cmp r14, 4
jne 0x1400910a9
mov r8, r14
lea rdx, str.true
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400910a9
lea rdx, str.Username
lea rcx, [rbp - 0x20]
call fcn.140094f90
lea r9, [rbp - 0x20]
lea r8, [rbp - 0x40]
lea rcx, [rbp - 0x60]
call fcn.140098ad0
mov rdi, rax
lea r14, [0x1401f76f0]
cmp r14, rax
je 0x1400908b8
mov rdx, qword [0x1401f7708]
cmp rdx, 0xf
jbe 0x14009087b
mov rcx, qword [0x1401f76f0]
inc rdx
cmp rdx, 0x1000
jb 0x140090876
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140090936
mov rcx, r8
call fcn.14010bacc
mov qword [0x1401f7700], r13
mov qword [0x1401f7708], 0xf
mov byte [0x1401f76f0], 0
movups xmm0, xmmword [rdi]
movups xmmword [0x1401f76f0], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [0x1401f7700], xmm1
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x1400908ef
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400908ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140090936
call fcn.14010bacc
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], 0
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x140090942
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009093d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009093d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010bacc
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r13w
mov dword [rbp + 0x160], 0x60000
mov edx, dword [rbp + 0x160]
mov rcx, qword [0x1401f9b30]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea rdx, [0x140141b90]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140095610
lea rdx, [0x1400957e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, dword [rbp + 0x160]
mov rcx, qword [0x1401f9b30]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
nop
lea rdx, str.Welcome_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140095610
cmp qword [0x1401f7708], 0xf
cmova r14, qword [0x1401f76f0]
mov r8, qword [0x1401f7700]
mov rdx, r14
mov rcx, rax
call fcn.140096bd0
lea rdx, [0x140142054]
mov rcx, rax
call fcn.140095610
lea rdx, [0x140087990]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x160]
call fcn.1400647a0
movabs rcx, 0x7fffffffa697d0ff
mov rax, qword [rbp + 0x160]
cmp rax, rcx
je 0x140090a2c
setl cl
test cl, cl
je 0x140090a2c
add rax, 0x59682f00
jmp 0x140090a36
movabs rax, 0x7fffffffffffffff
mov qword [rbp + 0x160], rax
lea rcx, [rbp + 0x160]
call fcn.140066e60
mov byte [0x1401f96f4], 1
call fcn.14008e010
call fcn.140052a10
mov ecx, 8
call fcn.14010b778
lea rcx, [0x140091e60]
mov qword [rax], rcx
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x140097310]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x80], rax
test rax, rax
je 0x14009109b
cmp dword [rbp - 0x78], 0
je 0x14009108f
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14009108f
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x80], xmm0
lea ecx, [rax + 8]
call fcn.14010b778
lea rcx, [0x140092e90]
mov qword [rax], rcx
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x140097310]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x80], rax
test rax, rax
je 0x140091081
cmp dword [rbp - 0x78], 0
je 0x140091075
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140091075
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x80], xmm0
lea ecx, [rax + 8]
call fcn.14010b778
lea rcx, [0x140093240]
mov qword [rax], rcx
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x140097310]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x80], rax
test rax, rax
je 0x140091067
cmp dword [rbp - 0x78], 0
je 0x14009105b
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14009105b
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x80], xmm0
lea ecx, [rax + 8]
call fcn.14010b778
lea rcx, [0x140093460]
mov qword [rax], rcx
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x140097310]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x80], rax
test rax, rax
je 0x14009104d
cmp dword [rbp - 0x78], 0
je 0x140091041
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140091041
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x80], xmm0
lea ecx, [rax + 8]
call fcn.14010b778
lea rcx, [0x140093a00]
mov qword [rax], rcx
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x140097310]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x80], rax
test rax, rax
je 0x140091033
cmp dword [rbp - 0x78], 0
je 0x140091027
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140091027
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x80], xmm0
lea ecx, [rax + 8]
call fcn.14010b778
lea rcx, [0x140093d90]
mov qword [rax], rcx
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x140097310]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x80], rax
test rax, rax
je 0x140091019
cmp dword [rbp - 0x78], 0
je 0x14009100d
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14009100d
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x80], xmm0
lea ecx, [rax + 8]
call fcn.14010b778
lea rcx, [0x1400941e0]
mov qword [rax], rcx
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x140097310]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x80], rax
test rax, rax
je 0x140090fff
cmp dword [rbp - 0x78], 0
je 0x140090ff3
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140090ff3
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x80], xmm0
lea ecx, [rax + 8]
call fcn.14010b778
lea rcx, [0x1400945a0]
mov qword [rax], rcx
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x140097310]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x80], rax
test rax, rax
je 0x140090fe5
cmp dword [rbp - 0x78], 0
je 0x140090fd9
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140090fd9
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x80], xmm0
lea ecx, [rax + 8]
call fcn.14010b778
lea rcx, [0x140094940]
mov qword [rax], rcx
