Function at 0x14004dcd0
Capabilities:
Query or enumerate registry value
Set registry value
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x498]
sub rsp, 0x570
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
mov rax, qword [0x140065010]
xor rax, rsp
mov qword [rbp + 0x400], rax
mov r13, rcx
cmp byte [rcx + 0x222], 0
jne 0x14004eb3d
lea r14, [0x14013c720]
lea r15, [0x14013c760]
xor r12d, r12d
lea rbx, [r12 - 1]
movabs rsi, 0x7fffffffffffffff
cmp byte [0x14007348c], r12b
je 0x14004e03d
lea rax, [rbp + 0x3f0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareX666
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14004e02f
mov dword [rbp + 0x3f8], 0x40
lea rax, [rbp + 0x3f8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Username
mov rcx, qword [rbp + 0x3f0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rbp + 0x3f0]
test eax, eax
jne 0x14004e029
mov dword [rbp + 0x3f8], 0x40
lea rax, [rbp + 0x3f8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Password
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rbp + 0x3f0]
test eax, eax
jne 0x14004e029
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r12, qword [0x14013c7d8]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xor eax, eax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov rdi, rbx
inc rdi
cmp byte [r15 + rdi], al
jne 0x14004de41
cmp rdi, rsi
ja 0x14004eb91
mov qword [rbp - 0x78], 0xf
cmp rdi, 0x10
jae 0x14004de7f
mov qword [rbp - 0x80], rdi
mov r8, rdi
mov rdx, r15
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rdi + 0x70], 0
jmp 0x14004df18
mov r14, rdi
or r14, 0xf
cmp r14, rsi
jbe 0x14004de90
mov r14, rsi
jmp 0x14004de9d
cmp r14, 0x16
mov ecx, 0x16
cmovb r14, rcx
mov rcx, r14
add rcx, 1
cmovb rcx, rbx
cmp rcx, 0x1000
jb 0x14004dee0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004eb97
mov rcx, rax
call fcn.140050970
test rax, rax
je 0x14004ded9
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x14004deed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14004deea
call fcn.140050970
mov r15, rax
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], r14
mov r8, rdi
lea rdx, [0x14013c760]
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [r15 + rdi], 0
lea r14, [0x14013c720]
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xor eax, eax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov rdi, rbx
nop dword [rax]
inc rdi
cmp byte [r14 + rdi], al
jne 0x14004df30
cmp rdi, rsi
ja 0x14004eb9d
mov qword [rbp - 0x58], 0xf
cmp rdi, 0x10
jae 0x14004df6d
mov qword [rbp - 0x60], rdi
mov r8, rdi
mov rdx, r14
lea rcx, [rbp - 0x70]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rdi - 0x70], 0
jmp 0x14004dffe
mov r14, rdi
or r14, 0xf
cmp r14, rsi
jbe 0x14004df7e
mov r14, rsi
jmp 0x14004df8b
cmp r14, 0x16
mov ecx, 0x16
cmovb r14, rcx
mov rcx, r14
add rcx, 1
cmovb rcx, rbx
cmp rcx, 0x1000
jb 0x14004dfce
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004eba3
mov rcx, rax
call fcn.140050970
test rax, rax
je 0x14004dfc7
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x14004dfdb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14004dfd8
call fcn.140050970
