Function at 0x1400084c0
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x1f0
mov rax, qword [0x14009f040]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
xor r15d, r15d
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
lea edx, [r15 + 5]
call qword [sym.imp.USER32.dll_ShowWindow]
vpxor xmm0, xmm0, xmm0
xor eax, eax
vmovups xmmword [rsp + 0x140], xmm0
mov qword [rsp + 0x150], rax
vmovups xmmword [rsp + 0x80], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rsp + 0x90], xmm1
lea r8d, [r15 + 0x25]
lea rdx, str.D6454ACFA_7666_2511_A8E3_2CF05D94A640
lea rcx, [rsp + 0x80]
call fcn.140006420
nop
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0xa0], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rsp + 0xb0], xmm1
lea r8d, [r15 + 0x25]
lea rdx, str.DAD6245FA_A68A_3415_A38E_D8BBC1172A57
lea rcx, [rsp + 0xa0]
call fcn.140006420
nop
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0xc0], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rsp + 0xd0], xmm1
lea r8d, [r15 + 0x25]
lea rdx, str.DA4B2DE2B_9A5B_154F_AC2D_AC2B834309B7
lea rcx, [rsp + 0xc0]
call fcn.140006420
nop
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0xe0], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rsp + 0xf0], xmm1
lea r8d, [r15 + 0x25]
lea rdx, str.D67C11B3D_2CA0_0EAF_FBE1_5811222B4F44
lea rcx, [rsp + 0xe0]
call fcn.140006420
nop
vpxor xmm0, xmm0, xmm0
vmovdqu xmmword [rsp + 0x140], xmm0
mov qword [rsp + 0x150], r15
mov ecx, 0x80
call fcn.14007f2c0
mov rbx, rax
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], rax
lea rcx, [rax + 0x80]
mov qword [rsp + 0x150], rcx
lea rax, [rsp + 0x140]
mov qword [rsp + 0x40], rax
lea rdi, [rsp + 0x80]
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x120], xmm0
mov qword [rsp + 0x120], rbx
mov qword [rsp + 0x128], rbx
lea rax, [rsp + 0x140]
mov qword [rsp + 0x130], rax
nop dword [rax + rax]
mov rdx, rdi
mov rcx, rbx
call fcn.140007750
add rbx, 0x20
mov qword [rsp + 0x128], rbx
add rdi, 0x20
lea rax, [rsp + 0x100]
cmp rdi, rax
jne 0x140008670
mov rdx, rbx
mov rcx, rbx
call fcn.140009150
mov qword [rsp + 0x148], rbx
lea r9, [fcn.140005220]
mov edx, 0x20
lea r8d, [rdx - 0x1c]
lea rcx, [rsp + 0x80]
call fcn.14007f698
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x100], xmm0
mov qword [rsp + 0x110], r15
mov qword [rsp + 0x118], 0xf
mov byte [rsp + 0x100], 0
lea rdx, [0x1400885e8]
lea rcx, str.wmic_csproduct_get_uuid
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__popen]
mov rbx, rax
test rax, rax
je 0x140008769
mov r8, rax
mov edx, 0x80
lea rcx, [rsp + 0x160]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
test rax, rax
je 0x140008760
nop dword [rax + rax]
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x100]
call fcn.140008d70
mov r8, rbx
mov edx, 0x80
lea rcx, [rsp + 0x160]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
test rax, rax
jne 0x140008730
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__pclose]
lea r12, [rsp + 0x100]
mov rcx, qword [rsp + 0x100]
mov r8, qword [rsp + 0x118]
cmp r8, 0xf
cmova r12, rcx
mov rsi, qword [rsp + 0x110]
add r12, rsi
lea r14, [rsp + 0x100]
cmp r8, 0xf
cmova r14, rcx
add r14, rsi
lea rbx, [rsp + 0x100]
cmp r8, 0xf
cmova rbx, rcx
cmp rbx, r14
je 0x140008840
movsx edi, byte [rbx]
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isxdigit]
test eax, eax
jne 0x1400087d5
cmp dil, 0x2d
jne 0x1400087dd
inc rbx
cmp rbx, r14
jne 0x1400087c0
mov r8, qword [rsp + 0x118]
mov rsi, qword [rsp + 0x110]
mov rcx, qword [rsp + 0x100]
cmp rbx, r14
je 0x140008840
lea rdi, [rbx + 1]
cmp rdi, r14
je 0x140008840
movsx esi, byte [rdi]
mov ecx, esi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isxdigit]
test eax, eax
jne 0x140008818
cmp sil, 0x2d
jne 0x140008820
movzx eax, byte [rdi]
mov byte [rbx], al
inc rbx
inc rdi
cmp rdi, r14
jne 0x140008803
mov r8, qword [rsp + 0x118]
mov rsi, qword [rsp + 0x110]
mov rcx, qword [rsp + 0x100]
lea rax, [rsp + 0x100]
cmp r8, 0xf
cmova rax, rcx
mov rdx, rbx
sub rdx, rax
sub r12, rbx
mov rax, rsi
sub rax, rdx
cmp rax, r12
cmovb r12, rax
lea rax, [rsp + 0x100]
cmp r8, 0xf
cmova rax, rcx
lea rcx, [rax + rdx]
sub rsi, r12
mov r8, rsi
sub r8, rdx
inc r8
lea rdx, [rcx + r12]
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x110], rsi
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0x7fffffffffffffff
sub rax, rsi
cmp rax, 1
jb 0x140008ceb
lea r9, [rsp + 0x100]
cmp qword [rsp + 0x118], 0xf
cmova r9, qword [rsp + 0x100]
mov qword [rsp + 0x30], 1
lea rax, [0x140088608]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea rcx, [rsp + 0x120]
call fcn.1400052f0
nop
lea rdx, [rsp + 0x120]
cmp qword [rsp + 0x138], 0xf
cmova rdx, qword [rsp + 0x120]
mov r8, qword [rsp + 0x130]
mov rcx, rbx
call fcn.1400093e0
nop
mov rdx, qword [rsp + 0x138]
cmp rdx, 0xf
jbe 0x140008968
inc rdx
mov rcx, qword [rsp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008963
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008963
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007f53c
lea rdx, str.Build:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140008f40
mov r13, rax
mov rbx, qword [rsp + 0x140]
mov rdi, qword [rsp + 0x148]
cmp rbx, rdi
je 0x1400089e8
mov r14, qword [rsp + 0x118]
mov rsi, qword [rsp + 0x110]
mov r12, qword [rsp + 0x100]
nop dword [rax + rax]
lea rdx, [rsp + 0x100]
cmp r14, 0xf
cmova rdx, r12
mov r8, qword [rbx + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1400089d1
mov rcx, qword [rbx]
cmp r8, rsi
jne 0x1400089df
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400089e8
add rbx, 0x20
cmp rbx, rdi
jne 0x1400089b0
lea rax, str.Admin
lea rdx, str.Beta
cmp rbx, rdi
cmovne rdx, rax
mov rcx, r13
call fcn.140008f40
lea rdx, [0x140009110]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rbx, qword [rsp + 0x140]
mov rdi, qword [rsp + 0x148]
cmp rbx, rdi
je 0x140008a8b
mov r14, qword [rsp + 0x118]
mov rsi, qword [rsp + 0x110]
mov r12, qword [rsp + 0x100]
nop dword [rax]
nop word [rax + rax]
lea rdx, [rsp + 0x100]
cmp r14, 0xf
cmova rdx, r12
mov r8, qword [rbx + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140008a71
mov rcx, qword [rbx]
cmp r8, rsi
jne 0x140008a7f
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140008a88
add rbx, 0x20
cmp rbx, rdi
jne 0x140008a50
cmp rbx, rdi
setne byte [0x14016b58c]
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x120], xmm0
mov qword [rsp + 0x130], r15
mov qword [rsp + 0x138], r15
mov r8d, 7
lea rdx, str.cs2.exe
lea rcx, [rsp + 0x120]
call fcn.140006420
lea rdx, [rsp + 0x120]
call fcn.1400080e0
mov ebx, eax
test eax, eax
jne 0x140008bc4
call fcn.140009870
test al, al
je 0x140008bc4
call fcn.140008030
test al, al
je 0x140008bc4
lea rax, [rsp + 0x160]
mov qword [rsp + 0x40], rax
lea rax, vtable.std::_Func_impl_no_alloc_void____cdecl___void___void___.0
mov qword [rsp + 0x160], rax
lea rax, [0x140077ad0]
mov qword [rsp + 0x168], rax
lea rax, [rsp + 0x160]
mov qword [rsp + 0x198], rax
lea rax, [rsp + 0x120]
mov qword [rsp + 0x68], rax
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x120], xmm0
mov qword [rsp + 0x130], r15
mov qword [rsp + 0x138], r15
lea r8d, [rbx + 7]
lea rdx, str.SDL_app
lea rcx, [rsp + 0x120]
call fcn.140006420
nop
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
lea r8d, [rbx + 0x10]
lea rdx, [0x1400886a0]
lea rcx, [rsp + 0x48]
call fcn.140006420
nop
lea r9, [rsp + 0x160]
lea r8, [rsp + 0x120]
lea rdx, [rsp + 0x48]
call fcn.140067080
nop
jmp 0x140008c3a
lea rdx, str._ERROR_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140008f40
call fcn.140009870
test al, al
jne 0x140008bf5
lea rdx, str.Failed_to_update_offsets.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140008f40
jmp 0x140008c2a
call fcn.140008030
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test al, al
jne 0x140008c13
lea rdx, str.Failed_to_call_InitAddress__.
call fcn.140008f40
jmp 0x140008c2a
lea rdx, str.Failed_to_attach_process__StatusCode:
call fcn.140008f40
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
lea rdx, [0x140009110]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rdx, qword [rsp + 0x118]
cmp rdx, 0xf
jbe 0x140008c8e
inc rdx
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008c89
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008c89
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007f53c
mov qword [rsp + 0x110], r15
mov qword [rsp + 0x118], 0xf
mov byte [rsp + 0x100], 0
lea rcx, [rsp + 0x140]
call fcn.140008d00
xor eax, eax
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.14007f2a0
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
call fcn.140004d00
nop
int3