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x140097310]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x80], rax
test rax, rax
je 0x140090fcb
cmp dword [rbp - 0x78], 0
je 0x140090fbf
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140090fbf
cmp rsi, 0xf
jbe 0x140090e7b
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140090e73
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140091433
mov rcx, rbx
call fcn.14010bacc
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x140090eb6
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140090eb1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140091433
call fcn.14010bacc
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], 0xf
mov byte [rbp + 0x40], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x140090f01
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140090efc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140091433
call fcn.14010bacc
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x78], 0xf
mov byte [rbp + 0x60], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x140090f51
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140090f4c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140091433
call fcn.14010bacc
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r13w
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x140090fa4
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140090f9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140091433
call fcn.14010bacc
nop
mov rbx, qword [rsp + 0x278]
add rsp, 0x220
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp - 0x78], r13d
mov ecx, r15d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp - 0x78], r13d
mov ecx, r15d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp - 0x78], r13d
mov ecx, r15d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp - 0x78], r13d
mov ecx, r15d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp - 0x78], r13d
mov ecx, r15d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp - 0x78], r13d
mov ecx, r15d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp - 0x78], r13d
mov ecx, r15d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp - 0x78], r13d
mov ecx, r15d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp - 0x78], r13d
mov ecx, r15d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0x160], 0x60000
mov edx, dword [rbp + 0x160]
mov rcx, qword [0x1401f9b30]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea rdx, [0x140141b90]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140095610
lea rdx, [0x1400957e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, dword [rbp + 0x160]
mov rcx, qword [0x1401f9b30]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
nop
lea rdx, str.Invalid_license_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140095610
lea rdx, [0x140087990]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x160]
call fcn.1400647a0
movabs rcx, 0x7fffffff4d2fa1fe
mov rax, qword [rbp + 0x160]
cmp rax, rcx
jg 0x140091153
mov ecx, 0xb2d05e00
add rcx, rax
mov qword [rbp + 0x160], rcx
jmp 0x140091164
movabs rax, 0x7fffffffffffffff
mov qword [rbp + 0x160], rax
lea rcx, [rbp + 0x160]
call fcn.140066e60
lea rdx, [0x140141fc8]
lea rcx, [rbp - 0x60]
call fcn.140094f90
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 7
cmova rdx, qword [rbp - 0x40]
lea rax, [rbp + 0x160]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400911dc
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova rdx, qword [rbp - 0x60]
mov rcx, qword [rbp + 0x160]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rbp + 0x160]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x14009121f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009121a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009121a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010bacc
lea rdx, str.Username
lea rcx, [rbp - 0x60]
call fcn.140094f90
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 7
cmova rdx, qword [rbp - 0x40]
lea rax, [rbp + 0x160]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14009128b
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova rdx, qword [rbp - 0x60]
mov rcx, qword [rbp + 0x160]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rbp + 0x160]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x1400912ce
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400912c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400912c9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010bacc
mov byte [0x1401f74ec], 0
cmp rsi, 0xf
jbe 0x14009130c
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140091304
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140091433
mov rcx, rbx
call fcn.14010bacc
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x140091347
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140091342
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140091433
call fcn.14010bacc
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], 0xf
mov byte [rbp + 0x40], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x140091392
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009138d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140091433
call fcn.14010bacc
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x78], 0xf
mov byte [rbp + 0x60], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x1400913de
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400913d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140091433
call fcn.14010bacc
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r13w
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x140090fa4
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140090f9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140090f9e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3