Function at 0x1400ed638
Capabilities:
Delete volume shadow copies
Enumerate files on windows
Enumerate processes
Execute command
Get common file path
Get disk information
Query or enumerate registry key
Read file on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x213e8]
mov eax, 0x214e8
call fcn.1401df8b0
sub rsp, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
lea rcx, [0x1402130e8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x1402130e8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtQueryKey
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.SeTakeOwnershipPrivilege
mov qword [0x140346320], rax
call 0x140000000
xor r13d, r13d
test eax, eax
jne 0x1400ed6b6
lea eax, [r13 + 1]
jmp 0x1400eecc3
lea rax, [rbp + 0x21448]
mov qword [rbp + 0x21448], r13
mov r15d, 0xf003f
mov qword [rsp + 0x20], rax
mov r14, 0xffffffff80000002
lea rdx, str.SYSTEMCurrentControlSetEnumDISPLAY
mov r9d, r15d
mov rcx, r14
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, 1
mov r12d, 0x208
test eax, eax
jne 0x1400ed92e
mov rsi, qword [rbp + 0x21448]
lea rcx, [rbp + 0x390]
mov r8d, r12d
xor edx, edx
call sub.VCRUNTIME140.dll_memset
xor r15d, r15d
mov dword [rbp + 0x21440], r12d
mov qword [rsp + 0x38], r15
lea r9, [rbp + 0x21440]
mov qword [rsp + 0x30], r15
lea r8, [rbp + 0x390]
mov qword [rsp + 0x28], r15
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x1400ed91c
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], r15
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x390]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400ed8d5
mov r14, qword [rsp + 0x48]
lea rcx, [rbp + 0x5a0]
mov r8, r12
xor edx, edx
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r12d, r15d
jmp 0x1400ed889
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r15
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x5a0]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400ed883
mov rbx, qword [rsp + 0x40]
lea rcx, [rbp + 0xde0]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov qword [rsp + 0x38], rax
xor edx, edx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
jmp 0x1400ed83a
lea rdx, str.device_parameters
lea rcx, [rbp + 0xde0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
xor ecx, ecx
test eax, eax
je 0x1400ed861
mov qword [rsp + 0x38], rcx
add r15d, edi
mov qword [rsp + 0x30], rcx
mov edx, r15d
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x21430]
mov dword [rbp + 0x21430], 0x208
lea r8, [rbp + 0xde0]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x1400ed806
jmp 0x1400ed877
lea r8, str.EDID
mov rcx, rbx
lea rdx, [rbp + 0xde0]
call 0x140000000
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r15d, r15d
add r12d, edi
mov edx, r12d
mov qword [rsp + 0x38], r15
lea r9, [rbp + 0x21438]
mov qword [rsp + 0x30], r15
lea r8, [rbp + 0x5a0]
mov qword [rsp + 0x28], r15
mov rcx, r14
mov qword [rsp + 0x20], r15
mov dword [rbp + 0x21438], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov rcx, r14
test eax, eax
je 0x1400ed7a6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r12d, 0x208
mov qword [rsp + 0x38], r15
lea r9, [rbp + 0x21440]
mov qword [rsp + 0x30], r15
lea r8, [rbp + 0x390]
add r13d, edi
mov qword [rsp + 0x28], r15
mov edx, r13d
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov dword [rbp + 0x21440], r12d
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x1400ed756
mov r14, 0xffffffff80000002
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r13d, r13d
mov r15d, 0xf003f
lea r8, str.SMBiosData
mov rcx, r14
lea rdx, str.SYSTEMCurrentControlSetServicesmssmbiosData
call 0x140000000
lea rax, [rbp + 0x21438]
mov qword [rbp + 0x21438], r13
mov r9d, r15d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMHardwareConfig
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400eda31
mov r8, r12
lea rcx, [rbp + 0x180]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rbx, qword [rbp + 0x21438]
lea r8, [rbp + 0x180]
mov rcx, rbx
lea rdx, str.LastConfig
mov r9d, r12d
call 0x140000000
mov r8, r12
lea rcx, [rbp + 0xde0]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov esi, r13d
jmp 0x1400ed9da
lea rdx, str.current
lea rcx, [rbp + 0xde0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400eda12
add esi, edi
mov edx, esi
mov qword [rsp + 0x38], r13
lea r9, [rbp + 0x21430]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0xde0]
mov qword [rsp + 0x28], r13
mov rcx, rbx
mov qword [rsp + 0x20], r13
mov dword [rbp + 0x21430], r12d
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x1400ed9be
jmp 0x1400eda28
lea r8, [rbp + 0x180]
mov rcx, rbx
lea rdx, [rbp + 0xde0]
call 0x140000000
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, str.ClientUUID
mov rcx, r14
lea rdx, str.SOFTWARENVIDIA_CorporationGlobal
call 0x140000000
lea r8, str.PersistenceIdentifier
mov rcx, r14
lea rdx, str.SOFTWARENVIDIA_CorporationGlobal
call 0x140000000
lea r8, str.ChipsetMatchID
mov rcx, r14
lea rdx, str.SOFTWARENVIDIA_CorporationGlobalCoProcManager
call 0x140000000
lea rdx, str.SYSTEMMountedDevices
mov rcx, r14
call 0x140000000
lea rdx, str.SOFTWAREMicrosoftDfrgStatistics
mov rcx, r14
call 0x140000000
mov rbx, 0xffffffff80000001
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBitBucketVolume
mov rcx, rbx
call 0x140000000
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerMountPoints2CPCVolume
mov rcx, rbx
call 0x140000000
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerMountPoints2
mov rcx, rbx
call 0x140000000
lea r8, str.LastEnum
mov rcx, rbx
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBitBucket
call 0x140000000
lea r8, str.WindowsAIKHash
mov rcx, r14
lea rdx, str.SYSTEMCurrentControlSetServicesTPMWMI
call 0x140000000
lea r8, str.WHQLClass
mov rcx, rbx
lea rdx, str.SoftwareMicrosoftDirect3D
call 0x140000000
lea r8, str.MSICache
mov rcx, rbx
lea rdx, str.SoftwareClassesInstallerDependencies
call 0x140000000
lea rax, [rbp + 0x21438]
mov qword [rbp + 0x21438], r13
mov r9d, r15d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystemMultifunctionAdapter0DiskController0DiskPeripheral
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400edbbf
mov rbx, qword [rbp + 0x21438]
lea rcx, [rbp + 0xde0]
mov r8, r12
xor edx, edx
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov esi, r13d
jmp 0x1400edb80
lea r8, str.Identifier
lea rdx, [rbp + 0xde0]
call 0x140000000
add esi, edi
mov edx, esi
mov qword [rsp + 0x38], r13
lea r9, [rbp + 0x21430]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0xde0]
mov qword [rsp + 0x28], r13
mov rcx, rbx
mov qword [rsp + 0x20], r13
mov dword [rbp + 0x21430], r12d
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov rcx, rbx
test eax, eax
je 0x1400edb69
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r13
mov r9d, r15d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.HARDWAREDEVICEMAPScsi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400edf1a
mov rsi, qword [rsp + 0x50]
lea rcx, [rbp + 0x180]
mov r8, r12
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], r13
lea r9, [rbp + 0x21448]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x180]
mov ebx, r13d
mov qword [rsp + 0x28], r13
xor edx, edx
mov qword [rsp + 0x20], r13
mov rcx, rsi
mov dword [rsp + 0x48], ebx
mov dword [rbp + 0x21448], r12d
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x1400edf11
lea rax, [rsp + 0x58]
mov qword [rsp + 0x58], r13
mov r9d, r15d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x180]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400edec8
mov r15, qword [rsp + 0x58]
lea rcx, [rbp + 0x390]
mov r8, r12
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], r13
lea r9, [rbp + 0x21440]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x390]
mov qword [rsp + 0x28], r13
xor edx, edx
mov rcx, r15
mov qword [rsp + 0x20], r13
mov r14d, r13d
mov dword [rsp + 0x40], r13d
mov dword [rbp + 0x21440], r12d
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x1400edeb9
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x390]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400ede70
mov rbx, qword [rsp + 0x60]
lea rcx, [rbp + 0xde0]
mov r8, r12
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], r13
lea r9, [rbp + 0x21438]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0xde0]
mov qword [rsp + 0x28], r13
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], r13
mov r12d, r13d
mov dword [rbp + 0x21438], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x1400ede61
lea rdx, str.arget
lea rcx, [rbp + 0xde0]
call sub.VCRUNTIME140.dll_wcsstr
test rax, rax
je 0x1400ede19
lea rax, [rsp + 0x68]
mov qword [rsp + 0x68], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0xde0]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400ede19
mov r14, qword [rsp + 0x68]
lea rcx, [rbp + 0x5a0]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
xor edx, edx
jmp 0x1400eddd2
lea r8, str.Identifier
lea rdx, [rbp + 0x5a0]
call 0x140000000
add r13d, edi
mov edx, r13d
xor eax, eax
mov dword [rbp + 0x21430], 0x208
mov qword [rsp + 0x38], rax
lea r9, [rbp + 0x21430]
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x5a0]
mov qword [rsp + 0x28], rax
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov rcx, r14
test eax, eax
je 0x1400eddb9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r13d, r13d
mov qword [rsp + 0x38], r13
lea r9, [rbp + 0x21438]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0xde0]
add r12d, edi
mov qword [rsp + 0x28], r13
mov edx, r12d
mov qword [rsp + 0x20], r13
mov rcx, rbx
mov dword [rbp + 0x21438], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x1400edd54
mov r14d, dword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r12d, 0x208
mov qword [rsp + 0x38], r13
lea r9, [rbp + 0x21440]
add r14d, edi
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
lea r8, [rbp + 0x390]
mov edx, r14d
mov qword [rsp + 0x20], r13
mov rcx, r15
mov dword [rsp + 0x40], r14d
mov dword [rbp + 0x21440], r12d
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x1400edccc
mov ebx, dword [rsp + 0x48]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r15d, 0xf003f
mov qword [rsp + 0x38], r13
lea r9, [rbp + 0x21448]
add ebx, edi
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
lea r8, [rbp + 0x180]
mov edx, ebx
mov qword [rsp + 0x20], r13
mov rcx, rsi
mov dword [rsp + 0x48], ebx
mov dword [rbp + 0x21448], r12d
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x1400edc45
mov r14, 0xffffffff80000002
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, str.RandomSeed
mov rcx, r14
lea rdx, str.SYSTEMCurrentControlSetServicesTPMODUID
call 0x140000000
lea r8, str.MachineGuid
mov rcx, r14
lea rdx, str.SOFTWAREMicrosoftCryptography
call 0x140000000
lea r8, str.HwProfileGuid
mov rcx, r14
lea rdx, str.SYSTEMCurrentControlSetControlIDConfigDBHardware_Profiles0001
call 0x140000000
lea rbx, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
mov rcx, r14
mov rdx, rbx
lea r8, str.AccountDomainSid
call 0x140000000
lea r8, str.PingID
mov rdx, rbx
mov rcx, r14
call 0x140000000
lea r8, str.SusClientId
mov rdx, rbx
mov rcx, r14
call 0x140000000
lea r8, str.SusClientIdValidation
mov rdx, rbx
mov rcx, r14
call 0x140000000
lea r8, str.Dhcpv6DUID
mov rcx, r14
lea rdx, str.SYSTEMCurrentControlSetServicesTcpip6Parameters
call 0x140000000
lea r8, str.ComputerHardwareId
mov rcx, r14
lea rdx, str.SYSTEMCurrentControlSetControlSystemInformation
call 0x140000000
lea r8, str.ComputerHardwareIds
mov rcx, r14
lea rdx, str.SYSTEMCurrentControlSetControlSystemInformation
call 0x140000000
lea r8, str.IE_Installed_Date
mov rcx, r14
lea rdx, str.SOFTWAREMicrosoftInternet_ExplorerMigration
call 0x140000000
lea r8, str.MachineId
mov rcx, r14
lea rdx, str.SOFTWAREMicrosoftSQMClient
call 0x140000000
lea r8, str.WinSqmFirstSessionStartTime
mov rcx, r14
lea rdx, str.SOFTWAREMicrosoftSQMClient
call 0x140000000
lea rbx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, r14
mov rdx, rbx
lea r8, str.InstallTime
call 0x140000000
lea r8, str.InstallDate
mov rdx, rbx
mov rcx, r14
call 0x140000000
lea r8, str.DigitalProductId
mov rdx, rbx
mov rcx, r14
call 0x140000000
lea r8, str.DigitalProductId4
mov rdx, rbx
mov rcx, r14
call 0x140000000
lea r8, str.BuildGUID
mov rdx, rbx
mov rcx, r14
call 0x140000000
lea r8, str.ProductId
mov rdx, rbx
mov rcx, r14
call 0x140000000
lea r8, str.BuildLab
mov rdx, rbx
mov rcx, r14
call 0x140000000
lea r8, str.BuildLabEx
mov rdx, rbx
mov rcx, r14
call 0x140000000
lea r8, str._DriverProviderInfo
mov rcx, r14
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000
call 0x140000000
lea r8, str.UserModeDriverGUID
mov rcx, r14
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000
call 0x140000000
lea rax, [rbp + 0x21438]
mov qword [rbp + 0x21438], r13
mov r9d, r15d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e972_e325_11ce_bfc1_08002be10318
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400ee1e5
mov rbx, qword [rbp + 0x21438]
lea rcx, [rbp + 0xde0]
mov r8, r12
xor edx, edx
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov esi, r13d
jmp 0x1400ee1a2
lea rdx, str.configuration
lea rcx, [rbp + 0xde0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400ee19e
lea rdx, str.properties
lea rcx, [rbp + 0xde0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400ee19e
lea r8, str.NetworkAddress
mov rcx, rbx
lea rdx, [rbp + 0xde0]
call 0x140000000
lea r8, str.NetworkInterfaceInstallTimestamp
mov rcx, rbx
lea rdx, [rbp + 0xde0]
call 0x140000000
add esi, edi
mov edx, esi
mov qword [rsp + 0x38], r13
lea r9, [rbp + 0x21430]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0xde0]
mov qword [rsp + 0x28], r13
mov rcx, rbx
mov qword [rsp + 0x20], r13
mov dword [rbp + 0x21430], r12d
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x1400ee142
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionDiagnosticsDiagTrackSettingsRequests
mov rcx, r14
call 0x140000000
lea r8, str.LastEventlogWrittenTime
mov rcx, r14
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionDiagnosticsDiagTrackSevilleEventlogManager
call 0x140000000
lea r8, str.ProductActivationTime
mov rcx, r14
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatformActivation
call 0x140000000
lea rbx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform
mov rcx, r14
mov rdx, rbx
lea r8, str.BackupProductKeyDefault
call 0x140000000
lea r8, str.actionlist
mov rdx, rbx
mov rcx, r14
call 0x140000000
lea r8, str.ServiceSessionId
mov rdx, rbx
mov rcx, r14
call 0x140000000
mov rbx, 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist
mov rcx, rbx
call 0x140000000
lea rdx, str.SoftwareHex_RaysIDAHistory
mov rcx, rbx
call 0x140000000
lea rdx, str.SoftwareHex_RaysIDAHistory64
mov rcx, rbx
call 0x140000000
lea rax, [rbp + 0x21438]
mov qword [rbp + 0x21438], r13
mov r9d, r15d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.HARDWAREUEFIESRT
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400ee3aa
mov r14, qword [rbp + 0x21438]
lea rcx, [rbp + 0xde0]
xor edx, edx
mov r8d, 0x205f8
call sub.VCRUNTIME140.dll_memset
mov r8, r12
mov ebx, r13d
xor edx, edx
lea rcx, [rbp + 0x180]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
jmp 0x1400ee319
mov eax, ebx
lea rdx, [rbp + 0x180]
imul rcx, rax, 0x208
lea rax, [rbp + 0xde0]
add rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
add ebx, edi
mov edx, ebx
mov qword [rsp + 0x38], r13
lea r9, [rbp + 0x21430]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x180]
mov qword [rsp + 0x28], r13
mov rcx, r14
mov qword [rsp + 0x20], r13
mov dword [rbp + 0x21430], r12d
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x1400ee2f5
test ebx, ebx
je 0x1400ee3a1
lea rsi, [rbp + 0xde0]
mov r8, r12
lea rcx, [rbp + 0x180]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rdx, rsi
lea rcx, [rbp + 0x180]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
lea rcx, [rbp + 0x180]
call 0x140000000
lea r8, [rbp + 0x180]
mov rdx, rsi
mov rcx, r14
call 0x140000000
add rsi, r12
sub rbx, rdi
jne 0x1400ee35a
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8, r12
lea rcx, [rsp + 0x70]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r8, r12
lea rcx, [rbp + 0x9c0]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r8, r12
lea rcx, [rbp + 0xbd0]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r8, r12
lea rcx, [rbp + 0x7b0]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x9c0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xor r8d, r8d
lea rax, [rbp + 0xbd0]
mov r9d, edi
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r8 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xor r8d, r8d
lea rax, [rbp + 0x7b0]
mov r9d, edi
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r8 + 0x1c]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea r8, [rbp + 0x9c0]
lea rdx, str._ws
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfA]
xor edx, edx
lea rcx, [rbp + 0xde0]
mov r8d, 0x140
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0xde0]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
lea rdx, [0x1402022b4]
lea rcx, [rbp + 0xe0c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x1400ee4d6
lea rdx, [0x1402022b8]
lea rcx, [rbp + 0xe0c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x1400ee4d6
lea r9, [rbp + 0xe0c]
lea r8, [rbp + 0x9c0]
lea rdx, str._ws_ws
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x70]
call 0x140000000
lea rdx, [rbp + 0xde0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1400ee47c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea r8, [rbp + 0x7b0]
lea rdx, str._wsD3DSCache
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x70]
call 0x140000000
lea r8, [rbp + 0x7b0]
lea rdx, str._wsNVIDIA_CorporationGfeSDK
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x70]
call 0x140000000
lea r8, [rbp + 0x7b0]
lea rdx, str._wsMicrosoftFeeds
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x70]
call 0x140000000
lea r8, [rbp + 0x7b0]
lea rdx, str._wsMicrosoftFeeds_Cache
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x70]
call 0x140000000
lea r8, [rbp + 0x7b0]
lea rdx, str._wsMicrosoftWindowsINetCache
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x70]
call 0x140000000
lea r8, [rbp + 0x7b0]
lea rdx, str._wsMicrosoftWindowsINetCookies
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x70]
call 0x140000000
lea r8, [rbp + 0x7b0]
lea rdx, str._wsMicrosoftWindowsWebCache
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x70]
call 0x140000000
lea r8, [rbp + 0x7b0]
lea rdx, str._wsMicrosoftXboxLiveAuthStateCache.dat
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x70]
call 0x140000000
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov r12d, eax
mov esi, 0x43
test eax, eax
je 0x1400eebfb
test dil, r12b
je 0x1400eebf2
mov r8d, esi
lea rdx, [0x1402024b8]
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfA]
xor r9d, r9d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0x70]
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x1400ee764
xor edx, edx
lea rcx, [rbp + 0xde0]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
lea r9, [rbp + 0x21430]
mov dword [rbp + 0x21430], r13d
mov r8d, 0x200
mov qword [rsp + 0x20], r13
lea rdx, [rbp + 0xde0]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400ee75b
cmp dword [rbp + 0x21430], 0x200
jne 0x1400ee75b
mov ebx, r13d
lea r14, [0x14033eb50]
mov rcx, qword [r14]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rdx, qword [r14]
lea rcx, [rbp + 0xde0]
mov r8, rax
mov eax, dword [r14 + 8]
add rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400ee709
add ebx, edi
add r14, 0x10
cmp ebx, 3
jb 0x1400ee6d7
jmp 0x1400ee75b
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ebx, eax
shl ebx, 0x10
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ecx, dword [r14 + 0xc]
xor r9d, r9d
add eax, ebx
xor r8d, r8d
xor edx, edx
mov dword [rbp + rcx + 0xde0], eax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x1400ee75b
xor r9d, r9d
mov qword [rsp + 0x20], r13
mov r8d, 0x200
lea rdx, [rbp + 0xde0]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, esi
lea rdx, str._c:WindowsSystem32_restoreMachineGuid.txt
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x70]
call 0x140000000
mov r8d, esi
lea rdx, str._c:UsersPublicLibrariescollection.dat
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x70]
call 0x140000000
mov r8d, esi
lea rdx, str._c:System_Volume_InformationIndexerVolumeGuid
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x70]
call 0x140000000
mov r8d, esi
lea rdx, str._c:System_Volume_InformationWPSettings.dat
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x70]
call 0x140000000
mov r8d, esi
lea rdx, str._c:System_Volume_Information_tracking.log
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x70]
call 0x140000000
mov r8d, esi
lea rdx, str._c:ProgramDataMicrosoftWindowsWER
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x70]
call 0x140000000
mov r8d, esi
lea rdx, str._c:UsersPublicShared_Files
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x70]
call 0x140000000
mov r8d, esi
lea rdx, str._c:WindowsINF_setupapi.dev.log
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x70]
call 0x140000000
mov r8d, esi
lea rdx, str._c:WindowsINF_setupapi.setup.log
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x70]
call 0x140000000
mov r8d, esi
lea rdx, str._c:UsersPublicLibraries
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x70]
call 0x140000000
mov r8d, esi
lea rdx, str._c:MSOCache
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x70]
call 0x140000000
mov r8d, esi
lea rdx, str._c:ProgramData_ntuser.pol
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x70]
call 0x140000000
mov r8d, esi
lea rdx, str._c:UsersDefaultNTUSER.DAT
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x70]
call 0x140000000
mov r8d, esi
lea rdx, str._c:Recovery_ntuser.sys
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x70]
call 0x140000000
mov r8d, esi
lea rdx, str._c:desktop.ini
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x70]
call 0x140000000
mov r8d, esi
lea rdx, str._c:WindowsPrefetch
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfA]
xor edx, edx
lea rcx, [rbp + 0xde0]
mov r8d, 0x140
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0xde0]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
lea rdx, [0x1402022b4]
lea rcx, [rbp + 0xe0c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x1400ee9c9
lea rdx, [0x1402022b8]
lea rcx, [rbp + 0xe0c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x1400ee9c9
lea r9, [rbp + 0xe0c]
mov r8d, esi
lea rdx, str._c:WindowsPrefetch_ws
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x70]
call 0x140000000
lea rdx, [rbp + 0xde0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1400ee973
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r8d, esi
lea rdx, [0x140202960]
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfA]
xor edx, edx
lea rcx, [rbp + 0xde0]
mov r8d, 0x140
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0xde0]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r14, rax
lea rdx, [0x1402022b4]
lea rcx, [rbp + 0xe0c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x1400eeb72
lea rdx, [0x1402022b8]
lea rcx, [rbp + 0xe0c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x1400eeb72
test byte [rbp + 0xde0], 0x10
je 0x1400eeb72
xor edx, edx
lea rcx, [rbp + 0x180]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0xe0c]
lea rcx, [rbp + 0x180]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
lea r9, [rbp + 0x180]
mov r8d, esi
lea rdx, str._c:Users_ws
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfA]
xor edx, edx
lea rcx, [rbp + 0x5a0]
mov r8d, 0x140
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x5a0]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
lea rdx, [0x1402022b4]
lea rcx, [rbp + 0x5cc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x1400eeb51
lea rdx, [0x1402022b8]
lea rcx, [rbp + 0x5cc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x1400eeb51
lea rdx, str.ntuser
lea rcx, [rbp + 0x5cc]
call qword [sym.imp.SHLWAPI.dll_StrStrA]
test rax, rax
je 0x1400eeb51
lea rax, [rbp + 0x5cc]
mov r8d, esi
lea r9, [rbp + 0x180]
mov qword [rsp + 0x20], rax
lea rdx, str._c:Users_ws_ws
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x70]
call 0x140000000
lea rdx, [rbp + 0x5a0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1400eead6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, [rbp + 0xde0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1400eea24
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r8d, esi
lea rdx, str._c:Users
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, str.desktop.ini
lea rcx, [rsp + 0x70]
call 0x140000000
xor edx, edx
lea rcx, [rbp + 0x390]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
mov r8d, esi
lea rdx, str.fsutil_usn_deletejournal__d__c:
lea rcx, [rbp + 0x390]
call fcn.1400a7a34
lea rcx, [rbp + 0x390]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esi, edi
shr r12d, 1
jne 0x1400ee621
lea rcx, str.vssadmin_delete_shadows__All__Quiet
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
test rax, rax
je 0x1400eecb4
xor edx, edx
lea rcx, [rbp + 0x394]
mov r8d, Ordinal_301
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x390]
mov dword [rbp + 0x390], 0x130
mov rcx, rbx
call sub.KERNEL32.dll_Process32First
jmp 0x1400eec74
lea rdx, str.WmiPrvSE.exe
lea rcx, [rbp + 0x3bc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400eec7a
lea rdx, [rbp + 0x390]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1400eec4d
jmp 0x1400eecab
mov r8d, dword [rbp + 0x398]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400eecab
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.net_stop_winmgmt__Y
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
add rsp, 0x214e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret