Function at 0x140011352
Capabilities:
Delete volume shadow copies
Enumerate files on windows
Enumerate processes
Execute command
Get common file path
Get disk information
Query or enumerate registry key
Read file on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
jmp 0x140011cd0
push rbp
push rdi
mov eax, 0x24b28
call fcn.1400110c8
sub rsp, rax
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x913a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140026080]
xor rax, rbp
mov qword [rbp + 0x24ad0], rax
lea rcx, [0x14002c0ba]
call fcn.1400114d3
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_srand]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtQueryKey
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140026450], rax
lea rcx, str.SeTakeOwnershipPrivilege
call fcn.140011393
test eax, eax
jne 0x140011d78
lea rcx, str.failed_to_adjust_privilege_n
call fcn.140011235
mov eax, 1
jmp 0x140013b11
mov qword [rbp + 8], 0
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetEnumDISPLAY
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140011dd1
mov rcx, 0xffffffff80000002
call fcn.14001113b
lea r8, str.SYSTEMCurrentControlSetEnumDISPLAY
mov rdx, rax
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140011235
jmp 0x1400120ab
mov rax, qword [rbp + 8]
mov qword [rbp + 0x28], rax
lea rax, [rbp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rbp + 0x274], 0
mov dword [rbp + 0x294], 0x208
jmp 0x140011e17
mov eax, dword [rbp + 0x274]
inc eax
mov dword [rbp + 0x274], eax
mov dword [rbp + 0x294], 0x208
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x294]
lea r8, [rbp + 0x50]
mov edx, dword [rbp + 0x274]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400120a1
mov qword [rbp + 0x2b8], 0
lea rax, [rbp + 0x2b8]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140011eb1
mov rcx, qword [rbp + 0x28]
call fcn.14001113b
lea r8, [rbp + 0x50]
mov rdx, rax
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140011235
jmp 0x14001209c
mov rax, qword [rbp + 0x2b8]
mov qword [rbp + 0x2d8], rax
lea rax, [rbp + 0x300]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rbp + 0x524], 0
mov dword [rbp + 0x544], 0x208
jmp 0x140011f00
mov eax, dword [rbp + 0x524]
inc eax
mov dword [rbp + 0x524], eax
mov dword [rbp + 0x544], 0x208
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x544]
lea r8, [rbp + 0x300]
mov edx, dword [rbp + 0x524]
mov rcx, qword [rbp + 0x2d8]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14001208f
mov qword [rbp + 0x568], 0
lea rax, [rbp + 0x568]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rbp + 0x300]
mov rcx, qword [rbp + 0x2d8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140011fac
mov rcx, qword [rbp + 0x2d8]
call fcn.14001113b
lea r8, [rbp + 0x300]
mov rdx, rax
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140011235
jmp 0x14001208a
mov rax, qword [rbp + 0x568]
mov qword [rbp + 0x588], rax
lea rax, [rbp + 0x5b0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rbp + 0x7d4], 0
mov dword [rbp + 0x7f4], 0x208
jmp 0x140011ffb
mov eax, dword [rbp + 0x7d4]
inc eax
mov dword [rbp + 0x7d4], eax
mov dword [rbp + 0x7f4], 0x208
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x7f4]
lea r8, [rbp + 0x5b0]
mov edx, dword [rbp + 0x7d4]
mov rcx, qword [rbp + 0x588]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14001207d
lea rdx, str.device_parameters
lea rcx, [rbp + 0x5b0]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x140012078
lea r8, str.EDID
lea rdx, [rbp + 0x5b0]
mov rcx, qword [rbp + 0x588]
call fcn.1400111ae
jmp 0x14001207d
jmp 0x140011fe3
mov rcx, qword [rbp + 0x588]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140011ee8
mov rcx, qword [rbp + 0x2d8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140011dff
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, str.SMBiosData
lea rdx, str.SYSTEMCurrentControlSetServicesmssmbiosData
mov rcx, 0xffffffff80000002
call fcn.14001100f
mov qword [rbp + 0x818], 0
lea rax, [rbp + 0x818]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SYSTEMHardwareConfig
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140012124
mov rcx, 0xffffffff80000002
call fcn.14001113b
lea r8, str.SYSTEMHardwareConfig
mov rdx, rax
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140011235
jmp 0x140012235
lea rax, [rbp + 0x840]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov rax, qword [rbp + 0x818]
mov qword [rbp + 0xa68], rax
mov r9d, 0x208
lea r8, [rbp + 0x840]
lea rdx, str.LastConfig
mov rcx, qword [rbp + 0xa68]
call fcn.140011113
lea rax, [rbp + 0xa90]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rbp + 0xcb4], 0
mov dword [rbp + 0xcd4], 0x208
jmp 0x1400121a6
mov eax, dword [rbp + 0xcb4]
inc eax
mov dword [rbp + 0xcb4], eax
mov dword [rbp + 0xcd4], 0x208
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0xcd4]
lea r8, [rbp + 0xa90]
mov edx, dword [rbp + 0xcb4]
mov rcx, qword [rbp + 0xa68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140012228
lea rdx, str.current
lea rcx, [rbp + 0xa90]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
je 0x140012223
lea r8, [rbp + 0x840]
lea rdx, [rbp + 0xa90]
mov rcx, qword [rbp + 0xa68]
call fcn.140011230
jmp 0x140012228
jmp 0x14001218e
mov rcx, qword [rbp + 0xa68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, str.ClientUUID
lea rdx, str.SOFTWARENVIDIA_CorporationGlobal
mov rcx, 0xffffffff80000002
call fcn.140011172
lea r8, str.PersistenceIdentifier
lea rdx, str.SOFTWARENVIDIA_CorporationGlobal
mov rcx, 0xffffffff80000002
call fcn.140011172
lea r8, str.ChipsetMatchID
lea rdx, str.SOFTWARENVIDIA_CorporationGlobalCoProcManager
mov rcx, 0xffffffff80000002
call fcn.140011172
lea rdx, str.SYSTEMMountedDevices
mov rcx, 0xffffffff80000002
call fcn.140011357
lea rdx, str.SOFTWAREMicrosoftDfrgStatistics
mov rcx, 0xffffffff80000002
call fcn.140011357
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBitBucketVolume
mov rcx, 0xffffffff80000001
call fcn.140011357
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerMountPoints2CPCVolume
mov rcx, 0xffffffff80000001
call fcn.140011357
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerMountPoints2
mov rcx, 0xffffffff80000001
call fcn.140011357
lea r8, str.LastEnum
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBitBucket
mov rcx, 0xffffffff80000001
call fcn.14001100f
lea r8, str.WindowsAIKHash
lea rdx, str.SYSTEMCurrentControlSetServicesTPMWMI
mov rcx, 0xffffffff80000002
call fcn.1400111ae
lea r8, str.WHQLClass
lea rdx, str.SoftwareMicrosoftDirect3D
mov rcx, 0xffffffff80000001
call fcn.1400111ae
lea r8, str.MSICache
lea rdx, str.SoftwareClassesInstallerDependencies
mov rcx, 0xffffffff80000001
call fcn.1400111ae
mov qword [rbp + 0xcf8], 0
lea rax, [rbp + 0xcf8]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystemMultifunctionAdapter0DiskController0DiskPeripheral
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400123a9
mov rcx, 0xffffffff80000002
call fcn.14001113b
lea r8, str.HARDWAREDESCRIPTIONSystemMultifunctionAdapter0DiskController0DiskPeripheral
mov rdx, rax
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140011235
jmp 0x14001246a
mov rax, qword [rbp + 0xcf8]
mov qword [rbp + 0xd18], rax
lea rax, [rbp + 0xd40]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rbp + 0xf64], 0
mov dword [rbp + 0xf84], 0x208
jmp 0x1400123f8
mov eax, dword [rbp + 0xf64]
inc eax
mov dword [rbp + 0xf64], eax
mov dword [rbp + 0xf84], 0x208
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0xf84]
lea r8, [rbp + 0xd40]
mov edx, dword [rbp + 0xf64]
mov rcx, qword [rbp + 0xd18]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14001245d
lea r8, str.Identifier
lea rdx, [rbp + 0xd40]
mov rcx, qword [rbp + 0xd18]
call fcn.140011172
jmp 0x1400123e0
mov rcx, qword [rbp + 0xd18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0xfa8], 0
lea rax, [rbp + 0xfa8]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.HARDWAREDEVICEMAPScsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400124c9
mov rcx, 0xffffffff80000002
call fcn.14001113b
lea r8, str.HARDWAREDEVICEMAPScsi
mov rdx, rax
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140011235
jmp 0x1400128cd
mov rax, qword [rbp + 0xfa8]
mov qword [rbp + 0xfc8], rax
lea rax, [rbp + 0xff0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rbp + 0x1214], 0
mov dword [rbp + 0x1234], 0x208
jmp 0x140012518
mov eax, dword [rbp + 0x1214]
inc eax
mov dword [rbp + 0x1214], eax
mov dword [rbp + 0x1234], 0x208
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x1234]
lea r8, [rbp + 0xff0]
mov edx, dword [rbp + 0x1214]
mov rcx, qword [rbp + 0xfc8]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400128c0
mov qword [rbp + 0x1258], 0
lea rax, [rbp + 0x1258]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rbp + 0xff0]
mov rcx, qword [rbp + 0xfc8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400125c4
mov rcx, qword [rbp + 0xfc8]
call fcn.14001113b
lea r8, [rbp + 0xff0]
mov rdx, rax
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140011235
jmp 0x1400128bb
mov rax, qword [rbp + 0x1258]
mov qword [rbp + 0x1278], rax
lea rax, [rbp + 0x12a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rbp + 0x14c4], 0
mov dword [rbp + 0x14e4], 0x208
jmp 0x140012613
mov eax, dword [rbp + 0x14c4]
inc eax
mov dword [rbp + 0x14c4], eax
mov dword [rbp + 0x14e4], 0x208
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x14e4]
lea r8, [rbp + 0x12a0]
mov edx, dword [rbp + 0x14c4]
mov rcx, qword [rbp + 0x1278]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400128ae
mov qword [rbp + 0x1508], 0
lea rax, [rbp + 0x1508]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rbp + 0x12a0]
mov rcx, qword [rbp + 0x1278]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400126bf
mov rcx, qword [rbp + 0x1278]
call fcn.14001113b
lea r8, [rbp + 0x12a0]
mov rdx, rax
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140011235
jmp 0x1400128a9
mov rax, qword [rbp + 0x1508]
mov qword [rbp + 0x1528], rax
lea rax, [rbp + 0x1550]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rbp + 0x1774], 0
mov dword [rbp + 0x1794], 0x208
jmp 0x14001270e
mov eax, dword [rbp + 0x1774]
inc eax
mov dword [rbp + 0x1774], eax
mov dword [rbp + 0x1794], 0x208
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x1794]
lea r8, [rbp + 0x1550]
mov edx, dword [rbp + 0x1774]
mov rcx, qword [rbp + 0x1528]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14001289c
lea rdx, str.arget
lea rcx, [rbp + 0x1550]
call fcn.140011285
test rax, rax
je 0x140012897
mov qword [rbp + 0x17b8], 0
lea rax, [rbp + 0x17b8]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rbp + 0x1550]
mov rcx, qword [rbp + 0x1528]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400127d6
mov rcx, qword [rbp + 0x1528]
call fcn.14001113b
lea r8, [rbp + 0x1550]
mov rdx, rax
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140011235
jmp 0x140012897
mov rax, qword [rbp + 0x17b8]
mov qword [rbp + 0x17d8], rax
lea rax, [rbp + 0x1800]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rbp + 0x1a24], 0
mov dword [rbp + 0x1a44], 0x208
jmp 0x140012825
mov eax, dword [rbp + 0x1a24]
inc eax
mov dword [rbp + 0x1a24], eax
mov dword [rbp + 0x1a44], 0x208
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x1a44]
lea r8, [rbp + 0x1800]
mov edx, dword [rbp + 0x1a24]
mov rcx, qword [rbp + 0x17d8]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14001288a
lea r8, str.Identifier
lea rdx, [rbp + 0x1800]
mov rcx, qword [rbp + 0x17d8]
call fcn.140011172
jmp 0x14001280d
mov rcx, qword [rbp + 0x17d8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400126f6
mov rcx, qword [rbp + 0x1528]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400125fb
mov rcx, qword [rbp + 0x1278]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140012500
mov rcx, qword [rbp + 0xfc8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, str.RandomSeed
lea rdx, str.SYSTEMCurrentControlSetServicesTPMODUID
mov rcx, 0xffffffff80000002
call fcn.1400111ae
lea r8, str.MachineGuid
lea rdx, str.SOFTWAREMicrosoftCryptography
mov rcx, 0xffffffff80000002
call fcn.140011172
lea r8, str.HwProfileGuid
lea rdx, str.SYSTEMCurrentControlSetControlIDConfigDBHardware_Profiles0001
mov rcx, 0xffffffff80000002
call fcn.140011172
lea r8, str.AccountDomainSid
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
mov rcx, 0xffffffff80000002
call fcn.140011172
lea r8, str.PingID
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
mov rcx, 0xffffffff80000002
call fcn.140011172
lea r8, str.SusClientId
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
mov rcx, 0xffffffff80000002
call fcn.140011172
lea r8, str.SusClientIdValidation
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
mov rcx, 0xffffffff80000002
call fcn.1400111ae
lea r8, str.Dhcpv6DUID
lea rdx, str.SYSTEMCurrentControlSetServicesTcpip6Parameters
mov rcx, 0xffffffff80000002
call fcn.1400111ae
lea r8, str.ComputerHardwareId
lea rdx, str.SYSTEMCurrentControlSetControlSystemInformation
mov rcx, 0xffffffff80000002
call fcn.140011172
lea r8, str.ComputerHardwareIds
lea rdx, str.SYSTEMCurrentControlSetControlSystemInformation
mov rcx, 0xffffffff80000002
call fcn.1400112bc
lea r8, str.IE_Installed_Date
lea rdx, str.SOFTWAREMicrosoftInternet_ExplorerMigration
mov rcx, 0xffffffff80000002
call fcn.1400111ae
lea r8, str.MachineId
lea rdx, str.SOFTWAREMicrosoftSQMClient
mov rcx, 0xffffffff80000002
call fcn.140011172
lea r8, str.WinSqmFirstSessionStartTime
lea rdx, str.SOFTWAREMicrosoftSQMClient
mov rcx, 0xffffffff80000002
call fcn.140011046
lea r8, str.InstallTime
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call fcn.140011046
lea r8, str.InstallDate
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call fcn.140011046
lea r8, str.DigitalProductId
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call fcn.1400111ae
lea r8, str.DigitalProductId4
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call fcn.1400111ae
lea r8, str.BuildGUID
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call fcn.140011172
lea r8, str.ProductId
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call fcn.140011172
lea r8, str.BuildLab
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call fcn.140011172
lea r8, str.BuildLabEx
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call fcn.140011172
lea r8, str._DriverProviderInfo
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000
mov rcx, 0xffffffff80000002
call fcn.140011172
lea r8, str.UserModeDriverGUID
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000
mov rcx, 0xffffffff80000002
call fcn.140011172
mov qword [rbp + 0x1a68], 0
lea rax, [rbp + 0x1a68]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e972_e325_11ce_bfc1_08002be10318
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140012b82
mov rcx, 0xffffffff80000002
call fcn.14001113b
lea r8, str.SYSTEMCurrentControlSetControlClass4d36e972_e325_11ce_bfc1_08002be10318
mov rdx, rax
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140011235
jmp 0x140012c90
mov rax, qword [rbp + 0x1a68]
mov qword [rbp + 0x1a88], rax
lea rax, [rbp + 0x1ab0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rbp + 0x1cd4], 0
mov dword [rbp + 0x1cf4], 0x208
jmp 0x140012bd1
mov eax, dword [rbp + 0x1cd4]
inc eax
mov dword [rbp + 0x1cd4], eax
mov dword [rbp + 0x1cf4], 0x208
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x1cf4]
lea r8, [rbp + 0x1ab0]
mov edx, dword [rbp + 0x1cd4]
mov rcx, qword [rbp + 0x1a88]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140012c83
lea rdx, str.configuration
lea rcx, [rbp + 0x1ab0]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
je 0x140012c7e
lea rdx, str.properties
lea rcx, [rbp + 0x1ab0]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
je 0x140012c7e
lea r8, str.NetworkAddress
lea rdx, [rbp + 0x1ab0]
mov rcx, qword [rbp + 0x1a88]
call fcn.14001100f
lea r8, str.NetworkInterfaceInstallTimestamp
lea rdx, [rbp + 0x1ab0]
mov rcx, qword [rbp + 0x1a88]
call fcn.140011046
