Function at 0x1400033a0
Capabilities:
Create process on windows
Enumerate processes
Execute command
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x440
mov rax, qword [0x14000e040]
xor rax, rsp
mov qword [rsp + 0x430], rax
xor edi, edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x1d0], xmm0
mov qword [rsp + 0x1e0], rdi
mov qword [rsp + 0x1e8], 0xf
mov byte [rsp + 0x1d0], dil
lea rdx, str.Do_you_want_to_launch_in_memory_mode___yes_no_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005680
lea rdx, [rsp + 0x1d0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140005860
xorps xmm0, xmm0
movups xmmword [rsp + 0x170], xmm0
mov qword [rsp + 0x180], rdi
mov qword [rsp + 0x188], rdi
mov r8d, 0x33
lea rdx, str.G:extraValoSkibidiST_External_Loader_skibidi.exe
lea rcx, [rsp + 0x170]
call fcn.140006580
nop
lea rdx, [rsp + 0x170]
cmp qword [rsp + 0x188], 7
cmova rdx, qword [rsp + 0x170]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rdi
mov r8, qword [rsp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.140006580
nop
mov qword [rsp + 0x1b0], rdi
lea r15, [0x14000e0c8]
mov qword [rsp + 0x1b8], r15
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x30]
call fcn.140002f80
movzx ebx, al
cmp dword [rsp + 0x1b0], edi
jne 0x140004bde
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140003516
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003511
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003511
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007c74
test bl, bl
jne 0x140003639
lea rdx, str.sigma.exe_not_found_in_the_specified_path.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140005460
lea rdx, [0x140005640]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov qword [rsp + 0x190], 5
lea rcx, [rsp + 0x190]
call fcn.140005a40
nop
mov rdx, qword [rsp + 0x188]
cmp rdx, 7
jbe 0x1400035a3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000359e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b69
call fcn.140007c74
mov qword [rsp + 0x180], rdi
mov qword [rsp + 0x188], 7
mov word [rsp + 0x170], di
mov rdx, qword [rsp + 0x1e8]
cmp rdx, 0xf
jbe 0x140003602
inc rdx
mov rcx, qword [rsp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400035fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004bd7
call fcn.140007c74
mov eax, 1
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.140007c10
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
xorps xmm0, xmm0
movups xmmword [rsp + 0x130], xmm0
mov qword [rsp + 0x140], rdi
mov qword [rsp + 0x148], 7
mov word [rsp + 0x130], di
lea rcx, [rsp + 0x1d0]
mov r13, qword [rsp + 0x1d0]
mov r14, qword [rsp + 0x1e8]
mov qword [rsp + 0x1c0], r14
cmp r14, 0xf
cmova rcx, r13
mov rax, qword [rsp + 0x1e0]
mov qword [rsp + 0x1b0], rax
cmp rax, 3
jne 0x140003dda
mov r8, rax
lea rdx, [0x14000a8d8]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140003dda
lea rdx, [rsp + 0x1f0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x140003814
lea rdx, str.Failed_to_get_temporary_path.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140005460
lea rdx, [0x140005640]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov qword [rsp + 0x190], 5
lea rcx, [rsp + 0x190]
call fcn.140005a40
nop
mov rdx, qword [rsp + 0x148]
cmp rdx, 7
jbe 0x140003759
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003754
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bc5
call fcn.140007c74
mov qword [rsp + 0x140], rdi
mov qword [rsp + 0x148], 7
mov word [rsp + 0x130], di
mov rdx, qword [rsp + 0x188]
cmp rdx, 7
jbe 0x1400037bd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400037b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003c2c
call fcn.140007c74
mov qword [rsp + 0x180], rdi
mov qword [rsp + 0x188], 7
mov word [rsp + 0x170], di
cmp r14, 0xf
jbe 0x140003602
lea rdx, [r14 + 1]
mov rax, r13
cmp rdx, 0x1000
jb 0x14000380c
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003c8b
mov rcx, r13
jmp 0x1400035fd
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea rax, [rsp + 0x1f0]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140003834
lea rdx, [rsp + 0x1f0]
lea rcx, [rsp + 0x30]
call fcn.140006580
nop
