Function at 0x100008d20
Capabilities:
Delete registry key
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x318
xor eax, eax
xor ebx, ebx
mov r13, rcx
mov qword [r11 - 0x248], rax
mov qword [r11 - 0x240], rax
mov qword [r11 - 0x238], rax
mov qword [r11 - 0x230], rax
mov qword [r11 - 0x228], rax
mov qword [r11 - 0x220], rax
lea rax, [r11 - 0x248]
lea ecx, [rbx + 2]
xor edx, edx
mov qword [rsp + 0x28], rax
mov r9d, 0x10000
mov r8d, 0x200000
mov r15d, ebx
mov dword [r11 + 0x20], ebx
mov dword [rsp + 0x110], 0x30
mov qword [rsp + 0x20], rbx
call sub.ntdll.dll_RtlCreateHeap
xor edx, edx
mov rcx, rax
mov r8d, 0x3e80
mov qword [0x100018d28], rax
call sub.ntdll.dll_RtlAllocateHeap
lea r9, [0x1000017d8]
lea r8, [0x1000017cc]
mov qword [0x1000151d0], rax
lea rax, [0x1000017a8]
lea rdx, [0x100001798]
lea rcx, [0x100001788]
mov qword [rsp + 0x20], rax
call fcn.100007c40
mov r11, qword [r13 + 0x18]
mov r9, qword [r11 + 0x20]
add r11, 0x20
cmp r9, r11
je 0x100008e3d
lea r8, [r9 - 0x10]
test r8, r8
je 0x100008e3d
mov rcx, qword [r8 + 0x30]
mov edx, ebx
cmp dword [r8 + 0x40], ebx
jbe 0x100008e35
nop word [rax + rax]
mov eax, dword [rcx]
add edx, 0x1000
add rcx, 0x1000
cmp edx, dword [r8 + 0x40]
jb 0x100008e20
mov r9, qword [r9]
cmp r9, r11
jne 0x100008e00
call fcn.100008330
lea r9, [rsp + 0x368]
lea r8, section..data
lea rdx, [0x100001780]
lea rcx, [0x100001740]
mov dword [rsp + 0x368], 4
call fcn.100007950
mov ecx, dword [section..data]
mov edx, 0xa
test eax, eax
lea r9, [rsp + 0x368]
lea r8, [0x1000151ec]
cmove ecx, edx
lea rdx, [0x100001730]
mov dword [rsp + 0x368], 4
mov dword [section..data], ecx
lea rcx, [0x100001740]
call fcn.100007950
lea r9, [rsp + 0x368]
lea r8, [0x1000151f0]
lea rdx, [0x100001718]
lea rcx, [0x100001740]
mov dword [rsp + 0x368], 4
call fcn.100007950
lea r9, [rsp + 0x368]
lea r8, [0x1000151f4]
lea rdx, [0x100001708]
lea rcx, [0x100001740]
mov dword [rsp + 0x368], 4
call fcn.100007950
mov rcx, qword [0x100018d28]
mov edx, 8
mov r8d, 0x800
call sub.ntdll.dll_RtlAllocateHeap
mov rcx, qword [0x100018d28]
mov edx, 8
mov r8d, 0x800
mov r14, rax
call sub.ntdll.dll_RtlAllocateHeap
mov rcx, qword [0x100018d28]
mov edx, 8
mov r8d, 0x800
mov qword [0x1000151c0], rax
call sub.ntdll.dll_RtlAllocateHeap
mov rcx, qword [0x100018d28]
mov edx, 8
mov r8d, 0x800
mov qword [0x1000151c8], rax
call sub.ntdll.dll_RtlAllocateHeap
mov r12d, ebx
mov qword [0x1000151d8], rax
xor edx, edx
mov r8d, 0x800
mov rcx, r14
mov ebp, 1
mov esi, 0xfffffff0
mov edi, 0x108
mov dword [rsp + 0x368], 0x800
call sub.ntdll.dll_memset
lea rcx, [0x1000016f8]
mov edx, r12d
call fcn.1000076b0
lea r9, [rsp + 0x368]
lea rcx, [0x100001740]
mov rdx, rax
mov r8, r14
call fcn.100007950
test eax, eax
je 0x100009e4d
movzx r9d, word [rsp + 0x368]
mov rcx, qword [0x1000151e0]
cmp r9d, edi
cmovg r9d, edi
lea edx, [r9 + 1]
add rdx, 0xf
and rdx, rsi
lea rax, [rcx + rdx]
cmp rax, 0x3e80
cmova rcx, rbx
cmp rdx, 0x3e8
jbe 0x10000901e
mov byte [0], bl
mov rax, qword [0x1000151d0]
lea r8, [rcx + rax]
add rcx, rdx
movsxd rdx, r9d
mov qword [0x1000151e0], rcx
mov rcx, rbx
test r9d, r9d
jle 0x100009052
nop
movzx eax, byte [r14 + rcx*2]
inc rcx
cmp rcx, rdx
mov byte [rcx + r8 - 1], al
jl 0x100009040
mov byte [rcx + r8], bl
mov rcx, qword [0x1000151d8]
lea rdx, [0x1000016f4]
call sub.ntdll.dll_sprintf
mov rdi, qword [0x1000151d8]
mov dword [rsp + 0x30], ebx
mov rcx, rdi
xor r9d, r9d
mov r8d, ebp
mov edx, 0x40000000
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
call fcn.100008a70
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1000090ab
lea rcx, [0x1000013e8]
mov rdx, rdi
call fcn.100007c40
lea rdx, [rsp + 0x300]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtFlushBuffersFile]
mov rcx, rsi
mov dword [0x100018d20], eax
call qword [sym.imp.ntdll.dll_NtClose]
xor edx, edx
mov r8d, 0x800
mov rcx, r14
mov dword [rsp + 0x368], 0x800
mov dword [0x100018d20], eax
call sub.ntdll.dll_memset
lea rcx, [0x1000016e8]
mov edx, r12d
call fcn.1000076b0
lea r9, [rsp + 0x368]
lea rcx, [0x100001740]
mov rdx, rax
mov r8, r14
call fcn.100007950
movzx r9d, word [rsp + 0x368]
mov rcx, qword [0x1000151e0]
mov esi, 0x108
lea edi, [rax + 1]
mov eax, 0xfffffff0
cmp r9d, esi
cmovg r9d, esi
lea edx, [r9 + 1]
add rdx, 0xf
and rdx, rax
lea rax, [rdx + rcx]
cmp rax, 0x3e80
cmova rcx, rbx
cmp rdx, 0x3e8
jbe 0x100009162
mov byte [0], bl
mov rax, qword [0x1000151d0]
lea r8, [rcx + rax]
add rcx, rdx
movsxd rdx, r9d
mov qword [0x1000151e0], rcx
mov rcx, rbx
test r9d, r9d
jle 0x1000091a2
nop word [rax + rax]
movzx eax, byte [r14 + rcx*2]
inc rcx
cmp rcx, rdx
mov byte [rcx + r8 - 1], al
jl 0x100009190
mov byte [rcx + r8], bl
mov rcx, qword [0x1000151c0]
lea rdx, [0x1000016f4]
call sub.ntdll.dll_sprintf
xor edx, edx
mov r8d, 0x800
mov rcx, r14
mov dword [rsp + 0x368], 0x800
call sub.ntdll.dll_memset
lea rcx, [0x1000016d8]
mov edx, r12d
call fcn.1000076b0
lea r9, [rsp + 0x368]
lea rcx, [0x100001740]
mov rdx, rax
mov r8, r14
call fcn.100007950
movzx r9d, word [rsp + 0x368]
mov rcx, qword [0x1000151e0]
add edi, eax
cmp r9d, esi
mov eax, 0xfffffff0
cmovg r9d, esi
lea edx, [r9 + 1]
add rdx, 0xf
and rdx, rax
lea rax, [rdx + rcx]
cmp rax, 0x3e80
cmova rcx, rbx
cmp rdx, 0x3e8
jbe 0x100009244
mov byte [0], bl
mov rax, qword [0x1000151d0]
lea r8, [rcx + rax]
add rcx, rdx
movsxd rdx, r9d
mov qword [0x1000151e0], rcx
mov rcx, rbx
test r9d, r9d
jle 0x100009282
nop word [rax + rax]
movzx eax, byte [r14 + rcx*2]
inc rcx
cmp rcx, rdx
mov byte [rcx + r8 - 1], al
jl 0x100009270
mov byte [rcx + r8], bl
mov rcx, qword [0x1000151c8]
lea rdx, [0x1000016f4]
call sub.ntdll.dll_sprintf
call fcn.10000a880
mov rcx, qword [r13 + 0x20]
add rcx, 0x70
cmp edi, 2
jl 0x100009d58
mov rdi, qword [0x1000151d8]
test rdi, rdi
je 0x1000092d7
cmp byte [rdi], 0x5c
jne 0x1000092d7
lea rdx, [rdi + 4]
lea rcx, [0x1000016b8]
call fcn.100007c40
mov rdi, qword [0x1000151d8]
mov rsi, qword [0x1000151c0]
test rsi, rsi
je 0x100009306
cmp byte [rsi], 0x5c
jne 0x100009306
lea rdx, [rsi + 4]
lea rcx, [0x1000016a0]
call fcn.100007c40
mov rsi, qword [0x1000151c0]
mov rdi, qword [0x1000151d8]
mov rbp, qword [0x1000151c8]
test rbp, rbp
je 0x10000933d
cmp byte [rbp], 0x5c
jne 0x10000933d
lea rdx, [rbp + 4]
lea rcx, [0x100001688]
call fcn.100007c40
mov rsi, qword [0x1000151c0]
mov rbp, qword [0x1000151c8]
mov rdi, qword [0x1000151d8]
mov rcx, qword [r13 + 0x20]
add rcx, 0x60
call fcn.1000077e0
mov r13, rax
cmp byte [rax], 0x5c
jne 0x10000937c
mov r8d, 6
mov rdx, rax
mov rcx, rdi
call sub.ntdll.dll__memicmp
test eax, eax
jne 0x100009399
mov rsi, qword [0x1000151c0]
mov rbp, qword [0x1000151c8]
mov rdi, qword [0x1000151d8]
cmp byte [r13 + 1], 0x3a
jne 0x1000093de
lea rcx, [rdi + 4]
mov r8d, 2
mov rdx, r13
call sub.ntdll.dll__memicmp
test eax, eax
je 0x1000093c9
mov eax, dword [0x1000151e8]
mov rsi, qword [0x1000151c0]
mov rbp, qword [0x1000151c8]
mov rdi, qword [0x1000151d8]
test r15d, r15d
mov r13d, 1
cmove eax, r13d
mov dword [0x1000151e8], eax
jmp 0x1000093e4
mov rsi, qword [0x1000151c0]
mov rbp, qword [0x1000151c8]
mov rdi, qword [0x1000151d8]
mov r13d, 1
test r12d, r12d
jne 0x10000951c
cmp dword [0x1000151f4], ebx
jne 0x10000951c
lea rdx, [rsp + 0xe0]
xor ecx, ecx
mov edi, ebx
mov esi, ebx
mov qword [rsp + 0xe0], 0xfffffffffd9da600
call qword [sym.imp.ntdll.dll_ZwDelayExecution]
lea rcx, [0x100001670]
mov dword [0x100018d20], eax
call fcn.100007c40
nop dword [rax + rax]
inc edi
test esi, esi
jne 0x100009470
lea rcx, [0x1000013cc]
call fcn.100007c40
lea rdx, [rsp + 0x108]
xor ecx, ecx
mov qword [rsp + 0x108], 0xffffffffff676980
call qword [sym.imp.ntdll.dll_ZwDelayExecution]
mov dword [0x100018d20], eax
call fcn.100011f30
cmp edi, 0x3c
mov esi, eax
jl 0x100009430
lea rcx, [0x100001668]
call fcn.100007c40
test esi, esi
jne 0x10000948e
lea rcx, [0x100001650]
call fcn.100007c40
jmp 0x1000094fb
call fcn.100012230
lea rcx, [0x100001668]
call fcn.100007c40
mov r12d, dword [section..data]
test r12d, r12d
jle 0x1000094fb
nop dword [rax + rax]
lea rcx, [0x100001620]
mov edx, r12d
call fcn.100007c40
lea rdx, [rsp + 0xf0]
xor ecx, ecx
mov qword [rsp + 0xf0], 0xffffffffff676980
call qword [sym.imp.ntdll.dll_ZwDelayExecution]
mov ecx, 0x3e8
mov dword [0x100018d20], eax
call fcn.1000122c0
test eax, eax
je 0x100009d1c
dec r12d
test r12d, r12d
jg 0x1000094b0
lea rcx, [0x1000015e0]
call fcn.100007c40
mov rsi, qword [0x1000151c0]
mov rbp, qword [0x1000151c8]
mov rdi, qword [0x1000151d8]
test rsi, rsi
je 0x100009553
cmp byte [rsi], bl
je 0x100009553
lea rdx, [rsp + 0x378]
mov rcx, rsi
call fcn.100012460
cmp eax, 1
jne 0x100009ce9
mov rsi, qword [0x1000151c0]
mov rbp, qword [0x1000151c8]
mov rdi, qword [0x1000151d8]
mov dword [rsp + 0x378], ebx
test rbp, rbp
je 0x1000095e4
cmp byte [rbp], bl
je 0x100009596
lea rdx, [rsp + 0x378]
mov rcx, rbp
call fcn.100012460
cmp eax, 1
jne 0x100009d28
mov rsi, qword [0x1000151c0]
mov rbp, qword [0x1000151c8]
mov rdi, qword [0x1000151d8]
test rbp, rbp
je 0x1000095e4
cmp byte [rbp], bl
je 0x1000095e4
test rdi, rdi
je 0x100009610
cmp byte [rdi], bl
je 0x1000095e4
xor r9d, r9d
mov r8d, r13d
mov rdx, rsi
mov rcx, rdi
call fcn.10000c9e0
mov dword [rsp + 0x370], eax
cmp eax, 0
jne 0x100009a1c
mov r9d, r13d
xor r8d, r8d
mov rdx, rbp
mov rcx, rdi
call fcn.10000c9e0
mov dword [rsp + 0x370], eax
jmp 0x100009617
test rdi, rdi
je 0x100009610
cmp byte [rdi], bl
je 0x100009610
test rsi, rsi
je 0x100009610
cmp byte [rsi], bl
je 0x100009610
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call fcn.10000c9e0
mov dword [rsp + 0x370], eax
jmp 0x100009617
mov eax, dword [rsp + 0x370]
test eax, eax
jne 0x100009a1c
lea rcx, [0x1000015b0]
inc r15d
call fcn.100007c40
lea rdx, [0x100001208]
lea rcx, [rsp + 0x280]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], 3
lea rax, [rsp + 0x280]
mov dword [rsp + 0x30], 3
lea r9, [rsp + 0x2b0]
lea r8, [rsp + 0x1a0]
lea rcx, [rsp + 0x78]
mov edx, 3
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x1a0], 0x30
mov qword [rsp + 0x1a8], rbx
mov dword [rsp + 0x1b8], ebx
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x1c0], rbx
mov qword [rsp + 0x1c8], rbx
call qword [sym.imp.ntdll.dll_NtCreateFile]
mov dword [0x100018d20], eax
test eax, eax
js 0x100009765
mov rcx, qword [rsp + 0x78]
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], 8
lea rax, [rsp + 0xa8]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x2b0]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0x10000
mov dword [rsp + 0xa8], 0x7d0
mov qword [rsp + 0x20], rax
mov dword [rsp + 0xac], pe_nt_image_headers64
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
mov dword [0x100018d20], eax
test eax, eax
js 0x10000975a
lea rdx, [rsp + 0xd8]
mov ecx, r13d
mov qword [rsp + 0xd8], 0xffffffffffe17b80
call qword [sym.imp.ntdll.dll_NtDelayExecution]
mov dword [0x100018d20], eax
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntdll.dll_NtClose]
lea rdx, [rsp + 0xf8]
xor ecx, ecx
mov qword [rsp + 0xf8], 0xffffffffffe17b80
call qword [sym.imp.ntdll.dll_ZwDelayExecution]
lea rdx, [0x100001208]
lea rcx, [rsp + 0x270]
mov dword [0x100018d20], eax
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], 3
lea rax, [rsp + 0x270]
mov dword [rsp + 0x30], 3
lea r9, [rsp + 0x260]
lea r8, [rsp + 0x200]
lea rcx, [rsp + 0x88]
mov edx, 3
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x200], 0x30
mov qword [rsp + 0x208], rbx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x218], ebx
mov qword [rsp + 0x210], rax
mov qword [rsp + 0x220], rbx
mov qword [rsp + 0x228], rbx
call qword [sym.imp.ntdll.dll_NtCreateFile]
mov dword [0x100018d20], eax
test eax, eax
js 0x1000098c7
mov rcx, qword [rsp + 0x88]
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], 8
lea rax, [rsp + 0x98]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x260]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0x10000
mov dword [rsp + 0x98], 0x7d0
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x9c], pe_nt_image_headers64
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
mov dword [0x100018d20], eax
test eax, eax
js 0x1000098b9
lea rdx, [rsp + 0xe8]
mov ecx, r13d
mov qword [rsp + 0xe8], 0xffffffffffe17b80
call qword [sym.imp.ntdll.dll_NtDelayExecution]
mov dword [0x100018d20], eax
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntdll.dll_NtClose]
lea rdx, [rsp + 0xc8]
xor ecx, ecx
mov qword [rsp + 0xc8], 0xffffffffffe17b80
call qword [sym.imp.ntdll.dll_ZwDelayExecution]
lea rdx, [0x100001208]
lea rcx, [rsp + 0x2a0]
mov dword [0x100018d20], eax
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], 3
lea rax, [rsp + 0x2a0]
mov dword [rsp + 0x30], 3
lea r9, [rsp + 0x2c0]
lea r8, [rsp + 0x170]
lea rcx, [rsp + 0x70]
mov edx, 3
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x170], 0x30
mov qword [rsp + 0x178], rbx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x188], ebx
mov qword [rsp + 0x180], rax
mov qword [rsp + 0x190], rbx
mov qword [rsp + 0x198], rbx
call qword [sym.imp.ntdll.dll_NtCreateFile]
mov dword [0x100018d20], eax
test eax, eax
js 0x100009cd3
mov rcx, qword [rsp + 0x70]
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], 8
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x2c0]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0x10000
mov dword [rsp + 0x68], 0x7d0
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x6c], pe_nt_image_headers64
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
mov dword [0x100018d20], eax
test eax, eax
js 0x100009a0c
lea rdx, [rsp + 0xd0]
mov ecx, r13d
mov qword [rsp + 0xd0], 0xffffffffffe17b80
call qword [sym.imp.ntdll.dll_NtDelayExecution]
mov dword [0x100018d20], eax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x100009cd3
lea rcx, [0x100001580]
mov edx, r15d
call fcn.100007c40
lea rdx, [0x100001208]
lea rcx, [rsp + 0x2f0]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], 3
lea rax, [rsp + 0x2f0]
mov dword [rsp + 0x30], 3
lea r9, [rsp + 0x2e0]
lea r8, [rsp + 0x1d0]
lea rcx, [rsp + 0x90]
mov edx, 3
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x1d0], 0x30
mov qword [rsp + 0x1d8], rbx
mov dword [rsp + 0x1e8], ebx
mov qword [rsp + 0x1e0], rax
mov qword [rsp + 0x1f0], rbx
mov qword [rsp + 0x1f8], rbx
call qword [sym.imp.ntdll.dll_NtCreateFile]
mov dword [0x100018d20], eax
test eax, eax
js 0x100009b6b
mov rcx, qword [rsp + 0x90]
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], 8
lea rax, [rsp + 0x80]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x2e0]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0x10000
mov dword [rsp + 0x80], 0x3e8
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x84], 0x1f4
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
mov dword [0x100018d20], eax
test eax, eax
js 0x100009b5d
lea rdx, [rsp + 0xb8]
mov ecx, r13d
mov qword [rsp + 0xb8], 0xffffffffffb3b4c0
call qword [sym.imp.ntdll.dll_NtDelayExecution]
mov dword [0x100018d20], eax
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtClose]
lea rdx, [rsp + 0xc0]
xor ecx, ecx
mov qword [rsp + 0xc0], 0xffffffffffe17b80
call qword [sym.imp.ntdll.dll_ZwDelayExecution]
lea rdx, [0x100001208]
lea rcx, [rsp + 0x2d0]
mov dword [0x100018d20], eax
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], 3
lea rax, [rsp + 0x2d0]
mov dword [rsp + 0x30], 3
lea r9, [rsp + 0x290]
lea r8, [rsp + 0x230]
lea rcx, [rsp + 0xb0]
mov edx, 3
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x230], 0x30
mov qword [rsp + 0x238], rbx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x248], ebx
mov qword [rsp + 0x240], rax
mov qword [rsp + 0x250], rbx
mov qword [rsp + 0x258], rbx
call qword [sym.imp.ntdll.dll_NtCreateFile]
mov dword [0x100018d20], eax
test eax, eax
js 0x100009ccd
mov rcx, qword [rsp + 0xb0]
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], 8
lea rax, [rsp + 0xa0]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x290]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0x10000
mov dword [rsp + 0xa0], 0x3e8
mov qword [rsp + 0x20], rax
mov dword [rsp + 0xa4], 0x1f4
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
mov dword [0x100018d20], eax
test eax, eax
js 0x100009cbf
lea rdx, [rsp + 0x100]
mov ecx, r13d
mov qword [rsp + 0x100], 0xffffffffffb3b4c0
call qword [sym.imp.ntdll.dll_NtDelayExecution]
mov dword [0x100018d20], eax
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ntdll.dll_NtClose]
mov dword [0x1000151e8], ebx
inc r12d
cmp r12d, 0x14
jge 0x100009d48
mov r13, qword [rsp + 0x360]
jmp 0x100008f83
cmp dword [rsp + 0x378], ebx
jle 0x100009d00
lea rcx, [0x100001550]
call fcn.100007c40
jmp 0x100009d13
mov rdx, qword [0x1000151c0]
lea rcx, [0x100001528]
call fcn.100007c40
test r15d, r15d
jne 0x100009db0
mov dword [0x1000151e8], r13d
jmp 0x100009db0
cmp dword [rsp + 0x378], ebx
jle 0x100009d3f
lea rcx, [0x1000014e8]
call fcn.100007c40
jmp 0x100009d13
mov rdx, qword [0x1000151c8]
jmp 0x100009d07
test r15d, r15d
je 0x100009db0
cmp r15d, r12d
je 0x100009e50
jmp 0x100009db0
call fcn.1000077e0
lea rcx, [0x1000014b8]
mov rdx, rax
call fcn.100007c40
mov rdx, qword [0x1000151d8]
lea rcx, [0x1000014a0]
call fcn.100007c40
mov rdx, qword [0x1000151c0]
lea rcx, [0x100001488]
call fcn.100007c40
mov rdx, qword [0x1000151c8]
lea rcx, [0x100001470]
call fcn.100007c40
test r15d, r15d
jne 0x100009db0
mov dword [0x1000151e8], ebp
lea rcx, [0x100001740]
call fcn.100007890
lea r8, [rsp + 0x140]
lea rcx, [rsp + 0x60]
mov edx, 0xf003f
mov dword [rsp + 0x140], 0x30
mov qword [rsp + 0x148], rbx
mov qword [rsp + 0x150], rax
mov dword [rsp + 0x158], 0x40
mov qword [rsp + 0x160], rbx
mov qword [rsp + 0x168], rbx
call qword [sym.imp.ntdll.dll_ZwOpenKey]
mov dword [0x100018d20], eax
test eax, eax
jns 0x100009e2c
lea rdx, [0x100001740]
lea rcx, [0x1000012c8]
mov r8d, eax
call fcn.100007c40
jmp 0x100009e4d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_ZwDeleteKey]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_ZwFlushKey]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_ZwClose]
cmp r15d, r12d
setne bl
mov ecx, ebx
call fcn.100008c20
mov r8, qword [0x1000151d0]
mov rcx, qword [0x100018d28]
xor edx, edx
call sub.ntdll.dll_RtlFreeHeap
xor edx, edx
or rcx, 0xffffffffffffffff
call sub.ntdll.dll_NtTerminateProcess
add rsp, 0x318
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret