Function at 0x14000a3f0
Capabilities:
Delete file
Execute command
Get disk information
Schedule task via schtasks
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x358]
sub rsp, 0x430
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x1400af0c0]
xor rax, rsp
mov qword [rbp + 0x300], rax
xor r15d, r15d
movzx ebx, byte [reloc.WS2_32.dll_accept]
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r15
mov r14d, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0xb8], r14
mov byte [rbp + 0xa0], r15b
lea r9, str.REG_ADD__HKCUSoftwareSysinternalsVolumeId___v_EulaAccepted__t_REG_DWORD__d_1__f__NUL_2_NUL
lea edx, [r15 + 0x5d]
lea rcx, [rbp + 0xa0]
call fcn.140004c20
lea rcx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], r14
cmova rcx, qword [rbp + 0xa0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov r8d, eax
mov dword [rsp + 0x34], eax
test bl, bl
je 0x14000aafc
call fcn.1400890b4
lea rdi, str.C:WindowsSystem32_vdisk.vhdx
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], reloc.WLDAP32.dll_Ordinal_30
lea r8, [rsp + 0x40]
mov edx, eax
lea rcx, [rbp - 0x68]
call fcn.140002650
nop
lea rcx, [rbp - 0x68]
call fcn.140003120
movzx ebx, al
mov rdx, qword [rbp - 0x50]
cmp rdx, 7
jbe 0x14000a520
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a51b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000a51b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140089ab4
test bl, bl
je 0x14000a78a
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
test eax, eax
je 0x14000a55d
lea rdx, str.e_91mCreating_spoofed_disk_drive_failed._Make_sure_to_delete_all_prior_created_spoofed_disk_drives.e_92m
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004000
lea rdx, [0x1400041d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000aaf7
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x1f0]
call sub.VCRUNTIME140.dll_memset
mov r8d, 2
lea rdx, str.C:WindowsSystem32Script.txt
lea rcx, [rbp + 0x1f0]
call fcn.140006740
nop
lea rdx, str.create_vdisk_file_C:WindowsSystem32_vdisk.vhdx__maximum5000000_typeexpandable
lea rcx, [rbp + 0x1f0]
call fcn.140004000
lea rdx, [0x1400041d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.attach_vdisk
call fcn.140004000
lea rdx, [0x1400041d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.convert_gpt
call fcn.140004000
lea rdx, [0x1400041d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.create_partition_primary
call fcn.140004000
lea rdx, [0x1400041d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.format_fsntfs_quick
call fcn.140004000
lea rdx, [0x1400041d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.assign_letterX
call fcn.140004000
lea rdx, [0x1400041d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x14009de80]
call fcn.140004000
lea rcx, [rbp + 0x1f8]
call fcn.140006a10
test rax, rax
jne 0x14000a68b
mov rax, qword [rbp + 0x1f0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x1f0]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rcx, str.diskpart__s_C:WindowsSystem32Script.txt__NUL_2_NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.schtasks__create__tn__Attach_Disk___tr__C:WindowsSystem32Attach.exe___sc_onstart__ru_SYSTEM__rl_HIGHEST__f__NUL_2_NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
je 0x14000a6cd
lea rdx, str.e_91mAttachment_of_spoofed_disk_drive_failed.e_92m
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004000
lea rdx, [0x1400041d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rax, qword [rbp + 0x1f0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x1f0], rax
mov rax, qword [rbp + 0x1f0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x1ec], edx
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x1f8], rax
cmp qword [rbp + 0x278], 0
je 0x14000a74e
lea rcx, [rbp + 0x1f8]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rbp + 0x268]
cmp rax, rcx
jne 0x14000a74e
mov r9, qword [rbp + 0x288]
mov rdx, qword [rbp + 0x280]
mov r8, rdx
lea rcx, [rbp + 0x1f8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
cmp byte [rbp + 0x274], 0
je 0x14000a763
lea rcx, [rbp + 0x1f8]
call fcn.140006a10
lea rcx, [rbp + 0x1f8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x200]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x298]
jmp 0x14000aaf1
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0xe0]
call sub.VCRUNTIME140.dll_memset
mov r8d, 2
lea rdx, str.C:GarfScript.txt
lea rcx, [rbp + 0xe0]
call fcn.140006740
nop
lea rdx, str.create_vdisk_file_C:WindowsSystem32_vdisk.vhdx__maximum5000000_typeexpandable
lea rcx, [rbp + 0xe0]
call fcn.140004000
lea rdx, [0x1400041d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.attach_vdisk
call fcn.140004000
lea rdx, [0x1400041d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.convert_gpt
call fcn.140004000
lea rdx, [0x1400041d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.create_partition_primary
call fcn.140004000
lea rdx, [0x1400041d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.format_fsntfs_quick
call fcn.140004000
lea rdx, [0x1400041d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.assign_letterX
call fcn.140004000
lea rdx, [0x1400041d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x14009de80]
call fcn.140004000
lea rcx, [rbp + 0xe8]
call fcn.140006a10
test rax, rax
jne 0x14000a8b8
mov rax, qword [rbp + 0xe0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0xe0]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rcx, str.diskpart__s_C:GarfScript.txt__NUL_2_NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_h__C:WindowsSystem32_vdisk.vhdx___NUL_2_NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.1400890b4
lea rcx, str.C:WindowsSystem32Attach.exe
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], reloc.WLDAP32.dll_Ordinal_30
lea r8, [rsp + 0x40]
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.140002650
nop
call fcn.1400890b4
lea rcx, str.C:GarfOtherAttach.exe
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], Ordinal_27
lea r8, [rsp + 0x40]
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.140002650
nop
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rcx, qword [rsp + 0x50]
call fcn.1400898c0
test eax, eax
jne 0x14000b30b
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x14000a99d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a998
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000a998
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140089ab4
movdqa xmm0, xmmword [0x1400a17d0]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r15w
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x14000a9f5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a9f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000a9f0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140089ab4
lea rcx, str.attrib_h__C:WindowsSystem32Attach.exe___NUL_2_NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.schtasks__create__tn__Attach_Disk___tr__C:WindowsSystem32Attach.exe___sc_onstart__ru_SYSTEM__rl_HIGHEST__f__NUL_2_NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
je 0x14000aa37
lea rdx, str.e_91mAttachment_of_spoofed_disk_drive_failed.e_92m
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004000
lea rdx, [0x1400041d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rax, qword [rbp + 0xe0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0xe0], rax
mov rax, qword [rbp + 0xe0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0xdc], edx
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0xe8], rax
cmp qword [rbp + 0x168], 0
je 0x14000aaba
mov rax, qword [rbp + 0x100]
lea rcx, [rbp + 0x158]
cmp qword [rax], rcx
jne 0x14000aaba
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
mov qword [rax], rcx
mov rax, qword [rbp + 0x120]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp + 0x138]
mov dword [rax], edx
cmp byte [rbp + 0x164], 0
je 0x14000aacf
lea rcx, [rbp + 0xe8]
call fcn.140006a10
lea rcx, [rbp + 0xe8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xf0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x188]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov r8d, dword [rsp + 0x34]
mov al, 0x41
mov byte [rsp + 0x30], al
mov r12d, 1
movzx edi, byte [rsp + 0x30]
movzx ebx, byte [rsp + 0x30]
movzx esi, byte [rsp + 0x30]
nop word [rax + rax]
movsx edx, al
lea ecx, [rdx - 0x41]
movzx eax, cl
bt r8d, eax
jae 0x14000b1f1
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
movzx eax, dl
mov byte [rbp + 0xc0], al
mov byte [rbp + 0xc1], 0
mov edx, 4
lea rcx, [rbp + 0x60]
call fcn.140009fc0
mov qword [rsp + 0x40], rax
mov edx, 4
lea rcx, [rbp - 0x68]
call fcn.140009fc0
mov qword [rbp - 0x28], rax
movabs rdx, 0x7fffffffffffffff
mov rcx, rdx
sub rcx, r12
cmp rcx, 0x1b
jb 0x14000b305
lea r13, [rbp + 0xc0]
cmp r14, 0xf
cmova r13, qword [rbp + 0xc0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], r15
add r12, 0x1b
lea r15, [rsp + 0x70]
cmp r12, 0xf
jbe 0x14000ac48
mov r14, r12
or r14, 0xf
cmp r14, rdx
jbe 0x14000abeb
mov r14, rdx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x14000ac12
cmp r14, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb r14, rax
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x14000ac31
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000b31d
mov rcx, rax
call fcn.140089a70
test rax, rax
je 0x14000b28e
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x14000ac43
test rcx, rcx
je 0x14000ac40
call fcn.140089a70
mov r15, rax
jmp 0x14000ac43
xor r15d, r15d
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r14
movups xmm0, xmmword [str.C:GarfOtherVolumeid.exe]
movups xmmword [r15], xmm0
movsd xmm0, qword [0x14009e160]
movsd qword [r15 + 0x10], xmm0
movzx eax, word [0x14009e168]
mov word [r15 + 0x18], ax
movzx eax, byte [reloc.WLDAP32.dll_Ordinal_32]
mov byte [r15 + 0x1a], al
lea rcx, [r15 + 0x1b]
mov r8d, 1
mov rdx, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [r15 + r12], 0
mov r8d, 2
lea rdx, [0x14009c7f8]
lea rcx, [rsp + 0x70]
call fcn.140003d00
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x38], xmm1
mov r14d, reloc.WS2_32.dll_ntohs
mov qword [rax + 0x18], r14
xor r15d, r15d
mov qword [rax + 0x10], r15
mov byte [rax], r15b
mov r9, qword [rbp - 0x28]
lea r8, [rbp - 0x48]
movzx edx, sil
lea rcx, [rbp]
call fcn.140012e60
nop
lea r8d, [r14 - 0xe]
lea rdx, reloc.WLDAP32.dll_Ordinal_45
lea rcx, [rbp]
call fcn.140003d00
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x50], xmm1
mov qword [rax + 0x18], r14
mov qword [rax + 0x10], r15
mov byte [rax], r15b
mov r9, qword [rsp + 0x40]
lea r8, [rbp + 0x40]
movzx edx, dil
lea rcx, [rbp - 0x20]
call fcn.140012e60
nop
lea r8d, [r14 + 6]
