Function at 0x180008ee0
Capabilities:
Execute command
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x1800ec0f8]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xor eax, eax
mov dword [rbp - 0x49], 0x31737514
mov qword [rbp - 0x3b], rax
xor ebx, ebx
mov dword [rbp - 0x33], eax
movabs r9, 0xc7e51bb4593021ca
mov dword [rbp - 0x45], 0x22c701d
mov dword [rbp - 0x41], 0x2b3f6735
mov word [rbp - 0x3d], 0x513d
mov qword [rbp - 0x59], rbx
mov rax, qword [rbp - 0x59]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x59]
mov rax, qword [rbp - 0x59]
add rcx, r9
movzx edx, byte [rbp + rax - 0x49]
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
mov rax, qword [rbp - 0x59]
add r8, rcx
add r8, rdx
add r8b, 0x7a
mov byte [rbp + rax - 0x49], r8b
mov rax, qword [rbp - 0x59]
inc rax
mov qword [rbp - 0x59], rax
mov rax, qword [rbp - 0x59]
cmp rax, 0x1a
jb 0x180008f40
lea rcx, [rbp - 0x49]
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x180009181
xor eax, eax
mov dword [rbp - 9], 0x91848097
mov word [rbp + 0x1a], ax
xorps xmm0, xmm0
movups xmmword [rbp + 0xa], xmm0
mov dword [rbp - 5], 0xc98d8481
movabs r9, 0x7b256f9d3d5bca5a
mov dword [rbp - 1], 0xbfb386a0
mov dword [rbp + 3], 0xb3cc8fbd
mov word [rbp + 7], 0x8988
mov byte [rbp + 9], 0x1a
mov qword [rbp - 0x59], rbx
mov rax, qword [rbp - 0x59]
nop word [rax + rax]
mov rcx, qword [rbp - 0x59]
mov rax, qword [rbp - 0x59]
add rcx, r9
movzx edx, byte [rbp + rax - 9]
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
mov rax, qword [rbp - 0x59]
add r8, rcx
add r8, rdx
sub r8b, 0x76
mov byte [rbp + rax - 9], r8b
mov rax, qword [rbp - 0x59]
inc rax
mov qword [rbp - 0x59], rax
mov rax, qword [rbp - 0x59]
cmp rax, 0x25
jb 0x180008fe0
lea rcx, [rbp - 9]
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x180009181
xor eax, eax
mov dword [rbp - 0x29], 0xd8d4c8e3
mov qword [rbp - 0x1e], rax
movabs r9, 0x3e270fcc3636e477
mov word [rbp - 0x16], ax
mov byte [rbp - 0x14], al
mov dword [rbp - 0x25], 0xdb12dec8
mov word [rbp - 0x21], 0x2dd2
mov byte [rbp - 0x1f], 0xc0
mov qword [rbp - 0x59], rbx
mov rax, qword [rbp - 0x59]
nop dword [rax]
mov rcx, qword [rbp - 0x59]
mov rax, qword [rbp - 0x59]
add rcx, r9
movzx edx, byte [rbp + rax - 0x29]
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
mov rax, qword [rbp - 0x59]
add r8, rcx
add r8, rdx
sub r8b, 0x41
mov byte [rbp + rax - 0x29], r8b
mov rax, qword [rbp - 0x59]
inc rax
mov qword [rbp - 0x59], rax
mov rax, qword [rbp - 0x59]
cmp rax, 0x16
jb 0x180009070
lea rcx, [rbp - 0x29]
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x180009181
xor eax, eax
mov dword [rbp + 0x27], 0xcafefec3
mov qword [rbp + 0x2e], rax
movabs r9, 0x250397c02800cf52
mov dword [rbp + 0x36], eax
mov word [rbp + 0x3a], ax
mov byte [rbp + 0x3c], al
mov word [rbp + 0x2b], 0xc8e6
mov byte [rbp + 0x2d], 0x66
mov qword [rbp - 0x59], rbx
mov rax, qword [rbp - 0x59]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x59]
mov rax, qword [rbp - 0x59]
add rcx, r9
movzx edx, byte [rbp + rax + 0x27]
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
mov rax, qword [rbp - 0x59]
add r8, rcx
add r8, rdx
sub r8b, 0x3e
mov byte [rbp + rax + 0x27], r8b
mov rax, qword [rbp - 0x59]
inc rax
mov qword [rbp - 0x59], rax
mov rax, qword [rbp - 0x59]
cmp rax, 0x16
jb 0x180009100
lea rdx, [rbp + 0x27]
xor ecx, ecx
call qword [sym.imp.user32.dll_FindWindowA]
test rax, rax
je 0x180009181
lea rdx, [rbp + 0x47]
mov rcx, rax
call qword [sym.imp.user32.dll_GetWindowThreadProcessId]
call qword [sym.imp.kernel32.dll_GetCurrentProcessId]
cmp dword [rbp + 0x47], eax
je 0x18000918a
lea rcx, [0x1800d3504]
call qword [sym.imp.ucrtbase.dll_system]
xor ecx, ecx
call qword [sym.imp.ucrtbase.dll_exit]
int3
xor ecx, ecx
call qword [sym.imp.ucrtbase.dll_exit]
int3
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1800b1550
mov rbx, qword [rsp + 0xe0]
add rsp, 0xd0
pop rbp
ret