Function at 0x1400053a0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create reverse shell
Create two anonymous pipes
Delete file
Execute command
Get common file path
Read file on windows
Self delete
Write and execute a file
Write file on windows
Write pipe

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x12c0]
mov eax, 0x13c0
call fcn.14011c710
sub rsp, rax
mov rax, qword [0x14019d080]
xor rax, rsp
mov qword [rbp + 0x12b0], rax
mov rbx, rdx
mov rsi, rcx
mov rax, qword [rcx]
mov rdi, qword [rcx + 8]
cmp rax, rdi
je 0x140006856
sub rdi, rax
mov r14d, edi
mov r9d, 4
mov r8d, 0x1000
mov edx, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140006856
mov r8d, r14d
mov rdx, qword [rsi]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea r9, [rbp + 0x88]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov edx, r14d
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140006856
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], rax
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], rax
lea rdx, [rbp + 0x1a0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r9, [rbp + 0x90]
xor r8d, r8d
lea rdx, [0x14014b638]
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
xor r12d, r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140006845
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x84]
mov r8d, edi
mov rdx, qword [rsi]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp - 0x48], Ordinal_26
mov dword [rbp - 0x38], 1
xor esi, esi
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x60], rsi
xor r9d, r9d
lea r8, [rbp - 0x48]
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x140006825
xor r9d, r9d
lea r8, [rbp - 0x48]
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x140006825
xor r8d, r8d
lea edx, [rsi + 1]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor r8d, r8d
lea edx, [rsi + 1]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov dword [rbp - 0x30], 0x68
mov dword [rbp + 0xc], 0x101
mov rax, qword [rbp - 0x50]
mov qword [rbp + 0x20], rax
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x28], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbp + 0x30], rax
mov word [rbp + 0x10], si
lea rax, [rbp - 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140006845
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14000560e
mov rbx, qword [rbx]
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x84]
mov rdx, rbx
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], rsi
mov qword [rbp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x60], sil
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x80]
mov r8d, 0x1000
lea rdx, [rbp + 0x2b0]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140005cd9
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rbp + 0x80]
test eax, eax
je 0x140005cd4
cmp rax, 0x1000
jae 0x140006882
mov byte [rbp + rax + 0x2b0], 0
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp + 0x60]
call fcn.14000bda0
lea rdi, [rbp + 0x60]
mov r13, qword [rbp + 0x78]
cmp r13, 0xf
seta r14b
mov r12, qword [rbp + 0x60]
cmova rdi, r12
mov r15, qword [rbp + 0x70]
cmp r15, 6
jb 0x14000575f
lea rbx, [r15 + rdi]
lea r8, [rbx - 5]
sub r8, rdi
mov edx, 0x46
mov rcx, rdi
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
je 0x14000575f
nop dword [rax + rax]
mov rdx, rsi
lea rax, str.Found.
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
inc rdx
cmp cl, byte [rax + rdx - 1]
jne 0x140005728
cmp rdx, 6
jne 0x140005710
mov eax, esi
jmp 0x14000572d
sbb eax, eax
or eax, 1
test eax, eax
je 0x140005752
inc r9
lea r8, [rbx - 5]
sub r8, r9
mov edx, 0x46
mov rcx, r9
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
jne 0x140005700
jmp 0x14000575f
sub r9, rdi
cmp r9, 0xffffffffffffffff
jne 0x140005db5
lea rdi, [rbp + 0x60]
test r14b, r14b
cmovne rdi, r12
cmp r15, 0xc
jb 0x1400057d9
lea rsi, [r15 + rdi]
lea r8, [rsi - 0xb]
sub r8, rdi
mov edx, 0x53
mov rcx, rdi
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x1400057d7
mov r8d, recv
lea rdx, str.Successfully
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400057ca
inc rbx
lea r8, [rsi - 0xb]
sub r8, rbx
mov edx, 0x53
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140005790
jmp 0x1400057d7
sub rbx, rdi
cmp rbx, 0xffffffffffffffff
jne 0x140005f20
xor esi, esi
lea rbx, [rbp + 0x60]
test r14b, r14b
cmovne rbx, r12
cmp r15, 4
jb 0x14000586f
lea rdi, [r15 + rbx]
lea r8, [rdi - 3]
sub r8, rbx
mov edx, reloc.WS2_32.dll_WSAStartup
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
je 0x14000586f
nop
mov rdx, rsi
lea rax, str.sync
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
inc rdx
cmp cl, byte [rax + rdx - 1]
jne 0x140005838
cmp rdx, 4
jne 0x140005820
mov eax, esi
jmp 0x14000583d
sbb eax, eax
or eax, 1
test eax, eax
je 0x140005862
inc r9
lea r8, [rdi - 3]
sub r8, r9
mov edx, reloc.WS2_32.dll_WSAStartup
mov rcx, r9
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
jne 0x140005810
jmp 0x14000586f
sub r9, rbx
cmp r9, 0xffffffffffffffff
jne 0x140006015
lea rbx, [rbp + 0x60]
test r14b, r14b
cmovne rbx, r12
cmp r15, 4
jb 0x1400058ff
lea rdi, [r15 + rbx]
lea r8, [rdi - 3]
sub r8, rbx
mov edx, 0x48
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
je 0x1400058ff
mov rdx, rsi
lea rax, str.HWID
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
inc rdx
cmp cl, byte [rax + rdx - 1]
jne 0x1400058c8
cmp rdx, 4
jne 0x1400058b0
mov eax, esi
jmp 0x1400058cd
sbb eax, eax
or eax, 1
test eax, eax
je 0x1400058f2
inc r9
lea r8, [rdi - 3]
sub r8, r9
mov edx, 0x48
mov rcx, r9
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
jne 0x1400058a0
jmp 0x1400058ff
sub r9, rbx
cmp r9, 0xffffffffffffffff
jne 0x1400060e3
lea rbx, [rbp + 0x60]
cmp r13, 0xf
cmova rbx, r12
cmp r15, 6
jb 0x14000598f
lea rdi, [r15 + rbx]
lea r8, [rdi - 5]
sub r8, rbx
mov edx, 0x62
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
je 0x14000598f
mov rdx, rsi
lea rax, str.banned
nop dword [rax + rax]
movzx ecx, byte [r9 + rdx]
inc rdx
cmp cl, byte [rax + rdx - 1]
jne 0x140005958
cmp rdx, 6
jne 0x140005940
mov eax, esi
jmp 0x14000595d
sbb eax, eax
or eax, 1
test eax, eax
je 0x140005982
inc r9
lea r8, [rdi - 5]
sub r8, r9
mov edx, 0x62
mov rcx, r9
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
jne 0x140005931
jmp 0x14000598f
sub r9, rbx
cmp r9, 0xffffffffffffffff
jne 0x1400061c9
lea rbx, [rbp + 0x60]
cmp r13, 0xf
cmova rbx, r12
cmp r15, 6
jb 0x140005a1f
lea rdi, [r15 + rbx]
lea r8, [rdi - 5]
sub r8, rbx
mov edx, 0x68
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
je 0x140005a1f
mov rdx, rsi
lea rax, str.hyperV
nop dword [rax + rax]
movzx ecx, byte [r9 + rdx]
inc rdx
cmp cl, byte [rax + rdx - 1]
jne 0x1400059e8
cmp rdx, 6
jne 0x1400059d0
mov eax, esi
jmp 0x1400059ed
sbb eax, eax
or eax, 1
test eax, eax
je 0x140005a12
inc r9
lea r8, [rdi - 5]
sub r8, r9
mov edx, 0x68
mov rcx, r9
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
jne 0x1400059c1
jmp 0x140005a1f
sub r9, rbx
cmp r9, 0xffffffffffffffff
jne 0x1400062b4
lea rdi, [rbp + 0x60]
cmp r13, 0xf
cmova rdi, r12
cmp r15, 8
jb 0x140005aa7
lea rsi, [r15 + rdi]
lea r8, [rsi - 7]
sub r8, rdi
mov edx, 0x63
mov rcx, rdi
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x140005aa7
nop dword [rax]
nop word [rax + rax]
mov r8d, 8
lea rdx, str.c035001e
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140005a9a
inc rbx
lea r8, [rsi - 7]
sub r8, rbx
mov edx, 0x63
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140005a60
jmp 0x140005aa7
sub rbx, rdi
cmp rbx, 0xffffffffffffffff
jne 0x14000639a
lea rdi, [rbp + 0x60]
cmp r13, 0xf
cmova rdi, r12
cmp r15, 0x11
jb 0x140005b27
lea rsi, [r15 + rdi]
lea r8, [rsi - 0x10]
sub r8, rdi
mov edx, 0x56
mov rcx, rdi
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x140005b27
nop dword [rax]
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.Vulnerable_Driver
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140005b1a
inc rbx
lea r8, [rsi - 0x10]
sub r8, rbx
mov edx, 0x56
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140005ae0
jmp 0x140005b27
sub rbx, rdi
cmp rbx, 0xffffffffffffffff
jne 0x140006483
lea rdi, [rbp + 0x60]
cmp r13, 0xf
cmova rdi, r12
cmp r15, 8
jb 0x140005ba7
lea rsi, [r15 + rdi]
lea r8, [rsi - 7]
sub r8, rdi
mov edx, 0x63
mov rcx, rdi
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x140005ba7
nop dword [rax]
mov r8d, 8
lea rdx, str.c0000041
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140005b9a
inc rbx
lea r8, [rsi - 7]
sub r8, rbx
mov edx, 0x63
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140005b60
jmp 0x140005ba7
sub rbx, rdi
cmp rbx, 0xffffffffffffffff
jne 0x140006573
lea rdi, [rbp + 0x60]
cmp r13, 0xf
cmova rdi, r12
cmp r15, 7
jb 0x140005c27
lea rsi, [r15 + rdi]
lea r8, [rsi - 6]
sub r8, rdi
mov edx, reloc.WS2_32.dll_WSAStartup
mov rcx, rdi
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x140005c27
nop dword [rax]
mov r8d, 7
lea rdx, str.support
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140005c1a
inc rbx
lea r8, [rsi - 6]
sub r8, rbx
mov edx, reloc.WS2_32.dll_WSAStartup
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140005be0
jmp 0x140005c27
sub rbx, rdi
cmp rbx, 0xffffffffffffffff
jne 0x140006663
lea rsi, [rbp + 0x60]
cmp r13, 0xf
cmova rsi, r12
cmp r15, 8
jb 0x140005ca7
lea rdi, [r15 + rsi]
lea r8, [rdi - 7]
sub r8, rsi
mov edx, 0x63
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x140005ca7
nop dword [rax]
mov r8d, 8
lea rdx, str.c0000138
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140005c9a
inc rbx
lea r8, [rdi - 7]
sub r8, rbx
mov edx, 0x63
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140005c60
jmp 0x140005ca7
sub rbx, rsi
cmp rbx, 0xffffffffffffffff
jne 0x1400066fd
xor esi, esi
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x80]
mov r8d, 0x1000
lea rdx, [rbp + 0x2b0]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140005680
mov r15, qword [rsp + 0x70]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 0xf
cmova rdx, qword [rbp + 0x60]
mov r9d, 0x40
lea r8, str.Process_Output
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call fcn.1400050e0
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 0xf
cmova rdx, qword [rbp + 0x60]
mov r9d, 0x40
lea r8, str.Process_Output
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x140005f16
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005f11
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005f11
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Error_
lea rdx, str.Key_not_found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Key_not_Found
lea rcx, [rbp + 0x40]
call fcn.14000d5a0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rsi
lea rax, [rbp + 0x2b0]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140005e20
lea rdx, [rbp + 0x2b0]
lea rcx, [rsp + 0x50]
call fcn.14000d5a0
lea rdx, [rsp + 0x50]
lea rcx, [0x1401f6bb0]
call fcn.1400c5700
call fcn.1400050e0
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x140005edb
inc rdx
mov rcx, qword [rbp + 0x40]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140005ed5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000681e
call fcn.14011c2b8
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x140005f16
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005f11
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005dae
call fcn.14011c2b8
mov eax, 1
jmp 0x140006858
mov r9d, 0x40
lea r8, str.Successfully
lea rdx, str.Successfully_loaded
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.Successfully_Spoofed
lea rcx, [rbp + 0x40]
call fcn.14000d5a0
nop
lea rcx, str.del_8H2E9Cp4__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xor r12d, r12d
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
lea rax, [rbp + 0x2b0]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r12b
jne 0x140005f92
lea rdx, [rbp + 0x2b0]
lea rcx, [rsp + 0x50]
call fcn.14000d5a0
lea rdx, [rsp + 0x50]
lea rcx, [0x1401f6bb0]
call fcn.1400c5700
call fcn.1400050e0
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
jmp 0x140005e9f
mov r9d, 0x40
lea r8, str.Failed
lea rdx, str.go_to_settings_and_sync_yout_time__restart_pc
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, str.del_8H2E9Cp4__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rsi
lea rax, [rbp + 0x2b0]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140006060
lea rdx, [rbp + 0x2b0]
lea rcx, [rsp + 0x50]
call fcn.14000d5a0
lea rdx, [rsp + 0x50]
lea rcx, [0x1401f6bb0]
call fcn.1400c5700
call fcn.1400050e0
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x140005edb
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Error_
lea rdx, str.HWID_Failed
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
mov r8d, recv
lea rdx, str.HWID_Failed_
lea rcx, [rbp + 0x40]
call fcn.14000d5a0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rsi
lea rax, [rbp + 0x2b0]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140006145
lea rdx, [rbp + 0x2b0]
lea rcx, [rsp + 0x50]
call fcn.14000d5a0
lea rdx, [rsp + 0x50]
lea rcx, [0x1401f6bb0]
call fcn.1400c5700
call fcn.1400050e0
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
jmp 0x140005e9f
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Error_
lea rdx, str.HWID_Failed
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
mov r8d, reloc.WS2_32.dll_select
lea rdx, str.The_User_is_Banned
lea rcx, [rbp + 0x40]
call fcn.14000d5a0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rsi
lea rax, [rbp + 0x2b0]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140006230
lea rdx, [rbp + 0x2b0]
lea rcx, [rsp + 0x50]
call fcn.14000d5a0
lea rdx, [rsp + 0x50]
lea rcx, [0x1401f6bb0]
call fcn.1400c5700
call fcn.1400050e0
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
jmp 0x140005e9f
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Error_
lea rdx, str.HWID_Failed
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.HyperV_Enabled_
lea rcx, [rbp + 0x40]
call fcn.14000d5a0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rsi
lea rax, [rbp + 0x2b0]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140006316
lea rdx, [rbp + 0x2b0]
lea rcx, [rsp + 0x50]
call fcn.14000d5a0
lea rdx, [rsp + 0x50]
lea rcx, [0x1401f6bb0]
call fcn.1400c5700
call fcn.1400050e0
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
jmp 0x140005e9f
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Error_
lea rdx, str.HWID_Failed
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.HyperV_Enabled_
lea rcx, [rbp + 0x40]
call fcn.14000d5a0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xor r12d, r12d
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
lea rax, [rbp + 0x2b0]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], r12b
jne 0x140006400
lea rdx, [rbp + 0x2b0]
lea rcx, [rsp + 0x50]
call fcn.14000d5a0
lea rdx, [rsp + 0x50]
lea rcx, [0x1401f6bb0]
call fcn.1400c5700
call fcn.1400050e0
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
jmp 0x140005e9f
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Error_
lea rdx, str.Vulnerable_Driver_Error
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.Vulnerable_Driver_Error
lea rcx, [rbp + 0x40]
call fcn.14000d5a0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xor r12d, r12d
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
lea rax, [rbp + 0x2b0]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r12b
jne 0x1400064f0
lea rdx, [rbp + 0x2b0]
lea rcx, [rsp + 0x50]
call fcn.14000d5a0
lea rdx, [rsp + 0x50]
lea rcx, [0x1401f6bb0]
call fcn.1400c5700
call fcn.1400050e0
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
jmp 0x140005e9f
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Error_
lea rdx, str.Disable_Vanguard_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.Error:_C0000041
lea rcx, [rbp + 0x40]
call fcn.14000d5a0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xor r12d, r12d
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
lea rax, [rbp + 0x2b0]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r12b
jne 0x1400065e0
lea rdx, [rbp + 0x2b0]
lea rcx, [rsp + 0x50]
call fcn.14000d5a0
lea rdx, [rsp + 0x50]
lea rcx, [0x1401f6bb0]
call fcn.1400c5700
call fcn.1400050e0
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
jmp 0x140005e9f
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Error_
lea rdx, str.Contac_Support_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_22
lea rdx, str.please_contact_support
lea rcx, [rbp + 0x40]
call fcn.14000d5a0
nop
call fcn.1400050e0
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
jmp 0x140005e9f
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Error_
lea rdx, str.Error:_C0000138
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.Error:_C0000138
lea rcx, [rbp + 0x40]
call fcn.14000d5a0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xor r12d, r12d
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
lea rax, [rbp + 0x2b0]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r12b
jne 0x140006762
lea rdx, [rbp + 0x2b0]
lea rcx, [rsp + 0x50]
call fcn.14000d5a0
lea rdx, [rsp + 0x50]
lea rcx, [0x1401f6bb0]
call fcn.1400c5700
call fcn.1400050e0
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x140005edb
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005ed5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005ed5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x140006856
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rbp + 0x12b0]
xor rcx, rsp
call fcn.14011bd80
mov rbx, qword [rsp + 0x1410]
add rsp, 0x13c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14011bea8
nop
int3