Function at 0x140048680
Capabilities:
Execute command
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x320]
sub rsp, 0x420
xor edi, edi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Apos_clicar_no_botao__aguarde_o_Woofer_destravar_e_reiniciar_seu_computador_de_forma_automatica
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], reloc.WS2_32.dll_ntohl
mov esi, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x58], rsi
movsd xmm0, qword [str.C:ProgramData]
movsd qword [rsp + 0x40], xmm0
mov eax, dword [0x140177058]
mov dword [rsp + 0x48], eax
movzx eax, word [0x14017705c]
mov word [rsp + 0x4c], ax
mov byte [rsp + 0x4e], dil
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], reloc.WS2_32.dll_ntohl
mov qword [rbp + 0xa8], rsi
movsd xmm0, qword [str.AMIFLDRV32.sys]
movsd qword [rbp + 0x90], xmm0
mov eax, dword [0x140177068]
mov dword [rbp + 0x98], eax
movzx eax, word [0x14017706c]
mov word [rbp + 0x9c], ax
mov byte [rbp + 0x9e], dil
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], 8
mov qword [rbp + 0xe8], rsi
movabs r15, 0x6578652e34343345
mov qword [rbp + 0xd0], r15
mov byte [rbp + 0xd8], dil
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], reloc.WS2_32.dll_ntohl
mov qword [rbp - 0x68], rsi
movsd xmm0, qword [str.amifldrv64.sys]
movsd qword [rbp - 0x80], xmm0
mov eax, dword [0x140177078]
mov dword [rbp - 0x78], eax
movzx eax, word [0x14017707c]
mov word [rbp - 0x74], ax
mov byte [rbp - 0x72], dil
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], reloc.WS2_32.dll_ntohl
mov qword [rbp - 8], rsi
movsd xmm0, qword [str.Volumeid64.exe]
movsd qword [rbp - 0x20], xmm0
mov eax, dword [0x140177088]
mov dword [rbp - 0x18], eax
movzx eax, word [0x14017708c]
mov word [rbp - 0x14], ax
mov byte [rbp - 0x12], dil
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], 8
mov qword [rbp + 0xc8], rsi
movabs r12, 0x7478742e74736f68
mov qword [rbp + 0xb0], r12
mov byte [rbp + 0xb8], dil
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], 7
mov qword [rbp - 0x28], rsi
mov rax, qword [str.mac.txt]
mov dword [rbp - 0x40], eax
movzx eax, word [0x140177094]
mov word [rbp - 0x3c], ax
movzx eax, byte [reloc.WS2_32.dll_WSACleanup]
mov byte [rbp - 0x3a], al
mov byte [rbp - 0x39], dil
movups xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x100], 8
mov qword [rbp + 0x108], rsi
movabs r13, 0x7478742e72657375
mov qword [rbp + 0xf0], r13
mov byte [rbp + 0xf8], dil
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x48], rsi
mov rax, qword [str.run.bat]
mov dword [rbp - 0x60], eax
movzx eax, word [0x14017709c]
mov word [rbp - 0x5c], ax
movzx eax, byte [reloc.WS2_32.dll_WSACleanup]
mov byte [rbp - 0x5a], al
mov byte [rbp - 0x59], dil
mov qword [rsp + 0x30], 1
lea r14, [0x140176ee0]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], reloc.WS2_32.dll_ntohl
lea r9, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14003fe10
nop
lea r8d, [rdi + 0xe]
lea rdx, [rbp + 0x90]
lea rcx, [rsp + 0x60]
call fcn.14003f8e0
xorps xmm0, xmm0
movups xmmword [rbp + 0x300], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x310], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x300], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x310], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], rsi
mov byte [rax], dil
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140048973
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004896e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004896e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140139f2c
movdqa xmm0, xmmword [0x14017a420]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], 0
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
mov rcx, qword [rsp + 0x50]
sub rax, rcx
cmp rax, 1
jb 0x1400495e0
lea r9, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae r9, qword [rsp + 0x40]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x140]
call fcn.14003fe10
nop
lea rdx, [rbp + 0xd0]
mov r8d, 8
lea rcx, [rbp + 0x140]
call fcn.14003f8e0
xorps xmm0, xmm0
movups xmmword [rbp + 0x2e0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x2f0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x2e0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x2f0], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], rsi
mov byte [rax], 0
mov rdx, qword [rbp + 0x158]
cmp rdx, 0x10
jb 0x140048a68
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048a63
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140048a63
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140139f2c
movdqa xmm0, xmmword [0x14017a420]
movdqu xmmword [rbp + 0x150], xmm0
mov byte [rbp + 0x140], 0
mov rax, rbx
mov rcx, qword [rsp + 0x50]
sub rax, rcx
cmp rax, 1
jb 0x1400495e6
lea r9, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae r9, qword [rsp + 0x40]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x160]
call fcn.14003fe10
nop
lea rdx, [rbp - 0x80]
mov r8d, reloc.WS2_32.dll_ntohl
lea rcx, [rbp + 0x160]
call fcn.14003f8e0
xorps xmm0, xmm0
movups xmmword [rbp + 0x2c0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x2d0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x2c0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x2d0], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], rsi
mov byte [rax], 0
mov rdx, qword [rbp + 0x178]
cmp rdx, 0x10
jb 0x140048b54
inc rdx
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048b4f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140048b4f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140139f2c
movdqa xmm0, xmmword [0x14017a420]
movdqu xmmword [rbp + 0x170], xmm0
mov byte [rbp + 0x160], 0
mov rax, rbx
mov rcx, qword [rsp + 0x50]
sub rax, rcx
cmp rax, 1
jb 0x1400495ec
lea r9, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae r9, qword [rsp + 0x40]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x180]
call fcn.14003fe10
nop
lea rdx, [rbp - 0x20]
mov r8d, reloc.WS2_32.dll_ntohl
lea rcx, [rbp + 0x180]
call fcn.14003f8e0
xorps xmm0, xmm0
movups xmmword [rbp + 0x2a0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x2b0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x2a0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x2b0], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], rsi
mov byte [rax], 0
mov rdx, qword [rbp + 0x198]
cmp rdx, 0x10
jb 0x140048c40
inc rdx
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048c3b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140048c3b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140139f2c
movdqa xmm0, xmmword [0x14017a420]
movdqu xmmword [rbp + 0x190], xmm0
mov byte [rbp + 0x180], 0
mov rax, rbx
mov rcx, qword [rsp + 0x50]
sub rax, rcx
cmp rax, 1
jb 0x1400495f2
lea r9, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae r9, qword [rsp + 0x40]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x1a0]
call fcn.14003fe10
nop
lea rdx, [rbp + 0xb0]
mov r8d, 8
lea rcx, [rbp + 0x1a0]
call fcn.14003f8e0
xorps xmm0, xmm0
movups xmmword [rbp + 0x280], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x290], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x280], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x290], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], rsi
mov byte [rax], 0
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 0x10
jb 0x140048d2f
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048d2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140048d2a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140139f2c
movdqa xmm0, xmmword [0x14017a420]
movdqu xmmword [rbp + 0x1b0], xmm0
mov byte [rbp + 0x1a0], 0
mov rax, rbx
mov rcx, qword [rsp + 0x50]
sub rax, rcx
cmp rax, 1
jb 0x1400495f8
lea r9, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae r9, qword [rsp + 0x40]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x1c0]
call fcn.14003fe10
nop
lea rdx, [rbp - 0x40]
mov r8d, 7
lea rcx, [rbp + 0x1c0]
call fcn.14003f8e0
xorps xmm0, xmm0
movups xmmword [rbp + 0x260], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x270], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x260], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x270], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], rsi
mov byte [rax], 0
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0x10
jb 0x140048e1b
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048e16
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140048e16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140139f2c
movdqa xmm0, xmmword [0x14017a420]
movdqu xmmword [rbp + 0x1d0], xmm0
mov byte [rbp + 0x1c0], 0
mov rax, rbx
mov rcx, qword [rsp + 0x50]
sub rax, rcx
cmp rax, 1
jb 0x1400495fe
lea r9, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae r9, qword [rsp + 0x40]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x1e0]
call fcn.14003fe10
nop
lea rdx, [rbp + 0xf0]
mov r8d, 8
lea rcx, [rbp + 0x1e0]
call fcn.14003f8e0
xorps xmm0, xmm0
movups xmmword [rbp + 0x240], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x250], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x240], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x250], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], rsi
mov byte [rax], 0
mov rdx, qword [rbp + 0x1f8]
cmp rdx, 0x10
jb 0x140048f0a
inc rdx
mov rcx, qword [rbp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048f05
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140048f05
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140139f2c
movdqa xmm0, xmmword [0x14017a420]
movdqu xmmword [rbp + 0x1f0], xmm0
mov byte [rbp + 0x1e0], 0
mov rax, qword [rsp + 0x50]
sub rbx, rax
cmp rbx, 1
jb 0x1400495da
lea r9, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae r9, qword [rsp + 0x40]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x200]
call fcn.14003fe10
nop
lea rdx, [rbp - 0x60]
mov r8d, 7
lea rcx, [rbp + 0x200]
call fcn.14003f8e0
xorps xmm0, xmm0
movups xmmword [rbp + 0x220], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x230], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x220], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x230], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], rsi
mov byte [rax], 0
mov rdx, qword [rbp + 0x218]
cmp rdx, 0x10
jb 0x140048ff3
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048fee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140048fee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140139f2c
movdqa xmm0, xmmword [0x14017a420]
movdqu xmmword [rbp + 0x210], xmm0
mov byte [rbp + 0x200], 0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x78], xmm1
mov qword [rbp + 0x88], rdi
mov ecx, 0x2827
call fcn.140139bc8
test rax, rax
je 0x1400495d3
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
mov qword [rbp + 0x78], rcx
lea rbx, [rcx + 0x2800]
mov qword [rbp + 0x88], rbx
mov r8d, 0x2800
lea rdx, [0x14090dc70]
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x80], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], rdi
mov ecx, 0x6a227
call fcn.140139bc8
test rax, rax
je 0x1400495cc
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
mov qword [rbp + 0x60], rcx
lea rbx, [rcx + 0x6a200]
mov qword [rbp + 0x70], rbx
mov r8d, 0x6a200
lea rdx, [0x1401974c0]
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x68], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], rdi
mov ecx, 0x7477
call fcn.140139bc8
test rax, rax
je 0x1400495c5
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
mov qword [rbp + 0x48], rcx
lea rbx, [rcx + 0x7450]
mov qword [rbp + 0x58], rbx
mov r8d, 0x7450
lea rdx, [0x140225ce0]
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x50], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rdi
mov ecx, 0x296d7
call fcn.140139bc8
test rax, rax
je 0x1400495be
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
mov qword [rbp + 0x30], rcx
lea rbx, [rcx + 0x296b0]
mov qword [rbp + 0x40], rbx
mov r8d, 0x296b0
lea rdx, [0x1408d4da0]
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x38], rbx
mov ecx, 0x846
call fcn.140139bc8
mov qword [rbp + 0x128], rax
lea rbx, [rax + 0x846]
mov qword [rbp + 0x138], rbx
mov r8d, 0x846
lea rdx, str.net_r_npc_r_nsupernout_r_npc_2349_r_nsergey_pc_r_nmaashf_pc_r_nslon__r_nhui_pc_r_nbalkon_r_nsuperpuper_r_n2017_r_ngomno_r_n314dc_r_nmalishka_r_nvorobey_r_naahs_r_naal_r_naalders_r_naalii_r_naam_r_naamy_r_naani_r_naardvark_r_naardvarks_r_naardwolf_r_naaren_r_naargh_r_naarhus_r_naarika_r_naaron_r_naaronic_r_naarrgh_r_naaru_r_naasen_r_naau_r_nachira_r_nachkar_r_nachmad_r_nachmetha_r_nachoo_r_nachor_r_nachroma_r_nachromatic_r_nachromatous_r_nachromia_r_nachromic_r_nachtel_r_nachy_r_nacicular_r_nacid_r_nacider_r_nacidic_r_nacidiferous_r_nacidify_r_nacidity_r_nacidosis_r_nacidrain_r_nacids_r_naciduria_r_nacier_r_nacilius_r_nacinaces_r_nacinaciform_r_nacinar_r_nacini_r_nacinus_r_nacis_r_nacker_r_nackerman_r_nackey_r_nackley_r_nacklin_r_nackman_r_nacknowledge_r_nacknowledged_r_nacle_r_nrsands_r_nampery_r_nampex_r_namphetamine_r_namphibia_r_namphibian_r_namphibious_r_namphibole_r_namphibological_r_namphigory_r_namphigou_r_nballon_r_nballoon_r_nballooner_r_nballoonfish_r_nballooning_r_nballoonist_r_nballoons_r_nballot_r_nballota_r_nballotage_r_nballou_r_nballow_r_nballpen_r_nballplayer_r_nballpoint_r_nballroom_r_nballs_r_nballsy_r_nballup_r_nbally_r_nballyhoo_r_nbalm_r_nbalmer_r_nbalmoral_r_nbalmy_r_nbalneologist_r_nbaloch_r_nbalog_r_nbalogh_r_nbaloghia_r_nbalolo_r_nbaloney_r_nbodybuild_r_nbodybuilder_r_nbodybuilders_r_nbodybuilding_r_nbodyguard_r_ncanel_r_ncanella_r_ncanelo_r_ncaner_r_ncanes_r_ncanete_r_ncanette_r_ncanfield_r_ncang_r_ncangia_r_ncangle_r_ncangue_r_ncanicola_r_ncanicula_r_ncanicular_r_ncompaq_r_ncompare_r_ncompared_r_ncompares_r_ncomparison_r_ncompart_r_ncompartment_r_ncompass_r_ncompassion_r_ncompatible_r_ncompatriot_r_ncompeer_r_ncompel_r_ndanni_r_ndannie_r_ndanny_r_ndannye_r_ndans_r_ndansant_r_ndanseuse_r_ndanta_r_ndante_r_ndantean_r_ndantesque_r_ndantist_r_ndanton_r_ndantoni_r_ndantu_r_nelfkin_r_nelflock_r_nelfreda_r_nelfrida_r_nelfrieda_r_nelga_r_nelgar_r_nelgie_r_nelgin_r_nfairway_r_nfairy_r_nfairyhood_r_nfairyland_r_nfairytale_r_nfaisal_r_nfaison_r_nfait_r_nfaith_r_nfaithbreaker_r_nfaithful_r_nfaithfully_r_nfaithfulness_r_nillness_r_nillogical_r_nilluminant_r_nilluminated_r_nillumination_r_nillumine_r_npatters_r_npattie_r_npatzer_r_nrubble_r_nrubbles_r_nrubellite_r_nrubeola_r_nrubidium_r_nrubier_r_nrubious_r_nscarves_r_nscary_r_nscat_r_nscathe_r_nscathing_r_nscats_r_nscatt_r_nscatter_r_nscatteration_r_nscatterbrain_r_ntidies_r_ntiffany_r_ntigereyes_r_ntigerish_r_ntighten_r_ntike_r_ntikes_r_ntilak_r_nverboten_r_nverbs_r_nverglas_r_nverifier_r_nverily_r_nvermicide_r_nyouths_r_nyowe_r_nyowes_r_nyows_r_nyuca_r_nyucca_r_nyuk_r_nyukking
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x130], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x18], xmm0
mov qword [rbp + 0x28], rdi
mov ecx, 0x27681
call fcn.140139bc8
test rax, rax
je 0x1400495b7
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
mov qword [rbp + 0x18], rcx
lea rbx, [rcx + 0x2765a]
mov qword [rbp + 0x28], rbx
mov r8d, 0x2765a
lea rdx, str.000000_n000001_n000002_n000003_n000004_n000005_n000006_n000007_n000008_n000009_n00000A_n00000B_n00000C_n00000D_n00000E_n00000F_n000010_n000011_n000012_n000013_n000014_n000015_n000016_n000017_n000018_n000019_n00001A_n00001B_n00001C_n00001D_n00001E_n00001F_n000020_n000021_n000022_n000023_n000024_n000025_n000026_n000027_n000028_n000029_n00002A_n00002B_n00002C_n00002D_n00002E_n00002F_n000030_n000031_n000032_n000033_n000034_n000035_n000036_n000037_n000038_n000039_n00003A_n00003B_n00003C_n00003D_n00003E_n00003F_n000040_n000041_n000042_n000043_n000044_n000045_n000046_n000047_n000048_n000049_n00004A_n00004B_n00004C_n00004D_n00004E_n00004F_n000050_n000051_n000052_n000053_n000054_n000055_n000056_n000057_n000058_n000059_n00005A_n00005B_n00005C_n00005D_n00005E_n00005F_n000060_n000061_n000062_n000063_n000064_n000065_n000066_n000067_n000068_n000069_n00006A_n00006B_n00006C_n00006D_n00006E_n00006F_n000070_n000071_n000072_n000073_n000074_n000075_n000076_n000077_n000078_n000079_n00007A_n00007B_n00007C_n00007D_n00007E_n00007F_n000080_n000081_n000082_n000083_n000084_n000085_n000086_n000087_n000088_n000089_n00008A_n00008B_n00008C_n00008D_n00008E_n00008F_n000090_n000091_n000092_n000093_n000094_n000095_n000096_n000097_n000098_n000099_n00009A_n00009B_n00009C_n00009D_n00009E_n00009F_n0000A0_n0000A1_n0000A2_n0000A3_n0000A4_n0000A5_n0000A6_n0000A7_n0000A8_n0000A9_n0000AA_n0000AB_n0000AC_n0000AD_n0000AE_n0000AF_n0000B0_n0000B1_n0000B2_n0000B3_n0000B4_n0000B5_n0000B6_n0000B7_n0000B8_n0000B9_n0000BA_n0000BB_n0000BC_n0000BD_n0000BE_n0000BF_n0000C0_n0000C1_n0000C2_n0000C3_n0000C4_n0000C5_n0000C6_n0000C7_n0000C8_n0000C9_n0000CA_n0000CB_n0000CC_n0000CD_n0000CE_n0000CF_n0000D0_n0000D1_n0000D2_n0000D3_n0000D4_n0000D5_n0000D6_n0000D7_n0000D8_n0000D9_n0000DA_n0000DB_n0000DC_n0000DD_n0000DE_n0000DF_n0000E0_n0000E1_n0000E2_n0000E3_n0000E4_n0000E5_n0000E6_n0000E7_n0000E8_n0000E9_n0000EA_n0000EB_n0000EC_n0000ED_n0000EE_n0000EF_n0000F0_n0000F1_n0000F2_n0000F3_n0000F4_n0000F5_n0000F6_n0000F7_n0000F8_n0000F9_n0000FA_n0000FB_n0000FC_n0000FD_n0000FE_n0000FF_n000100_n000101_n000102_n000103_n000104_n000105_n000106_n000107_n000108_n000109_n00010A_n00010B_n00010C_n00010D_n00010E_n00010F_n000110_n000111_n000112_n000113_n000114_n000115_n000116_n000117_n000118_n000119_n00011A_n00011B_n00011C_n00011D_n00011E_n00011F_n000120_n000121_n000122_n000123_n000124_n000125_n000126_n000127_n000128_n000129_n00012A_n00012B_n00012C_n00012D_n00012E_n00012F_n000130_n000131_n000132_n000133_n000134_n000135_n000136_n000137_n000138_n000139_n00013A_n00013B_n00013C_n00013D_n00013E_n00013F_n000140_n000141_n000142_n000143_n000144_n000145_n000146_n000147_n000148_n000149_n00014A_n00014B_n00014C_n00014D_n00014E_n00014F_n000150_n000151_n000152_n000153_n000154_n000155_n000156_n000157_n000158_n000159_n00015A_n00015B_n00015C_n00015D_n00015E_n00015F_n000160_n000161_n000162_n000163_n000164_n000165_n000166_n000167_n000168_n000169_n00016A_n00016B_n00016C_n00016D_n00016E_n00016F_n000170_n000171_n000172_n000173_n000174_n000175_n000176_n000177_n000178_n000179_n00017A_n00017B_n00017C_n00017D_n00017E_n00017F_n000180_n000181_n000182_n000183_n000184_n000185_n000186_n000187_n000188_n000189_n00018A_n00018B_n00018C_n00018D_n00018E_n00018F_n000190_n000191_n000192_n000193_n000194_n000195_n000196_n000197_n000198_n000199_n00019A_n00019B_n00019C_n00019D_n00019E_n00019F_n0001A0_n0001A1_n0001A2_n0001A3_n0001A4_n0001A5_n0001A6_n0001A7_n0001A8_n0001A9_n0001AA_n0001AB_n0001AC_n0001AD_n0001AE_n0001AF_n0001B0_n0001B1_n0001B2_n0001B3_n0001B4_n0001B5_n0001B6_n0001B7_n0001B8_n0001B9_n0001BA_n0001BB_n0001BC_n0001BD_n0001BE_n0001BF_n0001C0_n0001C1_n0001C2_n0001C3_n0001C4_n0001C5_n0001C6_n0001C7_n0001C8_n0001C9_n0001CA_n0001CB_n0001CC_n0001CD_n0001CE_n0001CF_n0001D0_n0001D1_n0001D2_n0001D3_n0001D4_n0001D5_n0001D6_n0001D7_n0001D8_n0001D9_n0001DA_n0001DB_n0001DC_n0001DD_n0001DE_n0001DF_n0001E0_n0001E1_n0001E2_n0001E3_n0001E4_n0001E5_n0001E6_n0001E7_n0001E8_n0001E9_n0001EA_n0001EB_n0001EC_n0001ED_n0001EE_n0001EF_n0001F0_n0001F1_n0001F2_n0001F3_n0001F4_n0001F5_n0001F6_n0001F7_n0001F8_n0001F9_n0001FA_n0001FB_n0001FC_n0001FD_n0001FE_n0001FF_n
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x20], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp], xmm0
mov qword [rbp + 0x10], rdi
mov ecx, 0x49dd0
call fcn.140139bc8
test rax, rax
je 0x1400495b0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
mov qword [rbp], rcx
lea rbx, [rcx + 0x49da9]
mov qword [rbp + 0x10], rbx
mov r8d, 0x49da9
lea rdx, str.aden_r_nadena_r_nadenaadenauer_r_nadenectomy_r_nadenine_r_nadenitis_r_nadeno_r_nadenocarcinoma_r_nadenoid_r_nadenoidal_r_nadenoidectomy_r_nadenoma_r_nadenosine_r_nadenovirus_r_nadept_r_nadequacy_r_nadequate_r_nader_r_nadermin_r_nadessive_r_nadest_r_nadey_r_nadham_r_nadhamh_r_nadhere_r_nadherence_r_nadherent_r_nadhern_r_nadhesion_r_nadhesive_r_nadhibit_r_nadi_r_nadiabatic_r_nadiana_r_nadiaphorism_r_nadiaphorous_r_nadiathermancy_r_nadiel_r_nadiell_r_nadieu_r_nadige_r_nadigranth_r_nadigun_r_nadila_r_nadim_r_nadin_r_nadina_r_nadinaadine_r_nadios_r_nadipocere_r_nadipose_r_nadis_r_nadit_r_nadjacency_r_nadjacent_r_nadjectival_r_nadjective_r_nadjoin_r_nadjoining_r_nadjoint_r_nadjourn_r_nadjournment_r_nadjudge_r_nadjudicate_r_nadjudication_r_nadjunct_r_nadjunction_r_nadjure_r_nadjust_r_nadjustment_r_nadjutant_r_nadjuvant_r_nadkins_r_nadkins_r_nadkinson_r_nadkison_r_nadkisson_r_nadlai_r_nadlar_r_nadlare_r_nadlay_r_nadlee_r_nadlei_r_nadler_r_nadler_r_nadley_r_nadlib_r_nadman_r_nadmass_r_nadmeasure_r_nadmeasurement_r_nadmetus_r_nadminicle_r_nadminister_r_nadministrate_r_nadministration_r_nadministrative_r_nadministrator_r_nadmirable_r_nadmiral_r_nadmiralty_r_nadmiration_r_nadmire_r_nadmissible_r_nadmission_r_nadmissive_r_nadmit_r_nadmittance_r_nadmittedly_r_nadmix_r_nadmixture_r_nadmonish_r_nadmonition_r_nadmonitory_r_nadna_r_nadnah_r_nadnate_r_nadne_r_nadnopoz_r_nado_r_nadobe_r_nadolescence_r_nadolescent_r_nadolf_r_nadolfo_r_nadolfoadolph_r_nadolphadolphe_r_nadolpho_r_nadolphus_r_nadon_r_nadonai_r_nadonic_r_nadonis_r_nadopt_r_nadopted_r_nadoptive_r_nadora_r_nadorable_r_nadoration_r_nadore_r_nadoree_r_nadorl_r_nadorn_r_nadorne_r_nadornment_r_nadorno_r_nadowa_r_nadown_r_nadp_r_nadrastus_r_nadrea_r_nadrell_r_nadrenal_r_nadrenalin_r_nadrenaline_r_nadrenocorticotropic_r_nadria_r_nadriaadriaens_r_nadrial_r_nadrian_r_nadrian_r_nadrianaadriane_r_nadrianadriana_r_nadrianeadrianna_r_nadriannaadrianne_r_nadrianneadriano_r_nadrianople_r_nadriatic_r_nadriel_r_nadriell_r_nadrien_r_nadrienadriena_r_nadriene_r_nadrieneadrienne_r_nadrienneadrift_r_nadroit_r_nadscititious_r_nadscription_r_nadsorb_r_nadsorbate_r_nadsorbent_r_nadularia_r_nadulate_r_nadulation_r_nadult_r_nadulterant_r_nadulterate_r_nadulteration_r_nadulterer_r_nadulteress_r_nadulterine_r_nadulterous_r_nadultery_r_nadulthood_r_nadumbral_r_nadumbrate_r_nadur_r_nadust_r_naduwa_r_nadvance_r_nadvanced_r_nadvancement_r_nadvantage_r_nadvantageous_r_nadvection_r_nadvent_r_nadventist_r_nadventitia_r_nadventitious_r_nadventure_r_nadventurer_r_nadventuresome_r_nadventuress_r_nadventurism_r_nadventurous_r_nadverb_r_nadverbial_r_nadversaria_r_nadversary_r_nadversative_r_nadverse_r_nadversity_r_nadvert_r_nadvertence_r_nadvertent_r_nadvertise_r_nadvertisement_r_nadvertising_r_nadvice_r_nadvisable_r_nadvise_r_nadvised_r_nadvisedly_r_nadvisee_r_nadvisement_r_nadviser_r_nadvisory_r_nadvocaat_r_nadvocacy_r_nadvocate_r_nadvocation_r_nadvowson_r_nadynamia_r_nadytum_r_nadz_r_nadze_r_naec_r_naeciospore_r_naecium_r_naedes_r_naedile_r_naegaeon_r_naegean_r_naegeus_r_naegina_r_naegir_r_naegis_r_naegisthus_r_naegospotami_r_naegrotat_r_naegyptus_r_naekerly_r_naelber_r_naemia_r_naenea_r_naeneas_r_naeneid_r_naeneous_r_naeneus_r_naeniah_r_naenneea_r_naeolian_r_naeolic_r_naeolipile_r_naeolis_r_naeolotropic_r_naeolus_r_naeon_r_naeonian_r_naer_r_naerate_r_naerator_r_naeri_r_naerial_r_naerialist_r_naerie_r_naeriel_r_naeriela_r_naeriell_r_naerification_r_naeriform_r_naerify_r_naero_r_naeroballistics_r_naerobatics_r_naerobe_r_naerobic_r_naerobiology_r_naerobiosis_r_naerodonetics_r_naerodontia_r_naerodrome_r_naerodynamics_r_naerodyne_r_naeroembolism_r_naerogram_r_naerograph_r_naerography_r_naerolite_r_naerology_r_naeromancy_r_naeromarine_r_naeromechanic_r_naeromechanics_r_naeromedical_r_naerometeorograph_r_naerometer_r_naerometry_r_naeronaut_r_naeronautics_r_naeroneurosis_r_naeropause_r_naerophagia_r_naerophobia_r_naerophone_r_naerophyte_r_naeroplane_r_naeroscope_r_naerosol_r_naerospace_r_naerosphere_r_naerostat_r_naerostatic_r_naerostatics_r_naerostation_r_naerotherapeutics_r_naerothermodynamics_r_naerugo_r_naery_r_naeschi
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 8], rbx
mov ecx, reloc.WLDAP32.dll_Ordinal_45
call fcn.140139bc8
mov qword [rbp + 0x110], rax
lea rbx, [rax + 0x2d]
mov qword [rbp + 0x120], rbx
mov r8d, reloc.WLDAP32.dll_Ordinal_45
lea rdx, str._echo_off_r_nstart_____C:ProgramDataE344.exe_
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x118], rbx
lea rdx, [rbp + 0x300]
lea rcx, [rbp + 0x78]
call fcn.140047650
lea rdx, [rbp + 0x2e0]
lea rcx, [rbp + 0x60]
call fcn.140047650
lea rdx, [rbp + 0x2c0]
lea rcx, [rbp + 0x48]
call fcn.140047650
lea rdx, [rbp + 0x2a0]
lea rcx, [rbp + 0x30]
call fcn.140047650
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x128]
call fcn.140047650
lea rdx, [rbp + 0x260]
lea rcx, [rbp + 0x18]
call fcn.140047650
lea rdx, [rbp + 0x240]
lea rcx, [rbp]
call fcn.140047650
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0x110]
call fcn.140047650
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x414
call fcn.140139bc8
mov qword [rsp + 0x60], rax
lea rbx, [rax + 0x414]
mov qword [rsp + 0x70], rbx
mov r8d, 0x414
lea rdx, str._echo_off_r_nsetlocal_enabledelayedexpansion_r_n_r_nfor__f__tokens3____i_in__reg.exe_query__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersion___v_DigitalProductId__do___r_n____set_x__i_r_n__r_n_r_nfor__l___z_in__104__2__132__do___r_n____set__a_array___z_0x_x:__z_2__r_n__r_n_r_ncall_:GetKey_r_necho_ProductKey:__t_t_t_GetKey__r_n_r_nendlocal_r_nexit__b_0_r_n_r_n:GetKey_r_n____setlocal_enabledelayedexpansion_r_n____set_out_0_r_n____set_pcBCDFGHJKMPQRTVWXY2346789_r_n____set_x0_r_n____for__l___i_in__0__1__28__do___r_n________if__x__gtr_28_goto_:Break_r_n_r_n________set_a0_r_n_r_n________for__l___j_in__132___2__104__do___r_n____________set__a_aarray___j____a___256_r_n____________set__a_array___j_____a____24____255__r_n____________set__a_a__24_r_n____________set__a_n__j_r_n__________r_n_r_n________for___z_in___a___do_set_key_pc:__z_1__key__r_n________set__a_f____x___2______6__r_n_r_n________if__f__equ_0_if__x__lss_28___r_n____________set__a_x1_r_n____________set_key__key__r_n__________r_n_r_n_________r_n________set__a_x1_r_n______r_n:Break_r_n_____r_n____endlocal__set__out:1__key__r_n____exit__b_r_n_r_n_t_r_n
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x68], rbx
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.140047820
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14004937b
mov rdx, qword [rsp + 0x70]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049376
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140049376
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140139f2c
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rdi
mov ecx, 0x3f4e
call fcn.140139bc8
test rax, rax
je 0x1400495a9
lea r8, [rax + 0x27]
and r8, 0xffffffffffffffe0
mov qword [r8 - 8], rax
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r8
lea rax, [r8 + 0x3f27]
mov qword [rsp + 0x70], rax
lea rdx, [0x14021cc67]
lea rcx, str._echo_off_n_nrem_Hostname_change_nSET__TextFileC:ProgramDatahost.txt__nFOR__f___a_IN__type___textfile__find__c__v_____DO_SET__a_numlines__a_nSET__A_RandomLine__RANDOM______NumLines___nIF___RandomLine___0___SET__RandomLine___ELSE__SET__RandomLineskip_randomline____nFOR__F__usebackq_tokens__RandomLine__delims____A_IN___TYPE__TextFile____DO___n_____echo___A_n_set_hostname__A_n____GOTO_Finish_n__n_n_n_n:Finish_n_echo__hostname__n_nrem_Username_change_nSET__TextFileC:ProgramDatahost.txt__nFOR__f___a_IN__type___textfile__find__c__v_____DO_SET__a_numlines__a_nSET__A_RandomLine__RANDOM______NumLines___nIF___RandomLine___0___SET__RandomLine___ELSE__SET__RandomLineskip_randomline____nFOR__F__usebackq_tokens__RandomLine__delims____A_IN___TYPE__TextFile____DO___n_____echo___A_n_set_user__A_n____GOTO_Finish_n__n_n:Finish_n_echo__user__n_nrem_Install_date_change_nset_min51000_nset_max59999_nset__a_d1_random____max5_min51_min5_n__nset_min6100_nset_max6999_nset__a_d2_random____max6_min61_min6_n__n_nrem_BuildID_nset_min114190_nset_max114478_nset__a_bi1_random____max1_min11_min1_n_nset_min21078_nset_max21292_nset__a_bi2_random____max2_min21_min2_n_nset_min3100_nset_max3999_nset__a_bi3_random____max3_min31_min3_n_nrem_VolumeID_nSetlocal_EnableDelayedExpansion_nSet__RNDLength4_nSet__AlphanumericABCDEF0123456789_nSet__Str__Alphanumeric_987654321_n:_LenLoop_nIF_NOT____Str:18_____SET__Str__Str:9__SET__A__Len9_GOTO_:_LenLoop_nSET__tmp__Str:9_1__nSET__A__Len_Len_tmp_nSet__count0_nSET__RndAlphaNum_n:_loop_nSet__a__count1_nSET__RND_Random__nSet__A__RND_RND____Len__nSET__RndAlphaNum__RndAlphaNum___Alphanumeric:__RND__1__nIf___count__lss___RNDLength__goto__loop_n_echo_Random_string_is___RndAlphaNum__n__nSetlocal_EnableDelayedExpansion_nSet__RNDLength4_nSet__AlphanumericABCDEF0123456789_nSet__Str__Alphanumeric_987654321_n:_LenLoop_nIF_NOT____Str:18_____SET__Str__Str:9__SET__A__Len9_GOTO_:_LenLoop_nSET__tmp__Str:9_1__nSET__A__Len_Len_tmp_nSet__count0_nSET__RndAlphaNum2_n:_loop_nSet__a__count21_nSET__RND_Random__nSet__A__RND_RND____Len__nSET__RndAlphaNum2__RndAlphaNum2___Alphanumeric:__RND__1__nIf___count2__lss___RNDLength__goto__loop_n_echo_Random_string_is___RndAlphaNum2__n_nset_I4_nset_N16_nset_CHAR0_1_2_3_4_5_6_7_8_9_A_B_C_D_E_F_n_nset_I4_n:LOOP1_nset__a_R1_N__random__32768_nfor__f__tokens_R_____q_in____CHAR____do__set_Hex0__q_Hex0___nSet__a_I_1_nIf__I__GTR_0_goto_LOOP1_n_nset_I4_n:LOOP2_nset__a_R1_N__random__32768_nfor__f__tokens_R_____q_in____CHAR____do__set_Hex1__q_Hex1___nSet__a_I_1_nIf__I__GTR_0_goto_LOOP2_n_nset_I8_n:LOOP3_nset__a_R1_N__random__32768_nfor__f__tokens_R_____q_in____CHAR____do__set_Hex8__q_Hex8___nSet__a_I_1_nIf__I__GTR_0_goto_LOOP3_n_nset_I10_n:LOOP4_nset__a_R1_N__random__32768_nfor__f__tokens_R_____q_in____CHAR____do__set_Hex10__q_Hex10___nSet__a_I_1_nIf__I__GTR_0_goto_LOOP4_n_nrem_MACadress_nSET__TextFileC:ProgramDatamac.txt__nFOR__f___a_IN__type___textfile__find__c__v_____DO_SET__a_numlines__a_nSET__A_RandomLine__RANDOM______NumLines___nIF___RandomLine___0___SET__RandomLine___ELSE__SET__RandomLineskip_randomline____nFOR__F__usebackq_tokens__RandomLine__delims____A_IN___TYPE__TextFile____DO___n_____echo___A_n_set_mac__A_n____GOTO_Finish_n__n_n:Finish_n_echo__mac__n_nset_min310_nset_max399_nset__a_m1_random____max3_min31_min3_n_nset_min310_nset_max399_nset__a_m2_random____max3_min31_min3_n_nset_min310_nset_max399_nset__a_m3_random____max3_min31_min3_n_nset_min410000_nset_max432000_nset__a_m4_random____max4_min41_min4_n_n_nrem_Hostname_username_change_nwmic_useraccount_where_caption_USERNAME__rename__user__nREG_ADD____HKEY_LOCAL_MACHINESYSTEMCurrentControlSet_servicesTcpipParameters___v__NV_Hostname___t_REG_SZ__d__hostname___f_nREG_ADD____HKEY_LOCAL_MACHINESYSTEMCurrentControlSet_servicesTcpipParameters___v_Hostname__t_REG_SZ__d__hostname___f_nREG_ADD____HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlComputerNameCom
call fcn.140063d50
mov qword [rsp + 0x68], rax
mov qword [rbp + 0x350], rdi
lea rcx, [rbp + 0x350]
call fcn.140062ac0
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.140047820
nop
lea rcx, [rsp + 0x60]
call fcn.140056500
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [0x1408c357d]
lea rdx, str._echo_off_r_nstart_____C:ProgramDataE344.exe_
lea rcx, [rsp + 0x60]
call fcn.1400598c0
nop
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.140047820
nop
lea rcx, [rsp + 0x60]
call fcn.140056500
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.shutdown__r__f__t_0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
lea rcx, [rbp + 0x110]
call fcn.140056500
nop
lea rcx, [rbp]
call fcn.140056500
nop
lea rcx, [rbp + 0x18]
call fcn.140056500
nop
lea rcx, [rbp + 0x128]
call fcn.140056500
nop
lea rcx, [rbp + 0x30]
call fcn.140056500
nop
lea rcx, [rbp + 0x48]
call fcn.140056500
nop
lea rcx, [rbp + 0x60]
call fcn.140056500
nop
lea rcx, [rbp + 0x78]
call fcn.140056500
nop
lea rcx, [rbp + 0x220]
call fcn.14003f5d0
nop
lea rcx, [rbp + 0x240]
call fcn.14003f5d0
nop
lea rcx, [rbp + 0x260]
call fcn.14003f5d0
nop
lea rcx, [rbp + 0x280]
call fcn.14003f5d0
nop
lea rcx, [rbp + 0x2a0]
call fcn.14003f5d0
nop
lea rcx, [rbp + 0x2c0]
call fcn.14003f5d0
nop
lea rcx, [rbp + 0x2e0]
call fcn.14003f5d0
nop
lea rcx, [rbp + 0x300]
call fcn.14003f5d0
nop
lea rcx, [rbp - 0x60]
call fcn.14003f5d0
nop
lea rcx, [rbp + 0xf0]
call fcn.14003f5d0
nop
lea rcx, [rbp - 0x40]
call fcn.14003f5d0
nop
lea rcx, [rbp + 0xb0]
call fcn.14003f5d0
nop
lea rcx, [rbp - 0x20]
call fcn.14003f5d0
nop
lea rcx, [rbp - 0x80]
call fcn.14003f5d0
nop
lea rcx, [rbp + 0xd0]
call fcn.14003f5d0
nop
lea rcx, [rbp + 0x90]
call fcn.14003f5d0
nop
lea rcx, [rsp + 0x40]
call fcn.14003f5d0
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14002f5a0
nop
call fcn.14002f5a0
nop
call fcn.14002f5a0
nop
call fcn.14002f5a0
nop
call fcn.14002f5a0
nop
call fcn.14002f5a0
nop
call fcn.14002f5a0
int3