Function at 0x14000bf60
Capabilities:
Execute command
Terminate process

Disassembly:
push rdi
sub rsp, 0x4d0
mov rax, qword [0x1400e7080]
xor rax, rsp
mov qword [rsp + 0x4c0], rax
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x21]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx eax, byte [rsp + 0x20]
mov byte [rsp + 0x90], al
movzx eax, byte [rsp + 0x21]
mov byte [rsp + 0x38], al
movabs rax, 0x18e0e9a473203dc9
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x1c0], rax
movabs rax, 0x157154bd3841fdf6
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x1c8], rax
movabs rax, 0x7dae070724a4e4e9
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x1d0], rax
movabs rax, 0x844e1a62ea5ba3fc
mov qword [rsp + 0xf8], rax
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x1d8], rax
lea rax, [rsp + 0x1c0]
mov qword [rsp + 0x98], rax
movabs rax, 0x388787cd174152a5
mov qword [rsp + 0x4a0], rax
movabs rax, 0x3b5f26d84e288f92
mov qword [rsp + 0x4a8], rax
movabs rax, 0x7dae070724a4eec7
mov qword [rsp + 0x4b0], rax
movabs rax, 0x844e1a62ea5ba3fc
mov qword [rsp + 0x4b8], rax
lea rax, [rsp + 0x22]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx eax, byte [rsp + 0x22]
mov byte [rsp + 0x40], al
movdqa xmm0, xmmword [rsp + 0x4a0]
movdqa xmmword [rsp + 0x260], xmm0
mov rax, qword [rsp + 0x98]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x250], xmm0
movdqa xmm0, xmmword [rsp + 0x250]
xorps xmm0, xmmword [rsp + 0x260]
movdqa xmmword [rsp + 0x270], xmm0
mov rax, qword [rsp + 0x98]
movdqa xmm0, xmmword [rsp + 0x270]
movdqu xmmword [rax], xmm0
mov rax, qword [rsp + 0x98]
add rax, 0x10
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0x4b0]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x290], xmm0
mov rax, qword [rsp + 0xb0]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x280], xmm0
movdqa xmm0, xmmword [rsp + 0x280]
xorps xmm0, xmmword [rsp + 0x290]
movdqa xmmword [rsp + 0x2a0], xmm0
mov rax, qword [rsp + 0xb0]
movdqa xmm0, xmmword [rsp + 0x2a0]
movdqu xmmword [rax], xmm0
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x100], rax
mov rcx, qword [rsp + 0x100]
call fcn.140001300
lea rax, [rsp + 0x23]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x24]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx eax, byte [rsp + 0x23]
mov byte [rsp + 0x48], al
movzx eax, byte [rsp + 0x24]
mov byte [rsp + 0x50], al
movabs rax, 0x6cc9c69f580d13f3
mov qword [rsp + 0x108], rax
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x1a0], rax
movabs rax, 0x3b5f26d84e28afb2
mov qword [rsp + 0x110], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x1a8], rax
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0xa0], rax
movabs rax, 0x388787cd174152a5
mov qword [rsp + 0x420], rax
movabs rax, 0x3b5f26d84e288f92
mov qword [rsp + 0x428], rax
lea rax, [rsp + 0x25]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx eax, byte [rsp + 0x25]
mov byte [rsp + 0x58], al
movdqa xmm0, xmmword [rsp + 0x420]
movdqa xmmword [rsp + 0x2c0], xmm0
mov rax, qword [rsp + 0xa0]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x2b0], xmm0
movdqa xmm0, xmmword [rsp + 0x2b0]
xorps xmm0, xmmword [rsp + 0x2c0]
movdqa xmmword [rsp + 0x2d0], xmm0
mov rax, qword [rsp + 0xa0]
movdqa xmm0, xmmword [rsp + 0x2d0]
movdqu xmmword [rax], xmm0
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x118], rax
mov rdx, qword [rsp + 0x118]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14000c974
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov edx, 5
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
lea rax, [rsp + 0x26]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x27]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx eax, byte [rsp + 0x26]
mov byte [rsp + 0x60], al
movzx eax, byte [rsp + 0x27]
mov byte [rsp + 0x68], al
movabs rax, 0x59c0a7f33a1c7ffe
mov qword [rsp + 0x120], rax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x1e0], rax
movabs rax, 0x4b3006ab2708eaff
mov qword [rsp + 0x128], rax
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x1e8], rax
movabs rax, 0x12f727754b8480a2
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x1f0], rax
movabs rax, 0xeb2a3a07983a8389
mov qword [rsp + 0x138], rax
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0x1f8], rax
movabs rax, 0x8c6db469390759bc
mov qword [rsp + 0x140], rax
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0x200], rax
movabs rax, 0x5eb14854453db8a8
mov qword [rsp + 0x148], rax
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x208], rax
movabs rax, 0x9f65490dc36f8e2c
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x210], rax
movabs rax, 0x10be408e4dc41dd5
mov qword [rsp + 0x158], rax
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x218], rax
movabs rax, 0x932414d1ea63511e
mov qword [rsp + 0x160], rax
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x220], rax
movabs rax, 0x655d047e767fd1fe
mov qword [rsp + 0x168], rax
mov rax, qword [rsp + 0x168]
mov qword [rsp + 0x228], rax
movabs rax, 0x6de30adf5470b86e
mov qword [rsp + 0x170], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x230], rax
movabs rax, 0x7de282d04fd978cd
mov qword [rsp + 0x178], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x238], rax
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x30], rax
movabs rax, 0x388787cd174152a5
mov qword [rsp + 0x440], rax
movabs rax, 0x3b5f26d84e288f92
mov qword [rsp + 0x448], rax
movabs rax, 0x7dae070724a4eec7
mov qword [rsp + 0x450], rax
movabs rax, 0x844e1a62ea5ba3fc
mov qword [rsp + 0x458], rax
movabs rax, 0xe91ddb495c6b3bc9
mov qword [rsp + 0x460], rax
movabs rax, 0x31c338742253d1c6
mov qword [rsp + 0x468], rax
movabs rax, 0xf3356923ae0efc4b
mov qword [rsp + 0x470], rax
movabs rax, 0x7fd223ae28b77cb0
mov qword [rsp + 0x478], rax
movabs rax, 0xfd4534a58343346d
mov qword [rsp + 0x480], rax
movabs rax, 0xa312410030df19a
mov qword [rsp + 0x488], rax
movabs rax, 0xc846bff2615dc0f
mov qword [rsp + 0x490], rax
movabs rax, 0x7de282da45f816a4
mov qword [rsp + 0x498], rax
lea rax, [rsp + 0x28]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx eax, byte [rsp + 0x28]
mov byte [rsp + 0x70], al
movdqa xmm0, xmmword [rsp + 0x440]
movdqa xmmword [rsp + 0x2e0], xmm0
mov rax, qword [rsp + 0x30]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x390], xmm0
movdqa xmm0, xmmword [rsp + 0x390]
xorps xmm0, xmmword [rsp + 0x2e0]
movdqa xmmword [rsp + 0x2f0], xmm0
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rsp + 0x2f0]
movdqu xmmword [rax], xmm0
mov rax, qword [rsp + 0x30]
add rax, 0x10
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0x450]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x310], xmm0
mov rax, qword [rsp + 0xb8]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x300], xmm0
movdqa xmm0, xmmword [rsp + 0x300]
xorps xmm0, xmmword [rsp + 0x310]
movdqa xmmword [rsp + 0x320], xmm0
mov rax, qword [rsp + 0xb8]
movdqa xmm0, xmmword [rsp + 0x320]
movdqu xmmword [rax], xmm0
mov rax, qword [rsp + 0x30]
add rax, 0x20
mov qword [rsp + 0xc0], rax
lea rax, [rsp + 0x460]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x340], xmm0
mov rax, qword [rsp + 0xc0]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x330], xmm0
movdqa xmm0, xmmword [rsp + 0x330]
xorps xmm0, xmmword [rsp + 0x340]
movdqa xmmword [rsp + 0x350], xmm0
mov rax, qword [rsp + 0xc0]
movdqa xmm0, xmmword [rsp + 0x350]
movdqu xmmword [rax], xmm0
mov rax, qword [rsp + 0x30]
add rax, 0x30
mov qword [rsp + 0xc8], rax
lea rax, [rsp + 0x470]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x370], xmm0
mov rax, qword [rsp + 0xc8]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x360], xmm0
movdqa xmm0, xmmword [rsp + 0x360]
xorps xmm0, xmmword [rsp + 0x370]
movdqa xmmword [rsp + 0x380], xmm0
mov rax, qword [rsp + 0xc8]
movdqa xmm0, xmmword [rsp + 0x380]
movdqu xmmword [rax], xmm0
mov rax, qword [rsp + 0x30]
add rax, 0x40
mov qword [rsp + 0xd0], rax
lea rax, [rsp + 0x480]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x3a0], xmm0
mov rax, qword [rsp + 0xd0]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x240], xmm0
movdqa xmm0, xmmword [rsp + 0x240]
xorps xmm0, xmmword [rsp + 0x3a0]
movdqa xmmword [rsp + 0x3b0], xmm0
mov rax, qword [rsp + 0xd0]
movdqa xmm0, xmmword [rsp + 0x3b0]
movdqu xmmword [rax], xmm0
mov rax, qword [rsp + 0x30]
add rax, 0x50
mov qword [rsp + 0xd8], rax
lea rax, [rsp + 0x490]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x3d0], xmm0
mov rax, qword [rsp + 0xd8]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x3c0], xmm0
movdqa xmm0, xmmword [rsp + 0x3c0]
xorps xmm0, xmmword [rsp + 0x3d0]
movdqa xmmword [rsp + 0x3e0], xmm0
mov rax, qword [rsp + 0xd8]
movdqa xmm0, xmmword [rsp + 0x3e0]
movdqu xmmword [rax], xmm0
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x180], rax
mov rcx, qword [rsp + 0x180]
call fcn.140001300
lea rax, [rsp + 0x29]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x2a]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx eax, byte [rsp + 0x29]
mov byte [rsp + 0x78], al
movzx eax, byte [rsp + 0x2a]
mov byte [rsp + 0x80], al
movabs rax, 0x38878788441413f5
mov qword [rsp + 0x188], rax
mov rax, qword [rsp + 0x188]
mov qword [rsp + 0x1b0], rax
movabs rax, 0x3b5f26d84e288f92
mov qword [rsp + 0x190], rax
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0x1b8], rax
lea rax, [rsp + 0x1b0]
mov qword [rsp + 0xa8], rax
movabs rax, 0x388787cd174152a5
mov qword [rsp + 0x430], rax
movabs rax, 0x3b5f26d84e288f92
mov qword [rsp + 0x438], rax
lea rax, [rsp + 0x2b]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx eax, byte [rsp + 0x2b]
mov byte [rsp + 0x88], al
movdqa xmm0, xmmword [rsp + 0x430]
movdqa xmmword [rsp + 0x400], xmm0
mov rax, qword [rsp + 0xa8]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x3f0], xmm0
movdqa xmm0, xmmword [rsp + 0x3f0]
xorps xmm0, xmmword [rsp + 0x400]
movdqa xmmword [rsp + 0x410], xmm0
mov rax, qword [rsp + 0xa8]
movdqa xmm0, xmmword [rsp + 0x410]
movdqu xmmword [rax], xmm0
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x198], rax
mov rcx, qword [rsp + 0x198]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call fcn.14000b980
xor edx, edx
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_SleepEx]
xor eax, eax
mov rcx, qword [rsp + 0x4c0]
xor rcx, rsp
call fcn.1400beaa0
add rsp, 0x4d0
pop rdi
ret