Function at 0x140005950
Capabilities:
Execute command
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov ecx, reloc.WLDAP32.dll_Ordinal_32
mov qword [rbp - 0x18], rbx
call fcn.14000bb40
movdqa xmm0, xmmword [reloc.WLDAP32.dll_Ordinal_30]
mov rcx, rax
movdqu xmmword [rbp - 0x10], xmm0
mov qword [rbp - 0x20], rax
movups xmm0, xmmword [str.netsh_interface_ipv6_uninstall]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140069c50]
movsd qword [rax + 0x10], xmm0
mov eax, dword [0x140069c58]
mov dword [rcx + 0x18], eax
movzx eax, word [0x140069c5c]
mov word [rcx + 0x1c], ax
mov byte [rcx + 0x1e], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x1400059f3
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400059ee
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400059ee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bdc4
mov ecx, 0x60
mov qword [rbp - 0x18], rbx
call fcn.14000bb40
movdqa xmm0, xmmword [0x14006b230]
mov rcx, rax
movdqu xmmword [rbp - 0x10], xmm0
mov qword [rbp - 0x20], rax
movaps xmm0, xmmword [str.netsh_advfirewall_firewall_set_rule_group_File_and_Printer_Sharing__new_enableno]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x140069c70]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x140069c80]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x140069c90]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x140069ca0]
movups xmmword [rax + 0x40], xmm0
movzx eax, word [0x140069cb0]
mov word [rcx + 0x50], ax
mov byte [rcx + 0x52], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140005a9d
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a98
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005a98
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bdc4
mov ecx, Ordinal_50
mov qword [rbp - 0x18], rbx
call fcn.14000bb40
movdqa xmm0, xmmword [0x14006b200]
mov rcx, rax
mov qword [rbp - 0x20], rax
movdqu xmmword [rbp - 0x10], xmm0
movups xmm0, xmmword [str.netsh_int_tcp_set_global_autotuninglevelnormal]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140069cc8]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x140069cd8]
movsd qword [rax + 0x20], xmm0
mov eax, dword [0x140069ce0]
mov dword [rcx + 0x28], eax
movzx eax, word [0x140069ce4]
mov word [rcx + 0x2c], ax
movzx eax, byte [0x140069ce6]
mov byte [rcx + 0x2e], al
mov byte [rcx + 0x2f], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140005b46
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005b41
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005b41
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bdc4
mov ecx, 0x60
mov qword [rbp - 0x18], rbx
call fcn.14000bb40
movdqa xmm0, xmmword [0x14006b260]
mov rcx, rax
movdqu xmmword [rbp - 0x10], xmm0
mov qword [rbp - 0x20], rax
movaps xmm0, xmmword [str.netsh_interface_set_interface__Microsoft_Network_Adapter_Multiplexor_Protocol__admindisabled]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x140069d00]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x140069d10]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x140069d20]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x140069d30]
movups xmmword [rax + 0x40], xmm0
movsd xmm0, qword [0x140069d40]
movsd qword [rax + 0x50], xmm0
mov eax, dword [0x140069d48]
mov dword [rcx + 0x58], eax
movzx eax, byte [0x140069d4c]
mov byte [rcx + 0x5c], al
mov byte [rcx + 0x5d], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140005c05
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005c00
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005c00
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bdc4
mov ecx, Ordinal_50
mov qword [rbp - 0x18], rbx
call fcn.14000bb40
movdqa xmm0, xmmword [reloc.WLDAP32.dll_Ordinal_32]
mov rcx, rax
movdqu xmmword [rbp - 0x10], xmm0
mov qword [rbp - 0x20], rax
movups xmm0, xmmword [str.sc_config_lltdsvc_startdisabled]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140069d60]
movups xmmword [rax + 0x10], xmm1
mov byte [rax + 0x20], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140005c83
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005c7e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005c7e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bdc4
mov ecx, 0x50
mov qword [rbp - 0x18], rbx
call fcn.14000bb40
movdqa xmm0, xmmword [0x14006b210]
mov rcx, rax
movdqu xmmword [rbp - 0x10], xmm0
mov qword [rbp - 0x20], rax
movaps xmm0, xmmword [str.netsh_advfirewall_firewall_set_rule_group_Network_Discovery__new_enableno]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x140069d90]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x140069da0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x140069db0]
movups xmmword [rax + 0x30], xmm1
movsd xmm0, qword [0x140069dc0]
movsd qword [rax + 0x40], xmm0
movzx eax, word [0x140069dc8]
mov word [rcx + 0x48], ax
movzx eax, byte [reloc.WS2_32.dll_WSAGetLastError]
mov byte [rcx + 0x4a], al
mov byte [rcx + 0x4b], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140005d39
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005d34
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005d34
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bdc4
mov ecx, 0x90
mov qword [rbp - 0x18], rbx
call fcn.14000bb40
movdqa xmm0, xmmword [0x14006b2a0]
mov rcx, rax
movdqu xmmword [rbp - 0x10], xmm0
mov qword [rbp - 0x20], rax
movaps xmm0, xmmword [str.reg_add__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpip6Parameters___v_DisabledComponents__t_REG_DWORD__d_0xFFFFFFFF__f]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x140069de0]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x140069df0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x140069e00]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x140069e10]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x140069e20]
movups xmmword [rax + 0x50], xmm1
movaps xmm0, xmmword [0x140069e30]
movups xmmword [rax + 0x60], xmm0
movaps xmm1, xmmword [0x140069e40]
movups xmmword [rax + 0x70], xmm1
mov eax, dword [0x140069e50]
mov dword [rcx + 0x80], eax
mov byte [rcx + 0x84], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140005e08
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005e03
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005e03
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bdc4
mov ecx, reloc.WS2_32.dll_WSASetLastError
mov qword [rbp - 0x18], rbx
call fcn.14000bb40
movdqa xmm0, xmmword [0x14006b290]
mov rcx, rax
movdqu xmmword [rbp - 0x10], xmm0
mov qword [rbp - 0x20], rax
movaps xmm0, xmmword [str.reg_delete__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpip6Parameters___v_DisabledComponents__f]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x140069e70]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x140069e80]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x140069e90]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x140069ea0]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x140069eb0]
movups xmmword [rax + 0x50], xmm1
movsd xmm0, qword [0x140069ec0]
movsd qword [rax + 0x60], xmm0
mov eax, dword [0x140069ec8]
mov dword [rcx + 0x68], eax
mov byte [rcx + 0x6c], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140005ec8
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005ec3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005ec3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bdc4
mov ecx, reloc.WLDAP32.dll_Ordinal_32
mov qword [rbp - 0x18], rbx
call fcn.14000bb40
movdqa xmm0, xmmword [reloc.WLDAP32.dll_Ordinal_30]
mov rcx, rax
movdqu xmmword [rbp - 0x10], xmm0
mov qword [rbp - 0x20], rax
movups xmm0, xmmword [str.netsh_interface_ipv6_uninstall]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140069c50]
movsd qword [rax + 0x10], xmm0
mov eax, dword [0x140069c58]
mov dword [rcx + 0x18], eax
movzx eax, word [0x140069c5c]
mov word [rcx + 0x1c], ax
mov byte [rcx + 0x1e], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140005f5c
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005f57
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005f57
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bdc4
mov ecx, 0x60
mov qword [rbp - 0x18], rbx
call fcn.14000bb40
movdqa xmm0, xmmword [0x14006b230]
mov rcx, rax
movdqu xmmword [rbp - 0x10], xmm0
mov qword [rbp - 0x20], rax
movaps xmm0, xmmword [str.netsh_advfirewall_firewall_set_rule_group_File_and_Printer_Sharing__new_enableno]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x140069c70]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x140069c80]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x140069c90]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x140069ca0]
movups xmmword [rax + 0x40], xmm0
movzx eax, word [0x140069cb0]
mov word [rcx + 0x50], ax
mov byte [rcx + 0x52], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140006006
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006001
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006001
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bdc4
mov ecx, Ordinal_50
mov qword [rbp - 0x18], rbx
call fcn.14000bb40
movdqa xmm0, xmmword [0x14006b200]
mov rcx, rax
mov qword [rbp - 0x20], rax
movdqu xmmword [rbp - 0x10], xmm0
movups xmm0, xmmword [str.netsh_int_tcp_set_global_autotuninglevelnormal]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140069cc8]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x140069cd8]
movsd qword [rax + 0x20], xmm0
mov eax, dword [0x140069ce0]
mov dword [rcx + 0x28], eax
movzx eax, word [0x140069ce4]
mov word [rcx + 0x2c], ax
movzx eax, byte [0x140069ce6]
mov byte [rcx + 0x2e], al
mov byte [rcx + 0x2f], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x1400060af
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400060aa
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400060aa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bdc4
mov ecx, 0x60
mov qword [rbp - 0x18], rbx
call fcn.14000bb40
movdqa xmm0, xmmword [0x14006b260]
mov rcx, rax
movdqu xmmword [rbp - 0x10], xmm0
mov qword [rbp - 0x20], rax
movaps xmm0, xmmword [str.netsh_interface_set_interface__Microsoft_Network_Adapter_Multiplexor_Protocol__admindisabled]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x140069d00]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x140069d10]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x140069d20]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x140069d30]
movups xmmword [rax + 0x40], xmm0
movsd xmm0, qword [0x140069d40]
movsd qword [rax + 0x50], xmm0
mov eax, dword [0x140069d48]
mov dword [rcx + 0x58], eax
movzx eax, byte [0x140069d4c]
mov byte [rcx + 0x5c], al
mov byte [rcx + 0x5d], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14000616e
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006169
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006169
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bdc4
mov ecx, Ordinal_50
mov qword [rbp - 0x18], rbx
call fcn.14000bb40
movdqa xmm0, xmmword [reloc.WLDAP32.dll_Ordinal_32]
mov rcx, rax
movdqu xmmword [rbp - 0x10], xmm0
mov qword [rbp - 0x20], rax
movups xmm0, xmmword [str.sc_config_lltdsvc_startdisabled]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140069d60]
movups xmmword [rax + 0x10], xmm1
mov byte [rax + 0x20], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x1400061ec
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400061e7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400061e7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bdc4
mov ecx, 0x50
mov qword [rbp - 0x18], rbx
call fcn.14000bb40
movdqa xmm0, xmmword [0x14006b210]
mov rcx, rax
movdqu xmmword [rbp - 0x10], xmm0
mov qword [rbp - 0x20], rax
movaps xmm0, xmmword [str.netsh_advfirewall_firewall_set_rule_group_Network_Discovery__new_enableno]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x140069d90]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x140069da0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x140069db0]
movups xmmword [rax + 0x30], xmm1
movsd xmm0, qword [0x140069dc0]
movsd qword [rax + 0x40], xmm0
movzx eax, word [0x140069dc8]
mov word [rcx + 0x48], ax
movzx eax, byte [reloc.WS2_32.dll_WSAGetLastError]
mov byte [rcx + 0x4a], al
mov byte [rcx + 0x4b], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x1400062a2
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000629d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000629d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bdc4
mov ecx, 0x50
mov qword [rbp - 0x18], rbx
call fcn.14000bb40
movdqa xmm0, xmmword [0x14006b220]
mov rcx, rax
movdqu xmmword [rbp - 0x10], xmm0
mov qword [rbp - 0x20], rax
movaps xmm0, xmmword [str.reg_delete__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v_EEE__f]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x140069ee0]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x140069ef0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x140069f00]
movups xmmword [rax + 0x30], xmm1
movsd xmm0, qword [0x140069f10]
movsd qword [rax + 0x40], xmm0
mov eax, dword [0x140069f18]
mov dword [rcx + 0x48], eax
movzx eax, word [0x140069f1c]
mov word [rcx + 0x4c], ax
mov byte [rcx + 0x4e], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140006357
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006352
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006352
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bdc4
mov ecx, reloc.WS2_32.dll_WSASetLastError
mov qword [rbp - 0x18], rbx
call fcn.14000bb40
movdqa xmm0, xmmword [0x14006b280]
mov rcx, rax
movdqu xmmword [rbp - 0x10], xmm0
mov qword [rbp - 0x20], rax
movaps xmm0, xmmword [str.reg_delete__HKLMSYSTEMCurrentControlSetServicesTcpipParametersInterfaces___v_NetworkAddress__f]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x140069f30]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x140069f40]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x140069f50]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x140069f60]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x140069f70]
movups xmmword [rax + 0x50], xmm1
mov eax, dword [0x140069f80]
mov dword [rcx + 0x60], eax
mov byte [rcx + 0x64], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14000640a
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006405
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006405
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bdc4
mov ecx, 0x60
mov qword [rbp - 0x18], rbx
call fcn.14000bb40
movdqa xmm0, xmmword [0x14006b240]
mov rcx, rax
movdqu xmmword [rbp - 0x10], xmm0
mov qword [rbp - 0x20], rax
movaps xmm0, xmmword [str.reg_delete__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v_ArpOffload__f]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x140069fa0]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x140069fb0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x140069fc0]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x140069fd0]
movups xmmword [rax + 0x40], xmm0
mov eax, dword [0x140069fe0]
mov dword [rcx + 0x50], eax
movzx eax, byte [0x140069fe4]
mov byte [rcx + 0x54], al
mov byte [rcx + 0x55], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x1400064bc
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400064b7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400064b7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bdc4
mov ecx, 0x60
mov qword [rbp - 0x18], rbx
call fcn.14000bb40
movdqa xmm0, xmmword [0x14006b250]
mov rcx, rax
movdqu xmmword [rbp - 0x10], xmm0
mov qword [rbp - 0x20], rax
movaps xmm0, xmmword [str.reg_delete__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v_TcpAckFrequency__f]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x14006a000]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x14006a010]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x14006a020]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x14006a030]
movups xmmword [rax + 0x40], xmm0
movsd xmm0, qword [0x14006a040]
movsd qword [rax + 0x50], xmm0
movzx eax, word [0x14006a048]
mov word [rcx + 0x58], ax
mov byte [rcx + 0x5a], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140006573
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000656e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000656e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bdc4
mov ecx, reloc.WS2_32.dll_WSASetLastError
mov qword [rbp - 0x18], rbx
call fcn.14000bb40
movdqa xmm0, xmmword [0x14006b270]
mov rcx, rax
movdqu xmmword [rbp - 0x10], xmm0
mov qword [rbp - 0x20], rax
movaps xmm0, xmmword [str.reg_delete__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v_TcpChecksumOffloadIPv4__f]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x14006a060]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x14006a070]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x14006a080]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x14006a090]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x14006a0a0]
movups xmmword [rax + 0x50], xmm1
movzx eax, byte [0x14006a0b0]
mov byte [rcx + 0x60], al
mov byte [rcx + 0x61], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140006627
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006622
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006622
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bdc4
mov ecx, reloc.WS2_32.dll_WSASetLastError
mov qword [rbp - 0x18], rbx
call fcn.14000bb40
movdqa xmm0, xmmword [0x14006b270]
mov rcx, rax
movdqu xmmword [rbp - 0x10], xmm0
mov qword [rbp - 0x20], rax
movaps xmm0, xmmword [str.reg_delete__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v_LargeSendOffloadv2IPv6__f]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x14006a0d0]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x14006a0e0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x14006a0f0]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x14006a100]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x14006a110]
movups xmmword [rax + 0x50], xmm1
movzx eax, byte [0x14006a120]
mov byte [rcx + 0x60], al
mov byte [rcx + 0x61], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x1400066db
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400066d6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400066d6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bdc4
mov edx, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x18], rbx
mov ecx, 0x61
movabs r8, 0x7fffffffffffffff
call fcn.1400041a0
lea rdx, [rbp + 0x10]
mov qword [rbp + 0x10], rax
call fcn.140004840
mov rcx, qword [rbp + 0x10]
lea rdx, str.reg_delete__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v_TcpChecksumOffloadIPv6__f
mov qword [rbp - 8], rcx
mov r8d, 0x61
mov rcx, rax
mov qword [rbp - 0x20], rax
mov rbx, rax
mov qword [rbp - 0x10], 0x61
call fcn.140001aa0
lea rcx, [rbp - 0x20]
mov byte [rbx + 0x61], 0
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.reg_delete__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v_UdpChecksumOffloadIPv6__f
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.reg_add__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpip6Parameters___v_DisabledComponents__t_REG_DWORD__d_0xFFFFFFFF__f
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.reg_add__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v_EEE__t_REG_DWORD__d_0__f
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.reg_add__HKLMSYSTEMCurrentControlSetServicesTcpipParametersInterfaces___v_NetworkAddress__t_REG_SZ__d_____f
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.reg_add__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v_ArpOffload__t_REG_DWORD__d_0__f
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.reg_add__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v_TcpAckFrequency__t_REG_DWORD__d_1__f
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.reg_add__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v_TcpChecksumOffloadIPv4__t_REG_DWORD__d_0__f
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.reg_add__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v_LargeSendOffloadv2IPv6__t_REG_DWORD__d_0__f
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.reg_add__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v_TcpChecksumOffloadIPv6__t_REG_DWORD__d_0__f
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.reg_add__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v_UdpChecksumOffloadIPv6__t_REG_DWORD__d_0__f
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.arp__d
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.ipconfig__flushdns
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.ipconfig__registerdns
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.ipconfig__release
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.ipconfig__renew
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.netsh_winsock_reset
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.reg_delete_HKLMSOFTWAREWOW6432NodeEasyAntiCheat__f
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.reg_delete_HKLMSYSTEMControlSet001ServicesEasyAntiCheat__f
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.reg_delete_HKLMSYSTEMControlSet001ServicesBEService__f
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.rmdir__s__q_C:Users_username_AppDataRoamingMicrosoftWindowsCloudStore
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.rmdir__s__q_C:Users_username_AppDataLocalFortniteGameSaved
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.rmdir__s__q_C:WindowsINF
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.rmdir__s__q_C:ProgramData_username_MicrosoftXboxLiveNSALCache
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.rmdir__s__q_C:UsersPublicDocuments
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.rmdir__s__q_C:WindowsPrefetch
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.rmdir__s__q_C:Users_username_AppDataLocalD3DSCache
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.rmdir__s__q_C:Users_username_AppDataLocalCrashReportClient
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.rmdir__s__q_C:Windows_temp
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.rmdir__s__q_C:Users_username_AppDataLocalMicrosoftWindowsSettingSyncmetastore
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.rmdir__s__q_C:WindowsSoftwareDistributionDataStoreLogs
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.rmdir__s__q_C:ProgramDataMicrosoftWindowsWERTemp
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.rmdir__s__q_C:Users_username_AppDataLocalAMDDxCache
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.rmdir__s__q__C:Users_username_AppDataLocalNVIDIA_Corporation_
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.taskkill__f__im_EpicGamesLauncher.exe
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.taskkill__f__im_FortniteClient_Win64_Shipping.exe
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.taskkill__f__im_OneDrive.exe
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.rd__q__s__systemdrive__Recycle.Bin
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.rd__q__s_d:_Recycle.Bin
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.rd__q__s_e:_Recycle.Bin
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
lea rdx, str.rd__q__s_f:_Recycle.Bin
lea rcx, [rbp - 0x20]
call fcn.140001960
lea rcx, [rbp - 0x20]
call fcn.140005930
lea rcx, [rbp - 0x20]
call fcn.1400041d0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret