Function at 0x140001d90
Capabilities:
Create thread
Delete registry key
Enumerate processes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb60]
sub rsp, 0xc60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0xb50], rax
xor r12d, r12d
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x1400018f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
movabs r13, 0xb2f4fc0794908cf3
lea r15, str.regedit.exe
lea r14, str.ProcessHacker.exe
lea rsi, str.Taskmgr.exe
mov dword [rbp + 0x490], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001f5d
lea rdx, [rbp + 0x490]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140001f54
lea rdx, [rbp + 0x4bc]
mov rcx, r12
nop dword [rax]
movzx eax, word [rdx + rcx*2]
cmp ax, word [rsi + rcx*2]
jne 0x140001f3c
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [rsi + rcx*2 + 2]
jne 0x140001f3c
add rcx, 2
cmp rcx, 0xc
jne 0x140001e50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, r12d
mov dword [rbp + 0x10], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400020bb
lea rdx, [rbp + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140001efb
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rbp + 0x3c]
mov rcx, r12
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
cmp ax, word [rsi + rcx*2]
jne 0x1400020a1
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [rsi + rcx*2 + 2]
jne 0x1400020a1
add rcx, 2
cmp rcx, 0xc
jne 0x140001ed0
mov edi, dword [rbp + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1400020bb
mov ecx, edi
call fcn.140001b90
test al, al
jne 0x140001f5d
lea rdx, str.Failed_to_inject_DLL_into_Task_Manager.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003260
mov rcx, rax
lea rdx, [0x140003430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140001f5d
lea rdx, [rbp + 0x490]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001e42
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x6d0], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400020e8
lea rdx, [rbp + 0x6d0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400020df
nop word [rax + rax]
lea rdx, [rbp + 0x6fc]
mov rcx, r12
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
cmp ax, word [r14 + rcx*2]
jne 0x1400020c7
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r14 + rcx*2 + 2]
jne 0x1400020c7
add rcx, 2
cmp rcx, 0x12
jne 0x140001fb0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, r12d
mov dword [rbp + 0x250], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400021d5
lea rdx, [rbp + 0x250]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140002060
nop dword [rax]
lea rdx, [rbp + 0x27c]
mov rcx, r12
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
cmp ax, word [r14 + rcx*2]
jne 0x1400021b8
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r14 + rcx*2 + 2]
jne 0x1400021b8
add rcx, 2
cmp rcx, 0x12
jne 0x140002030
mov edi, dword [rbp + 0x258]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1400021d5
mov ecx, edi
call fcn.140001b90
test al, al
jne 0x1400020e8
lea rdx, str.Failed_to_inject_DLL_into_Process_Hacker.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003260
mov rcx, rax
lea rdx, [0x140003430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400020e8
lea rdx, [rbp + 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001ec0
jmp 0x140001efb
lea rdx, str.Task_Manager_process_not_found.
jmp 0x140001f1e
lea rdx, [rbp + 0x6d0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001fa0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x910], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140002202
lea rdx, [rbp + 0x910]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400021f9
lea rdx, [rbp + 0x93c]
mov rcx, r12
nop dword [rax]
movzx eax, word [rdx + rcx*2]
cmp ax, word [r15 + rcx*2]
jne 0x1400021e1
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r15 + rcx*2 + 2]
jne 0x1400021e1
add rcx, 2
cmp rcx, 0xc
jne 0x140002130
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.SOFTWAREWinRARArcHistory
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov ebx, eax
test eax, eax
jne 0x140002b18
lea rdx, str.Deleted_registry_tree:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140003470
mov rcx, rax
lea rdx, str.SOFTWAREWinRARArcHistory
call fcn.140003470
mov rcx, rax
lea rdx, [0x140003650]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x140002b98
lea rdx, [rbp + 0x250]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140002020
jmp 0x140002060
lea rdx, str.Process_Hacker_process_not_found.
