Function at 0x14008b730
Capabilities:
Execute command
Reference wmi statements
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x6d0
mov rax, qword [0x1403d3080]
xor rax, rsp
mov qword [rsp + 0x6c0], rax
mov rdi, rcx
mov qword [rsp + 0xd0], rcx
xor r12d, r12d
lea rsi, [rcx + 0x80]
mov rax, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x14008b780
mov rax, qword [rsi]
mov qword [rsi + 0x10], r12
mov byte [rax], r12b
mov byte [rcx + 0x78], r12b
xorps xmm0, xmm0
movups xmmword [rsp + 0x630], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x640], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_22
lea rdx, str.https:__api.ipify.org_
lea rcx, [rsp + 0x630]
call fcn.1400041a0
nop
mov byte [rsp + 0x620], 0
xor edx, edx
lea rcx, [rsp + 0x628]
call fcn.140094f00
nop
lea r8, [rsp + 0x620]
lea rdx, [rsp + 0x630]
lea rcx, [rsp + 0x650]
call fcn.140091dc0
nop
cmp dword [rsp + 0x650], 0xc8
jne 0x14008c7e9
lea rdx, [rsp + 0x658]
lea rcx, [rsp + 0x600]
call fcn.14000d8b0
nop
lea rcx, [rsp + 0x658]
call fcn.140003530
nop
lea rcx, [rsp + 0x630]
call fcn.140003530
lea rdx, [rsp + 0x600]
lea rcx, [rdi + 0x58]
call fcn.14002c640
lea rcx, [rsp + 0x600]
call fcn.140003530
lea rcx, [rsp + 0xe0]
call fcn.1400972f0
nop
lea rcx, [rsp + 0x4f0]
call fcn.1400929e0
mov rbx, rax
mov byte [rsp + 0xf8], 0
xor eax, eax
mov qword [rsp + 0x100], rax
xor edx, edx
lea rcx, [rsp + 0x100]
call fcn.140094a70
mov byte [rsp + 0xf8], 3
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.140161880
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r12
movups xmm0, xmmword [rbx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rax + 0x10], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], r12
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x600], rax
lea rax, [rsp + 0x110]
mov qword [rsp + 0x608], rax
lea rdx, [rsp + 0x600]
lea rcx, [rsp + 0x360]
call fcn.1400936f0
mov qword [rsp + 0x370], r12
lea rcx, [rsp + 0x110]
call fcn.140097440
nop
lea r8, str.PNPDeviceID
lea rdx, str.SELECT__FROM_Win32_VideoController
lea rcx, [rsp + 0x510]
call fcn.1400923f0
mov rbx, rax
mov byte [rsp + 0x128], 0
xor eax, eax
mov qword [rsp + 0x130], rax
xor edx, edx
lea rcx, [rsp + 0x130]
call fcn.140094a70
mov byte [rsp + 0x128], 3
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.140161880
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r12
movups xmm0, xmmword [rbx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rax + 0x10], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x138], r12
lea rax, [rsp + 0x110]
mov qword [rsp + 0x600], rax
lea rax, [rsp + 0x140]
mov qword [rsp + 0x608], rax
lea rdx, [rsp + 0x600]
lea rcx, [rsp + 0x378]
call fcn.1400936f0
mov qword [rsp + 0x388], r12
lea rcx, [rsp + 0x140]
call fcn.140097500
nop
lea r8, str.Product
lea rdx, str.SELECT__FROM_Win32_BaseBoard
lea rcx, [rsp + 0x530]
call fcn.1400923f0
mov rbx, rax
mov byte [rsp + 0x158], 0
xor eax, eax
mov qword [rsp + 0x160], rax
xor edx, edx
lea rcx, [rsp + 0x160]
call fcn.140094a70
mov byte [rsp + 0x158], 3
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.140161880
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r12
movups xmm0, xmmword [rbx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rax + 0x10], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], r12
lea rax, [rsp + 0x140]
mov qword [rsp + 0x600], rax
lea rax, [rsp + 0x170]
mov qword [rsp + 0x608], rax
lea rdx, [rsp + 0x600]
lea rcx, [rsp + 0x390]
call fcn.1400936f0
mov qword [rsp + 0x3a0], r12
mov byte [rsp + 0x68], 0
xor eax, eax
mov qword [rsp + 0x70], rax
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.140094a70
mov byte [rsp + 0x68], 3
xorps xmm0, xmm0
movups xmmword [rsp + 0x600], xmm0
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.140161880
mov rbx, rax
lea rax, [rsp + 0x5f0]
mov qword [rsp + 0x600], rax
mov qword [rsp + 0x608], rbx
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r12
mov r8d, 3
lea rdx, [0x1403b21f0]
mov rcx, rbx
call fcn.1400041a0
nop
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], r12
lea r8, str.Name
lea rdx, str.SELECT__FROM_Win32_Processor
lea rcx, [rsp + 0x550]
call fcn.1400923f0
mov rbx, rax
mov byte [rsp + 0x80], 0
xor eax, eax
mov qword [rsp + 0x88], rax
xor edx, edx
lea rcx, [rsp + 0x88]
call fcn.140094a70
mov byte [rsp + 0x80], 3
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.140161880
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r12
movups xmm0, xmmword [rbx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rax + 0x10], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], r12
lea rax, [rsp + 0x68]
mov qword [rsp + 0x600], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x608], rax
lea rdx, [rsp + 0x600]
lea rcx, [rsp + 0x3a8]
call fcn.1400936f0
mov qword [rsp + 0x3b8], r12
mov byte [rsp + 0x98], 0
xor eax, eax
mov qword [rsp + 0xa0], rax
xor edx, edx
lea rcx, [rsp + 0xa0]
call fcn.140094a70
mov byte [rsp + 0x98], 3
xorps xmm0, xmm0
movups xmmword [rsp + 0x600], xmm0
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.140161880
mov rbx, rax
lea rax, [rsp + 0x5f0]
mov qword [rsp + 0x600], rax
mov qword [rsp + 0x608], rbx
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r12
mov r8d, 3
lea rdx, [0x1403b2218]
mov rcx, rbx
call fcn.1400041a0
nop
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], r12
lea r8, str.PartNumber
lea rdx, str.SELECT__FROM_Win32_PhysicalMemory
lea rcx, [rsp + 0x570]
call fcn.1400923f0
nop
cmp qword [rax + 0x18], 0xf
jbe 0x14008bcbe
mov rax, qword [rax]
mov rcx, rax
call fcn.140092970
mov rbx, rax
mov byte [rsp + 0xb0], 0
xor eax, eax
mov qword [rsp + 0xb8], rax
xor edx, edx
lea rcx, [rsp + 0xb8]
call fcn.140094a70
mov byte [rsp + 0xb0], 3
xorps xmm0, xmm0
movups xmmword [rsp + 0x600], xmm0
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.140161880
mov r14, rax
lea rax, [rsp + 0x5f0]
mov qword [rsp + 0x600], rax
mov qword [rsp + 0x608], r14
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], r12
mov qword [r14 + 0x18], r12
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x14008bd40
mov rdx, rbx
mov rcx, r14
call fcn.1400041a0
nop
mov qword [rsp + 0xb8], r14
mov qword [rsp + 0xc0], r12
lea rax, [rsp + 0x98]
mov qword [rsp + 0x600], rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x608], rax
lea rdx, [rsp + 0x600]
lea rcx, [rsp + 0x3c0]
call fcn.1400936f0
mov qword [rsp + 0x3d0], r12
mov byte [rsp + 0x38], 0
xor eax, eax
mov qword [rsp + 0x40], rax
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140094a70
mov byte [rsp + 0x38], 3
xorps xmm0, xmm0
movups xmmword [rsp + 0x600], xmm0
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.140161880
mov rbx, rax
lea rax, [rsp + 0x5f0]
mov qword [rsp + 0x600], rax
mov qword [rsp + 0x608], rbx
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r12
mov r8d, 7
lea rdx, str.SSD_HDD
mov rcx, rbx
call fcn.1400041a0
nop
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], r12
lea r8, str.Model
lea rdx, str.SELECT__FROM_Win32_DiskDrive
lea rcx, [rsp + 0x590]
call fcn.1400923f0
mov rbx, rax
mov byte [rsp + 0x50], 0
xor eax, eax
mov qword [rsp + 0x58], rax
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.140094a70
mov byte [rsp + 0x50], 3
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.140161880
lea rcx, [rsp + 0x5f0]
mov qword [rsp + 0x620], rcx
mov qword [rsp + 0x628], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r12
movups xmm0, xmmword [rbx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rax + 0x10], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
lea rcx, [rsp + 0x620]
call fcn.1400a5d00
mov rbx, rax
lea rcx, [rsp + 0x620]
call fcn.140004a40
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], r12
lea rax, [rsp + 0x38]
mov qword [rsp + 0x600], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x608], rax
lea rdx, [rsp + 0x600]
lea rcx, [rsp + 0x3d8]
call fcn.140093090
nop
lea rdx, [0x1403b22d8]
lea rcx, [rsp + 0x170]
call fcn.1400975c0
nop
lea r8, str.Name
lea rdx, str.SELECT__FROM_Win32_VideoController
lea rcx, [rsp + 0x5b0]
call fcn.1400923f0
nop
mov rdx, rax
lea rcx, [rsp + 0x188]
call fcn.1400973b0
nop
lea rax, [rsp + 0x170]
mov qword [rsp + 0x600], rax
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x608], rax
lea rdx, [rsp + 0x600]
lea rcx, [rsp + 0x3f0]
call fcn.140093090
nop
lea rdx, str.discord
lea rcx, [rsp + 0x2a0]
call fcn.1400975c0
nop
lea rdx, str.username
lea rcx, [rsp + 0x1b0]
call fcn.1400975c0
nop
lea rdx, [0x14042419b]
lea rcx, [rsp + 0x1c8]
call fcn.1400975c0
nop
lea rax, [rsp + 0x1b0]
mov qword [rsp + 0x600], rax
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x608], rax
lea rdx, [rsp + 0x600]
lea rcx, [rsp + 0x470]
call fcn.140093090
nop
lea rcx, [rsp + 0x1e0]
call fcn.140097740
nop
lea rdx, [0x140424092]
lea rcx, [rsp + 0x1f8]
call fcn.1400975c0
nop
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x600], rax
lea rax, [rsp + 0x210]
mov qword [rsp + 0x608], rax
lea rdx, [rsp + 0x600]
lea rcx, [rsp + 0x488]
call fcn.140093090
nop
lea rdx, [0x1403b2304]
lea rcx, [rsp + 0x210]
call fcn.1400975c0
nop
lea rax, [0x1403b2308]
mov qword [rsp + 0x600], rax
mov qword [rsp + 0x608], 5
lea r8, [0x140424092]
lea rdx, [rsp + 0x600]
lea rcx, [rsp + 0x5d0]
call fcn.140097290
nop
mov rdx, rax
lea rcx, [rsp + 0x228]
call fcn.1400973b0
nop
lea rax, [rsp + 0x210]
mov qword [rsp + 0x600], rax
lea rax, [rsp + 0x240]
mov qword [rsp + 0x608], rax
lea rdx, [rsp + 0x600]
lea rcx, [rsp + 0x4a0]
call fcn.140093090
nop
lea rdx, str.avatar_url
lea rcx, [rsp + 0x240]
call fcn.1400975c0
nop
lea rdx, [0x1404242a4]
lea rcx, [rsp + 0x258]
call fcn.1400975c0
nop
lea rax, [rsp + 0x240]
mov qword [rsp + 0x600], rax
lea rax, [rsp + 0x270]
mov qword [rsp + 0x608], rax
lea rdx, [rsp + 0x600]
lea rcx, [rsp + 0x4b8]
call fcn.140093090
nop
lea rdx, str.is_running
lea rcx, [rsp + 0x270]
call fcn.1400975c0
lea rdx, [0x140424090]
lea rcx, [rsp + 0x288]
call fcn.140097800
nop
lea rax, [rsp + 0x270]
mov qword [rsp + 0x600], rax
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0x608], rax
lea rdx, [rsp + 0x600]
lea rcx, [rsp + 0x4d0]
call fcn.140093090
nop
lea rax, [rsp + 0x470]
mov qword [rsp + 0x600], rax
lea rax, [rsp + 0x4e8]
mov qword [rsp + 0x608], rax
lea rdx, [rsp + 0x600]
lea rcx, [rsp + 0x2b8]
call fcn.140093090
nop
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0x600], rax
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x608], rax
lea rdx, [rsp + 0x600]
lea rcx, [rsp + 0x408]
call fcn.140093090
nop
lea rcx, [rsp + 0x2d0]
call fcn.140097860
nop
call fcn.140092260
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x2e8]
call fcn.140097680
nop
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x600], rax
lea rax, [rsp + 0x300]
mov qword [rsp + 0x608], rax
lea rdx, [rsp + 0x600]
lea rcx, [rsp + 0x420]
call fcn.140093090
nop
lea rcx, [rsp + 0x300]
call fcn.140097bb0
nop
lea rcx, [rdi + 0x58]
call fcn.140003330
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x318]
call fcn.140097680
nop
lea rax, [rsp + 0x300]
mov qword [rsp + 0x600], rax
lea rax, [rsp + 0x330]
mov qword [rsp + 0x608], rax
lea rdx, [rsp + 0x600]
lea rcx, [rsp + 0x438]
call fcn.140093090
nop
lea rdx, str.version
lea rcx, [rsp + 0x330]
call fcn.1400975c0
nop
lea rdx, [rdi + 0x20]
lea rcx, [rsp + 0x348]
call fcn.140097920
nop
lea rax, [rsp + 0x330]
mov qword [rsp + 0x600], rax
lea rax, [rsp + 0x360]
mov qword [rsp + 0x608], rax
lea rdx, [rsp + 0x600]
lea rcx, [rsp + 0x450]
call fcn.140093090
nop
lea rax, [rsp + 0x360]
mov qword [rsp + 0x620], rax
lea rax, [rsp + 0x468]
mov qword [rsp + 0x628], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x600]
call fcn.1400936f0
nop
lea r9, [0x14008b710]
mov edx, Ordinal_27
lea r8d, [rdx - 0xd]
lea rcx, [rsp + 0x360]
call fcn.140161ef4
nop
lea r9, [0x14008b710]
mov edx, Ordinal_27
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0x330]
call fcn.140161ef4
nop
lea r9, [0x14008b710]
mov edx, Ordinal_27
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0x300]
call fcn.140161ef4
nop
lea r9, [0x14008b710]
mov edx, Ordinal_27
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0x2d0]
call fcn.140161ef4
nop
lea r9, [0x14008b710]
mov edx, Ordinal_27
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0x2a0]
call fcn.140161ef4
nop
lea r9, [0x14008b710]
mov edx, Ordinal_27
lea r8d, [rdx - 0x13]
lea rcx, [rsp + 0x470]
call fcn.140161ef4
nop
lea r9, [0x14008b710]
mov edx, Ordinal_27
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0x270]
call fcn.140161ef4
nop
lea r9, [0x14008b710]
mov edx, Ordinal_27
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0x240]
call fcn.140161ef4
nop
lea r9, [0x14008b710]
mov edx, Ordinal_27
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0x210]
call fcn.140161ef4
nop
lea rcx, [rsp + 0x5d0]
call fcn.140003530
nop
lea r9, [0x14008b710]
mov edx, Ordinal_27
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0x1e0]
call fcn.140161ef4
nop
lea r9, [0x14008b710]
mov edx, Ordinal_27
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0x1b0]
call fcn.140161ef4
nop
lea r9, [0x14008b710]
mov edx, Ordinal_27
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0x170]
call fcn.140161ef4
nop
lea rcx, [rsp + 0x5b0]
call fcn.140003530
nop
lea r9, [0x14008b710]
mov edx, Ordinal_27
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0x38]
call fcn.140161ef4
nop
lea rcx, [rsp + 0x590]
call fcn.140003530
nop
lea r9, [0x14008b710]
mov edx, Ordinal_27
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0x98]
call fcn.140161ef4
nop
lea rcx, [rsp + 0x570]
call fcn.140003530
nop
lea r9, [0x14008b710]
mov edx, Ordinal_27
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0x68]
call fcn.140161ef4
nop
lea rcx, [rsp + 0x550]
call fcn.140003530
nop
lea r9, [0x14008b710]
mov edx, Ordinal_27
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0x140]
call fcn.140161ef4
nop
lea rcx, [rsp + 0x530]
call fcn.140003530
nop
lea r9, [0x14008b710]
mov edx, Ordinal_27
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0x110]
call fcn.140161ef4
nop
lea rcx, [rsp + 0x510]
call fcn.140003530
nop
lea r9, [0x14008b710]
mov edx, Ordinal_27
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0xe0]
call fcn.140161ef4
nop
lea rcx, [rsp + 0x4f0]
call fcn.140003530
lea rax, [rsp + 0x630]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x600]
lea rcx, [rsp + 0x630]
call fcn.1400933a0
mov rbx, rax
lea r8, str._init
mov rdx, rdi
lea rcx, [rsp + 0x650]
call fcn.140086b50
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x698]
call fcn.140091990
nop
lea rdx, [rsp + 0x6a0]
lea rcx, [rsp + 0x678]
call fcn.14000d8b0
nop
cmp dword [rsp + 0x698], 0xc8
jne 0x14008c705
mov qword [rsp + 0x1a8], r12
lea r8, [rsp + 0x170]
lea rdx, [rsp + 0x678]
lea rcx, [rsp + 0x620]
call fcn.140097950
nop
lea rdx, str.success
lea rcx, [rsp + 0x620]
call fcn.140097a70
mov rcx, rax
call fcn.140097ac0
movzx ebx, al
lea rdx, str.message
lea rcx, [rsp + 0x620]
call fcn.140097a70
lea rdx, [rsp + 0x630]
mov rcx, rax
call fcn.140097b20
nop
mov byte [rdi + 0x78], bl
lea rdx, [rsp + 0x630]
mov rcx, rsi
call fcn.14000d710
mov byte [rdi + 0x100], 1
lea rcx, [rsp + 0x630]
call fcn.140003530
nop
movzx edx, byte [rsp + 0x620]
lea rcx, [rsp + 0x628]
call fcn.140094a70
nop
jmp 0x14008c789
mov byte [rdi + 0x78], 0
mov qword [rsp + 0x1a8], r12
lea r8, [rsp + 0x170]
lea rdx, [rsp + 0x678]
lea rcx, [rsp + 0x620]
call fcn.140097950
nop
lea rdx, str.message
lea rcx, [rsp + 0x620]
call fcn.140097a70
lea rdx, [rsp + 0x630]
mov rcx, rax
call fcn.140097b20
nop
lea rdx, [rsp + 0x630]
mov rcx, rsi
call fcn.14000d710
nop
lea rcx, [rsp + 0x630]
call fcn.140003530
nop
movzx edx, byte [rsp + 0x620]
lea rcx, [rsp + 0x628]
call fcn.140094a70
nop
lea rcx, [rsp + 0x678]
call fcn.140003530
nop
lea rcx, [rsp + 0x6a0]
call fcn.140003530
nop
movzx edx, byte [rsp + 0x600]
lea rcx, [rsp + 0x608]
call fcn.140094a70
nop
mov rcx, qword [rsp + 0x6c0]
xor rcx, rsp
call fcn.140161860
lea r11, [rsp + 0x6d0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
lea rcx, str.start_cmd.exe__K__echo_application_was_not_able_to_retreive_information_that_requires_connection__pause___nul__exit_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3