Function at 0x140001490
Capabilities:
Delete service
Execute command
Set console window title
Stop service
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x390
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14001a010]
xor rax, rsp
mov qword [rbp + 0x2d0], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x2b0], xmm0
movups xmmword [rbp + 0x2c0], xmm0
xor esi, esi
mov ebx, esi
lea rdi, str.0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x84210843
imul r8d
add edx, r8d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x3e
sub r8d, ecx
movsxd rax, r8d
movzx ecx, word [rdi + rax*2]
add word [rbp + rbx*2 + 0x2b0], cx
inc rbx
cmp rbx, 0xf
jne 0x140001500
lea rcx, str.Color_0A
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
lea rdx, [rbp + 0x200]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov r12d, 0xf0
test eax, eax
je 0x140001596
movzx edx, word [rbp + 0x208]
and dx, r12w
add dx, 0xb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._n_Starting_._._.__n
call fcn.1400091c0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
lea rdx, [rbp + 0x200]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x1400015dc
movzx edx, word [rbp + 0x208]
and dx, r12w
add dx, 0xf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
lea rdx, [rbp + 0x200]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x140001621
movzx edx, word [rbp + 0x208]
and dx, r12w
add dx, 0xb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._n_welcome_to_Starware_Solutions_Spooofer____n
call fcn.1400091c0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
lea rdx, [rbp + 0x200]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x140001667
movzx edx, word [rbp + 0x208]
and dx, r12w
add dx, 0xf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
lea rdx, [rbp + 0x200]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x1400016ac
movzx edx, word [rbp + 0x208]
and dx, r12w
add dx, 0xb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._n_Ready__n
call fcn.1400091c0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
lea rdx, [rbp + 0x200]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x1400016f2
movzx edx, word [rbp + 0x208]
and dx, r12w
add dx, 0xf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm6, xmm6
movss xmm7, dword [0x140015f30]
movsd xmm8, qword [0x140015f28]
movsd xmm9, qword [0x140015f20]
movss xmm10, dword [0x140015f18]
nop dword [rax]
nop word [rax + rax]
lea rdx, [0x14000ca24]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003c80
movaps xmm0, xmm6
mulss xmm0, xmm7
cvttss2si edi, xmm0
mov ebx, esi
cmp ebx, edi
jge 0x14000175d
lea rdx, [0x14000ca28]
jmp 0x14000176d
lea rdx, [0x14000ca2c]
je 0x14000176d
lea rdx, [0x14000ca30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003c80
inc ebx
cmp ebx, 0x46
jl 0x140001750
lea rdx, [0x14000ca38]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003c80
cvtss2sd xmm6, xmm6
movaps xmm0, xmm6
mulsd xmm0, xmm8
cvttsd2si edx, xmm0
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x14000ca34]
call fcn.140003c80
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
addsd xmm6, xmm9
cvtsd2ss xmm6, xmm6
comiss xmm10, xmm6
ja 0x140001730
lea rdx, [0x140004020]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0xc8], esi
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xe0], xmm1
xor r8d, r8d
lea rdx, [0x14000c930]
lea rcx, [rbp + 0xd0]
call fcn.140004350
nop
movabs r15, 0xca99bcc24f518e1b
mov qword [rbp + 0x2a0], r15
movabs r14, 0x2c1b87975806c78c
mov qword [rbp + 0x2a8], r14
movabs rax, 0xe4fc88f43827ff72
mov qword [rbp + 0x240], rax
movabs rax, 0x2c1b87975875beff
mov qword [rbp + 0x248], rax
movdqa xmm0, xmmword [rbp + 0x2a0]
xorps xmm0, xmmword [rbp + 0x240]
movdqa xmmword [rbp + 0x240], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
lea rax, [rbp + 0x240]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1400018a4
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0x40]
call fcn.140004350
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
je 0x140001944
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 0x10
cmovae rdx, qword [rbp + 0x40]
mov r8d, 0x10020
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
test rax, rax
je 0x14000193b
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x200], xmm0
mov qword [rbp + 0x210], rax
mov dword [rbp + 0x218], eax
lea r8, [rbp + 0x200]
lea edx, [rax + 1]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x140001932
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x140001982
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000197d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000197d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ab9c
mov qword [rbp + 0x200], r15
mov qword [rbp + 0x208], r14
movabs rax, 0x7dc98b9ce4599a85
mov qword [rbp + 0x210], rax
movabs rax, 0x8442ab0901d8b38e
mov qword [rbp + 0x218], rax
movabs rax, 0x80ca1fce72e0639f
mov qword [rbp + 0x220], rax
movabs rdi, 0xddf65563e2d5cf90
mov qword [rbp + 0x228], rdi
movabs rax, 0x14a04e18fdb5d179
mov qword [rbp + 0x230], rax
movabs rax, 0x57b04b155a57b332
mov qword [rbp + 0x238], rax
movabs rax, 0xe5b9daed6f3deb7f
mov qword [rbp + 0x260], rax
movabs rax, 0x4968d2cb6245e7fd
mov qword [rbp + 0x268], rax
movabs rax, 0xfacf8e9c105e9f7
mov qword [rbp + 0x270], rax
movabs rax, 0xf403f72c64b5d2e0
mov qword [rbp + 0x278], rax
movabs rax, 0xef8643af068127ef
mov qword [rbp + 0x280], rax
movabs rax, 0xad9b3037beb9aef3
mov qword [rbp + 0x288], rax
movabs rax, 0x7194786f8bc4b825
mov qword [rbp + 0x290], rax
movabs rax, 0x57b04b15292ec01c
mov qword [rbp + 0x298], rax
movups xmm0, xmmword [rbp + 0x260]
movaps xmmword [rbp + 0x40], xmm0
movups xmm1, xmmword [rbp + 0x270]
movaps xmmword [rbp + 0x50], xmm1
movups xmm0, xmmword [rbp + 0x280]
movaps xmmword [rbp + 0x60], xmm0
movups xmm1, xmmword [rbp + 0x290]
movaps xmmword [rbp + 0x70], xmm1
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x200]
vmovdqa ymmword [rbp + 0x40], ymm1
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0x220]
vmovdqa ymmword [rbp + 0x60], ymm1
lea rcx, [rbp + 0x40]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [rbp + 0x240], r15
mov qword [rbp + 0x248], r14
movabs r13, 0xca99bcc24f22e278
mov qword [rbp + 0x2a0], r13
mov qword [rbp + 0x2a8], r14
movdqa xmm0, xmmword [rbp + 0x240]
xorps xmm0, xmmword [rbp + 0x2a0]
movdqa xmmword [rbp + 0x240], xmm0
lea rcx, [rbp + 0x240]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0xf0]
call sub.VCRUNTIME140.dll_memset
mov qword [rbp + 0x240], r15
mov qword [rbp + 0x248], r14
movabs rbx, 0xaffedbab010db458
mov qword [rbp + 0x2a0], rbx
movabs rax, 0x2c1b87e42175e9fe
mov qword [rbp + 0x2a8], rax
movdqa xmm0, xmmword [rbp + 0x240]
xorps xmm0, xmmword [rbp + 0x2a0]
movdqa xmmword [rbp + 0x40], xmm0
mov r8d, 0x20
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0xf0]
call fcn.1400035c0
nop
mov r8d, 0x3900
lea rdx, [0x14001a050]
lea rcx, [rbp + 0xf0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0xf8]
call fcn.140003940
test rax, rax
jne 0x140001be1
mov rax, qword [rbp + 0xf0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0xf0]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov qword [rbp + 0x240], r15
mov qword [rbp + 0x248], r14
mov qword [rbp + 0x2a0], rbx
movabs rax, 0x2c1b87e42175e9fe
mov qword [rbp + 0x2a8], rax
movdqa xmm0, xmmword [rbp + 0x240]
xorps xmm0, xmmword [rbp + 0x2a0]
movdqa xmmword [rbp + 0x240], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x200], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x210], xmm1
lea rax, [rbp + 0x240]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140001c41
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0x200]
call fcn.140004350
nop
lea rcx, [rbp + 0x200]
call fcn.1400099b0
movzx ebx, al
mov rdx, qword [rbp + 0x218]
cmp rdx, 0x10
jb 0x140001cb2
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001cad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001cad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ab9c
test bl, bl
jne 0x140001d3a
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
lea rdx, [rbp + 0x200]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x140001cf4
movzx edx, word [rbp + 0x208]
and dx, r12w
add dx, 0xb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._n__Driver_Is_Already_Mounted__Or_Your_AV_is_blocking._If_this_isnt_your_first_start__please_you_must_disable_AV_n
call fcn.1400091c0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
lea rdx, [rbp + 0x200]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x140001d3a
movzx edx, word [rbp + 0x208]
and dx, r12w
add dx, 0xf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call fcn.1400045e0
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140002693
mov rcx, rax
call fcn.140006cd0
test rax, rax
jne 0x140001f3d
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdi, rax
lea rdx, [rbp + 0x200]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x140001d9b
movzx edx, word [rbp + 0x208]
and dx, r12w
add dx, 0xb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._n__Failed_to_map_driver__contact_Starware_Solutions__n
call fcn.1400091c0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdi, rax
lea rdx, [rbp + 0x200]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x140001de1
movzx edx, word [rbp + 0x208]
and dx, r12w
add dx, 0xf
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, rbx
call fcn.140004a70
nop
mov rax, qword [rbp + 0xf0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0xf0], rax
mov rax, qword [rbp + 0xf0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0xec], edx
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0xf8], rax
cmp qword [rbp + 0x178], 0
je 0x140001e6d
mov rax, qword [rbp + 0x110]
lea rcx, [rbp + 0x168]
cmp qword [rax], rcx
jne 0x140001e6d
mov rdx, qword [rbp + 0x188]
mov rcx, qword [rbp + 0x180]
mov qword [rax], rcx
mov rax, qword [rbp + 0x130]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp + 0x148]
mov dword [rax], edx
cmp byte [rbp + 0x174], 0
je 0x140001e82
lea rcx, [rbp + 0xf8]
call fcn.140003940
lea rcx, [rbp + 0xf8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x100]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x198]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0x10
jb 0x140001eef
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001eea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001eea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ab9c
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x2d0]
xor rcx, rsp
call fcn.14000ab40
lea r11, [rsp + 0x390]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, rbx
call fcn.140004a70
mov qword [rbp + 0x260], r15
