Function at 0x140085780
Capabilities:
Execute command
Reference wmi statements
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x660
mov rax, qword [0x1401480c0]
xor rax, rsp
mov qword [rsp + 0x650], rax
mov rdi, rcx
mov qword [rsp + 0x70], rcx
xor r15d, r15d
xor r8d, r8d
lea rdx, [0x140122f9a]
sub rcx, 0xffffffffffffff80
call fcn.1400674b0
mov byte [rdi + 0x78], r15b
xorps xmm0, xmm0
movups xmmword [rsp + 0x5a0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x5b0], xmm1
lea ecx, [r15 + 0x20]
call fcn.140094f58
mov qword [rsp + 0x5a0], rax
movdqa xmm0, xmmword [reloc.WLDAP32.dll_Ordinal_22]
movdqu xmmword [rsp + 0x5b0], xmm0
movups xmm1, xmmword [str.https:__api.ipify.org_]
movups xmmword [rax], xmm1
mov ecx, dword [0x140131078]
mov dword [rax + 0x10], ecx
movzx ecx, word [0x14013107c]
mov word [rax + 0x14], cx
mov byte [rax + 0x16], r15b
lea rcx, [rsp + 0x5c0]
call fcn.140064800
mov r8, rax
lea rdx, [rsp + 0x5a0]
lea rcx, [rsp + 0x5d0]
call fcn.140089de0
nop
cmp dword [rsp + 0x5d0], 0xc8
jne 0x1400865bc
lea rdx, [rsp + 0x5d8]
lea rcx, [rsp + 0x580]
call fcn.14004e2f0
nop
lea rcx, [rsp + 0x5d8]
call fcn.140046b40
nop
mov rdx, qword [rsp + 0x5b8]
cmp rdx, 0xf
jbe 0x1400858c6
inc rdx
mov rcx, qword [rsp + 0x5a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400858c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400858c1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400952ac
lea rdx, [rsp + 0x580]
lea rcx, [rdi + 0x58]
call fcn.140068ac0
mov rdx, qword [rsp + 0x598]
cmp rdx, 0xf
jbe 0x14008591d
inc rdx
mov rcx, qword [rsp + 0x580]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140085918
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140085918
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400952ac
lea rcx, [rsp + 0xe0]
call fcn.14008bac0
nop
lea rcx, [rsp + 0x560]
call fcn.14008a9b0
mov rbx, rax
mov byte [rsp + 0xf8], 0
xor eax, eax
mov qword [rsp + 0x100], rax
xor edx, edx
lea rcx, [rsp + 0x100]
call fcn.140066c10
mov byte [rsp + 0xf8], 3
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.140094f58
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], r15
movups xmm0, xmmword [rbx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rax + 0x10], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], r15
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x580], rax
lea rax, [rsp + 0x110]
mov qword [rsp + 0x588], rax
lea rdx, [rsp + 0x580]
lea rcx, [rsp + 0x390]
call fcn.140064370
mov qword [rsp + 0x3a0], r15
lea rcx, [rsp + 0xb0]
call fcn.14008bc10
nop
lea r8, str.PNPDeviceID
lea rdx, str.SELECT__FROM_Win32_VideoController
lea rcx, [rsp + 0x540]
call fcn.14008a3d0
mov rbx, rax
mov byte [rsp + 0xc8], 0
xor eax, eax
mov qword [rsp + 0xd0], rax
xor edx, edx
lea rcx, [rsp + 0xd0]
call fcn.140066c10
mov byte [rsp + 0xc8], 3
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.140094f58
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], r15
movups xmm0, xmmword [rbx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rax + 0x10], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], r15
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x580], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x588], rax
lea rdx, [rsp + 0x580]
lea rcx, [rsp + 0x3a8]
call fcn.140064370
mov qword [rsp + 0x3b8], r15
lea rcx, [rsp + 0x80]
call fcn.14008bcd0
nop
lea r8, str.Product
lea rdx, str.SELECT__FROM_Win32_BaseBoard
lea rcx, [rsp + 0x520]
call fcn.14008a3d0
mov rbx, rax
mov byte [rsp + 0x98], 0
xor eax, eax
mov qword [rsp + 0xa0], rax
xor edx, edx
lea rcx, [rsp + 0xa0]
call fcn.140066c10
mov byte [rsp + 0x98], 3
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.140094f58
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], r15
movups xmm0, xmmword [rbx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rax + 0x10], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], r15
lea rax, [rsp + 0x80]
mov qword [rsp + 0x580], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x588], rax
lea rdx, [rsp + 0x580]
lea rcx, [rsp + 0x3c0]
call fcn.140064370
mov qword [rsp + 0x3d0], r15
mov byte [rsp + 0x38], 0
xor eax, eax
mov qword [rsp + 0x40], rax
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140066c10
mov byte [rsp + 0x38], 3
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.140094f58
nop
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 3
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov ecx, dword [0x140130db8]
mov word [rax], cx
movzx ecx, byte [0x140130dba]
mov byte [rax + 2], cl
mov byte [rax + 3], 0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], r15
lea r8, str.Name
lea rdx, str.SELECT__FROM_Win32_Processor
lea rcx, [rsp + 0x500]
call fcn.14008a3d0
mov rbx, rax
mov byte [rsp + 0x50], 0
xor eax, eax
mov qword [rsp + 0x58], rax
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.140066c10
mov byte [rsp + 0x50], 3
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.140094f58
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], r15
movups xmm0, xmmword [rbx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rax + 0x10], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], r15
lea rax, [rsp + 0x38]
mov qword [rsp + 0x580], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x588], rax
lea rdx, [rsp + 0x580]
lea rcx, [rsp + 0x3d8]
call fcn.140062cc0
nop
lea rdx, [0x140130df0]
lea rcx, [rsp + 0x110]
call fcn.14008bd90
nop
lea r8, str.PartNumber
lea rdx, str.SELECT__FROM_Win32_PhysicalMemory
lea rcx, [rsp + 0x4e0]
call fcn.14008a3d0
nop
mov rcx, rax
call fcn.140046b20
mov rcx, rax
call fcn.14008a940
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x128]
call fcn.14008be50
nop
lea rax, [rsp + 0x110]
mov qword [rsp + 0x580], rax
lea rax, [rsp + 0x140]
mov qword [rsp + 0x588], rax
lea rdx, [rsp + 0x580]
lea rcx, [rsp + 0x3f0]
call fcn.140062cc0
nop
lea rdx, str.SSD_HDD
lea rcx, [rsp + 0x300]
call fcn.14008bd90
nop
lea r8, str.Model
lea rdx, str.SELECT__FROM_Win32_DiskDrive
lea rcx, [rsp + 0x4c0]
call fcn.14008a3d0
nop
mov rdx, rax
lea rcx, [rsp + 0x318]
call fcn.14008bb80
nop
lea rax, [rsp + 0x300]
mov qword [rsp + 0x580], rax
lea rax, [rsp + 0x330]
mov qword [rsp + 0x588], rax
lea rdx, [rsp + 0x580]
lea rcx, [rsp + 0x408]
call fcn.140062cc0
nop
lea rdx, [0x140130e70]
lea rcx, [rsp + 0x2d0]
call fcn.14008bd90
nop
lea r8, str.Name
lea rdx, str.SELECT__FROM_Win32_VideoController
lea rcx, [rsp + 0x4a0]
call fcn.14008a3d0
nop
mov rdx, rax
lea rcx, [rsp + 0x2e8]
call fcn.14008bb80
nop
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x580], rax
lea rax, [rsp + 0x300]
mov qword [rsp + 0x588], rax
lea rdx, [rsp + 0x580]
lea rcx, [rsp + 0x420]
call fcn.140062cc0
nop
lea rdx, str.discord
lea rcx, [rsp + 0x1e0]
call fcn.14008bd90
nop
lea rdx, str.username
lea rcx, [rsp + 0x2a0]
call fcn.14008bd90
nop
lea rdx, [0x1409d482b]
lea rcx, [rsp + 0x2b8]
call fcn.14008bd90
nop
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0x580], rax
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x588], rax
lea rdx, [rsp + 0x580]
lea rcx, [rsp + 0x330]
call fcn.140062cc0
nop
lea rcx, [rsp + 0x270]
call fcn.14008bf10
nop
lea rdx, [0x1409d4722]
lea rcx, [rsp + 0x288]
call fcn.14008bd90
nop
lea rax, [rsp + 0x270]
mov qword [rsp + 0x580], rax
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0x588], rax
lea rdx, [rsp + 0x580]
lea rcx, [rsp + 0x348]
call fcn.140062cc0
nop
lea rdx, str.avatar_url
lea rcx, [rsp + 0x240]
call fcn.14008bd90
nop
lea rdx, [0x1409d4934]
lea rcx, [rsp + 0x258]
call fcn.14008bd90
nop
lea rax, [rsp + 0x240]
mov qword [rsp + 0x580], rax
lea rax, [rsp + 0x270]
mov qword [rsp + 0x588], rax
lea rdx, [rsp + 0x580]
lea rcx, [rsp + 0x360]
call fcn.140062cc0
nop
lea rdx, str.is_running
lea rcx, [rsp + 0x210]
call fcn.14008bd90
lea rdx, [0x1409d4720]
lea rcx, [rsp + 0x228]
call fcn.14008bfd0
nop
lea rax, [rsp + 0x210]
mov qword [rsp + 0x580], rax
lea rax, [rsp + 0x240]
mov qword [rsp + 0x588], rax
lea rdx, [rsp + 0x580]
lea rcx, [rsp + 0x378]
call fcn.140062cc0
nop
lea rax, [rsp + 0x330]
mov qword [rsp + 0x580], rax
lea rax, [rsp + 0x390]
mov qword [rsp + 0x588], rax
lea rdx, [rsp + 0x580]
lea rcx, [rsp + 0x1f8]
call fcn.140062cc0
nop
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x580], rax
lea rax, [rsp + 0x210]
mov qword [rsp + 0x588], rax
lea rdx, [rsp + 0x580]
lea rcx, [rsp + 0x438]
call fcn.140062cc0
nop
lea rcx, [rsp + 0x1b0]
call fcn.14008c030
nop
call fcn.14008a230
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x1c8]
call fcn.14008be50
nop
lea rax, [rsp + 0x1b0]
mov qword [rsp + 0x580], rax
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x588], rax
lea rdx, [rsp + 0x580]
lea rcx, [rsp + 0x450]
call fcn.140062cc0
nop
lea rcx, [rsp + 0x180]
call fcn.14008c0f0
nop
lea rcx, [rdi + 0x58]
call fcn.140046b20
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x198]
call fcn.14008be50
nop
lea rax, [rsp + 0x180]
mov qword [rsp + 0x580], rax
lea rax, [rsp + 0x1b0]
mov qword [rsp + 0x588], rax
lea rdx, [rsp + 0x580]
lea rcx, [rsp + 0x468]
call fcn.140062cc0
nop
lea rdx, [0x140130ec8]
lea rcx, [rsp + 0x150]
call fcn.14008bd90
nop
lea rdx, [rdi + 0x20]
lea rcx, [rsp + 0x168]
call fcn.14008c1b0
nop
lea rax, [rsp + 0x150]
mov qword [rsp + 0x580], rax
lea rax, [rsp + 0x180]
mov qword [rsp + 0x588], rax
lea rdx, [rsp + 0x580]
lea rcx, [rsp + 0x480]
call fcn.140062cc0
nop
lea rax, [rsp + 0x390]
mov qword [rsp + 0x580], rax
lea rax, [rsp + 0x498]
mov qword [rsp + 0x588], rax
lea rdx, [rsp + 0x580]
lea rcx, [rsp + 0x5c0]
call fcn.140064370
nop
lea r9, [0x140062c60]
mov edx, Ordinal_26
lea r8d, [rdx - 0xd]
lea rcx, [rsp + 0x390]
call fcn.140094f94
nop
lea r9, [0x140062c60]
mov edx, Ordinal_26
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0x150]
call fcn.140094f94
nop
lea r9, [0x140062c60]
mov edx, Ordinal_26
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0x180]
call fcn.140094f94
nop
lea r9, [0x140062c60]
mov edx, Ordinal_26
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0x1b0]
call fcn.140094f94
nop
lea r9, [0x140062c60]
mov edx, Ordinal_26
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0x1e0]
call fcn.140094f94
nop
lea r9, [0x140062c60]
mov edx, Ordinal_26
lea r8d, [rdx - 0x14]
lea rcx, [rsp + 0x330]
call fcn.140094f94
nop
lea r9, [0x140062c60]
mov edx, Ordinal_26
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0x210]
call fcn.140094f94
nop
lea r9, [0x140062c60]
mov edx, Ordinal_26
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0x240]
call fcn.140094f94
nop
lea r9, [0x140062c60]
mov edx, Ordinal_26
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0x270]
call fcn.140094f94
nop
lea r9, [0x140062c60]
mov edx, Ordinal_26
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0x2a0]
call fcn.140094f94
nop
lea r9, [0x140062c60]
mov edx, Ordinal_26
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0x2d0]
call fcn.140094f94
nop
lea rcx, [rsp + 0x4a0]
call fcn.140046b40
nop
lea r9, [0x140062c60]
mov edx, Ordinal_26
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0x300]
call fcn.140094f94
nop
lea rcx, [rsp + 0x4c0]
call fcn.140046b40
nop
lea r9, [0x140062c60]
mov edx, Ordinal_26
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0x110]
call fcn.140094f94
nop
lea rcx, [rsp + 0x4e0]
call fcn.140046b40
nop
lea r9, [0x140062c60]
mov edx, Ordinal_26
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0x38]
call fcn.140094f94
nop
lea rcx, [rsp + 0x500]
call fcn.140046b40
nop
lea r9, [0x140062c60]
mov edx, Ordinal_26
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0x80]
call fcn.140094f94
nop
lea rcx, [rsp + 0x520]
call fcn.140046b40
nop
lea r9, [0x140062c60]
mov edx, Ordinal_26
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0xb0]
call fcn.140094f94
nop
lea rcx, [rsp + 0x540]
call fcn.140046b40
nop
lea r9, [0x140062c60]
mov edx, Ordinal_26
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0xe0]
call fcn.140094f94
nop
lea rcx, [rsp + 0x560]
call fcn.140046b40
lea rax, [rsp + 0x5a0]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x5c0]
lea rcx, [rsp + 0x5a0]
call fcn.140068690
mov rbx, rax
lea r8, str._init
mov rdx, rdi
lea rcx, [rsp + 0x5d0]
call fcn.14006c640
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x618]
call fcn.140089a10
nop
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x5f8]
call fcn.14004e2f0
nop
cmp dword [rsp + 0x618], 0xc8
jne 0x1400864ea
mov qword [rsp + 0x148], r15
lea r8, [rsp + 0x110]
lea rdx, [rsp + 0x5f8]
lea rcx, [rsp + 0x580]
call fcn.14008c1d0
nop
lea rdx, [0x14012d4c0]
lea rcx, [rsp + 0x580]
call fcn.14006cf10
mov rcx, rax
call fcn.14006cdc0
movzx ebx, al
lea rdx, str.message
lea rcx, [rsp + 0x580]
call fcn.14006cf10
lea rdx, [rsp + 0x5a0]
mov rcx, rax
call fcn.14006cc50
nop
mov byte [rdi + 0x78], bl
lea rdx, [rsp + 0x5a0]
lea rcx, [rdi + 0x80]
call fcn.140065190
mov byte [rdi + 0x100], 1
lea rcx, [rsp + 0x5a0]
call fcn.140046b40
nop
lea rcx, [rsp + 0x580]
call fcn.1400642d0
jmp 0x14008656a
mov byte [rdi + 0x78], 0
mov qword [rsp + 0x148], r15
lea r8, [rsp + 0x110]
lea rdx, [rsp + 0x5f8]
lea rcx, [rsp + 0x580]
call fcn.14008c1d0
nop
lea rdx, str.message
lea rcx, [rsp + 0x580]
call fcn.14006cf10
lea rdx, [rsp + 0x5a0]
mov rcx, rax
call fcn.14006cc50
nop
lea rdx, [rsp + 0x5a0]
lea rcx, [rdi + 0x80]
call fcn.140065190
nop
lea rcx, [rsp + 0x5a0]
call fcn.140046b40
nop
lea rcx, [rsp + 0x580]
call fcn.1400642d0
nop
lea rcx, [rsp + 0x5f8]
call fcn.140046b40
nop
lea rcx, [rsp + 0x620]
call fcn.140046b40
nop
lea rcx, [rsp + 0x5c0]
call fcn.1400642d0
mov rcx, qword [rsp + 0x650]
xor rcx, rsp
call fcn.140095860
lea r11, [rsp + 0x660]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
lea rcx, str.start_cmd.exe__K__echo_application_was_not_able_to_retreive_information_that_requires_connection__pause___nul__exit_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3