jmp 0x140012bb9
mov rcx, qword [rbp + 0x1a88]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionDiagnosticsDiagTrackSettingsRequests
mov rcx, 0xffffffff80000002
call fcn.140011357
lea r8, str.LastEventlogWrittenTime
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionDiagnosticsDiagTrackSevilleEventlogManager
mov rcx, 0xffffffff80000002
call fcn.140011046
lea r8, str.ProductActivationTime
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatformActivation
mov rcx, 0xffffffff80000002
call fcn.140011046
lea r8, str.BackupProductKeyDefault
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform
mov rcx, 0xffffffff80000002
call fcn.14001100f
lea r8, str.actionlist
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform
mov rcx, 0xffffffff80000002
call fcn.14001100f
lea r8, str.ServiceSessionId
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform
mov rcx, 0xffffffff80000002
call fcn.14001100f
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist
mov rcx, 0xffffffff80000001
call fcn.140011357
lea rdx, str.SoftwareHex_RaysIDAHistory
mov rcx, 0xffffffff80000001
call fcn.140011357
lea rdx, str.SoftwareHex_RaysIDAHistory64
mov rcx, 0xffffffff80000001
call fcn.140011357
mov qword [rbp + 0x1d18], 0
lea rax, [rbp + 0x1d18]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.HARDWAREUEFIESRT
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140012dbd
mov rcx, 0xffffffff80000002
call fcn.14001113b
lea r8, str.HARDWAREUEFIESRT
mov rdx, rax
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140011235
jmp 0x140012f5e
mov rax, qword [rbp + 0x1d18]
mov qword [rbp + 0x1d38], rax
lea rax, [rbp + 0x1d60]
mov rdi, rax
xor eax, eax
mov ecx, 0x205f8
rep stosb byte [rdi], al
mov dword [rbp + 0x22374], 0
lea rax, [rbp + 0x223a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rbp + 0x225c4], 0
mov dword [rbp + 0x225e4], 0x208
jmp 0x140012e29
mov eax, dword [rbp + 0x225c4]
inc eax
mov dword [rbp + 0x225c4], eax
mov dword [rbp + 0x225e4], 0x208
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x225e4]
lea r8, [rbp + 0x223a0]
mov edx, dword [rbp + 0x225c4]
mov rcx, qword [rbp + 0x1d38]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140012eb5
mov eax, dword [rbp + 0x22374]
imul rax, rax, 0x208
lea rax, [rbp + rax + 0x1d60]
mov qword [rbp + 0x24ac8], rax
mov eax, dword [rbp + 0x22374]
inc eax
mov dword [rbp + 0x22374], eax
lea rdx, [rbp + 0x223a0]
mov rcx, qword [rbp + 0x24ac8]
call qword [sym.imp.ucrtbased.dll_wcscpy]
jmp 0x140012e11
mov dword [rbp + 0x22604], 0
jmp 0x140012ecf
mov eax, dword [rbp + 0x22604]
inc eax
mov dword [rbp + 0x22604], eax
mov eax, dword [rbp + 0x22374]
cmp dword [rbp + 0x22604], eax
jae 0x140012f51
lea rax, [rbp + 0x22630]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov eax, dword [rbp + 0x22604]
imul rax, rax, 0x208
lea rax, [rbp + rax + 0x1d60]
mov rdx, rax
lea rcx, [rbp + 0x22630]
call qword [sym.imp.ucrtbased.dll_wcscpy]
lea rcx, [rbp + 0x22630]
call fcn.1400110aa
mov eax, dword [rbp + 0x22604]
imul rax, rax, 0x208
lea rax, [rbp + rax + 0x1d60]
lea r8, [rbp + 0x22630]
mov rdx, rax
mov rcx, qword [rbp + 0x1d38]
call fcn.140011230
jmp 0x140012ec1
mov rcx, qword [rbp + 0x1d38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.SOFTWARELandfall_Games
mov rcx, 0xffffffff80000001
call fcn.140011357
lea rcx, str.rd__s__q_C:ProgramDataEQU8
call qword [sym.imp.ucrtbased.dll_system]
lea rax, [rbp + 0x22860]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rbp + 0x22a90]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rbp + 0x22cc0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rbp + 0x22ef0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdx, [rbp + 0x22a90]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rax, [rbp + 0x22cc0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov edx, 0x1a
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rax, [rbp + 0x22ef0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov edx, 0x1c
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea r8, [rbp + 0x22a90]
lea rdx, [0x1400216d8]
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rax, [rbp + 0x23120]
mov rdi, rax
xor eax, eax
mov ecx, 0x250
rep stosb byte [rdi], al
lea rdx, [rbp + 0x23120]
lea rcx, [rbp + 0x22860]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbp + 0x23388], rax
lea rdx, [0x1400216e4]
lea rcx, [rbp + 0x2314c]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
je 0x1400130d5
lea rdx, [0x1400216e8]
lea rcx, [rbp + 0x2314c]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
je 0x1400130d5
lea rax, [rbp + 0x2314c]
mov qword [rbp + 0x233a8], rax
mov r9, qword [rbp + 0x233a8]
lea r8, [rbp + 0x22a90]
lea rdx, [0x1400216f0]
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x22860]
call fcn.140011078
lea rdx, [rbp + 0x23120]
mov rcx, qword [rbp + 0x23388]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140013069
mov rcx, qword [rbp + 0x23388]
call qword [sym.imp.KERNEL32.dll_FindClose]
lea r8, [rbp + 0x22ef0]
lea rdx, str._wsD3DSCache
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x22860]
call fcn.140011078
lea r8, [rbp + 0x22ef0]
lea rdx, str._wsNVIDIA_CorporationGfeSDK
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x22860]
call fcn.140011078
lea r8, [rbp + 0x22ef0]
lea rdx, str._wsMicrosoftFeeds
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x22860]
call fcn.140011078
lea r8, [rbp + 0x22ef0]
lea rdx, str._wsMicrosoftFeeds_Cache
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x22860]
call fcn.140011078
lea r8, [rbp + 0x22ef0]
lea rdx, str._wsMicrosoftWindowsINetCache
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x22860]
call fcn.140011078
lea r8, [rbp + 0x22ef0]
lea rdx, str._wsMicrosoftWindowsINetCookies
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x22860]
call fcn.140011078
lea r8, [rbp + 0x22ef0]
lea rdx, str._wsMicrosoftWindowsWebCache
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x22860]
call fcn.140011078
lea r8, [rbp + 0x22ef0]
lea rdx, str._wsMicrosoftXboxLiveAuthStateCache.dat
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x22860]
call fcn.140011078
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rbp + 0x233c4], eax
mov dword [rbp + 0x233e4], 0x43
mov dword [rbp + 0x23404], 0
jmp 0x140013274
mov eax, dword [rbp + 0x233c4]
shr eax, 1
mov dword [rbp + 0x233c4], eax
mov eax, dword [rbp + 0x23404]
inc eax
mov dword [rbp + 0x23404], eax
cmp dword [rbp + 0x233c4], 0
je 0x140013a08
mov eax, dword [rbp + 0x233c4]
and eax, 1
test eax, eax
je 0x140013a03
mov edx, dword [rbp + 0x233e4]
lea rcx, str._n___DRIVE:__c____n_n
call fcn.140011235
mov r8d, dword [rbp + 0x233e4]
lea rdx, str.._c:
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
mov edx, 0xc0000000
lea rcx, [rbp + 0x22860]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0x23428], rax
cmp qword [rbp + 0x23428], 0xffffffffffffffff
je 0x14001346c
lea rax, [rbp + 0x23450]
mov rdi, rax
xor eax, eax
mov ecx, 0x200
rep stosb byte [rdi], al
mov dword [rbp + 0x23664], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x23664]
mov r8d, 0x200
lea rdx, [rbp + 0x23450]
mov rcx, qword [rbp + 0x23428]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001345f
mov eax, dword [rbp + 0x23664]
cmp rax, 0x200
jne 0x14001345f
mov dword [rbp + 0x23684], 0
jmp 0x140013383
mov eax, dword [rbp + 0x23684]
inc eax
mov dword [rbp + 0x23684], eax
mov eax, dword [rbp + 0x23684]
cmp rax, 3
jae 0x14001345f
mov eax, dword [rbp + 0x23684]
imul rax, rax, 0x10
lea rcx, section..data
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x236a8], rax
mov rax, qword [rbp + 0x236a8]
mov rcx, qword [rax]
call fcn.140011203
mov rcx, qword [rbp + 0x236a8]
mov ecx, dword [rcx + 8]
lea rcx, [rbp + rcx + 0x23450]
mov r8, rax
mov rax, qword [rbp + 0x236a8]
mov rdx, qword [rax]
call fcn.1400111c2
test eax, eax
jne 0x14001345a
call qword [sym.imp.ucrtbased.dll_rand]
shl eax, 0x10
mov dword [rbp + 0x24ac4], eax
call qword [sym.imp.ucrtbased.dll_rand]
mov ecx, dword [rbp + 0x24ac4]
add ecx, eax
mov eax, ecx
mov rcx, qword [rbp + 0x236a8]
mov ecx, dword [rcx + 0xc]
mov dword [rbp + rcx + 0x23450], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x23428]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x140013458
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x200
lea rdx, [rbp + 0x23450]
mov rcx, qword [rbp + 0x23428]
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x14001345f
jmp 0x140013375
mov rcx, qword [rbp + 0x23428]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:WindowsSystem32_restoreMachineGuid.txt
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x22860]
call fcn.140011078
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:UsersPublicLibrariescollection.dat
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x22860]
call fcn.140011078
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:System_Volume_InformationIndexerVolumeGuid
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x22860]
call fcn.140011078
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:System_Volume_InformationWPSettings.dat
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x22860]
call fcn.140011078
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:System_Volume_Information_tracking.log
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x22860]
call fcn.140011078
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:ProgramDataMicrosoftWindowsWER
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x22860]
call fcn.140011078
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:UsersPublicShared_Files
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x22860]
call fcn.140011078
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:WindowsINF_setupapi.dev.log
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x22860]
call fcn.140011078
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:WindowsINF_setupapi.setup.log
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x22860]
call fcn.140011078
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:UsersPublicLibraries
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x22860]
call fcn.140011078
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:MSOCache
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x22860]
call fcn.140011078
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:ProgramData_ntuser.pol
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x22860]
call fcn.140011078
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:UsersDefaultNTUSER.DAT
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x22860]
call fcn.140011078
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:Recovery_ntuser.sys
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x22860]
call fcn.140011078
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:desktop.ini
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x22860]
call fcn.140011078
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:WindowsPrefetch
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rax, [rbp + 0x236d0]
mov rdi, rax
xor eax, eax
mov ecx, 0x250
rep stosb byte [rdi], al
lea rdx, [rbp + 0x236d0]
lea rcx, [rbp + 0x22860]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbp + 0x23938], rax
lea rdx, [0x1400216e4]
lea rcx, [rbp + 0x236fc]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
je 0x14001376a
lea rdx, [0x1400216e8]
lea rcx, [rbp + 0x236fc]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
je 0x14001376a
lea rax, [rbp + 0x236fc]
mov qword [rbp + 0x23958], rax
mov r9, qword [rbp + 0x23958]
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:WindowsPrefetch_ws
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x22860]
call fcn.140011078
lea rdx, [rbp + 0x236d0]
mov rcx, qword [rbp + 0x23938]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400136fe
mov rcx, qword [rbp + 0x23938]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r8d, dword [rbp + 0x233e4]
lea rdx, [0x140021ee0]
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rax, [rbp + 0x23980]
mov rdi, rax
xor eax, eax
mov ecx, 0x250
rep stosb byte [rdi], al
lea rdx, [rbp + 0x23980]
lea rcx, [rbp + 0x22860]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbp + 0x23be8], rax
lea rdx, [0x1400216e4]
lea rcx, [rbp + 0x239ac]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
je 0x140013964
lea rdx, [0x1400216e8]
lea rcx, [rbp + 0x239ac]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
je 0x140013964
lea rax, [rbp + 0x239ac]
mov qword [rbp + 0x23c08], rax
mov eax, dword [rbp + 0x23980]
and eax, 0x10
test eax, eax
je 0x140013964
lea rax, [rbp + 0x23c30]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov rdx, qword [rbp + 0x23c08]
lea rcx, [rbp + 0x23c30]
call qword [sym.imp.ucrtbased.dll_wcscpy]
lea r9, [rbp + 0x23c30]
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:Users_ws
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rax, [rbp + 0x23e60]
mov rdi, rax
xor eax, eax
mov ecx, 0x250
rep stosb byte [rdi], al
lea rdx, [rbp + 0x23e60]
lea rcx, [rbp + 0x22860]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbp + 0x240c8], rax
lea rdx, [0x1400216e4]
lea rcx, [rbp + 0x23e8c]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
je 0x14001393b
lea rdx, [0x1400216e8]
lea rcx, [rbp + 0x23e8c]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
je 0x14001393b
lea rax, [rbp + 0x23e8c]
mov qword [rbp + 0x240e8], rax
lea rdx, str.ntuser
mov rcx, qword [rbp + 0x240e8]
call qword [sym.imp.SHLWAPI.dll_StrStrW]
test rax, rax
je 0x14001393b
mov rax, qword [rbp + 0x240e8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x23c30]
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:Users_ws_ws
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x22860]
call fcn.140011078
lea rdx, [rbp + 0x23e60]
mov rcx, qword [rbp + 0x240c8]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400138aa
mov rcx, qword [rbp + 0x240c8]
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, [rbp + 0x23980]
mov rcx, qword [rbp + 0x23be8]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400137dc
mov rcx, qword [rbp + 0x23be8]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:Users
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, str.desktop.ini
lea rcx, [rbp + 0x22860]
call fcn.1400112e9
lea rax, [rbp + 0x24110]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
mov r8d, dword [rbp + 0x233e4]
lea rdx, str.fsutil_usn_deletejournal__d__c:
lea rcx, [rbp + 0x24110]
call fcn.140011488
lea rcx, [rbp + 0x24110]
call qword [sym.imp.ucrtbased.dll_system]
mov eax, dword [rbp + 0x233e4]
inc eax
mov dword [rbp + 0x233e4], eax
jmp 0x140013258
lea rcx, str.vssadmin_delete_shadows__All__Quiet
call qword [sym.imp.ucrtbased.dll_system]
xor edx, edx
mov ecx, 2
call fcn.14001123f
mov qword [rbp + 0x24238], rax
cmp qword [rbp + 0x24238], 0
je 0x140013af5
lea rax, [rbp + 0x24260]
mov rdi, rax
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
mov dword [rbp + 0x24260], 0x238
lea rdx, [rbp + 0x24260]
mov rcx, qword [rbp + 0x24238]
call fcn.1400112fd
test eax, eax
je 0x140013ae8
lea rdx, str.WmiPrvSE.exe
lea rcx, [rbp + 0x2428c]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x140013ad1
mov r8d, dword [rbp + 0x24268]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x244b8], rax
cmp qword [rbp + 0x244b8], 0xffffffffffffffff
je 0x140013acf
lea rcx, str.Killed_Winmgmt_n
call fcn.140011235
xor edx, edx
mov rcx, qword [rbp + 0x244b8]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp + 0x244b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140013ae8
lea rdx, [rbp + 0x24260]
mov rcx, qword [rbp + 0x24238]
call fcn.140011460
test eax, eax
jne 0x140013a6a
mov rcx, qword [rbp + 0x24238]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.net_stop_winmgmt__Y
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001fa60]
call fcn.14001142e
mov rax, rdi
mov rcx, qword [rbp + 0x24ad0]
xor rcx, rbp
call fcn.140011253
lea rsp, [rbp + 0x24ae8]
pop rdi
pop rbp
ret