mov qword [rbp + 0x268], r14
movabs r12, 0x7dc98b9ce4599a85
mov qword [rbp + 0x270], r12
movabs rax, 0x8442ab0901d8b38e
mov qword [rbp + 0x278], rax
movabs rax, 0x80ca1fce72e0639f
mov qword [rbp + 0x280], rax
mov qword [rbp + 0x288], rdi
movabs rax, 0xcac5bcec4f0d8e47
mov qword [rbp + 0x200], rax
movabs rax, 0x2c6887ee586ec7dc
mov qword [rbp + 0x208], rax
movabs rax, 0x7da58bfde43a9aec
mov qword [rbp + 0x210], rax
movabs rax, 0x8434ab6001aab3ca
mov qword [rbp + 0x218], rax
movabs rax, 0x80ca1fce72d063fa
mov qword [rbp + 0x220], rax
mov qword [rbp + 0x228], rdi
movups xmm0, xmmword [rbp + 0x200]
movaps xmmword [rbp], xmm0
movups xmm1, xmmword [rbp + 0x210]
movaps xmmword [rbp + 0x10], xmm1
movups xmm2, xmmword [rbp + 0x220]
vmovdqu ymm0, ymmword [rbp + 0x260]
vpxor ymm1, ymm0, ymmword [rbp]
vmovdqa ymmword [rbp], ymm1
vxorps xmm2, xmm2, xmmword [rbp + 0x280]
vmovdqa xmmword [rbp + 0x20], xmm2
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x10000000
lea r8d, [r9 + 3]
lea rcx, [rbp]
vzeroupper
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140002275
mov qword [rbp + 0x260], r15
mov qword [rbp + 0x268], r14
mov qword [rbp + 0x270], r12
movabs rcx, 0x8442ab0901d8b38e
mov qword [rbp + 0x278], rcx
movabs rdx, 0x80ca1fce72e0639f
mov qword [rbp + 0x280], rdx
mov qword [rbp + 0x288], rdi
movabs rax, 0xb8dc9cae2e25ef5d
mov qword [rbp + 0x200], rax
movabs rax, 0x4378a7bb7874a8fe
mov qword [rbp + 0x208], rax
movabs rax, 0x3c90abe88738eeeb
mov qword [rbp + 0x210], rax
movabs rax, 0xb5729b39228de9da
mov qword [rbp + 0x218], rax
movabs rax, 0xe3b976aa528e0cbf
mov qword [rbp + 0x220], rax
movabs rax, 0xddf65563ccb1bdff
mov qword [rbp + 0x228], rax
movups xmm0, xmmword [rbp + 0x200]
movaps xmmword [rbp], xmm0
movups xmm1, xmmword [rbp + 0x210]
movaps xmmword [rbp + 0x10], xmm1
movups xmm2, xmmword [rbp + 0x220]
vmovdqu ymm0, ymmword [rbp + 0x260]
vpxor ymm1, ymm0, ymmword [rbp]
vmovdqa ymmword [rbp], ymm1
vxorps xmm2, xmm2, xmmword [rbp + 0x280]
vmovdqa xmmword [rbp + 0x20], xmm2
mov qword [rbp + 0x200], r15
mov qword [rbp + 0x208], r14
mov qword [rbp + 0x210], r12
mov qword [rbp + 0x218], rcx
mov qword [rbp + 0x220], rdx
mov qword [rbp + 0x228], rdi
movabs r10, 0x14a04e18fdb5d179
mov qword [rbp + 0x230], r10
movabs r9, 0x57b04b155a57b332
mov qword [rbp + 0x238], r9
movabs rax, 0xa3ebd8e22422e77f
mov qword [rbp + 0x260], rax
movabs rax, 0x4875e6ff7874a2fa
mov qword [rbp + 0x268], rax
movabs rax, 0x11a8fdf28d79ffe9
mov qword [rbp + 0x270], rax
movabs rax, 0xa42cde7b21f6d7e7
mov qword [rbp + 0x278], rax
movabs rax, 0xeea372aa13c010fe
mov qword [rbp + 0x280], rax
movabs rax, 0xaf99210290a1bcf9
mov qword [rbp + 0x288], rax
mov qword [rbp + 0x290], r10
mov qword [rbp + 0x298], r9
vmovups xmm0, xmmword [rbp + 0x260]
vmovaps xmmword [rbp + 0x40], xmm0
vmovups xmm1, xmmword [rbp + 0x270]
vmovaps xmmword [rbp + 0x50], xmm1
vmovups xmm0, xmmword [rbp + 0x280]
vmovaps xmmword [rbp + 0x60], xmm0
vmovups xmm1, xmmword [rbp + 0x290]
vmovaps xmmword [rbp + 0x70], xmm1
vmovdqu ymm0, ymmword [rbp + 0x200]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x40], ymm1
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0x220]
vmovdqa ymmword [rbp + 0x60], ymm1
lea r9d, [rbx + 0x11]
lea r8, [rbp]
lea rdx, [rbp + 0x40]
xor ecx, ecx
vzeroupper
call qword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [rbx + 2]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x38], rsi
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x2201a4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
nop dword [rax]
nop word [rax + rax]
lea rdx, str._n_______________n_n_n_n_n_n_n________________________________________________________________________________________________________________________________________n________________________________________________________________________________________________________________________________________n________________________________________________________________________________________________________________________n_____________________________________________________________________________________________________________________________________n____________________________________________________________________________________________.______________________________n________________________________________________________________________________________________________________________________________n_n_n_n_n_________________________________n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003c80
mov rcx, rax
mov dl, 0xa
call fcn.140003e50
call fcn.14000a800
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str._n___2__Randomize_Everytime_You_Check__n
call fcn.14000a740
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str._n___3__Use_Custom_Serials_n
call fcn.14000a740
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str._n___4__Randomize_Serials_n
call fcn.14000a740
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0xcc], esi
lea rdx, [rbp + 0xcc]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov ecx, dword [rbp + 0xcc]
sub ecx, 1
je 0x1400024f7
sub ecx, 1
je 0x1400024f0
sub ecx, 1
je 0x1400023b1
cmp ecx, 1
je 0x1400023a7
mov qword [rbp + 0x240], r15
mov qword [rbp + 0x248], r14
mov qword [rbp + 0x2a0], r13
mov qword [rbp + 0x2a8], r14
movdqa xmm1, xmmword [rbp + 0x240]
movdqu xmm0, xmmword [rbp + 0x2a0]
xorps xmm1, xmm0
movdqa xmmword [rbp + 0x200], xmm1
lea rcx, [rbp + 0x200]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x1400022b0
mov edx, 0x222480
jmp 0x1400024fc
mov qword [rbp + 0x260], r15
mov qword [rbp + 0x268], r14
mov qword [rbp + 0x270], r12
movabs rax, 0x8442ab0901d8b38e
mov qword [rbp + 0x278], rax
movabs rax, 0x80ca1fce72e0639f
mov qword [rbp + 0x280], rax
mov qword [rbp + 0x288], rdi
movabs rax, 0xb8f8c8916f0ca540
mov qword [rbp + 0x200], rax
movabs rax, 0x4074d4b73d74a6fb
mov qword [rbp + 0x208], rax
movabs rax, 0x51e9f8f28b30eef0
mov qword [rbp + 0x210], rax
movabs rax, 0xdd62d96c75b6f6ae
mov qword [rbp + 0x218], rax
movabs rax, 0xe9b87a9d529216f0
mov qword [rbp + 0x220], rax
movabs rax, 0xddf67559c2a6a3f1
mov qword [rbp + 0x228], rax
movups xmm0, xmmword [rbp + 0x200]
movaps xmmword [rbp + 0x80], xmm0
movups xmm1, xmmword [rbp + 0x210]
movaps xmmword [rbp + 0x90], xmm1
movups xmm2, xmmword [rbp + 0x220]
vmovdqu ymm0, ymmword [rbp + 0x260]
vpxor ymm1, ymm0, ymmword [rbp + 0x80]
vmovdqa ymmword [rbp + 0x80], ymm1
vxorps xmm2, xmm2, xmmword [rbp + 0x280]
vmovdqa xmmword [rbp + 0xa0], xmm2
lea rdx, [rbp + 0x80]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
vzeroupper
call fcn.140003c80
lea rdx, [rbp + 0xd0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140004060
lea rcx, [rbp + 0xd0]
call fcn.1400036d0
mov qword [rbp + 0xc0], rax
mov r9d, 8
lea r8, [rbp + 0xc0]
mov edx, 0x221248
jmp 0x140002502
mov edx, 0x2210a0
jmp 0x1400024fc
mov edx, 0x22084c
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x38], rsi
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x200], r15
mov qword [rbp + 0x208], r14
mov qword [rbp + 0x210], r12
movabs rax, 0x8442ab0901d8b38e
mov qword [rbp + 0x218], rax
movabs rax, 0x80ca1fce72e0639f
mov qword [rbp + 0x220], rax
mov qword [rbp + 0x228], rdi
movabs r10, 0x14a04e18fdb5d179
mov qword [rbp + 0x230], r10
movabs r9, 0x57b04b155a57b332
mov qword [rbp + 0x238], r9
movabs rax, 0xabeecea33b028411
mov qword [rbp + 0x260], rax
movabs rax, 0x586eebf80b26a2fe
mov qword [rbp + 0x268], rax
movabs rax, 0x39e9b1bc9737f5ec
mov qword [rbp + 0x270], rax
movabs rax, 0xa42dec292dbddde1
mov qword [rbp + 0x278], rax
movabs rax, 0xef933fa511850bdc
mov qword [rbp + 0x280], rax
movabs rax, 0xbc9f2706b1f5bde5
mov qword [rbp + 0x288], rax
movabs rax, 0x14a04e18fd9ba215
mov qword [rbp + 0x290], rax
mov qword [rbp + 0x298], r9
movups xmm0, xmmword [rbp + 0x260]
movaps xmmword [rbp], xmm0
movups xmm1, xmmword [rbp + 0x270]
movaps xmmword [rbp + 0x10], xmm1
movups xmm0, xmmword [rbp + 0x280]
movaps xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rbp + 0x290]
movaps xmmword [rbp + 0x30], xmm1
vmovdqu ymm0, ymmword [rbp + 0x200]
vpxor ymm1, ymm0, ymmword [rbp]
vmovdqa ymmword [rbp], ymm1
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x220]
vmovdqa ymmword [rbp + 0x20], ymm1
lea rdx, [rbp]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
vzeroupper
call fcn.140003c80
lea rdx, [0x140004020]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rbp + 0x200], r15
mov qword [rbp + 0x208], r14
movabs rcx, 0x7dc98b9ce4599a85
mov qword [rbp + 0x210], rcx
movabs rdx, 0x8442ab0901d8b38e
mov qword [rbp + 0x218], rdx
movabs r8, 0x80ca1fce72e0639f
mov qword [rbp + 0x220], r8
mov qword [rbp + 0x228], rdi
movabs r10, 0x14a04e18fdb5d179
mov qword [rbp + 0x230], r10
movabs r9, 0x57b04b155a57b332
mov qword [rbp + 0x238], r9
movabs rax, 0xb8dc9cae2e25ef5d
mov qword [rbp + 0x260], rax
movabs rax, 0x4378a7bb7874a8fe
mov qword [rbp + 0x268], rax
movabs rax, 0x99aabe88738eeeb
mov qword [rbp + 0x270], rax
movabs rax, 0xd762ce7b60afc1ef
mov qword [rbp + 0x278], rax
movabs rax, 0xf3a470a706950ff0
mov qword [rbp + 0x280], rax
movabs rax, 0xbe853c07c2bba0b0
mov qword [rbp + 0x288], rax
movabs rax, 0x14a04e18d3d1a316
mov qword [rbp + 0x290], rax
mov qword [rbp + 0x298], r9
movups xmm0, xmmword [rbp + 0x260]
movaps xmmword [rbp], xmm0
movups xmm1, xmmword [rbp + 0x270]
movaps xmmword [rbp + 0x10], xmm1
movups xmm0, xmmword [rbp + 0x280]
movaps xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rbp + 0x290]
movaps xmmword [rbp + 0x30], xmm1
vmovdqu ymm0, ymmword [rbp + 0x200]
vpxor ymm1, ymm0, ymmword [rbp]
vmovdqa ymmword [rbp], ymm1
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x220]
vmovdqa ymmword [rbp + 0x20], ymm1
mov qword [rbp + 0x260], r15
mov qword [rbp + 0x268], r14
mov qword [rbp + 0x270], rcx
mov qword [rbp + 0x278], rdx
mov qword [rbp + 0x280], r8
mov qword [rbp + 0x288], rdi
movabs rax, 0xbfcf9cae2a25e052
mov qword [rbp + 0x200], rax
movabs rax, 0x4569c3b72a63a9e0
mov qword [rbp + 0x208], rax
movabs rax, 0x11a0eadac42bfff3
mov qword [rbp + 0x210], rax
movabs rax, 0xeb0e8b6655f8d7eb
mov qword [rbp + 0x218], rax
movabs rax, 0x80ca1fce72c107fe
mov qword [rbp + 0x220], rax
mov qword [rbp + 0x228], rdi
vmovups xmm0, xmmword [rbp + 0x200]
vmovaps xmmword [rbp + 0x80], xmm0
vmovups xmm1, xmmword [rbp + 0x210]
vmovaps xmmword [rbp + 0x90], xmm1
vmovups xmm2, xmmword [rbp + 0x220]
vmovdqu ymm0, ymmword [rbp + 0x260]
vpxor ymm1, ymm0, ymmword [rbp + 0x80]
vmovdqa ymmword [rbp + 0x80], ymm1
vxorps xmm2, xmm2, xmmword [rbp + 0x280]
vmovdqa xmmword [rbp + 0xa0], xmm2
mov r9d, 0x10
lea r8, [rbp]
lea rdx, [rbp + 0x80]
xor ecx, ecx
vzeroupper
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3