Function at 0x1400405f0
Capabilities:
Delete volume shadow copies

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x1401c10c0]
xor rax, rsp
mov qword [rbp + 0x47], rax
lea rcx, [rbp + 0x27]
call fcn.14003f9e0
nop
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.ComputerHKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlIDConfigDBHardware_Profiles0001
mov rcx, 0xffffffff80000002
call qword [0x140133020]
test eax, eax
jne 0x1400406b6
mov eax, dword [rbp + 0x37]
inc eax
lea rcx, [rbp + 0x27]
cmp qword [rbp + 0x3f], 0xf
cmova rcx, qword [rbp + 0x27]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.HwProfileGuid
mov rcx, qword [rbp - 9]
call qword [0x1401330c8]
xor ecx, ecx
test eax, eax
jne 0x140040692
mov r9d, 0x40
lea r8, str.Success
lea rdx, str.HwProfileGuid_successfully_updated_
jmp 0x1400406a6
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Could_not_set_registry_value.
call qword [0x140133800]
mov rcx, qword [rbp - 9]
call qword [0x140133010]
lea rcx, [rbp + 7]
call fcn.1400400e0
lea rax, [rbp - 1]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.ComputerHKEY_LOCAL_MACHINESOFTWAREMicrosoftCryptography
mov rcx, 0xffffffff80000002
call qword [0x140133020]
test eax, eax
jne 0x14004075f
mov eax, dword [rbp + 0x17]
inc eax
lea rcx, [rbp + 7]
cmp qword [rbp + 0x1f], 0xf
cmova rcx, qword [rbp + 7]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.MachineGuid
mov rcx, qword [rbp - 1]
call qword [0x1401330c8]
xor ecx, ecx
test eax, eax
jne 0x14004073b
mov r9d, 0x40
lea r8, str.Success
lea rdx, str.MachineGuid_successfully_updated_
jmp 0x14004074f
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Could_not_set_registry_value.
call qword [0x140133800]
mov rcx, qword [rbp - 9]
call qword [0x140133010]
lea rax, [rbp - 1]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.ComputerHKEY_LOCAL_MACHINESOFTWAREMicrosoftCryptography
mov rcx, 0xffffffff80000002
call qword [0x140133020]
test eax, eax
jne 0x1400407ff
mov eax, dword [rbp + 0x17]
inc eax
lea rcx, [rbp + 7]
cmp qword [rbp + 0x1f], 0xf
cmova rcx, qword [rbp + 7]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.GUID
mov rcx, qword [rbp - 1]
call qword [0x1401330c8]
xor ecx, ecx
test eax, eax
jne 0x1400407db
mov r9d, 0x40
lea r8, str.Success
lea rdx, str.GUID_successfully_updated_
jmp 0x1400407ef
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Could_not_set_registry_value.
call qword [0x140133800]
mov rcx, qword [rbp - 9]
call qword [0x140133010]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMSYSTEMCurrentControlSetControlComputerNameComputerName__v_ComputerName__t_REG_SZ__d__Random___f__nul
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMSYSTEMCurrentControlSetControlComputerNameActiveComputerName__v_ComputerName__t_REG_SZ__d__Random___f__nul
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMSYSTEMCurrentControlSetControlSystemInformation__v_ComputerHardwareId__t_REG_SZ__d__Random__Random___Random__Random___Random__Random___f__nul
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMSYSTEMCurrentControlSetControlIDConfigDBHardware___Profiles0001__v_HwProfileGuid__t_REG_SZ__d__Random__Random___Random__Random___Random__Random___f__nul
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMSOFTWAREMicrosoftSQMClient__v_MachineId__t_REG_SZ__d__Random__Random___Random__Random___Random__Random___f__nul
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_InstallTime__t_REG_QWORD__d__Random__Random___Random__Random___Random__Random___f
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_InstallDate__t_REG_QWORD__d__Random__Random___Random__Random___Random__Random___f
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMSOFTWAREMicrosoftCryptography__v_MachineGuid__t_REG_SZ__d__Random__Random___Random__Random___Random__Random___f__nul
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMSOFTWAREMicrosoftCryptography__v_GUID__t_REG_SZ__d__Random__Random___Random__Random___Random__Random___f__nul
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMSOFTWARENVIDIA___CorporationGlobal__v_ClientUUID__t_REG_SZ__d__Random__Random___Random__Random___Random__Random___f
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMHARDWAREDEVICEMAPScsiScsi___Port___0Scsi___Bus___0Target___Id___0Logical___Unit___Id___0__v_Identifier__t_REG_SZ__d__Random__Random___Random__Random___Random__Random___f
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMHARDWAREDEVICEMAPScsiScsi___Port___1Scsi___Bus___0Target___Id___0Logical___Unit___Id___0__v_Identifier__t_REG_SZ__d__Random__Random___Random__Random___Random__Random___f
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMHARDWAREDESCRIPTIONSystemMultifunctionAdapter0DiskController0DiskPeripheral0__v_Identifier__t_REG_SZ__d__Random__Random___Random__Random___Random__Random___f
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMHARDWAREDESCRIPTIONSystemMultifunctionAdapter0DiskController0DiskPeripheral1__v_Identifier__t_REG_SZ__d__Random__Random___Random__Random___Random__Random___f
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMSYSTEMControlSet001ServicesBasicDisplayVideo__v_VideoID__t_REG_SZ__d__Random__Random___Random__Random___Random__Random___f__nul
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMSYSTEMCurrentControlSetServicesTcpipParameters__v_Hostname__t_REG_SZ__d__Random__Random___Random__Random___Random__Random___f__nul
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMSystemCurrentControlSetServicesTcpipParameters__v_Domain__t_REG_SZ__d__Random__Random___Random__Random___Random__Random___f__nul
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMSystemCurrentControlSetControlDevQuery6__v_UUID__t_REG_SZ__d_Random__Random___Random__Random___Random__Random___f__nul
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMSYSTEMCurrentControlSetServicesTcpipParameters__v_NV___Hostname__t_REG_SZ__d__Random__Random___Random__Random___Random__Random___f
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_ProductId__t_REG_SZ__d__Random__Random___Random__Random___Random__Random___f__nul
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_BuildGUID__t_REG_SZ__d__Random__Random___Random__Random___Random__Random___f__nul
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_sc_stop_winmgmt__nul
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_sc_start_winmgmt__nul
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_net_stop_winmgmt__y__nul
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_net_start_winmgmt__y__nul
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_powershell_vssadmin_delete_shadows__all__nul
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_powershell_Reset_PhysicalDisk___nul
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_fsutil_usn_deletejournal__n_C:__nul
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_fsutil_usn_deletejournal__n_D:__nul
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_fsutil_usn_deletejournal__n_E:__nul
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_fsutil_usn_deletejournal__n_F:__nul
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_del__s__f__q_C:WindowsSystem32_restoreMachineGuid.txt__nul
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_del__s__f__q_C:System_Volume_InformationIndexerVolumeGuid__nul
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_del__s__f__q_C:System_Volume_Information_tracking.log__nul
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_del__s__f__q_C:WindowsINF_setupapi.dev.log__nul
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_del__s__f__q_C:WindowsINF_setupapi.setup.log__nul
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_rmdir__s__q_C:Windows_temp__nul
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_rmdir__s__q_C:Users_username_AppDataLocalTemp__nul
call qword [0x140133cb8]
lea rcx, str.START__B_cmd__c_rmdir__s__q_C:WindowsPrefetch__nul
call qword [0x140133cb8]
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x140040a38
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040a33
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140040a33
call qword [0x140133ce8]
int3
call fcn.14012cdb4
movdqa xmm0, xmmword [0x1401a3c10]
movdqu xmmword [rbp + 0x17], xmm0
mov byte [rbp + 7], 0
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0xf
jbe 0x140040a87
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040a82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140040a82
call qword [0x140133ce8]
int3
call fcn.14012cdb4
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14012c680
add rsp, 0x90
pop rbp
ret