jmp 0x140002083
lea rdx, [rbp + 0x910]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140002122
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x52
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14000259c
call fcn.140001ae0
mov ebx, eax
mov ecx, eax
call fcn.140001920
mov rsi, rax
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rsp + 0x50], 0xa0
mov dword [rsp + 0x58], r12d
mov qword [rsp + 0x5c], 8
mov dword [rsp + 0x64], 0x18
mov dword [rsp + 0x68], 0xa8
mov dword [rsp + 0x6c], 0x50
mov dword [rsp + 0x70], 0x10
mov dword [rsp + 0x74], 0x20
mov dword [rsp + 0x78], 0x50
mov dword [rsp + 0x7c], 0x560
mov ecx, 0x30
call fcn.140003710
mov r13, rax
mov qword [rbp - 0x20], rax
lea rdi, [rax + 0x30]
mov qword [rbp - 0x10], rdi
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x18], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov ecx, 0x30
call fcn.140003710
mov rbx, rax
mov qword [rsp + 0x30], rax
lea rcx, [rax + 0x30]
mov qword [rsp + 0x40], rcx
sub rdi, r13
mov r8, rdi
mov rdx, r13
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + 0x30]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x30]
lea rdx, [rsi + 0x2652868]
mov rcx, r14
call fcn.1400019d0
mov rbx, rax
lea rdx, str.1_successfully.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003260
mov rcx, rax
lea rdx, [0x140003430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp - 0x40], 0x3deb851f
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp - 0x40]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call fcn.140001ae0
mov ebx, eax
mov ecx, eax
call fcn.140001920
mov rsi, rax
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
mov dword [rbp - 0x80], 0x30
mov dword [rbp - 0x7c], 0x2b4
mov ecx, 8
call fcn.140003710
mov r15, rax
mov qword [rbp - 8], rax
lea rdi, [rax + 8]
mov qword [rbp + 8], rdi
mov rax, qword [rbp - 0x80]
mov qword [r15], rax
mov qword [rbp], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov ecx, 8
call fcn.140003710
mov rbx, rax
mov qword [rsp + 0x30], rax
lea rcx, [rax + 8]
mov qword [rsp + 0x40], rcx
sub rdi, r15
mov r8, rdi
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + 8]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x30]
lea rdx, [rsi + 0x212b208]
mov rcx, r14
call fcn.1400019d0
mov rbx, rax
lea rdx, str.0_successfully.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003260
mov rcx, rax
lea rdx, [0x140003430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp - 0x3c], 0xe
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp - 0x3c]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call fcn.140001ae0
mov ebx, eax
mov ecx, eax
call fcn.140001920
mov rsi, rax
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov dword [rbp - 0x78], 0x40
mov dword [rbp - 0x74], 0x28c
mov ecx, 8
call fcn.140003710
mov r12, rax
mov qword [rbp - 0x58], rax
lea rdi, [rax + 8]
mov qword [rbp - 0x48], rdi
mov rax, qword [rbp - 0x78]
mov qword [r12], rax
mov qword [rbp - 0x50], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov ecx, 8
call fcn.140003710
mov rbx, rax
mov qword [rsp + 0x30], rax
lea rcx, [rax + 8]
mov qword [rsp + 0x40], rcx
sub rdi, r12
mov r8, rdi
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + 8]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x30]
lea rdx, [rsi + 0x212b208]
mov rcx, r14
call fcn.1400019d0
mov rbx, rax
lea rdx, str.5_successfully.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003260
mov rcx, rax
lea rdx, [0x140003430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp - 0x38], 0x41480000
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp - 0x38]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r12, r12
je 0x14000256a
mov edx, 8
mov rcx, r12
call fcn.14000374c
nop
test r15, r15
je 0x14000257d
mov edx, 8
mov rcx, r15
call fcn.14000374c
nop
test r13, r13
je 0x14000258f
mov edx, 0x30
mov rcx, r13
call fcn.14000374c
movabs r13, 0xb2f4fc0794908cf3
xor r12d, r12d
mov ecx, 0x30
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140002707
call fcn.140001ae0
mov ebx, eax
mov ecx, eax
call fcn.140001920
mov rsi, rax
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rsp + 0x50], 0xa0
mov dword [rsp + 0x58], r12d
mov qword [rsp + 0x5c], 8
mov dword [rsp + 0x64], 0x18
mov dword [rsp + 0x68], 0xa8
mov dword [rsp + 0x6c], 0x50
mov dword [rsp + 0x70], 0x10
mov dword [rsp + 0x74], 0x20
mov dword [rsp + 0x78], 0x50
mov dword [rsp + 0x7c], 0x560
mov ecx, 0x30
call fcn.140003710
mov r15, rax
mov qword [rbp - 0x58], rax
lea rdi, [rax + 0x30]
mov qword [rbp - 0x48], rdi
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x50], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov ecx, 0x30
call fcn.140003710
mov rbx, rax
mov qword [rsp + 0x30], rax
lea rcx, [rax + 0x30]
mov qword [rsp + 0x40], rcx
sub rdi, r15
mov r8, rdi
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + 0x30]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x30]
lea rdx, [rsi + 0x2652868]
mov rcx, r14
call fcn.1400019d0
mov rbx, rax
lea rdx, str.2_successfully.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003260
mov rcx, rax
lea rdx, [0x140003430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp - 0x34], 0x3eb33333
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp - 0x34]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r15, r15
je 0x140002707
mov edx, 0x30
mov rcx, r15
call fcn.14000374c
mov ecx, 0x39
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140002872
call fcn.140001ae0
mov ebx, eax
mov ecx, eax
call fcn.140001920
mov rsi, rax
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rsp + 0x50], 0xa0
mov dword [rsp + 0x58], r12d
mov qword [rsp + 0x5c], 8
mov dword [rsp + 0x64], 0x18
mov dword [rsp + 0x68], 0xa8
mov dword [rsp + 0x6c], 0x50
mov dword [rsp + 0x70], 0x10
mov dword [rsp + 0x74], 0x20
mov dword [rsp + 0x78], 0x50
