Function at 0x1400825b0
Capabilities:
Capture network configuration via ipconfig
Enumerate device drivers on windows
Execute command

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x6a8]
sub rsp, 0x790
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
movaps xmmword [rax - 0x58], xmm9
movaps xmmword [rax - 0x68], xmm10
movaps xmmword [rax - 0x78], xmm11
movaps xmmword [rax - 0x88], xmm12
movaps xmmword [rax - 0x98], xmm13
movaps xmmword [rax - 0xa8], xmm14
movaps xmmword [rax - 0xb8], xmm15
mov rax, qword [0x1400e6210]
xor rax, rsp
mov qword [rbp + 0x5e8], rax
mov rsi, qword [0x1400e6b50]
mov qword [rsp + 0x30], 0x41b58ab3
lea rax, str.47_32_96_4_info_48_48_3_msg_64_16_8_commands_80_32_18_compiler_temporary_96_32_18_compiler_temporary_112_32_18_compiler_temporary_128_32_18_compiler_temporary_144_1_4_done_160_8_10_windowSize_176_8_18_compiler_temporary_192_8_18_compiler_temporary_208_8_18_compiler_temporary_224_8_18_compiler_temporary_240_8_18_compiler_temporary_256_32_18_compiler_temporary_272_8_18_compiler_temporary_288_8_18_compiler_temporary_304_8_18_compiler_temporary_320_32_18_compiler_temporary_336_8_18_compiler_temporary_352_8_18_compiler_temporary_368_8_18_compiler_temporary_384_32_18_compiler_temporary_400_8_18_compiler_temporary_416_8_18_compiler_temporary_432_8_18_compiler_temporary_448_32_18_compiler_temporary_464_8_18_compiler_temporary_480_8_18_compiler_temporary_496_8_18_compiler_temporary_512_32_18_compiler_temporary_528_8_18_compiler_temporary_544_8_18_compiler_temporary_560_8_18_compiler_temporary_576_32_18_compiler_temporary_592_8_18_compiler_temporary_608_8_18_compiler_temporary_624_8_18_compiler_temporary_640_32_18_compiler_temporary_656_8_18_compiler_temporary_672_8_18_compiler_temporary_688_8_18_compiler_temporary_704_32_18_compiler_temporary_720_8_18_compiler_temporary_736_8_18_compiler_temporary_752_8_18_compiler_temporary_768_32_18_compiler_temporary_
mov qword [rsp + 0x38], rax
lea rax, [fcn.1400825b0]
mov qword [rsp + 0x40], rax
lea rdi, [rsp + 0x30]
shr rdi, 3
add rdi, rsi
mov dword [rdi], 0xf1f1f1f1
mov edx, recv
lea rcx, [rdi + 4]
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_set_shadow_00
mov dword [rdi + 0x10], 0xf2f2f2f2
mov edx, 6
lea rcx, [rdi + 0x14]
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_set_shadow_00
mov dword [rdi + 0x1a], 0xf2f2f2f2
mov dword [rdi + 0x1e], 0xf2f20000
mov dword [rdi + 0x22], 0xf8f8f2f2
mov dword [rdi + 0x26], 0xf2f2f8f8
mov dword [rdi + 0x2a], 0xf8f8f2f2
mov dword [rdi + 0x2e], 0xf2f2f8f8
mov dword [rdi + 0x32], 0xf8f8f2f2
mov dword [rdi + 0x36], 0xf2f2f8f8
mov dword [rdi + 0x3a], 0xf8f8f2f2
mov dword [rdi + 0x3e], 0xf2f2f8f8
mov dword [rdi + 0x42], 0xf201f2f2
mov dword [rdi + 0x46], 0xf2f8f2f8
mov dword [rdi + 0x4a], 0xf2f8f2f8
mov dword [rdi + 0x4e], 0xf2f8f2f8
mov dword [rdi + 0x52], 0xf8f8f8f8
mov dword [rdi + 0x56], 0xf2f2f2f2
mov dword [rdi + 0x5a], 0xf2f8f2f8
mov dword [rdi + 0x5e], 0xf8f8f2f8
mov dword [rdi + 0x62], 0xf2f2f8f8
mov dword [rdi + 0x66], 0xf2f8f2f2
mov dword [rdi + 0x6a], 0xf2f8f2f8
mov dword [rdi + 0x6e], 0xf8f8f8f8
mov dword [rdi + 0x72], 0xf2f2f2f2
mov dword [rdi + 0x76], 0xf2f8f2f8
mov dword [rdi + 0x7a], 0xf8f8f2f8
mov dword [rdi + 0x7e], 0xf2f2f8f8
mov dword [rdi + 0x82], 0xf2f8f2f2
mov dword [rdi + 0x86], 0xf2f8f2f8
mov dword [rdi + 0x8a], 0xf8f8f8f8
mov dword [rdi + 0x8e], 0xf2f2f2f2
mov dword [rdi + 0x92], 0xf2f8f2f8
mov dword [rdi + 0x96], 0xf8f8f2f8
mov dword [rdi + 0x9a], 0xf2f2f8f8
mov dword [rdi + 0x9e], 0xf2f8f2f2
mov dword [rdi + 0xa2], 0xf2f8f2f8
mov dword [rdi + 0xa6], 0xf8f8f8f8
mov dword [rdi + 0xaa], 0xf2f2f2f2
mov dword [rdi + 0xae], 0xf2f8f2f8
mov dword [rdi + 0xb2], 0xf8f8f2f8
mov dword [rdi + 0xb6], 0xf2f2f8f8
mov dword [rdi + 0xba], 0xf2f8f2f2
mov dword [rdi + 0xbe], 0xf2f8f2f8
mov dword [rdi + 0xc2], 0xf8f8f8f8
mov dword [rdi + 0xc6], 0xf3f3f3f3
lea rcx, [rbp + 0x50]
shr rcx, 3
add rcx, rsi
mov edx, 4
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_set_shadow_00
lea rcx, [rbp + 0x90]
shr rcx, 3
add rcx, rsi
mov edx, 4
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_set_shadow_00
lea rcx, [rbp + 0xd0]
shr rcx, 3
add rcx, rsi
mov edx, 4
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_set_shadow_00
lea rcx, [rbp + 0x110]
shr rcx, 3
add rcx, rsi
mov edx, 4
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_set_shadow_00
lea rcx, [rsp + 0x50]
call fcn.140075380
nop
lea rcx, [rbp + 0x20]
call fcn.140083770
lea rcx, [rbp + 0x20]
call fcn.140083960
nop
lea rdx, [rbp + 0x50]
call fcn.14007f710
mov rdx, rax
call fcn.140080080
lea rcx, [rbp + 0x50]
shr rcx, 3
add rcx, rsi
mov edx, 4
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_set_shadow_f8
lea rdx, [rbp + 0x90]
lea rcx, [rsp + 0x50]
call fcn.14007f990
mov rdx, rax
call fcn.140080080
lea rcx, [rbp + 0x90]
shr rcx, 3
add rcx, rsi
mov edx, 4
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_set_shadow_f8
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x50]
call fcn.14007f820
mov rdx, rax
call fcn.140080080
lea rcx, [rbp + 0xd0]
shr rcx, 3
add rcx, rsi
mov edx, 4
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_set_shadow_f8
lea rdx, str.Welcome_to_the_Daulaires_CLI_Tool_
lea rcx, [rbp + 0x110]
call fcn.1400019f0
mov rdx, rax
call fcn.140080080
lea rcx, [rbp + 0x110]
shr rcx, 3
add rcx, rsi
mov edx, 4
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_set_shadow_f8
mov ecx, 0x80
call fcn.140084920
mov rbx, rax
test rax, rax
je 0x140082959
mov rcx, rax
call fcn.140083780
xor edx, edx
lea r9d, [rdx + 8]
lea r8d, [r9 + 0x78]
mov rcx, rbx
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_memset
mov rcx, rbx
call fcn.140083630
mov r15, rax
jmp 0x14008295c
xor r15d, r15d
mov rcx, r15
call fcn.1400800e0
xor r14b, r14b
mov byte [rbp + 0x150], r14b
mov r12d, 1
movss xmm6, dword [0x1400cd31c]
movss xmm7, dword [0x1400cd1d8]
movss xmm12, dword [0x1400cd250]
movss xmm8, dword [0x1400cd1dc]
movss xmm13, dword [0x1400cd220]
movss xmm14, dword [0x1400cd234]
movss xmm9, dword [0x1400cd204]
movss xmm10, dword [0x1400cd1f0]
movss xmm15, dword [0x1400cd1fc]
movss xmm11, dword [0x1400cd1ec]
nop dword [rax]
lea rcx, [rbp - 0x30]
shr rcx, 3
add rcx, rsi
mov edx, 6
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_set_shadow_00
lea rax, [rbp + 0x160]
shr rax, 3
mov byte [rax + rsi], 0
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140082a5b
nop
lea rcx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rbp - 0x28]
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_load4
movzx r14d, r14b
cmp dword [rbp - 0x28], 0x12
cmove r14d, r12d
mov byte [rbp + 0x150], r14b
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x140082a10
test r14b, r14b
jne 0x140083624
lea rax, [rbp + 0x170]
shr rax, 3
mov byte [rax + rsi], r14b
lea rax, [rbp + 0x180]
shr rax, 3
mov byte [rax + rsi], r14b
mov rcx, r15
call fcn.140080e90
call fcn.1400080a0
call fcn.1400093c0
call fcn.14001ae90
call fcn.140019960
lea rdx, [rax + 8]
mov r8d, 8
lea rcx, [rbp + 0x160]
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_memcpy
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x170]
call fcn.1400052a0
mov rbx, rax
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x180]
call fcn.1400052a0
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.14002a990
lea rax, [rbp + 0x170]
shr rax, 3
mov byte [rax + rsi], pe_nt_image_headers64
lea rax, [rbp + 0x180]
shr rax, 3
mov byte [rax + rsi], pe_nt_image_headers64
xor edx, edx
lea rcx, [rbp + 0x160]
call fcn.14002aa90
call fcn.1400812e0
xor edx, edx
mov r8d, 0x2422
lea rcx, str.Home
call fcn.140023ad0
test al, al
je 0x14008360d
call fcn.14006a840
test al, al
je 0x140082b65
call fcn.14006c320
test al, al
je 0x140082b60
lea r8, [rbp + 0x150]
call fcn.14006cbe0
call fcn.14006c340
movzx r14d, byte [rbp + 0x150]
call fcn.14006ad70
lea rax, [rbp + 0x190]
shr rax, 3
mov byte [rax + rsi], 0
lea rax, [rbp + 0x1a0]
shr rax, 3
mov byte [rax + rsi], 0
lea rax, [rbp + 0x1b0]
shr rax, 3
mov byte [rax + rsi], 0
movss dword [rsp + 0x20], xmm6
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ShowServices
lea rcx, [rbp + 0x1a0]
call fcn.14001dea0
mov rdi, rax
lea rcx, [rbp + 0x190]
call fcn.14002a390
mov rbx, rax
lea rcx, [rdi + 4]
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_load4
lea rcx, [rbx + 4]
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_load4
movss xmm0, dword [rdi + 4]
addss xmm0, dword [rbx + 4]
mulss xmm0, xmm7
call fcn.140030880
lea rax, [rbp + 0x190]
shr rax, 3
mov byte [rax + rsi], pe_nt_image_headers64
lea rax, [rbp + 0x1a0]
shr rax, 3
mov byte [rax + rsi], pe_nt_image_headers64
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x1b0]
call fcn.1400052a0
mov rdx, rax
lea rcx, str.Show_Services
call fcn.140068260
test al, al
je 0x140082c8e
lea rcx, [rbp + 0x1c0]
shr rcx, 3
add rcx, rsi
mov edx, 4
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_set_shadow_00
lea rdx, str.Launching_sc_query...
lea rcx, [rbp + 0x1c0]
call fcn.1400019f0
mov rdx, rax
call fcn.140080080
lea rcx, [rbp + 0x1c0]
shr rcx, 3
add rcx, rsi
mov edx, 4
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_set_shadow_f8
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.c:windows_system32_sc.exe_query
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rbp + 0x200]
shr rax, 3
mov byte [rax + rsi], 0
lea rax, [rbp + 0x210]
shr rax, 3
mov byte [rax + rsi], 0
lea rax, [rbp + 0x220]
shr rax, 3
mov byte [rax + rsi], 0
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.140030580
lea rcx, [rbp + 0x200]
call fcn.14002a390
mov rdi, rax
movss dword [rsp + 0x20], xmm6
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ShowDrivers
lea rcx, [rbp + 0x210]
call fcn.14001dea0
mov rbx, rax
lea rcx, [rdi + 4]
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_load4
lea rcx, [rbx + 4]
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_load4
movss xmm0, dword [rdi + 4]
subss xmm0, dword [rbx + 4]
mulss xmm0, xmm12
call fcn.140030880
lea rax, [rbp + 0x200]
shr rax, 3
mov byte [rax + rsi], pe_nt_image_headers64
lea rax, [rbp + 0x210]
shr rax, 3
mov byte [rax + rsi], pe_nt_image_headers64
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x220]
call fcn.1400052a0
mov rdx, rax
lea rcx, str.Show_Drivers
call fcn.140068260
test al, al
je 0x140082dbb
lea rcx, [rbp + 0x230]
shr rcx, 3
add rcx, rsi
mov edx, 4
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_set_shadow_00
lea rdx, str.Launching_driverquery...
lea rcx, [rbp + 0x230]
call fcn.1400019f0
mov rdx, rax
call fcn.140080080
lea rcx, [rbp + 0x230]
shr rcx, 3
add rcx, rsi
mov edx, 4
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_set_shadow_f8
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14007fb00
lea rax, [rbp + 0x270]
shr rax, 3
mov byte [rax + rsi], 0
lea rax, [rbp + 0x280]
shr rax, 3
mov byte [rax + rsi], 0
lea rax, [rbp + 0x290]
shr rax, 3
mov byte [rax + rsi], 0
movss dword [rsp + 0x20], xmm6
xor r9d, r9d
xor r8d, r8d
lea rdx, str.netstat
lea rcx, [rbp + 0x280]
call fcn.14001dea0
mov rdi, rax
lea rcx, [rbp + 0x270]
call fcn.14002a390
mov rbx, rax
lea rcx, [rdi + 4]
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_load4
lea rcx, [rbx + 4]
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_load4
movss xmm0, dword [rdi + 4]
addss xmm0, dword [rbx + 4]
mulss xmm0, xmm8
call fcn.140030880
lea rax, [rbp + 0x270]
shr rax, 3
mov byte [rax + rsi], pe_nt_image_headers64
lea rax, [rbp + 0x280]
shr rax, 3
mov byte [rax + rsi], pe_nt_image_headers64
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x290]
call fcn.1400052a0
mov rdx, rax
lea rcx, str.netstat
call fcn.140068260
test al, al
je 0x140082ee5
lea rcx, [rbp + 0x2a0]
shr rcx, 3
add rcx, rsi
mov edx, 4
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_set_shadow_00
lea rdx, str.Launching_netstat...
lea rcx, [rbp + 0x2a0]
call fcn.1400019f0
mov rdx, rax
call fcn.140080080
lea rcx, [rbp + 0x2a0]
shr rcx, 3
add rcx, rsi
mov edx, 4
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_set_shadow_f8
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.c:windows_system32_netstat.exe__ano
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rbp + 0x2e0]
shr rax, 3
mov byte [rax + rsi], 0
lea rax, [rbp + 0x2f0]
shr rax, 3
mov byte [rax + rsi], 0
lea rax, [rbp + 0x300]
shr rax, 3
mov byte [rax + rsi], 0
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.140030580
lea rcx, [rbp + 0x2e0]
call fcn.14002a390
mov rdi, rax
movss dword [rsp + 0x20], xmm6
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1400cbcc0]
lea rcx, [rbp + 0x2f0]
call fcn.14001dea0
mov rbx, rax
lea rcx, [rdi + 4]
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_load4
lea rcx, [rbx + 4]
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_load4
movss xmm0, dword [rdi + 4]
subss xmm0, dword [rbx + 4]
mulss xmm0, xmm13
call fcn.140030880
lea rax, [rbp + 0x2e0]
shr rax, 3
mov byte [rax + rsi], pe_nt_image_headers64
lea rax, [rbp + 0x2f0]
shr rax, 3
mov byte [rax + rsi], pe_nt_image_headers64
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x300]
call fcn.1400052a0
mov rdx, rax
lea rcx, [0x1400cbcc0]
call fcn.140068260
test al, al
je 0x140083012
lea rcx, [rbp + 0x310]
shr rcx, 3
add rcx, rsi
mov edx, 4
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_set_shadow_00
lea rdx, str.Launching_cmd...
lea rcx, [rbp + 0x310]
call fcn.1400019f0
mov rdx, rax
call fcn.140080080
lea rcx, [rbp + 0x310]
shr rcx, 3
add rcx, rsi
mov edx, 4
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_set_shadow_f8
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14007ef90
lea rax, [rbp + 0x350]
shr rax, 3
mov byte [rax + rsi], 0
lea rax, [rbp + 0x360]
shr rax, 3
mov byte [rax + rsi], 0
lea rax, [rbp + 0x370]
shr rax, 3
mov byte [rax + rsi], 0
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.140030580
movss dword [rsp + 0x20], xmm6
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ipconfig
lea rcx, [rbp + 0x360]
call fcn.14001dea0
mov rdi, rax
lea rcx, [rbp + 0x350]
call fcn.14002a390
mov rbx, rax
lea rcx, [rdi + 4]
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_load4
lea rcx, [rbx + 4]
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_load4
movss xmm0, dword [rdi + 4]
addss xmm0, dword [rbx + 4]
mulss xmm0, xmm14
call fcn.140030880
lea rax, [rbp + 0x350]
shr rax, 3
mov byte [rax + rsi], pe_nt_image_headers64
lea rax, [rbp + 0x360]
shr rax, 3
mov byte [rax + rsi], pe_nt_image_headers64
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x370]
call fcn.1400052a0
mov rdx, rax
lea rcx, str.ipconfig
call fcn.140068260
test al, al
je 0x140083147
lea rcx, [rbp + 0x380]
shr rcx, 3
add rcx, rsi
mov edx, 4
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_set_shadow_00
lea rdx, str.Launching_ipconfig...
lea rcx, [rbp + 0x380]
call fcn.1400019f0
mov rdx, rax
call fcn.140080080
lea rcx, [rbp + 0x380]
shr rcx, 3
add rcx, rsi
mov edx, 4
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_set_shadow_f8
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.c:windows_system32ipconfig.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rbp + 0x3c0]
shr rax, 3
mov byte [rax + rsi], 0
lea rax, [rbp + 0x3d0]
shr rax, 3
mov byte [rax + rsi], 0
lea rax, [rbp + 0x3e0]
shr rax, 3
mov byte [rax + rsi], 0
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.140030580
lea rcx, [rbp + 0x3c0]
call fcn.14002a390
mov rdi, rax
movss dword [rsp + 0x20], xmm6
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1400cc080]
lea rcx, [rbp + 0x3d0]
call fcn.14001dea0
mov rbx, rax
mov rcx, rdi
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_load4
mov rcx, rbx
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_load4
movss xmm0, dword [rdi]
subss xmm0, dword [rbx]
mulss xmm0, xmm9
call fcn.140030880
lea rax, [rbp + 0x3c0]
shr rax, 3
mov byte [rax + rsi], pe_nt_image_headers64
lea rax, [rbp + 0x3d0]
shr rax, 3
mov byte [rax + rsi], pe_nt_image_headers64
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x3e0]
call fcn.1400052a0
mov rdx, rax
lea rcx, [0x1400cc080]
call fcn.140068260
test al, al
je 0x140083278
lea rcx, [rbp + 0x3f0]
shr rcx, 3
add rcx, rsi
mov edx, 4
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_set_shadow_00
lea rdx, str.Launching_net...
lea rcx, [rbp + 0x3f0]
call fcn.1400019f0
mov rdx, rax
call fcn.140080080
lea rcx, [rbp + 0x3f0]
shr rcx, 3
add rcx, rsi
mov edx, 4
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_set_shadow_f8
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.c:windows_system32_net.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rbp + 0x430]
shr rax, 3
mov byte [rax + rsi], 0
lea rax, [rbp + 0x440]
shr rax, 3
mov byte [rax + rsi], 0
lea rax, [rbp + 0x450]
shr rax, 3
mov byte [rax + rsi], 0
lea rcx, [rbp + 0x430]
call fcn.14002a390
mov rdi, rax
movss dword [rsp + 0x20], xmm6
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1400cc2c0]
lea rcx, [rbp + 0x440]
call fcn.14001dea0
mov rbx, rax
lea rcx, [rdi + 4]
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_load4
lea rcx, [rbx + 4]
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_load4
movss xmm0, dword [rdi + 4]
subss xmm0, dword [rbx + 4]
mulss xmm0, xmm10
call fcn.140030880
lea rax, [rbp + 0x430]
shr rax, 3
mov byte [rax + rsi], pe_nt_image_headers64
lea rax, [rbp + 0x440]
shr rax, 3
mov byte [rax + rsi], pe_nt_image_headers64
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x450]
call fcn.1400052a0
mov rdx, rax
lea rcx, [0x1400cc2c0]
call fcn.140068260
test al, al
je 0x1400833a2
lea rcx, [rbp + 0x460]
shr rcx, 3
add rcx, rsi
mov edx, 4
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_set_shadow_00
lea rdx, str.Launching_netstat...
lea rcx, [rbp + 0x460]
call fcn.1400019f0
mov rdx, rax
call fcn.140080080
lea rcx, [rbp + 0x460]
shr rcx, 3
add rcx, rsi
mov edx, 4
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_set_shadow_f8
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.c:windows_system32_arp.exe__a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rbp + 0x4a0]
shr rax, 3
mov byte [rax + rsi], 0
lea rax, [rbp + 0x4b0]
shr rax, 3
mov byte [rax + rsi], 0
lea rax, [rbp + 0x4c0]
shr rax, 3
mov byte [rax + rsi], 0
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.140030580
movss dword [rsp + 0x20], xmm6
xor r9d, r9d
xor r8d, r8d
lea rdx, str.tasklist
lea rcx, [rbp + 0x4b0]
call fcn.14001dea0
mov rdi, rax
lea rcx, [rbp + 0x4a0]
call fcn.14002a390
mov rbx, rax
lea rcx, [rdi + 4]
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_load4
lea rcx, [rbx + 4]
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_load4
movss xmm0, dword [rdi + 4]
addss xmm0, dword [rbx + 4]
mulss xmm0, xmm15
call fcn.140030880
lea rax, [rbp + 0x4a0]
shr rax, 3
mov byte [rax + rsi], pe_nt_image_headers64
lea rax, [rbp + 0x4b0]
shr rax, 3
mov byte [rax + rsi], pe_nt_image_headers64
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x4c0]
call fcn.1400052a0
mov rdx, rax
lea rcx, str.tasklist
call fcn.140068260
test al, al
je 0x1400834d7
lea rcx, [rbp + 0x4d0]
shr rcx, 3
add rcx, rsi
mov edx, 4
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_set_shadow_00
lea rdx, str.Launching_tasklist...
lea rcx, [rbp + 0x4d0]
call fcn.1400019f0
mov rdx, rax
call fcn.140080080
lea rcx, [rbp + 0x4d0]
shr rcx, 3
add rcx, rsi
mov edx, 4
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_set_shadow_f8
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.c:windows_system32_tasklist.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rbp + 0x510]
shr rax, 3
mov byte [rax + rsi], 0
lea rax, [rbp + 0x520]
shr rax, 3
mov byte [rax + rsi], 0
lea rax, [rbp + 0x530]
shr rax, 3
mov byte [rax + rsi], 0
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.140030580
lea rcx, [rbp + 0x510]
call fcn.14002a390
mov rdi, rax
movss dword [rsp + 0x20], xmm6
xor r9d, r9d
xor r8d, r8d
lea rdx, str.nslookup
lea rcx, [rbp + 0x520]
call fcn.14001dea0
mov rbx, rax
mov rcx, rdi
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_load4
mov rcx, rbx
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_load4
movss xmm0, dword [rdi]
subss xmm0, dword [rbx]
mulss xmm0, xmm11
call fcn.140030880
lea rax, [rbp + 0x510]
shr rax, 3
mov byte [rax + rsi], pe_nt_image_headers64
lea rax, [rbp + 0x520]
shr rax, 3
mov byte [rax + rsi], pe_nt_image_headers64
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x530]
call fcn.1400052a0
mov rdx, rax
lea rcx, str.nslookup
call fcn.140068260
test al, al
je 0x140083608
lea rcx, [rbp + 0x540]
shr rcx, 3
add rcx, rsi
mov edx, 4
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_set_shadow_00
lea rdx, str.Launching_nslookup...
lea rcx, [rbp + 0x540]
call fcn.1400019f0
mov rdx, rax
call fcn.140080080
lea rcx, [rbp + 0x540]
shr rcx, 3
add rcx, rsi
mov edx, 4
call sub.clang_rt.asan_dynamic_x86_64.dll___asan_set_shadow_f8
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.c:windows_system32_nslookup.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140028670
call fcn.14001d560
call fcn.14001da70
mov rcx, r15
call fcn.140081040
jmp 0x1400829d0
call fcn.140083790
int3