Function at 0x140001510
Capabilities:
Execute command

Disassembly:
mov r11, rsp
sub rsp, 0x68
mov rax, qword [0x140007040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [r11 + 8], rbx
lea rcx, str.Spoofing_process_started__Please_do_not_touch_your_keyboard..._n
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 - 8], rdi
mov qword [r11 - 0x10], r14
call fcn.140001020
lea rcx, [rsp + 0x20]
call fcn.1400013b0
mov r14, qword [rsp + 0x38]
lea rbx, [rsp + 0x20]
mov rbp, qword [rsp + 0x20]
cmp r14, 0xf
mov rdi, qword [rsp + 0x30]
cmova rbx, rbp
cmp rdi, 4
jb 0x1400015b8
lea rsi, [rdi + rbx]
mov edx, 0x44
lea r8, [rsi - 3]
mov rcx, rbx
sub r8, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x1400015b8
nop
cmp dword [rax], 0x6c6c6544
je 0x140001808
inc rax
lea r8, [rsi - 3]
sub r8, rax
mov rcx, rax
mov edx, 0x44
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x140001590
cmp r14, 0xf
lea rbx, [rsp + 0x20]
cmova rbx, rbp
cmp rdi, 2
jb 0x140001617
lea rsi, [rdi + rbx]
mov edx, 0x48
lea r8, [rsi - 1]
mov rcx, rbx
sub r8, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140001617
nop dword [rax + rax]
cmp word [rax], 0x5048
je 0x140001827
inc rax
lea r8, [rsi - 1]
sub r8, rax
mov rcx, rax
mov edx, 0x48
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x1400015f0
cmp r14, 0xf
lea rbx, [rsp + 0x20]
cmova rbx, rbp
cmp rdi, 4
jb 0x140001678
lea rsi, [rdi + rbx]
mov edx, 0x41
lea r8, [rsi - 3]
mov rcx, rbx
sub r8, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140001678
nop word [rax + rax]
cmp dword [rax], 0x72656341
je 0x140001846
inc rax
lea r8, [rsi - 3]
sub r8, rax
mov rcx, rax
mov edx, 0x41
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x140001650
cmp r14, 0xf
lea rbx, [rsp + 0x20]
cmova rbx, rbp
cmp rdi, 4
jb 0x1400016d8
lea rsi, [rdi + rbx]
mov edx, 0x41
lea r8, [rsi - 3]
mov rcx, rbx
sub r8, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x1400016d8
nop dword [rax + rax]
cmp dword [rax], 0x53555341
je 0x140001862
inc rax
lea r8, [rsi - 3]
sub r8, rax
mov rcx, rax
mov edx, 0x41
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x1400016b0
cmp r14, 0xf
lea rbx, [rsp + 0x20]
cmova rbx, rbp
cmp rdi, 3
jb 0x140001735
lea rsi, [rdi + rbx]
mov edx, 0x4d
lea r8, [rsi - 2]
mov rcx, rbx
sub r8, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140001735
cmp word [rax], 0x534d
jne 0x140001719
cmp byte [rax + 2], 0x49
je 0x14000187e
inc rax
lea r8, [rsi - 2]
sub r8, rax
mov rcx, rax
mov edx, 0x4d
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x140001708
cmp r14, 0xf
mov qword [rsp + 0x50], r15
lea rbx, [rsp + 0x20]
cmova rbx, rbp
cmp rdi, 8
jb 0x140001799
lea rsi, [rdi + rbx]
mov edx, 0x47
lea r8, [rsi - 7]
mov rcx, rbx
sub r8, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140001799
movabs r15, 0x6574796261676947
cmp qword [rax], r15
je 0x14000189a
inc rax
lea r8, [rsi - 7]
sub r8, rax
mov rcx, rax
mov edx, 0x47
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x140001774
cmp r14, 0xf
lea rbx, [rsp + 0x20]
cmova rbx, rbp
cmp rdi, 6
jb 0x1400018c0
lea r8, [rdi - 5]
mov edx, 0x41
add r8, rbx
mov rcx, rbx
sub r8, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x1400018c0
cmp dword [rax], 0x6f527341
jne 0x1400017e4
cmp word [rax + 4], 0x6b63
je 0x1400018b0
inc rax
lea r8, [rdi - 5]
add r8, rbx
mov edx, 0x41
sub r8, rax
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x1400017d0
jmp 0x1400018c0
sub rax, rbx
cmp rax, 0xffffffffffffffff
je 0x1400015b8
lea rcx, str.C:DMITooldell_tool.exe__mod__sn_123456__csn_654321
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x1400018d2
sub rax, rbx
cmp rax, 0xffffffffffffffff
je 0x140001617
lea rcx, str.C:HPBQ138hp_tool.exe__serial123456__asset654321
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x1400018d2
sub rax, rbx
cmp rax, 0xffffffffffffffff
je 0x140001678
lea rcx, str.C:AcerTool_acer_tool.exe__setserial123456__setasset654321
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x1400018d2
sub rax, rbx
cmp rax, 0xffffffffffffffff
je 0x1400016d8
lea rcx, str.C:ASUSTool_asus_tool.exe__setserial123456__setasset654321
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x1400018d2
sub rax, rbx
cmp rax, 0xffffffffffffffff
je 0x140001735
lea rcx, str.C:MSIToolmsi_tool.exe__setserial123456__setasset654321
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x1400018d2
sub rax, rbx
cmp rax, 0xffffffffffffffff
je 0x140001799
lea rcx, str.C:GigabyteToolgigabyte_tool.exe__setserial123456__setasset654321
jmp 0x1400018c7
sub rax, rbx
lea rcx, str.C:AsRockTool_asrock_tool.exe__setserial123456__setasset654321
cmp rax, 0xffffffffffffffff
jne 0x1400018c7
lea rcx, str.C:AMIDEWINx64.EXE__SU_auto
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r15, qword [rsp + 0x50]
lea rcx, [0x1400046e4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_winmgmt__y
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_start_winmgmt__y
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_winmgmt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.timeout_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_start_winmgmt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.timeout_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400046e4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r9d, 0x40
lea r8, str.Information
lea rdx, str.Spoofed_Successfully__Please_restart_your_computer_to_ensure_changes_persist.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rdx, qword [rsp + 0x38]
mov r14, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x1400019b2
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400019ad
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400019ad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002eac
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140002e50
add rsp, 0x68
ret