Function at 0x140004780
Capabilities:
Delete file
Delete registry key
Delete registry value
Get cpu information
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x590]
sub rsp, 0x690
mov rax, qword [0x1400f60c0]
xor rax, rsp
mov qword [rbp + 0x580], rax
xor r15d, r15d
mov edi, r15d
mov dword [rsp + 0x70], r15d
call fcn.140003bb0
mov rbx, rax
lea rdx, str.BaseBoardManufacturer
lea rcx, [rbp + 0x430]
call fcn.14000f4e0
nop
lea rdx, str.BaseBoardProduct
lea rcx, [rbp + 0x450]
call fcn.14000f4e0
nop
lea rdx, str.BaseBoardVersion
lea rcx, [rbp + 0x470]
call fcn.14000f4e0
nop
lea rdx, str.SystemFamily
lea rcx, [rbp + 0x490]
call fcn.14000f4e0
nop
lea rdx, str.SystemManufacturer
lea rcx, [rbp + 0x4b0]
call fcn.14000f4e0
nop
lea rdx, str.SystemProductName
lea rcx, [rbp + 0x4d0]
call fcn.14000f4e0
nop
lea rdx, str.SystemSKU
lea rcx, [rbp + 0x4f0]
call fcn.14000f4e0
nop
lea rdx, str.SystemVersion
lea rcx, [rbp + 0x510]
call fcn.14000f4e0
nop
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x14000488c
lea rdx, str.clean
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011e00
lea rdx, str.SYSTEMCurrentControlSetEnumUSB
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
lea rdx, str.SYSTEMCurrentControlSetEnumDISPLAY
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
lea rdx, str.SYSTEMCurrentControlSetControlGraphicsDriversConnectivity
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
lea rdx, str.SYSTEMCurrentControlSetControlGraphicsDriversConfiguration
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
lea rdx, str.SYSTEMCurrentControlSetServicesmssmbiosData
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
lea rdx, str.HARDWAREDEVICEMAPScsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
lea rdx, str.SYSTEMHardwareConfig
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
lea rdx, str.SOFTWAREMicrosoftDfrgStatistics
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
lea rdx, str.SYSTEMMountedDevices
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
lea rdx, str.SOFTWAREMicrosoftDfrgStatistics
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBitBucketVolume
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerMountPoints2CPCVolume
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerMountPoints2
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBitBucket
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
lea rdx, str.SoftwareHex_RaysIDAHistory
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
lea rdx, str.SoftwareHex_RaysIDAHistory64
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionDiagnosticsDiagTrackSettingsRequests
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
lea rdx, str.HARDWAREUEFIESRT
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
lea rdx, str.SoftwareMicrosoftOfficeCommonClientTelemetry
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsClientTelemetry
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
lea rdx, str..DEFAULTSoftwareMicrosoftOfficeCommonClientTelemetry
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
lea rdx, str.S___1___5___18SoftwareMicrosoftOfficeCommonClientTelemetry
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionDiagnosticsDiagTrackSettingsRequests
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssist
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatformBackupProductKeyDefault
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform_actionlist
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatformServiceSessionId
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWindows_Activation_TechnologiesAdminObjectStore
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWindows_Activation_TechnologiesAdminObjectStoreMachineId
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rcx, [rbp + 0x530]
call fcn.1400041b0
cmp qword [rax + 0x18], 7
jbe 0x140004afa
mov rax, qword [rax]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.WppRecorder_TraceGuid
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindowsWin32kWPPParameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x140004b71
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004b6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004b6c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400baae8
mov edx, reloc.WS2_32.dll_sendto
lea rcx, [rbp + 0x530]
call fcn.140004670
cmp qword [rax + 0x18], 7
jbe 0x140004b8c
mov rax, qword [rax]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 3
lea r8, str.WindowsAIKHash
lea rdx, str.SYSTEMCurrentControlSetServicesTPMWMI
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x140004c03
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004bfe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004bfe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400baae8
mov edx, reloc.WS2_32.dll_sendto
lea rcx, [rbp + 0x530]
call fcn.140004670
cmp qword [rax + 0x18], 7
jbe 0x140004c1e
mov rax, qword [rax]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 3
lea r8, str.WHQLClass
lea rdx, str.SoftwareMicrosoftDirect3D
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x140004c95
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004c90
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004c90
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400baae8
mov edx, reloc.WS2_32.dll_sendto
lea rcx, [rbp + 0x530]
call fcn.140004670
cmp qword [rax + 0x18], 7
jbe 0x140004cb0
mov rax, qword [rax]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 3
lea r8, str.MSICache
lea rdx, str.SoftwareClassesInstallerDependencies
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x140004d27
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004d22
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004d22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400baae8
lea rcx, [rbp + 0x530]
call fcn.1400041b0
cmp qword [rax + 0x18], 7
jbe 0x140004d3d
mov rax, qword [rax]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.ClientUUID
lea rdx, str.SOFTWARENVIDIA_CorporationGlobal
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x140004db4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004daf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004daf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400baae8
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rbp + 0x530]
call fcn.1400043f0
cmp qword [rax + 0x18], 7
jbe 0x140004dcf
mov rax, qword [rax]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.PersistenceIdentifier
lea rdx, str.SOFTWARENVIDIA_CorporationGlobal
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x140004e46
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004e41
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004e41
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400baae8
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rbp + 0x530]
call fcn.1400043f0
cmp qword [rax + 0x18], 7
jbe 0x140004e61
mov rax, qword [rax]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.ChipsetMatchID
lea rdx, str.SOFTWARENVIDIA_CorporationGlobalCoProcManager
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x140004ed8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004ed3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004ed3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400baae8
lea rcx, [rbp + 0x530]
call fcn.1400041b0
cmp qword [rax + 0x18], 7
jbe 0x140004eee
mov rax, qword [rax]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.MachineGuid
lea rdx, str.SOFTWAREMicrosoftCryptography
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x140004f65
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004f60
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004f60
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400baae8
lea rcx, [rbp + 0x530]
call fcn.1400041b0
cmp qword [rax + 0x18], 7
jbe 0x140004f7b
mov rax, qword [rax]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.HwProfileGuid
lea rdx, str.SYSTEMCurrentControlSetControlIDConfigDBHardware_Profiles0001
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x140004ff2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004fed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004fed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400baae8
lea rcx, [rbp + 0x530]
call fcn.1400041b0
cmp qword [rax + 0x18], 7
jbe 0x140005008
mov rax, qword [rax]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.SusClientId
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x14000507f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000507a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000507a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400baae8
lea rcx, [rbp + 0x530]
call fcn.1400041b0
cmp qword [rax + 0x18], 7
jbe 0x140005095
mov rax, qword [rax]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.ComputerHardwareId
lea rdx, str.SYSTEMCurrentControlSetControlSystemInformation
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x14000510c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005107
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005107
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400baae8
lea rcx, [rbp + 0x530]
call fcn.1400041b0
cmp qword [rax + 0x18], 7
jbe 0x140005122
mov rax, qword [rax]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.MachineId
lea rdx, str.SOFTWAREMicrosoftSQMClient
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x140005199
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005194
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005194
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400baae8
mov edx, reloc.WS2_32.dll_sendto
lea rcx, [rbp + 0x530]
call fcn.140004670
cmp qword [rax + 0x18], 7
jbe 0x1400051b4
mov rax, qword [rax]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 3
lea r8, str.RandomSeed
lea rdx, str.SYSTEMCurrentControlSetServicesTPMODUID
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x14000522b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005226
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005226
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400baae8
mov edx, reloc.WS2_32.dll_sendto
lea rcx, [rbp + 0x530]
call fcn.1400043f0
cmp qword [rax + 0x18], 7
jbe 0x140005246
mov rax, qword [rax]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.AccountDomainSid
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x1400052bd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400052b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400052b8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400baae8
mov edx, reloc.WS2_32.dll_sendto
lea rcx, [rbp + 0x530]
call fcn.1400043f0
cmp qword [rax + 0x18], 7
jbe 0x1400052d8
mov rax, qword [rax]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.PingID
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x14000534f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000534a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000534a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400baae8
mov edx, reloc.WS2_32.dll_sendto
lea rcx, [rbp + 0x530]
call fcn.1400043f0
cmp qword [rax + 0x18], 7
jbe 0x14000536a
mov rax, qword [rax]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.SusClientId
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x1400053e1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400053dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400053dc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400baae8
mov edx, reloc.WS2_32.dll_sendto
lea rcx, [rbp + 0x530]
call fcn.140004670
cmp qword [rax + 0x18], 7
jbe 0x1400053fc
mov rax, qword [rax]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 3
lea r8, str.SusClientIdValidation
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x140005473
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000546e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000546e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400baae8
mov edx, reloc.WS2_32.dll_sendto
lea rcx, [rbp + 0x530]
call fcn.140004670
cmp qword [rax + 0x18], 7
jbe 0x14000548e
mov rax, qword [rax]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 3
lea r8, str.Dhcpv6DUID
lea rdx, str.SYSTEMCurrentControlSetServicesTcpip6Parameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x140005505
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005500
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005500
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400baae8
lea rcx, [rbp + 0x530]
call fcn.1400041b0
cmp qword [rax + 0x18], 7
jbe 0x14000551b
mov rax, qword [rax]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 7
lea r8, str.ComputerHardwareIds
lea rdx, str.SYSTEMCurrentControlSetControlSystemInformation
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x140005592
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000558d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000558d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400baae8
mov edx, reloc.WS2_32.dll_sendto
lea rcx, [rbp + 0x530]
call fcn.140004670
cmp qword [rax + 0x18], 7
jbe 0x1400055ad
mov rax, qword [rax]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 3
lea r8, str.IE_Installed_Date
lea rdx, str.SOFTWAREMicrosoftInternet_ExplorerMigration
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x140005624
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000561f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000561f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400baae8
mov dword [rsp + 0x28], 0x64
lea rbx, [0x140003470]
mov qword [rsp + 0x20], rbx
mov r9d, listen
lea r8, str.WinSqmFirstSessionStartTime
lea rdx, str.SOFTWAREMicrosoftSQMClient
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rbx
mov r9d, listen
lea r8, str.InstallTime
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rbx
mov r9d, listen
lea r8, str.InstallDate
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov edx, reloc.WS2_32.dll_sendto
lea rcx, [rbp + 0x530]
call fcn.140004670
cmp qword [rax + 0x18], 7
jbe 0x1400056d0
mov rax, qword [rax]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 3
lea r8, str.DigitalProductId
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x140005747
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005742
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005742
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400baae8
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rbx
mov r9d, listen
lea r8, str.InstallTime
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov edx, Ordinal_26
lea rcx, [rbp + 0x530]
call fcn.140004670
cmp qword [rax + 0x18], 7
jbe 0x140005790
mov rax, qword [rax]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.BuildGUID
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x140005807
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005802
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005802
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400baae8
mov edx, Ordinal_26
lea rcx, [rbp + 0x530]
call fcn.140004670
cmp qword [rax + 0x18], 7
jbe 0x140005822
mov rax, qword [rax]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.BuildLab
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x140005899
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005894
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005894
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400baae8
mov edx, reloc.WS2_32.dll_sendto
lea rcx, [rbp + 0x530]
call fcn.140004670
cmp qword [rax + 0x18], 7
jbe 0x1400058b4
mov rax, qword [rax]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 3
lea r8, str.DigitalProductId4
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x14000592b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005926
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005926
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400baae8
mov edx, reloc.WS2_32.dll_sendto
lea rcx, [rbp + 0x530]
call fcn.140004670
cmp qword [rax + 0x18], 7
jbe 0x140005946
mov rax, qword [rax]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 3
lea r8, str.IE_Installed_Date
lea rdx, str.SOFTWAREMicrosoftInternet_ExplorerMigration
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x1400059bd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400059b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400059b8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400baae8
lea rcx, [rbp + 0x530]
call fcn.1400041b0
cmp qword [rax + 0x18], 7
jbe 0x1400059d3
mov rax, qword [rax]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.BuildGUID
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x140005a4a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a45
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005a45
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400baae8
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rbp + 0x530]
call fcn.1400043f0
cmp qword [rax + 0x18], 7
jbe 0x140005a65
mov rax, qword [rax]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.ProductId
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x140005adc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005ad7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005ad7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400baae8
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rbp + 0x530]
call fcn.1400043f0
cmp qword [rax + 0x18], 7
jbe 0x140005af7
mov rax, qword [rax]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.BuildLab
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x140005b6e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005b69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005b69
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400baae8
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rbp + 0x530]
call fcn.1400043f0
cmp qword [rax + 0x18], 7
jbe 0x140005b89
mov rax, qword [rax]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.BuildLabEx
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x140005c00
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005bfb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005bfb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400baae8
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rbp + 0x530]
call fcn.1400043f0
cmp qword [rax + 0x18], 7
jbe 0x140005c1b
mov rax, qword [rax]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.ProcessorNameString
lea rdx, str.HARDWAREDESCRIPTIONSystemCentralProcessor0
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x140005c92
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005c8d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005c8d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400baae8
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rbp + 0x530]
call fcn.1400043f0
cmp qword [rax + 0x18], 7
jbe 0x140005cad
mov rax, qword [rax]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str._DriverProviderInfo
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x140005d24
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005d1f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005d1f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400baae8
lea rcx, [rbp + 0x530]
call fcn.1400041b0
cmp qword [rax + 0x18], 7
jbe 0x140005d3a
mov rax, qword [rax]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.UserModeDriverGUID
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x140005db1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005dac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005dac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400baae8
lea rcx, [rbp + 0x530]
call fcn.1400041b0
cmp qword [rax + 0x18], 7
jbe 0x140005dc7
mov rax, qword [rax]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.deviceId
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionOneSettingsWSDUpdateAgentQueryParameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x140005e3e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005e39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005e39
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400baae8
mov ebx, r15d
mov r12d, reloc.WLDAP32.dll_Ordinal_45
nop word [rax + rax]
lea r9, [rbp + 0x55a]
mov r8d, ebx
test ebx, ebx
jns 0x140005ea0
neg r8d
sub r9, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x140005e61
add r9, 0xfffffffffffffffe
mov word [r9], r12w
jmp 0x140005ed0
sub r9, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x140005ea0
lea r8, [rbp + 0x55a]
mov rdx, r9
lea rcx, [rbp + 0x560]
call fcn.140017880
or edi, 0x18
lea r8, [rbp + 0x560]
lea rdx, str.HARDWAREDESCRIPTIONSystemMultifunctionAdapter0DiskController0DiskPeripheral_
lea rcx, [rsp + 0x50]
call fcn.140012220
nop
mov rdx, qword [rbp + 0x578]
cmp rdx, 7
jbe 0x140005f48
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x560]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005f43
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000650c
call fcn.1400baae8
mov qword [rbp + 0x570], r15
mov qword [rbp + 0x578], 7
mov word [rbp + 0x560], r15w
lea rdx, str.ChipsetMatchID
lea rcx, [rbp + 0x530]
call fcn.14000f4e0
nop
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.14000f4e0
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rdx, qword [rsp + 0x30]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x74]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x14000600a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006005
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006513
call fcn.1400baae8
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r15w
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x140006064
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000605f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000651a
call fcn.1400baae8
test esi, esi
je 0x140006106
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rbp + 0x530]
call fcn.1400043f0
cmp qword [rax + 0x18], 7
jbe 0x140006087
mov rax, qword [rax]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rdx, qword [rsp + 0x50]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.ChipsetMatchID
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x140006106
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006100
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006521
call fcn.1400baae8
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x140006148
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006143
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006528
call fcn.1400baae8
inc ebx
cmp ebx, 0x13
jl 0x140005e50
mov rsi, r15
lea rbx, [rbp + 0x430]
nop dword [rax]
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14000616d
mov rdx, qword [rbx]
lea rcx, [rbp + 0x530]
call fcn.14000f4e0
nop
lea rdx, str.HARDWAREDESCRIPTIONDESCRIPTIONSystemBIOS
lea rcx, [rsp + 0x30]
call fcn.14000f4e0
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rdx, qword [rsp + 0x30]
lea rax, [rsp + 0x74]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x70]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r14d, eax
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140006205
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006200
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000652f
call fcn.1400baae8
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r15w
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x14000625f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000625a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006536
call fcn.1400baae8
test r14d, r14d
je 0x1400062fd
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rbp + 0x530]
call fcn.1400043f0
cmp qword [rax + 0x18], 7
jbe 0x140006283
mov rax, qword [rax]
mov r8, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140006290
mov r8, qword [rbx]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 1
lea rdx, str.HARDWAREDESCRIPTIONDESCRIPTIONSystemBIOS
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x1400062fd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400062f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000653d
call fcn.1400baae8
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14000630a
mov rdx, qword [rbx]
lea rcx, [rbp + 0x530]
call fcn.14000f4e0
nop
lea rdx, str.HARDWAREDESCRIPTIONSystemBIOS
lea rcx, [rsp + 0x30]
call fcn.14000f4e0
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rdx, qword [rsp + 0x30]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x7c]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r14d, eax
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x1400063a2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000639d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006544
call fcn.1400baae8
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r15w
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x1400063fc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400063f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000654b
call fcn.1400baae8
test r14d, r14d
je 0x14000649a
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rbp + 0x530]
call fcn.1400043f0
cmp qword [rax + 0x18], 7
jbe 0x140006420
mov rax, qword [rax]
mov r8, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14000642d
mov r8, qword [rbx]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 1
lea rdx, str.HARDWAREDESCRIPTIONSystemBIOS
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x14000649a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006495
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006552
call fcn.1400baae8
inc rsi
add rbx, 0x20
cmp rsi, 8
jl 0x140006160
mov ebx, r15d
nop
lea r9, [rbp + 0x55a]
test ebx, ebx
jns 0x140006559
mov ecx, ebx
neg ecx
nop dword [rax]
nop word [rax + rax]
sub r9, 2
mov eax, 0xcccccccd
mul ecx
shr edx, 3
movzx eax, dx
shl ax, 2
lea r8d, [rax + rdx]
add r8w, r8w
sub cx, r8w
add cx, 0x30
mov word [r9], cx
mov ecx, edx
test edx, edx
jne 0x1400064d0
add r9, 0xfffffffffffffffe
mov word [r9], r12w
jmp 0x140006590
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r8d, ebx
nop dword [rax]
sub r9, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x140006560
lea r8, [rbp + 0x55a]
mov rdx, r9
lea rcx, [rbp + 0x560]
call fcn.140017880
or edi, 6
lea r8, [rbp + 0x560]
lea rdx, str.HARDWAREDESCRIPTIONSystemMultifunctionAdapter0DiskController0DiskPeripheral_
lea rcx, [rsp + 0x50]
call fcn.140012220
nop
mov rdx, qword [rbp + 0x578]
cmp rdx, 7
jbe 0x140006608
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x560]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006603
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006e11
call fcn.1400baae8
mov qword [rbp + 0x570], r15
mov qword [rbp + 0x578], 7
mov word [rbp + 0x560], r15w
lea rdx, str.Identifier
lea rcx, [rbp + 0x530]
call fcn.14000f4e0
nop
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.14000f4e0
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rdx, qword [rsp + 0x30]
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x78]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x1400066ca
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400066c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006e18
call fcn.1400baae8
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r15w
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x140006724
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000671f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006e1f
call fcn.1400baae8
test esi, esi
je 0x1400067c6
mov edx, reloc.WS2_32.dll_sendto
lea rcx, [rbp + 0x530]
call fcn.1400043f0
cmp qword [rax + 0x18], 7
jbe 0x140006747
mov rax, qword [rax]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rdx, qword [rsp + 0x50]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.Identifier
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x1400067c6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400067c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006e26
call fcn.1400baae8
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x140006808
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006803
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006e2d
call fcn.1400baae8
inc ebx
cmp ebx, 0x13
jl 0x1400064b0
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x40], xmm1
xor r8d, r8d
lea rdx, [0x1400ce119]
lea rcx, [rbp + 0x30]
call fcn.1400131c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x60], xmm1
mov r8d, 5
lea rdx, str.0000
lea rcx, [rbp + 0x50]
call fcn.1400131c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x80], xmm1
mov r8d, 5
lea rdx, str.0001
lea rcx, [rbp + 0x70]
call fcn.1400131c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xa0], xmm1
mov r8d, 5
lea rdx, str.0002
lea rcx, [rbp + 0x90]
call fcn.1400131c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xc0], xmm1
mov r8d, 5
lea rdx, str.0003
lea rcx, [rbp + 0xb0]
call fcn.1400131c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xe0], xmm1
mov r8d, 5
lea rdx, str.0004
lea rcx, [rbp + 0xd0]
call fcn.1400131c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x100], xmm1
mov r8d, 5
lea rdx, str.0005
lea rcx, [rbp + 0xf0]
call fcn.1400131c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x120], xmm1
mov r8d, 5
lea rdx, str.0006
lea rcx, [rbp + 0x110]
call fcn.1400131c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x140], xmm1
mov r8d, 5
lea rdx, str.0007
lea rcx, [rbp + 0x130]
call fcn.1400131c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x160], xmm1
mov r8d, 5
lea rdx, str.0008
lea rcx, [rbp + 0x150]
call fcn.1400131c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x170], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x180], xmm1
mov r8d, 5
lea rdx, str.0009
lea rcx, [rbp + 0x170]
call fcn.1400131c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x190], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1a0], xmm1
mov r8d, 5
lea rdx, str.0010
lea rcx, [rbp + 0x190]
call fcn.1400131c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1c0], xmm1
mov r8d, 4
lea rdx, str.0011
lea rcx, [rbp + 0x1b0]
call fcn.1400131c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1e0], xmm1
mov r8d, 4
lea rdx, str.0012
lea rcx, [rbp + 0x1d0]
call fcn.1400131c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x200], xmm1
mov r8d, 4
lea rdx, str.0013
lea rcx, [rbp + 0x1f0]
call fcn.1400131c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x210], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x220], xmm1
mov r8d, 4
lea rdx, str.0014
lea rcx, [rbp + 0x210]
call fcn.1400131c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x230], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x240], xmm1
mov r8d, 4
lea rdx, str.0015
lea rcx, [rbp + 0x230]
call fcn.1400131c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x250], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x260], xmm1
mov r8d, 4
lea rdx, str.0016
lea rcx, [rbp + 0x250]
call fcn.1400131c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x270], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x280], xmm1
mov r8d, 4
lea rdx, str.0017
lea rcx, [rbp + 0x270]
call fcn.1400131c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x290], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x2a0], xmm1
mov r8d, 4
lea rdx, str.0018
lea rcx, [rbp + 0x290]
call fcn.1400131c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x2b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x2c0], xmm1
mov r8d, 4
lea rdx, str.0019
lea rcx, [rbp + 0x2b0]
call fcn.1400131c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x2d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x2e0], xmm1
mov r8d, 4
lea rdx, str.0014
lea rcx, [rbp + 0x2d0]
call fcn.1400131c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x2f0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x300], xmm1
mov r8d, 4
lea rdx, str.0020
lea rcx, [rbp + 0x2f0]
call fcn.1400131c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x310], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x320], xmm1
mov r8d, 4
lea rdx, str.0021
lea rcx, [rbp + 0x310]
call fcn.1400131c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x330], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x340], xmm1
mov r8d, 4
lea rdx, str.0022
lea rcx, [rbp + 0x330]
call fcn.1400131c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x350], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x360], xmm1
mov r8d, 4
lea rdx, str.0023
lea rcx, [rbp + 0x350]
call fcn.1400131c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x370], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x380], xmm1
mov r8d, 4
lea rdx, str.0024
lea rcx, [rbp + 0x370]
call fcn.1400131c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x390], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x3a0], xmm1
mov r8d, 4
lea rdx, str.0025
lea rcx, [rbp + 0x390]
call fcn.1400131c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x3b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x3c0], xmm1
mov r8d, 4
lea rdx, str.0026
lea rcx, [rbp + 0x3b0]
call fcn.1400131c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x3e0], xmm1
mov r8d, 4
lea rdx, str.0027
lea rcx, [rbp + 0x3d0]
call fcn.1400131c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x3f0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x400], xmm1
mov r8d, 4
lea rdx, str.0028
lea rcx, [rbp + 0x3f0]
call fcn.1400131c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x410], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x420], xmm1
mov r8d, 4
lea rdx, str.0029
lea rcx, [rbp + 0x410]
call fcn.1400131c0
nop
mov rsi, r15
movabs r14, 0xf0f0f0f0f0f0f0f1
nop word [rax + rax]
mov rax, rsi
shl rax, 5
lea rdx, [rbp + 0x30]
add rdx, rax
cmp qword [rdx + 0x18], 0xf
jbe 0x140006e34
mov r8, qword [rdx]
mov r9, r8
add r8, qword [rdx + 0x10]
jmp 0x140006e3e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r8, qword [rdx + 0x10]
add r8, rdx
mov r9, rdx
mov rdx, r9
lea rcx, [rbp + 0x530]
call fcn.1400124c0
nop
mov r8, rax
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e972_e325_11ce_bfc1_08002be10318
lea rcx, [rsp + 0x50]
call fcn.140012220
nop
mov rdx, qword [rbp + 0x548]
cmp rdx, 7
jbe 0x140006ea9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006ea4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007642
call fcn.1400baae8
mov qword [rbp + 0x540], r15
mov qword [rbp + 0x548], 7
mov word [rbp + 0x530], r15w
lea rdx, str.OriginalNetworkAddress
lea rcx, [rsp + 0x30]
call fcn.14000f4e0
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rdx, qword [rsp + 0x50]
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x78]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140006f4d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006f48
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007650
call fcn.1400baae8
test ebx, ebx
je 0x140006fe3
lea rcx, [rsp + 0x30]
call fcn.140003ef0
cmp qword [rax + 0x18], 7
jbe 0x140006f69
mov rax, qword [rax]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rdx, qword [rsp + 0x50]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.OriginalNetworkAddress
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140006fe3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006fde
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007649
call fcn.1400baae8
lea rdx, str.NetworkAddress
lea rcx, [rsp + 0x30]
call fcn.14000f4e0
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rdx, qword [rsp + 0x50]
lea rax, [rsp + 0x74]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x80]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x14000706c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007067
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007650
call fcn.1400baae8
test ebx, ebx
je 0x140007102
lea rcx, [rsp + 0x30]
call fcn.140003ef0
cmp qword [rax + 0x18], 7
jbe 0x140007088
mov rax, qword [rax]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rdx, qword [rsp + 0x50]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.NetworkAddress
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140007102
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400070fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007657
call fcn.1400baae8
lea rdx, str.InstallTimeStamp
lea rcx, [rbp + 0x560]
call fcn.14000f4e0
nop
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.14000f4e0
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rdx, qword [rsp + 0x30]
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x78]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x1400071a8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400071a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000765e
call fcn.1400baae8
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r15w
mov rdx, qword [rbp + 0x578]
cmp rdx, 7
jbe 0x140007202
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x560]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400071fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007665
call fcn.1400baae8
test ebx, ebx
je 0x140007353
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
movups xmm0, xmmword [str.ABCDEF0123456789]
movups xmmword [rbp + 0x560], xmm0
movzx eax, byte [0x1400ce350]
mov byte [rbp + 0x570], al
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r15w
or edi, 1
mov dword [rsp + 0x70], edi
mov ebx, Ordinal_26
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movsxd rcx, eax
mov rax, r14
mul rcx
shr rdx, 4
imul rax, rdx, 0x11
sub rcx, rax
movsx r9d, byte [rbp + rcx + 0x560]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
cmp rcx, rdx
jae 0x1400072b7
lea rax, [rcx + 1]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
cmp rdx, 7
cmova rax, qword [rsp + 0x30]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r15w
jmp 0x1400072c1
lea rcx, [rsp + 0x30]
call fcn.140012cf0
sub rbx, 1
jne 0x140007260
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rax, qword [rsp + 0x30]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rdx, qword [rsp + 0x50]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 3]
lea r8, str.InstallTimeStamp
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
and edi, 0xfffffffe
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140007353
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000734e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000766c
call fcn.1400baae8
lea rdx, str.CLSGUID
lea rcx, [rbp + 0x560]
call fcn.14000f4e0
nop
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.14000f4e0
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rdx, qword [rsp + 0x30]
lea rax, [rbp - 0x74]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x70]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x1400073f9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400073f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007673
call fcn.1400baae8
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r15w
mov rdx, qword [rbp + 0x578]
cmp rdx, 7
jbe 0x140007453
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x560]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000744e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000767a
call fcn.1400baae8
test ebx, ebx
je 0x1400074ea
lea rcx, [rsp + 0x30]
call fcn.1400041b0
cmp qword [rax + 0x18], 7
jbe 0x14000746f
mov rax, qword [rax]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rdx, qword [rsp + 0x50]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.CLSGUID
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x1400074ea
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400074e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007681
call fcn.1400baae8
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x14000752c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007527
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007688
call fcn.1400baae8
inc rsi
cmp rsi, 0x20
jl 0x140006df0
lea rbx, str.C:WindowsSystem32_restoreMachineGuid.txt
mov qword [rbp - 0x60], rbx
lea r11, str.C:WindowsINF_setupapi.dev.log
mov qword [rbp - 0x58], r11
lea r10, str.C:UsersPublicShared_Files
mov qword [rbp - 0x50], r10
lea r9, str.C:ProgramDataMicrosoftWindowsWER
mov qword [rbp - 0x48], r9
lea r8, str.C:System_Volume_Information_tracking.log
mov qword [rbp - 0x40], r8
lea rdx, str.C:System_Volume_InformationWPSettings.dat
mov qword [rbp - 0x38], rdx
lea rcx, str.C:System_Volume_InformationIndexerVolumeGuid
mov qword [rbp - 0x30], rcx
lea rax, str.C:UsersPublicLibrariescollection.dat
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], r11
mov qword [rbp - 8], r10
mov qword [rbp], r9
mov qword [rbp + 8], r8
mov qword [rbp + 0x10], rdx
mov qword [rbp + 0x18], rcx
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rbx
lea rbx, [rbp - 0x60]
nop dword [rax]
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add rbx, 8
lea rax, [rbp + 0x30]
cmp rbx, rax
jne 0x1400075c0
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
nop
lea r9, [fcn.14000f6f0]
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov r8d, edx
lea rcx, [rbp + 0x30]
call fcn.1400ba7d8
nop
lea r9, [fcn.140007800]
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea r8d, [rdx - 0x18]
lea rcx, [rbp + 0x430]
call fcn.1400ba7d8
mov rcx, qword [rbp + 0x580]
xor rcx, rsp
call fcn.1400ba5d0
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3