Function at 0x14005ab20
Capabilities:
Check if file exists
Create process on windows
Enumerate files on windows
Get file attributes
Persist via run registry key
Persist via windows service
Query environment variable
Schedule task via schtasks
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
xor r15d, r15d
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.Reg_add__HKCUSoftwareMicrosoftGameBar___v__AllowAutoGameMode___t_REG_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.Reg_add__HKCUSoftwareMicrosoftGameBar___v__AutoGameModeEnabled___t_REG_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.Reg_add__HKLMSYSTEMCurrentControlSetServices_nvlddmkmFTS___v__EnableRID61684___t_REG_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.Reg_add__HKCUSoftwareNVIDIA_CorporationGlobalNVTweakDevices509901423_0Color___v__NvCplUseColorCorrection___t_REG_DWORD__d__0___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.Reg_add__HKLMSYSTEMCurrentControlSetControlGraphicsDrivers___v__PlatformSupportMiracast___t_REG_DWORD__d__0___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.Reg_add__HKLMSYSTEMCurrentControlSetServices_nvlddmkmGlobalNVTweak___v__DisplayPowerSaving___t_REG_DWORD__d__0___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000___v__D3PCLatency___t_REG_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000___v__F1TransitionLatency___t_REG_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000___v__LOWLATENCY___t_REG_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000___v__Node3DLowLatency___t_REG_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000___v__PciLatencyTimerControl___t_REG_DWORD__d__20___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000___v__RMDeepL1EntryLatencyUsec___t_REG_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000___v__RmGspcMaxFtuS___t_REG_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000___v__RmGspcMinFtuS___t_REG_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000___v__RmGspcPerioduS___t_REG_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000___v__RMLpwrEiIdleThresholdUs___t_REG_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000___v__RMLpwrGrIdleThresholdUs___t_REG_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000___v__RMLpwrGrRgIdleThresholdUs___t_REG_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000___v__RMLpwrMsIdleThresholdUs___t_REG_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000___v__VRDirectFlipDPCDelayUs___t_REG_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000___v__VRDirectFlipTimingMarginUs___t_REG_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000___v__VRDirectJITFlipMsHybridFlipDelayUs___t_REG_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000___v__vrrCursorMarginUs___t_REG_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000___v__vrrDeflickerMarginUs___t_REG_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000___v__vrrDeflickerMaxUs___t_REG_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000___v__RMHdcpKeyGlobZero___t_REG_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000___v__TCCSupported___t_REG_DWORD__d__0___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000___v__PreferSystemMemoryContiguous___t_REG_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetServices_nvlddmkm___v__RmGpsPsEnablePerCpuCoreDpc___t_REG_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetServices_nvlddmkmNVAPI___v__RmGpsPsEnablePerCpuCoreDpc___t_REG_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetServices_nvlddmkmGlobalNVTweak___v__RmGpsPsEnablePerCpuCoreDpc___t_REG_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlGraphicsDrivers___v__RmGpsPsEnablePerCpuCoreDpc___t_REG_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlGraphicsDriversPower___v__RmGpsPsEnablePerCpuCoreDpc___t_REG_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000___v__RmCacheLoc___t_REG_DWORD__d__0___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlGraphicsDrivers___v__TdrLevel___t_REG_DWORD__d__0___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlGraphicsDrivers___v__TdrDelay___t_REG_DWORD__d__0___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlGraphicsDrivers___v__TdrDdiDelay___t_REG_DWORD__d__0___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlGraphicsDrivers___v__TdrDebugMode___t_REG_DWORD__d__0___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlGraphicsDrivers___v__TdrLimitCount___t_REG_DWORD__d__0___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlGraphicsDrivers___v__TdrLimitTime___t_REG_DWORD__d__0___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlGraphicsDrivers___v__TdrTestMode___t_REG_DWORD__d__0___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000___v__RmFbsrPagedDMA___t_REG_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000___v__Acceleration.Level___t_REG_DWORD__d__0___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetServices_nvlddmkm___v__DisablePreemption___t_REG_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetServices_nvlddmkm___v__DisableCudaContextPreemption___t_REG_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetServices_nvlddmkm___v__EnableCEPreemption___t_REG_DWORD__d__0___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetServices_nvlddmkm___v__DisablePreemptionOnS3S4___t_REG_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetServices_nvlddmkm___v__ComputePreemption___t_REG_DWORD__d__0___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetServices_nvlddmkm___v__DisableWriteCombining___t_REG_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000___v__DesktopStereoShortcuts___t_REG_DWORD__d__0___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000___v__FeatureControl___t_REG_DWORD__d__4___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rcx, str.cdCache
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14004980a
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x60], xmm1
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r15b
jne 0x1400495b5
mov rdx, rax
lea rcx, [rbp + 0x50]
call fcn.14003f1e0
nop
mov r8, qword [rbp + 0x60]
mov rcx, qword [rbp + 0x68]
mov rax, rcx
sub rax, r8
mov r14d, 4
lea rsi, str.cd__
cmp rax, r14
jb 0x140049663
lea rax, [r8 + 4]
mov qword [rbp + 0x60], rax
lea rbx, [rbp + 0x50]
cmp rcx, 0xf
cmova rbx, qword [rbp + 0x50]
lea rax, [0x1400e7b20]
cmp rax, rbx
jbe 0x140049627
lea rax, [rbx + r8]
cmp rsi, rax
ja 0x140049627
cmp rbx, rsi
ja 0x14004961f
mov rdi, r15
jmp 0x14004962a
mov rdi, rbx
sub rdi, rsi
jmp 0x14004962a
mov rdi, r14
lea rcx, [rbx + 4]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rdi]
sub r14, rdi
lea rdx, [rsi + 4]
add rdx, rdi
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x50]
jmp 0x14004967c
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov rdx, r14
lea rcx, [rbp + 0x50]
call fcn.14003fb10
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r8d, 1
lea rdx, [0x1400e7b18]
lea rcx, [rsp + 0x50]
call fcn.14003e8c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova r9, qword [rsp + 0x30]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140049766
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049761
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140049761
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bd908
movdqa xmm0, xmmword [0x1400f17b0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400497c1
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400497b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400497b4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bd908
movdqa xmm0, xmmword [0x1400f17b0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp + 0x68]
cmp rdx, 0xf
jbe 0x14004980a
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049805
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140049805
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bd908
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKCUSoftwareNVIDIA_CorporationGlobalNVTweakDevices509901423_0Color___v__NvCplUseColorCorrection___t_Reg_DWORD__d__0___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlGraphicsDrivers___v__PlatformSupportMiracast___t_Reg_DWORD__d__0___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetServices_nvlddmkmGlobalNVTweak___v__DisplayPowerSaving___t_Reg_DWORD__d__0___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.cd___SYSTEMDRIVE_Program_FilesNVIDIA_CorporationNVSMI_
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.nvidia_smi__acp_UNRESTRICTED
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.nvidia_smi__acp_DEFAULT
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, [rbp + 0x70]
lea rcx, str.HKLMSystemCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be10318NVIDIA
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140049e19
lea r12, [0x1400e7dbc]
lea r14, str.reg_delete__
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], r15
lea rax, [rbp + 0x9c]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140049940
lea rdx, [rbp + 0x9c]
lea rcx, [rsp + 0x70]
call fcn.14003f1e0
nop
mov r8, qword [rbp - 0x80]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
sub rax, r8
cmp rax, 0xc
jb 0x1400499e9
lea rax, [r8 + 0xc]
mov qword [rbp - 0x80], rax
lea rbx, [rsp + 0x70]
cmp rcx, 0xf
cmova rbx, qword [rsp + 0x70]
cmp r12, rbx
jbe 0x1400499a7
lea rax, [rbx + r8]
cmp r14, rax
ja 0x1400499a7
cmp rbx, r14
ja 0x14004999f
mov rdi, r15
jmp 0x1400499ac
mov rdi, rbx
sub rdi, r14
jmp 0x1400499ac
mov edi, recv
lea rcx, [rbx + 0xc]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rdi]
mov r8d, recv
sub r8, rdi
lea rdx, [r14 + 0xc]
add rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x70]
jmp 0x140049a09
mov qword [rsp + 0x28], send
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov edx, recv
lea rcx, [rsp + 0x70]
call fcn.14003fb10
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r8d, Ordinal_33
lea rdx, str.___v__EnableTiledDisplay___f
lea rcx, [rsp + 0x50]
call fcn.14003e8c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova r9, qword [rsp + 0x30]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140049af2
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049aed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049ed0
call fcn.1400bd908
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140049b42
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049b3d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049ed7
call fcn.1400bd908
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140049b91
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049b8c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049ede
call fcn.1400bd908
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], r15
lea rax, [rbp + 0x9c]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140049bb0
lea rdx, [rbp + 0x9c]
lea rcx, [rbp - 0x70]
call fcn.14003f1e0
nop
mov r8, qword [rbp - 0x60]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
sub rax, r8
cmp rax, 0xc
jb 0x140049c55
lea rax, [r8 + 0xc]
mov qword [rbp - 0x60], rax
lea rbx, [rbp - 0x70]
cmp rcx, 0xf
cmova rbx, qword [rbp - 0x70]
cmp r12, rbx
jbe 0x140049c14
lea rax, [rbx + r8]
cmp r14, rax
ja 0x140049c14
cmp rbx, r14
ja 0x140049c0c
mov rdi, r15
jmp 0x140049c19
mov rdi, rbx
sub rdi, r14
jmp 0x140049c19
mov edi, recv
lea rcx, [rbx + 0xc]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rdi]
mov r8d, recv
sub r8, rdi
lea rdx, [r14 + 0xc]
add rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x70]
jmp 0x140049c74
mov qword [rsp + 0x28], send
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov edx, recv
lea rcx, [rbp - 0x70]
call fcn.14003fb10
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r8d, reloc.WLDAP32.dll_Ordinal_22
lea rdx, str.___v__TCCSupported___f
lea rcx, [rsp + 0x50]
call fcn.14003e8c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova r9, qword [rsp + 0x30]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140049d5d
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049d58
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049ee5
call fcn.1400bd908
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140049dad
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049da8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049eec
call fcn.1400bd908
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140049dfb
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049df6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049ef3
call fcn.1400bd908
lea rdx, [rbp + 0x70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140049920
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, [rbp + 0x70]
lea rcx, str.HKLMSystemControlSet001ControlClass4d36e968_e325_11ce_bfc1_08002be10318NVIDIA
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rsi, rax
lea r12, [0x1400e3da9]
lea r14, str.reg_add__
cmp rax, 0xffffffffffffffff
je 0x14004a107
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r15
lea rax, [rbp + 0x9c]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140049e70
lea rdx, [rbp + 0x9c]
lea rcx, [rbp - 0x50]
call fcn.14003f1e0
nop
mov r8, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
sub rax, r8
cmp rax, 9
jb 0x140049f43
lea rax, [r8 + 9]
mov qword [rbp - 0x40], rax
lea rbx, [rbp - 0x50]
cmp rcx, 0xf
cmova rbx, qword [rbp - 0x50]
cmp r12, rbx
jbe 0x140049f02
lea rax, [rbx + r8]
cmp r14, rax
ja 0x140049f02
cmp rbx, r14
ja 0x140049efa
mov rdi, r15
jmp 0x140049f07
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdi, rbx
sub rdi, r14
jmp 0x140049f07
mov edi, 9
lea rcx, [rbx + 9]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rdi]
mov r8d, 9
sub r8, rdi
lea rdx, [r14 + 9]
add rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x50]
jmp 0x140049f62
mov qword [rsp + 0x28], 9
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov edx, 9
lea rcx, [rbp - 0x50]
call fcn.14003fb10
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r8d, reloc.WLDAP32.dll_Ordinal_50
lea rdx, str.___v__DisableDynamicPstate___t_REG_DWORD__d__1___f
lea rcx, [rsp + 0x50]
call fcn.14003e8c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova r9, qword [rsp + 0x30]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14004a04b
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a046
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a1b0
call fcn.1400bd908
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14004a09b
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a096
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a1b7
call fcn.1400bd908
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x14004a0e9
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a0e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a1be
call fcn.1400bd908
lea rdx, [rbp + 0x70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140049e50
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, [rbp + 0x70]
lea rcx, str.HKLMSystemControlSet001ControlClass4d36e968_e325_11ce_bfc1_08002be10318NVIDIA
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14004ab16
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], r15
lea rax, [rbp + 0x9c]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004a150
lea rdx, [rbp + 0x9c]
lea rcx, [rbp - 0x30]
call fcn.14003f1e0
nop
mov r8, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
sub rax, r8
cmp rax, 9
jb 0x14004a20e
lea rax, [r8 + 9]
mov qword [rbp - 0x20], rax
lea rbx, [rbp - 0x30]
cmp rcx, 0xf
cmova rbx, qword [rbp - 0x30]
cmp r12, rbx
jbe 0x14004a1cd
lea rax, [rbx + r8]
cmp r14, rax
ja 0x14004a1cd
cmp rbx, r14
ja 0x14004a1c5
mov rdi, r15
jmp 0x14004a1d2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdi, rbx
sub rdi, r14
jmp 0x14004a1d2
mov edi, 9
lea rcx, [rbx + 9]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rdi]
mov r8d, 9
sub r8, rdi
lea rdx, [r14 + 9]
add rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x30]
jmp 0x14004a22d
mov qword [rsp + 0x28], 9
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov edx, 9
lea rcx, [rbp - 0x30]
call fcn.14003fb10
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r8d, reloc.WLDAP32.dll_Ordinal_46
lea rdx, str.___v__PowerMizerEnable___t_REG_DWORD__d__1___f
lea rcx, [rsp + 0x50]
call fcn.14003e8c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova r9, qword [rsp + 0x30]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14004a316
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a311
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ae50
call fcn.1400bd908
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14004a366
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a361
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ae57
call fcn.1400bd908
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x14004a3b4
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a3af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ae5e
call fcn.1400bd908
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], r15
mov qword [rbp + 8], r15
lea rax, [rbp + 0x9c]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14004a3d1
lea rdx, [rbp + 0x9c]
lea rcx, [rbp - 0x10]
call fcn.14003f1e0
nop
mov r8, qword [rbp]
mov rcx, qword [rbp + 8]
mov rax, rcx
sub rax, r8
cmp rax, 9
jb 0x14004a476
lea rax, [r8 + 9]
mov qword [rbp], rax
lea rbx, [rbp - 0x10]
cmp rcx, 0xf
cmova rbx, qword [rbp - 0x10]
cmp r12, rbx
jbe 0x14004a435
lea rax, [rbx + r8]
cmp r14, rax
ja 0x14004a435
cmp rbx, r14
ja 0x14004a42d
mov rdi, r15
jmp 0x14004a43a
mov rdi, rbx
sub rdi, r14
jmp 0x14004a43a
mov edi, 9
lea rcx, [rbx + 9]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rdi]
mov r8d, 9
sub r8, rdi
lea rdx, [r14 + 9]
add rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x10]
jmp 0x14004a495
mov qword [rsp + 0x28], 9
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov edx, 9
lea rcx, [rbp - 0x10]
call fcn.14003fb10
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r8d, reloc.WLDAP32.dll_Ordinal_45
lea rdx, str.___v__PowerMizerLevel___t_REG_DWORD__d__1___f
lea rcx, [rsp + 0x50]
call fcn.14003e8c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova r9, qword [rsp + 0x30]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14004a57e
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a579
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ae65
call fcn.1400bd908
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14004a5ce
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a5c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ae6c
call fcn.1400bd908
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x14004a61c
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a617
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ae73
call fcn.1400bd908
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], r15
lea rax, [rbp + 0x9c]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004a640
lea rdx, [rbp + 0x9c]
lea rcx, [rbp + 0x10]
call fcn.14003f1e0
nop
mov r8, qword [rbp + 0x20]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
sub rax, r8
cmp rax, 9
jb 0x14004a6e5
lea rax, [r8 + 9]
mov qword [rbp + 0x20], rax
lea rbx, [rbp + 0x10]
cmp rcx, 0xf
cmova rbx, qword [rbp + 0x10]
cmp r12, rbx
jbe 0x14004a6a4
lea rax, [rbx + r8]
cmp r14, rax
ja 0x14004a6a4
cmp rbx, r14
ja 0x14004a69c
mov rdi, r15
jmp 0x14004a6a9
mov rdi, rbx
sub rdi, r14
jmp 0x14004a6a9
mov edi, 9
lea rcx, [rbx + 9]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rdi]
mov r8d, 9
sub r8, rdi
lea rdx, [r14 + 9]
add rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x10]
jmp 0x14004a704
mov qword [rsp + 0x28], 9
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov edx, 9
lea rcx, [rbp + 0x10]
call fcn.14003fb10
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r8d, Ordinal_50
lea rdx, str.___v__PowerMizerLevelAC___t_REG_DWORD__d__1___f
lea rcx, [rsp + 0x50]
call fcn.14003e8c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova r9, qword [rsp + 0x30]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14004a7ed
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a7e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ae7a
call fcn.1400bd908
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14004a83d
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a838
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ae81
call fcn.1400bd908
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x14004a88b
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a886
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ae88
call fcn.1400bd908
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], r15
lea rax, [rbp + 0x9c]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004a8b0
lea rdx, [rbp + 0x9c]
lea rcx, [rbp + 0x30]
call fcn.14003f1e0
nop
mov r8, qword [rbp + 0x40]
mov rcx, qword [rbp + 0x48]
mov rax, rcx
sub rax, r8
cmp rax, 9
jb 0x14004a952
lea rax, [r8 + 9]
mov qword [rbp + 0x40], rax
lea rbx, [rbp + 0x30]
cmp rcx, 0xf
cmova rbx, qword [rbp + 0x30]
cmp r12, rbx
jbe 0x14004a914
lea rax, [rbx + r8]
cmp r14, rax
ja 0x14004a914
cmp rbx, r14
ja 0x14004a90c
mov rdi, r15
jmp 0x14004a919
mov rdi, rbx
sub rdi, r14
jmp 0x14004a919
mov edi, 9
lea rcx, [rbx + 9]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rdi]
mov r8d, 9
sub r8, rdi
lea rdx, [rdi + r12]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x30]
jmp 0x14004a971
mov qword [rsp + 0x28], 9
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov edx, 9
lea rcx, [rbp + 0x30]
call fcn.14003fb10
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r8d, reloc.WLDAP32.dll_Ordinal_45
lea rdx, str.___v__PerfLevelSrc___t_REG_DWORD__d__8738___f
lea rcx, [rsp + 0x50]
call fcn.14003e8c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova r9, qword [rsp + 0x30]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14004aa5a
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004aa55
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ae8f
call fcn.1400bd908
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14004aaaa
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004aaa5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ae96
call fcn.1400bd908
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x14004aaf8
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004aaf3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ae9d
call fcn.1400bd908
lea rdx, [rbp + 0x70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14004a130
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetServices_nvlddmkmFTS___v__EnableRID61684___t_REG_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetServices_nvlddmkm___v__DisableWriteCombining___t_Reg_DWORD__d__1___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSOFTWARENVIDIA_CorporationNvControlPanel2Client___v__OptInOrOutPreference___t_REG_DWORD__d_0__f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSOFTWARENVIDIA_CorporationGlobalFTS___v__EnableRID44231___t_REG_DWORD__d_0__f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSOFTWARENVIDIA_CorporationGlobalFTS___v__EnableRID64640___t_REG_DWORD__d_0__f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_add__HKLMSOFTWARENVIDIA_CorporationGlobalFTS___v__EnableRID66610___t_REG_DWORD__d_0__f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.reg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun___v__NvBackend___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.schtasks__change__disable__tn__NvTmRep_CrashReport1_B2FE1952_0186_46C3_BAEC_A80AA35AC5B8_
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.schtasks__change__disable__tn__NvTmRep_CrashReport2_B2FE1952_0186_46C3_BAEC_A80AA35AC5B8_
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.schtasks__change__disable__tn__NvTmRep_CrashReport3_B2FE1952_0186_46C3_BAEC_A80AA35AC5B8_
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.schtasks__change__disable__tn__NvTmRep_CrashReport4_B2FE1952_0186_46C3_BAEC_A80AA35AC5B8_
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.sc_config_NvTelemetyContainer_startdisabled
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.sc_stop_NvTelemetyContainer
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rcx, str._systmedrive_Program_FilesNVIDIA_CorporationInstaller2InstallerCoreNVI2.DLL
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14004ad4a
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.rundll32___systmedrive_Program_FilesNVIDIA_CorporationInstaller2InstallerCoreNVI2.DLL__UninstallPackage_NvTelemetryContainer
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.Reg.exe_add__HKLMSYSTEMControlSet001Services_nvlddmkm___v__LogWarningEntries___t_REG_DWORD__d__0___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.Reg.exe_add__HKLMSYSTEMControlSet001Services_nvlddmkm___v__LogPagingEntries___t_REG_DWORD__d__0___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.Reg.exe_add__HKLMSYSTEMControlSet001Services_nvlddmkm___v__LogEventEntries___t_REG_DWORD__d__0___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.Reg.exe_add__HKLMSYSTEMControlSet001Services_nvlddmkm___v__LogErrorEntries___t_REG_DWORD__d__0___f
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.sc_config_NVDisplay.ContainerLocalSystem_start_auto
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, str.sc_start_NVDisplay.ContainerLocalSystem
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
jmp 0x140048da0