mov dword [rsp + 0x7c], 0x560
mov ecx, 0x30
call fcn.140003710
mov r15, rax
mov qword [rbp - 0x58], rax
lea rdi, [rax + 0x30]
mov qword [rbp - 0x48], rdi
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x50], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov ecx, 0x30
call fcn.140003710
mov rbx, rax
mov qword [rsp + 0x30], rax
lea rcx, [rax + 0x30]
mov qword [rsp + 0x40], rcx
sub rdi, r15
mov r8, rdi
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + 0x30]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x30]
lea rdx, [rsi + 0x2652868]
mov rcx, r14
call fcn.1400019d0
mov rbx, rax
lea rdx, str.3_successfully.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003260
mov rcx, rax
lea rdx, [0x140003430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp - 0x30], 0x3f4ccccd
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp - 0x30]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r15, r15
je 0x140002872
mov edx, 0x30
mov rcx, r15
call fcn.14000374c
mov ecx, 0x4b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140002990
call fcn.140001ae0
mov ebx, eax
mov ecx, eax
call fcn.140001920
mov rsi, rax
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov dword [rbp - 0x70], 0x30
mov dword [rbp - 0x6c], 0x2b4
mov ecx, 8
call fcn.140003710
mov r15, rax
mov qword [rbp - 0x58], rax
lea rdi, [rax + 8]
mov qword [rbp - 0x48], rdi
mov rax, qword [rbp - 0x70]
mov qword [r15], rax
mov qword [rbp - 0x50], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov ecx, 8
call fcn.140003710
mov rbx, rax
mov qword [rsp + 0x30], rax
lea rcx, [rax + 8]
mov qword [rsp + 0x40], rcx
sub rdi, r15
mov r8, rdi
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + 8]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x30]
lea rdx, [rsi + 0x212b208]
mov rcx, r14
call fcn.1400019d0
mov rbx, rax
lea rdx, str.4_successfully.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003260
mov rcx, rax
lea rdx, [0x140003430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp - 0x2c], 0
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp - 0x2c]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r15, r15
je 0x140002990
mov edx, 8
mov rcx, r15
call fcn.14000374c
mov ecx, 0x4a
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140002aae
call fcn.140001ae0
mov ebx, eax
mov ecx, eax
call fcn.140001920
mov rsi, rax
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov dword [rbp - 0x68], 0x40
mov dword [rbp - 0x64], 0x28c
mov ecx, 8
call fcn.140003710
mov r15, rax
mov qword [rbp - 0x58], rax
lea rdi, [rax + 8]
mov qword [rbp - 0x48], rdi
mov rax, qword [rbp - 0x68]
mov qword [r15], rax
mov qword [rbp - 0x50], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov ecx, 8
call fcn.140003710
mov rbx, rax
mov qword [rsp + 0x30], rax
lea rcx, [rax + 8]
mov qword [rsp + 0x40], rcx
sub rdi, r15
mov r8, rdi
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + 8]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x30]
lea rdx, [rsi + 0x212b208]
mov rcx, r14
call fcn.1400019d0
mov rbx, rax
lea rdx, str.5_successfully.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003260
mov rcx, rax
lea rdx, [0x140003430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp - 0x28], 0x41880000
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp - 0x28]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r15, r15
je 0x140002aae
mov edx, 8
mov rcx, r15
call fcn.14000374c
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x140003157
lea rcx, [rbp - 0x60]
call fcn.1400011c0
mov rax, qword [rbp - 0x60]
movabs rcx, 0x7fffffffc46535ff
cmp rax, rcx
lea rdi, [rax + 0x3b9aca00]
jl 0x140002af0
movabs rdi, 0x7fffffffffffffff
nop
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov rcx, rax
cmp rbx, 0x989680
jne 0x140003083
imul rax, rcx, 0x64
jmp 0x1400030f4
lea rdx, str.Failed_to_delete_registry_tree:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003260
mov rcx, rax
lea rdx, str.SOFTWAREWinRARArcHistory
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, str.__Error_code:
call fcn.140003260
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
mov rcx, rax
lea rdx, [0x140003430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Failed_to_delete_registry_tree:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003260
mov rcx, rax
lea rdx, str.SOFTWAREWinRARArcHistory
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x140003430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.SYSTEMControlSet001Services_bamStateUserSettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov ebx, eax
test eax, eax
jne 0x140002be9
lea rdx, str.Deleted_registry_tree:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140003470
mov rcx, rax
lea rdx, str.SYSTEMControlSet001Services_bamStateUserSettings
call fcn.140003470
mov rcx, rax
lea rdx, [0x140003650]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x140002c69
lea rdx, str.Failed_to_delete_registry_tree:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003260
mov rcx, rax
lea rdx, str.SYSTEMControlSet001Services_bamStateUserSettings
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, str.__Error_code:
call fcn.140003260
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
mov rcx, rax
lea rdx, [0x140003430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Failed_to_delete_registry_tree:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003260
mov rcx, rax
lea rdx, str.SYSTEMControlSet001Services_bamStateUserSettings
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x140003430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov ebx, eax
test eax, eax
jne 0x140002cba
lea rdx, str.Deleted_registry_tree:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140003470
mov rcx, rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore
call fcn.140003470
mov rcx, rax
lea rdx, [0x140003650]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x140002d3a
lea rdx, str.Failed_to_delete_registry_tree:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003260
mov rcx, rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, str.__Error_code:
call fcn.140003260
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
mov rcx, rax
lea rdx, [0x140003430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Failed_to_delete_registry_tree:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003260
mov rcx, rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x140003430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageAppSwitched
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov ebx, eax
test eax, eax
jne 0x140002d8b
lea rdx, str.Deleted_registry_tree:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140003470
mov rcx, rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageAppSwitched
call fcn.140003470
mov rcx, rax
lea rdx, [0x140003650]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x140002e0b
lea rdx, str.Failed_to_delete_registry_tree:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003260
mov rcx, rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageAppSwitched
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, str.__Error_code:
call fcn.140003260
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
mov rcx, rax
lea rdx, [0x140003430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Failed_to_delete_registry_tree:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003260
mov rcx, rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageAppSwitched
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x140003430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.SOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov ebx, eax
test eax, eax
jne 0x140002e5c
lea rdx, str.Deleted_registry_tree:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140003470
mov rcx, rax
lea rdx, str.SOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache
call fcn.140003470
mov rcx, rax
lea rdx, [0x140003650]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x140002edc
lea rdx, str.Failed_to_delete_registry_tree:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003260
mov rcx, rax
lea rdx, str.SOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, str.__Error_code:
call fcn.140003260
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
mov rcx, rax
lea rdx, [0x140003430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Failed_to_delete_registry_tree:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003260
mov rcx, rax
lea rdx, str.SOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x140003430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerFileExts
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov ebx, eax
test eax, eax
jne 0x140002f2d
lea rdx, str.Deleted_registry_tree:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140003470
mov rcx, rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerFileExts
call fcn.140003470
mov rcx, rax
lea rdx, [0x140003650]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x140002fad
lea rdx, str.Failed_to_delete_registry_tree:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003260
mov rcx, rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerFileExts
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, str.__Error_code:
call fcn.140003260
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
mov rcx, rax
lea rdx, [0x140003430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Failed_to_delete_registry_tree:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003260
mov rcx, rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerFileExts
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x140003430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssist
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov ebx, eax
test eax, eax
jne 0x140002ffe
lea rdx, str.Deleted_registry_tree:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140003470
mov rcx, rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssist
call fcn.140003470
mov rcx, rax
lea rdx, [0x140003650]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x140002202
lea rdx, str.Failed_to_delete_registry_tree:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003260
mov rcx, rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssist
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, str.__Error_code:
call fcn.140003260
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
mov rcx, rax
lea rdx, [0x140003430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Failed_to_delete_registry_tree:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003260
mov rcx, rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssist
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x140003430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140002202
cmp rbx, 0x16e3600
jne 0x1400030d6
mov rax, r13
imul rcx
lea r8, [rcx + rdx]
sar r8, 0x18
mov rax, r8
shr rax, 0x3f
add r8, rax
imul rax, r8, 0x16e3600
sub rcx, rax
imul rcx, rcx, 0x3b9aca00
mov rax, r13
imul rcx
lea rax, [rcx + rdx]
sar rax, 0x18
mov rcx, rax
shr rcx, 0x3f
add rax, rcx
imul rcx, r8, 0x3b9aca00
jmp 0x1400030f1
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rcx, rcx, 0x3b9aca00
add rax, rcx
cmp rax, rdi
jge 0x140001df3
mov rcx, rdi
sub rcx, rax
movabs rax, 0x4e94914f0000
cmp rcx, rax
jl 0x140003121
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x140002af0
movabs rax, 0x431bde82d7b634db
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x14000314b
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x140002af0
xor eax, eax
mov rcx, qword [rbp + 0xb50]
xor rcx, rsp
call fcn.1400036f0
lea r11, [rsp + 0xc60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret