Function at 0x140011352
Capabilities:
Delete volume shadow copies
Enumerate files on windows
Enumerate processes
Execute command
Get common file path
Get disk information
Query or enumerate registry key
Read file on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
jmp 0x140011ce0
push rbp
push rdi
mov eax, 0x24b28
call fcn.1400110c8
sub rsp, rax
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x913a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140026080]
xor rax, rbp
mov qword [rbp + 0x24ad0], rax
lea rcx, [0x14002c0ba]
call fcn.1400114d3
nop
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_srand]
nop
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
nop
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtQueryKey
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140026c18], rax
lea rcx, str.SeTakeOwnershipPrivilege
call fcn.140011393
test eax, eax
jne 0x140011d8c
lea rcx, str.failed_to_adjust_privilege_n
call fcn.140011235
nop
mov eax, 1
jmp 0x140013baa
mov qword [rbp + 8], 0
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetEnumDISPLAY
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140011de6
mov rcx, 0xffffffff80000002
call fcn.14001113b
lea r8, str.SYSTEMCurrentControlSetEnumDISPLAY
mov rdx, rax
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140011235
nop
jmp 0x1400120c6
mov rax, qword [rbp + 8]
mov qword [rbp + 0x28], rax
lea rax, [rbp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rbp + 0x274], 0
mov dword [rbp + 0x294], 0x208
jmp 0x140011e2c
mov eax, dword [rbp + 0x274]
inc eax
mov dword [rbp + 0x274], eax
mov dword [rbp + 0x294], 0x208
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x294]
lea r8, [rbp + 0x50]
mov edx, dword [rbp + 0x274]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400120bb
mov qword [rbp + 0x2b8], 0
lea rax, [rbp + 0x2b8]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140011ec7
mov rcx, qword [rbp + 0x28]
call fcn.14001113b
lea r8, [rbp + 0x50]
mov rdx, rax
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140011235
nop
jmp 0x1400120b6
mov rax, qword [rbp + 0x2b8]
mov qword [rbp + 0x2d8], rax
lea rax, [rbp + 0x300]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rbp + 0x524], 0
mov dword [rbp + 0x544], 0x208
jmp 0x140011f16
mov eax, dword [rbp + 0x524]
inc eax
mov dword [rbp + 0x524], eax
mov dword [rbp + 0x544], 0x208
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x544]
lea r8, [rbp + 0x300]
mov edx, dword [rbp + 0x524]
mov rcx, qword [rbp + 0x2d8]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400120a8
mov qword [rbp + 0x568], 0
lea rax, [rbp + 0x568]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rbp + 0x300]
mov rcx, qword [rbp + 0x2d8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140011fc3
mov rcx, qword [rbp + 0x2d8]
call fcn.14001113b
lea r8, [rbp + 0x300]
mov rdx, rax
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140011235
nop
jmp 0x1400120a3
mov rax, qword [rbp + 0x568]
mov qword [rbp + 0x588], rax
lea rax, [rbp + 0x5b0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rbp + 0x7d4], 0
mov dword [rbp + 0x7f4], 0x208
jmp 0x140012012
mov eax, dword [rbp + 0x7d4]
inc eax
mov dword [rbp + 0x7d4], eax
mov dword [rbp + 0x7f4], 0x208
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x7f4]
lea r8, [rbp + 0x5b0]
mov edx, dword [rbp + 0x7d4]
mov rcx, qword [rbp + 0x588]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140012095
lea rdx, str.device_parameters
lea rcx, [rbp + 0x5b0]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x140012090
lea r8, str.EDID
lea rdx, [rbp + 0x5b0]
mov rcx, qword [rbp + 0x588]
call fcn.1400111ae
nop
jmp 0x140012095
jmp 0x140011ffa
mov rcx, qword [rbp + 0x588]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x140011efe
mov rcx, qword [rbp + 0x2d8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x140011e14
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea r8, str.SMBiosData
lea rdx, str.SYSTEMCurrentControlSetServicesmssmbiosData
mov rcx, 0xffffffff80000002
call fcn.14001100f
nop
mov qword [rbp + 0x818], 0
lea rax, [rbp + 0x818]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SYSTEMHardwareConfig
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140012141
mov rcx, 0xffffffff80000002
call fcn.14001113b
lea r8, str.SYSTEMHardwareConfig
mov rdx, rax
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140011235
nop
jmp 0x140012255
lea rax, [rbp + 0x840]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov rax, qword [rbp + 0x818]
mov qword [rbp + 0xa68], rax
mov r9d, 0x208
lea r8, [rbp + 0x840]
lea rdx, str.LastConfig
mov rcx, qword [rbp + 0xa68]
call fcn.140011113
nop
lea rax, [rbp + 0xa90]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rbp + 0xcb4], 0
mov dword [rbp + 0xcd4], 0x208
jmp 0x1400121c4
mov eax, dword [rbp + 0xcb4]
inc eax
mov dword [rbp + 0xcb4], eax
mov dword [rbp + 0xcd4], 0x208
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0xcd4]
lea r8, [rbp + 0xa90]
mov edx, dword [rbp + 0xcb4]
mov rcx, qword [rbp + 0xa68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140012247
lea rdx, str.current
lea rcx, [rbp + 0xa90]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
je 0x140012242
lea r8, [rbp + 0x840]
lea rdx, [rbp + 0xa90]
mov rcx, qword [rbp + 0xa68]
call fcn.140011230
nop
jmp 0x140012247
jmp 0x1400121ac
mov rcx, qword [rbp + 0xa68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea r8, str.ClientUUID
lea rdx, str.SOFTWARENVIDIA_CorporationGlobal
mov rcx, 0xffffffff80000002
call fcn.140011172
nop
lea r8, str.PersistenceIdentifier
lea rdx, str.SOFTWARENVIDIA_CorporationGlobal
mov rcx, 0xffffffff80000002
call fcn.140011172
nop
lea r8, str.ChipsetMatchID
lea rdx, str.SOFTWARENVIDIA_CorporationGlobalCoProcManager
mov rcx, 0xffffffff80000002
call fcn.140011172
nop
lea rdx, str.SYSTEMMountedDevices
mov rcx, 0xffffffff80000002
call fcn.140011357
nop
lea rdx, str.SOFTWAREMicrosoftDfrgStatistics
mov rcx, 0xffffffff80000002
call fcn.140011357
nop
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBitBucketVolume
mov rcx, 0xffffffff80000001
call fcn.140011357
nop
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerMountPoints2CPCVolume
mov rcx, 0xffffffff80000001
call fcn.140011357
nop
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerMountPoints2
mov rcx, 0xffffffff80000001
call fcn.140011357
nop
lea r8, str.LastEnum
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBitBucket
mov rcx, 0xffffffff80000001
call fcn.14001100f
nop
lea r8, str.WindowsAIKHash
lea rdx, str.SYSTEMCurrentControlSetServicesTPMWMI
mov rcx, 0xffffffff80000002
call fcn.1400111ae
nop
lea r8, str.WHQLClass
lea rdx, str.SoftwareMicrosoftDirect3D
mov rcx, 0xffffffff80000001
call fcn.1400111ae
nop
lea r8, str.MSICache
lea rdx, str.SoftwareClassesInstallerDependencies
mov rcx, 0xffffffff80000001
call fcn.1400111ae
nop
mov qword [rbp + 0xcf8], 0
lea rax, [rbp + 0xcf8]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystemMultifunctionAdapter0DiskController0DiskPeripheral
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400123d6
mov rcx, 0xffffffff80000002
call fcn.14001113b
lea r8, str.HARDWAREDESCRIPTIONSystemMultifunctionAdapter0DiskController0DiskPeripheral
mov rdx, rax
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140011235
nop
jmp 0x140012499
mov rax, qword [rbp + 0xcf8]
mov qword [rbp + 0xd18], rax
lea rax, [rbp + 0xd40]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rbp + 0xf64], 0
mov dword [rbp + 0xf84], 0x208
jmp 0x140012425
mov eax, dword [rbp + 0xf64]
inc eax
mov dword [rbp + 0xf64], eax
mov dword [rbp + 0xf84], 0x208
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0xf84]
lea r8, [rbp + 0xd40]
mov edx, dword [rbp + 0xf64]
mov rcx, qword [rbp + 0xd18]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14001248b
lea r8, str.Identifier
lea rdx, [rbp + 0xd40]
mov rcx, qword [rbp + 0xd18]
call fcn.140011172
nop
jmp 0x14001240d
mov rcx, qword [rbp + 0xd18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov qword [rbp + 0xfa8], 0
lea rax, [rbp + 0xfa8]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.HARDWAREDEVICEMAPScsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400124f9
mov rcx, 0xffffffff80000002
call fcn.14001113b
lea r8, str.HARDWAREDEVICEMAPScsi
mov rdx, rax
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140011235
nop
jmp 0x140012905
mov rax, qword [rbp + 0xfa8]
mov qword [rbp + 0xfc8], rax
lea rax, [rbp + 0xff0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rbp + 0x1214], 0
mov dword [rbp + 0x1234], 0x208
jmp 0x140012548
mov eax, dword [rbp + 0x1214]
inc eax
mov dword [rbp + 0x1214], eax
mov dword [rbp + 0x1234], 0x208
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x1234]
lea r8, [rbp + 0xff0]
mov edx, dword [rbp + 0x1214]
mov rcx, qword [rbp + 0xfc8]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400128f7
mov qword [rbp + 0x1258], 0
lea rax, [rbp + 0x1258]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rbp + 0xff0]
mov rcx, qword [rbp + 0xfc8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400125f5
mov rcx, qword [rbp + 0xfc8]
call fcn.14001113b
lea r8, [rbp + 0xff0]
mov rdx, rax
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140011235
nop
jmp 0x1400128f2
mov rax, qword [rbp + 0x1258]
mov qword [rbp + 0x1278], rax
lea rax, [rbp + 0x12a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rbp + 0x14c4], 0
mov dword [rbp + 0x14e4], 0x208
jmp 0x140012644
mov eax, dword [rbp + 0x14c4]
inc eax
mov dword [rbp + 0x14c4], eax
mov dword [rbp + 0x14e4], 0x208
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x14e4]
lea r8, [rbp + 0x12a0]
mov edx, dword [rbp + 0x14c4]
mov rcx, qword [rbp + 0x1278]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400128e4
mov qword [rbp + 0x1508], 0
lea rax, [rbp + 0x1508]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rbp + 0x12a0]
mov rcx, qword [rbp + 0x1278]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400126f1
mov rcx, qword [rbp + 0x1278]
call fcn.14001113b
lea r8, [rbp + 0x12a0]
mov rdx, rax
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140011235
nop
jmp 0x1400128df
mov rax, qword [rbp + 0x1508]
mov qword [rbp + 0x1528], rax
lea rax, [rbp + 0x1550]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rbp + 0x1774], 0
mov dword [rbp + 0x1794], 0x208
jmp 0x140012740
mov eax, dword [rbp + 0x1774]
inc eax
mov dword [rbp + 0x1774], eax
mov dword [rbp + 0x1794], 0x208
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x1794]
lea r8, [rbp + 0x1550]
mov edx, dword [rbp + 0x1774]
mov rcx, qword [rbp + 0x1528]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400128d1
lea rdx, str.arget
lea rcx, [rbp + 0x1550]
call fcn.140011285
test rax, rax
je 0x1400128cc
mov qword [rbp + 0x17b8], 0
lea rax, [rbp + 0x17b8]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rbp + 0x1550]
mov rcx, qword [rbp + 0x1528]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140012809
mov rcx, qword [rbp + 0x1528]
call fcn.14001113b
lea r8, [rbp + 0x1550]
mov rdx, rax
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140011235
nop
jmp 0x1400128cc
mov rax, qword [rbp + 0x17b8]
mov qword [rbp + 0x17d8], rax
lea rax, [rbp + 0x1800]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rbp + 0x1a24], 0
mov dword [rbp + 0x1a44], 0x208
jmp 0x140012858
mov eax, dword [rbp + 0x1a24]
inc eax
mov dword [rbp + 0x1a24], eax
mov dword [rbp + 0x1a44], 0x208
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x1a44]
lea r8, [rbp + 0x1800]
mov edx, dword [rbp + 0x1a24]
mov rcx, qword [rbp + 0x17d8]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400128be
lea r8, str.Identifier
lea rdx, [rbp + 0x1800]
mov rcx, qword [rbp + 0x17d8]
call fcn.140011172
nop
jmp 0x140012840
mov rcx, qword [rbp + 0x17d8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x140012728
mov rcx, qword [rbp + 0x1528]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x14001262c
mov rcx, qword [rbp + 0x1278]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x140012530
mov rcx, qword [rbp + 0xfc8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea r8, str.RandomSeed
lea rdx, str.SYSTEMCurrentControlSetServicesTPMODUID
mov rcx, 0xffffffff80000002
call fcn.1400111ae
nop
lea r8, str.MachineGuid
lea rdx, str.SOFTWAREMicrosoftCryptography
mov rcx, 0xffffffff80000002
call fcn.140011172
nop
lea r8, str.HwProfileGuid
lea rdx, str.SYSTEMCurrentControlSetControlIDConfigDBHardware_Profiles0001
mov rcx, 0xffffffff80000002
call fcn.140011172
nop
lea r8, str.AccountDomainSid
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
mov rcx, 0xffffffff80000002
call fcn.140011172
nop
lea r8, str.PingID
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
mov rcx, 0xffffffff80000002
call fcn.140011172
nop
lea r8, str.SusClientId
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
mov rcx, 0xffffffff80000002
call fcn.140011172
nop
lea r8, str.SusClientIdValidation
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
mov rcx, 0xffffffff80000002
call fcn.1400111ae
nop
lea r8, str.Dhcpv6DUID
lea rdx, str.SYSTEMCurrentControlSetServicesTcpip6Parameters
mov rcx, 0xffffffff80000002
call fcn.1400111ae
nop
lea r8, str.ComputerHardwareId
lea rdx, str.SYSTEMCurrentControlSetControlSystemInformation
mov rcx, 0xffffffff80000002
call fcn.140011172
nop
lea r8, str.ComputerHardwareIds
lea rdx, str.SYSTEMCurrentControlSetControlSystemInformation
mov rcx, 0xffffffff80000002
call fcn.1400112bc
nop
lea r8, str.IE_Installed_Date
lea rdx, str.SOFTWAREMicrosoftInternet_ExplorerMigration
mov rcx, 0xffffffff80000002
call fcn.1400111ae
nop
lea r8, str.MachineId
lea rdx, str.SOFTWAREMicrosoftSQMClient
mov rcx, 0xffffffff80000002
call fcn.140011172
nop
lea r8, str.WinSqmFirstSessionStartTime
lea rdx, str.SOFTWAREMicrosoftSQMClient
mov rcx, 0xffffffff80000002
call fcn.140011046
nop
lea r8, str.InstallTime
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call fcn.140011046
nop
lea r8, str.InstallDate
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call fcn.140011046
nop
lea r8, str.DigitalProductId
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call fcn.1400111ae
nop
lea r8, str.DigitalProductId4
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call fcn.1400111ae
nop
lea r8, str.BuildGUID
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call fcn.140011172
nop
lea r8, str.ProductId
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call fcn.140011172
nop
lea r8, str.BuildLab
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call fcn.140011172
nop
lea r8, str.BuildLabEx
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call fcn.140011172
nop
lea r8, str._DriverProviderInfo
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000
mov rcx, 0xffffffff80000002
call fcn.140011172
nop
lea r8, str.UserModeDriverGUID
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000
mov rcx, 0xffffffff80000002
call fcn.140011172
nop
mov qword [rbp + 0x1a68], 0
lea rax, [rbp + 0x1a68]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e972_e325_11ce_bfc1_08002be10318
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140012bd2
mov rcx, 0xffffffff80000002
call fcn.14001113b
lea r8, str.SYSTEMCurrentControlSetControlClass4d36e972_e325_11ce_bfc1_08002be10318
mov rdx, rax
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140011235
nop
jmp 0x140012ce3
mov rax, qword [rbp + 0x1a68]
mov qword [rbp + 0x1a88], rax
lea rax, [rbp + 0x1ab0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rbp + 0x1cd4], 0
mov dword [rbp + 0x1cf4], 0x208
jmp 0x140012c21
mov eax, dword [rbp + 0x1cd4]
inc eax
mov dword [rbp + 0x1cd4], eax
mov dword [rbp + 0x1cf4], 0x208
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x1cf4]
lea r8, [rbp + 0x1ab0]
mov edx, dword [rbp + 0x1cd4]
mov rcx, qword [rbp + 0x1a88]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140012cd5
lea rdx, str.configuration
lea rcx, [rbp + 0x1ab0]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
je 0x140012cd0
lea rdx, str.properties
lea rcx, [rbp + 0x1ab0]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
je 0x140012cd0
lea r8, str.NetworkAddress
lea rdx, [rbp + 0x1ab0]
mov rcx, qword [rbp + 0x1a88]
call fcn.14001100f
nop
lea r8, str.NetworkInterfaceInstallTimestamp
lea rdx, [rbp + 0x1ab0]
mov rcx, qword [rbp + 0x1a88]
call fcn.140011046
nop
jmp 0x140012c09
mov rcx, qword [rbp + 0x1a88]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionDiagnosticsDiagTrackSettingsRequests
mov rcx, 0xffffffff80000002
call fcn.140011357
nop
lea r8, str.LastEventlogWrittenTime
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionDiagnosticsDiagTrackSevilleEventlogManager
mov rcx, 0xffffffff80000002
call fcn.140011046
nop
lea r8, str.ProductActivationTime
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatformActivation
mov rcx, 0xffffffff80000002
call fcn.140011046
nop
lea r8, str.BackupProductKeyDefault
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform
mov rcx, 0xffffffff80000002
call fcn.14001100f
nop
lea r8, str.actionlist
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform
mov rcx, 0xffffffff80000002
call fcn.14001100f
nop
lea r8, str.ServiceSessionId
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform
mov rcx, 0xffffffff80000002
call fcn.14001100f
nop
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist
mov rcx, 0xffffffff80000001
call fcn.140011357
nop
lea rdx, str.SoftwareHex_RaysIDAHistory
mov rcx, 0xffffffff80000001
call fcn.140011357
nop
lea rdx, str.SoftwareHex_RaysIDAHistory64
mov rcx, 0xffffffff80000001
call fcn.140011357
nop
mov qword [rbp + 0x1d18], 0
lea rax, [rbp + 0x1d18]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.HARDWAREUEFIESRT
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140012e1a
mov rcx, 0xffffffff80000002
call fcn.14001113b
lea r8, str.HARDWAREUEFIESRT
mov rdx, rax
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140011235
nop
jmp 0x140012fc0
mov rax, qword [rbp + 0x1d18]
mov qword [rbp + 0x1d38], rax
lea rax, [rbp + 0x1d60]
mov rdi, rax
xor eax, eax
mov ecx, 0x205f8
rep stosb byte [rdi], al
mov dword [rbp + 0x22374], 0
lea rax, [rbp + 0x223a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rbp + 0x225c4], 0
mov dword [rbp + 0x225e4], 0x208
jmp 0x140012e86
mov eax, dword [rbp + 0x225c4]
inc eax
mov dword [rbp + 0x225c4], eax
mov dword [rbp + 0x225e4], 0x208
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x225e4]
lea r8, [rbp + 0x223a0]
mov edx, dword [rbp + 0x225c4]
mov rcx, qword [rbp + 0x1d38]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140012f13
mov eax, dword [rbp + 0x22374]
imul rax, rax, 0x208
lea rax, [rbp + rax + 0x1d60]
mov qword [rbp + 0x24ac8], rax
mov eax, dword [rbp + 0x22374]
inc eax
mov dword [rbp + 0x22374], eax
lea rdx, [rbp + 0x223a0]
mov rcx, qword [rbp + 0x24ac8]
call qword [sym.imp.ucrtbased.dll_wcscpy]
nop
jmp 0x140012e6e
mov dword [rbp + 0x22604], 0
jmp 0x140012f2d
mov eax, dword [rbp + 0x22604]
inc eax
mov dword [rbp + 0x22604], eax
mov eax, dword [rbp + 0x22374]
cmp dword [rbp + 0x22604], eax
jae 0x140012fb2
lea rax, [rbp + 0x22630]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov eax, dword [rbp + 0x22604]
imul rax, rax, 0x208
lea rax, [rbp + rax + 0x1d60]
mov rdx, rax
lea rcx, [rbp + 0x22630]
call qword [sym.imp.ucrtbased.dll_wcscpy]
nop
lea rcx, [rbp + 0x22630]
call fcn.1400110aa
nop
mov eax, dword [rbp + 0x22604]
imul rax, rax, 0x208
lea rax, [rbp + rax + 0x1d60]
lea r8, [rbp + 0x22630]
mov rdx, rax
mov rcx, qword [rbp + 0x1d38]
call fcn.140011230
nop
jmp 0x140012f1f
mov rcx, qword [rbp + 0x1d38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rax, [rbp + 0x22860]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rbp + 0x22a90]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rbp + 0x22cc0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rbp + 0x22ef0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdx, [rbp + 0x22a90]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
nop
lea rax, [rbp + 0x22cc0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov edx, 0x1a
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
nop
lea rax, [rbp + 0x22ef0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov edx, 0x1c
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
nop
lea r8, [rbp + 0x22a90]
lea rdx, [0x140021670]
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
lea rax, [rbp + 0x23120]
mov rdi, rax
xor eax, eax
mov ecx, 0x250
rep stosb byte [rdi], al
lea rdx, [rbp + 0x23120]
lea rcx, [rbp + 0x22860]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbp + 0x23388], rax
lea rdx, [0x14002167c]
lea rcx, [rbp + 0x2314c]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
je 0x14001311d
lea rdx, [0x140021680]
lea rcx, [rbp + 0x2314c]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
je 0x14001311d
lea rax, [rbp + 0x2314c]
mov qword [rbp + 0x233a8], rax
mov r9, qword [rbp + 0x233a8]
lea r8, [rbp + 0x22a90]
lea rdx, [0x140021688]
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
lea rcx, [rbp + 0x22860]
call fcn.140011078
nop
lea rdx, [rbp + 0x23120]
mov rcx, qword [rbp + 0x23388]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400130af
mov rcx, qword [rbp + 0x23388]
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea r8, [rbp + 0x22ef0]
lea rdx, str._wsD3DSCache
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
lea rcx, [rbp + 0x22860]
call fcn.140011078
nop
lea r8, [rbp + 0x22ef0]
lea rdx, str._wsNVIDIA_CorporationGfeSDK
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
lea rcx, [rbp + 0x22860]
call fcn.140011078
nop
lea r8, [rbp + 0x22ef0]
lea rdx, str._wsMicrosoftFeeds
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
lea rcx, [rbp + 0x22860]
call fcn.140011078
nop
lea r8, [rbp + 0x22ef0]
lea rdx, str._wsMicrosoftFeeds_Cache
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
lea rcx, [rbp + 0x22860]
call fcn.140011078
nop
lea r8, [rbp + 0x22ef0]
lea rdx, str._wsMicrosoftWindowsINetCache
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
lea rcx, [rbp + 0x22860]
call fcn.140011078
nop
lea r8, [rbp + 0x22ef0]
lea rdx, str._wsMicrosoftWindowsINetCookies
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
lea rcx, [rbp + 0x22860]
call fcn.140011078
nop
lea r8, [rbp + 0x22ef0]
lea rdx, str._wsMicrosoftWindowsWebCache
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
lea rcx, [rbp + 0x22860]
call fcn.140011078
nop
lea r8, [rbp + 0x22ef0]
lea rdx, str._wsMicrosoftXboxLiveAuthStateCache.dat
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
lea rcx, [rbp + 0x22860]
call fcn.140011078
nop
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rbp + 0x233c4], eax
mov dword [rbp + 0x233e4], 0x43
mov dword [rbp + 0x23404], 0
jmp 0x1400132cd
mov eax, dword [rbp + 0x233c4]
shr eax, 1
mov dword [rbp + 0x233c4], eax
mov eax, dword [rbp + 0x23404]
inc eax
mov dword [rbp + 0x23404], eax
cmp dword [rbp + 0x233c4], 0
je 0x140013a92
mov eax, dword [rbp + 0x233c4]
and eax, 1
test eax, eax
je 0x140013a8d
mov edx, dword [rbp + 0x233e4]
lea rcx, str._n___DRIVE:__c____n_n
call fcn.140011235
nop
mov r8d, dword [rbp + 0x233e4]
lea rdx, str.._c:
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
mov edx, 0xc0000000
lea rcx, [rbp + 0x22860]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0x23428], rax
cmp qword [rbp + 0x23428], 0xffffffffffffffff
je 0x1400134c9
lea rax, [rbp + 0x23450]
mov rdi, rax
xor eax, eax
mov ecx, 0x200
rep stosb byte [rdi], al
mov dword [rbp + 0x23664], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x23664]
mov r8d, 0x200
lea rdx, [rbp + 0x23450]
mov rcx, qword [rbp + 0x23428]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400134bb
mov eax, dword [rbp + 0x23664]
cmp rax, 0x200
jne 0x1400134bb
mov dword [rbp + 0x23684], 0
jmp 0x1400133de
mov eax, dword [rbp + 0x23684]
inc eax
mov dword [rbp + 0x23684], eax
mov eax, dword [rbp + 0x23684]
cmp rax, 3
jae 0x1400134bb
mov eax, dword [rbp + 0x23684]
imul rax, rax, 0x10
lea rcx, section..data
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x236a8], rax
mov rax, qword [rbp + 0x236a8]
mov rcx, qword [rax]
call fcn.140011203
mov rcx, qword [rbp + 0x236a8]
mov ecx, dword [rcx + 8]
lea rcx, [rbp + rcx + 0x23450]
mov r8, rax
mov rax, qword [rbp + 0x236a8]
mov rdx, qword [rax]
call fcn.1400111c2
test eax, eax
jne 0x1400134b6
call qword [sym.imp.ucrtbased.dll_rand]
shl eax, 0x10
mov dword [rbp + 0x24ac4], eax
call qword [sym.imp.ucrtbased.dll_rand]
mov ecx, dword [rbp + 0x24ac4]
add ecx, eax
mov eax, ecx
mov rcx, qword [rbp + 0x236a8]
mov ecx, dword [rcx + 0xc]
mov dword [rbp + rcx + 0x23450], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x23428]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x1400134b4
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x200
lea rdx, [rbp + 0x23450]
mov rcx, qword [rbp + 0x23428]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
jmp 0x1400134bb
jmp 0x1400133d0
mov rcx, qword [rbp + 0x23428]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:WindowsSystem32_restoreMachineGuid.txt
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
lea rcx, [rbp + 0x22860]
call fcn.140011078
nop
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:UsersPublicLibrariescollection.dat
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
lea rcx, [rbp + 0x22860]
call fcn.140011078
nop
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:System_Volume_InformationIndexerVolumeGuid
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
lea rcx, [rbp + 0x22860]
call fcn.140011078
nop
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:System_Volume_InformationWPSettings.dat
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
lea rcx, [rbp + 0x22860]
call fcn.140011078
nop
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:System_Volume_Information_tracking.log
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
lea rcx, [rbp + 0x22860]
call fcn.140011078
nop
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:ProgramDataMicrosoftWindowsWER
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
lea rcx, [rbp + 0x22860]
call fcn.140011078
nop
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:UsersPublicShared_Files
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
lea rcx, [rbp + 0x22860]
call fcn.140011078
nop
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:WindowsINF_setupapi.dev.log
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
lea rcx, [rbp + 0x22860]
call fcn.140011078
nop
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:WindowsINF_setupapi.setup.log
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
lea rcx, [rbp + 0x22860]
call fcn.140011078
nop
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:UsersPublicLibraries
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
lea rcx, [rbp + 0x22860]
call fcn.140011078
nop
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:MSOCache
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
lea rcx, [rbp + 0x22860]
call fcn.140011078
nop
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:ProgramData_ntuser.pol
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
lea rcx, [rbp + 0x22860]
call fcn.140011078
nop
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:UsersDefaultNTUSER.DAT
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
lea rcx, [rbp + 0x22860]
call fcn.140011078
nop
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:Recovery_ntuser.sys
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
lea rcx, [rbp + 0x22860]
call fcn.140011078
nop
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:desktop.ini
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
lea rcx, [rbp + 0x22860]
call fcn.140011078
nop
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:WindowsPrefetch
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
lea rax, [rbp + 0x236d0]
mov rdi, rax
xor eax, eax
mov ecx, 0x250
rep stosb byte [rdi], al
lea rdx, [rbp + 0x236d0]
lea rcx, [rbp + 0x22860]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbp + 0x23938], rax
lea rdx, [0x14002167c]
lea rcx, [rbp + 0x236fc]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
je 0x1400137e8
lea rdx, [0x140021680]
lea rcx, [rbp + 0x236fc]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
je 0x1400137e8
lea rax, [rbp + 0x236fc]
mov qword [rbp + 0x23958], rax
mov r9, qword [rbp + 0x23958]
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:WindowsPrefetch_ws
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
lea rcx, [rbp + 0x22860]
call fcn.140011078
nop
lea rdx, [rbp + 0x236d0]
mov rcx, qword [rbp + 0x23938]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14001377a
mov rcx, qword [rbp + 0x23938]
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov r8d, dword [rbp + 0x233e4]
lea rdx, [0x140021e80]
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
lea rax, [rbp + 0x23980]
mov rdi, rax
xor eax, eax
mov ecx, 0x250
rep stosb byte [rdi], al
lea rdx, [rbp + 0x23980]
lea rcx, [rbp + 0x22860]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbp + 0x23be8], rax
lea rdx, [0x14002167c]
lea rcx, [rbp + 0x239ac]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
je 0x1400139e9
lea rdx, [0x140021680]
lea rcx, [rbp + 0x239ac]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
je 0x1400139e9
lea rax, [rbp + 0x239ac]
mov qword [rbp + 0x23c08], rax
mov eax, dword [rbp + 0x23980]
and eax, 0x10
test eax, eax
je 0x1400139e9
lea rax, [rbp + 0x23c30]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov rdx, qword [rbp + 0x23c08]
lea rcx, [rbp + 0x23c30]
call qword [sym.imp.ucrtbased.dll_wcscpy]
nop
lea r9, [rbp + 0x23c30]
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:Users_ws
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
lea rax, [rbp + 0x23e60]
mov rdi, rax
xor eax, eax
mov ecx, 0x250
rep stosb byte [rdi], al
lea rdx, [rbp + 0x23e60]
lea rcx, [rbp + 0x22860]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbp + 0x240c8], rax
lea rdx, [0x14002167c]
lea rcx, [rbp + 0x23e8c]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
je 0x1400139bf
lea rdx, [0x140021680]
lea rcx, [rbp + 0x23e8c]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
je 0x1400139bf
lea rax, [rbp + 0x23e8c]
mov qword [rbp + 0x240e8], rax
lea rdx, str.ntuser
mov rcx, qword [rbp + 0x240e8]
call qword [sym.imp.SHLWAPI.dll_StrStrW]
test rax, rax
je 0x1400139bf
mov rax, qword [rbp + 0x240e8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x23c30]
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:Users_ws_ws
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
lea rcx, [rbp + 0x22860]
call fcn.140011078
nop
lea rdx, [rbp + 0x23e60]
mov rcx, qword [rbp + 0x240c8]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14001392c
mov rcx, qword [rbp + 0x240c8]
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea rdx, [rbp + 0x23980]
mov rcx, qword [rbp + 0x23be8]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14001385c
mov rcx, qword [rbp + 0x23be8]
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov r8d, dword [rbp + 0x233e4]
lea rdx, str._c:Users
lea rcx, [rbp + 0x22860]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
lea rdx, str.desktop.ini
lea rcx, [rbp + 0x22860]
call fcn.1400112e9
nop
lea rax, [rbp + 0x24110]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
mov r8d, dword [rbp + 0x233e4]
lea rdx, str.fsutil_usn_deletejournal__d__c:
lea rcx, [rbp + 0x24110]
call fcn.140011488
nop
lea rcx, [rbp + 0x24110]
call qword [sym.imp.ucrtbased.dll_system]
nop
mov eax, dword [rbp + 0x233e4]
inc eax
mov dword [rbp + 0x233e4], eax
jmp 0x1400132b1
lea rcx, str.vssadmin_delete_shadows__All__Quiet
call qword [sym.imp.ucrtbased.dll_system]
nop
xor edx, edx
mov ecx, 2
call fcn.14001123f
mov qword [rbp + 0x24238], rax
cmp qword [rbp + 0x24238], 0
je 0x140013b8c
lea rax, [rbp + 0x24260]
mov rdi, rax
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
mov dword [rbp + 0x24260], 0x238
lea rdx, [rbp + 0x24260]
mov rcx, qword [rbp + 0x24238]
call fcn.1400112fd
test eax, eax
je 0x140013b7e
lea rdx, str.WmiPrvSE.exe
lea rcx, [rbp + 0x2428c]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x140013b63
mov r8d, dword [rbp + 0x24268]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x244b8], rax
cmp qword [rbp + 0x244b8], 0xffffffffffffffff
je 0x140013b61
lea rcx, str.Killed_Winmgmt_n
call fcn.140011235
nop
xor edx, edx
mov rcx, qword [rbp + 0x244b8]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
mov rcx, qword [rbp + 0x244b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x140013b7e
lea rdx, [rbp + 0x24260]
mov rcx, qword [rbp + 0x24238]
call fcn.140011460
test eax, eax
jne 0x140013af9
mov rcx, qword [rbp + 0x24238]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, str.net_stop_winmgmt__Y
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
nop
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001fa60]
call fcn.14001142e
mov rax, rdi
mov rcx, qword [rbp + 0x24ad0]
xor rcx, rbp
call fcn.140011253
lea rsp, [rbp + 0x24ae8]
pop rdi
pop rbp
ret