Function at 0x140032130
Capabilities:
Execute command
Persist via windows service
Set registry value

Disassembly:
mov eax, 0x3348
call fcn.140130590
sub rsp, rax
lea rdx, str.reg_delete_HKLMSystemCurrentControlSetControlTimeZoneInformation__f__nul_2_1
lea rcx, [rsp + 0x390]
call fcn.140032f00
mov rcx, rax
call fcn.140032f30
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersionNotificationsData__v_418A073AA3BC3475__t_REG_BINARY__d__random__random__random__random__random__random__random__random__random__random__random__random___f__nul_2_1
lea rcx, [rsp + 0x3250]
call fcn.140032f50
mov rcx, rax
call fcn.140032f80
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.reg_delete_HKLMHARDWAREDESCRIPTIONSystemCentralProcessor0__f__nul_2_1
lea rcx, [rsp + 0x340]
call fcn.140032fa0
mov rcx, rax
call fcn.140032fd0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x1401513c0]
lea rcx, [rsp + 0x2480]
call fcn.140032ff0
mov rcx, rax
call fcn.140033020
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSYSTEMCurrentControlSetControlComputerNameComputerName__v_ComputerName__t_REG_SZ__d_DESKTOP__random___f__nul_2_1
lea rcx, [rsp + 0x1590]
call fcn.140033040
mov rcx, rax
call fcn.140033070
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSYSTEMCurrentControlSetControlComputerNameActiveComputerName__v_ComputerName__t_REG_SZ__d_DESKTOP__random___f__nul_2_1
lea rcx, [rsp + 0x16b0]
call fcn.140033090
mov rcx, rax
call fcn.1400330c0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate__v_SusClientId__t_REG_SZ__d_Apple_random___random___random___random___f__nul_2_1
lea rcx, [rsp + 0x1be0]
call fcn.1400330e0
mov rcx, rax
call fcn.140033110
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSYSTEMHardwareConfig__v_LastConfig__t_REG_SZ__d_Apple__random___random__f__nul_2_1
lea rcx, [rsp + 0x780]
call fcn.140033130
mov rcx, rax
call fcn.140033160
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSYSTEMHardwareConfigCurrent__v_BaseBoardProduct__t_REG_SZ__d_Apple__random__random__random___f__nul_2_1
lea rcx, [rsp + 0xee0]
call fcn.140033180
mov rcx, rax
call fcn.1400331b0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSYSTEMSoftwareMicrosoft__v_BuildLab__t_REG_SZ__d_Apple__random___f__nul_2_1
lea rcx, [rsp + 0x4b0]
call fcn.1400331d0
mov rcx, rax
call fcn.140033200
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSYSTEMSoftwareMicrosoft__v_BuildLabEx__t_REG_SZ__d_Apple__random___f__nul_2_1
lea rcx, [rsp + 0x5d0]
call fcn.140033220
mov rcx, rax
call fcn.140033250
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMHARDWAREDESCRIPTIONSystemBIOS__v_BaseBoardProduct__t_REG_SZ__d_Apple__random__random__random___f__nul_2_1
lea rcx, [rsp + 0x1060]
call fcn.140033270
mov rcx, rax
call fcn.1400332a0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSYSTEMControlSet001ServiceskbdclassParameters__v_WppRecorder_TraceGuid__t_REG_SZ__d_Apple__random___random___random__random___f__nul_2_1
lea rcx, [rsp + 0x2040]
call fcn.1400332c0
mov rcx, rax
call fcn.1400332f0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSYSTEMControlSet001ServicesmouhidParameters__v_WppRecorder_TraceGuid__t_REG_SZ__d_Apple__random___random___random__random___f__nul_2_1
lea rcx, [rsp + 0x1e60]
call fcn.140033310
mov rcx, rax
call fcn.140033340
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSYSTEMControlSet001ControlClass4d36e968_e325_11ce_bfc1_08002be103180000__v_UserModeDriverGUID__t_REG_SZ__d_Apple__random___random___random__random___f__nul_2_1
lea rcx, [rsp + 0x2780]
call fcn.140033360
mov rcx, rax
call fcn.140033390
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_BuildBranch__t_REG_SZ__d_Apple__random___random___random__random___f__nul_2_1
lea rcx, [rsp + 0x18f0]
call fcn.1400333b0
mov rcx, rax
call fcn.1400333e0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_BuildGUID__t_REG_SZ__d_Apple__random___random___random__random___f__nul_2_1
lea rcx, [rsp + 0x17d0]
call fcn.140033400
mov rcx, rax
call fcn.140033430
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_BuildLab__t_REG_SZ__d_Apple__random___random___random__random___f__nul_2_1
lea rcx, [rsp + 0x1740]
call fcn.140033450
mov rcx, rax
call fcn.140033480
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMHARDWAREDEVICEMAPScsiScsi___Port___0Scsi___Bus___0Target___Id___0Logical___Unit___Id___0__v_Identifier__t_REG_SZ__d_Apple__random___random___random__random___f__nul_2_1
lea rcx, [rsp + 0x2cc0]
call fcn.1400334a0
mov rcx, rax
call fcn.1400334d0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMHARDWAREDEVICEMAPScsiScsi___Port___1Scsi___Bus___0Target___Id___0Logical___Unit___Id___0__v_Identifier__t_REG_SZ__d_Apple__random___random___random__random___f__nul_2_1
lea rcx, [rsp + 0x2d80]
call fcn.1400334a0
mov rcx, rax
call fcn.1400334d0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMHARDWAREDESCRIPTIONSystemMultifunctionAdapter0DiskController0DiskPeripheral0__v_Identifier__t_REG_SZ__d_Apple__random___random___random__random___f__nul_2_1
lea rcx, [rsp + 0x2300]
call fcn.1400334f0
mov rcx, rax
call fcn.140033520
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMHARDWAREDESCRIPTIONSystemMultifunctionAdapter0DiskController0DiskPeripheral1__v_Identifier__t_REG_SZ__d_Apple__random___random___random__random___f__nul_2_1
lea rcx, [rsp + 0x23c0]
call fcn.1400334f0
mov rcx, rax
call fcn.140033520
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSYSTEMControlSet001ServicesBasicDisplayVideo__v_VideoID__t_REG_SZ__d_Apple__random___random___random__random___f__nul_2_1
lea rcx, [rsp + 0x1980]
call fcn.1400333b0
mov rcx, rax
call fcn.1400333e0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x140151fb0]
lea rcx, [rsp + 0x11e0]
call fcn.140033540
mov rcx, rax
call fcn.140033570
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSYSTEMCurrentControlSetServicesTcpipParameters__v_Hostname__t_REG_SZ__d_DESKTOP__random___f__nul_2_1
lea rcx, [rsp + 0xe60]
call fcn.140033590
mov rcx, rax
call fcn.1400335c0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSystemCurrentControlSetServicesTcpipParameters__v_Domain__t_REG_SZ__d__random___f__nul_2_1
lea rcx, [rsp + 0xa20]
call fcn.1400335e0
mov rcx, rax
call fcn.140033610
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSystemCurrentControlSetControlDevQuery6__v_UUID__t_REG_SZ__d__random___f__nul_2_1
lea rcx, [rsp + 0x7f0]
call fcn.140033130
mov rcx, rax
call fcn.140033160
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSYSTEMCurrentControlSetServicesTcpipParameters__v_NV___Hostname__t_REG_SZ__d_DESKTOP__random___f__nul_2_1
lea rcx, [rsp + 0x1260]
call fcn.140033540
mov rcx, rax
call fcn.140033570
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSYSTEMCurrentControlSetControlIDConfigDBHardware___Profiles0001__v_HwProfileGuid__t_REG_SZ__d_Apple_random___random___random___random__random___f__nul_2_1
lea rcx, [rsp + 0x2240]
call fcn.140033630
mov rcx, rax
call fcn.140033660
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSYSTEMCurrentControlSetControlIDConfigDBHardware___Profiles0001__v_GUID__t_REG_SZ__d_Apple_random___random___random___random__random___f__nul_2_1
lea rcx, [rsp + 0x20e0]
call fcn.140033680
mov rcx, rax
call fcn.1400336b0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_BuildGUID__t_REG_SZ__d__random___f__nul_2_1
lea rcx, [rsp + 0x9b0]
call fcn.1400336d0
mov rcx, rax
call fcn.140033700
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_REGisteredOwner__t_REG_SZ__d__random___f__nul_2_1
lea rcx, [rsp + 0xbe0]
call fcn.140033720
mov rcx, rax
call fcn.140033750
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_REGisteredOrganization__t_REG_SZ__d__random___f__nul_2_1
lea rcx, [rsp + 0xf60]
call fcn.140033770
mov rcx, rax
call fcn.1400337a0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSOFTWAREMicrosoftCryptography__v_GUID__t_REG_SZ__d__random___random___random___random___f__nul_2_1
lea rcx, [rsp + 0xce0]
call fcn.1400337c0
mov rcx, rax
call fcn.1400337f0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSOFTWAREMicrosoftCryptography__v_MachineGuid__t_REG_SZ__d_Apple_random___random___random___random___f__nul_2_1
lea rcx, [rsp + 0x12e0]
call fcn.140033810
mov rcx, rax
call fcn.140033840
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_ProductId__t_REG_SZ__d_Apple_random___random___random___random___f__nul_2_1
lea rcx, [rsp + 0x1860]
call fcn.140033400
mov rcx, rax
call fcn.140033430
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_InstallDate__t_REG_SZ__d_Apple_random___f__nul_2_1
lea rcx, [rsp + 0xd60]
call fcn.1400337c0
mov rcx, rax
call fcn.1400337f0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_InstallTime__t_REG_SZ__d__random___f__nul_2_1
lea rcx, [rsp + 0xb00]
call fcn.140033860
mov rcx, rax
call fcn.140033890
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_BuildLabEx__t_REG_SZ__d__random___f__nul_2_1
lea rcx, [rsp + 0xa90]
call fcn.1400335e0
mov rcx, rax
call fcn.140033610
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSYSTEMCurrentControlSetControlSystemInformation__v_ComputerHardwareId__t_REG_SZ__d_Apple_random___random___random___random___f__nul_2_1
lea rcx, [rsp + 0x1f00]
call fcn.140033310
mov rcx, rax
call fcn.140033340
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_delete_HKCUSoftwareEpic___Games__f__nul_2_1
lea rcx, [rsp + 0x20]
call fcn.1400338b0
mov rcx, rax
call fcn.1400338e0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersionTracingMicrosoftProfileProfile__v_Guid__t_REG_SZ__d__random___random___random___random__random___f__nul_2_1
lea rcx, [rsp + 0x2190]
call fcn.140033900
mov rcx, rax
call fcn.140033930
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.reg_delete_HKLMSOFTWAREClassescom.epicgames.launcher__f__nul_2_1
lea rcx, [rsp + 0x2a0]
call fcn.140033950
mov rcx, rax
call fcn.140033980
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.reg_delete_HKLMSOFTWAREWOW6432NodeEpicGames__f__nul_2_1
lea rcx, [rsp + 0x140]
call fcn.140031de0
mov rcx, rax
call fcn.140031e10
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.reg_delete_HKLMSOFTWAREWOW6432NodeEpic___Games__f__nul_2_1
lea rcx, [rsp + 0x1c0]
call fcn.1400339a0
mov rcx, rax
call fcn.1400339d0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.reg_delete_HKCRcom.epicgames.launcher__f__nul_2_1
lea rcx, [rsp + 0xc8]
call fcn.1400339f0
mov rcx, rax
call fcn.140033a20
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x140152a60]
lea rcx, [rsp + 0x58]
call fcn.1400338b0
mov rcx, rax
call fcn.1400338e0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x140152aa0]
lea rcx, [rsp + 0x200]
call fcn.140033a40
mov rcx, rax
call fcn.140033a70
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.reg_delete_HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerBitBucketVolume__f__nul_2_1
lea rcx, [rsp + 0x630]
call fcn.140033a90
mov rcx, rax
call fcn.140033ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.reg_delete_HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerMountPoints2CPCVolume__f__nul_2_1
lea rcx, [rsp + 0x8d0]
call fcn.140033ae0
mov rcx, rax
call fcn.140033b10
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.reg_delete_HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerMountPoints2__f__nul_2_1
lea rcx, [rsp + 0x510]
call fcn.140033b30
mov rcx, rax
call fcn.140033b60
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.reg_delete_HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerBitBucketLastEnum__f__nul_2_1
lea rcx, [rsp + 0x710]
call fcn.140033b80
mov rcx, rax
call fcn.140033bb0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate__v_AccountDomainSid__t_REG_SZ__d_Apple__random___random___random__random___f__nul_2_1
lea rcx, [rsp + 0x1fa0]
call fcn.140033bd0
mov rcx, rax
call fcn.140033c00
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate__v_PingID__t_REG_SZ__d_Apple__random___random___random__random___f__nul_2_1
lea rcx, [rsp + 0x1aa0]
call fcn.140033c20
mov rcx, rax
call fcn.140033c50
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate__v_SusClientId__t_REG_SZ__d_Apple__random___random___random__random___f__nul_2_1
lea rcx, [rsp + 0x1c80]
call fcn.1400330e0
mov rcx, rax
call fcn.140033110
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.reg_delete_HKLMSYSTEMCurrentControlSetServicesmssmbiosData__v_SMBiosData__f__nul_2_1
lea rcx, [rsp + 0x3f0]
call fcn.140033c70
mov rcx, rax
call fcn.140033ca0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSOFTWARENVIDIA___CorporationGlobal__v_ClientUUID__t_REG_SZ__d_Apple__random___random___random__random___f__nul_2_1
lea rcx, [rsp + 0x1620]
call fcn.140033040
mov rcx, rax
call fcn.140033070
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSOFTWARENVIDIA___CorporationGlobal__v_PersistenceIdentifier__t_REG_SZ__d_Apple__random___random___random__random___f__nul_2_1
lea rcx, [rsp + 0x1a10]
call fcn.1400333b0
mov rcx, rax
call fcn.1400333e0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSOFTWARENVIDIA___CorporationGlobalCoProcManager__v_ChipsetMatchID__t_REG_SZ__d_Apple__random___random___random__random___f__nul_2_1
lea rcx, [rsp + 0x1b40]
call fcn.140033cc0
mov rcx, rax
call fcn.140033cf0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.reg_delete_HKLMSYSTEMMountedDevices__f__nul_2_1
lea rcx, [rsp + 0x90]
call fcn.1400338b0
mov rcx, rax
call fcn.1400338e0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.reg_delete_HKCUSoftwareMicrosoftWindowsShellAssociationsUrlAssociationscom.epicgames.launcher__f__nul_2_1
lea rcx, [rsp + 0xc60]
call fcn.140033720
mov rcx, rax
call fcn.140033750
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.reg_delete_HKLMSOFTWAREMicrosoftDfrgStatistics__f__nul_2_1
lea rcx, [rsp + 0x250]
call fcn.140033a40
mov rcx, rax
call fcn.140033a70
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.reg_delete_HKCUSOFTWAREMicrosoftWindowsCurrentVersionExplorerBitBucketVolume__f__nul_2_1
lea rcx, [rsp + 0x6a0]
call fcn.140033a90
mov rcx, rax
call fcn.140033ac0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.reg_delete_HKCUSOFTWAREMicrosoftWindowsCurrentVersionExplorerMountPoints2CPCVolume__f__nul_2_1
lea rcx, [rsp + 0x940]
call fcn.140033ae0
mov rcx, rax
call fcn.140033b10
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.reg_delete_HKCUSOFTWAREMicrosoftWindowsCurrentVersionExplorerMountPoints2__f__nul_2_1
lea rcx, [rsp + 0x570]
call fcn.140033b30
mov rcx, rax
call fcn.140033b60
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.reg_delete_HKCUSOFTWAREMicrosoftWindowsCurrentVersionExplorerBitBucket__v_LastEnum__f__nul_2_1
lea rcx, [rsp + 0x860]
call fcn.140033d10
mov rcx, rax
call fcn.140033d40
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKCUSoftwareClassesInterface__v_ClsidStore__t_REG_BINARY__d__random__random__random__random__random__random__random__random__random__random__random__random___f__nul_2_1
lea rcx, [rsp + 0x2540]
call fcn.140032ff0
mov rcx, rax
call fcn.140033020
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSYSTEMCurrentControlSetControlSystemInformation__v_ComputerHardwareId__t_REG_SZ__d_Apple__random___random___random__random___f__nul_2_1
lea rcx, [rsp + 0x1d20]
call fcn.140033d60
mov rcx, rax
call fcn.140033d90
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSYSTEMCurrentControlSetControlSystemInformation__v_ComputerHardwareIds__t_REG_SZ__d_Apple__random___random___random__random___f__nul_2_1
lea rcx, [rsp + 0x1dc0]
call fcn.140033db0
mov rcx, rax
call fcn.140033de0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSOFTWAREMicrosoftSQMClient__v_MachineId__t_REG_SZ__d_Apple__random___random___random__random___f__nul_2_1
lea rcx, [rsp + 0xfe0]
call fcn.140033e00
mov rcx, rax
call fcn.140033e30
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.reg_delete_HKCUSoftwareClassesInterface__v_ClsidStore__f__nul_2_1
lea rcx, [rsp + 0x2f0]
call fcn.140033e50
mov rcx, rax
call fcn.140033e80
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000__v__DriverProviderInfo__t_REG_SZ__d_Apple__random___random___random__random___f__nul_2_1
lea rcx, [rsp + 0x2c00]
call fcn.140033ea0
mov rcx, rax
call fcn.140033ed0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000__v_UserModeDriverGUID__t_REG_SZ__d_Apple__random___random___random__random___f__nul_2_1
lea rcx, [rsp + 0x2b40]
call fcn.140033ef0
mov rcx, rax
call fcn.140033f20
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.reg_delete_HKLMSOFTWAREMicrosoftWindowsCurrentVersionDiagnosticsDiagTrackSettingsRequests__f__nul_2_1
lea rcx, [rsp + 0xb70]
call fcn.140033860
mov rcx, rax
call fcn.140033890
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.reg_delete_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersionSoftwareProtectionPlatform__v_BackupProductKeyDefault__f__nul_2_1
lea rcx, [rsp + 0x1500]
call fcn.140033f40
mov rcx, rax
call fcn.140033f70
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.reg_delete_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersionSoftwareProtectionPlatform__v_actionlist__f__nul_2_1
lea rcx, [rsp + 0xde0]
call fcn.140033f90
mov rcx, rax
call fcn.140033fc0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x140153900]
lea rcx, [rsp + 0x10e0]
call fcn.140033270
mov rcx, rax
call fcn.1400332a0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.reg_delete_HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist__f__nul_2_1
lea rcx, [rsp + 0x450]
call fcn.140033c70
mov rcx, rax
call fcn.140033ca0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.reg_delete_HKCUSoftwareHex_RaysIDAHistory__f__nul_2_1
lea rcx, [rsp + 0x100]
call fcn.140033fe0
mov rcx, rax
call fcn.140034010
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.reg_delete_HKCUSoftwareHex_RaysIDAHistory64__f__nul_2_1
lea rcx, [rsp + 0x180]
call fcn.140034030
mov rcx, rax
call fcn.140034060
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.reg_delete_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersionSoftwareProtectionPlatform__v_ServiceSessionId__f__nul_2_1
lea rcx, [rsp + 0x1160]
call fcn.140033270
mov rcx, rax
call fcn.1400332a0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKCUSoftwareMicrosoftDirect3D__v_WHQLClass__t_REG_BINARY__d__random__random__random__random__random__random__random__random__random__random__random__random___f__nul_2_1
lea rcx, [rsp + 0x2600]
call fcn.140032ff0
mov rcx, rax
call fcn.140033020
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKCUSoftwareClassesInstallerDependencies__v_MSICache__t_REG_BINARY__d__random__random__random__random__random__random__random__random__random__random__random___f__nul_2_1
lea rcx, [rsp + 0x2900]
call fcn.140034080
mov rcx, rax
call fcn.1400340b0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSYSTEMCurrentControlSetServicesTPMWMI__v_WindowsAIKHash__t_REG_BINARY__d__random__random__random__random__random__random__random__random__random__random___f__nul_2_1
lea rcx, [rsp + 0x29c0]
call fcn.140034080
mov rcx, rax
call fcn.1400340b0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate__v_SusClientIdValidation__t_REG_BINARY__d__random__random__random__random__random__random__random__random__random__random__random__random___f__nul_2_1
lea rcx, [rsp + 0x3170]
call fcn.1400340d0
mov rcx, rax
call fcn.140034100
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKCUSYSTEMCurrentControlSetServicesTPMODUID__v_RandomSeed__t_REG_BINARY__d__random__random__random__random__random__random__random__random__random__random__random__random___f__nul_2_1
lea rcx, [rsp + 0x2fd0]
call fcn.140034120
mov rcx, rax
call fcn.140034150
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSOFTWAREMicrosoftInternet___ExplorerMigration__v_IE___Installed___Date__t_REG_BINARY__d__random__random__random__random__random__random__random__random__random___f__nul_2_1
lea rcx, [rsp + 0x2e40]
call fcn.140034170
mov rcx, rax
call fcn.1400341a0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_DigitalProductId__t_REG_BINARY__d__random__random__random__random__random__random__random__random__random___f__nul_2_1
lea rcx, [rsp + 0x2840]
call fcn.140033360
mov rcx, rax
call fcn.140033390
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_DigitalProductId4__t_REG_BINARY__d__random__random__random__random__random__random__random__random__random___f__nul_2_1
lea rcx, [rsp + 0x2a80]
call fcn.140034080
mov rcx, rax
call fcn.1400340b0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSOFTWAREMicrosoftSQMClient__v_WinSqmFirstSessionStartTime__t_REG_QWORD__d__random__random__random___f__nul_2_1
lea rcx, [rsp + 0x1360]
call fcn.140033810
mov rcx, rax
call fcn.140033840
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_InstallTime__t_REG_QWORD__d__random__random__random___f__nul_2_1
lea rcx, [rsp + 0x13e0]
call fcn.1400341c0
mov rcx, rax
call fcn.1400341f0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_InstallDate__t_REG_QWORD__d__random__random__random___f__nul_2_1
lea rcx, [rsp + 0x1470]
call fcn.1400341c0
mov rcx, rax
call fcn.1400341f0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindowsCurrentVersionDiagnosticsDiagTrackSevilleEventlogManager__v_LastEventlogWrittenTime__t_REG_QWORD__d__random__random__random___f__nul_2_1
lea rcx, [rsp + 0x26c0]
call fcn.140032ff0
mov rcx, rax
call fcn.140033020
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSystemCurrentControlSetControlNotifications__v_418A073AA3BC8075__t_REG_BINARY__d__random__random__random__random__random__random__random__random__random__random__random__random___f__nul_2_1
lea rcx, [rsp + 0x30a0]
call fcn.140034210
mov rcx, rax
call fcn.140034240
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindowsCurrentVersionWINEVTChannelsMicrosoft_Windows_Kernel_EventTracing_Admin__v_OwningPublisher__t_REG_SZ__d__random___random___random__random___f__nul_2_1
lea rcx, [rsp + 0x2f00]
call fcn.140034260
mov rcx, rax
call fcn.140034290
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, 1
add rsp, 0x3348
ret