mov rsi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
sub rax, rsi
cmp rax, 7
jb 0x1400038a2
lea rax, [rsi + 7]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rcx, 7
cmova rbx, qword [rsp + 0x30]
lea rcx, [rbx + rsi*2]
mov r8d, 0xe
lea rdx, str.RAMDisk
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rsi*2 + 0xe], di
lea rax, [rsp + 0x30]
jmp 0x1400038c1
mov qword [rsp + 0x20], 7
lea r9, str.RAMDisk
mov edx, 7
lea rcx, [rsp + 0x30]
call fcn.1400063b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x150], xmm0
mov qword [rsp + 0x160], rdi
mov qword [rsp + 0x168], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x150], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x160], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140003947
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003942
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003942
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007c74
movdqa xmm0, xmmword [0x14000abe0]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], di
lea rdx, [rsp + 0x150]
cmp qword [rsp + 0x168], 7
cmova rdx, qword [rsp + 0x150]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
mov r8, qword [rsp + 0x160]
lea rcx, [rsp + 0x50]
call fcn.140006580
nop
mov qword [rsp + 0x190], rdi
mov qword [rsp + 0x198], r15
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x50]
call fcn.140002f80
movzx ebx, al
cmp dword [rsp + 0x190], 0
jne 0x140004bf8
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x140003a11
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003a0c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003a0c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007c74
test bl, bl
jne 0x140003c92
lea rdx, [rsp + 0x150]
cmp qword [rsp + 0x168], 7
cmova rdx, qword [rsp + 0x150]
xorps xmm0, xmm0
movups xmmword [rsp + 0x190], xmm0
mov qword [rsp + 0x1a0], rdi
mov qword [rsp + 0x1a8], rdi
mov r8, qword [rsp + 0x160]
lea rcx, [rsp + 0x190]
call fcn.140006580
nop
lea rcx, [rsp + 0x190]
cmp qword [rsp + 0x1a8], 7
cmova rcx, qword [rsp + 0x190]
call fcn.140007528
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x140004c12
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 7
jbe 0x140003add
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ad8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003ad8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007c74
test bl, bl
jne 0x140003c92
lea rdx, str.Failed_to_create_temporary_directory.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140005460
lea rdx, [0x140005640]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov qword [rsp + 0x190], 5
lea rcx, [rsp + 0x190]
call fcn.140005a40
nop
mov rdx, qword [rsp + 0x168]
cmp rdx, 7
jbe 0x140003b6a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b65
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003dd3
call fcn.140007c74
mov qword [rsp + 0x160], rdi
mov qword [rsp + 0x168], 7
mov word [rsp + 0x150], di
mov rdx, qword [rsp + 0x148]
cmp rdx, 7
jbe 0x140003bd1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003bcc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003bcc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007c74
mov qword [rsp + 0x140], rdi
mov qword [rsp + 0x148], 7
mov word [rsp + 0x130], di
mov rdx, qword [rsp + 0x188]
cmp rdx, 7
jbe 0x140003c38
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c33
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003c33
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007c74
mov qword [rsp + 0x180], rdi
mov qword [rsp + 0x188], 7
mov word [rsp + 0x170], di
cmp r14, 0xf
jbe 0x140003602
lea rdx, [r14 + 1]
mov rax, r13
cmp rdx, 0x1000
jb 0x14000380c
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000380c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x50]
call fcn.140005be0
mov rbx, rax
lea rax, [rsp + 0x130]
cmp rax, rbx
je 0x140003d42
mov rdx, qword [rsp + 0x148]
cmp rdx, 7
jbe 0x140003d00
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003cfb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003d7b
call fcn.140007c74
mov qword [rsp + 0x140], rdi
mov qword [rsp + 0x148], 7
mov word [rsp + 0x130], di
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x130], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x140], xmm1
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x140003d88
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003d82
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007c74
nop
mov rdx, qword [rsp + 0x168]
cmp rdx, 7
jbe 0x14000426f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004269
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004269
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xorps xmm0, xmm0
movups xmmword [rsp + 0x150], xmm0
mov qword [rsp + 0x160], rdi
mov qword [rsp + 0x168], rdi
mov r8d, 0xb
lea rdx, str.D:_beepboop
lea rcx, [rsp + 0x150]
call fcn.140006580
nop
lea rdx, [rsp + 0x150]
cmp qword [rsp + 0x168], 7
cmova rdx, qword [rsp + 0x150]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
mov r8, qword [rsp + 0x160]
lea rcx, [rsp + 0x50]
call fcn.140006580
nop
mov qword [rsp + 0x190], rdi
mov qword [rsp + 0x198], r15
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x50]
call fcn.140002f80
movzx ebx, al
cmp dword [rsp + 0x190], 0
jne 0x140004c26
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x140003ec7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ec2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003ec2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007c74
test bl, bl
jne 0x14000412d
lea rdx, [rsp + 0x150]
cmp qword [rsp + 0x168], 7
cmova rdx, qword [rsp + 0x150]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rdi
mov r8, qword [rsp + 0x160]
lea rcx, [rsp + 0x30]
call fcn.140006580
nop
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rcx, qword [rsp + 0x30]
call fcn.140007528
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x140004c40
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140003f78
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f73
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003f73
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007c74
test bl, bl
jne 0x14000412d
lea rdx, str.Failed_to_create_beepboop_directory.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140005460
lea rdx, [0x140005640]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov qword [rsp + 0x190], 5
lea rcx, [rsp + 0x190]
call fcn.140005a40
nop
mov rdx, qword [rsp + 0x168]
cmp rdx, 7
jbe 0x140004005
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004000
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004262
call fcn.140007c74
mov qword [rsp + 0x160], rdi
mov qword [rsp + 0x168], 7
mov word [rsp + 0x150], di
mov rdx, qword [rsp + 0x148]
cmp rdx, 7
jbe 0x14000406c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004067
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004067
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007c74
mov qword [rsp + 0x140], rdi
mov qword [rsp + 0x148], 7
mov word [rsp + 0x130], di
mov rdx, qword [rsp + 0x188]
cmp rdx, 7
jbe 0x1400040d3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400040ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400040ce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007c74
mov qword [rsp + 0x180], rdi
mov qword [rsp + 0x188], 7
mov word [rsp + 0x170], di
cmp r14, 0xf
jbe 0x140003602
lea rdx, [r14 + 1]
mov rax, r13
cmp rdx, 0x1000
jb 0x14000380c
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000380c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x50]
call fcn.140005be0
mov rbx, rax
lea rax, [rsp + 0x130]
cmp rax, rbx
je 0x1400041dd
mov rdx, qword [rsp + 0x148]
cmp rdx, 7
jbe 0x14000419b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004196
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004216
call fcn.140007c74
mov qword [rsp + 0x140], rdi
mov qword [rsp + 0x148], 7
mov word [rsp + 0x130], di
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x130], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x140], xmm1
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x140004223
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000421d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000421d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007c74
nop
mov rdx, qword [rsp + 0x168]
cmp rdx, 7
jbe 0x14000426f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004269
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004269
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007c74
nop
lea rdx, [rsp + 0x130]
cmp qword [rsp + 0x148], 7
cmova rdx, qword [rsp + 0x130]
xorps xmm0, xmm0
movups xmmword [rsp + 0x150], xmm0
mov qword [rsp + 0x160], rdi
mov qword [rsp + 0x168], rdi
mov r8, qword [rsp + 0x140]
lea rcx, [rsp + 0x150]
call fcn.140006580
nop
lea rdx, [rsp + 0x170]
cmp qword [rsp + 0x188], 7
cmova rdx, qword [rsp + 0x170]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rdi
mov r8, qword [rsp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.140006580
nop
lea rdx, [rsp + 0x150]
cmp qword [rsp + 0x168], 7
cmova rdx, qword [rsp + 0x150]
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rcx, qword [rsp + 0x30]
mov r8d, 2
call fcn.140007284
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x140004c51
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140004383
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000437e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000437e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007c74
movdqa xmm0, xmmword [0x14000abe0]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], di
mov rdx, qword [rsp + 0x168]
cmp rdx, 7
jbe 0x1400043e2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400043dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400043dc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007c74
nop
mov dword [rsp + 0xc0], 0x70
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0xc4], xmm0
movups xmmword [rsp + 0xd4], xmm0
movups xmmword [rsp + 0xe4], xmm0
movups xmmword [rsp + 0xf4], xmm0
movups xmmword [rsp + 0x104], xmm0
movups xmmword [rsp + 0x114], xmm0
mov qword [rsp + 0x124], rax
mov dword [rsp + 0x12c], eax
lea rax, str.runas
mov qword [rsp + 0xd0], rax
lea rax, [rsp + 0x130]
cmp qword [rsp + 0x148], 7
cmova rax, qword [rsp + 0x130]
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xc8], rdi
mov dword [rsp + 0xf0], 1
lea rcx, [rsp + 0xc0]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x1400044d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
cmp eax, 0x4c7
jne 0x1400044ab
lea rdx, str.User_refused_to_allow_privileges_elevation.
call fcn.140005460
jmp 0x1400044c2
lea rdx, str.Failed_to_run_as_admin._Error_code:
call fcn.140005460
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140005640]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov qword [rsp + 0x190], 5
nop
lea rcx, [rsp + 0x190]
call fcn.140005a40
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x88], rdi
mov r8d, 0xb
lea rdx, str.skibidi.exe
lea rcx, [rsp + 0x70]
call fcn.140006580
nop
mov dword [rsp + 0x1f0], 0x238
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
lea rdx, [rsp + 0x1f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x140004691
lea rdx, [rsp + 0x1f0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x140004691
mov r15, qword [rsp + 0x88]
mov r12, qword [rsp + 0x80]
mov r14, qword [rsp + 0x70]
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0xa8], rdi
lea rax, [rsp + 0x21c]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400045b0
lea rdx, [rsp + 0x21c]
lea rcx, [rsp + 0x90]
call fcn.140006580
lea rcx, [rsp + 0x70]
cmp r15, 7
cmova rcx, r14
lea r8, [rsp + 0x90]
mov r9, qword [rsp + 0x90]
mov r10, qword [rsp + 0xa8]
cmp r10, 7
cmova r8, r9
mov rdx, qword [rsp + 0xa0]
cmp rdx, r12
jne 0x14000462a
test rdx, rdx
je 0x140004626
sub r8, rcx
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x14000462a
add rcx, 2
sub rdx, 1
jne 0x140004612
mov bl, 1
jmp 0x14000462c
xor bl, bl
cmp r10, 7
jbe 0x140004667
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x14000465f
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400047e7
mov rcx, r9
call fcn.140007c74
mov rcx, rsi
test bl, bl
jne 0x140004687
lea rdx, [rsp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x140004581
jmp 0x14000469e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
jmp 0x1400046a9
mov r15, qword [rsp + 0x88]
mov r14, qword [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
cmp r15, 7
jbe 0x1400046e4
lea rdx, [r15*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x1400046dc
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400047ee
mov rcx, r14
call fcn.140007c74
test bl, bl
je 0x1400044e0
lea rcx, [rsp + 0x1d0]
cmp qword [rsp + 0x1c0], 0xf
cmova rcx, r13
mov r8, qword [rsp + 0x1b0]
cmp r8, 3
jne 0x140004841
lea rdx, [0x14000a8d8]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140004841
lea rdx, [rsp + 0x130]
cmp qword [rsp + 0x148], 7
cmova rdx, qword [rsp + 0x130]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rdi
mov r8, qword [rsp + 0x140]
lea rcx, [rsp + 0x30]
call fcn.140006580
nop
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rcx, qword [rsp + 0x30]
call fcn.1400079d4
mov rdx, rax
shr rdx, 0x20
movzx ecx, al
mov qword [rsp + 0x1b0], rcx
mov dword [rsp + 0x1c0], edx
lea rax, [0x14000e0c8]
mov qword [rsp + 0x1c8], rax
movaps xmm0, xmmword [rsp + 0x1c0]
movdqa xmmword [rsp + 0x1c0], xmm0
cmp edx, 0x91
jne 0x1400047d7
lea r8, [rsp + 0x1b0]
lea rdx, [rsp + 0x1c0]
lea rcx, [rsp + 0x30]
call fcn.140003090
cmp dword [rsp + 0x1c0], 0
jne 0x140004c68
jmp 0x1400047f5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x14000492f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000492a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000492a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rdi
mov r8d, 0xb
lea rdx, str.D:_beepboop
lea rcx, [rsp + 0x30]
call fcn.140006580
nop
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rcx, qword [rsp + 0x30]
call fcn.1400079d4
mov rdx, rax
shr rdx, 0x20
movzx ecx, al
mov qword [rsp + 0x1b0], rcx
mov dword [rsp + 0x1c0], edx
lea rax, [0x14000e0c8]
mov qword [rsp + 0x1c8], rax
movaps xmm0, xmmword [rsp + 0x1c0]
movdqa xmmword [rsp + 0x1c0], xmm0
cmp edx, 0x91
jne 0x1400048dc
lea r8, [rsp + 0x1b0]
lea rdx, [rsp + 0x1c0]
lea rcx, [rsp + 0x30]
call fcn.140003090
cmp dword [rsp + 0x1c0], 0
jne 0x140004c82
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x14000492f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000492a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000492a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007c74
lea rdx, str.Do_you_want_to_reboot_the_PC___yes_no_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005680
lea rdx, [rsp + 0x1d0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140005860
lea rcx, [rsp + 0x1d0]
mov rbx, qword [rsp + 0x1d0]
mov rsi, qword [rsp + 0x1e8]
cmp rsi, 0xf
cmova rcx, rbx
mov r8, qword [rsp + 0x1e0]
cmp r8, 3
jne 0x1400049a1
lea rdx, [0x14000a8d8]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400049a1
lea rcx, str.shutdown__r__t_0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [rsp + 0x1b0], 5
lea rcx, [rsp + 0x1b0]
call fcn.140005a40
nop
mov rdx, qword [rsp + 0x148]
cmp rdx, 7
jbe 0x140004a03
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400049fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b00
call fcn.140007c74
mov qword [rsp + 0x140], rdi
mov qword [rsp + 0x148], 7
mov word [rsp + 0x130], di
mov rdx, qword [rsp + 0x188]
cmp rdx, 7
jbe 0x140004a67
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004a62
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b69
call fcn.140007c74
mov qword [rsp + 0x180], rdi
mov qword [rsp + 0x188], 7
mov word [rsp + 0x170], di
cmp rsi, 0xf
jbe 0x140004aba
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140004ab2
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004bd7
mov rcx, rbx
call fcn.140007c74
xor eax, eax
jmp 0x140003607
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x1b0]
lea rcx, str.exists
call fcn.140002990
nop
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x190]
lea rcx, str.exists
call fcn.140002990
nop
shr rbx, 0x20
lea r8, [rsp + 0x190]
mov edx, ebx
call fcn.1400028a0
nop
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x190]
lea rcx, str.exists
call fcn.140002990
nop
shr rbx, 0x20
lea r8, [rsp + 0x30]
mov edx, ebx
call fcn.1400028a0
nop
shr rdx, 0x20
lea r9, [rsp + 0x150]
lea r8, [rsp + 0x30]
call fcn.140002910
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x1c0]
lea rcx, str.remove_all
call fcn.140002990
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x1c0]
lea rcx, str.remove_all
call fcn.140002990
int3