Function at 0x14000fb30
Capabilities:
Execute command
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x1400aa0c0]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor edi, edi
call fcn.140004370
call fcn.140005060
lea rdx, str.Extreme_Spoof
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140013620
lea rdx, [0x1400137f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x1400137f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea r9d, [rdi + 0x31]
lea r8, str.Garf_Spoofer
lea rdx, str.Do_not_close_Garf_Spoofer_before_the_spoofing_process_is_finished._Read_the_spoofing_instructions_first._If_spoofing_takes_longer_than_expected_contact_support.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x14001010e
call fcn.1400057c0
call fcn.1400058f0
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
mov qword [rbp + 0x17], rdi
mov qword [rbp + 0x1f], rdi
lea r8d, [rdi + 7]
lea rdx, str.3.05.04
lea rcx, [rbp + 7]
call fcn.140014cd0
nop
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.140012780
mov rcx, rax
call fcn.14000c730
call fcn.140084864
lea rsi, str.C:WindowsSystem32GarfBios.rom
mov qword [rbp - 0x59], rsi
mov qword [rbp - 0x51], reloc.WLDAP32.dll_Ordinal_33
lea r8, [rbp - 0x59]
mov edx, eax
lea rcx, [rbp - 0x39]
call fcn.140002740
nop
lea rcx, [rbp - 0x39]
call fcn.140003e90
movzx ebx, al
mov rdx, qword [rbp - 0x21]
cmp rdx, 7
jbe 0x14000fc7e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fc79
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000fc79
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140085540
test bl, bl
jne 0x14000fcc3
call fcn.1400056b0
lea rdx, str.e_91mYour_device_is_not_eligible_for_deep_spoofing._Error_code:_1._Press_any_key_to_close_Garf_Spoofer.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140013620
lea rdx, [0x1400137f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.PAUSE__NUL_2_NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movzx ebx, byte [0x1400ab474]
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x49], rdi
mov qword [rbp - 0x41], rdi
mov r8d, reloc.WLDAP32.dll_Ordinal_33
mov rdx, rsi
lea rcx, [rbp - 0x59]
call fcn.140014cd0
movzx r8d, bl
xor edx, edx
lea rcx, [rbp - 0x59]
call fcn.14000ca00
lea rdx, str.e_96mSpoofing...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140013620
lea rdx, [0x1400137f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov r13, qword [rbp + 0x17]
sub rax, r13
cmp rax, 0x1d
jb 0x14001013b
lea r12, [rbp + 7]
mov rsi, qword [rbp + 7]
mov r14, qword [rbp + 0x1f]
cmp r14, 0xf
cmova r12, rsi
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x49], xmm1
lea r15, [r13 + 0x1d]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rbp - 0x59]
cmp r15, rbx
jbe 0x14000fdec
mov rbx, r15
or rbx, 0xf
cmp rbx, rcx
jbe 0x14000fda8
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140085350
test rax, rax
je 0x14000fdd0
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000fde8
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000fdd7
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140010141
jmp 0x14000fd8d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14000fde6
call fcn.140085350
mov rdi, rax
jmp 0x14000fde8
xor edi, edi
mov qword [rbp - 0x59], rdi
mov qword [rbp - 0x49], r15
mov qword [rbp - 0x41], rbx
movups xmm0, xmmword [str.C:WindowsSystem32GarfAFU_]
movups xmmword [rdi], xmm0
movsd xmm0, qword [0x1400991b8]
movsd qword [rdi + 0x10], xmm0
mov eax, dword [0x1400991c0]
mov dword [rdi + 0x18], eax
movzx eax, byte [0x1400991c4]
mov byte [rdi + 0x1c], al
lea rcx, [rdi + 0x1d]
mov r8, r13
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r15], 0
mov r8d, 0x42
lea rdx, str.AFUWINx64.exe__C:WindowsSystem32GarfBios.rom___GAN__NUL_2_NUL
lea rcx, [rbp - 0x59]
call fcn.140013110
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x19], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 9], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp - 0x41]
cmp rdx, 0xf
jbe 0x14000feb7
inc rdx
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000feb2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000feb2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140085540
movdqa xmm0, xmmword [0x14009c2b0]
movdqu xmmword [rbp - 0x49], xmm0
mov byte [rbp - 0x59], 0
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova rcx, qword [rbp - 0x19]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ebx, eax
test eax, eax
je 0x14000ff3d
call fcn.1400056b0
lea rdx, str.e_91mYour_device_is_not_eligible_for_deep_spoofing._Error_code:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140013620
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, str.._Press_any_key_to_close_Garf_Spoofer.
call fcn.140013620
lea rdx, [0x1400137f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.PAUSE__NUL_2_NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.e_92m_1__Spoofed.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140013620
lea rdx, [0x1400137f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.1400082b0
call fcn.140009600
call fcn.14000a630
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x14000ff8e
lea rcx, str.BCDEDIT__SET_hypervisorlaunchtype_off__NUL_2_NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._5__TPM_bypassed.
jmp 0x14000ff95
lea rdx, str.e_91m_5__TPM_bypass_skipped.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140013620
lea rdx, [0x1400137f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x1400137f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.e_96mCleaning_up...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140013620
lea rdx, [0x1400137f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.1400056b0
lea rdx, str.e_92mCleaned_up.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140013620
lea rdx, [0x1400137f0]
invalid
add byte [rax], al
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x1400137f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.e_95mSpoofing_finished.
call fcn.140013620
lea rdx, [0x1400137f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x1400137f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.e_93mPress_any_key_to_restart_your_device.
call fcn.140013620
lea rdx, [0x1400137f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.PAUSE__NUL_2_NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.SHUTDOWN__r__f__t_0__NUL_2_NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x1400100c3
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400100be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400100be
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140085540
movdqa xmm0, xmmword [0x14009c2b0]
movdqu xmmword [rbp - 9], xmm0
mov byte [rbp - 0x19], 0
cmp r14, 0xf
jbe 0x14001010e
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140010106
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140010106
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140085540
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140085210
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001f40
nop
call fcn.140001ea0
int3