Function at 0x140011613
Capabilities:
Delete file
Execute command

Disassembly:
jmp 0x14001be10
push rbp
push rdi
sub rsp, 0x248
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x56
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14003e040]
xor rax, rbp
mov qword [rbp + 0x208], rax
lea rcx, [0x1400460fd]
call fcn.140011c08
lea rax, str._n_________echo_off_n____________________________setlocal_EnableDelayedExpansion_n_____________________________n____________________________powershell__command__Get_MpPreference__Select_Object__ExpandProperty_DisableRealtimeMonitoring____temp.txt_n____________________________findstr__i__FALSE__temp.txt___nul___set_DefenderOn____set_DefenderOff__n____________________________del_temp.txt_n_____________________________n____________________________powershell__command__if___Get_Tpm_.TpmPresent__eq__false___Off__else__On_____temp.txt_n____________________________findstr__i__Off__temp.txt___nul___set_TPMOff____set_TPMOn__n____________________________del_temp.txt_n_____________________________n____________________________powershell__command__if___Confirm_SecureBootUEFI___eq__false___Off__else__Onn_____temp.txt_n____________________________findstr__i__Off__temp.txt___nul___set_SecureBootOff____set_SecureBootOnn__n____________________________del_temp.txt_n_____________________________n____________________________powershell__command__if___Get_ItemProperty_HKLM:SystemCurrentControlSetControl__Name_PEFirmwareType_.PEFirmwareType__eq_2___Legacy__else__UEFI_____temp.txt_n____________________________findstr__i__UEFI__temp.txt___nul___set_BIOSUEFI____set_BIOSLegacy__n____________________________del_temp.txt_n_____________________________n____________________________powershell__command__if___Get_CimInstance__ClassName_Win32_DeviceGuard__Namespace_rootMicrosoftWindowsDeviceGuard_.VirtualizationBasedSecurityStatus__eq_1___On__else__Off_____temp.txt_n____________________________findstr__i__Off__temp.txt___nul___set_VBSOff____set_VBSOn__n____________________________del_temp.txt_n_____________________________n____________________________powershell__command__if___Get_MpPreference_.AttackSurfaceReductionRulesAction__eq_NotConfigured___Off__else__On_____temp.txt_n____________________________findstr__i__Off__temp.txt___nul___set_ExploitProtectionOff____set_ExploitProtectionOn__n____________________________del_temp.txt_n_____________________________n____________________________::_Checking_Visual_C_Redistributable_n____________________________powershell__command__if__Test_Path_HKLM:SOFTWAREMicrosoftDevDivVCServicing14.0RuntimeMinimum___On__else__Off_____temp.txt_n____________________________findstr__i__Off__temp.txt___nul___set_VisualCppOff____set_VisualCppOn__n____________________________del_temp.txt_n_____________________________n____________________________::_Checking_UAC__User_Account_Control__n____________________________powershell__command__if___Get_ItemProperty_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem__Name_EnableLUA_.EnableLUA__eq_0___Off__else__On_____temp.txt_n____________________________findstr__i__Off__temp.txt___nul___set_UACOff____set_UACOn__n____________________________del_temp.txt_n_____________________________n____________________________::_Checking_Fast_Boot_n____________________________powershell__command__if___Get_ItemProperty_HKLM:SYSTEMCurrentControlSetControlSession_ManagerPower__Name_HiberbootEnabled_.HiberbootEnabled__eq_0___Off__else__On_____temp.txt_n____________________________findstr__i__Off__temp.txt___nul___set_FastBootOff____set_FastBootOn__n____________________________del_temp.txt_n_____________________________n____________________________::_Checking_Riva_Tuner_n____________________________if_exist__C:Program_Files__x86_RivaTuner_Statistics_ServerRTSS.exe___set_RivaTunerInstalled__else_if_exist__D:Program_Files__x86_RivaTuner_Statistics_ServerRTSS.exe___set_RivaTunerInstalled__else__set_RivaTunerNot_installed__n_____________________________n____________________________echo_Checking_your_PC_for_requirements__this_may_take_up_to_30_seconds.__n____________________________dxdiag__t_temp.txt_n____________________________timeout__t_10__nul_n_____________________________n____________________________for__f
mov qword [rbp + 8], rax
mov edx, 0x108
lea rcx, [rbp + 0x30]
call fcn.1400114d8
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, str.temp_script.bat
lea rcx, [rbp + 0x30]
call fcn.1400114b5
nop
lea rcx, [rbp + 0x30]
call fcn.14001187a
movzx eax, al
test eax, eax
je 0x14001becd
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x30]
call fcn.140011177
lea rcx, [rbp + 0x30]
call fcn.140011659
lea rcx, str.temp_script.bat
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.temp_script.bat
call qword [sym.imp.ucrtbased.dll_remove]
jmp 0x14001beea
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Failed_to_create_the_batch_script_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
lea rcx, [rbp + 0x30]
call fcn.14001130c
lea rcx, [rbp - 0x30]
lea rdx, [0x14002f830]
call fcn.140011a1e
mov rcx, qword [rbp + 0x208]
xor rcx, rbp
call fcn.1400115f5
lea rsp, [rbp + 0x218]
pop rdi
pop rbp
ret