mov r15, rax
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], r14
mov r8, rdi
lea rdx, [0x14013c720]
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [r15 + rdi], 0
lea r8, [rsp + 0x70]
lea rdx, [rbp - 0x70]
mov rcx, r12
call fcn.1400030e0
mov byte [r13 + 0x222], al
mov byte [0x14007348c], 0
lea r15, [0x14013c760]
xor r12d, r12d
jmp 0x14004e03d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [r13 + 0x222], r12b
mov byte [0x14007348c], r12b
mov r14, qword [0x14013c6a0]
lea rcx, [r14 + 0x4838]
movss xmm1, dword [r14 + 0x37d0]
movss xmm0, dword [r14 + 0x37d4]
mov dword [rsp + 0x50], 2
movss dword [rsp + 0x54], xmm1
movss dword [rsp + 0x58], xmm0
lea rdx, [rsp + 0x50]
call fcn.14002da50
mov qword [r14 + 0x37d0], 0
movss xmm1, dword [r13 + 4]
movss xmm0, dword [r13]
mov rcx, qword [0x14013c6a0]
mov eax, dword [rcx + 0x47b8]
or eax, 1
mov dword [rcx + 0x47b8], eax
movss dword [rcx + 0x47c8], xmm0
movss dword [rcx + 0x47cc], xmm1
mov qword [rcx + 0x47d0], 0
mov dword [rcx + 0x47bc], 2
movss xmm1, dword [r13 + 0xc]
movss xmm0, dword [r13 + 8]
or eax, 2
mov dword [rcx + 0x47b8], eax
movss dword [rcx + 0x47d8], xmm0
movss dword [rcx + 0x47dc], xmm1
mov dword [rcx + 0x47c0], 1
xor edx, edx
lea r8d, [rdx + 0x2f]
lea rcx, str.Login
call fcn.14001fbc0
mov rcx, qword [0x14013c6a0]
mov rax, qword [rcx + 0x3ed8]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ed8]
movss xmm7, dword [rax + 0x20]
movss xmm10, dword [rax + 0x24]
movss xmm8, dword [rax + 0x28]
movss xmm9, dword [rax + 0x2c]
mov rdi, qword [rax + 0x298]
add rcx, 0x37c8
lea rax, [rbp - 0x50]
mov edx, 8
nop dword [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x14004e160
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movss xmm6, dword [0x14005c798]
movaps xmm2, xmm6
subss xmm2, dword [0x14013bd70]
mulss xmm2, dword [0x14005c73c]
addss xmm2, dword [0x14013bd70]
movss dword [0x14013bd70], xmm2
movaps xmm0, xmmword [0x14005c9c0]
movups xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call fcn.1400165d0
movaps xmm1, xmm10
addss xmm1, dword [0x14005c820]
movaps xmm0, xmm7
addss xmm0, dword [0x14005c840]
movss dword [rsp + 0x60], xmm0
movss dword [rsp + 0x64], xmm1
movaps xmm0, xmm7
movss xmm11, dword [0x14005c80c]
addss xmm0, xmm11
movss dword [rsp + 0x50], xmm0
movss dword [rsp + 0x54], xmm1
movss dword [rsp + 0x20], xmm6
mov r9d, eax
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.1400393b0
movaps xmm0, xmmword [0x14005ca00]
movups xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call fcn.1400165d0
movss xmm0, dword [0x14005c7ec]
subss xmm9, xmm0
addss xmm9, xmm10
subss xmm8, xmm0
addss xmm8, xmm7
movss dword [rsp + 0x50], xmm8
movss dword [rsp + 0x54], xmm9
addss xmm10, xmm0
addss xmm7, xmm0
movss dword [rsp + 0x60], xmm7
movss dword [rsp + 0x64], xmm10
mov dword [rsp + 0x28], r12d
movss xmm0, dword [rbp - 0x40]
movss dword [rsp + 0x20], xmm0
mov r9d, eax
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.140039620
mov rcx, qword [0x14013c6a0]
mov rax, qword [rcx + 0x3ed8]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ed8]
movss xmm1, dword [rax + 0x24]
subss xmm1, dword [rax + 0x88]
addss xmm1, dword [0x14005c7f8]
movss xmm0, dword [rax + 0x20]
subss xmm0, dword [rax + 0x84]
addss xmm0, dword [0x14005c86c]
movss dword [rax + 0x100], xmm0
movss dword [rax + 0x104], xmm1
mov byte [rax + 0x141], 1
mov dword [rsp + 0x50], 0x41a00000
mov dword [rsp + 0x54], 0x41a00000
lea rdx, [rsp + 0x50]
lea rcx, [0x14005a4bc]
call fcn.140044080
test al, al
je 0x14004e372
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rax, qword [r14 + 0x38]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x30], r12
lea rax, str.X666
mov qword [rsp + 0x28], rax
xorps xmm9, xmm9
movss dword [rsp + 0x20], xmm9
movss xmm6, dword [0x14005c894]
movaps xmm3, xmm6
movss xmm2, dword [rcx + 0x14]
lea rdx, [rsp + 0x50]
call fcn.14003d5b0
movss xmm7, dword [rax]
mov rax, qword [r14 + 0x38]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x30], r12
lea rax, [0x14005bc9c]
mov qword [rsp + 0x28], rax
movss dword [rsp + 0x20], xmm9
movaps xmm3, xmm6
movss xmm2, dword [rcx + 0x14]
lea rdx, [rsp + 0x50]
call fcn.14003d5b0
movss xmm6, dword [rax]
movss xmm8, dword [0x14005c870]
subss xmm8, xmm7
subss xmm8, xmm6
movss xmm7, dword [0x14005c7c4]
subss xmm8, xmm7
movss xmm10, dword [0x14005c7b4]
subss xmm8, xmm10
mulss xmm8, dword [0x14005c768]
movss dword [rsp + 0x50], xmm8
mov dword [rsp + 0x54], 0x41700000
movss xmm0, dword [0x14013bdc8]
movss dword [rsp + 0x60], xmm0
movss xmm1, dword [0x14013bdcc]
movss dword [rsp + 0x64], xmm1
movss xmm0, dword [0x14013bdd0]
movss dword [rsp + 0x68], xmm0
mov dword [rsp + 0x6c], 0x3f800000
lea rcx, [rsp + 0x60]
call fcn.1400165d0
mov r8d, eax
mov rcx, qword [r14 + 0x38]
mov rdx, qword [rcx + 0x60]
mov rcx, qword [rdx + 8]
movss xmm2, dword [rcx + 0x14]
test eax, 0xff000000
je 0x14004e4f9
test rcx, rcx
jne 0x14004e49c
mov rax, qword [rdi + 0x38]
mov rcx, qword [rax + 8]
ucomiss xmm2, xmm9
jp 0x14004e4ad
jne 0x14004e4ad
mov rax, qword [rdi + 0x38]
movss xmm2, dword [rax + 0x10]
movups xmm0, xmmword [rdi + 0x88]
movups xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x48], 0
movss dword [rsp + 0x40], xmm9
lea rax, [0x14005bc9f]
mov qword [rsp + 0x38], rax
lea rax, [0x14005bc9c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r8d
lea r9, [rsp + 0x50]
mov rdx, rdi
call fcn.14003d7d0
mov r8, qword [0x14013c6a0]
movups xmm0, xmmword [r8 + 0x38a4]
movups xmmword [rsp + 0x50], xmm0
shufps xmm0, xmm0, 0xff
mulss xmm0, dword [r8 + 0x37c8]
movss dword [rsp + 0x5c], xmm0
lea rcx, [rsp + 0x50]
call fcn.1400165d0
mov r9d, eax
addss xmm6, xmm7
addss xmm6, xmm10
addss xmm6, xmm8
movss dword [rsp + 0x50], xmm6
mov dword [rsp + 0x54], 0x41700000
mov rcx, qword [r14 + 0x38]
mov rdx, qword [rcx + 0x60]
mov rcx, qword [rdx + 8]
movss xmm2, dword [rcx + 0x14]
test eax, 0xff000000
je 0x14004e5d2
test rcx, rcx
jne 0x14004e56e
mov rax, qword [rdi + 0x38]
mov rcx, qword [rax + 8]
ucomiss xmm2, xmm9
jp 0x14004e57f
jne 0x14004e57f
mov rax, qword [rdi + 0x38]
movss xmm2, dword [rax + 0x10]
movups xmm0, xmmword [rdi + 0x88]
movups xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x48], 0
movss dword [rsp + 0x40], xmm9
lea rax, [0x14005bc98]
mov qword [rsp + 0x38], rax
lea rax, str.X666
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r9d
lea r9, [rsp + 0x50]
mov rdx, rdi
call fcn.14003d7d0
mov r8, qword [0x14013c6a0]
mov rax, qword [r8 + 0x3ed8]
mov byte [rax + 0xb8], 1
mov rax, qword [r8 + 0x3ed8]
movss xmm1, dword [rax + 0x24]
subss xmm1, dword [rax + 0x88]
addss xmm1, dword [0x14005c828]
movss xmm0, dword [rax + 0x20]
subss xmm0, dword [rax + 0x84]
addss xmm0, xmm11
movss dword [rax + 0x100], xmm0
movss dword [rax + 0x104], xmm1
mov byte [rax + 0x141], 1
mov rax, qword [r8 + 0x3ed8]
movss xmm0, dword [rax + 0x28]
subss xmm0, dword [0x14005c820]
movss dword [rsp + 0x50], xmm0
mov dword [rsp + 0x54], 0x41c80000
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r14, [0x14013c720]
mov r8, r14
xor edx, edx
lea rcx, str.Email
call fcn.140048c80
mov rcx, qword [0x14013c6a0]
mov rax, qword [rcx + 0x3ed8]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ed8]
movss xmm1, dword [rax + 0x24]
subss xmm1, dword [rax + 0x88]
addss xmm1, dword [0x14005c838]
movss xmm0, dword [rax + 0x20]
subss xmm0, dword [rax + 0x84]
addss xmm0, xmm11
movss dword [rax + 0x100], xmm0
movss dword [rax + 0x104], xmm1
mov byte [rax + 0x141], 1
mov rax, qword [rcx + 0x3ed8]
movss xmm0, dword [rax + 0x28]
subss xmm0, dword [0x14005c820]
movss dword [rsp + 0x50], xmm0
mov dword [rsp + 0x54], 0x41c80000
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x8000
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8, r15
xor edx, edx
lea rcx, str.Password
call fcn.140048c80
mov rcx, qword [0x14013c6a0]
mov rax, qword [rcx + 0x3ed8]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ed8]
movss xmm2, dword [rax + 0x24]
subss xmm2, dword [rax + 0x88]
addss xmm2, dword [0x14005c854]
movss xmm1, dword [rax + 0x20]
subss xmm1, dword [rax + 0x84]
addss xmm1, xmm11
movss dword [rax + 0x100], xmm1
movss dword [rax + 0x104], xmm2
mov byte [rax + 0x141], 1
call fcn.140045180
movss xmm1, dword [0x14005c898]
xorps xmm0, xmm0
call fcn.140025920
mov rdx, qword [0x14013c6a0]
mov rax, qword [rdx + 0x3ed8]
mov byte [rax + 0xb8], 1
mov rax, qword [rdx + 0x3ed8]
movss xmm1, dword [rax + 0x24]
subss xmm1, dword [rax + 0x88]
addss xmm1, dword [0x14005c854]
movss xmm0, dword [rax + 0x20]
subss xmm0, dword [rax + 0x84]
addss xmm0, dword [0x14005c868]
movss dword [rax + 0x100], xmm0
movss dword [rax + 0x104], xmm1
mov byte [rax + 0x141], 1
mov dword [rsp + 0x50], 0x425c0000
mov dword [rsp + 0x54], 0x41d80000
lea rdx, [rsp + 0x50]
lea rcx, str.Login
call fcn.140044080
test al, al
je 0x14004eb2e
mov r12, qword [0x14013c7d8]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xor eax, eax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov rdi, rbx
inc rdi
cmp byte [r15 + rdi], al
jne 0x14004e846
cmp rdi, rsi
ja 0x14004eba9
mov qword [rbp - 0x58], 0xf
cmp rdi, 0x10
jae 0x14004e883
mov qword [rbp - 0x60], rdi
mov r8, rdi
mov rdx, r15
lea rcx, [rbp - 0x70]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rdi - 0x70], 0
jmp 0x14004e922
mov r14, rdi
or r14, 0xf
cmp r14, rsi
jbe 0x14004e894
mov r14, rsi
jmp 0x14004e8a1
cmp r14, 0x16
mov ecx, 0x16
cmovb r14, rcx
mov rcx, r14
add rcx, 1
cmovb rcx, rbx
cmp rcx, 0x1000
jb 0x14004e8e4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004ebaf
mov rcx, rax
call fcn.140050970
test rax, rax
je 0x14004e8dd
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x14004e8f1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14004e8ee
call fcn.140050970
mov r15, rax
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], r14
mov r8, rdi
lea rdx, [0x14013c760]
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [r15 + rdi], 0
lea r15, [0x14013c760]
lea r14, [0x14013c720]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xor edx, edx
mov qword [rbp - 0x80], rdx
mov qword [rbp - 0x78], rdx
mov rdi, rbx
inc rdi
cmp byte [r14 + rdi], dl
jne 0x14004e937
cmp rdi, rsi
ja 0x14004ebb5
mov qword [rbp - 0x78], 0xf
cmp rdi, 0x10
jae 0x14004e975
mov qword [rbp - 0x80], rdi
mov r8, rdi
mov rdx, r14
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rdi + 0x70], 0
jmp 0x14004ea11
mov rax, rdi
or rax, 0xf
cmp rax, rsi
ja 0x14004e991
mov rsi, rax
cmp rax, 0x16
mov eax, 0x16
cmovb rsi, rax
mov rcx, rsi
add rcx, 1
cmovb rcx, rbx
cmp rcx, 0x1000
jb 0x14004e9d4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004eb8b
mov rcx, rax
call fcn.140050970
test rax, rax
je 0x14004e9cd
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14004e9e6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14004e9e3
call fcn.140050970
mov r14, rax
jmp 0x14004e9e6
mov r14, rdx
mov qword [rsp + 0x70], r14
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], rsi
mov r8, rdi
lea rdx, [0x14013c720]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rdi], 0
lea r14, [0x14013c720]
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x70]
mov rcx, r12
call fcn.1400030e0
test al, al
je 0x14004eaf9
lea rax, [rbp + 0x3f8]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x3f0]
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareX666
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14004eaef
mov rax, rbx
inc rax
cmp byte [r14 + rax], 0
jne 0x14004ea76
inc eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r14
mov r9d, 1
xor r8d, r8d
lea rdx, str.Username
mov rcx, qword [rbp + 0x3f0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
nop dword [rax + rax]
inc rbx
cmp byte [r15 + rbx], 0
jne 0x14004eab0
inc ebx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r15
mov r9d, 1
xor r8d, r8d
lea rdx, str.Password
mov rcx, qword [rbp + 0x3f0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x3f0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [r13 + 0x222], 1
jmp 0x14004eb2e
mov rdx, qword [0x14013c7c8]
add rdx, 0xa8
cmp qword [rdx + 0x18], 0x10
jb 0x14004eb11
mov rdx, qword [rdx]
mov r9d, 0x10
lea r8, str.Error
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov byte [r13 + 0x222], 0
call fcn.1400220f0
mov ecx, 1
call fcn.140016b70
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.140050950
lea r11, [rsp + 0x570]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400028e0
nop
call fcn.1400029f0
int3
call fcn.1400028e0
nop
call fcn.1400029f0
int3
call fcn.1400028e0
nop
call fcn.1400029f0
int3
call fcn.1400028e0
nop
call fcn.1400029f0
int3