Function at 0x1400409d0
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x100]
sub rsp, 0x200
movaps xmmword [rsp + 0x1f0], xmm6
mov rax, qword [0x14019f0c0]
xor rax, rsp
mov qword [rbp + 0xe0], rax
xor ebx, ebx
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], rbx
mov r8d, 0x2d0
lea rdx, str.__echo_off_n_title_SCS_HWID_Checker_n_echo._n_color_90_n_echo._ncolor_90_n_:start_n_color_4_n_cls_n__echo_e_34m_n___echo_Disk_Drive_Serial_Numbers_:_n___echo_e_0m_n____wmic_diskdrive_get_model__serialnumber_n___echo_e_34m_n_echo_CPU_Serial_Number_n_echo_e_0m_n_wmic_cpu_get_serialnumber_n_echo_e_34m_n_echo_BIOS_Serial_Number_n_echo_e_0m_n_wmic_bios_get_serialnumber_n_echo_e_34m_necho_Motherboard_Serial_Number_n__echo_e_0m_n__wmic_baseboard_get_serialnumber_n_echo_e_34m_n__echo_Motherboard_Manufacturer_n_echo_e_0m_nwmic_baseboard_get_product__manufacturer__version_n_echo_e_34m_n_echo_UUID_Serial_Number_n_echo_e_0m_n_wmic_path_win32_computersystemproduct_get_uuid_n_echo_e_34m_n_echo_MAC_Addresses_n_echo_e_0m_ngetmac_necho_e_0m_npause___nul_ngoto_start_n
lea rcx, [rbp - 0x58]
call fcn.140044700
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x80], rbx
mov r8d, Ordinal_41
lea rdx, str.C:Windows_scsspooferSerialChecker.bat
lea rcx, [rsp + 0x68]
call fcn.140044700
nop
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 2
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x30]
call fcn.140042690
nop
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0xf
cmova rdx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x48]
lea rcx, [rbp - 0x30]
call fcn.1400453f0
lea rcx, [rbp - 0x28]
call fcn.140043030
test rax, rax
jne 0x140040abb
mov rax, qword [rbp - 0x30]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x30]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
movabs rax, 0x7fffffffffffffff
mov rcx, qword [rsp + 0x78]
sub rax, rcx
cmp rax, 0xc
jb 0x140040d33
lea rax, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], send
lea r9, str.cmd.exe__C__
lea r8, [rsp + 0x68]
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.140045190
nop
mov r8d, 1
lea rdx, [0x1401853cc]
lea rcx, [rsp + 0x48]
call fcn.1400433c0
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x140040b9a
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040b95
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140040b95
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401159d4
movdqa xmm6, xmmword [0x140186650]
movdqu xmmword [rsp + 0x58], xmm6
mov byte [rsp + 0x48], 0
lea rcx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0xf
cmova rcx, qword [rbp - 0x78]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
je 0x140040be9
lea rdx, str.Failed_to_execute_Serial_Checker_script.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140043b40
lea rdx, [0x140043d20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x140040c2f
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040c22
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140040c22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401159d4
movdqa xmm6, xmmword [0x140186650]
movdqu xmmword [rbp - 0x68], xmm6
mov byte [rbp - 0x78], 0
mov rax, qword [rbp - 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x30], rax
mov rax, qword [rbp - 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 0x34], edx
lea rcx, [rbp - 0x28]
call fcn.140042620
lea rcx, [rbp - 0x20]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x78]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x140040cbb
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040cb6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140040cb6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401159d4
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x80], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x68], 0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x140040d0b
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040d06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140040d06
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401159d4
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.1401152a0
mov rbx, qword [rsp + 0x210]
movaps xmm6, xmmword [rsp + 0x1f0]
add rsp, 0x200
pop rbp
ret
call fcn.140037170
nop
int3