Function at 0x140062630
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
lea rcx, str.netsh_advfirewall_set_allprofiles_state_on
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_BlockAllInbound__dirin_actionblock_enableyes
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x190
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_BlockAllOutbound__dirout_actionblock_enableyes
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm6, xmmword [0x140169588]
lea rax, [rbp - 0x50]
mov qword [rbp + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xor ebx, ebx
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rbx
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400cd190
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x40], reloc.WS2_32.dll_select
mov qword [rbp - 0x38], Ordinal_32
movups xmm0, xmmword [str.Fake_Lag:_Enabled_]
movups xmmword [rax], xmm0
movzx ecx, word [0x1400efff0]
mov word [rax + 0x10], cx
mov byte [rax + 0x12], bl
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], 9
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.N_NJA_HEX]
movsd qword [rbp - 0x30], xmm0
movzx eax, byte [0x1400ef838]
mov byte [rbp - 0x28], al
mov byte [rbp - 0x27], bl
movdqa xmmword [rbp - 0x60], xmm6
lea r9, [rbp - 0x60]
lea r8, [rbp - 0x50]
lea rdx, [rbp - 0x30]
call fcn.140052010
xorps xmm0, xmm0
movss xmm1, dword [0x140104110]
ucomiss xmm1, xmm0
jp 0x140062804
jne 0x140062804
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
movups xmm6, xmmword [0x140169588]
lea rax, [rbp - 0x30]
mov qword [rbp + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rbx
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400cd190
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x20], reloc.WS2_32.dll_send
mov qword [rbp - 0x18], Ordinal_32
movups xmm0, xmmword [str.Fake_Lag:_Disabled_]
movups xmmword [rax], xmm0
movzx ecx, word [0x1400f0008]
mov word [rax + 0x10], cx
movzx ecx, byte [reloc.WLDAP32.dll_Ordinal_33]
mov byte [rax + 0x12], cl
mov byte [rax + 0x13], bl
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], 9
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.N_NJA_HEX]
movsd qword [rbp - 0x50], xmm0
movzx eax, byte [0x1400ef838]
mov byte [rbp - 0x48], al
mov byte [rbp - 0x47], bl
movdqa xmmword [rbp - 0x60], xmm6
lea r9, [rbp - 0x60]
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x50]
call fcn.140052010
lea rcx, str.netsh_advfirewall_firewall_delete_rule_name_BlockAllInbound_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_firewall_delete_rule_name_BlockAllOutbound_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movss xmm1, dword [0x140104110]
ucomiss xmm1, dword [0x1400f09fc]
jp 0x1400628f8
jne 0x1400628f8
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.netsh_advfirewall_firewall_delete_rule_name_BlockAllInbound_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_firewall_delete_rule_name_BlockAllOutbound_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
movups xmm6, xmmword [0x140169588]
lea rax, [rbp - 0x30]
mov qword [rbp + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rbx
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400cd190
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x20], reloc.WS2_32.dll_send
mov qword [rbp - 0x18], Ordinal_32
movups xmm0, xmmword [str.Fake_Lag:_Disabled_]
movups xmmword [rax], xmm0
movzx ecx, word [0x1400f0008]
mov word [rax + 0x10], cx
movzx ecx, byte [reloc.WLDAP32.dll_Ordinal_33]
mov byte [rax + 0x12], cl
mov byte [rax + 0x13], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], 9
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.N_NJA_HEX]
movsd qword [rbp - 0x50], xmm0
movzx eax, byte [0x1400ef838]
mov byte [rbp - 0x48], al
mov byte [rbp - 0x47], 0
movdqa xmmword [rbp - 0x60], xmm6
lea r9, [rbp - 0x60]
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x50]
call fcn.140052010
movss xmm1, dword [0x140104110]
ucomiss xmm1, dword [0x1400f0a1c]
jp 0x1400629ec
jne 0x1400629ec
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.netsh_advfirewall_firewall_delete_rule_name_BlockAllInbound_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_firewall_delete_rule_name_BlockAllOutbound_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
movups xmm6, xmmword [0x140169588]
lea rax, [rbp - 0x30]
mov qword [rbp + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rbx
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400cd190
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x20], reloc.WS2_32.dll_send
mov qword [rbp - 0x18], Ordinal_32
movups xmm0, xmmword [str.Fake_Lag:_Disabled_]
movups xmmword [rax], xmm0
movzx ecx, word [0x1400f0008]
mov word [rax + 0x10], cx
movzx ecx, byte [reloc.WLDAP32.dll_Ordinal_33]
mov byte [rax + 0x12], cl
mov byte [rax + 0x13], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], 9
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.N_NJA_HEX]
movsd qword [rbp - 0x50], xmm0
movzx eax, byte [0x1400ef838]
mov byte [rbp - 0x48], al
mov byte [rbp - 0x47], 0
movdqa xmmword [rbp - 0x60], xmm6
lea r9, [rbp - 0x60]
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x50]
call fcn.140052010
movss xmm1, dword [0x140104110]
ucomiss xmm1, dword [0x1400f0a28]
jp 0x140062ae0
jne 0x140062ae0
mov ecx, 0xdac
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.netsh_advfirewall_firewall_delete_rule_name_BlockAllInbound_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_firewall_delete_rule_name_BlockAllOutbound_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
movups xmm6, xmmword [0x140169588]
lea rax, [rbp - 0x30]
mov qword [rbp + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rbx
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400cd190
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x20], reloc.WS2_32.dll_send
mov qword [rbp - 0x18], Ordinal_32
movups xmm0, xmmword [str.Fake_Lag:_Disabled_]
movups xmmword [rax], xmm0
movzx ecx, word [0x1400f0008]
mov word [rax + 0x10], cx
movzx ecx, byte [reloc.WLDAP32.dll_Ordinal_33]
mov byte [rax + 0x12], cl
mov byte [rax + 0x13], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], 9
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.N_NJA_HEX]
movsd qword [rbp - 0x50], xmm0
movzx eax, byte [0x1400ef838]
mov byte [rbp - 0x48], al
mov byte [rbp - 0x47], 0
movdqa xmmword [rbp - 0x60], xmm6
lea r9, [rbp - 0x60]
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x50]
call fcn.140052010
movss xmm1, dword [0x140104110]
ucomiss xmm1, dword [0x1400f0a38]
jp 0x140062bd4
jne 0x140062bd4
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.netsh_advfirewall_firewall_delete_rule_name_BlockAllInbound_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_firewall_delete_rule_name_BlockAllOutbound_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
movups xmm6, xmmword [0x140169588]
lea rax, [rbp - 0x30]
mov qword [rbp + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rbx
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400cd190
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x20], reloc.WS2_32.dll_send
mov qword [rbp - 0x18], Ordinal_32
movups xmm0, xmmword [str.Fake_Lag:_Disabled_]
movups xmmword [rax], xmm0
movzx ecx, word [0x1400f0008]
mov word [rax + 0x10], cx
movzx ecx, byte [reloc.WLDAP32.dll_Ordinal_33]
mov byte [rax + 0x12], cl
mov byte [rax + 0x13], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], 9
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.N_NJA_HEX]
movsd qword [rbp - 0x50], xmm0
movzx eax, byte [0x1400ef838]
mov byte [rbp - 0x48], al
mov byte [rbp - 0x47], 0
movdqa xmmword [rbp - 0x60], xmm6
lea r9, [rbp - 0x60]
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x50]
call fcn.140052010
movss xmm1, dword [0x140104110]
ucomiss xmm1, dword [0x1400f0a4c]
jp 0x140062cc0
jne 0x140062cc0
mov ecx, 0x157c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.netsh_advfirewall_firewall_delete_rule_name_BlockAllInbound_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_firewall_delete_rule_name_BlockAllOutbound_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
movups xmm6, xmmword [0x140169588]
lea rax, [rbp - 0x30]
mov qword [rbp + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rbx
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400cd190
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x20], reloc.WS2_32.dll_send
mov qword [rbp - 0x18], Ordinal_32
movups xmm0, xmmword [str.Fake_Lag:_Disabled_]
movups xmmword [rax], xmm0
movzx ecx, word [0x1400f0008]
mov word [rax + 0x10], cx
movzx ecx, byte [reloc.WLDAP32.dll_Ordinal_33]
mov byte [rax + 0x12], cl
mov byte [rax + 0x13], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], 9
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.N_NJA_HEX]
movsd qword [rbp - 0x50], xmm0
movzx eax, byte [0x1400ef838]
mov byte [rbp - 0x48], al
mov byte [rbp - 0x47], 0
movdqa xmmword [rbp - 0x60], xmm6
lea r9, [rbp - 0x60]
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x50]
call fcn.140052010
mov rbx, qword [rsp + 0x98]
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop rbp
ret