Function at 0x140005980
Capabilities:
Execute command
Self delete
Set console window title
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov rax, qword [0x140010040]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor r12d, r12d
lea rcx, str.____________________________
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rdx, str.C:ProgramDataMicrosoftWindowsDevManView.cfg
lea rcx, [rbp - 0x69]
call fcn.140006cb0
nop
mov r8d, 0x49a
lea rdx, str._General__r_nShowGridLines0_r_nSaveFilterIndex0_r_nShowInfoTip1_r_nShowLegacyDrivers0_r_nShowTimeInGMT0_r_nMarkDisabledItems1_r_nShowOnlyConnected0_r_nLoadFrom1_r_nControlSet0_r_nComputerName_r_nWinDir_r_nAutoStartRemoteRegistry1_r_nAddExportHeaderLine0_r_nMarkConnectedDevices0_r_nMarkOddEvenRows0_r_nShowOnlyDevicesWithLocation0_r_nStartAsHidden0_r_nAutoSizeColumnsOnLoad0_r_nTrayIcon0_r_nUseQuickFilter0_r_nQuickFilterString_r_nQuickFilterColumnsMode1_r_nQuickFilterFindMode1_r_nQuickFilterShowHide1_r_nDisableEnableWaitTime100_r_nPropertiesPos2C_00_00_00_00_00_00_00_01_00_00_00_FF_FF_FF_FF_FF_FF_FF_FF_FF_FF_FF_FF_FF_FF_FF_FF_A3_02_00_00_2D_01_00_00_9B_04_00_00_E4_03_00_00_r_nWinPos2C_00_00_00_00_00_00_00_01_00_00_00_FF_FF_FF_FF_FF_FF_FF_FF_FF_FF_FF_FF_FF_FF_FF_FF_2D_00_00_00_A5_00_00_00_09_07_00_00_7A_03_00_00_r_nColumns49_01_00_00_96_00_01_00_96_00_02_00_96_00_03_00_96_00_04_00_96_00_05_00_96_00_06_00_96_00_07_00_96_00_08_00_50_00_09_00_50_00_0A_00_78_00_0B_00_78_00_0C_00_50_00_0D_00_96_00_0E_00_96_00_0F_00_78_00_10_00_78_00_11_00_78_00_12_00_78_00_13_00_96_00_14_00_78_00_15_00_78_00_16_00_64_00_17_00_78_00_18_00_78_00_19_00_r_nSort0_r_n_RecentFiles__r_n0_r_n1_r_n2_r_n3_r_n4_r_n5_r_n6_r_n7_r_n8_r_n9_r_n
lea rcx, [rbp - 0x69]
call fcn.140005850
nop
mov rdx, qword [rbp - 0x51]
cmp rdx, 7
jbe 0x140005a2d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a28
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005a28
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008eb8
lea rdx, str.C:ProgramDataMicrosoftWindowsDevManView.chm
lea rcx, [rbp - 0x69]
call fcn.140006cb0
nop
mov r8d, 0x4d1a
lea rdx, str.ITSF
lea rcx, [rbp - 0x69]
call fcn.140005850
nop
mov rdx, qword [rbp - 0x51]
cmp rdx, 7
jbe 0x140005a98
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a93
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005a93
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008eb8
lea rdx, str.C:ProgramDataMicrosoftWindowsDevManView.exe
lea rcx, [rbp - 0x69]
call fcn.140006cb0
nop
mov r8d, 0x28b78
lea rdx, [0x1400108f0]
lea rcx, [rbp - 0x69]
call fcn.140005850
nop
mov rdx, qword [rbp - 0x51]
cmp rdx, 7
jbe 0x140005b03
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005afe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005afe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008eb8
lea rdx, str.C:ProgramDataMicrosoftWindows_amide.sys
lea rcx, [rbp - 0x69]
call fcn.140006cb0
nop
mov r8d, 0x4be8
lea rdx, [0x1400d9370]
lea rcx, [rbp - 0x69]
call fcn.140005850
nop
mov rdx, qword [rbp - 0x51]
cmp rdx, 7
jbe 0x140005b6e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005b69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005b69
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008eb8
lea rdx, str.C:ProgramDataMicrosoftWindows_amifldrv64.sys
lea rcx, [rbp - 0x69]
call fcn.140006cb0
nop
mov r8d, 0x4be8
lea rdx, [0x1400d3d90]
lea rcx, [rbp - 0x69]
call fcn.140005850
nop
mov rdx, qword [rbp - 0x51]
cmp rdx, 7
jbe 0x140005bd9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005bd4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005bd4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008eb8
lea rdx, str.C:ProgramDataMicrosoftWindowsAMIDEWINx64.exe
lea rcx, [rbp - 0x69]
call fcn.140006cb0
nop
mov r8d, 0x71270
lea rdx, [0x140039470]
lea rcx, [rbp - 0x69]
call fcn.140005850
nop
mov rdx, qword [rbp - 0x51]
cmp rdx, 7
jbe 0x140005c44
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005c3f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005c3f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008eb8
lea rdx, str.C:ProgramDataMicrosoftWindowsVolumeid64.exe
lea rcx, [rbp - 0x69]
call fcn.140006cb0
nop
mov r8d, 0x296b0
lea rdx, [0x1400aa6e0]
lea rcx, [rbp - 0x69]
call fcn.140005850
nop
mov rdx, qword [rbp - 0x51]
cmp rdx, 7
jbe 0x140005caf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005caa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005caa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008eb8
lea rdx, [0x14000c1e0]
lea rcx, [rbp - 0x69]
call fcn.140006cb0
nop
mov r8d, 0x546
lea rdx, str.echo_off_r_ncls_r_nstart_C:ProgramDataMicrosoftWindowsDevManView.exe__uninstall__WAN_Miniport___use_wildcard___r_nstart_C:ProgramDataMicrosoftWindowsDevManView.exe__uninstall__Disk_drive___use_wildcard___r_nstart_C:ProgramDataMicrosoftWindowsDevManView.exe__uninstall__C:__r_nstart_C:ProgramDataMicrosoftWindowsDevManView.exe__uninstall__D:__r_nstart_C:ProgramDataMicrosoftWindowsDevManView.exe__uninstall__E:__r_nstart_C:ProgramDataMicrosoftWindowsDevManView.exe__uninstall__F:__r_nstart_C:ProgramDataMicrosoftWindowsDevManView.exe__uninstall__G:__r_nstart_C:ProgramDataMicrosoftWindowsDevManView.exe__uninstall__Disk__r_nstart_C:ProgramDataMicrosoftWindowsDevManView.exe__uninstall__disk__r_nstart_C:ProgramDataMicrosoftWindowsDevManView.exe__uninstall__Disk___use_wildcard___r_nstart_C:ProgramDataMicrosoftWindowsDevManView.exe__uninstall__SWDWPDBUSENUM___use_wildcard___r_nstart_C:ProgramDataMicrosoftWindowsDevManView.exe__uninstall__USBSTOR___use_wildcard___r_nstart_C:ProgramDataMicrosoftWindowsDevManView.exe__uninstall__SCSIDisk___use_wildcard___r_nstart_C:ProgramDataMicrosoftWindowsDevManView.exe__uninstall__STORAGE___use_wildcard___r_nstart_C:ProgramDataMicrosoftWindowsDevManView.exe__uninstall__WAN_Miniport___use_wildcard___r_ncls_r_n
lea rcx, [rbp - 0x69]
call fcn.140005850
nop
mov rdx, qword [rbp - 0x51]
cmp rdx, 7
jbe 0x140005d1a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005d15
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005d15
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008eb8
lea rdx, [0x14000c240]
lea rcx, [rbp - 0x69]
call fcn.140006cb0
nop
mov r8d, 0x841
lea rdx, str._echo_off_r_ncolor_0a_r_ntitle______r_necho_______________________________________________________________________________r_necho_____________________________________________________________________________r_necho____________________________________________________________________________r_necho__________________________________________________________________________r_necho_________________________________________________________________________r_necho_________________________________________________________________________r_necho________________________________________________________________________r_necho_________________________________________________________________________r_necho______________________________________________________________________________r_necho______________________________________________________________________________r_necho______________________________________________________________________________r_necho_______________________________________________________________________________r_necho_____________________________________________________________________________r_necho____________________________________________________________________________r_necho_____________________________________________________________________________r_necho_____________________________________________________________________r_necho_______________________________________________________________________r_necho______________________________________________________________________r_necho___________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________r_necho_Baseboard_r_nwmic_baseboard_get_serialnumber_r_necho_Bios_r_nwmic_bios_get_serialnumber_r_necho_CPU_r_nwmic_cpu_get_serialnumber_r_necho_Diskdrive_r_nwmic_diskdrive_get_serialnumber_r_necho_Baseboard_r_nwmic_baseboard_get_manufacturer_r_necho_Mac_Address_r_ngetmac_r_n_r_necho_Done_checking____Press_any_key_to_close__r_npause
lea rcx, [rbp - 0x69]
call fcn.140005850
nop
mov rdx, qword [rbp - 0x51]
cmp rdx, 7
jbe 0x140005d85
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005d80
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005d80
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008eb8
lea rdx, str._n_Starting_Driverless_Spoofing_Process_DEBUG:_1__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400075e0
call fcn.1400087dc
lea rcx, [0x14000c2d8]
mov qword [rbp - 0x19], rcx
mov qword [rbp - 0x11], 0x2d
lea r8, [rbp - 0x19]
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.1400018c0
nop
lea rcx, [rsp + 0x30]
cmp qword [rbp - 0x71], 7
cmova rcx, qword [rsp + 0x30]
mov r9d, 0xffffffff
mov r8d, 3
lea rdx, [rbp + 7]
call fcn.140008918
mov edx, eax
test eax, eax
jne 0x140005e36
mov eax, dword [rbp + 0x17]
test al, 1
mov ecx, 0x1ff
mov r8d, 0x16d
cmovne ecx, r8d
mov dword [rbp - 0x15], ecx
bt eax, 0xa
jae 0x140005e28
mov ecx, dword [rbp + 0x1b]
cmp ecx, 0xa000000c
jne 0x140005e19
lea eax, [rdx + 4]
jmp 0x140005e59
cmp ecx, 0xa0000003
jne 0x140005e28
mov eax, 0xa
jmp 0x140005e59
movzx eax, al
and eax, 0x10
or eax, 0x20
shr eax, 4
jmp 0x140005e59
mov dword [rbp - 0x15], 0xffff
sub eax, 2
je 0x140005e54
sub eax, 1
je 0x140005e54
sub eax, 0x32
je 0x140005e54
cmp eax, 0x46
mov eax, r12d
jne 0x140005e59
mov eax, 1
mov dword [rbp - 0x19], edx
lea rcx, [0x1400e2c80]
mov qword [rbp - 0x11], rcx
movaps xmm0, xmmword [rbp - 0x19]
movdqa xmmword [rbp - 0x19], xmm0
test eax, eax
je 0x140005eb9
cmp eax, 1
setne bl
mov rdx, qword [rbp - 0x71]
cmp rdx, 7
jbe 0x140005eca
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005ec5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005ec5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
xor bl, bl
test edx, edx
jne 0x140006c9e
jmp 0x140005e7a
call fcn.140008eb8
lea r13, [0x14000b6fb]
lea r15, str.C:ProgramDataMicrosoftWindowsVolumeid64.exe_c:
test bl, bl
je 0x1400065be
lea rdx, str._n__If_A_Window_Called_VolumeId_Pop_Ups_Press_Agree_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400075e0
lea rcx, [rbp - 0x41]
call fcn.140002350
mov r14, rax
lea rcx, [rbp - 0x69]
call fcn.140002350
mov rdi, rax
mov r8, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rcx, rdx
sub rcx, r8
cmp rcx, 0x33
jb 0x140005f90
lea rax, [r8 + 0x33]
mov qword [rdi + 0x10], rax
mov rbx, rdi
cmp rdx, 0xf
jbe 0x140005f33
mov rbx, qword [rdi]
cmp r13, rbx
jbe 0x140005f53
lea rax, [rbx + r8]
cmp r15, rax
ja 0x140005f53
cmp rbx, r15
ja 0x140005f4b
mov rsi, r12
jmp 0x140005f58
mov rsi, rbx
sub rsi, r15
jmp 0x140005f58
mov esi, 0x33
lea rcx, [rbx + 0x33]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r15
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rsi]
mov r8d, 0x33
sub r8, rsi
lea rdx, [r15 + 0x33]
add rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140005fae
mov qword [rsp + 0x28], 0x33
mov qword [rsp + 0x20], r15
mov edx, 0x33
mov rcx, rdi
call fcn.140008280
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x19], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp - 9], xmm1
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov r8d, 1
lea rdx, [0x14000b650]
lea rcx, [rbp - 0x19]
call fcn.140007000
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x79], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r9, r14
lea r8, [rsp + 0x30]
lea rcx, [rbp + 7]
call fcn.140008090
nop
lea rcx, [rbp + 7]
call fcn.140002860
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x14000606b
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006065
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006065
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008eb8
nop
mov rdx, qword [rbp - 0x71]
cmp rdx, 0xf
jbe 0x1400060ab
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400060a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400060a5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008eb8
nop
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x1400060e9
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400060e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400060e4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008eb8
movdqa xmm0, xmmword [0x14000c7c0]
movdqu xmmword [rbp - 9], xmm0
mov byte [rbp - 0x19], 0
mov rdx, qword [rbp - 0x51]
cmp rdx, 0xf
jbe 0x140006138
inc rdx
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006133
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006133
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008eb8
movdqa xmm0, xmmword [0x14000c7c0]
movdqu xmmword [rbp - 0x59], xmm0
mov byte [rbp - 0x69], 0
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x140006187
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006182
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006182
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008eb8
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x79], xmm1
mov r8d, 0x31
lea rdx, str.del_C:ProgramDataMicrosoftWindowsSPOOFED2.bat
lea rcx, [rsp + 0x30]
call fcn.140007900
nop
lea rcx, [rsp + 0x30]
call fcn.140002860
nop
mov rdx, qword [rbp - 0x71]
cmp rdx, 0xf
jbe 0x1400061f6
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400061f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c45
call fcn.140008eb8
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x79], xmm1
mov r8d, 0x29
lea rdx, str.C:ProgramDataMicrosoftWindowsDisk.bat
lea rcx, [rsp + 0x30]
call fcn.140007900
nop
lea rcx, [rsp + 0x30]
call fcn.140002860
nop
mov rdx, qword [rbp - 0x71]
cmp rdx, 0xf
jbe 0x140006265
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006260
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c45
call fcn.140008eb8
lea rdx, str._n_Starting_Driverless_Spoofing_Process_DEBUG:_2__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400075e0
call fcn.140004b90
lea rdx, str._n_Starting_Driverless_Spoofing_Process_DEBUG:_3__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400075e0
call fcn.140002aa0
lea rdx, str._n_Starting_Driverless_Spoofing_Process_DEBUG:_4__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400075e0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x79], xmm1
mov r8d, 0x33
lea rdx, str.del_C:ProgramDataMicrosoftWindowsDevManView.cfg
lea rcx, [rsp + 0x30]
call fcn.140007900
nop
lea rcx, [rsp + 0x30]
call fcn.140002860
nop
mov rdx, qword [rbp - 0x71]
cmp rdx, 0xf
jbe 0x140006317
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006312
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c45
call fcn.140008eb8
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x79], xmm1
mov r8d, 0x33
lea rdx, str.del_C:ProgramDataMicrosoftWindowsDevManView.chm
lea rcx, [rsp + 0x30]
call fcn.140007900
nop
lea rcx, [rsp + 0x30]
call fcn.140002860
nop
mov rdx, qword [rbp - 0x71]
cmp rdx, 0xf
jbe 0x140006386
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006381
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c45
call fcn.140008eb8
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x79], xmm1
mov r8d, 0x33
lea rdx, str.del_C:ProgramDataMicrosoftWindowsDevManView.exe
lea rcx, [rsp + 0x30]
call fcn.140007900
nop
lea rcx, [rsp + 0x30]
call fcn.140002860
nop
mov rdx, qword [rbp - 0x71]
cmp rdx, 0xf
jbe 0x1400063f5
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400063f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c45
call fcn.140008eb8
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x79], xmm1
mov r8d, 0x2e
lea rdx, str.del_C:ProgramDataMicrosoftWindows_amide.sys
lea rcx, [rsp + 0x30]
call fcn.140007900
nop
lea rcx, [rsp + 0x30]
call fcn.140002860
nop
mov rdx, qword [rbp - 0x71]
cmp rdx, 0xf
jbe 0x140006464
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000645f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c45
call fcn.140008eb8
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x79], xmm1
mov r8d, 0x33
lea rdx, str.del_C:ProgramDataMicrosoftWindows_amifldrv64.sys
lea rcx, [rsp + 0x30]
call fcn.140007900
nop
lea rcx, [rsp + 0x30]
call fcn.140002860
nop
mov rdx, qword [rbp - 0x71]
cmp rdx, 0xf
jbe 0x1400064d3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400064ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c45
call fcn.140008eb8
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x79], xmm1
mov r8d, 0x34
lea rdx, str.del_C:ProgramDataMicrosoftWindowsAMIDEWINx64.exe
lea rcx, [rsp + 0x30]
call fcn.140007900
nop
lea rcx, [rsp + 0x30]
call fcn.140002860
nop
mov rdx, qword [rbp - 0x71]
cmp rdx, 0xf
jbe 0x140006542
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000653d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c45
call fcn.140008eb8
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x79], xmm1
mov r8d, 0x2d
lea rdx, str.del_C:ProgramDataMicrosoftWindowsDisk.bat
lea rcx, [rsp + 0x30]
call fcn.140007900
nop
lea rcx, [rsp + 0x30]
call fcn.140002860
nop
mov rdx, qword [rbp - 0x71]
cmp rdx, 0xf
jbe 0x1400065b1
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400065ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c45
call fcn.140008eb8
lea rcx, str.C:ProgramDataMicrosoftWindowsSerialC.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._n_Starting_Driverless_Spoofing_Process_DEBUG:_5__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400075e0
lea rdx, str.C:ProgramDataMicrosoftWindowsSPOOFED2.bat
lea rcx, [rbp + 7]
call fcn.140006cb0
nop
mov r8d, 0x841
lea rdx, str._echo_off_r_ncolor_0a_r_ntitle______r_necho_______________________________________________________________________________r_necho_____________________________________________________________________________r_necho____________________________________________________________________________r_necho__________________________________________________________________________r_necho_________________________________________________________________________r_necho_________________________________________________________________________r_necho________________________________________________________________________r_necho_________________________________________________________________________r_necho______________________________________________________________________________r_necho______________________________________________________________________________r_necho______________________________________________________________________________r_necho_______________________________________________________________________________r_necho_____________________________________________________________________________r_necho____________________________________________________________________________r_necho_____________________________________________________________________________r_necho_____________________________________________________________________r_necho_______________________________________________________________________r_necho______________________________________________________________________r_necho___________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________r_necho_Baseboard_r_nwmic_baseboard_get_serialnumber_r_necho_Bios_r_nwmic_bios_get_serialnumber_r_necho_CPU_r_nwmic_cpu_get_serialnumber_r_necho_Diskdrive_r_nwmic_diskdrive_get_serialnumber_r_necho_Baseboard_r_nwmic_baseboard_get_manufacturer_r_necho_Mac_Address_r_ngetmac_r_n_r_necho_Done_checking____Press_any_key_to_close__r_npause
lea rcx, [rbp + 7]
call fcn.140005850
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 7
jbe 0x14000663c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006637
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006637
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008eb8
lea rcx, [rbp - 0x41]
call fcn.140002350
mov r14, rax
lea rcx, [rsp + 0x30]
call fcn.140002350
mov rbx, rax
mov r8, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rcx, rdx
sub rcx, r8
cmp rcx, 0x33
jb 0x1400066da
lea rax, [r8 + 0x33]
mov qword [rbx + 0x10], rax
mov rdi, rbx
cmp rdx, 0xf
jbe 0x14000667d
mov rdi, qword [rbx]
cmp r13, rdi
jbe 0x14000669d
lea rax, [rdi + r8]
cmp r15, rax
ja 0x14000669d
cmp rdi, r15
ja 0x140006695
mov rsi, r12
jmp 0x1400066a2
mov rsi, rdi
sub rsi, r15
jmp 0x1400066a2
mov esi, 0x33
lea rcx, [rdi + 0x33]
inc r8
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rdi + rsi]
mov r8d, 0x33
sub r8, rsi
lea rdx, [r15 + 0x33]
add rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1400066f8
mov qword [rsp + 0x28], 0x33
mov qword [rsp + 0x20], r15
mov edx, 0x33
mov rcx, rbx
call fcn.140008280
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x19], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 9], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov r8d, 1
lea rdx, [0x14000b650]
lea rcx, [rbp - 0x19]
call fcn.140007000
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x69], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x59], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r9, r14
lea r8, [rbp - 0x69]
lea rcx, [rbp + 7]
call fcn.140008090
nop
lea rcx, [rbp + 7]
call fcn.140002860
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x1400067b3
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400067ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400067ad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008eb8
nop
mov rdx, qword [rbp - 0x51]
cmp rdx, 0xf
jbe 0x1400067f2
inc rdx
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400067ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400067ec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008eb8
nop
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x140006830
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000682b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000682b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008eb8
movdqa xmm0, xmmword [0x14000c7c0]
movdqu xmmword [rbp - 9], xmm0
mov byte [rbp - 0x19], 0
mov rdx, qword [rbp - 0x71]
cmp rdx, 0xf
jbe 0x140006880
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000687b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000687b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008eb8
movdqa xmm0, xmmword [0x14000c7c0]
movdqu xmmword [rbp - 0x79], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x1400068d0
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400068cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400068cb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008eb8
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x79], xmm1
mov r8d, 0x29
lea rdx, str.C:ProgramDataMicrosoftWindowsDisk.bat
lea rcx, [rsp + 0x30]
call fcn.140007900
nop
lea rcx, [rsp + 0x30]
call fcn.140002860
nop
mov rdx, qword [rbp - 0x71]
cmp rdx, 0xf
jbe 0x14000693f
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000693a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c45
call fcn.140008eb8
call fcn.140004b90
call fcn.140002aa0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x79], xmm1
mov r8d, 0x33
lea rdx, str.del_C:ProgramDataMicrosoftWindowsDevManView.cfg
lea rcx, [rsp + 0x30]
call fcn.140007900
nop
lea rcx, [rsp + 0x30]
call fcn.140002860
nop
mov rdx, qword [rbp - 0x71]
cmp rdx, 0xf
jbe 0x1400069b8
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400069b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c45
call fcn.140008eb8
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x79], xmm1
mov r8d, 0x33
lea rdx, str.del_C:ProgramDataMicrosoftWindowsDevManView.chm
lea rcx, [rsp + 0x30]
call fcn.140007900
nop
lea rcx, [rsp + 0x30]
call fcn.140002860
nop
mov rdx, qword [rbp - 0x71]
cmp rdx, 0xf
jbe 0x140006a27
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006a22
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c45
call fcn.140008eb8
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x79], xmm1
mov r8d, 0x33
lea rdx, str.del_C:ProgramDataMicrosoftWindowsDevManView.exe
lea rcx, [rsp + 0x30]
call fcn.140007900
nop
lea rcx, [rsp + 0x30]
call fcn.140002860
nop
mov rdx, qword [rbp - 0x71]
cmp rdx, 0xf
jbe 0x140006a96
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006a91
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c45
call fcn.140008eb8
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x79], xmm1
mov r8d, 0x2e
lea rdx, str.del_C:ProgramDataMicrosoftWindows_amide.sys
lea rcx, [rsp + 0x30]
call fcn.140007900
nop
lea rcx, [rsp + 0x30]
call fcn.140002860
nop
mov rdx, qword [rbp - 0x71]
cmp rdx, 0xf
jbe 0x140006b05
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006b00
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c45
call fcn.140008eb8
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x79], xmm1
mov r8d, 0x33
lea rdx, str.del_C:ProgramDataMicrosoftWindows_amifldrv64.sys
lea rcx, [rsp + 0x30]
call fcn.140007900
nop
lea rcx, [rsp + 0x30]
call fcn.140002860
nop
mov rdx, qword [rbp - 0x71]
cmp rdx, 0xf
jbe 0x140006b74
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006b6f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c45
call fcn.140008eb8
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x79], xmm1
mov r8d, 0x34
lea rdx, str.del_C:ProgramDataMicrosoftWindowsAMIDEWINx64.exe
lea rcx, [rsp + 0x30]
call fcn.140007900
nop
lea rcx, [rsp + 0x30]
call fcn.140002860
nop
mov rdx, qword [rbp - 0x71]
cmp rdx, 0xf
jbe 0x140006bdf
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006bda
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c45
call fcn.140008eb8
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x79], xmm1
mov r8d, 0x2d
lea rdx, str.del_C:ProgramDataMicrosoftWindowsDisk.bat
lea rcx, [rsp + 0x30]
call fcn.140007900
nop
lea rcx, [rsp + 0x30]
call fcn.140002860
nop
mov rdx, qword [rbp - 0x71]
cmp rdx, 0xf
jbe 0x140006c51
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006c4c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006c4c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008eb8
lea rdx, str._n_Starting_Driverless_Spoofing_Process_DEBUG:_6__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400075e0
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140008cb0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea r8, [rsp + 0x30]
lea rdx, [rbp - 0x19]
call fcn.1400022f0
int3