Function at 0x1400149a0
Capabilities:
Capture network configuration via ipconfig
Delete volume shadow copies
Encode data using xor
Execute command
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
mov rax, qword [0x1400fa280]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
lea rdx, [rbp - 0x51]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov edx, dword [rbp - 0x51]
and edx, 0x80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdi, rax
mov dword [rbp - 0x19], 0x60
lea rdx, [rbp - 0x19]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfoEx]
mov dword [rbp - 0x15], 0x140064
xor ebx, ebx
mov dword [rbp - 0xb], ebx
mov dword [rbp - 7], 0x140064
mov dword [rbp - 3], 0x140064
lea rdx, [rbp - 0x19]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferInfoEx]
lea rdx, [rbp - 0x59]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov edx, dword [rbp - 0x59]
and edx, 0xfffffffd
mov dword [rbp - 0x59], edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140014b54
lea rcx, str.taskkill__IM_ProcessHacker.exe__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__IM_dnSpy.exe__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__IM_cheatengine_x86_64.exe__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rbp - 0x59], 0xe0fef2
mov byte [rbp - 0x55], 1
lea rcx, [rbp - 0x59]
call fcn.140014560
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__IM_ollydbg.exe__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__IM_ida.exe__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__IM_ida64.exe__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rbp - 0x59], 0xe0fef2
mov byte [rbp - 0x55], 1
lea rcx, [rbp - 0x59]
call fcn.140014560
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__IM_radare2.exe__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__IM_x64dbg.exe__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rbp - 0x59], 0xe0fef2
mov byte [rbp - 0x55], 1
lea rcx, [rbp - 0x59]
call fcn.140014560
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Stop_debugging_u_yerk
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006030
lea rdx, [0x1400138b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea ecx, [rbx - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rdi, rax
mov edx, 0xfffffff0
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowLongA]
and eax, 0xfffaffff
mov r8d, eax
mov edx, 0xfffffff0
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetWindowLongA]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rdi, rax
lea rdx, [rbp - 0x29]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x190
mov r9d, 0x320
mov r8d, dword [rbp - 0x25]
mov edx, dword [rbp - 0x29]
mov rcx, rdi
call qword [sym.imp.USER32.dll_MoveWindow]
lea rcx, [0x1400fa640]
call fcn.1400036c0
mov dword [rbp - 0x59], 0xe0fef2
mov byte [rbp - 0x55], 1
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx - 0x6f]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 3
jb 0x140014be0
mov byte [rbp - 0x55], bl
lea rcx, [rbp - 0x59]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140066e28]
call fcn.140015550
lea rcx, [0x140066e30]
call fcn.140015550
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.__________________Selecione_uma_opcao:_____________________n
call fcn.140015550
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._n_n
call fcn.140015550
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140066ef0]
call fcn.140015550
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140066ef4]
call fcn.140015550
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140066ef8]
call fcn.140015550
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._Status___Spoofer_Easy_Anti_Cheat__Battleye_
call fcn.140015550
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.Working._n_n
call fcn.140015550
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140066ef0]
call fcn.140015550
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140066f3c]
call fcn.140015550
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140066ef8]
call fcn.140015550
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movdqa xmm0, xmmword [0x1400671e0]
movdqu xmmword [rbp - 0x79], xmm0
mov word [rbp - 0x69], 0x100
mov rcx, rbx
nop
lea eax, [rcx - 0x6f]
xor byte [rbp + rcx - 0x79], al
inc rcx
cmp rcx, 0x10
jb 0x140014dd0
mov byte [rbp - 0x68], bl
lea rdx, [rbp - 0x79]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006030
lea rcx, [0x140066ef0]
call fcn.140015550
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140066ef4]
call fcn.140015550
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140066ef8]
call fcn.140015550
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._Selecione_uma_opcao:
call fcn.140015550
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
movdqa xmm1, xmmword [0x1400671a0]
movdqu xmmword [rbp - 0x39], xmm1
mov byte [rbp - 0x49], bl
lea rdx, [rbp - 0x4d]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
cmp dword [rbp - 0x4d], 1
jne 0x1400154e7
lea rcx, [0x140066d00]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140066e28]
call fcn.140015550
lea rcx, [0x140066e30]
call fcn.140015550
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._____________________Coloque_sua_key:______________________n
call fcn.140015550
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._n_n
call fcn.140015550
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dword [rbp - 0x59], 0x100c99b
mov rcx, rbx
nop dword [rax + rax]
lea eax, [rcx - 0x6f]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 2
jb 0x140014f50
mov byte [rbp - 0x56], 0
lea rdx, [rbp - 0x59]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006030
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov word [rbp - 0x59], Ordinal_46
mov byte [rbp - 0x57], 0
lea rdx, [rbp - 0x59]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006030
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movdqa xmm0, xmmword [0x1400671b0]
movdqu xmmword [rbp - 0x79], xmm0
mov byte [rbp - 0x69], 1
mov rcx, rbx
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x6f]
xor byte [rbp + rcx - 0x79], al
inc rcx
cmp rcx, 0xf
jb 0x140014fe0
mov byte [rbp - 0x69], 0
lea rdx, [rbp - 0x79]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006030
lea rdx, [rbp - 0x49]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140012a10
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x79]
call fcn.140005390
mov rdx, rax
lea rcx, [0x1400fa640]
call fcn.140004270
lea rcx, [0x140066d00]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movdqa xmm0, xmmword [0x140067210]
movdqu xmmword [rbp - 0x79], xmm0
mov dword [rbp - 0x69], 0xf783cdc5
mov dword [rbp - 0x65], 0xcec8c9d5
mov dword [rbp - 0x61], 0x8285d8cc
mov dword [rbp - 0x5d], 0x100a483
nop
lea eax, [rbx - 0x6f]
xor byte [rbp + rbx - 0x79], al
inc rbx
cmp rbx, 0x1e
jb 0x140015080
mov byte [rbp - 0x5a], 0
lea rdx, [rbp - 0x79]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006030
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140066d00]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_EpicGamesLauncher.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_FortniteClient_Win64_Shipping.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_OneDrive.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r9d, 0x44
lea r8, str.Info
lea rdx, str.Habilitar_Clear__
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
sub eax, 6
je 0x1400152f0
cmp eax, 1
jne 0x1400154e7
mov edx, Ordinal_301
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.powershell.exe__Reset_PhysicalDisk___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.NETSH_WINSOCK_RESET
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.NETSH_INT_IP_RESET
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.NETSH_INTERFACE_IPV4_RESET
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.NETSH_INTERFACE_IPV6_RESET
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.NETSH_INTERFACE_TCP_RESET
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.IPCONFIG__RELEASE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.IPCONFIG__RELEASE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.IPCONFIG__RENEW
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.IPCONFIG__FLUSHDNS
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.IPCONFIG__RENEW
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_winmgmt__y__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.vssadmin_delete_shadows__All__Quiet__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, reloc.WS2_32.dll_ntohs
call fcn.1400148a0
mov dword [rbp - 0x59], 0x100c99b
lea rdx, [rbp - 0x59]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012c80
mov ecx, 5
call fcn.1400148a0
mov word [rbp - 0x59], 0xba
mov byte [rbp - 0x57], 1
lea rdx, [rbp - 0x59]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012c50
mov ecx, reloc.WS2_32.dll_ntohs
call fcn.1400148a0
movdqa xmm0, xmmword [0x140067220]
movdqu xmmword [rbp - 0x79], xmm0
mov dword [rbp - 0x69], 0x8ad1c7c7
mov dword [rbp - 0x65], 0xad868b
mov byte [rbp - 0x61], 1
lea rdx, [rbp - 0x79]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012d00
call fcn.1400148d0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, reloc.WS2_32.dll_ntohs
call fcn.1400148a0
mov dword [rbp - 0x59], 0x100c99b
lea rdx, [rbp - 0x59]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012c80
mov ecx, 5
call fcn.1400148a0
mov word [rbp - 0x59], 0xba
mov byte [rbp - 0x57], 1
lea rdx, [rbp - 0x59]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012c50
mov ecx, reloc.WS2_32.dll_ntohs
call fcn.1400148a0
movdqa xmm0, xmmword [0x140067200]
movdqu xmmword [rbp - 0x79], xmm0
mov dword [rbp - 0x69], 0xcbc7c3db
mov dword [rbp - 0x65], 0x100868b
lea rdx, [rbp - 0x79]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012cc0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, Ordinal_301
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.powershell.exe__Reset_PhysicalDisk___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.NETSH_WINSOCK_RESET
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.NETSH_INT_IP_RESET
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.NETSH_INTERFACE_IPV4_RESET
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.NETSH_INTERFACE_IPV6_RESET
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.NETSH_INTERFACE_TCP_RESET
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.IPCONFIG__RELEASE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.IPCONFIG__RELEASE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.IPCONFIG__RENEW
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.IPCONFIG__FLUSHDNS
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.IPCONFIG__RENEW
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_winmgmt__y__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.vssadmin_delete_shadows__All__Quiet__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140066d00]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, Ordinal_301
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, reloc.WS2_32.dll_ntohs
call fcn.1400148a0
mov dword [rbp - 0x59], 0x100c99b
lea rdx, [rbp - 0x59]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012c80
mov ecx, 5
call fcn.1400148a0
mov word [rbp - 0x59], 0xba
mov byte [rbp - 0x57], 1
lea rdx, [rbp - 0x59]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012c50
mov ecx, reloc.WS2_32.dll_ntohs
call fcn.1400148a0
movdqa xmm0, xmmword [0x140067220]
movdqu xmmword [rbp - 0x79], xmm0
mov dword [rbp - 0x69], 0x8ad1c7c7
mov dword [rbp - 0x65], 0xad868b
mov byte [rbp - 0x61], 1
lea rdx, [rbp - 0x79]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012d00
call fcn.1400148d0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, reloc.WS2_32.dll_ntohs
call fcn.1400148a0
mov dword [rbp - 0x59], 0x100c99b
lea rdx, [rbp - 0x59]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012c80
mov ecx, 5
call fcn.1400148a0
mov word [rbp - 0x59], 0xba
mov byte [rbp - 0x57], 1
lea rdx, [rbp - 0x59]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012c50
mov ecx, reloc.WS2_32.dll_ntohs
call fcn.1400148a0
movdqa xmm0, xmmword [0x140067200]
movdqu xmmword [rbp - 0x79], xmm0
mov dword [rbp - 0x69], 0xcbc7c3db
mov dword [rbp - 0x65], 0x100868b
lea rdx, [rbp - 0x79]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012cc0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, Ordinal_301
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov rdx, qword [rbp - 0x31]
cmp rdx, 0xf
jbe 0x140015525
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015520
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140015520
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140062e34
xor eax, eax
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140063190
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret