Function at 0x14000dae9
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
movaps xmmword [rsp + 0xb0], xmm11
movaps xmmword [rsp + 0xa0], xmm10
movaps xmmword [rsp + 0x90], xmm9
movaps xmmword [rsp + 0x80], xmm8
movaps xmmword [rsp + 0x70], xmm7
movaps xmmword [rsp + 0x60], xmm6
mov r15, rcx
call fcn.14003b9e6
lea rbx, [rsp + 0x48]
and qword [rbx], 0
mov r12d, 8
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, str.softwaresoftwareclasses_allfilesystemobjects_shellexcontextmenuhandlerssoftwareclasses_allfilesystemobjects_shellexdragdrophandlerssoftwareclasses_allfilesystemobjects_shellexpropertysheethandlerssoftwareclassesclsidserverexecutable
lea rsi, [rsp + 0x30]
mov r9d, 8
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b51d8]
lea rsi, [rsp + 0x30]
mov r9d, 0x41
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5219]
lea rsi, [rsp + 0x30]
mov r9d, 0x3e
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5257]
lea rsi, [rsp + 0x30]
mov r9d, 0x43
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov r13d, 2
mov ecx, 2
call fcn.14009822a
mov qword [rbx], rax
mov qword [rbx + 8], rdx
movups xmm8, xmmword [str.ntdll.dll]
movups xmmword [rdx], xmm8
movups xmm9, xmmword [0x1400b52d0]
movups xmmword [rdx + 0x10], xmm9
mov qword [rbx + 0x10], r13
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b529a]
lea rsi, [rsp + 0x30]
mov r9d, 0x16
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, str.softwareclasses.cmdsoftwareclassesdirectory_background_shellexcontextmenuhandlerssoftwareclassesdirectory_shellexcontextmenuhandlerssoftwareclassesdirectory_shellexcopyhookhandlerssoftwareclassesdirectory_shellexdragdrophandlerssoftwareclassesdirectory_shellexpropertysheethandlerssoftwareclassesdrive_shellexcontextmenuhandlerssoftwareclassesexefile_shellopencommandsoftwareclasses.exesoftwareclasses_filtersoftwareclasses_folder_shellexcolumnhandlerssoftwareclasses_folder_shellexcontextmenuhandlerssoftwareclasses_folder_shellexdragdrophandlerssoftwareclasses_folder_shellexextshellfolderviewssoftwareclasses_folder_shellexpropertysheethandlerssoftwareclasseshtmlfile_shellopencommandsoftwareclassesprotocols_filtersoftwareclassesprotocolshandlersoftwareclasses_shellexcontextmenuhandlerssoftwareclasses_shellexpropertysheethandlerssoftwareclientsmailsoftwaremicrosoft_active_setupinstalled_componentsstubpath
lea rsi, [rsp + 0x30]
mov r9d, 0x15
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b52f5]
lea rsi, [rsp + 0x30]
mov r9d, 0x41
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5336]
lea rsi, [rsp + 0x30]
mov r9d, 0x36
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b536c]
lea rsi, [rsp + 0x30]
mov r9d, 0x33
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b539f]
lea rsi, [rsp + 0x30]
mov r9d, 0x33
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b53d2]
lea rsi, [rsp + 0x30]
mov r9d, 0x38
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b540a]
lea rsi, [rsp + 0x30]
mov r9d, 0x32
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov ebp, 1
mov ecx, 1
call fcn.14009822a
mov qword [rbx], rax
mov qword [rbx + 8], rdx
movups xmm6, xmmword [str.ntdll.dll]
movups xmmword [rdx], xmm6
mov qword [rbx + 0x10], rbp
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b543c]
lea rsi, [rsp + 0x30]
mov r9d, 0x2b
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5467]
lea rsi, [rsp + 0x30]
mov r9d, 0x15
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b547c]
lea rsi, [rsp + 0x30]
mov r9d, 0x17
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5493]
lea rsi, [rsp + 0x30]
mov r9d, 0x2e
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b54c1]
lea rsi, [rsp + 0x30]
mov r9d, 0x33
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b54f4]
lea rsi, [rsp + 0x30]
mov r9d, 0x30
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5524]
lea rsi, [rsp + 0x30]
mov r9d, 0x33
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5557]
lea rsi, [rsp + 0x30]
mov r9d, 0x35
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov ecx, 1
call fcn.14009822a
mov qword [rbx], rax
mov qword [rbx + 8], rdx
movups xmmword [rdx], xmm6
mov qword [rbx + 0x10], rbp
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b558c]
lea rsi, [rsp + 0x30]
mov r9d, 0x2c
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b55b8]
lea rsi, [rsp + 0x30]
mov r9d, 0x21
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b55d9]
lea rsi, [rsp + 0x30]
mov r9d, 0x22
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b55fb]
lea rsi, [rsp + 0x30]
mov r9d, 0x2e
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5629]
lea rsi, [rsp + 0x30]
mov r9d, 0x30
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5659]
lea rsi, [rsp + 0x30]
mov r9d, 0x15
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov ecx, 1
call fcn.14009822a
mov qword [rbx], rax
mov qword [rbx + 8], rdx
movups xmm10, xmmword [0x1400b56b0]
movups xmmword [rdx], xmm10
mov qword [rbx + 0x10], rbp
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b566e]
lea rsi, [rsp + 0x30]
mov r9d, 0x34
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, str.softwaremicrosoft_bidinterfaceloadersoftwaremicrosoftcommand_processorautorun
lea rsi, [rsp + 0x30]
mov r9d, 0x26
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov ecx, 1
call fcn.14009822a
mov qword [rbx], rax
mov qword [rbx + 8], rdx
movups xmm11, xmmword [str._nW_v_]
movups xmmword [rdx], xmm11
mov qword [rbx + 0x10], rbp
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b56e6]
lea rsi, [rsp + 0x30]
mov r9d, 0x24
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, str.softwaremicrosoftcryptographyoidencodingtype_0cryptsipdllgetsigneddatamsgsoftwaremicrosoftcryptographyoidencodingtype_0cryptsipdllverifyindirectdatasoftwaremicrosoftcryptographyproviders_trust_finalpolicysoftwaremicrosoftctflangbaraddinsoftwaremicrosoftinternet_explorerexplorer_barssoftwaremicrosoftinternet_explorerextensionssoftwaremicrosoftinternet_explorer_toolbarsoftwaremicrosoftmicrosoft_sql_serversoftwaremicrosoft_netshsoftwaremicrosoftoffice_access_addinssoftwaremicrosoftofficeexcel_addinssoftwaremicrosoftofficeoutlook_addinssoftwaremicrosoftofficepowerpoint_addinssoftwaremicrosoftofficeword_addinssoftwaremicrosoftoffice_test_specialperfsoftwaremicrosoft_terminal_server_clientdefaultsoftwaremicrosoft_vbamonitorssoftwaremicrosoftwbemesssoftwaremicrosoftwindows_ce_services_autostartonconnectsoftwaremicrosoftwindows_ce_services_autostartondisconnectsoftwaremicrosoft_airdropdllname
lea rsi, [rsp + 0x30]
mov r9d, 0x4e
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5776]
lea rsi, [rsp + 0x30]
mov r9d, 0x50
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b57c6]
lea rsi, [rsp + 0x30]
mov r9d, 0x3b
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5801]
lea rsi, [rsp + 0x30]
mov r9d, 0x23
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5824]
lea rsi, [rsp + 0x30]
mov r9d, 0x32
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5856]
lea rsi, [rsp + 0x30]
mov r9d, 0x2f
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5885]
lea rsi, [rsp + 0x30]
mov r9d, 0x2c
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b58b1]
lea rsi, [rsp + 0x30]
mov r9d, 0x27
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b58d8]
lea rsi, [rsp + 0x30]
mov r9d, 0x18
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b58f0]
lea rsi, [rsp + 0x30]
mov r9d, 0x27
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5917]
lea rsi, [rsp + 0x30]
mov r9d, 0x26
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b593d]
lea rsi, [rsp + 0x30]
mov r9d, 0x28
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5965]
lea rsi, [rsp + 0x30]
mov r9d, 0x2b
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5990]
lea rsi, [rsp + 0x30]
mov r9d, 0x25
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b59b5]
lea rsi, [rsp + 0x30]
mov r9d, 0x2b
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b59e0]
lea rsi, [rsp + 0x30]
mov r9d, 0x31
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5a11]
lea rsi, [rsp + 0x30]
mov r9d, 0x1f
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5a30]
lea rsi, [rsp + 0x30]
mov r9d, 0x1b
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5a4b]
lea rsi, [rsp + 0x30]
mov r9d, 0x39
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5a84]
lea rsi, [rsp + 0x30]
mov r9d, 0x3c
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov ecx, 1
call fcn.14009822a
mov qword [rbx], rax
mov qword [rbx + 8], rdx
movups xmm0, xmmword [0x1400b5ae8]
movups xmmword [rdx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5ac0]
lea rsi, [rsp + 0x30]
mov r9d, 0x1a
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov ecx, 1
call fcn.14009822a
mov qword [rbx], rax
mov qword [rbx + 8], rdx
movups xmm6, xmmword [str.___v_]
movups xmmword [rdx], xmm6
mov qword [rbx + 0x10], rbp
mov qword [rsp + 0x20], rbx
lea r8, str.softwaremicrosoftwindowscurrentversiondebug
lea rsi, [rsp + 0x30]
mov r9d, 0x29
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, str.softwaremicrosoftwindowscurrentversion_app_pathssoftwaremicrosoftwindowscurrentversion_authenticationcredential_provider_filterssoftwaremicrosoftwindowscurrentversion_authenticationcredential_providerssoftwaremicrosoftwindowscurrentversion_authenticationplap_providerssoftwaremicrosoftwindowscurrentversioncontrol_panelcplssoftwaremicrosoftwindowscurrentversionexplorer_browser_helper_objectssoftwaremicrosoftwindowscurrentversionexplorer_sharedtaskschedulersoftwaremicrosoftwindowscurrentversionexplorer_shellexecutehookssoftwaremicrosoftwindowscurrentversionexplorer_shelliconoverlayidentifierssoftwaremicrosoftwindowscurrentversionexplorer_shellserviceobjectssoftwaremicrosoftwindowscurrentversionexplorer_tbdensoftwaremicrosoftwindowscurrentversiongroup_policy_scriptslogoffsoftwaremicrosoftwindowscurrentversiongroup_policy_scriptslogonsoftwaremicrosoftwindowscurrentversiongroup_policy_scripts_shutdownsoftwaremicrosoftwindowscurrentversiongroup_policy_scripts_startupsoftwaremicrosoftwindowscurrentversionpoliciesexplorer_runsoftwaremicrosoftwindowscurrentversionpolicies_systemshellenablelua
lea rsi, [rsp + 0x30]
mov r9d, 0x33
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5b6b]
lea rsi, [rsp + 0x30]
mov r9d, 0x54
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5bbf]
lea rsi, [rsp + 0x30]
mov r9d, 0x4d
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5c0c]
lea rsi, [rsp + 0x30]
mov r9d, 0x47
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5c53]
lea rsi, [rsp + 0x30]
mov r9d, 0x3c
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5c8f]
lea rsi, [rsp + 0x30]
mov r9d, 0x49
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5cd8]
lea rsi, [rsp + 0x30]
mov r9d, 0x46
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5d1e]
lea rsi, [rsp + 0x30]
mov r9d, 0x44
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5d62]
lea rsi, [rsp + 0x30]
mov r9d, 0x4e
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5db0]
lea rsi, [rsp + 0x30]
mov r9d, 0x46
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5df6]
lea rsi, [rsp + 0x30]
mov r9d, 0x38
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5e2e]
lea rsi, [rsp + 0x30]
mov r9d, 0x45
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5e73]
lea rsi, [rsp + 0x30]
mov r9d, 0x44
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5eb7]
lea rsi, [rsp + 0x30]
mov r9d, 0x47
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5efe]
lea rsi, [rsp + 0x30]
mov r9d, 0x46
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5f44]
lea rsi, [rsp + 0x30]
mov r9d, 0x3f
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov ecx, 2
call fcn.14009822a
mov qword [rbx], rax
mov qword [rbx + 8], rdx
movups xmm0, xmmword [0x1400b5fd0]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [0x1400b5fe0]
movups xmmword [rdx + 0x10], xmm0
mov qword [rbx + 0x10], r13
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b5f83]
lea rsi, [rsp + 0x30]
mov r9d, 0x39
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, str.softwaremicrosoftwindowscurrentversion_runsoftwaremicrosoftwindowscurrentversion_runonceexsoftwaremicrosoftwindowscurrentversion_runoncesoftwaremicrosoftwindowscurrentversion_runservicessoftwaremicrosoftwindowscurrentversion_runservicesoncesoftwaremicrosoftwindowscurrentversion_shell_extensions_approvedsoftwaremicrosoftwindowscurrentversion_shellserviceobjectdelayloadsoftwaremicrosoftwindowscurrentversionwindowsupdate_testsoftwaremicrosoftwindowscurrentversionwsmanclientsoftwaremicrosoftwindowscurrentversionwsman_servicesoftwaremicrosoftwow64x86softwaremicrosoftwindows_ntcurrentversion_accessibility_atsatexedescriptionstartexesimpleprofile
lea rsi, [rsp + 0x30]
mov r9d, 0x2d
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b601d]
lea rsi, [rsp + 0x30]
mov r9d, 0x33
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6050]
lea rsi, [rsp + 0x30]
mov r9d, 0x31
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6081]
lea rsi, [rsp + 0x30]
mov r9d, 0x35
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b60b6]
lea rsi, [rsp + 0x30]
mov r9d, 0x39
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b60ef]
lea rsi, [rsp + 0x30]
mov r9d, 0x43
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6132]
lea rsi, [rsp + 0x30]
mov r9d, 0x45
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6177]
lea rsi, [rsp + 0x30]
mov r9d, 0x3c
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b61b3]
lea rsi, [rsp + 0x30]
mov r9d, 0x36
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b61e9]
lea rsi, [rsp + 0x30]
mov r9d, 0x37
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6220]
lea rsi, [rsp + 0x30]
mov r9d, 0x1c
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov esi, 4
mov ecx, 4
call fcn.14009822a
mov qword [rbx], rax
mov qword [rbx + 8], rdx
movups xmm0, xmmword [str.zb_v_]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [0x1400b62b0]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [0x1400b62c0]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [0x1400b62d0]
movups xmmword [rdx + 0x30], xmm0
mov qword [rbx + 0x10], rsi
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b623c]
lea rsi, [rsp + 0x30]
mov r9d, 0x3e
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, str.softwaremicrosoftwindows_ntcurrentversion_aedebugsoftwaremicrosoftwindows_ntcurrentversion_aedebugprotectedsoftwaremicrosoftwindows_ntcurrentversion_appcompatflagscustomsoftwaremicrosoftwindows_ntcurrentversion_appcompatflagsinstalledsdbsoftwaremicrosoftwindows_ntcurrentversiondrivers32softwaremicrosoftwindows_ntcurrentversion_font_driverssoftwaremicrosoftwindows_ntcurrentversionknownmanageddebuggingdllssoftwaremicrosoftwindows_ntcurrentversionimage_file_execution_optionsdebugger
lea rsi, [rsp + 0x30]
mov r9d, 0x34
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6314]
lea rsi, [rsp + 0x30]
mov r9d, 0x3d
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6351]
lea rsi, [rsp + 0x30]
mov r9d, 0x42
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6393]
lea rsi, [rsp + 0x30]
mov r9d, 0x48
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b63db]
lea rsi, [rsp + 0x30]
mov r9d, 0x36
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6411]
lea rsi, [rsp + 0x30]
mov r9d, 0x39
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b644a]
lea rsi, [rsp + 0x30]
mov r9d, 0x46
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov ecx, 1
call fcn.14009822a
mov qword [rbx], rax
mov qword [rbx + 8], rdx
movups xmm7, xmmword [0x1400b64e8]
movups xmmword [rdx], xmm7
mov qword [rbx + 0x10], rbp
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6490]
lea rsi, [rsp + 0x30]
mov r9d, 0x49
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, str.softwaremicrosoftwindows_ntcurrentversionminidumpauxiliarydllssoftwaremicrosoftwindows_ntcurrentversion_silentprocessexitsoftwaremicrosoftwindows_ntcurrentversion_systemrestoresoftwaremicrosoftwindows_ntcurrentversion_terminal_serverinstall_softwaremicrosoftwindowscurrentversion_runsoftwaremicrosoftwindows_ntcurrentversion_terminal_serverinstall_softwaremicrosoftwindowscurrentversion_runonceexsoftwaremicrosoftwindows_ntcurrentversion_terminal_serverinstall_softwaremicrosoftwindowscurrentversion_runoncesoftwaremicrosoftwindows_ntcurrentversionwindowsappinit_dllsiconservicelibtaskmanuserinitvmappletloadrun
lea rsi, [rsp + 0x30]
mov r9d, 0x42
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b653a]
lea rsi, [rsp + 0x30]
mov r9d, 0x3e
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6578]
lea rsi, [rsp + 0x30]
mov r9d, 0x3a
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b65b2]
lea rsi, [rsp + 0x30]
mov r9d, WSACleanup
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6624]
lea rsi, [rsp + 0x30]
mov r9d, 0x78
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b669c]
lea rsi, [rsp + 0x30]
mov r9d, 0x76
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov ecx, 8
call fcn.14009822a
mov rdi, rdx
mov qword [rbx], rax
mov qword [rbx + 8], rdx
lea r14, str.Fg_v_
mov ecx, send
mov rsi, r14
rep movsq qword [rdi], qword [rsi]
mov qword [rbx + 0x10], r12
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6712]
lea rsi, [rsp + 0x30]
mov r9d, 0x34
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, str.softwaremicrosoftwindows_ntcurrentversionwinlogon_alternateshells_availableshellssoftwaremicrosoftwindows_ntcurrentversionwinlogongpextensionssoftwaremicrosoftwindows_ntcurrentversionwinlogonappsetup
lea rsi, [rsp + 0x30]
mov r9d, 0x55
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6855]
lea rsi, [rsp + 0x30]
mov r9d, 0x42
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov ecx, 3
call fcn.14009822a
mov qword [rbx], rax
mov qword [rbx + 8], rdx
movups xmm0, xmmword [0x1400b68d8]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [0x1400b68e8]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [str.gg_v_]
movups xmmword [rdx + 0x20], xmm0
mov qword [rbx + 0x10], 3
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6897]
lea rsi, [rsp + 0x30]
mov r9d, 0x35
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, str.softwaremicrosoftwindows_ntcurrentversionwinlogon_notifysoftwarepoliciesmicrosoftwindowscredentialsdelegationallowdefaultcredentials
lea rsi, [rsp + 0x30]
mov r9d, 0x3c
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov ecx, 1
call fcn.14009822a
mov qword [rbx], rax
mov qword [rbx + 8], rdx
movups xmm0, xmmword [str.i_v_]
movups xmmword [rdx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6944]
lea rsi, [rsp + 0x30]
mov r9d, 0x39
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov ecx, 5
call fcn.14009822a
mov rdi, rdx
mov qword [rbx], rax
mov qword [rbx + 8], rdx
lea rsi, [0x1400b6a30]
mov ecx, 0xa
rep movsq qword [rdi], qword [rsi]
mov qword [rbx + 0x10], 5
mov qword [rsp + 0x20], rbx
lea r8, str.softwarepoliciesmicrosoftwindows_defenderdisableantispywaredisableroutinelytakingactiondisablerealtimemonitoringnoautoupdateauoptions
lea rsi, [rsp + 0x30]
mov r9d, 0x2c
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov ecx, 1
call fcn.14009822a
mov qword [rbx], rax
mov qword [rbx + 8], rdx
movups xmm0, xmmword [0x1400b6ac0]
movups xmmword [rdx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rsp + 0x20], rbx
lea r8, str.softwarepoliciesmicrosoftwindows_ntdnsclientenablemulticast
lea rsi, [rsp + 0x30]
mov r9d, 0x30
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, str.softwarepoliciesmicrosoftwindows_system_scriptslogoffsoftwarepoliciesmicrosoftwindows_system_scriptslogonsoftwarepoliciesmicrosoftwindows_system_scripts_shutdownsoftwarepoliciesmicrosoftwindows_system_scripts_startupsoftwarewow6432nodeclasses_allfilesystemobjects_shellexcontextmenuhandlerssoftwarewow6432nodeclasses_allfilesystemobjects_shellexdragdrophandlerssoftwarewow6432nodeclasses_allfilesystemobjects_shellexpropertysheethandlerssoftwarewow6432nodeclassesclsidsoftwarewow6432nodeclassesdirectory_background_shellexcontextmenuhandlerssoftwarewow6432nodeclassesdirectory_shellexcontextmenuhandlerssoftwarewow6432nodeclassesdirectory_shellexcopyhookhandlerssoftwarewow6432nodeclassesdirectory_shellexdragdrophandlerssoftwarewow6432nodeclassesdirectory_shellexpropertysheethandlerssoftwarewow6432nodeclasses_folder_shellexcolumnhandlerssoftwarewow6432nodeclasses_folder_shellexcontextmenuhandlerssoftwarewow6432nodeclasses_folder_shellexdragdrophandlerssoftwarewow6432nodeclasses_folder_shellexextshellfolderviewssoftwarewow6432nodeclasses_folder_shellexpropertysheethandlerssoftwarewow6432nodeclasses_shellexcontextmenuhandlerssoftwarewow6432nodeclasses_shellexpropertysheethandlerssoftwarewow6432nodemicrosoft_active_setupinstalled_componentssoftwarewow6432nodemicrosoft_bidinterfaceloadersoftwarewow6432nodemicrosoftcommand_processorsoftwarewow6432nodemicrosoftcryptographyoidencodingtype_0cryptsipdllgetsigneddatamsgsoftwarewow6432nodemicrosoftcryptographyoidencodingtype_0cryptsipdllverifyindirectdatasoftwarewow6432nodemicrosoftcryptographyproviders_trust_finalpolicysoftwarewow6432nodemicrosoftinternet_explorerexplorer_barssoftwarewow6432nodemicrosoftinternet_explorerextensionssoftwarewow6432nodemicrosoftinternet_explorer_toolbarsoftwarewow6432nodemicrosoftoffice_access_addinssoftwarewow6432nodemicrosoftofficeexcel_addinssoftwarewow6432nodemicrosoftofficeoutlook_addinssoftwarewow6432nodemicrosoftofficepowerpoint_addinssoftwarewow6432nodemicrosoftofficeword_addinssoftwarewow6432nodemicrosoftwindows_ce_services_autostartonconnectsoftwarewow6432nodemicrosoftwindows_ce_services_autostartondisconnectsoftwarewow6432nodemicrosoftwindowscurrentversionsoftwarewow6432nodemicrosoftwindowscurrentversionexplorer_browser_helper_objectssoftwarewow6432nodemicrosoftwindowscurrentversionexplorer_sharedtaskschedulersoftwarewow6432nodemicrosoftwindowscurrentversionexplorer_shellexecutehookssoftwarewow6432nodemicrosoftwindowscurrentversionexplorer_shelliconoverlayidentifierssoftwarewow6432nodemicrosoftwindowscurrentversionexplorer_shellserviceobjectssoftwarewow6432nodemicrosoftwindowscurrentversionpoliciesexplorer_runsoftwarewow6432nodemicrosoftwindowscurrentversion_runsoftwarewow6432nodemicrosoftwindowscurrentversion_runonceexsoftwarewow6432nodemicrosoftwindowscurrentversion_runoncesoftwarewow6432nodemicrosoftwindowscurrentversion_runservicessoftwarewow6432nodemicrosoftwindowscurrentversion_runservicesoncesoftwarewow6432nodemicrosoftwindowscurrentversion_shareddllssoftwarewow6432nodemicrosoftwindowscurrentversion_shell_extensions_approvedsoftwarewow6432nodemicrosoftwindowscurrentversion_shellserviceobjectdelayloadsoftwarewow6432nodemicrosoftwindows_ntcurrentversion_aedebugsoftwarewow6432nodemicrosoftwindows_ntcurrentversiondrivers32softwarewow6432nodemicrosoftwindows_ntcurrentversionknownmanageddebuggingdllssoftwarewow6432nodemicrosoftwindows_ntcurrentversionimage_file_execution_optionssoftwarewow6432nodemicrosoftwindows_ntcurrentversionminidumpauxiliarydllssoftwarewow6432nodemicrosoftwindows_ntcurrentversionwindowssoftwarewow6432nodemicrosoft_
lea rsi, [rsp + 0x30]
mov r9d, 0x39
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6b09]
lea rsi, [rsp + 0x30]
mov r9d, 0x38
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6b41]
lea rsi, [rsp + 0x30]
mov r9d, 0x3b
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6b7c]
lea rsi, [rsp + 0x30]
mov r9d, 0x3a
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6bb6]
lea rsi, [rsp + 0x30]
mov r9d, 0x4d
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6c03]
lea rsi, [rsp + 0x30]
mov r9d, 0x4a
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6c4d]
lea rsi, [rsp + 0x30]
mov r9d, 0x4f
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov ecx, 2
call fcn.14009822a
mov qword [rbx], rax
mov qword [rbx + 8], rdx
movups xmmword [rdx], xmm8
movups xmmword [rdx + 0x10], xmm9
mov qword [rbx + 0x10], r13
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6c9c]
lea rsi, [rsp + 0x30]
mov r9d, 0x22
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6cbe]
lea rsi, [rsp + 0x30]
mov r9d, 0x4d
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6d0b]
lea rsi, [rsp + 0x30]
mov r9d, 0x42
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6d4d]
lea rsi, [rsp + 0x30]
mov r9d, 0x3f
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6d8c]
lea rsi, [rsp + 0x30]
mov r9d, 0x3f
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6dcb]
lea rsi, [rsp + 0x30]
mov r9d, 0x44
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6e0f]
lea rsi, [rsp + 0x30]
mov r9d, 0x3a
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6e49]
lea rsi, [rsp + 0x30]
mov r9d, 0x3f
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6e88]
lea rsi, [rsp + 0x30]
mov r9d, 0x3c
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6ec4]
lea rsi, [rsp + 0x30]
mov r9d, 0x3f
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6f03]
lea rsi, [rsp + 0x30]
mov r9d, 0x41
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6f44]
lea rsi, [rsp + 0x30]
mov r9d, 0x3a
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6f7e]
lea rsi, [rsp + 0x30]
mov r9d, 0x3c
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov ecx, 1
call fcn.14009822a
mov qword [rbx], rax
mov qword [rbx + 8], rdx
movups xmmword [rdx], xmm10
mov qword [rbx + 0x10], rbp
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6fba]
lea rsi, [rsp + 0x30]
mov r9d, 0x40
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b6ffa]
lea rsi, [rsp + 0x30]
mov r9d, 0x32
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov ecx, 1
call fcn.14009822a
mov qword [rbx], rax
mov qword [rbx + 8], rdx
movups xmmword [rdx], xmm11
mov qword [rbx + 0x10], rbp
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b702c]
lea rsi, [rsp + 0x30]
mov r9d, 0x30
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b705c]
lea rsi, [rsp + 0x30]
mov r9d, 0x5a
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b70b6]
lea rsi, [rsp + 0x30]
mov r9d, 0x5c
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b7112]
lea rsi, [rsp + 0x30]
mov r9d, 0x47
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b7159]
lea rsi, [rsp + 0x30]
mov r9d, 0x3e
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b7197]
lea rsi, [rsp + 0x30]
mov r9d, 0x3b
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b71d2]
lea rsi, [rsp + 0x30]
mov r9d, 0x38
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b720a]
lea rsi, [rsp + 0x30]
mov r9d, 0x33
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b723d]
lea rsi, [rsp + 0x30]
mov r9d, 0x32
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b726f]
lea rsi, [rsp + 0x30]
mov r9d, 0x34
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b72a3]
lea rsi, [rsp + 0x30]
mov r9d, 0x37
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b72da]
lea rsi, [rsp + 0x30]
mov r9d, 0x31
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b730b]
lea rsi, [rsp + 0x30]
mov r9d, 0x45
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b7350]
lea rsi, [rsp + 0x30]
mov r9d, 0x48
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov ecx, 1
call fcn.14009822a
mov qword [rbx], rax
mov qword [rbx + 8], rdx
movups xmmword [rdx], xmm6
mov qword [rbx + 0x10], rbp
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b7398]
lea rsi, [rsp + 0x30]
mov r9d, 0x35
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b73cd]
lea rsi, [rsp + 0x30]
mov r9d, 0x55
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b7422]
lea rsi, [rsp + 0x30]
mov r9d, 0x52
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b7474]
lea rsi, [rsp + 0x30]
mov r9d, 0x50
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b74c4]
lea rsi, [rsp + 0x30]
mov r9d, 0x5a
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b751e]
lea rsi, [rsp + 0x30]
mov r9d, 0x52
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b7570]
lea rsi, [rsp + 0x30]
mov r9d, 0x4b
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b75bb]
lea rsi, [rsp + 0x30]
mov r9d, 0x39
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b75f4]
lea rsi, [rsp + 0x30]
mov r9d, 0x3f
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b7633]
lea rsi, [rsp + 0x30]
mov r9d, 0x3d
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b7670]
lea rsi, [rsp + 0x30]
mov r9d, 0x41
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b76b1]
lea rsi, [rsp + 0x30]
mov r9d, 0x45
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b76f6]
lea rsi, [rsp + 0x30]
mov r9d, 0x40
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b7736]
lea rsi, [rsp + 0x30]
mov r9d, 0x4f
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b7785]
lea rsi, [rsp + 0x30]
mov r9d, 0x51
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b77d6]
lea rsi, [rsp + 0x30]
mov r9d, 0x40
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b7816]
lea rsi, [rsp + 0x30]
mov r9d, 0x42
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b7858]
lea rsi, [rsp + 0x30]
mov r9d, 0x52
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov ecx, 1
call fcn.14009822a
mov qword [rbx], rax
mov qword [rbx + 8], rdx
movups xmmword [rdx], xmm7
mov qword [rbx + 0x10], rbp
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b78aa]
lea rsi, [rsp + 0x30]
mov r9d, 0x55
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b78ff]
lea rsi, [rsp + 0x30]
mov r9d, 0x4e
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov ecx, 8
call fcn.14009822a
mov rdi, rdx
mov qword [rbx], rax
mov qword [rbx + 8], rdx
mov ecx, send
mov rsi, r14
rep movsq qword [rdi], qword [rsi]
mov qword [rbx + 0x10], r12
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b794d]
lea rsi, [rsp + 0x30]
mov r9d, 0x40
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b798d]
lea rsi, [rsp + 0x30]
mov r9d, 0x5a
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov ecx, 4
call fcn.14009822a
mov qword [rbx], rax
mov qword [rbx + 8], rdx
movups xmm0, xmmword [0x1400b7a58]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [str.2z_v_]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [str.Fz_v_]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [str.j_v_]
movups xmmword [rdx + 0x30], xmm0
mov edi, 4
mov qword [rbx + 0x10], rdi
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b79e7]
lea rsi, [rsp + 0x30]
mov r9d, 0x38
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, str.systemcontrolset001_servicesportproxysystemcurrentcontrolsetcontrol_bootverificationprogramimagepath
lea rsi, [rsp + 0x30]
mov r9d, 0x27
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov ecx, 1
call fcn.14009822a
mov qword [rbx], rax
mov qword [rbx + 8], rdx
movups xmm0, xmmword [0x1400b7b00]
movups xmmword [rdx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b7abf]
lea rsi, [rsp + 0x30]
mov r9d, 0x38
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov ecx, 1
call fcn.14009822a
mov qword [rbx], rax
mov qword [rbx + 8], rdx
movups xmm0, xmmword [0x1400b7b50]
movups xmmword [rdx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rsp + 0x20], rbx
lea r8, str.systemcurrentcontrolsetcontrol_filesystemntfsencryptpagingfile__v_
lea rsi, [rsp + 0x30]
mov r9d, 0x2b
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov ecx, 0xc
call fcn.14009822a
mov rcx, rdx
mov qword [rbx], rax
mov qword [rbx + 8], rdx
lea rdx, [0x1400b7c78]
mov r8d, 0xc0
call fcn.1400a1fa0
mov qword [rbx + 0x10], send
mov qword [rsp + 0x20], rbx
lea r8, str.systemcurrentcontrolsetcontrollsasecurity_packagesauthentication_packagesnotification_packagesrunasppldisablerestrictedadmindisablerestrictedadminoutboundcredslimitblankpassworduselmcompatibilitylevelNtlmMinClientSecRestrictSendingNTLMTrafficRestrictReceivingNTLMTraffic
lea rsi, [rsp + 0x30]
mov r9d, 0x24
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, str.systemcurrentcontrolsetcontrol_networkproviderordersystemcurrentcontrolsetcontrolprintmonitorssystemcurrentcontrolsetcontrolprintproviderssystemcurrentcontrolsetcontrol_safebootalternateshell
lea rsi, [rsp + 0x30]
mov r9d, 0x36
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b7d6e]
lea rsi, [rsp + 0x30]
mov r9d, 0x2f
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b7d9d]
lea rsi, [rsp + 0x30]
mov r9d, 0x30
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov ecx, 1
call fcn.14009822a
mov qword [rbx], rax
mov qword [rbx + 8], rdx
movups xmm0, xmmword [0x1400b7e08]
movups xmmword [rdx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b7dcd]
lea rsi, [rsp + 0x30]
mov r9d, 0x29
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, str.systemcurrentcontrolsetcontrol_securityproviderssystemcurrentcontrolsetcontrol_servicecontrolmanagerextensionsystemcurrentcontrolsetcontrol_session_managersystemcurrentcontrolsetcontrol_terminal_serverfdenytsconnectionsfsinglesessionperuser
lea rsi, [rsp + 0x30]
mov r9d, 0x32
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b7e4a]
lea rsi, [rsp + 0x30]
mov r9d, 0x3f
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b7e89]
lea rsi, [rsp + 0x30]
mov r9d, 0x30
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov ecx, 2
call fcn.14009822a
mov qword [rbx], rax
mov qword [rbx + 8], rdx
movups xmm0, xmmword [0x1400b7f10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [0x1400b7f20]
movups xmmword [rdx + 0x10], xmm0
mov qword [rbx + 0x10], r13
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b7eb9]
lea rsi, [rsp + 0x30]
mov r9d, 0x30
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, str.systemcurrentcontrolsetcontrol_terminal_server_addinssystemcurrentcontrolsetcontrol_terminal_serverutilitiessystemcurrentcontrolsetcontrol_terminal_serverwds_rdpwdstartupprograms
lea rsi, [rsp + 0x30]
mov r9d, 0x37
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b7f67]
lea rsi, [rsp + 0x30]
mov r9d, 0x3a
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov ecx, 1
call fcn.14009822a
mov qword [rbx], rax
mov qword [rbx + 8], rdx
movups xmm0, xmmword [0x1400b7ff0]
movups xmmword [rdx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b7fa1]
lea rsi, [rsp + 0x30]
mov r9d, 0x3a
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov ecx, 1
call fcn.14009822a
mov qword [rbx], rax
mov qword [rbx + 8], rdx
movups xmm0, xmmword [0x1400b8058]
movups xmmword [rdx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rsp + 0x20], rbx
lea r8, str.systemcurrentcontrolsetcontrol_terminal_serverwinstations_rdp_tcpinitialprogram
lea rsi, [rsp + 0x30]
mov r9d, 0x44
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov ecx, 4
call fcn.14009822a
mov qword [rbx], rax
mov qword [rbx + 8], rdx
movups xmm0, xmmword [0x1400b80a0]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [0x1400b80b0]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [0x1400b80c0]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [0x1400b80d0]
movups xmmword [rdx + 0x30], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rsp + 0x20], rbx
lea r8, str.systemcurrentcontrolset_servicesfailurecommandtype
lea rsi, [rsp + 0x30]
mov r9d, 0x21
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov ecx, 2
call fcn.14009822a
mov qword [rbx], rax
mov qword [rbx + 8], rdx
movups xmm0, xmmword [0x1400b8128]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [0x1400b8138]
movups xmmword [rdx + 0x10], xmm0
mov qword [rbx + 0x10], r13
mov qword [rsp + 0x20], rbx
lea r8, str.systemcurrentcontrolset_services_ntdslsadbextptdirectoryserviceextpt
lea rsi, [rsp + 0x30]
mov r9d, 0x26
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, str.systemcurrentcontrolset_servicesportproxysystemcurrentcontrolset_serviceswinsock2parameters_appid_cataloglibrarypathprotocolname
lea rsi, [rsp + 0x30]
mov r9d, 0x2b
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov ecx, 2
call fcn.14009822a
mov qword [rbx], rax
mov qword [rbx + 8], rdx
movups xmm6, xmmword [0x1400b81d0]
movups xmmword [rdx], xmm6
movups xmm7, xmmword [0x1400b81e0]
movups xmmword [rdx + 0x10], xmm7
mov qword [rbx + 0x10], r13
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b8173]
lea rsi, [rsp + 0x30]
mov r9d, 0x43
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov ecx, 2
call fcn.14009822a
mov qword [rbx], rax
mov qword [rbx + 8], rdx
movups xmmword [rdx], xmm6
movups xmmword [rdx + 0x10], xmm7
mov qword [rbx + 0x10], r13
mov qword [rsp + 0x20], rbx
lea r8, str.systemcurrentcontrolset_serviceswinsock2parameters_namespace_catalog5catalog_entries64systemcurrentcontrolset_serviceswinsock2parametersprotocol_catalog9catalog_entries64systemcurrentcontrolset_serviceswinsock2parametersprotocol_catalog9catalog_entriessystem_setupcmdlinecontrol_paneldesktopscrnsave.exescreensaveactivescreensaverissecurescreensavertimeoutwallpaper
lea rsi, [rsp + 0x30]
mov r9d, 0x5a
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov ecx, 2
call fcn.14009822a
mov qword [rbx], rax
mov qword [rbx + 8], rdx
movups xmmword [rdx], xmm6
movups xmmword [rdx + 0x10], xmm7
mov qword [rbx + 0x10], r13
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b824a]
lea rsi, [rsp + 0x30]
mov r9d, 0x59
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
mov ecx, 2
call fcn.14009822a
mov qword [rbx], rax
mov qword [rbx + 8], rdx
movups xmmword [rdx], xmm6
movups xmmword [rdx + 0x10], xmm7
mov qword [rbx + 0x10], r13
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b82a3]
lea rsi, [rsp + 0x30]
mov r9d, 0x57
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009343
and qword [rbx], 0
mov qword [rbx + 8], r12
and qword [rbx + 0x10], 0
mov qword [rsp + 0x20], rbx
lea r8, [0x1400b82fa]
lea rsi, [rsp + 0x30]
mov r9d, 0x14
mov rcx, rsi
mov rdx, r15
call fcn.1400035e0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
movaps xmm6, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x70]
movaps xmm8, xmmword [rsp + 0x80]
movaps xmm9, xmmword [rsp + 0x90]
movaps xmm10, xmmword [rsp + 0xa0]
movaps xmm11, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.140009343