Function at 0x1400c6b8b
Capabilities:
Execute command
Terminate process

Disassembly:
jmp 0x140207cc0
push rbp
push rsi
push rdi
sub rsp, 0x980
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x198
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14044aff8]
xor rax, rbp
mov qword [rbp + 0x958], rax
lea rcx, reloc.d2d1.dll_Ordinal_1
call fcn.1400c9dfe
lea rcx, [0x1400c939f]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rax, [rbp + 0x464]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x488]
lea rcx, [rbp + 0x464]
call fcn.140203ed0
mov rcx, rax
call fcn.1400ca330
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
lea rax, [rbp + 0x4b4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x4d4]
lea rcx, [rbp + 0x4b4]
call fcn.140204070
mov rcx, rax
call fcn.1400ca3df
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
lea rax, [rbp + 0x4f4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x4f4]
call fcn.140204220
lea rcx, [rbp + 8]
call fcn.1400c7de7
mov rcx, rax
call fcn.1400c8aa8
mov qword [rbp + 0x38], rax
cmp qword [rbp + 0x38], 0
jne 0x140207e3e
lea rax, [rbp + 0x578]
lea rcx, [rbp + 8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xd
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x514]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x538]
lea rcx, [rbp + 0x514]
call fcn.140204290
mov rcx, rax
call fcn.1400c9601
mov qword [rbp + 0x948], rax
lea rax, [rbp + 0x900]
lea rcx, [rbp + 0x578]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xd
rep movsb byte [rdi], byte [rsi]
lea rdx, [rbp + 0x900]
mov rcx, qword [rbp + 0x948]
call fcn.1400c7cf7
xor al, al
jmp 0x1402081c9
lea rax, [rbp + 0x5f8]
lea rcx, [rbp + 8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xd
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x5a4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x5c8]
lea rcx, [rbp + 0x5a4]
call fcn.140204300
mov rcx, rax
call fcn.1400c7de7
mov qword [rbp + 0x948], rax
lea rax, [rbp + 0x930]
lea rcx, [rbp + 0x5f8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xd
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rbp + 0x38]
lea rdx, [rbp + 0x930]
mov rcx, qword [rbp + 0x948]
call fcn.1400c7cf7
call fcn.1400c69e2
movzx eax, al
test eax, eax
jne 0x140207f06
lea rax, [rbp + 0x624]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x648]
lea rcx, [rbp + 0x624]
call fcn.140204370
mov rcx, rax
call fcn.1400c8710
mov rcx, rax
call fcn.1400c7cf7
xor al, al
jmp 0x1402081c9
xor edx, edx
xor ecx, ecx
call fcn.1400c986d
movzx eax, al
test eax, eax
jne 0x140207f58
lea rax, [rbp + 0x694]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x6b8]
lea rcx, [rbp + 0x694]
call fcn.1402043e0
mov rcx, rax
call fcn.1400c786f
mov rcx, rax
call fcn.1400c7cf7
call fcn.1400c9db8
xor al, al
jmp 0x1402081c9
mov ecx, dword [rbp + 0x38]
call fcn.1400c65c3
mov qword [0x140453d50], rax
cmp qword [0x140453d50], 0
jne 0x140207fb3
lea rax, [rbp + 0x704]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x728]
lea rcx, [rbp + 0x704]
call fcn.140204450
mov rcx, rax
call fcn.1400c66ef
mov rcx, rax
call fcn.1400c7cf7
call fcn.1400c9db8
xor al, al
jmp 0x1402081c9
mov rdx, qword [0x140453d50]
lea rcx, [rbp + 0x768]
call fcn.1400c86b6
lea rcx, [rbp + 0x60]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x40
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x7c4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx eax, word [rbp + 0x60]
mov dword [rbp + 0x944], eax
lea rdx, [rbp + 0x7e8]
lea rcx, [rbp + 0x7c4]
call fcn.1402044c0
mov rcx, rax
call fcn.1400c72f2
mov ecx, dword [rbp + 0x944]
mov edx, ecx
mov rcx, rax
call fcn.1400c7cf7
movzx eax, word [rbp + 0x60]
cmp eax, 0x5a4d
je 0x140208060
lea rax, [rbp + 0x824]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x848]
lea rcx, [rbp + 0x824]
call fcn.140203bf0
mov rcx, rax
call fcn.1400c9273
mov rcx, rax
call fcn.1400c7cf7
lea rax, [rbp + 0x884]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x8a8]
lea rcx, [rbp + 0x884]
call fcn.140203c60
mov rcx, rax
call fcn.1400c9926
mov qword [rbp + 0x948], rax
mov rax, qword [0x140453d50]
mov qword [rbp + 0x950], rax
mov r8d, 3
mov rdx, qword [rbp + 0x948]
mov rcx, qword [rbp + 0x950]
call fcn.1400c9647
mov dword [0x140453d68], eax
cmp dword [0x140453d68], 0
jne 0x1402080d3
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov qword [rbp + 0xe8], rax
lea rdx, [rbp + 0xb8]
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rbp + 0x108], rax
mov edx, 0xa
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [rbp + 0x124], eax
mov edx, 0x75
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [rbp + 0x144], eax
mov eax, dword [rbp + 0xb8]
mov ecx, dword [rbp + 0xc0]
sub ecx, eax
mov eax, ecx
imul eax, dword [rbp + 0x144]
cdq
idiv dword [rbp + 0x124]
mov dword [0x140454a6c], eax
mov eax, dword [rbp + 0xbc]
mov ecx, dword [rbp + 0xc4]
sub ecx, eax
mov eax, ecx
imul eax, dword [rbp + 0x144]
cdq
idiv dword [rbp + 0x124]
mov dword [0x140454a68], eax
cvtsi2ss xmm0, dword [0x140454a6c]
divss xmm0, dword [0x140262ddc]
movss dword [0x140453db0], xmm0
cvtsi2ss xmm0, dword [0x140454a68]
divss xmm0, dword [0x140262ddc]
movss dword [0x140453db4], xmm0
mov qword [0x140453d60], 0
mov rcx, qword [0x140453d60]
call fcn.14020b2b0
mov al, 1
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1402abcc0]
call fcn.1400c9386
mov rax, rdi
mov rcx, qword [rbp + 0x958]
xor rcx, rbp
call fcn.1400c7dba
lea rsp, [rbp + 0x960]
pop rdi
pop rsi
pop rbp
ret