Function at 0x140001b00
Capabilities:
Disable system features via registry on windows
Execute command
Persist via windows service
Schedule task via schtasks
Self delete
Set registry value
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x410]
sub rsp, 0x510
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x400], rax
lea rcx, [0x14000574c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x14000574c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n__________________________________n__________________________n__________________________n______________________n______________________n______________________n
call fcn.140001330
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140005824]
call fcn.140001330
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140005824]
call fcn.140001330
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Choose_an_option_n
call fcn.140001330
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140005824]
call fcn.140001330
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.1._Create_restore_point_n
call fcn.140001330
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.2._General_Windows_Tweaks_n
call fcn.140001330
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.3._Optimize_Windows_n
call fcn.140001330
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.4._GPU_Nvidia_Tweaks_n
call fcn.140001330
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.5._CPU_Tweaks_n
call fcn.140001330
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.6._RAM_Tweaks_n
call fcn.140001330
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.7._Mouse_And_Keyboard_Tweaks_n
call fcn.140001330
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.8._Fortnite_FPS_Tweaks_n
call fcn.140001330
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140005824]
call fcn.140001330
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.9._Exit_n
call fcn.140001330
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140005824]
call fcn.140001330
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n___
call fcn.140001330
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea rdx, [rsp + 0x20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov eax, dword [rsp + 0x20]
dec eax
cmp eax, 8
ja case.default.0x140001cbc
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x28b4]
add rcx, rdx
jmp rcx
lea rax, str.powershell__Command__Checkpoint_Computer__Description_Unklar_Restore_Point_
mov qword [rsp + 0x28], rax
lea rbx, [rsp + 0x28]
lea rax, str.Reg.exe_delete__HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionSystemRestore___v__RPSessionInterval___f__nul_2_1
mov qword [rsp + 0x30], rax
lea rax, str.Reg.exe_delete__HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionSystemRestore___v__DisableConfig___f__nul_2_1
mov qword [rsp + 0x38], rax
lea rax, str.Reg.exe_add__HKLMSoftwareMicrosoftWindows_NTCurrentVersionSystemRestore___v__SystemRestorePointCreationFrequency___t_REG_DWORD__d_0__f__nul_2_1
mov qword [rsp + 0x40], rax
mov rdi, qword [rbx]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
je 0x140001d3c
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_executing_command:
call fcn.140001330
mov rcx, rax
mov rdx, rdi
call fcn.140001330
mov rcx, rax
lea rdx, [0x140001980]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
add rbx, 8
lea rax, [rsp + 0x48]
cmp rbx, rax
jne 0x140001cf3
lea rdx, str.Restore_point_created._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001330
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140001b00
jmp 0x14000288e
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__DisablePagingExecutive___t_REG_DWORD__d__1___f
mov qword [rbp + 0x240], rax
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlGraphicsDrivers___v__DpiMapIommuContiguous___t_REG_DWORD__d__1___f
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__MoveImages___t_REG_DWORD__d__0___f
mov qword [rbp + 0x248], rcx
mov qword [rbp + 0x250], rax
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_ManagementPrefetchParameters___v__EnablePrefetcher___t_REG_DWORD__d__0___f
lea rax, str.Reg.exe_add__HKCUControl_PanelDesktop___v__AutoEndTasks___t_REG_SZ__d__1___f
mov qword [rbp + 0x258], rcx
mov qword [rbp + 0x268], rax
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_ManagementPrefetchParameters___v__EnableSuperfetch___t_REG_DWORD__d__0___f
lea rax, str.Reg.exe_add__HKCUControl_PanelDesktop___v__HungAppTimeout___t_REG_SZ__d__1000___f
mov qword [rbp + 0x260], rcx
mov qword [rbp + 0x270], rax
lea rax, str.Reg.exe_add__HKCUControl_PanelDesktop___v__WaitToKillAppTimeout___t_REG_SZ__d__2000___f
mov qword [rbp + 0x278], rax
lea rax, str.Reg.exe_add__HKCUControl_PanelDesktop___v__LowLevelHooksTimeout___t_REG_SZ__d__1000___f
mov qword [rbp + 0x280], rax
lea rax, str.Reg.exe_add__HKCUControl_PanelDesktop___v__MenuShowDelay___t_REG_SZ__d__0___f
mov qword [rbp + 0x288], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControl___v__WaitToKillServiceTimeout___t_REG_SZ__d__2000___f
mov qword [rbp + 0x290], rax
lea rax, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionReliability___v__TimeStampInterval___t_REG_DWORD__d__1___f
mov qword [rbp + 0x298], rax
lea rax, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionReliability___v__IoPriority___t_REG_DWORD__d__3___f
mov qword [rbp + 0x2a0], rax
lea rax, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Optionscsrss.exePerfOptions___v__CpuPriorityClass___t_REG_DWORD__d__4___f
mov qword [rbp + 0x2a8], rax
lea rax, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Optionscsrss.exePerfOptions___v__IoPriority___t_REG_DWORD__d__3___f
mov qword [rbp + 0x2b0], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesDXGKrnl___v__MonitorLatencyTolerance___t_REG_DWORD__d__1___f
mov qword [rbp + 0x2b8], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesDXGKrnl___v__MonitorRefreshLatencyTolerance___t_REG_DWORD__d__1___f
mov qword [rbp + 0x2c0], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlPower___v__ExitLatency___t_REG_DWORD__d__1___f
mov qword [rbp + 0x2c8], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlPower___v__ExitLatencyCheckEnabled___t_REG_DWORD__d__1___f
mov qword [rbp + 0x2d0], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlPower___v__Latency___t_REG_DWORD__d__1___f
mov qword [rbp + 0x2d8], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlPower___v__LatencyToleranceDefault___t_REG_DWORD__d__1___f
mov qword [rbp + 0x2e0], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlPower___v__LatencyToleranceFSVP___t_REG_DWORD__d__1___f
mov qword [rbp + 0x2e8], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlPower___v__LatencyTolerancePerfOverride___t_REG_DWORD__d__1___f
mov qword [rbp + 0x2f0], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlPower___v__LatencyToleranceScreenOffIR___t_REG_DWORD__d__1___f
mov qword [rbp + 0x2f8], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlPower___v__LatencyToleranceVSyncEnabled___t_REG_DWORD__d__1___f
mov qword [rbp + 0x300], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlPower___v__RtlCapabilityCheckLatency___t_REG_DWORD__d__1___f
mov qword [rbp + 0x308], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlGraphicsDriversPower___v__DefaultD3TransitionLatencyActivelyUsed___t_REG_DWORD__d__1___f
mov qword [rbp + 0x310], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlGraphicsDriversPower___v__DefaultD3TransitionLatencyIdleLongTime___t_REG_DWORD__d__1___f
mov qword [rbp + 0x318], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlGraphicsDriversPower___v__DefaultD3TransitionLatencyIdleMonitorOff___t_REG_DWORD__d__1___f
mov qword [rbp + 0x320], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlGraphicsDriversPower___v__DefaultD3TransitionLatencyIdleNoContext___t_REG_DWORD__d__1___f
mov qword [rbp + 0x328], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlGraphicsDriversPower___v__DefaultD3TransitionLatencyIdleShortTime___t_REG_DWORD__d__1___f
mov qword [rbp + 0x330], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlGraphicsDriversPower___v__DefaultD3TransitionLatencyIdleVeryLongTime___t_REG_DWORD__d__1___f
mov qword [rbp + 0x338], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlGraphicsDriversPower___v__DefaultLatencyToleranceIdle0___t_REG_DWORD__d__1___f
mov qword [rbp + 0x340], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlGraphicsDriversPower___v__DefaultLatencyToleranceIdle0MonitorOff___t_REG_DWORD__d__1___f
mov qword [rbp + 0x348], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlGraphicsDriversPower___v__DefaultLatencyToleranceIdle1___t_REG_DWORD__d__1___f
mov qword [rbp + 0x350], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlGraphicsDriversPower___v__DefaultLatencyToleranceIdle1MonitorOff___t_REG_DWORD__d__1___f
mov qword [rbp + 0x358], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlGraphicsDriversPower___v__DefaultLatencyToleranceMemory___t_REG_DWORD__d__1___f
mov qword [rbp + 0x360], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlGraphicsDriversPower___v__DefaultLatencyToleranceNoContext___t_REG_DWORD__d__1___f
mov qword [rbp + 0x368], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlGraphicsDriversPower___v__DefaultLatencyToleranceNoContextMonitorOff___t_REG_DWORD__d__1___f
mov qword [rbp + 0x370], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlGraphicsDriversPower___v__DefaultLatencyToleranceOther___t_REG_DWORD__d__1___f
mov qword [rbp + 0x378], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlGraphicsDriversPower___v__DefaultLatencyToleranceTimerPeriod___t_REG_DWORD__d__1___f
mov qword [rbp + 0x380], rax
lea rbx, [rbp + 0x240]
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlGraphicsDriversPower___v__DefaultMemoryRefreshLatencyToleranceActivelyUsed___t_REG_DWORD__d__1___f
mov qword [rbp + 0x388], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlGraphicsDriversPower___v__DefaultMemoryRefreshLatencyToleranceMonitorOff___t_REG_DWORD__d__1___f
mov qword [rbp + 0x390], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlGraphicsDriversPower___v__DefaultMemoryRefreshLatencyToleranceNoContext___t_REG_DWORD__d__1___f
mov qword [rbp + 0x398], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlGraphicsDriversPower___v__Latency___t_REG_DWORD__d__1___f
mov qword [rbp + 0x3a0], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlGraphicsDriversPower___v__MaxIAverageGraphicsLatencyInOneBucket___t_REG_DWORD__d__1___f
mov qword [rbp + 0x3a8], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlGraphicsDriversPower___v__MiracastPerfTrackGraphicsLatency___t_REG_DWORD__d__1___f
mov qword [rbp + 0x3b0], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlGraphicsDriversPower___v__MonitorLatencyTolerance___t_REG_DWORD__d__1___f
mov qword [rbp + 0x3b8], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlGraphicsDriversPower___v__MonitorRefreshLatencyTolerance___t_REG_DWORD__d__1___f
mov qword [rbp + 0x3c0], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlGraphicsDriversPower___v__TransitionLatency___t_REG_DWORD__d__1___f
mov qword [rbp + 0x3c8], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__LargeSystemCache___t_REG_DWORD__d__1___f
mov qword [rbp + 0x3d0], rax
lea rax, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfile___v__NetworkThrottlingIndex___t_REG_DWORD__d__4294967295___f
mov qword [rbp + 0x3d8], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesTcpipParametersInterfaces___v__TcpAckFrequency___t_REG_DWORD__d__1___f
mov qword [rbp + 0x3e0], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesTcpipParametersInterfaces___v__TCPNoDelay___t_REG_DWORD__d__1___f
mov qword [rbp + 0x3e8], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesTcpipParametersInterfaces___v__TcpDelAckTicks___t_REG_DWORD__d__0___f
mov qword [rbp + 0x3f0], rax
nop dword [rax + rax]
mov rdi, qword [rbx]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
je 0x1400020c9
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_executing_command:
call fcn.140001330
mov rcx, rax
mov rdx, rdi
call fcn.140001330
mov rcx, rax
lea rdx, [0x140001980]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
add rbx, 8
lea rax, [rbp + 0x3f8]
cmp rbx, rax
jne 0x140002080
lea rdx, str.Done._n
jmp 0x140001d51
lea rax, str.schtasks__end__tn__MicrosoftWindowsCustomer_Experience_Improvement_ProgramConsolidator_
mov qword [rbp + 0xe0], rax
lea rbx, [rbp + 0xe0]
lea rax, str.schtasks__change__tn__MicrosoftWindowsCustomer_Experience_Improvement_ProgramConsolidator___disable
mov qword [rbp + 0xe8], rax
lea rax, str.schtasks__end__tn__MicrosoftWindowsCustomer_Experience_Improvement_ProgramBthSQM_
mov qword [rbp + 0xf0], rax
lea rax, str.schtasks__change__tn__MicrosoftWindowsCustomer_Experience_Improvement_ProgramBthSQM___disable
mov qword [rbp + 0xf8], rax
lea rax, str.schtasks__end__tn__MicrosoftWindowsCustomer_Experience_Improvement_ProgramKernelCeipTask_
mov qword [rbp + 0x100], rax
lea rax, str.schtasks__change__tn__MicrosoftWindowsCustomer_Experience_Improvement_ProgramKernelCeipTask___disable
mov qword [rbp + 0x108], rax
lea rax, str.schtasks__end__tn__MicrosoftWindowsCustomer_Experience_Improvement_ProgramUsbCeip_
mov qword [rbp + 0x110], rax
lea rax, str.schtasks__change__tn__MicrosoftWindowsCustomer_Experience_Improvement_ProgramUsbCeip___disable
mov qword [rbp + 0x118], rax
lea rax, str.schtasks__end__tn__MicrosoftWindowsCustomer_Experience_Improvement_ProgramUploader_
mov qword [rbp + 0x120], rax
lea rax, str.schtasks__change__tn__MicrosoftWindowsCustomer_Experience_Improvement_ProgramUploader___disable
mov qword [rbp + 0x128], rax
lea rax, str.schtasks__end__tn__MicrosoftWindowsApplication_ExperienceMicrosoft_Compatibility_Appraiser_
mov qword [rbp + 0x130], rax
lea rax, str.schtasks__change__tn__MicrosoftWindowsApplication_ExperienceMicrosoft_Compatibility_Appraiser___disable
mov qword [rbp + 0x138], rax
lea rax, str.schtasks__end__tn__MicrosoftWindowsApplication_ExperienceProgramDataUpdater_
mov qword [rbp + 0x140], rax
lea rax, str.schtasks__change__tn__MicrosoftWindowsApplication_ExperienceProgramDataUpdater___disable
mov qword [rbp + 0x148], rax
lea rax, str.schtasks__end__tn__MicrosoftWindowsApplication_ExperienceStartupAppTask_
mov qword [rbp + 0x150], rax
lea rax, str.schtasks__end__tn__MicrosoftWindowsShellFamilySafetyMonitor_
mov qword [rbp + 0x158], rax
lea rax, str.schtasks__change__tn__MicrosoftWindowsShellFamilySafetyMonitor___disable
mov qword [rbp + 0x160], rax
lea rax, str.schtasks__end__tn__MicrosoftWindowsShellFamilySafetyRefresh_
mov qword [rbp + 0x168], rax
lea rax, str.schtasks__change__tn__MicrosoftWindowsShellFamilySafetyRefresh___disable
mov qword [rbp + 0x170], rax
lea rax, str.schtasks__end__tn__MicrosoftWindowsShellFamilySafetyUpload_
mov qword [rbp + 0x178], rax
lea rax, str.schtasks__change__tn__MicrosoftWindowsShellFamilySafetyUpload___disable
mov qword [rbp + 0x180], rax
lea rax, str.schtasks__end__tn__MicrosoftWindowsMaintenanceWinSAT_
mov qword [rbp + 0x188], rax
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rbp + 0x190]
add rbx, 8
cmp rbx, rax
jne 0x140002220
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionScheduleMaintenance___v__MaintenanceDisabled___t_REG_DWORD__d__1___f
mov qword [rbp - 0x40], rax
lea rbx, [rbp - 0x40]
lea rax, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionThemesPersonalize___v__EnableTransparency___t_REG_DWORD__d__0___f
mov qword [rbp - 0x38], rax
lea rax, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindowsWindows_Feeds___v__EnableFeeds___t_REG_DWORD__d__0___f
mov qword [rbp - 0x30], rax
lea rax, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoft___v__AllowNewsAndInterests___t_REG_DWORD__d__0___f
mov qword [rbp - 0x28], rax
lea rax, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindowsSystem___v__EnableActivityFeed___t_REG_DWORD__d__0___f
mov qword [rbp - 0x20], rax
lea rax, str.Reg.exe_add__HKCUControl_PanelInternationalUser_Profile___v__HttpAcceptLanguageOptOut___t_REG_DWORD__d__1___f
mov qword [rbp - 0x18], rax
lea rax, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionAdvertisingInfo___v__Enabled___t_REG_DWORD__d__0___f
mov qword [rbp - 0x10], rax
lea rax, str.Reg.exe_add__HKLMSoftwarePoliciesMicrosoftWindowsSystem___v__EnableActivityFeed___t_REG_DWORD__d__0___f
mov qword [rbp - 8], rax
lea rax, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced___v__DisallowShaking___t_REG_DWORD__d__1___f
mov qword [rbp], rax
lea rax, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced___v__EnableBalloonTips___t_REG_DWORD__d__0___f
mov qword [rbp + 8], rax
lea rax, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced___v__ShowSyncProviderNotifications___t_REG_DWORD__d__0___f
mov qword [rbp + 0x10], rax
lea rax, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStoreuserNotificationListener___v__Value___t_REG_SZ__d__Deny___f
mov qword [rbp + 0x18], rax
lea rax, str.Reg.exe_add__HKLMSoftwarePoliciesMicrosoftWindowsAdvertisingInfo___v__DisabledByGroupPolicy___t_REG_DWORD__d__1___f
mov qword [rbp + 0x20], rax
lea rax, str.Reg.exe_add__HKCUSOFTWAREMicrosoftGameBar___v__AllowAutoGameMode___t_REG_DWORD__d__1___f
mov qword [rbp + 0x28], rax
lea rax, str.Reg.exe_add__HKCUSOFTWAREMicrosoftGameBar___v__AutoGameModeEnabled___t_REG_DWORD__d__1___f
mov qword [rbp + 0x30], rax
lea rax, str.Reg.exe_add__HKLMSOFTWAREMicrosoftPolicyManagercurrentdeviceSystem___v__AllowExperimentation___t_REG_DWORD__d__0___f
mov qword [rbp + 0x38], rax
lea rax, str.Reg.exe_add__HKLMSOFTWAREMicrosoftPolicyManagerdefaultSystemAllowExperimentation___v__value___t_REG_DWORD__d__0___f
mov qword [rbp + 0x40], rax
mov rdi, qword [rbx]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
je 0x14000234c
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_executing_command:
call fcn.140001330
mov rcx, rax
mov rdx, rdi
call fcn.140001330
mov rcx, rax
lea rdx, [0x140001980]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
add rbx, 8
lea rax, [rbp + 0x48]
cmp rbx, rax
jne 0x140002303
lea rdx, str.Done._n
jmp 0x140001d51
call fcn.140002d60
lea rdx, str.Done._n
jmp 0x140001d51
lea rcx, str.powercfg__setactive_SCHEME_CURRENT
lea rax, str.powercfg__setACvalueindex_scheme_current_SUB_PROCESSOR_SYSCOOLPOL_1
mov qword [rbp + 0x60], rcx
mov qword [rbp + 0x50], rax
lea rbx, [rbp + 0x50]
lea rax, str.powercfg__setDCvalueindex_scheme_current_SUB_PROCESSOR_SYSCOOLPOL_1
mov qword [rbp + 0x78], rcx
mov qword [rbp + 0x58], rax
lea rax, str.bcdedit__set_current_numproc__NUMBER_OF_PROCESSORS_
mov qword [rbp + 0x68], rax
lea rax, str.powercfg__setacvalueindex_scheme_current_SUB_SLEEP_AWAYMODE_0
mov qword [rbp + 0x70], rax
lea rax, str.powercfg__setacvalueindex_scheme_current_SUB_SLEEP_ALLOWSTANDBY_0
mov qword [rbp + 0x80], rax
lea rax, str.powercfg__setacvalueindex_scheme_current_SUB_SLEEP_HYBRIDSLEEP_0
mov qword [rbp + 0x90], rax
lea rax, str.powercfg__setacvalueindex_scheme_current_sub_processor_PROCTHROTTLEMIN_100
mov qword [rbp + 0xa0], rax
lea rax, str.powercfg__setacvalueindex_scheme_current_sub_processor_IDLESCALING_1
mov qword [rbp + 0xb0], rax
lea rax, str.powercfg__setacvalueindex_scheme_current_sub_processor_CPMINCORES_100
mov qword [rbp + 0xc0], rax
lea rax, str.powercfg__setacvalueindex_scheme_current_sub_processor_THROTTLING_0
mov qword [rbp + 0xd0], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlPowerPowerSettings54533251_82be_4824_96c1_47b60b740d000cc5b647_c1df_4637_891a_dec35c318583___v__ValueMin___t_REG_DWORD__d__0___f
mov qword [rbp + 0xd8], rax
mov qword [rbp + 0x88], rcx
mov qword [rbp + 0x98], rcx
mov qword [rbp + 0xa8], rcx
mov qword [rbp + 0xb8], rcx
mov qword [rbp + 0xc8], rcx
nop word [rax + rax]
mov rdi, qword [rbx]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
je 0x140002489
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_executing_command:
call fcn.140001330
mov rcx, rax
mov rdx, rdi
call fcn.140001330
mov rcx, rax
lea rdx, [0x140001980]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
add rbx, 8
lea rax, [rbp + 0xe0]
cmp rbx, rax
jne 0x140002440
lea rdx, str.Done._n
jmp 0x140001d51
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__DisablePagingExecutive___t_REG_DWORD__d__1___f
mov qword [rbp + 0x190], rax
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlGraphicsDrivers___v__DpiMapIommuContiguous___t_REG_DWORD__d__1___f
mov qword [rbp + 0x1b8], rax
lea rbx, [rbp + 0x190]
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__LargeSystemCache___t_REG_DWORD__d__0___f
mov qword [rbp + 0x198], rcx
mov qword [rbp + 0x1c0], rax
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_ManagementPrefetchParameters___v__EnablePrefetcher___t_REG_DWORD__d__0___f
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__NonPagedPoolQuota___t_REG_DWORD__d__0___f
mov qword [rbp + 0x1a0], rcx
mov qword [rbp + 0x1c8], rax
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_ManagementPrefetchParameters___v__EnableSuperfetch___t_REG_DWORD__d__0___f
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__NonPagedPoolSize___t_REG_DWORD__d__0___f
mov qword [rbp + 0x1a8], rcx
mov qword [rbp + 0x1d0], rax
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__ClearPageFileAtShutdown___t_REG_DWORD__d__0___f
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__PagedPoolQuota___t_REG_DWORD__d__0___f
mov qword [rbp + 0x1b0], rcx
mov qword [rbp + 0x1d8], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__PagedPoolSize___t_REG_DWORD__d__192___f
mov qword [rbp + 0x1e0], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__SecondLevelDataCache___t_REG_DWORD__d__1024___f
mov qword [rbp + 0x1e8], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__SessionPoolSize___t_REG_DWORD__d__192___f
mov qword [rbp + 0x1f0], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__SessionViewSize___t_REG_DWORD__d__192___f
mov qword [rbp + 0x1f8], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__SystemPages___t_REG_DWORD__d__4294967295___f
mov qword [rbp + 0x200], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__PhysicalAddressExtension___t_REG_DWORD__d__1___f
mov qword [rbp + 0x208], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__FeatureSettings___t_REG_DWORD__d__1___f
mov qword [rbp + 0x210], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__FeatureSettingsOverride___t_REG_DWORD__d__3___f
mov qword [rbp + 0x218], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__FeatureSettingsOverrideMask___t_REG_DWORD__d__3___f
mov qword [rbp + 0x220], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__IoPageLockLimit___t_REG_DWORD__d__16710656___f
mov qword [rbp + 0x228], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__PoolUsageMaximum___t_REG_DWORD__d__96___f
mov qword [rbp + 0x230], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__Start___t_REG_DWORD__d__4___f
mov qword [rbp + 0x238], rax
nop dword [rax]
mov rdi, qword [rbx]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
je 0x140002629
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_executing_command:
call fcn.140001330
mov rcx, rax
mov rdx, rdi
call fcn.140001330
mov rcx, rax
lea rdx, [0x140001980]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
add rbx, 8
lea rax, [rbp + 0x240]
cmp rbx, rax
jne 0x1400025e0
lea rdx, str.Done._n
jmp 0x140001d51
lea rax, str.Reg.exe_add__HKCUControl_PanelAccessibilityKeyboard_Response___v__Flags___t_REG_SZ__d__122___f
mov qword [rsp + 0x50], rax
lea rbx, [rsp + 0x50]
lea rax, str.Reg.exe_add__HKCUControl_PanelAccessibilityToggleKeys___v__Flags___t_REG_SZ__d__58___f
mov qword [rsp + 0x58], rax
lea rax, str.Reg.exe_add__HKCUControl_PanelAccessibilityStickyKeys___v__Flags___t_REG_SZ__d__506___f
mov qword [rsp + 0x60], rax
lea rax, str.Reg.exe_add__HKCUControl_PanelAccessibilityMouseKeys___v__Flags___t_REG_SZ__d__0___f
mov qword [rsp + 0x68], rax
lea rax, str.Reg.exe_add__HKCUControl_PanelMouse___v__MouseSpeed___t_REG_SZ__d__0___f
mov qword [rsp + 0x70], rax
lea rax, str.Reg.exe_add__HKCUControl_PanelMouse___v__MouseThreshold1___t_REG_SZ__d__0___f
mov qword [rsp + 0x78], rax
lea rax, str.Reg.exe_add__HKCUControl_PanelMouse___v__MouseThreshold2___t_REG_SZ__d__0___f
mov qword [rbp - 0x80], rax
lea rax, str.Reg.exe_add__HKCUControl_PanelMouse___v__MouseSensitivity___t_REG_SZ__d__10___f
mov qword [rbp - 0x78], rax
lea rax, str.Reg.exe_add__HKCUControl_PanelKeyboard___v__KeyboardDelay___t_REG_SZ__d__0___f
mov qword [rbp - 0x70], rax
lea rax, str.Reg.exe_add__HKCUControl_PanelKeyboard___v__KeyboardSpeed___t_REG_SZ__d__31___f
mov qword [rbp - 0x68], rax
lea rax, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Optionscsrss.exePerfOptions___v__CpuPriorityClass___t_REG_DWORD__d__4___f
mov qword [rbp - 0x60], rax
lea rax, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Optionscsrss.exePerfOptions___v__IoPriority___t_REG_DWORD__d__3___f
mov qword [rbp - 0x58], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesmouclassParameters___v__MouseDataQueueSize___t_REG_DWORD__d__32___f
mov qword [rbp - 0x50], rax
lea rax, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServiceskbdclassParameters___v__KeyboardDataQueueSize___t_REG_DWORD__d__32___f
mov qword [rbp - 0x48], rax
nop word [rax + rax]
mov rdi, qword [rbx]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
je 0x140002739
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_executing_command:
call fcn.140001330
mov rcx, rax
mov rdx, rdi
call fcn.140001330
mov rcx, rax
lea rdx, [0x140001980]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
add rbx, 8
lea rax, [rbp - 0x40]
cmp rbx, rax
jne 0x1400026f0
lea rdx, str.Done._n
jmp 0x140001d51
lea rcx, str.powershell__Command__Invoke_WebRequest__Uri_https:__github.com_Orbmu2k_nvidiaProfileInspector_releases_latest_download_nvidiaProfileInspector.zip__OutFile__temp__nvidiaProfileInspector.zip__Expand_Archive__Path__temp__nvidiaProfileInspector.zip__DestinationPath__temp___Force_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wsystem]
test eax, eax
jne 0x140002810
lea rcx, str.powershell__Command__Invoke_WebRequest__Uri_https:__cdn.discordapp.com_attachments_1190623185805250570_1207510237922332683_fortnitefps.nip_ex65dfe88bis65cd738bhm9b07e43c1a44b553bc880c4fc094448c7e6c1f3079cee2f258b34ca9dafca7ca__OutFile__temp__fortnitefps.nip
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
jne 0x1400027d9
lea rcx, str.start_____wait___temp_NvidiaProfileInspector.exe____temp__fortnitefps.nip_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
jne 0x1400027a2
lea rcx, str.del__Q__temp_.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Done._n
jmp 0x140001d51
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Failed_to_load_preset.
call fcn.140001330
mov rcx, rax
lea rdx, [0x140001980]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Failed_to_download_or_save_the_file.
call fcn.140001330
mov rcx, rax
lea rdx, [0x140001980]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.Failed_to_download.
call fcn.140001590
mov rcx, rax
lea rdx, [0x1400019c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [0x14000574c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Bye._n
call fcn.140001330
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Invalid_choice._n
call fcn.140001330
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.140003670
lea r11, [rsp + 0x510]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret