Function at 0x1400010d0
Capabilities:
Delete volume shadow copies
Enumerate files on windows
Enumerate processes
Get common file path
Get disk information
Query or enumerate registry key
Read file on windows
Terminate process
Write file on windows

Disassembly:
push rbp
push rdi
lea rbp, [rsp - 0x218f8]
mov eax, 0x219f8
call fcn.1400177b0
sub rsp, rax
mov rax, qword [0x140025008]
xor rax, rsp
mov qword [rbp + 0x218d0], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov dword [rsp + 0x30], 0x206
xor r9d, r9d
mov rcx, rax
mov dword [rsp + 0x28], 1
xor r8d, r8d
mov dword [rsp + 0x20], 1
xor edx, edx
call qword [sym.imp.USER32.dll_SetWindowPos]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.14000655c
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtQueryKey
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edi, edi
lea r8, [rsp + 0x40]
lea rdx, str.SeTakeOwnershipPrivilege
mov qword [0x140026e80], rax
xor ecx, ecx
mov qword [rsp + 0x40], rdi
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x1400011a6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.SeTakeOwnershipPrivilege
lea rcx, str.Failed_to_lookup_privilege__ws:__d_n
call fcn.140001010
jmp 0x140001260
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x1c4], rax
mov dword [rbp + 0x1c0], 1
mov dword [rbp + 0x1cc], 2
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x48]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400011fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_open_current_process_token:__d_n
call fcn.140001010
jmp 0x140001260
mov rcx, qword [rsp + 0x48]
lea r8, [rbp + 0x1c0]
mov qword [rsp + 0x28], rdi
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x14000123c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_adjust_current_process_token_privileges:__d_n
call fcn.140001010
jmp 0x140001255
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
jne 0x14000128a
lea rcx, str.Token_failed_to_acquire_privilege_n
call fcn.140001010
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.failed_to_adjust_privilege_n
call fcn.140001010
mov eax, 1
mov rcx, qword [rbp + 0x218d0]
xor rcx, rsp
call fcn.1400041b0
add rsp, 0x219f8
pop rdi
pop rbp
ret
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x21a10], rbx
mov qword [rsp + 0x21a18], rsi
mov qword [rsp + 0x21a20], r12
mov qword [rsp + 0x219f0], r13
mov qword [rsp + 0x219e8], r14
mov qword [rsp + 0x219e0], r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], rdi
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetEnumDISPLAY
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000131c
mov rcx, 0xffffffff80000002
call fcn.140002e20
mov rdx, rax
lea r8, str.SYSTEMCurrentControlSetEnumDISPLAY
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x1400015ec
mov r15, qword [rsp + 0x48]
lea rcx, [rbp + 0x1d0]
xor edx, edx
mov r8d, 0x208
call fcn.1400053d0
mov qword [rsp + 0x38], rdi
lea r9, [rbp + 0x1b0]
mov qword [rsp + 0x30], rdi
lea r8, [rbp + 0x1d0]
mov qword [rsp + 0x28], rdi
xor edx, edx
mov rcx, r15
mov qword [rsp + 0x20], rdi
mov r12d, edi
mov dword [rbp + 0x1b0], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400015e3
nop word [rax + rax]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x1d0]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400013cf
mov rcx, r15
call fcn.140002e20
mov rdx, rax
lea r8, [rbp + 0x1d0]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x1400015a0
mov rsi, qword [rsp + 0x40]
lea rcx, [rbp + 0xa90]
xor edx, edx
mov r8d, 0x208
call fcn.1400053d0
mov qword [rsp + 0x38], rdi
lea r9, [rbp + 0x1b8]
mov qword [rsp + 0x30], rdi
lea r8, [rbp + 0xa90]
mov qword [rsp + 0x28], rdi
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rdi
mov r14d, edi
mov dword [rbp + 0x1b8], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140001597
nop word [rax + rax]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], rdi
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0xa90]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000147f
mov rcx, rsi
call fcn.140002e20
mov rdx, rax
lea r8, [rbp + 0xa90]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140001554
mov rdi, qword [rsp + 0x50]
lea rcx, [rbp + 0x880]
xor edx, edx
mov r8d, 0x208
call fcn.1400053d0
xor r13d, r13d
mov dword [rbp + 0x1b4], 0x208
mov qword [rsp + 0x38], r13
lea r9, [rbp + 0x1b4]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x880]
mov qword [rsp + 0x28], r13
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], r13
mov ebx, r13d
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140001549
nop dword [rax]
lea rdx, str.device_parameters
lea rcx, [rbp + 0x880]
call fcn.1400067f8
mov rcx, rdi
test eax, eax
je 0x140001536
mov qword [rsp + 0x38], r13
lea r9, [rbp + 0x1b4]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x880]
inc ebx
mov qword [rsp + 0x28], r13
mov edx, ebx
mov qword [rsp + 0x20], r13
mov dword [rbp + 0x1b4], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1400014e0
jmp 0x140001549
lea r8, str.EDID
lea rdx, [rbp + 0x880]
call fcn.1400036a0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov qword [rsp + 0x38], rdi
lea r9, [rbp + 0x1b8]
mov qword [rsp + 0x30], rdi
lea r8, [rbp + 0xa90]
inc r14d
mov qword [rsp + 0x28], rdi
mov edx, r14d
mov qword [rsp + 0x20], rdi
mov rcx, rsi
mov dword [rbp + 0x1b8], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140001430
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], rdi
lea r9, [rbp + 0x1b0]
mov qword [rsp + 0x30], rdi
lea r8, [rbp + 0x1d0]
inc r12d
mov qword [rsp + 0x28], rdi
mov edx, r12d
mov qword [rsp + 0x20], rdi
mov rcx, r15
mov dword [rbp + 0x1b0], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140001380
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, str.SMBiosData
mov rcx, 0xffffffff80000002
lea rdx, str.SYSTEMCurrentControlSetServicesmssmbiosData
call fcn.140003c00
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], rdi
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMHardwareConfig
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000165d
mov rcx, 0xffffffff80000002
call fcn.140002e20
mov rdx, rax
lea r8, str.SYSTEMHardwareConfig
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140001752
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x208
call fcn.1400053d0
mov rdi, qword [rsp + 0x50]
lea r8, [rsp + 0x70]
mov rcx, rdi
lea rdx, str.LastConfig
call fcn.140002f50
xor edx, edx
lea rcx, [rbp + 0x1d0]
mov r8d, 0x208
call fcn.1400053d0
xor r12d, r12d
mov dword [rbp + 0x1b0], 0x208
mov qword [rsp + 0x38], r12
lea r9, [rbp + 0x1b0]
mov qword [rsp + 0x30], r12
lea r8, [rbp + 0x1d0]
mov qword [rsp + 0x28], r12
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], r12
mov ebx, r12d
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140001747
nop dword [rax]
lea rdx, str.current
lea rcx, [rbp + 0x1d0]
call fcn.1400067f8
mov rcx, rdi
test eax, eax
jne 0x140001736
mov qword [rsp + 0x38], r12
lea r9, [rbp + 0x1b0]
mov qword [rsp + 0x30], r12
lea r8, [rbp + 0x1d0]
inc ebx
mov qword [rsp + 0x28], r12
mov edx, ebx
mov qword [rsp + 0x20], r12
mov dword [rbp + 0x1b0], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1400016e0
jmp 0x140001747
lea r8, [rsp + 0x70]
lea rdx, [rbp + 0x1d0]
call fcn.1400038e0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
lea r8, str.ClientUUID
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWARENVIDIA_CorporationGlobal
call fcn.140003140
lea r8, str.PersistenceIdentifier
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWARENVIDIA_CorporationGlobal
call fcn.140003140
lea r8, str.ChipsetMatchID
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWARENVIDIA_CorporationGlobalCoProcManager
call fcn.140003140
lea rdx, str.SYSTEMMountedDevices
mov rcx, 0xffffffff80000002
call fcn.140003b00
lea rdx, str.SOFTWAREMicrosoftDfrgStatistics
mov rcx, 0xffffffff80000002
call fcn.140003b00
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBitBucketVolume
mov rcx, 0xffffffff80000001
call fcn.140003b00
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerMountPoints2CPCVolume
mov rcx, 0xffffffff80000001
call fcn.140003b00
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerMountPoints2
mov rcx, 0xffffffff80000001
call fcn.140003b00
lea r8, str.LastEnum
mov rcx, 0xffffffff80000001
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBitBucket
call fcn.140003c00
lea r8, str.WindowsAIKHash
mov rcx, 0xffffffff80000002
lea rdx, str.SYSTEMCurrentControlSetServicesTPMWMI
call fcn.1400036a0
lea r8, str.WHQLClass
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftDirect3D
call fcn.1400036a0
lea r8, str.MSICache
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareClassesInstallerDependencies
call fcn.1400036a0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], rdi
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystemMultifunctionAdapter0DiskController0DiskPeripheral
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400018be
mov rcx, 0xffffffff80000002
call fcn.140002e20
mov rdx, rax
lea r8, str.HARDWAREDESCRIPTIONSystemMultifunctionAdapter0DiskController0DiskPeripheral
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x14000197e
mov rdi, qword [rsp + 0x50]
lea rcx, [rbp + 0x1d0]
xor edx, edx
mov r8d, 0x208
call fcn.1400053d0
xor r12d, r12d
mov dword [rbp + 0x1b0], 0x208
mov qword [rsp + 0x38], r12
lea r9, [rbp + 0x1b0]
mov qword [rsp + 0x30], r12
lea r8, [rbp + 0x1d0]
mov qword [rsp + 0x28], r12
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], r12
mov ebx, r12d
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140001973
nop dword [rax + rax]
lea r8, str.Identifier
mov rcx, rdi
lea rdx, [rbp + 0x1d0]
call fcn.140003140
mov qword [rsp + 0x38], r12
lea r9, [rbp + 0x1b0]
mov qword [rsp + 0x30], r12
lea r8, [rbp + 0x1d0]
inc ebx
mov qword [rsp + 0x28], r12
mov edx, ebx
mov qword [rsp + 0x20], r12
mov rcx, rdi
mov dword [rbp + 0x1b0], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140001920
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], rdi
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.HARDWAREDEVICEMAPScsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400019d5
mov rcx, 0xffffffff80000002
call fcn.140002e20
mov rdx, rax
lea r8, str.HARDWAREDEVICEMAPScsi
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140001da2
mov r13, qword [rsp + 0x50]
lea rcx, [rbp + 0xa90]
xor edx, edx
mov r8d, 0x208
call fcn.1400053d0
mov qword [rsp + 0x38], rdi
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rdi
lea r8, [rbp + 0xa90]
mov ebx, edi
mov qword [rsp + 0x28], rdi
xor edx, edx
mov qword [rsp + 0x20], rdi
mov rcx, r13
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140001d99
nop
lea rax, [rsp + 0x58]
mov qword [rsp + 0x58], rdi
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0xa90]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140001a7f
mov rcx, r13
call fcn.140002e20
mov rdx, rax
lea r8, [rbp + 0xa90]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140001d58
mov r15, qword [rsp + 0x58]
lea rcx, [rbp + 0x1d0]
xor edx, edx
mov r8d, 0x208
call fcn.1400053d0
mov qword [rsp + 0x38], rdi
lea r9, [rbp + 0x1b4]
mov qword [rsp + 0x30], rdi
lea r8, [rbp + 0x1d0]
mov qword [rsp + 0x28], rdi
xor edx, edx
mov rcx, r15
mov qword [rsp + 0x20], rdi
mov r12d, edi
mov dword [rbp + 0x1b4], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140001d4f
nop word [rax + rax]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], rdi
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x1d0]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140001b2f
mov rcx, r15
call fcn.140002e20
mov rdx, rax
lea r8, [rbp + 0x1d0]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140001d08
mov rsi, qword [rsp + 0x60]
lea rcx, [rbp + 0x880]
xor edx, edx
mov r8d, 0x208
call fcn.1400053d0
mov qword [rsp + 0x38], rdi
lea r9, [rbp + 0x1b8]
mov qword [rsp + 0x30], rdi
lea r8, [rbp + 0x880]
mov qword [rsp + 0x28], rdi
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rdi
mov r14d, edi
mov dword [rbp + 0x1b8], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140001cff
nop word [rax + rax]
lea rdx, str.arget
lea rcx, [rbp + 0x880]
call fcn.140004e90
test rax, rax
je 0x140001cbc
lea rax, [rbp + 0x1c0]
mov qword [rbp + 0x1c0], rdi
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x880]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140001bff
mov rcx, rsi
call fcn.140002e20
mov rdx, rax
lea r8, [rbp + 0x880]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140001cbc
mov rdi, qword [rbp + 0x1c0]
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x208
call fcn.1400053d0
xor eax, eax
mov dword [rbp + 0x1b0], 0x208
mov qword [rsp + 0x38], rax
lea r9, [rbp + 0x1b0]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rax
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140001cb1
nop word [rax + rax]
lea r8, str.Identifier
mov rcx, rdi
lea rdx, [rsp + 0x70]
call fcn.140003140
xor eax, eax
mov dword [rbp + 0x1b0], 0x208
mov qword [rsp + 0x38], rax
lea r9, [rbp + 0x1b0]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rax
inc ebx
mov edx, ebx
mov qword [rsp + 0x20], rax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140001c60
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov qword [rsp + 0x38], rdi
lea r9, [rbp + 0x1b8]
mov qword [rsp + 0x30], rdi
lea r8, [rbp + 0x880]
inc r14d
mov qword [rsp + 0x28], rdi
mov edx, r14d
mov qword [rsp + 0x20], rdi
mov rcx, rsi
mov dword [rbp + 0x1b8], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140001b90
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], rdi
lea r9, [rbp + 0x1b4]
mov qword [rsp + 0x30], rdi
lea r8, [rbp + 0x1d0]
inc r12d
mov qword [rsp + 0x28], rdi
mov edx, r12d
mov qword [rsp + 0x20], rdi
mov rcx, r15
mov dword [rbp + 0x1b4], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140001ae0
mov ebx, dword [rsp + 0x48]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], rdi
lea r9, [rsp + 0x40]
inc ebx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
lea r8, [rbp + 0xa90]
mov edx, ebx
mov qword [rsp + 0x20], rdi
mov rcx, r13
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140001a30
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, str.RandomSeed
mov rcx, 0xffffffff80000002
lea rdx, str.SYSTEMCurrentControlSetServicesTPMODUID
call fcn.1400036a0
lea r8, str.MachineGuid
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftCryptography
call fcn.140003140
lea r8, str.HwProfileGuid
mov rcx, 0xffffffff80000002
lea rdx, str.SYSTEMCurrentControlSetControlIDConfigDBHardware_Profiles0001
call fcn.140003140
lea r8, str.AccountDomainSid
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
call fcn.140003140
lea r8, str.PingID
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
call fcn.140003140
lea r8, str.SusClientId
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
call fcn.140003140
lea r8, str.SusClientIdValidation
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
call fcn.1400036a0
lea r8, str.Dhcpv6DUID
mov rcx, 0xffffffff80000002
lea rdx, str.SYSTEMCurrentControlSetServicesTcpip6Parameters
call fcn.1400036a0
lea r8, str.ComputerHardwareId
mov rcx, 0xffffffff80000002
lea rdx, str.SYSTEMCurrentControlSetControlSystemInformation
call fcn.140003140
call fcn.140003230
lea r8, str.IE_Installed_Date
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftInternet_ExplorerMigration
call fcn.1400036a0
lea r8, str.MachineId
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftSQMClient
call fcn.140003140
lea r8, str.WinSqmFirstSessionStartTime
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftSQMClient
call fcn.1400034f0
lea r8, str.InstallTime
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
call fcn.1400034f0
lea r8, str.InstallDate
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
call fcn.1400034f0
lea r8, str.DigitalProductId
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
call fcn.1400036a0
lea r8, str.DigitalProductId4
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
call fcn.1400036a0
lea r8, str.BuildGUID
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
call fcn.140003140
lea r8, str.ProductId
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
call fcn.140003140
lea r8, str.BuildLab
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
call fcn.140003140
lea r8, str.BuildLabEx
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
call fcn.140003140
lea r8, str._DriverProviderInfo
mov rcx, 0xffffffff80000002
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000
call fcn.140003140
lea r8, str.UserModeDriverGUID
mov rcx, 0xffffffff80000002
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000
call fcn.140003140
lea rax, [rbp + 0x1c0]
mov qword [rbp + 0x1c0], rdi
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e972_e325_11ce_bfc1_08002be10318
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000203e
mov rcx, 0xffffffff80000002
call fcn.140002e20
mov rdx, rax
lea r8, str.SYSTEMCurrentControlSetControlClass4d36e972_e325_11ce_bfc1_08002be10318
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140002142
mov rbx, qword [rbp + 0x1c0]
lea rcx, [rbp + 0x880]
xor edx, edx
mov r8d, 0x208
call fcn.1400053d0
xor r12d, r12d
mov dword [rsp + 0x40], 0x208
mov qword [rsp + 0x38], r12
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], r12
lea r8, [rbp + 0x880]
mov qword [rsp + 0x28], r12
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140002137
nop word [rax + rax]
lea rdx, str.configuration
lea rcx, [rbp + 0x880]
call fcn.1400067f8
test eax, eax
je 0x1400020fa
lea rdx, str.properties
lea rcx, [rbp + 0x880]
call fcn.1400067f8
test eax, eax
je 0x1400020fa
lea r8, str.NetworkAddress
mov rcx, rbx
lea rdx, [rbp + 0x880]
call fcn.140003c00
lea r8, str.NetworkInterfaceInstallTimestamp
mov rcx, rbx
lea rdx, [rbp + 0x880]
call fcn.1400034f0
mov qword [rsp + 0x38], r12
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], r12
lea r8, [rbp + 0x880]
inc edi
mov qword [rsp + 0x28], r12
mov edx, edi
mov qword [rsp + 0x20], r12
mov rcx, rbx
mov dword [rsp + 0x40], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1400020a0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionDiagnosticsDiagTrackSettingsRequests
mov rcx, 0xffffffff80000002
call fcn.140003b00
lea r8, str.LastEventlogWrittenTime
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionDiagnosticsDiagTrackSevilleEventlogManager
call fcn.1400034f0
lea r8, str.ProductActivationTime
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatformActivation
call fcn.1400034f0
lea r8, str.BackupProductKeyDefault
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform
call fcn.140003c00
lea r8, str.actionlist
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform
call fcn.140003c00
lea r8, str.ServiceSessionId
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform
call fcn.140003c00
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist
mov rcx, 0xffffffff80000001
call fcn.140003b00
lea rdx, str.SoftwareHex_RaysIDAHistory
mov rcx, 0xffffffff80000001
call fcn.140003b00
lea rdx, str.SoftwareHex_RaysIDAHistory64
mov rcx, 0xffffffff80000001
call fcn.140003b00
lea rax, [rbp + 0x1c0]
mov qword [rbp + 0x1c0], rdi
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.HARDWAREUEFIESRT
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000226b
mov rcx, 0xffffffff80000002
call fcn.140002e20
mov rdx, rax
lea r8, str.HARDWAREUEFIESRT
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x1400023e9
mov r14, qword [rbp + 0x1c0]
lea rcx, [rbp + 0x12d0]
xor edx, edx
mov r8d, 0x205f8
call fcn.1400053d0
xor edx, edx
lea rcx, [rbp + 0x1d0]
mov r8d, 0x208
mov esi, edi
call fcn.1400053d0
mov qword [rsp + 0x38], rdi
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rdi
lea r8, [rbp + 0x1d0]
mov qword [rsp + 0x28], rdi
xor edx, edx
mov rcx, r14
mov qword [rsp + 0x20], rdi
mov ebx, edi
mov dword [rsp + 0x40], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400023e0
nop dword [rax]
mov eax, esi
lea r8, [rbp + 0x12d0]
imul rcx, rax, 0x208
inc esi
lea rax, [rbp + 0x1d0]
add r8, rcx
lea rdx, [rbp + 0x1d0]
sub r8, rax
nop word [rax + rax]
movzx eax, word [rdx]
mov word [r8 + rdx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x140002310
mov qword [rsp + 0x38], rdi
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rdi
lea r8, [rbp + 0x1d0]
inc ebx
mov qword [rsp + 0x28], rdi
mov edx, ebx
mov qword [rsp + 0x20], rdi
mov rcx, r14
mov dword [rsp + 0x40], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1400022e0
test esi, esi
je 0x1400023e0
lea rbx, [rsp + 0x70]
lea rax, [rbp + 0x12d0]
sub rbx, rax
lea rdi, [rbp + 0x12d0]
nop dword [rax + rax]
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x208
call fcn.1400053d0
mov rcx, rdi
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rbx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1400023a0
lea rcx, [rsp + 0x70]
call fcn.140002ea0
lea r8, [rsp + 0x70]
mov rdx, rdi
mov rcx, r14
call fcn.1400038e0
add rdi, 0x208
sub rbx, 0x208
sub rsi, 1
jne 0x140002380
xor edi, edi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
lea rcx, [rbp + 0x670]
mov r8d, 0x208
call fcn.1400053d0
xor edx, edx
lea rcx, [rbp + 0xeb0]
mov r8d, 0x208
call fcn.1400053d0
xor edx, edx
lea rcx, [rbp + 0x10c0]
mov r8d, 0x208
call fcn.1400053d0
xor edx, edx
lea rcx, [rbp + 0xca0]
mov r8d, 0x208
call fcn.1400053d0
lea rdx, [rbp + 0xeb0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov r9d, 1
lea rax, [rbp + 0x10c0]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x19]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov r9d, 1
lea rax, [rbp + 0xca0]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x1b]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea r8, [rbp + 0xeb0]
lea rdx, [0x140021d98]
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea rcx, [rbp + 0x420]
mov r8d, 0x250
call fcn.1400053d0
lea rdx, [rbp + 0x420]
lea rcx, [rbp + 0x670]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
nop dword [rax]
nop word [rax + rax]
movzx edx, word [rbp + 0x44c]
movzx ecx, word [rbp + 0x44e]
cmp dx, 0x2e
jne 0x14000250d
test cx, cx
je 0x14000253b
cmp dx, dx
jne 0x14000250d
cmp cx, dx
jne 0x14000250d
cmp word [rbp + 0x450], 0
je 0x14000253b
lea r9, [rbp + 0x44c]
lea r8, [rbp + 0xeb0]
lea rdx, [0x140021da8]
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x670]
call fcn.140003d00
lea rdx, [rbp + 0x420]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400024e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea r8, [rbp + 0xca0]
lea rdx, str._wsD3DSCache
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x670]
call fcn.140003d00
lea r8, [rbp + 0xca0]
lea rdx, str._wsNVIDIA_CorporationGfeSDK
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x670]
call fcn.140003d00
lea r8, [rbp + 0xca0]
lea rdx, str._wsMicrosoftFeeds
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x670]
call fcn.140003d00
lea r8, [rbp + 0xca0]
lea rdx, str._wsMicrosoftFeeds_Cache
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x670]
call fcn.140003d00
lea r8, [rbp + 0xca0]
lea rdx, str._wsMicrosoftWindowsINetCache
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x670]
call fcn.140003d00
lea r8, [rbp + 0xca0]
lea rdx, str._wsMicrosoftWindowsINetCookies
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x670]
call fcn.140003d00
lea r8, [rbp + 0xca0]
lea rdx, str._wsMicrosoftWindowsWebCache
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x670]
call fcn.140003d00
lea r8, [rbp + 0xca0]
lea rdx, str._wsMicrosoftXboxLiveAuthStateCache.dat
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x670]
call fcn.140003d00
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov r15d, eax
mov esi, 0x43
test eax, eax
je 0x140002d15
lea r13, [0x140025a40]
nop dword [rax]
test r15b, 1
je 0x140002d07
mov edx, esi
lea rcx, str._n___DRIVE:__c____n_n
call fcn.140001010
mov r8d, esi
lea rdx, str.._c:
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_wsprintfW]
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
lea rcx, [rbp + 0x670]
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140002817
xor edx, edx
lea rcx, [rbp + 0x880]
mov r8d, 0x200
call fcn.1400053d0
lea r9, [rsp + 0x48]
mov dword [rsp + 0x48], edi
mov r8d, 0x200
mov qword [rsp + 0x20], rdi
lea rdx, [rbp + 0x880]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400027ab
cmp dword [rsp + 0x48], 0x200
jne 0x1400027ab
mov ebx, edi
mov rdi, r13
nop word [rax + rax]
mov rdx, qword [rdi]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140002780
mov eax, dword [rdi + 8]
lea rcx, [rbp + 0x880]
add rcx, rax
call fcn.140017820
test eax, eax
je 0x1400027b9
inc ebx
add rdi, 0x10
cmp ebx, 3
jb 0x140002770
xor r12d, r12d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000281a
call fcn.140006530
mov ebx, eax
shl ebx, 0x10
call fcn.140006530
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rax + rbx]
mov eax, dword [rdi + 0xc]
mov dword [rbp + rax + 0x880], ecx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x1400027ab
xor r12d, r12d
lea rdx, [rbp + 0x880]
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov r8d, 0x200
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000281a
xor r12d, r12d
mov r8d, esi
lea rdx, str._c:WindowsSystem32_restoreMachineGuid.txt
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x670]
call fcn.140003d00
mov r8d, esi
lea rdx, str._c:UsersPublicLibrariescollection.dat
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x670]
call fcn.140003d00
mov r8d, esi
lea rdx, str._c:System_Volume_InformationIndexerVolumeGuid
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x670]
call fcn.140003d00
mov r8d, esi
lea rdx, str._c:System_Volume_InformationWPSettings.dat
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x670]
call fcn.140003d00
mov r8d, esi
lea rdx, str._c:System_Volume_Information_tracking.log
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x670]
call fcn.140003d00
mov r8d, esi
lea rdx, str._c:ProgramDataMicrosoftWindowsWER
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x670]
call fcn.140003d00
mov r8d, esi
lea rdx, str._c:UsersPublicShared_Files
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x670]
call fcn.140003d00
mov r8d, esi
lea rdx, str._c:WindowsINF_setupapi.dev.log
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x670]
call fcn.140003d00
mov r8d, esi
lea rdx, str._c:WindowsINF_setupapi.setup.log
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x670]
call fcn.140003d00
mov r8d, esi
lea rdx, str._c:UsersPublicLibraries
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x670]
call fcn.140003d00
mov r8d, esi
lea rdx, str._c:MSOCache
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x670]
call fcn.140003d00
mov r8d, esi
lea rdx, str._c:ProgramData_ntuser.pol
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x670]
call fcn.140003d00
mov r8d, esi
lea rdx, str._c:UsersDefaultNTUSER.DAT
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x670]
call fcn.140003d00
mov r8d, esi
lea rdx, str._c:Recovery_ntuser.sys
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x670]
call fcn.140003d00
mov r8d, esi
lea rdx, str._c:desktop.ini
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x670]
call fcn.140003d00
mov r8d, esi
lea rdx, str._c:WindowsPrefetch
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea rcx, [rbp + 0x12d0]
mov r8d, 0x250
call fcn.1400053d0
lea rdx, [rbp + 0x12d0]
lea rcx, [rbp + 0x670]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
nop dword [rax]
movzx edx, word [rbp + 0x12fc]
movzx ecx, word [rbp + 0x12fe]
cmp dx, 0x2e
jne 0x140002a9d
test cx, cx
je 0x140002ac7
cmp dx, dx
jne 0x140002a9d
cmp cx, dx
jne 0x140002a9d
cmp word [rbp + 0x1300], 0
je 0x140002ac7
lea r9, [rbp + 0x12fc]
mov r8d, esi
lea rdx, str._c:WindowsPrefetch_ws
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x670]
call fcn.140003d00
lea rdx, [rbp + 0x12d0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140002a70
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r8d, esi
lea rdx, [0x140022460]
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea rcx, [rbp + 0x420]
mov r8d, 0x250
call fcn.1400053d0
lea rdx, [rbp + 0x420]
lea rcx, [rbp + 0x670]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
nop word [rax + rax]
movzx edx, word [rbp + 0x44c]
movzx ecx, word [rbp + 0x44e]
cmp dx, 0x2e
jne 0x140002b65
test cx, cx
je 0x140002c8b
cmp dx, dx
jne 0x140002b65
cmp cx, dx
jne 0x140002b65
cmp word [rbp + 0x450], 0
je 0x140002c8b
test byte [rbp + 0x420], 0x10
je 0x140002c8b
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x208
call fcn.1400053d0
mov rcx, r12
nop word [rax + rax]
movzx eax, word [rbp + rcx + 0x44c]
mov word [rsp + rcx + 0x70], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140002b90
lea r9, [rsp + 0x70]
mov r8d, esi
lea rdx, str._c:Users_ws
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea rcx, [rbp + 0x1d0]
mov r8d, 0x250
call fcn.1400053d0
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x670]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
nop dword [rax]
movzx edx, word [rbp + 0x1fc]
movzx ecx, word [rbp + 0x1fe]
cmp dx, 0x2e
jne 0x140002c1d
test cx, cx
je 0x140002c6a
cmp dx, dx
jne 0x140002c1d
cmp cx, dx
jne 0x140002c1d
cmp word [rbp + 0x200], 0
je 0x140002c6a
lea rdx, str.ntuser
lea rcx, [rbp + 0x1fc]
call qword [sym.imp.SHLWAPI.dll_StrStrW]
test rax, rax
je 0x140002c6a
lea rax, [rbp + 0x1fc]
mov r8d, esi
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea rdx, str._c:Users_ws_ws
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x670]
call fcn.140003d00
lea rdx, [rbp + 0x1d0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140002bf0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, [rbp + 0x420]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140002b30
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r8d, esi
lea rdx, str._c:Users
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x670]
call fcn.140004040
xor edx, edx
lea rcx, [rbp + 0xa90]
mov r8d, 0x104
call fcn.1400053d0
mov r8d, esi
lea rdx, str.fsutil_usn_deletejournal__d__c:
lea rcx, [rbp + 0xa90]
call fcn.140001070
lea rcx, [rbp + 0xa90]
call fcn.140008a1c
inc esi
shr r15d, 1
mov edi, 0
jne 0x1400026b0
lea rcx, str.vssadmin_delete_shadows__All__Quiet
call fcn.140008a1c
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r15, qword [rsp + 0x219e0]
mov rbx, rax
mov r14, qword [rsp + 0x219e8]
mov r13, qword [rsp + 0x219f0]
mov r12, qword [rsp + 0x21a20]
mov rsi, qword [rsp + 0x21a18]
test rax, rax
je 0x140002dfc
xor edx, edx
lea rcx, [rsp + 0x74]
mov r8d, 0x234
call fcn.1400053d0
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140002df3
nop dword [rax]
lea rdx, str.WmiPrvSE.exe
lea rcx, [rbp - 0x64]
call fcn.1400067f8
test eax, eax
je 0x140002db8
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140002d90
jmp 0x140002df3
mov r8d, dword [rsp + 0x78]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140002df3
lea rcx, str.Killed_Winmgmt_n
call fcn.140001010
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.net_stop_winmgmt__Y
call fcn.140008a1c
xor ecx, ecx
call fcn.140006524
mov rbx, qword [rsp + 0x21a10]
int3