lea rdx, str.__nobanner__NUL_2_NUL
lea rcx, [rbp - 0x20]
call fcn.140003d00
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], r14
mov byte [rax], r15b
mov rdx, qword [rbp + 0xb8]
cmp rdx, r14
jbe 0x14000ad92
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ad8d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b26b
call fcn.140089ab4
movups xmmword [rbp + 0xa0], xmm6
movups xmmword [rbp + 0xb0], xmm7
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14000addb
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000add6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b272
call fcn.140089ab4
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], r14
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x14000ae23
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ae1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b279
call fcn.140089ab4
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x14000ae5e
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ae59
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b280
call fcn.140089ab4
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], r14
mov byte [rbp], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x14000aea6
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000aea0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b287
call fcn.140089ab4
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x14000aee2
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000aedd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b28e
call fcn.140089ab4
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], r14
mov byte [rsp + 0x70], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x14000af2a
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000af25
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b295
call fcn.140089ab4
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], r14
mov byte [rbp - 0x68], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x14000af71
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000af6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b29c
call fcn.140089ab4
lea rcx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0xf
cmova rcx, qword [rbp + 0xa0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 8
lea rcx, [rbp + 0x80]
call fcn.140009fc0
mov qword [rsp + 0x40], rax
lea r13, [rbp + 0xc0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov edx, 1
lea r12, [rdx + 6]
lea r15, [rsp + 0x50]
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r14
mov eax, dword [str.LABEL]
mov dword [r15], eax
movzx eax, word [0x14009e180]
mov word [r15 + 4], ax
lea rcx, [r15 + 6]
mov r8d, edx
mov rdx, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [r15 + r12], 0
mov r8d, 2
lea rdx, [0x14009c7f8]
lea rcx, [rsp + 0x50]
call fcn.140003d00
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x38], xmm1
mov r14d, reloc.WS2_32.dll_ntohs
mov qword [rax + 0x18], r14
xor r15d, r15d
mov qword [rax + 0x10], r15
mov byte [rax], r15b
mov r9, qword [rsp + 0x40]
lea r8, [rbp - 0x48]
movzx edx, bl
lea rcx, [rbp + 0x20]
call fcn.140012e60
nop
lea r8d, [r14 - 4]
lea rdx, str.__NUL_2_NUL
lea rcx, [rbp + 0x20]
call fcn.140003d00
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], r14
mov byte [rax], r15b
mov rdx, qword [rbp + 0xb8]
cmp rdx, r14
jbe 0x14000b0aa
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b0a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b2a3
call fcn.140089ab4
movups xmmword [rbp + 0xa0], xmm6
movups xmmword [rbp + 0xb0], xmm7
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x14000b0f3
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b0ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b2aa
call fcn.140089ab4
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], r14
mov byte [rbp + 0x20], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x14000b13b
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b135
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b2b1
call fcn.140089ab4
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14000b178
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b173
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b2b8
call fcn.140089ab4
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r14
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x14000b1c8
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b1c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b2bf
call fcn.140089ab4
lea rcx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0xf
cmova rcx, qword [rbp + 0xa0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov r8d, dword [rsp + 0x34]
mov r12d, 1
movzx eax, byte [rsp + 0x30]
inc al
mov byte [rsp + 0x30], al
cmp al, 0x5a
jle 0x14000ab20
lea rdx, str._2__Spoofed.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004000
lea rdx, [0x1400041d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x14000b2cb
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b2c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b2c6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140089ab4
mov rcx, qword [rbp + 0x300]
xor rcx, rsp
call fcn.140089a50
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001f40
nop
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x50]
mov edx, eax
call fcn.140007b70
nop
call fcn.140001ea0
int3