Function at 0x14002d380
Capabilities:
Delete registry key
Delete registry value
Encode data using xor
Execute command
Set console window title

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0x5f]
sub rsp, 0x90
mov rax, qword [0x14003f040]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov qword [r11 + 8], rbx
lea rcx, str.bypass__tpm.msc
mov qword [r11 + 0x10], rdi
movaps xmmword [rsp + 0x70], xmm7
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ecx, 0xfffffff5
mov ebx, 0xb
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movups xmm3, xmmword [str._YPNeZRL]
movzx eax, byte [0x1400391e4]
xor ebx, ebx
mov edi, dword [0x14003f090]
mov ecx, ebx
mov edx, dword [0x1400391e0]
movdqa xmm7, xmmword [0x14003a860]
mov dword [rbp + 0x27], edx
mov byte [rbp + 0x2b], al
movups xmmword [rbp + 0x17], xmm3
cmp edi, 2
jl 0x14002d60c
movdqa xmm4, xmmword [0x14003a880]
movdqa xmm2, xmmword [0x14003a800]
movdqa xmm5, xmmword [str.1111]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
movd eax, xmm3
movdqa xmm3, xmmword [0x14003a820]
movaps xmmword [rsp + 0x80], xmm6
movdqa xmm6, xmmword [0x14003a870]
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, eax
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm6
xorps xmm2, xmm0
movd dword [rbp + 0x17], xmm2
movdqa xmm2, xmmword [0x14003a810]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm3
pmulld xmm0, xmm5
psubd xmm2, xmm0
punpckldq xmm1, xmm3
movd xmm0, dword [rbp + 0x1b]
andps xmm2, xmm7
pmuldq xmm1, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm6
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rbp + 0x1b], xmm2
movdqa xmm2, xmmword [0x14003a830]
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm2
pmulld xmm0, xmm5
psubd xmm3, xmm0
punpckldq xmm1, xmm2
movd xmm0, dword [rbp + 0x1f]
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
pmuldq xmm1, xmm4
paddb xmm3, xmm6
xorps xmm3, xmm0
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
movd dword [rbp + 0x1f], xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
movdqa xmm3, xmmword [0x14003a840]
psubd xmm2, xmm0
movd xmm0, dword [rbp + 0x23]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
andps xmm2, xmm7
packuswb xmm2, xmm2
mov ecx, 0x14
packuswb xmm2, xmm2
paddb xmm2, xmm6
pmuldq xmm1, xmm4
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rbp + 0x23], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm3, xmm0
movd xmm0, edx
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmm6
movaps xmm6, xmmword [rsp + 0x80]
xorps xmm3, xmm0
movd dword [rbp + 0x27], xmm3
mov eax, ecx
lea r8, [rbp + 0x17]
add r8, rax
nop word [rax + rax]
mov eax, 0x5397829d
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x31
movzx eax, cl
inc ecx
sub al, dl
add al, 0x37
xor byte [r8 - 1], al
cmp ecx, 0x15
jl 0x14002d620
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp + 0x17]
call fcn.14002a6c0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14001a540
mov rdx, qword [0x1400bcb40]
lea rcx, [rbp + 0x17]
mov qword [rsp + 0x48], rcx
xor r9d, r9d
lea rcx, [fcn.14002d370]
mov qword [0x1400bcb20], rax
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov byte [rsp + 0x38], bl
mov rcx, rax
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], bl
mov dword [rbp + 0x17], ebx
call fcn.1400290d0
mov rcx, qword [0x1400bcb20]
test rax, rax
jne 0x14002d6cb
call fcn.14001b870
mov rcx, qword [0x1400bcb20]
call fcn.14001b870
movzx eax, word [0x1400391f4]
cmp edi, 2
movsd xmm0, qword [str.dHVU_]
mov ecx, dword [0x1400391f0]
mov r9, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rdi, qword [rsp + 0xa8]
mov word [rbp + 0x23], ax
movzx eax, byte [0x1400391f6]
mov byte [rbp + 0x25], al
mov dword [rbp + 0x1f], ecx
movsd qword [rbp + 0x17], xmm0
jl 0x14002d853
movdqa xmm4, xmmword [0x14003a880]
mov ebx, 0xc
movdqa xmm3, xmmword [0x14003a800]
movdqa xmm2, xmmword [0x14003a810]
movdqa xmm1, xmm3
movdqa xmm5, xmmword [str.1111]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
mov eax, dword [0x14003a870]
punpckldq xmm1, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm2
pmulld xmm0, xmm5
psubd xmm3, xmm0
punpckldq xmm1, xmm2
andps xmm3, xmm7
pmuldq xmm1, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, eax
paddb xmm3, xmm0
movd xmm0, dword [str.dHVU_]
xorps xmm3, xmm0
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
movd dword [rbp + 0x17], xmm3
movdqa xmm3, xmmword [0x14003a820]
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movd xmm1, dword [rbp + 0x1b]
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, eax
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
xorps xmm2, xmm1
movdqa xmm1, xmm3
pmuldq xmm0, xmm4
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd dword [rbp + 0x1b], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movd xmm1, ecx
pmulld xmm0, xmm5
psubd xmm3, xmm0
movd xmm0, eax
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmm0
xorps xmm3, xmm1
movd dword [rbp + 0x1f], xmm3
movaps xmm7, xmmword [rsp + 0x70]
lea r8, [rbp + 0x17]
mov eax, ebx
add r8, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x5397829d
lea r8, [r8 + 1]
imul ebx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x31
movzx eax, bl
inc ebx
sub al, dl
add al, 0x37
xor byte [r8 - 1], al
cmp ebx, 0xf
jl 0x14002d870
mov rbx, qword [rsp + 0xa0]
lea rdx, [rbp + 0x17]
mov rcx, r9
call fcn.14002a6c0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x1400391c9], 0
movzx eax, word [0x1400391c8]
mov word [rbp + 0x17], ax
je 0x14002d8d8
xor byte [rbp + 0x18], 0x38
mov byte [rbp + 0x17], 0xa
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp + 0x17]
call fcn.14002a6c0
lea rcx, [0x14003920c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rbp + 0x17]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesTPMWMI
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14002d93a
mov rcx, qword [rbp + 0x17]
lea rdx, str.WindowsAIKHash
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x17]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesTPMWMI
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14002d97f
mov rcx, qword [rbp + 0x17]
lea rdx, str.TaskManufacturerId
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x17]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesTPMWMI
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14002d9c4
mov rcx, qword [rbp + 0x17]
lea rdx, str.TaskInformationFlags
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.SYSTEMCurrentControlSetServicesTPMWMITaskStates
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea rdx, str.SYSTEMCurrentControlSetServicesTPMWMIPlatformQuoteKeys
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea rdx, str.SYSTEMCurrentControlSetServicesTPMWMIEndorsementEKCertStoreECCCertificates
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea rax, [rbp + 0x17]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesTPMWMIEndorsement
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14002da45
mov rcx, qword [rbp + 0x17]
lea rdx, str.EkRetryLast
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x17]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesTPMWMIEndorsement
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14002da8a
mov rcx, qword [rbp + 0x17]
lea rdx, str.EKPub
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x17]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesTPMWMIEndorsement
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14002dacf
mov rcx, qword [rbp + 0x17]
lea rdx, str.EkNoFetch
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x17]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesTPMWMIEndorsement
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14002db14
mov rcx, qword [rbp + 0x17]
lea rdx, str.EkTries
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x17]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesTPMParametersWdf
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14002db59
mov rcx, qword [rbp + 0x17]
lea rdx, str.TimeOfLastTelemetry
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x17]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesTPMWMIAdmin
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14002db9e
mov rcx, qword [rbp + 0x17]
lea rdx, str.SRKPub
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.SYSTEMCurrentControlSetServicesTPMWMIUser
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea rdx, str.SYSTEMCurrentControlSetServicesTPMKeyAttestationKeys
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea rdx, str.SYSTEMCurrentControlSetServicesTPMEnum
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea rdx, str.SYSTEMCurrentControlSetServicesTPMODUID
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
xor eax, eax
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14002dc20
add rsp, 0x90
pop rbp
ret