Function at 0x140061c80
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
lea rcx, str.netsh_advfirewall_set_allprofiles_state_on
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_BlockAllInbound__dirin_actionblock_enableyes
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x190
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.netsh_advfirewall_firewall_add_rule_name_BlockAllOutbound__dirout_actionblock_enableyes
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm6, xmmword [0x140165588]
lea rax, [rbp - 0x50]
mov qword [rbp + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xor ebx, ebx
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rbx
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400cb0dc
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x40], reloc.WS2_32.dll_select
mov qword [rbp - 0x38], Ordinal_35
movups xmm0, xmmword [str.Fake_Lag:_Enabled_]
movups xmmword [rax], xmm0
movzx ecx, word [0x1400ecd60]
mov word [rax + 0x10], cx
mov byte [rax + 0x12], bl
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], 9
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.N_NJA_HEX]
movsd qword [rbp - 0x30], xmm0
movzx eax, byte [0x1400ec738]
mov byte [rbp - 0x28], al
mov byte [rbp - 0x27], bl
movdqa xmmword [rbp - 0x60], xmm6
lea r9, [rbp - 0x60]
lea r8, [rbp - 0x50]
lea rdx, [rbp - 0x30]
call fcn.140052000
xorps xmm0, xmm0
movss xmm1, dword [0x140100110]
ucomiss xmm1, xmm0
jp 0x140061e54
jne 0x140061e54
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
movups xmm6, xmmword [0x140165588]
lea rax, [rbp - 0x30]
mov qword [rbp + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rbx
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400cb0dc
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x20], reloc.WS2_32.dll_send
mov qword [rbp - 0x18], Ordinal_35
movups xmm0, xmmword [str.Fake_Lag:_Disabled_]
movups xmmword [rax], xmm0
movzx ecx, word [0x1400ecd78]
mov word [rax + 0x10], cx
movzx ecx, byte [reloc.WLDAP32.dll_Ordinal_33]
mov byte [rax + 0x12], cl
mov byte [rax + 0x13], bl
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], 9
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.N_NJA_HEX]
movsd qword [rbp - 0x50], xmm0
movzx eax, byte [0x1400ec738]
mov byte [rbp - 0x48], al
mov byte [rbp - 0x47], bl
movdqa xmmword [rbp - 0x60], xmm6
lea r9, [rbp - 0x60]
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x50]
call fcn.140052000
lea rcx, str.netsh_advfirewall_firewall_delete_rule_name_BlockAllInbound_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_firewall_delete_rule_name_BlockAllOutbound_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movss xmm1, dword [0x140100110]
ucomiss xmm1, dword [0x1400ed704]
jp 0x140061f48
jne 0x140061f48
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.netsh_advfirewall_firewall_delete_rule_name_BlockAllInbound_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_firewall_delete_rule_name_BlockAllOutbound_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
movups xmm6, xmmword [0x140165588]
lea rax, [rbp - 0x30]
mov qword [rbp + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rbx
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400cb0dc
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x20], reloc.WS2_32.dll_send
mov qword [rbp - 0x18], Ordinal_35
movups xmm0, xmmword [str.Fake_Lag:_Disabled_]
movups xmmword [rax], xmm0
movzx ecx, word [0x1400ecd78]
mov word [rax + 0x10], cx
movzx ecx, byte [reloc.WLDAP32.dll_Ordinal_33]
mov byte [rax + 0x12], cl
mov byte [rax + 0x13], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], 9
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.N_NJA_HEX]
movsd qword [rbp - 0x50], xmm0
movzx eax, byte [0x1400ec738]
mov byte [rbp - 0x48], al
mov byte [rbp - 0x47], 0
movdqa xmmword [rbp - 0x60], xmm6
lea r9, [rbp - 0x60]
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x50]
call fcn.140052000
movss xmm1, dword [0x140100110]
ucomiss xmm1, dword [0x1400ed724]
jp 0x14006203c
jne 0x14006203c
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.netsh_advfirewall_firewall_delete_rule_name_BlockAllInbound_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_firewall_delete_rule_name_BlockAllOutbound_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
movups xmm6, xmmword [0x140165588]
lea rax, [rbp - 0x30]
mov qword [rbp + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rbx
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400cb0dc
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x20], reloc.WS2_32.dll_send
mov qword [rbp - 0x18], Ordinal_35
movups xmm0, xmmword [str.Fake_Lag:_Disabled_]
movups xmmword [rax], xmm0
movzx ecx, word [0x1400ecd78]
mov word [rax + 0x10], cx
movzx ecx, byte [reloc.WLDAP32.dll_Ordinal_33]
mov byte [rax + 0x12], cl
mov byte [rax + 0x13], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], 9
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.N_NJA_HEX]
movsd qword [rbp - 0x50], xmm0
movzx eax, byte [0x1400ec738]
mov byte [rbp - 0x48], al
mov byte [rbp - 0x47], 0
movdqa xmmword [rbp - 0x60], xmm6
lea r9, [rbp - 0x60]
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x50]
call fcn.140052000
movss xmm1, dword [0x140100110]
ucomiss xmm1, dword [0x1400ed730]
jp 0x140062130
jne 0x140062130
mov ecx, 0xdac
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.netsh_advfirewall_firewall_delete_rule_name_BlockAllInbound_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_firewall_delete_rule_name_BlockAllOutbound_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
movups xmm6, xmmword [0x140165588]
lea rax, [rbp - 0x30]
mov qword [rbp + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rbx
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400cb0dc
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x20], reloc.WS2_32.dll_send
mov qword [rbp - 0x18], Ordinal_35
movups xmm0, xmmword [str.Fake_Lag:_Disabled_]
movups xmmword [rax], xmm0
movzx ecx, word [0x1400ecd78]
mov word [rax + 0x10], cx
movzx ecx, byte [reloc.WLDAP32.dll_Ordinal_33]
mov byte [rax + 0x12], cl
mov byte [rax + 0x13], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], 9
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.N_NJA_HEX]
movsd qword [rbp - 0x50], xmm0
movzx eax, byte [0x1400ec738]
mov byte [rbp - 0x48], al
mov byte [rbp - 0x47], 0
movdqa xmmword [rbp - 0x60], xmm6
lea r9, [rbp - 0x60]
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x50]
call fcn.140052000
movss xmm1, dword [0x140100110]
ucomiss xmm1, dword [0x1400ed740]
jp 0x140062224
jne 0x140062224
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.netsh_advfirewall_firewall_delete_rule_name_BlockAllInbound_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_firewall_delete_rule_name_BlockAllOutbound_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
movups xmm6, xmmword [0x140165588]
lea rax, [rbp - 0x30]
mov qword [rbp + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rbx
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400cb0dc
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x20], reloc.WS2_32.dll_send
mov qword [rbp - 0x18], Ordinal_35
movups xmm0, xmmword [str.Fake_Lag:_Disabled_]
movups xmmword [rax], xmm0
movzx ecx, word [0x1400ecd78]
mov word [rax + 0x10], cx
movzx ecx, byte [reloc.WLDAP32.dll_Ordinal_33]
mov byte [rax + 0x12], cl
mov byte [rax + 0x13], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], 9
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.N_NJA_HEX]
movsd qword [rbp - 0x50], xmm0
movzx eax, byte [0x1400ec738]
mov byte [rbp - 0x48], al
mov byte [rbp - 0x47], 0
movdqa xmmword [rbp - 0x60], xmm6
lea r9, [rbp - 0x60]
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x50]
call fcn.140052000
movss xmm1, dword [0x140100110]
ucomiss xmm1, dword [0x1400ed754]
jp 0x140062310
jne 0x140062310
mov ecx, 0x157c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.netsh_advfirewall_firewall_delete_rule_name_BlockAllInbound_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_firewall_delete_rule_name_BlockAllOutbound_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
movups xmm6, xmmword [0x140165588]
lea rax, [rbp - 0x30]
mov qword [rbp + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rbx
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400cb0dc
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x20], reloc.WS2_32.dll_send
mov qword [rbp - 0x18], Ordinal_35
movups xmm0, xmmword [str.Fake_Lag:_Disabled_]
movups xmmword [rax], xmm0
movzx ecx, word [0x1400ecd78]
mov word [rax + 0x10], cx
movzx ecx, byte [reloc.WLDAP32.dll_Ordinal_33]
mov byte [rax + 0x12], cl
mov byte [rax + 0x13], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], 9
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.N_NJA_HEX]
movsd qword [rbp - 0x50], xmm0
movzx eax, byte [0x1400ec738]
mov byte [rbp - 0x48], al
mov byte [rbp - 0x47], 0
movdqa xmmword [rbp - 0x60], xmm6
lea r9, [rbp - 0x60]
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x50]
call fcn.140052000
mov rbx, qword [rsp + 0x98]
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop rbp
ret