Function at 0x180009800
Capabilities:
Execute command
Timestomp file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x150
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1801e6a40]
xor rax, rsp
mov qword [rbp + 0xe0], rax
movabs r11, 0xf037e7b2b750a38c
movabs r10, 0xbd0e1790f6fd94ae
mov qword [rbp + 0x40], r11
movabs r9, 0xf07e4f6c56812b98
mov rax, qword [rbp + 0x40]
movabs r8, 0xf17011f09d2ac737
mov qword [rbp], rax
movabs rdx, 0x417c6a5f0f38dd1f
mov qword [rbp + 0x40], r10
movabs rcx, 0xbaefe517a596f9b9
mov rax, qword [rbp + 0x40]
movabs r14, 0xf067e7eeb76aa3cf
mov qword [rbp + 8], rax
movabs r15, 0xbd7c17f7f69294dc
mov qword [rbp + 0x40], r9
movabs r12, 0xf0384f4c56ec2bf9
mov rax, qword [rbp + 0x40]
movabs r13, 0xf10311959d46c75e
mov qword [rbp + 0x10], rax
movabs rbx, 0x41266a720f0fdd43
mov qword [rbp + 0x40], r8
movabs rsi, 0xbad8e54ba5e6f9d0
mov rax, qword [rbp + 0x40]
movabs rdi, 0xae82af79afa9ca02
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x40], rdx
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x40], rcx
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x28], rax
movabs rax, 0x6f71b35d7698ed7
mov qword [rbp + 0x40], rax
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x30], rax
movabs rax, 0xae82af79afa9ca67
mov qword [rbp + 0x40], rax
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x40], r14
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x40], r15
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x40], r12
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x40], r13
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x78], rax
mov qword [rbp + 0x40], rbx
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x40], rsi
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x88], rax
movabs rax, 0x68f1b50d7478ead
mov qword [rbp + 0x40], rax
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x40], rdi
mov rax, qword [rbp + 0x40]
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp]
vmovdqu ymm0, ymmword [rbp + 0x20]
mov qword [rbp + 0x98], rax
vmovdqa ymmword [rbp], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x80]
vmovdqa ymmword [rbp + 0x20], ymm1
mov qword [rbp + 0x40], r11
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x40], r10
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x40], r9
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x40], r8
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x78], rax
xor r9d, r9d
mov qword [rbp + 0x40], rdx
mov r8d, 1
mov rax, qword [rbp + 0x40]
mov edx, 0x80000000
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x40], rcx
lea rcx, [rbp]
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x88], rax
movabs rax, 0x6a11b1dd7018ed7
mov qword [rbp + 0x40], rax
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x90], rax
movabs rax, 0xae82af1cafd1ca67
mov qword [rbp + 0x40], rax
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x98], rax
mov qword [rbp + 0x40], r14
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0x40], r15
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0x40], r12
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0x40], r13
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0xb8], rax
mov qword [rbp + 0x40], rbx
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0x40], rsi
xor esi, esi
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0xc8], rax
movabs rax, 0x68f1b50d7478ead
mov qword [rbp + 0x40], rax
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0xd0], rax
mov qword [rsp + 0x30], rsi
mov qword [rbp + 0x40], rdi
mov rax, qword [rbp + 0x40]
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqu ymm0, ymmword [rbp + 0x80]
vmovdqa ymmword [rbp + 0x60], ymm1
mov qword [rbp + 0xd8], rax
vpxor ymm1, ymm0, ymmword [rbp + 0xc0]
mov dword [rsp + 0x28], 0x80
vmovdqa ymmword [rbp + 0x80], ymm1
mov dword [rsp + 0x20], 3
vzeroupper
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180009b53
lea r9, [rbp + 0x40]
mov rcx, rax
lea r8, [rbp + 0x50]
lea rdx, [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov rcx, rbx
test eax, eax
jne 0x180009d3e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movabs rax, 0xf00be787b70ba389
lea rcx, [0x180499fc0]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x60], rax
movabs rax, 0xbd0817d7f6f694b9
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x68], rax
movabs rax, 0xf0574f2f56cc2b96
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x70], rax
movabs rax, 0xf16511b59d3fc72e
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x78], rax
movabs rax, 0x41066a170f63dd2a
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x80], rax
movabs rax, 0xbabde526a58ff9a4
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x88], rax
movabs rax, 0x68f1b50d7698ede
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x48], rdi
mov rax, qword [rbp + 0x48]
lea rdx, [rbp + 0x60]
mov qword [rbp + 0x98], rax
mov qword [rbp + 0x48], r14
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0x48], r15
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0x48], r12
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0x48], r13
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0xb8], rax
movabs rax, 0x41266a720f0fdd43
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0xc0], rax
movabs rax, 0xbad8e54ba5e6f9d0
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0xc8], rax
movabs rax, 0x68f1b50d7478ead
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0x48], rdi
mov rax, qword [rbp + 0x48]
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqu ymm0, ymmword [rbp + 0x80]
vmovdqa ymmword [rbp + 0x60], ymm1
mov qword [rbp + 0xd8], rax
vpxor ymm1, ymm0, ymmword [rbp + 0xc0]
vmovdqa ymmword [rbp + 0x80], ymm1
vzeroupper
call fcn.180011090
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.180011c00
movzx edx, ax
mov rcx, rbx
call fcn.180011a50
mov rcx, rbx
call fcn.180010710
lea rcx, str.PAUSE
call qword [sym.imp.ucrtbased.dll_system]
xor eax, eax
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.180111e20
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], rsi
lea rcx, [rbp + 0x60]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x100
mov dword [rsp + 0x20], 3
mov r8d, 7
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180009b53
lea r9, [rbp + 0x40]
mov rcx, rax
lea r8, [rbp + 0x50]
lea rdx, [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rbx
test eax, eax
je 0x180009b4d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movabs rax, 0xf002e782b703a389
lea rcx, [0x180499e20]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x60], rax
movabs rax, 0xbd11179ef6e694fc
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x68], rax
movabs rax, 0xf05b4f6c569f2b9c
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x70], rax
movabs rax, 0xf16611fc9d36c731
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x78], rax
movabs rax, 0x41536a010f2fdd27
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x80], rax
movabs rax, 0xbaabe52ea585f9b3
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x88], rax
movabs rax, 0x6e31b25d7218ede
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x90], rax
movabs rax, 0xae82af57afd0ca6e
mov qword [rbp + 0x48], rax
jmp 0x180009c01