Function at 0x1400112c6
Capabilities:
Execute command
Log keystrokes via polling
Terminate process

Disassembly:
jmp 0x140012050
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x22
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001e040]
xor rax, rbp
mov qword [rbp + 0x138], rax
lea rcx, [0x1400240fc]
call fcn.1400113e8
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbp + 8], rax
mov dx, 9
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call fcn.1400112b7
test eax, eax
jne 0x1400120d7
lea rcx, str.e_1me_31m_n_INFO_Program_must_be_run_as_Administrator_to_manage_firewall_rules__n_ne_0m
call fcn.1400111db
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
lea rcx, [fcn.14001141a]
call fcn.14001118b
lea rcx, str._nGreetings
call fcn.1400111db
lea rcx, str.whoami
call qword [sym.imp.ucrtbased.dll_system]
call fcn.140011050
lea rcx, str._n_ne_0m
call fcn.1400111db
mov dx, 0xb
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.Scanning_for_open_Policies:_n
call fcn.1400111db
call fcn.14001123f
call fcn.1400110f5
lea rcx, str.e_1me_33mIf_Policy_is_found_use_powershell_Remove_NetQosPolicy__PolicyStore_ActiveStore_in_Windows_Powershell_with_Administrator_OR_do_a_Lag_run_for_resetting_ne_0m
call fcn.1400111db
call fcn.1400112bc
lea rcx, str.e_1me_35m_n_n_ATTENTION_Input_PRE_Lag_in_milliseconds_e.g._200_ne_0m
call fcn.1400111db
mov dword [rbp + 0x24], 0xc8
lea rdx, [rbp + 0x24]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___unsigned_int____ptr64____ptr64]
cmp dword [rbp + 0x24], 0
ja 0x140012178
mov dword [rbp + 0x134], 0xc8
jmp 0x140012181
mov eax, dword [rbp + 0x24]
mov dword [rbp + 0x134], eax
mov eax, dword [rbp + 0x134]
mov dword [rbp + 0x24], eax
lea rcx, str.e_1me_35m_ATTENTION_Input_REAL_Lag_in_milliseconds_e.g._1900_ne_0m
call fcn.1400111db
mov dword [rbp + 0x44], 0x76c
lea rdx, [rbp + 0x44]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___unsigned_int____ptr64____ptr64]
cmp dword [rbp + 0x44], 0
ja 0x1400121c0
mov dword [rbp + 0x134], 0x76c
jmp 0x1400121c9
mov eax, dword [rbp + 0x44]
mov dword [rbp + 0x134], eax
mov eax, dword [rbp + 0x134]
mov dword [rbp + 0x44], eax
mov edx, dword [rbp + 0x44]
mov ecx, dword [rbp + 0x24]
call fcn.14001108c
mov byte [rbp + 0x64], 0
lea rcx, str.e_1me_35m_n_ATTENTION_Press_F2_for_LagSwitch_..._n_ne_0m
call fcn.1400111db
xor eax, eax
cmp eax, 1
je 0x140012281
mov ecx, 0x71
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x140012271
movzx eax, byte [rbp + 0x64]
test eax, eax
jne 0x140012271
mov byte [rbp + 0x64], 1
call fcn.140011168
mov ecx, dword [rbp + 0x24]
call fcn.14001132a
mov ecx, dword [rbp + 0x24]
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140011140
mov ecx, 0x3a98
call fcn.140011145
call fcn.1400113ac
mov ecx, dword [rbp + 0x44]
call fcn.1400110a0
mov ecx, dword [rbp + 0x44]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov cl, 1
call fcn.140011073
mov edx, dword [rbp + 0x44]
mov ecx, dword [rbp + 0x24]
call fcn.14001108c
lea rcx, str.e_1me_35m_n_n_ATTENTION_Press_CTRL__D_for_LagSwitch_..._n_ne_0m
call fcn.1400111db
mov byte [rbp + 0x64], 0
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400121ed
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001adf0]
call fcn.140011375
mov rax, rdi
mov rcx, qword [rbp + 0x138]
xor rcx, rbp
call fcn.1400111f4
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret