Function at 0x140004820
Capabilities:
Contain obfuscated stackstrings
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x14009b020]
xor rax, rsp
mov qword [rbp + 0x50], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov ecx, 0x26
mov dword [rsp + 0x30], 0x7a0026
mov dword [rsp + 0x34], 0x430054
mov dword [rsp + 0x38], 0x4f0041
mov dword [rsp + 0x3c], 0x520055
mov dword [rsp + 0x40], 0x5f0054
mov dword [rsp + 0x44], 0x4b007a
mov dword [rsp + 0x48], 0x450047
mov dword [rsp + 0x4c], 0x4f004e
mov dword [rsp + 0x50], 0x430048
mov dword [rsp + 0x54], 0x75007a
mov dword [rsp + 0x58], 0x75007f
mov dword [rsp + 0x5c], 0x630072
mov dword [rsp + 0x60], 0x7a006b
mov dword [rsp + 0x64], 0x530065
mov dword [rsp + 0x68], 0x540054
mov dword [rsp + 0x6c], 0x480043
mov dword [rsp + 0x70], 0x650052
mov dword [rsp + 0x74], 0x480049
mov dword [rsp + 0x78], 0x540052
mov dword [rsp + 0x7c], 0x4a0049
mov dword [rbp - 0x80], 0x430075
mov dword [rbp - 0x7c], 0x7a0052
mov dword [rbp - 0x78], 0x430075
mov dword [rbp - 0x74], 0x500054
mov dword [rbp - 0x70], 0x45004f
mov dword [rbp - 0x6c], 0x550043
mov dword [rbp - 0x68], 0x26007a
movzx eax, word [0x140094afa]
xor ax, cx
mov word [rbp - 0x64], ax
movzx eax, word [0x140094afc]
xor ax, cx
mov word [rbp - 0x62], ax
movzx eax, word [0x140094afe]
xor ax, cx
mov word [rbp - 0x60], ax
movzx eax, word [str.SYSTEMCurrentControlSetServices_]
xor ax, cx
mov word [rbp - 0x5e], ax
movzx eax, word [0x140094b02]
xor ax, cx
mov word [rbp - 0x5c], ax
movzx eax, word [0x140094b04]
xor ax, cx
mov word [rbp - 0x5a], ax
movzx eax, word [0x140094b06]
xor ax, cx
mov word [rbp - 0x58], ax
movzx eax, word [0x140094b08]
xor ax, cx
mov word [rbp - 0x56], ax
movzx eax, word [0x140094b0a]
xor ax, cx
mov word [rbp - 0x54], ax
movzx eax, word [0x140094b0c]
xor ax, cx
mov word [rbp - 0x52], ax
movzx eax, word [0x140094b0e]
xor ax, cx
mov word [rbp - 0x50], ax
movzx eax, word [0x140094b10]
xor ax, cx
mov word [rbp - 0x4e], ax
movzx eax, word [0x140094b12]
xor ax, cx
mov word [rbp - 0x4c], ax
movzx eax, word [0x140094b14]
xor ax, cx
mov word [rbp - 0x4a], ax
movzx eax, word [0x140094b16]
xor ax, cx
mov word [rbp - 0x48], ax
movzx eax, word [0x140094b18]
xor ax, cx
mov word [rbp - 0x46], ax
movzx eax, word [0x140094b1a]
xor ax, cx
mov word [rbp - 0x44], ax
movzx eax, word [0x140094b1c]
xor ax, cx
mov word [rbp - 0x42], ax
movzx eax, word [0x140094b1e]
xor ax, cx
mov word [rbp - 0x40], ax
movzx eax, word [0x140094b20]
xor ax, cx
mov word [rbp - 0x3e], ax
movzx eax, word [0x140094b22]
xor ax, cx
mov word [rbp - 0x3c], ax
movzx eax, word [0x140094b24]
xor ax, cx
mov word [rbp - 0x3a], ax
movzx eax, word [0x140094b26]
xor ax, cx
mov word [rbp - 0x38], ax
movzx eax, word [0x140094b28]
xor ax, cx
mov word [rbp - 0x36], ax
movzx eax, word [0x140094b2a]
xor ax, cx
mov word [rbp - 0x34], ax
movzx eax, word [0x140094b2c]
xor ax, cx
mov word [rbp - 0x32], ax
movzx eax, word [0x140094b2e]
xor ax, cx
mov word [rbp - 0x30], ax
movzx eax, word [0x140094b30]
xor ax, cx
mov word [rbp - 0x2e], ax
movzx eax, word [0x140094b32]
xor ax, cx
mov word [rbp - 0x2c], ax
movzx eax, word [0x140094b34]
xor ax, cx
mov word [rbp - 0x2a], ax
movzx eax, word [0x140094b36]
xor ax, cx
mov word [rbp - 0x28], ax
movzx eax, word [0x140094b38]
xor ax, cx
mov word [rbp - 0x26], ax
movzx eax, word [0x140094b3a]
xor ax, cx
mov word [rbp - 0x24], ax
movzx eax, word [0x140094b3c]
xor ax, cx
mov word [rbp - 0x22], ax
movzx eax, word [0x140094b3e]
xor ax, cx
mov word [rbp - 0x20], ax
movzx eax, word [0x140094b40]
xor ax, cx
mov word [rbp - 0x1e], ax
movzx eax, word [0x140094b42]
xor ax, cx
mov word [rbp - 0x1c], ax
movzx eax, word [0x140094b44]
xor ax, cx
mov word [rbp - 0x1a], ax
movzx eax, word [0x140094b46]
xor ax, cx
mov word [rbp - 0x18], ax
movzx eax, word [str._ntoskrnl.exe]
xor ax, cx
mov word [rbp - 0x16], ax
movzx eax, word [0x140094b4a]
xor ax, cx
mov word [rbp - 0x14], ax
movzx eax, word [0x140094b4c]
xor ax, cx
mov word [rbp - 0x12], ax
movzx eax, word [0x140094b4e]
xor ax, cx
mov word [rbp - 0x10], ax
movzx eax, word [0x140094b50]
xor ax, cx
mov word [rbp - 0xe], ax
movzx eax, word [0x140094b52]
xor ax, cx
mov word [rbp - 0xc], ax
movzx eax, word [0x140094b54]
xor ax, cx
mov word [rbp - 0xa], ax
movzx eax, word [0x140094b56]
xor ax, cx
mov word [rbp - 8], ax
movzx eax, word [str.win32kbase.sys]
xor ax, cx
mov word [rbp - 6], ax
movzx eax, word [0x140094b5a]
xor ax, cx
mov word [rbp - 4], ax
movzx eax, word [0x140094b5c]
xor ax, cx
mov word [rbp - 2], ax
movzx eax, word [0x140094b5e]
xor ax, cx
mov word [rbp], ax
movzx eax, word [0x140094b60]
xor ax, cx
mov word [rbp + 2], ax
xor eax, eax
mov word [rbp + 4], ax
xor r14d, r14d
nop dword [rax]
xor word [rsp + rax*2 + 0x32], cx
inc rax
cmp rax, 0x69
jae 0x140004c25
movzx ecx, word [rsp + 0x30]
jmp 0x140004c10
mov word [rbp + 4], r14w
lea r8, [0x1400a8158]
lea rdx, [rsp + 0x32]
lea rcx, [rbp + 0x10]
call fcn.14000ebe0
nop
lea rdx, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae rdx, qword [rbp + 0x10]
lea rcx, [rsp + 0x20]
call qword [0x1400a9f00]
lea rcx, [rsp + 0x20]
call qword [0x1400a9f08]
mov ebx, eax
mov ecx, 0x57
mov dword [rsp + 0x30], 0x40057
mov dword [rsp + 0x34], 0x4000e
mov dword [rsp + 0x38], 0x120003
mov dword [rsp + 0x3c], 0xb001a
mov dword [rsp + 0x40], 0x220014
mov dword [rsp + 0x44], 0x250025
mov dword [rsp + 0x48], 0x390032
mov dword [rsp + 0x4c], 0x140023
mov dword [rsp + 0x50], 0x390038
mov dword [rsp + 0x54], 0x250023
mov dword [rsp + 0x58], 0x3b0038
mov dword [rsp + 0x5c], 0x320004
mov dword [rsp + 0x60], 0xb0023
mov dword [rsp + 0x64], 0x320004
mov dword [rsp + 0x68], 0x210025
mov dword [rsp + 0x6c], 0x34003e
mov dword [rsp + 0x70], 0x240032
mov dword [rsp + 0x74], 0x57000b
movzx eax, word [0x140094b46]
xor ax, cx
mov word [rsp + 0x78], ax
movzx eax, word [str._ntoskrnl.exe]
xor ax, cx
mov word [rsp + 0x7a], ax
movzx eax, word [0x140094b4a]
xor ax, cx
mov word [rsp + 0x7c], ax
movzx eax, word [0x140094b4c]
xor ax, cx
mov word [rsp + 0x7e], ax
movzx eax, word [0x140094b4e]
xor ax, cx
mov word [rbp - 0x80], ax
movzx eax, word [0x140094b50]
xor ax, cx
mov word [rbp - 0x7e], ax
movzx eax, word [0x140094b52]
xor ax, cx
mov word [rbp - 0x7c], ax
movzx eax, word [0x140094b54]
xor ax, cx
mov word [rbp - 0x7a], ax
movzx eax, word [0x140094b56]
xor ax, cx
mov word [rbp - 0x78], ax
movzx eax, word [str.win32kbase.sys]
xor ax, cx
mov word [rbp - 0x76], ax
movzx eax, word [0x140094b5a]
xor ax, cx
mov word [rbp - 0x74], ax
movzx eax, word [0x140094b5c]
xor ax, cx
mov word [rbp - 0x72], ax
movzx eax, word [0x140094b5e]
xor ax, cx
mov word [rbp - 0x70], ax
movzx eax, word [0x140094b60]
xor ax, cx
mov word [rbp - 0x6e], ax
movzx eax, word [0x140094b62]
xor ax, cx
mov word [rbp - 0x6c], ax
movzx eax, word [0x140094b64]
xor ax, cx
mov word [rbp - 0x6a], ax
movzx eax, word [0x140094b66]
xor ax, cx
mov word [rbp - 0x68], ax
movzx eax, word [str.win32kfull.sys]
xor ax, cx
mov word [rbp - 0x66], ax
movzx eax, word [0x140094b6a]
xor ax, cx
mov word [rbp - 0x64], ax
movzx eax, word [0x140094b6c]
xor ax, cx
mov word [rbp - 0x62], ax
movzx eax, word [0x140094b6e]
xor ax, cx
mov word [rbp - 0x60], ax
movzx eax, word [0x140094b70]
xor ax, cx
mov word [rbp - 0x5e], ax
movzx eax, word [0x140094b72]
xor ax, cx
mov word [rbp - 0x5c], ax
movzx eax, word [0x140094b74]
xor ax, cx
mov word [rbp - 0x5a], ax
movzx eax, word [0x140094b76]
xor ax, cx
mov word [rbp - 0x58], ax
movzx eax, word [0x140094b78]
xor ax, cx
mov word [rbp - 0x56], ax
movzx eax, word [0x140094b7a]
xor ax, cx
mov word [rbp - 0x54], ax
movzx eax, word [0x140094b7c]
xor ax, cx
mov word [rbp - 0x52], ax
movzx eax, word [0x140094b7e]
xor ax, cx
mov word [rbp - 0x50], ax
movzx eax, word [str.x____xxx]
xor ax, cx
mov word [rbp - 0x4e], ax
movzx eax, word [0x140094b82]
xor ax, cx
mov word [rbp - 0x4c], ax
movzx eax, word [0x140094b84]
xor ax, cx
mov word [rbp - 0x4a], ax
movzx eax, word [0x140094b86]
xor ax, cx
mov word [rbp - 0x48], ax
movzx eax, word [0x140094b88]
xor ax, cx
mov word [rbp - 0x46], ax
xor eax, eax
mov word [rbp - 0x44], ax
mov rax, r14
nop dword [rax]
nop dword [rax + rax]
xor word [rsp + rax*2 + 0x32], cx
inc rax
cmp rax, 0x45
jae 0x140004f05
movzx ecx, word [rsp + 0x30]
jmp 0x140004ef0
mov word [rbp - 0x44], r14w
lea r8, [0x1400a8158]
lea rdx, [rsp + 0x32]
lea rcx, [rbp + 0x30]
call fcn.14000ebe0
cmp qword [rax + 0x18], 8
jb 0x140004f29
mov rax, qword [rax]
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x140004f76
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004f70
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004fe3
call fcn.140014b60
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x140004fb2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004fad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004fdd
call fcn.140014b60
mov eax, ebx
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.140014b40
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140025408
nop
call fcn.140025408
nop
int3