Function at 0x140001200
Capabilities:
Encode data using xor
Execute command
Terminate process

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140005040]
xor rax, rsp
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
lea rdx, [rsp + 0x40]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r8d, dword [rsp + 0x44]
mov r9d, 0x320
mov edx, dword [rsp + 0x40]
mov rcx, rbx
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x258
call qword [sym.imp.USER32.dll_MoveWindow]
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x1400034a4]
call fcn.140001490
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140001020]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.____F1__BYPASS_VANGUARD__VGK__VGC_
call fcn.140001490
lea rdx, [0x140001660]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140001020]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.____F2__Check_status_VGC__VGK
call fcn.140001490
lea rdx, [0x140001660]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140001020]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.____F3__Exit
call fcn.140001490
lea rdx, [0x140001660]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_conio_l1_1_0.dll__getch]
test al, al
jne 0x140001310
call qword [sym.imp.api_ms_win_crt_conio_l1_1_0.dll__getch]
movsx eax, al
sub eax, 0x3b
je 0x14000134d
sub eax, 1
je 0x1400013e6
cmp eax, 1
jne 0x140001310
mov edx, 0x1f4
lea ecx, [rdx - 0x64]
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov edx, 0x1f4
lea ecx, [rdx - 0x64]
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, [0x140003500]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_config_vgc_start_disabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_config_vgk_start_disabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_vgc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_vgk
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__IM_vgtray.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r9d, 0x20
lea r8, str.BYPASS
lea rdx, str.Done_bypassing_vgc__vgk
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov r9d, 0x20
lea r8, str.ADMIN
lea rdx, str.You_need_to_reebot_restart__optional_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140001310
mov edx, 0x1f4
lea ecx, [rdx - 0x64]
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, [0x140003500]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_query_vgc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_query_vgk
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n_n_Press_any_bind_to_back._._.
call fcn.140001490
xor ecx, ecx
mov dword [rsp + 0x30], 0x787f6858
mov dword [rsp + 0x34], 0x61302d69
mov dword [rsp + 0x38], 0x1007d65
nop dword [rax + rax]
lea eax, [rcx + 8]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0xa
jb 0x140001450
lea rcx, [rsp + 0x30]
mov byte [rsp + 0x3b], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140003500]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x140001260