Function at 0x1400058f0
Capabilities:
Execute command
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
xor esi, esi
mov dword [rbp + 0x67], esi
lea rdx, str.e_96mPreparing_files...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140013620
lea rdx, [0x1400137f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rax, [rbp + 7]
mov qword [rbp + 0x67], rax
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
mov qword [rbp + 0x17], rsi
mov qword [rbp + 0x1f], rsi
lea r8d, [rsi + 0x32]
lea rdx, str.s58X6_uvB__1Aq_VN4Oln__m_RD_dSxA_es__iwHJ5fI
lea rcx, [rbp + 7]
call fcn.140014cd0
nop
lea rax, [rbp - 0x19]
mov qword [rbp + 0x6f], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], rsi
mov qword [rbp - 1], rsi
lea r8d, [rsi + 0x3c]
lea rdx, str.C:WindowsSystem32GarfwG0Buo06fUWu5AcDiJKmmhyuXfozwKPN.7z
lea rcx, [rbp - 0x19]
call fcn.140014cd0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], rsi
mov qword [rbp - 0x21], rsi
lea r8d, [rsi + 0x3e]
lea rdx, str.C:WindowsSystem32GarfwG0Buo06fUWu5AcDiJKmmhyuXfozwKPN.garf
lea rcx, [rbp - 0x39]
call fcn.140014cd0
nop
lea r8, [rbp + 7]
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x39]
call fcn.140005140
lea rcx, str.__C:Program_Files7_Zip7z.exe__x__C:WindowsSystem32GarfwG0Buo06fUWu5AcDiJKmmhyuXfozwKPN.7z___pTC5Ipe2NN69Fq8FiS6az1ANuDr4drAlr__oC:WindowsSystem32Garf__aoa___NUL_2_NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140084864
lea rcx, str.C:WindowsSystem32GarfAFU
mov qword [rbp - 0x39], rcx
mov qword [rbp - 0x31], Ordinal_33
lea r8, [rbp - 0x39]
mov edx, eax
lea rcx, [rbp + 0x27]
call fcn.140002740
nop
mov ebx, Ordinal_27
mov dword [rbp + 0x67], ebx
lea rcx, [rbp + 0x27]
call fcn.140003e90
test al, al
je 0x140005a82
call fcn.140084864
lea rcx, str.C:WindowsSystem32GarfAMIDE
mov qword [rbp - 0x39], rcx
mov qword [rbp - 0x31], reloc.WLDAP32.dll_Ordinal_30
lea r8, [rbp - 0x39]
mov edx, eax
lea rcx, [rbp + 7]
call fcn.140002740
nop
mov ebx, 0x7b
mov dword [rbp + 0x67], ebx
lea rcx, [rbp + 7]
call fcn.140003e90
test al, al
je 0x140005a82
call fcn.140084864
lea rcx, str.C:WindowsSystem32GarfOther
mov qword [rbp - 0x39], rcx
mov qword [rbp - 0x31], reloc.WLDAP32.dll_Ordinal_30
lea r8, [rbp - 0x39]
mov edx, eax
lea rcx, [rbp - 0x19]
call fcn.140002740
nop
mov ebx, 0x1ff
mov dword [rbp + 0x67], ebx
lea rcx, [rbp - 0x19]
call fcn.140003e90
test al, al
je 0x140005a82
xor dil, dil
jmp 0x140005a85
mov dil, 1
test bl, 4
je 0x140005ae1
and ebx, 0xfffffffb
mov rdx, qword [rbp - 1]
cmp rdx, 7
jbe 0x140005ad0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005acb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005acb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140085540
movdqa xmm0, xmmword [0x14009c2a0]
movdqu xmmword [rbp - 9], xmm0
mov word [rbp - 0x19], si
test bl, 2
je 0x140005b3d
and ebx, 0xfffffffd
mov rdx, qword [rbp + 0x1f]
cmp rdx, 7
jbe 0x140005b2c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005b27
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005b27
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140085540
movdqa xmm0, xmmword [0x14009c2a0]
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 7], si
test bl, 1
je 0x140005b85
mov rdx, qword [rbp + 0x3f]
cmp rdx, 7
jbe 0x140005b85
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005b80
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005b80
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140085540
test dil, dil
je 0x140005bcb
call fcn.1400056b0
lea rdx, str.e_91mPreparation_failed._Press_any_key_to_close_Garf_Spoofer.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140013620
lea rdx, [0x1400137f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.PAUSE__NUL_2_NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rbx, qword [rsp + 0xd8]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret