Function at 0x14001a6d6
Capabilities:
Execute command
Set registry value

Disassembly:
jmp 0x140026290
push rbp
push rdi
mov eax, 0x1338
call fcn.14001a1ea
sub rsp, rax
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x376
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140059040]
xor rax, rbp
mov qword [rbp + 0x1300], rax
lea rcx, [0x1400610f9]
call fcn.14001a9f1
nop
xor ecx, ecx
call fcn.140027270
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_srand]
nop
mov edx, 0x20
lea rcx, [rbp + 8]
call fcn.14001a0ff
lea rcx, [rbp + 8]
call fcn.14001a6a4
nop
lea rdx, str.Changing_Disk_serials
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001a145
lea rdx, [0x14001a06e]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rax, [rbp + 8]
mov qword [rbp + 0x48], rax
mov rcx, qword [rbp + 0x48]
call fcn.14001a2d0
mov qword [rbp + 0x68], rax
mov rcx, qword [rbp + 0x48]
call fcn.14001a2c1
mov qword [rbp + 0x88], rax
jmp 0x140026353
mov rax, qword [rbp + 0x68]
add rax, 0x28
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x88]
cmp qword [rbp + 0x68], rax
je 0x1400265ca
mov rdx, qword [rbp + 0x68]
lea rcx, [rbp + 0xa8]
call fcn.14001a181
nop
lea rax, [rbp + 0x668]
mov qword [rbp + 0x698], rax
lea rax, [rbp + 0x6e8]
mov qword [rbp + 0x718], rax
mov byte [rbp + 0x734], 0x5c
lea rax, [rbp + 0x758]
mov qword [rbp + 0x788], rax
lea rax, [rbp + 0x7a8]
mov qword [rbp + 0x7d8], rax
lea rdx, [rbp + 0x6b8]
lea rcx, [rbp + 0xa8]
call fcn.14001a15e
mov qword [rbp + 0x1248], rax
mov rax, qword [rbp + 0x1248]
mov qword [rbp + 0x1250], rax
mov rdx, qword [rbp + 0x1250]
mov rcx, qword [rbp + 0x698]
call fcn.14001a7e4
mov qword [rbp + 0x1258], rax
mov rax, qword [rbp + 0x1258]
mov qword [rbp + 0x1260], rax
mov rdx, qword [rbp + 0x788]
lea rcx, [rbp + 0xa8]
call fcn.14001a15e
mov qword [rbp + 0x1268], rax
mov rdx, qword [rbp + 0x7d8]
lea rcx, [rbp + 0xa8]
call fcn.14001aa23
mov qword [rbp + 0x1270], rax
lea r9, [rbp + 0x734]
mov r8, qword [rbp + 0x1268]
mov rdx, qword [rbp + 0x1270]
lea rcx, [rbp + 0x7f8]
call fcn.14001a5f5
mov qword [rbp + 0x1278], rax
mov rax, qword [rbp + 0x1278]
mov qword [rbp + 0x1280], rax
mov rdx, qword [rbp + 0x1280]
mov rcx, qword [rbp + 0x718]
call fcn.14001a7e4
mov qword [rbp + 0x1288], rax
mov r9, qword [rbp + 0x1260]
mov r8, qword [rbp + 0x1288]
lea rdx, [rbp + 0x828]
lea rcx, [rbp + 0xa8]
call fcn.14001a726
lea rcx, [rbp + 0x828]
call fcn.14001a31b
lea rcx, [rbp + 0x7f8]
call fcn.14001a31b
nop
lea rcx, [rbp + 0x6b8]
call fcn.14001a31b
nop
lea rcx, [rbp + 0x858]
call fcn.14001a1f4
mov qword [rbp + 0x1248], rax
mov rax, qword [rbp + 0x1248]
mov qword [rbp + 0x1250], rax
lea r8, [rbp + 0xa8]
lea rdx, str.Volumeid64.exe
lea rcx, [rbp + 0x898]
call fcn.14001a078
mov qword [rbp + 0x1258], rax
mov rax, qword [rbp + 0x1258]
mov qword [rbp + 0x1260], rax
lea r8, [0x14005231c]
mov rdx, qword [rbp + 0x1260]
lea rcx, [rbp + 0x8d8]
call fcn.14001a929
mov qword [rbp + 0x1268], rax
mov rax, qword [rbp + 0x1268]
mov qword [rbp + 0x1270], rax
mov r8, qword [rbp + 0x1250]
mov rdx, qword [rbp + 0x1270]
lea rcx, [rbp + 0x918]
call fcn.14001a109
mov qword [rbp + 0x1278], rax
mov rcx, qword [rbp + 0x1278]
call fcn.14001a10e
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, [rbp + 0x918]
call fcn.14001a203
nop
lea rcx, [rbp + 0x8d8]
call fcn.14001a203
nop
lea rcx, [rbp + 0x898]
call fcn.14001a203
nop
lea rcx, [rbp + 0x858]
call fcn.14001a203
nop
lea rcx, [rbp + 0xa8]
call fcn.14001a203
nop
jmp 0x140026347
lea rdx, str.Disk_serials_changed
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001a145
lea rdx, [0x14001a06e]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x14001a06e]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rdx, str.Changing_guilds
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001a145
lea rdx, [0x14001a06e]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x14001a06e]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0xe8]
call fcn.14001a091
nop
lea rdx, str.Changing_MachineGuid
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001a145
nop
lea r8, [rbp + 0xe8]
lea rdx, [0x140052390]
lea rcx, [rbp + 0x958]
call fcn.14001a078
mov qword [rbp + 0x1248], rax
mov rax, qword [rbp + 0x1248]
mov qword [rbp + 0x1250], rax
lea r8, [0x140052390]
mov rdx, qword [rbp + 0x1250]
lea rcx, [rbp + 0x998]
call fcn.14001a929
mov qword [rbp + 0x1258], rax
mov rax, qword [rbp + 0x1258]
mov qword [rbp + 0x1260], rax
lea rdx, [0x1400523bc]
lea rcx, [rbp + 0x9d8]
call fcn.14001a465
mov qword [rbp + 0x1268], rax
mov rax, qword [rbp + 0x1268]
mov qword [rbp + 0x1270], rax
lea rdx, str.HKLMSOFTWAREMicrosoftCryptography
lea rcx, [rbp + 0xa18]
call fcn.14001a465
mov qword [rbp + 0x1278], rax
mov rax, qword [rbp + 0x1278]
mov qword [rbp + 0x1280], rax
lea rdx, [0x140052390]
lea rcx, [rbp + 0xa58]
call fcn.14001a465
mov qword [rbp + 0x1288], rax
mov rax, qword [rbp + 0x1288]
mov qword [rbp + 0x1290], rax
mov r8, qword [rbp + 0x1290]
lea rdx, str.REG_ADD
lea rcx, [rbp + 0xa98]
call fcn.14001aa28
mov qword [rbp + 0x1298], rax
mov rax, qword [rbp + 0x1298]
mov qword [rbp + 0x12a0], rax
mov r8, qword [rbp + 0x1280]
mov rdx, qword [rbp + 0x12a0]
lea rcx, [rbp + 0xad8]
call fcn.14001a109
mov qword [rbp + 0x12a8], rax
mov rax, qword [rbp + 0x12a8]
mov qword [rbp + 0x12b0], rax
mov r8, qword [rbp + 0x1270]
mov rdx, qword [rbp + 0x12b0]
lea rcx, [rbp + 0xb18]
call fcn.14001a109
mov qword [rbp + 0x12b8], rax
mov rax, qword [rbp + 0x12b8]
mov qword [rbp + 0x12c0], rax
lea r8, str._v_MachineGuid__t_REG_SZ__d
mov rdx, qword [rbp + 0x12c0]
lea rcx, [rbp + 0xb58]
call fcn.14001a929
mov qword [rbp + 0x12c8], rax
mov rax, qword [rbp + 0x12c8]
mov qword [rbp + 0x12d0], rax
mov r8, qword [rbp + 0x1260]
mov rdx, qword [rbp + 0x12d0]
lea rcx, [rbp + 0xb98]
call fcn.14001a109
mov qword [rbp + 0x12d8], rax
mov rax, qword [rbp + 0x12d8]
mov qword [rbp + 0x12e0], rax
lea r8, [0x14005238c]
mov rdx, qword [rbp + 0x12e0]
lea rcx, [rbp + 0xbd8]
call fcn.14001a929
mov qword [rbp + 0x12e8], rax
mov rcx, qword [rbp + 0x12e8]
call fcn.14001a10e
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, [rbp + 0xbd8]
call fcn.14001a203
nop
lea rcx, [rbp + 0xb98]
call fcn.14001a203
nop
lea rcx, [rbp + 0xb58]
call fcn.14001a203
nop
lea rcx, [rbp + 0xb18]
call fcn.14001a203
nop
lea rcx, [rbp + 0xad8]
call fcn.14001a203
nop
lea rcx, [rbp + 0xa98]
call fcn.14001a203
nop
lea rcx, [rbp + 0xa58]
call fcn.14001a203
nop
lea rcx, [rbp + 0xa18]
call fcn.14001a203
nop
lea rcx, [rbp + 0x9d8]
call fcn.14001a203
nop
lea rcx, [rbp + 0x998]
call fcn.14001a203
nop
lea rcx, [rbp + 0x958]
call fcn.14001a203
nop
lea rdx, str._nChanging_HwProfileGuid
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001a145
nop
lea r8, [rbp + 0xe8]
lea rdx, [0x140052420]
lea rcx, [rbp + 0xc18]
call fcn.14001a078
mov qword [rbp + 0x1248], rax
mov rax, qword [rbp + 0x1248]
mov qword [rbp + 0x1250], rax
lea r8, [0x14005241c]
mov rdx, qword [rbp + 0x1250]
lea rcx, [rbp + 0xc58]
call fcn.14001a929
mov qword [rbp + 0x1258], rax
mov rax, qword [rbp + 0x1258]
mov qword [rbp + 0x1260], rax
lea rdx, [0x1400523bc]
lea rcx, [rbp + 0xc98]
call fcn.14001a465
mov qword [rbp + 0x1268], rax
mov rax, qword [rbp + 0x1268]
mov qword [rbp + 0x1270], rax
lea rdx, str.HKLMSYSTEMCurrentControlSetControlIDconfigDBHardware_Profiles0001
lea rcx, [rbp + 0xcd8]
call fcn.14001a465
mov qword [rbp + 0x1278], rax
mov rax, qword [rbp + 0x1278]
mov qword [rbp + 0x1280], rax
lea rdx, [0x140052390]
lea rcx, [rbp + 0xd18]
call fcn.14001a465
mov qword [rbp + 0x1288], rax
mov rax, qword [rbp + 0x1288]
mov qword [rbp + 0x1290], rax
mov r8, qword [rbp + 0x1290]
lea rdx, str.REG_ADD
lea rcx, [rbp + 0xd58]
call fcn.14001aa28
mov qword [rbp + 0x1298], rax
mov rax, qword [rbp + 0x1298]
mov qword [rbp + 0x12a0], rax
mov r8, qword [rbp + 0x1280]
mov rdx, qword [rbp + 0x12a0]
lea rcx, [rbp + 0xd98]
call fcn.14001a109
mov qword [rbp + 0x12a8], rax
mov rax, qword [rbp + 0x12a8]
mov qword [rbp + 0x12b0], rax
mov r8, qword [rbp + 0x1270]
mov rdx, qword [rbp + 0x12b0]
lea rcx, [rbp + 0xdd8]
call fcn.14001a109
mov qword [rbp + 0x12b8], rax
mov rax, qword [rbp + 0x12b8]
mov qword [rbp + 0x12c0], rax
lea r8, str._v_HwProfileGuid__t_REG_SZ__d
mov rdx, qword [rbp + 0x12c0]
lea rcx, [rbp + 0xe18]
call fcn.14001a929
mov qword [rbp + 0x12c8], rax
mov rax, qword [rbp + 0x12c8]
mov qword [rbp + 0x12d0], rax
mov r8, qword [rbp + 0x1260]
mov rdx, qword [rbp + 0x12d0]
lea rcx, [rbp + 0xe58]
call fcn.14001a109
mov qword [rbp + 0x12d8], rax
mov rax, qword [rbp + 0x12d8]
mov qword [rbp + 0x12e0], rax
lea r8, [0x14005238c]
mov rdx, qword [rbp + 0x12e0]
lea rcx, [rbp + 0xe98]
call fcn.14001a929
mov qword [rbp + 0x12e8], rax
mov rcx, qword [rbp + 0x12e8]
call fcn.14001a10e
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, [rbp + 0xe98]
call fcn.14001a203
nop
lea rcx, [rbp + 0xe58]
call fcn.14001a203
nop
lea rcx, [rbp + 0xe18]
call fcn.14001a203
nop
lea rcx, [rbp + 0xdd8]
call fcn.14001a203
nop
lea rcx, [rbp + 0xd98]
call fcn.14001a203
nop
lea rcx, [rbp + 0xd58]
call fcn.14001a203
nop
lea rcx, [rbp + 0xd18]
call fcn.14001a203
nop
lea rcx, [rbp + 0xcd8]
call fcn.14001a203
nop
lea rcx, [rbp + 0xc98]
call fcn.14001a203
nop
lea rcx, [rbp + 0xc58]
call fcn.14001a203
nop
lea rcx, [rbp + 0xc18]
call fcn.14001a203
nop
lea rdx, str._nChanging_MacAddr
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001a145
nop
mov dl, 0xc
lea rcx, [rbp + 0xed8]
call fcn.14001a00a
mov qword [rbp + 0x1248], rax
mov rax, qword [rbp + 0x1248]
mov qword [rbp + 0x1250], rax
mov r8, qword [rbp + 0x1250]
lea rdx, [0x140052390]
lea rcx, [rbp + 0xf18]
call fcn.14001aa28
mov qword [rbp + 0x1258], rax
mov rax, qword [rbp + 0x1258]
mov qword [rbp + 0x1260], rax
lea r8, [0x140052390]
mov rdx, qword [rbp + 0x1260]
lea rcx, [rbp + 0xf58]
call fcn.14001a929
mov qword [rbp + 0x1268], rax
mov rax, qword [rbp + 0x1268]
mov qword [rbp + 0x1270], rax
lea rdx, [0x1400523bc]
lea rcx, [rbp + 0xf98]
call fcn.14001a465
mov qword [rbp + 0x1278], rax
mov rax, qword [rbp + 0x1278]
mov qword [rbp + 0x1280], rax
lea rdx, str.HKLMSYSTEMCurrentControlSetControlClass4d36e972_e325_11ce_bfc1_08002be103180001
lea rcx, [rbp + 0xfd8]
call fcn.14001a465
mov qword [rbp + 0x1288], rax
mov rax, qword [rbp + 0x1288]
mov qword [rbp + 0x1290], rax
lea rdx, [0x140052390]
lea rcx, [rbp + 0x1018]
call fcn.14001a465
mov qword [rbp + 0x1298], rax
mov rax, qword [rbp + 0x1298]
mov qword [rbp + 0x12a0], rax
mov r8, qword [rbp + 0x12a0]
lea rdx, str.REG_ADD
lea rcx, [rbp + 0x1058]
call fcn.14001aa28
mov qword [rbp + 0x12a8], rax
mov rax, qword [rbp + 0x12a8]
mov qword [rbp + 0x12b0], rax
mov r8, qword [rbp + 0x1290]
mov rdx, qword [rbp + 0x12b0]
lea rcx, [rbp + 0x1098]
call fcn.14001a109
mov qword [rbp + 0x12b8], rax
mov rax, qword [rbp + 0x12b8]
mov qword [rbp + 0x12c0], rax
mov r8, qword [rbp + 0x1280]
mov rdx, qword [rbp + 0x12c0]
lea rcx, [rbp + 0x10d8]
call fcn.14001a109
mov qword [rbp + 0x12c8], rax
mov rax, qword [rbp + 0x12c8]
mov qword [rbp + 0x12d0], rax
lea r8, str._v_NetworkAddress__t_REG_SZ__d
mov rdx, qword [rbp + 0x12d0]
lea rcx, [rbp + 0x1118]
call fcn.14001a929
mov qword [rbp + 0x12d8], rax
mov rax, qword [rbp + 0x12d8]
mov qword [rbp + 0x12e0], rax
mov r8, qword [rbp + 0x1270]
mov rdx, qword [rbp + 0x12e0]
lea rcx, [rbp + 0x1158]
call fcn.14001a109
mov qword [rbp + 0x12e8], rax
mov rax, qword [rbp + 0x12e8]
mov qword [rbp + 0x12f0], rax
lea r8, [0x14005238c]
mov rdx, qword [rbp + 0x12f0]
lea rcx, [rbp + 0x1198]
call fcn.14001a929
mov qword [rbp + 0x12f8], rax
mov rcx, qword [rbp + 0x12f8]
call fcn.14001a10e
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, [rbp + 0x1198]
call fcn.14001a203
nop
lea rcx, [rbp + 0x1158]
call fcn.14001a203
nop
lea rcx, [rbp + 0x1118]
call fcn.14001a203
nop
lea rcx, [rbp + 0x10d8]
call fcn.14001a203
nop
lea rcx, [rbp + 0x1098]
call fcn.14001a203
nop
lea rcx, [rbp + 0x1058]
call fcn.14001a203
nop
lea rcx, [rbp + 0x1018]
call fcn.14001a203
nop
lea rcx, [rbp + 0xfd8]
call fcn.14001a203
nop
lea rcx, [rbp + 0xf98]
call fcn.14001a203
nop
lea rcx, [rbp + 0xf58]
call fcn.14001a203
nop
lea rcx, [rbp + 0xf18]
call fcn.14001a203
nop
lea rcx, [rbp + 0xed8]
call fcn.14001a203
nop
lea rdx, str._nChanging_motherboard_id__may_not_work_
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001a145
lea rdx, [0x14001a06e]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov dl, 0x20
lea rcx, [rbp + 0x11d8]
call fcn.14001a00a
mov qword [rbp + 0x1248], rax
mov rax, qword [rbp + 0x1248]
mov qword [rbp + 0x1250], rax
mov r8, qword [rbp + 0x1250]
lea rdx, str.AMIDEWINx64.EXE__SU
lea rcx, [rbp + 0x1218]
call fcn.14001aa28
mov qword [rbp + 0x1258], rax
mov rcx, qword [rbp + 0x1258]
call fcn.14001a10e
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, [rbp + 0x1218]
call fcn.14001a203
nop
lea rcx, [rbp + 0x11d8]
call fcn.14001a203
nop
lea rdx, str._n_nRestart_your_computer_
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001a145
lea rdx, [0x14001a06e]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0xe8]
call fcn.14001a203
nop
lea rcx, [rbp + 8]
call fcn.14001a9a6
nop
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x140051750]
call fcn.14001a852
mov eax, edi
mov rcx, qword [rbp + 0x1300]
xor rcx, rbp
call fcn.14001a4ce
lea rsp, [rbp + 0x1318]
pop rdi
pop rbp
ret