Function at 0x14000fd00
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Execute command
Schedule task via at
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x1400f70c0]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor ebx, ebx
lea rdi, [0x140000000]
nop
lea rcx, [0x1400e6794]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400ea3e0]
movdqu xmmword [rbp - 0x49], xmm0
mov dword [rbp - 0x39], 0x407f7e02
mov dword [rbp - 0x35], 0x693d41
mov byte [rbp - 0x31], 1
mov rcx, rbx
nop
lea eax, [rcx + 0x4d]
xor byte [rbp + rcx - 0x49], al
inc rcx
cmp rcx, 0x17
jb 0x14000fd60
mov byte [rbp - 0x31], 0
mov edx, ntohl
lea rcx, [rbp - 0x49]
call fcn.140023a60
movdqa xmm0, xmmword [0x1400ea4c0]
movdqu xmmword [rbp - 0x49], xmm0
mov dword [rbp - 0x39], 0x407f0172
mov dword [rbp - 0x35], 0x444a3d49
mov dword [rbp - 0x31], 0x3738393a
mov word [rbp - 0x2d], 0x63
mov byte [rbp - 0x2b], 1
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x4d]
xor byte [rbp + rcx - 0x49], al
inc rcx
cmp rcx, 0x1d
jb 0x14000fdc0
mov byte [rbp - 0x2b], 0
mov edx, 3
lea rcx, [rbp - 0x49]
call fcn.140023a60
movdqa xmm0, xmmword [0x1400ea3d0]
movdqu xmmword [rbp - 0x49], xmm0
mov dword [rbp - 0x39], 0x4f7f7102
mov dword [rbp - 0x35], 0x4b434d41
mov dword [rbp - 0x31], 0x47383945
mov word [rbp - 0x2d], 0x63
mov byte [rbp - 0x2b], 1
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x4d]
xor byte [rbp + rcx - 0x49], al
inc rcx
cmp rcx, 0x1d
jb 0x14000fe20
mov byte [rbp - 0x2b], 0
mov edx, 9
lea rcx, [rbp - 0x49]
call fcn.140023a60
movdqa xmm0, xmmword [0x1400ea3c0]
movdqu xmmword [rbp - 0x29], xmm0
movdqa xmm1, xmmword [str.rp_NBC8:9Hbc_a]
movdqu xmmword [rbp - 0x19], xmm1
mov byte [rbp - 9], 1
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x4d]
xor byte [rbp + rcx - 0x29], al
inc rcx
cmp rcx, 0x1f
jb 0x14000fe70
mov byte [rbp - 9], 0
mov edx, 1
lea rcx, [rbp - 0x29]
call fcn.140023a60
movdqa xmm0, xmmword [0x1400ea440]
movdqu xmmword [rbp - 0x49], xmm0
mov dword [rbp - 0x39], 0x6a55542e
mov word [rbp - 0x35], 0x100
mov rcx, rbx
nop
lea eax, [rcx + 0x4d]
xor byte [rbp + rcx - 0x49], al
inc rcx
cmp rcx, 0x14
jb 0x14000feb0
mov byte [rbp - 0x34], 0
mov edx, 3
lea rcx, [rbp - 0x49]
call fcn.140023a60
movdqa xmm0, xmmword [0x1400ea400]
movdqu xmmword [rbp - 0x49], xmm0
mov dword [rbp - 0x39], 0x630312d
mov dword [rbp - 0x35], 0x100686b
mov rcx, rbx
lea eax, [rcx + 0x4d]
xor byte [rbp + rcx - 0x49], al
inc rcx
cmp rcx, 0x16
jb 0x14000fef0
mov byte [rbp - 0x32], 0
mov edx, ntohl
lea rcx, [rbp - 0x49]
call fcn.140023a60
movdqa xmm0, xmmword [0x1400ea4b0]
movdqu xmmword [rbp - 0x49], xmm0
mov dword [rbp - 0x39], 0x6a131f0b
mov word [rbp - 0x35], WSASetLastError
mov byte [rbp - 0x33], 1
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x4d]
xor byte [rbp + rcx - 0x49], al
inc rcx
cmp rcx, 0x15
jb 0x14000ff40
mov byte [rbp - 0x33], 0
mov edx, 3
lea rcx, [rbp - 0x49]
call fcn.140023a60
movdqa xmm0, xmmword [0x1400ea470]
movdqu xmmword [rbp - 0x49], xmm0
mov dword [rbp - 0x39], 0x6a552d31
mov word [rbp - 0x35], 0x100
mov rcx, rbx
nop
lea eax, [rcx + 0x4d]
xor byte [rbp + rcx - 0x49], al
inc rcx
cmp rcx, 0x14
jb 0x14000ff80
mov byte [rbp - 0x34], 0
mov edx, 9
lea rcx, [rbp - 0x49]
call fcn.140023a60
movdqa xmm0, xmmword [0x1400ea3f0]
movdqu xmmword [rbp - 0x49], xmm0
mov dword [rbp - 0x39], 0x555413
mov byte [rbp - 0x35], 1
mov rcx, rbx
nop dword [rax]
lea eax, [rcx + 0x4d]
xor byte [rbp + rcx - 0x49], al
inc rcx
cmp rcx, 0x13
jb 0x14000ffc0
mov byte [rbp - 0x35], 0
mov edx, 1
lea rcx, [rbp - 0x49]
call fcn.140023a60
movdqa xmm0, xmmword [0x1400ea4a0]
movdqu xmmword [rbp - 0x29], xmm0
movdqa xmm1, xmmword [0x1400ea360]
movdqu xmmword [rbp - 0x19], xmm1
movdqa xmm0, xmmword [0x1400ea380]
jl 0x14000ffa5
or eax, 0x7f0ff300
test r14d, 0x48010745
mov ecx, ebx
lea eax, [rcx + 0x4d]
xor byte [rbp + rcx - 0x29], al
inc rcx
cmp rcx, 0x2f
jb 0x140010010
mov byte [rbp + 7], 0
mov edx, ntohl
lea rcx, [rbp - 0x29]
call fcn.140023a60
mov dword [rbp + 0xf], 0xd79156d
mov dword [rbp + 0x13], 0x3d2b1771
mov dword [rbp + 0x17], 0x525d5c21
mov word [rbp + 0x1b], 0x100
mov rcx, rbx
lea eax, [rcx + 0x4d]
xor byte [rbp + rcx + 0xf], al
inc rcx
cmp rcx, 0xc
jb 0x140010050
mov byte [rbp + 0x1c], 0
mov edx, 3
lea rcx, [rbp + 0xf]
call fcn.140023a60
movdqa xmm0, xmmword [0x1400ea410]
movdqu xmmword [rbp - 0x49], xmm0
mov dword [rbp - 0x39], 0xf362a2d
mov dword [rbp - 0x35], 0x100420f
mov rcx, rbx
lea eax, [rcx + 0x4d]
xor byte [rbp + rcx - 0x49], al
inc rcx
cmp rcx, 0x16
jb 0x140010090
mov byte [rbp - 0x32], 0
mov edx, 3
lea rcx, [rbp - 0x49]
call fcn.140023a60
lea rdx, [rbp + 0x3f]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov eax, dword [rbp + 0x3f]
dec eax
cmp eax, 5
ja case.default.0x1400100dd
cdqe
mov ecx, dword [rdi + rax*4 + 0x10878]
add rcx, rdi
jmp rcx
lea rcx, [0x1400e6794]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Artic
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, str.___Closing_All_Fortnite_Related_Apps...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140020d80
lea rdx, [0x140020f50]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.taskkill__f__im_EpicGamesLauncher.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_FortniteClient_Win64_Shipping.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_OneDrive.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400e6794]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400ea450]
movdqu xmmword [rbp - 0x29], xmm0
movdqa xmm1, xmmword [0x1400ea3b0]
movdqu xmmword [rbp - 0x19], xmm1
mov dword [rbp - 9], 0x1005d4d
mov rcx, rbx
nop dword [rax]
lea eax, [rcx + 0x4d]
xor byte [rbp + rcx - 0x29], al
inc rcx
cmp rcx, 0x22
jb 0x140010190
mov byte [rbp - 6], 0
mov edx, ntohl
lea rcx, [rbp - 0x29]
call fcn.140023a60
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400e6794]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400ea450]
movdqu xmmword [rbp - 0x29], xmm0
movdqa xmm1, xmmword [0x1400ea3b0]
movdqu xmmword [rbp - 0x19], xmm1
mov dword [rbp - 9], 0x1005c4d
mov rcx, rbx
nop
lea eax, [rcx + 0x4d]
xor byte [rbp + rcx - 0x29], al
inc rcx
cmp rcx, 0x22
jb 0x1400101f0
mov byte [rbp - 6], 0
mov edx, ntohl
lea rcx, [rbp - 0x29]
call fcn.140023a60
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400e6794]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400ea450]
movdqu xmmword [rbp - 0x29], xmm0
movdqa xmm1, xmmword [0x1400ea3b0]
movdqu xmmword [rbp - 0x19], xmm1
mov dword [rbp - 9], 0x1005f4d
mov rcx, rbx
nop
lea eax, [rcx + 0x4d]
xor byte [rbp + rcx - 0x29], al
inc rcx
cmp rcx, 0x22
jb 0x140010250
mov byte [rbp - 6], 0
mov edx, ntohl
lea rcx, [rbp - 0x29]
call fcn.140023a60
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400e6794]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rbp + 0x1f], 0x312a220e
mov dword [rbp + 0x23], 0x333d3b3f
mov dword [rbp + 0x27], 0x7879767b
mov word [rbp + 0x2b], 0x77
mov byte [rbp + 0x2d], 1
mov rcx, rbx
nop dword [rax]
lea eax, [rcx + 0x4d]
xor byte [rbp + rcx + 0x1f], al
inc rcx
cmp rcx, 0xd
jb 0x1400102b0
mov byte [rbp + 0x2d], 0
mov edx, ntohl
lea rcx, [rbp + 0x1f]
call fcn.140023a60
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400e6794]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140004650
lea rcx, [0x1400e6794]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.___successfully_cleaned__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140020d80
lea rcx, str.Artic
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x14000fd30
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
mov qword [rbp - 0x39], rbx
mov qword [rbp - 0x31], rbx
mov r8d, Ordinal_45
lea rdx, str.C:Program_FilesCommon_FilesSystemOle_DB_
lea rcx, [rbp - 0x49]
call fcn.140021400
lea rcx, [rbp - 0x49]
call fcn.14000f940
lea rax, [rbp - 0x49]
mov qword [rbp + 0x2f], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
mov qword [rbp - 0x39], rbx
mov qword [rbp - 0x31], rbx
mov r8d, ntohl
lea rdx, str.Checker.bat
lea rcx, [rbp - 0x49]
call fcn.140021400
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], rbx
mov qword [rbp - 0x11], rbx
mov r8d, 6
lea rdx, str.762537
lea rcx, [rbp - 0x29]
call fcn.140021400
nop
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x29]
call fcn.14000f6b0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.start_Checker.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x14000fd30
lea rcx, [0x1400e6794]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Artic
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__1.1.1.1_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400e6794]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400ea430]
movdqu xmmword [rbp - 0x49], xmm0
mov dword [rbp - 0x39], 0x5373d33
mov dword [rbp - 0x35], 0x1006805
mov rcx, rbx
nop dword [rax + rax]
lea eax, [rcx + 0x4d]
xor byte [rbp + rcx - 0x49], al
inc rcx
cmp rcx, 0x16
jb 0x140010470
mov byte [rbp - 0x32], 0
mov edx, ntohl
lea rcx, [rbp - 0x49]
call fcn.140023a60
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x14000fd30
call fcn.14000fa80
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x14000fd30
lea rcx, [0x1400e6794]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Artic
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
movdqa xmm0, xmmword [0x1400ea3e0]
movdqu xmmword [rbp - 0x49], xmm0
mov dword [rbp - 0x39], 0x407f7e02
mov dword [rbp - 0x35], 0x693d41
mov byte [rbp - 0x31], 1
mov rcx, rbx
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x4d]
xor byte [rbp + rcx - 0x49], al
inc rcx
cmp rcx, 0x17
jb 0x140010510
mov byte [rbp - 0x31], 0
mov edx, ntohl
lea rcx, [rbp - 0x49]
call fcn.140023a60
movdqa xmm0, xmmword [0x1400ea4c0]
movdqu xmmword [rbp - 0x49], xmm0
mov dword [rbp - 0x39], 0x407f0172
mov dword [rbp - 0x35], 0x444a3d49
mov dword [rbp - 0x31], 0x3738393a
mov word [rbp - 0x2d], 0x63
mov byte [rbp - 0x2b], 1
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x4d]
xor byte [rbp + rcx - 0x49], al
inc rcx
cmp rcx, 0x1d
jb 0x140010570
mov byte [rbp - 0x2b], 0
mov edx, 3
lea rcx, [rbp - 0x49]
call fcn.140023a60
movdqa xmm0, xmmword [0x1400ea3d0]
movdqu xmmword [rbp - 0x49], xmm0
mov dword [rbp - 0x39], 0x4f7f7102
mov dword [rbp - 0x35], 0x4b434d41
mov dword [rbp - 0x31], 0x47383945
mov word [rbp - 0x2d], 0x63
mov byte [rbp - 0x2b], 1
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x4d]
xor byte [rbp + rcx - 0x49], al
inc rcx
cmp rcx, 0x1d
jb 0x1400105d0
mov byte [rbp - 0x2b], 0
mov edx, 9
lea rcx, [rbp - 0x49]
call fcn.140023a60
movdqa xmm0, xmmword [0x1400ea3c0]
movdqu xmmword [rbp - 0x49], xmm0
mov dword [rbp - 0x39], 0x3f707e72
mov dword [rbp - 0x35], 0x3843424e
mov dword [rbp - 0x31], 0x6248393a
mov dword [rbp - 0x2d], 0x1006063
mov rdx, rbx
nop
lea eax, [rdx + 0x4d]
xor byte [rbp + rdx - 0x49], al
inc rdx
cmp rdx, 0x1e
jb 0x140010620
mov byte [rbp - 0x2a], 0
mov edx, 1
lea rcx, [rbp - 0x49]
call fcn.140023a60
lea rcx, str.Artic
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
movdqa xmm0, xmmword [0x1400ea420]
movdqu xmmword [rbp - 0x29], xmm0
movdqa xmm1, xmmword [0x1400ea3a0]
movdqu xmmword [rbp - 0x19], xmm1
mov dword [rbp - 9], 0x1f364e0a
mov dword [rbp - 5], 0x30530004
mov dword [rbp - 1], 0x1b1e0010
mov dword [rbp + 3], 0x100701c
nop word [rax + rax]
lea eax, [rbx + 0x4d]
xor byte [rbp + rbx - 0x29], al
inc rbx
cmp rbx, 0x2e
jb 0x140010690
mov byte [rbp + 6], 0
mov edx, 1
lea rcx, [rbp - 0x29]
call fcn.140023a60
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140010856
lea rcx, [0x1400e6794]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [0x1400e6794]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Invalid_Selection_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140020d80
mov rax, qword [str.ZUWSO]
mov qword [rbp + 0x2f], rax
cmp byte [0x1400e9c6f], 0
je 0x14001084c
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x140010812
movdqa xmm4, xmmword [0x1400ea480]
movdqa xmm2, xmmword [0x1400ea330]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400ea350]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400ea390]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400ea460]
movd xmm0, dword [rbp + 0x2f]
xorps xmm2, xmm0
movd dword [rbp + 0x2f], xmm2
movdqa xmm3, xmmword [0x1400ea340]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400ea350]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400ea390]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400ea460]
movd xmm0, dword [rbp + 0x33]
xorps xmm2, xmm0
movd dword [rbp + 0x33], xmm2
jmp 0x14001084c
lea r8, [rbp + 0x2f]
nop word [rax + rax]
mov eax, 0x4ec4ec4f
imul ebx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x34
movzx eax, bl
sub al, cl
add al, 0x39
xor byte [r8], al
inc ebx
lea r8, [r8 + 1]
cmp ebx, 8
jl 0x140010820
lea rcx, [rbp + 0x2f]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140085590
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret