Function at 0x140002ab0
Capabilities:
Delete file
Execute command

Disassembly:
sub rsp, 0x48
lea rcx, [0x140084884]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._n_Spoofing..._n_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400060d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.140071780
mov qword [rsp + 0x20], rax
movdqa xmm0, xmmword [reloc.WLDAP32.dll_Ordinal_26]
movdqu xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [str.C:WindowsSystem32dr.sys]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1400848a8]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x1400848b0]
mov word [rax + 0x18], cx
mov byte [rax + 0x1a], 0
mov r8d, 0x67df8
lea rdx, [0x1403be8e0]
lea rcx, [rsp + 0x20]
call fcn.140002740
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140002b80
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b7b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002b7b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400719fc
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.140071780
mov qword [rsp + 0x20], rax
movdqa xmm0, xmmword [reloc.WLDAP32.dll_Ordinal_26]
movdqu xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [str.C:WindowsSystem32mp.exe]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1400848c8]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x1400848d0]
mov word [rax + 0x18], cx
mov byte [rax + 0x1a], 0
mov r8d, 0x84800
lea rdx, [0x140426f00]
lea rcx, [rsp + 0x20]
call fcn.140002740
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140002c2c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c27
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002c27
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400719fc
lea rcx, str.C:WindowsSystem32mp.exe_C:WindowsSystem32dr.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem32dr.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:WindowsSystem32mp.exe
add rsp, 0x48
jmp qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
and byte [rdi], sil
cmp dword [rax], esp
invalid
and byte [rsi], dh
xor esp, dword [rax]
xor eax, 0x33352043
and byte [rdx], dh
and byte [rbx], r14b
xor dword [rax], esp
xor al, byte [rax + riz + 0x33]
xor eax, 0x20443220
xor esi, dword [rdx]
and byte [rbx], dh
xor dword [rax], esp
xor al, byte [rax + riz + 0x33]
xor ah, byte [rax]
xor esi, dword [0x160438c2f]
xor esi, dword [rdx]
and byte [rbx], dh
xor esp, dword [rax]
xor edi, dword [rax]
and byte [rbx], dh
xor ah, byte [rax]
xor esi, dword [0x160428c41]
xor edi, dword [rax]
and byte [rdx], dh
and byte [rbx], r14b
xor eax, 0x20383320
xor esi, dword [rcx]
and byte [rbx], dh
xor ah, byte [rax]
xor esi, dword [rcx]
and byte [rbx], dh
xor al, 0x20
xor edi, dword [rax]
and byte [rbx], dh
xor esp, dword [rax]
xor esi, dword [rax + riz]
xor al, byte [rax + riz + 0x33]
xor ah, byte [rax]
xor esi, dword [0x160438c6e]
xor esi, dword [rax + riz]
xor esi, dword [rax + riz]
xor esi, dword [rdi]
and byte [rbx], dh
xor al, 0x20
xor esi, dword [rdx]
and byte [rbx], dh
xor al, 0x20
xor edi, dword [rax]
and byte [rdx], dh
and byte [rbx], r14b
xor dword [rax], esp
xor esi, dword [rax]
and byte [rbx], dh
xor byte [rax], ah
xor esi, dword [rcx]
and byte [0x1734579ba], dh
and byte [rdi], dh
cmp dword [rax], esp
invalid
xor byte [rcx], dh
and byte [rax], dh
xor byte [rax], ah
xor byte [rax], dh
and byte [rax], dh
xor byte [rax], ah
xor byte [rax], dh
and byte [rax], dh
xor byte [rax], ah
xor byte [rax], dh
and byte [rax], dh
xor byte [rax], ah
xor byte [rax], dh