Function at 0x14000abd0
Capabilities:
Delete registry value
Delete volume shadow copies
Enumerate files on windows
Enumerate processes
Execute command
Get common file path
Get disk information
Persist via windows service
Query or enumerate registry key
Query or enumerate registry value
Read file on windows
Set registry value
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push rbp
push r13
lea rbp, [rsp - 0x21648]
mov eax, 0x21748
call fcn.140023300
sub rsp, rax
mov rax, qword [0x140081040]
xor rax, rsp
mov qword [rbp + 0x21620], rax
lea rcx, str.color_0A
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.title_Diamorphine.cc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
lea rcx, [0x140025db0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x140025db0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtQueryKey
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r13d, r13d
lea r8, [rsp + 0x58]
lea rdx, str.SeTakeOwnershipPrivilege
mov qword [0x1400824c8], rax
xor ecx, ecx
mov qword [rsp + 0x58], r13
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x14000ac94
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.SeTakeOwnershipPrivilege
lea rcx, str.Failed_to_lookup_privilege__ws:__d_n
call fcn.14000ab70
jmp 0x14000ad42
mov rax, qword [rsp + 0x58]
mov qword [rbp - 0x74], rax
mov dword [rbp - 0x78], 1
mov dword [rbp - 0x6c], 2
mov qword [rsp + 0x48], r13
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x48]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x14000ace3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_open_current_process_token:__d_n
call fcn.14000ab70
jmp 0x14000ad42
mov rcx, qword [rsp + 0x48]
lea r8, [rbp - 0x78]
mov qword [rsp + 0x28], r13
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x14000ad1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_adjust_current_process_token_privileges:__d_n
call fcn.14000ab70
jmp 0x14000ad37
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
jne 0x14000ad58
lea rcx, str.Token_failed_to_acquire_privilege_n
call fcn.14000ab70
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.failed_to_adjust_privilege_n
call fcn.14000ab70
mov eax, 1
jmp 0x14000e0e1
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x21760], rbx
mov qword [rsp + 0x21768], rsi
mov qword [rsp + 0x21770], rdi
mov qword [rsp + 0x21740], r12
mov qword [rsp + 0x21738], r14
mov qword [rsp + 0x21730], r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x58], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetEnumDISPLAY
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14000ae24
lea rcx, [0x140081f80]
mov dword [rsp + 0x48], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x48]
mov r9d, 0x208
lea r8, [0x140081f80]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1400824c8]
lea r8, str.SYSTEMCurrentControlSetEnumDISPLAY
lea rdx, [0x140081f86]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000b126
mov r15, qword [rsp + 0x58]
lea rcx, [rbp + 0x5d0]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], r13
lea r9, [rsp + 0x74]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x5d0]
mov qword [rsp + 0x28], r13
xor edx, edx
mov rcx, r15
mov qword [rsp + 0x20], r13
mov r12d, r13d
mov dword [rsp + 0x74], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x14000b11d
nop dword [rax]
nop word [rax + rax]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x5d0]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14000af09
lea rcx, [0x140081f80]
mov dword [rsp + 0x48], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x48]
mov r9d, 0x208
lea r8, [0x140081f80]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, r15
call qword [0x1400824c8]
lea r8, [rbp + 0x5d0]
lea rdx, [0x140081f86]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000b0de
mov rsi, qword [rsp + 0x60]
lea rcx, [rbp + 0x3c0]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], r13
lea r9, [rsp + 0x78]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x3c0]
mov qword [rsp + 0x28], r13
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], r13
mov r14d, r13d
mov dword [rsp + 0x78], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x14000b0d5
nop dword [rax + rax]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x3c0]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14000afe9
lea rcx, [0x140081f80]
mov dword [rsp + 0x48], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x48]
mov r9d, 0x208
lea r8, [0x140081f80]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x1400824c8]
lea r8, [rbp + 0x3c0]
lea rdx, [0x140081f86]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000b096
mov rdi, qword [rsp + 0x50]
lea rcx, [rbp - 0x60]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], r13
lea r9, [rsp + 0x70]
mov qword [rsp + 0x30], r13
lea r8, [rbp - 0x60]
mov qword [rsp + 0x28], r13
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], r13
mov ebx, r13d
mov dword [rsp + 0x70], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x14000b08d
nop
lea rdx, str.device_parameters
lea rcx, [rbp - 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, rdi
test eax, eax
je 0x14000b07d
mov qword [rsp + 0x38], r13
lea r9, [rsp + 0x70]
mov qword [rsp + 0x30], r13
lea r8, [rbp - 0x60]
inc ebx
mov qword [rsp + 0x28], r13
mov edx, ebx
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x70], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x14000b030
jmp 0x14000b08d
lea r8, str.EDID
lea rdx, [rbp - 0x60]
call fcn.14000e7a0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], r13
lea r9, [rsp + 0x78]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x3c0]
inc r14d
mov qword [rsp + 0x28], r13
mov edx, r14d
mov qword [rsp + 0x20], r13
mov rcx, rsi
mov dword [rsp + 0x78], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x14000af60
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], r13
lea r9, [rsp + 0x74]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x5d0]
inc r12d
mov qword [rsp + 0x28], r13
mov edx, r12d
mov qword [rsp + 0x20], r13
mov rcx, r15
mov dword [rsp + 0x74], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x14000ae80
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlVideo
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14000b1b7
lea rcx, [0x140081f80]
mov dword [rsp + 0x48], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x48]
mov r9d, 0x208
lea r8, [0x140081f80]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1400824c8]
lea r8, str.SYSTEMCurrentControlSetControlVideo
lea rdx, [0x140081f86]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000b577
mov r12, qword [rsp + 0x50]
lea rcx, [rbp + 0x3c0]
call sub.VCRUNTIME140.dll_memset
xor ebx, ebx
mov dword [rsp + 0x78], 0x208
mov qword [rsp + 0x38], rbx
lea r9, [rsp + 0x78]
mov qword [rsp + 0x30], rbx
lea r8, [rbp + 0x3c0]
mov qword [rsp + 0x28], rbx
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x14000b56b
nop word [rax + rax]
xor edx, edx
lea rcx, [rbp - 0x60]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], rbx
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.HARDWAREDEVICEMAPVIDEO
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000b2b5
xor edx, edx
mov dword [rsp + 0x48], 0x208
mov r8d, 0x208
lea rcx, [0x140081f80]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x48]
mov r9d, 0x208
lea r8, [0x140081f80]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1400824c8]
lea r8, str.HARDWAREDEVICEMAPVIDEO
lea rdx, [0x140081f86]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000b52c
mov r14, qword [rsp + 0x60]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rdx, str.MaxObjectNumber
lea rax, [rsp + 0x74]
mov dword [rsp + 0x74], ebx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x70], 4
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000b2fb
mov eax, 1
jmp 0x14000b31b
mov rcx, r14
call fcn.14000e100
mov rdx, rax
lea r8, str.MaxObjectNumber
lea rcx, str.Failed_to_read:__ws_ws_n_n
call fcn.14000ab70
mov eax, ebx
test eax, eax
je 0x14000b523
xor edx, edx
lea rcx, [rbp + 0x5d0]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0x7e0]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
cmp dword [rsp + 0x74], 0
mov esi, ebx
jbe 0x14000b523
nop dword [rax + rax]
mov r8d, esi
mov dword [rsp + 0x70], 0x208
lea rdx, str.DeviceVideo_d
lea rcx, [rbp + 0x5d0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x5d0]
lea rax, [rbp + 0x7e0]
xor r8d, r8d
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000b4f9
lea rdx, [rbp + 0x3c0]
lea rcx, [rbp + 0x7e0]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
mov r15, rax
test rax, rax
je 0x14000b517
cmp word [rbp - 0x60], 0
jne 0x14000b4a4
mov rdx, rbx
movzx ecx, word [rbp + rdx + 0x3c0]
mov word [rbp + rdx - 0x60], cx
lea rdx, [rdx + 2]
test cx, cx
jne 0x14000b3e1
mov edi, ebx
lea rcx, [rbp - 0x60]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x14000b404
test rax, rax
je 0x14000b491
mov rcx, rbx
nop word [rax + rax]
lea rbx, [rbp - 0x60]
mov edx, 0x80
lea rbx, [rbx + rcx*2]
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswctype]
test eax, eax
je 0x14000b468
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdqe
mov rcx, 0xffffffffffffffff
lea r8, [0x1400810f0]
inc rcx
cmp word [r8 + rcx*2], 0
jne 0x14000b450
xor edx, edx
div rcx
movzx eax, word [r8 + rdx*2]
mov word [rbx], ax
inc edi
lea rdx, [rbp - 0x60]
mov ecx, edi
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x14000b480
cmp rcx, rax
jb 0x14000b420
xor ebx, ebx
lea r8, [rbp - 0x60]
mov rcx, r12
lea rdx, [rbp + 0x3c0]
call fcn.14000e970
lea rax, [rbp - 0x60]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x14000b4b0
add r8, r8
lea rdx, [rbp - 0x60]
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x70]
lea rdx, [rbp + 0x5d0]
mov dword [rsp + 0x28], eax
mov r9d, 1
lea rax, [rbp + 0x7e0]
xor r8d, r8d
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x14000b517
mov rcx, r14
call fcn.14000e100
mov rdx, rax
lea r8, [rbp + 0x5d0]
lea rcx, str.Failed_to_read:__ws_ws_n_n
call fcn.14000ab70
inc esi
cmp esi, dword [rsp + 0x74]
jb 0x14000b360
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], rbx
lea r9, [rsp + 0x78]
mov qword [rsp + 0x30], rbx
lea r8, [rbp + 0x3c0]
inc r13d
mov qword [rsp + 0x28], rbx
mov edx, r13d
mov qword [rsp + 0x20], rbx
mov rcx, r12
mov dword [rsp + 0x78], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x14000b210
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r13d, r13d
lea r8, str.SMBiosData
mov rcx, 0xffffffff80000002
lea rdx, str.SYSTEMCurrentControlSetServicesmssmbiosData
call fcn.14000ec90
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMHardwareConfig
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14000b622
lea rcx, [0x140081f80]
mov dword [rsp + 0x48], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x48]
mov r9d, 0x208
lea r8, [0x140081f80]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1400824c8]
lea r8, str.SYSTEMHardwareConfig
lea rdx, [0x140081f86]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000b77c
lea rcx, [rbp - 0x60]
call sub.VCRUNTIME140.dll_memset
mov rdi, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rdx, str.LastConfig
lea rax, [rbp - 0x60]
mov dword [rsp + 0x58], 0x208
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000b69a
lea rcx, [rbp - 0x60]
call fcn.14000e180
mov eax, dword [rsp + 0x58]
lea rdx, str.LastConfig
mov dword [rsp + 0x28], eax
mov r9d, 1
lea rax, [rbp - 0x60]
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x14000b6b8
mov rcx, rdi
call fcn.14000e100
mov rdx, rax
lea r8, str.LastConfig
lea rcx, str.Failed_to_read:__ws_ws_n_n
call fcn.14000ab70
xor edx, edx
lea rcx, [rbp + 0x3c0]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], r13
lea r9, [rsp + 0x74]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x3c0]
mov qword [rsp + 0x28], r13
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], r13
mov ebx, r13d
mov dword [rsp + 0x74], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x14000b773
nop word [rax + rax]
lea rdx, str.current
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, rdi
test eax, eax
jne 0x14000b763
mov qword [rsp + 0x38], r13
lea r9, [rsp + 0x74]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x3c0]
inc ebx
mov qword [rsp + 0x28], r13
mov edx, ebx
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x74], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x14000b710
jmp 0x14000b773
lea r8, [rbp - 0x60]
lea rdx, [rbp + 0x3c0]
call fcn.14000e970
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, str.ClientUUID
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWARENVIDIA_CorporationGlobal
call fcn.14000e3a0
lea r8, str.PersistenceIdentifier
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWARENVIDIA_CorporationGlobal
call fcn.14000e3a0
lea r8, str.ChipsetMatchID
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWARENVIDIA_CorporationGlobalCoProcManager
call fcn.14000e3a0
lea rdx, str.SYSTEMMountedDevices
mov rcx, 0xffffffff80000002
call fcn.14000eb90
lea rdx, str.SOFTWAREMicrosoftDfrgStatistics
mov rcx, 0xffffffff80000002
call fcn.14000eb90
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBitBucketVolume
mov rcx, 0xffffffff80000001
call fcn.14000eb90
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerMountPoints2CPCVolume
mov rcx, 0xffffffff80000001
call fcn.14000eb90
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerMountPoints2
mov rcx, 0xffffffff80000001
call fcn.14000eb90
lea r8, str.LastEnum
mov rcx, 0xffffffff80000001
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBitBucket
call fcn.14000ec90
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesTPMWMI
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000b89a
mov rcx, 0xffffffff80000002
call fcn.14000e100
mov rdx, rax
lea r8, str.SYSTEMCurrentControlSetServicesTPMWMI
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000b971
mov rsi, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rdx, str.WindowsAIKHash
mov rcx, rsi
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov dword [rsp + 0x70], r13d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14000b8ed
mov rcx, rsi
call fcn.14000e100
mov rdx, rax
lea r8, str.WindowsAIKHash
lea rcx, str.Failed_to_query_size_of:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000b968
mov ecx, dword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x14000b90d
lea rcx, str.Failed_to_allocate_buffer_for_SpoofBinary_n_n
call fcn.14000ab70
jmp 0x14000b968
mov eax, dword [rsp + 0x70]
mov ebx, r13d
test eax, eax
je 0x14000b93d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x14000b92e
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov eax, dword [rsp + 0x70]
cmp ebx, eax
jb 0x14000b918
mov dword [rsp + 0x28], eax
lea rdx, str.WindowsAIKHash
mov r9d, 3
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftDirect3D
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000b9c8
mov rcx, 0xffffffff80000001
call fcn.14000e100
mov rdx, rax
lea r8, str.SoftwareMicrosoftDirect3D
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000ba9f
mov rsi, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rdx, str.WHQLClass
mov rcx, rsi
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov dword [rsp + 0x70], r13d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14000ba1b
mov rcx, rsi
call fcn.14000e100
mov rdx, rax
lea r8, str.WHQLClass
lea rcx, str.Failed_to_query_size_of:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000ba96
mov ecx, dword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x14000ba3b
lea rcx, str.Failed_to_allocate_buffer_for_SpoofBinary_n_n
call fcn.14000ab70
jmp 0x14000ba96
mov eax, dword [rsp + 0x70]
mov ebx, r13d
test eax, eax
je 0x14000ba6b
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x14000ba5c
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov eax, dword [rsp + 0x70]
cmp ebx, eax
jb 0x14000ba46
mov dword [rsp + 0x28], eax
lea rdx, str.WHQLClass
mov r9d, 3
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareClassesInstallerDependencies
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000baf6
mov rcx, 0xffffffff80000001
call fcn.14000e100
mov rdx, rax
lea r8, str.SoftwareClassesInstallerDependencies
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000bbcd
mov rsi, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rdx, str.MSICache
mov rcx, rsi
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov dword [rsp + 0x70], r13d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14000bb49
mov rcx, rsi
call fcn.14000e100
mov rdx, rax
lea r8, str.MSICache
lea rcx, str.Failed_to_query_size_of:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000bbc4
mov ecx, dword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x14000bb69
lea rcx, str.Failed_to_allocate_buffer_for_SpoofBinary_n_n
call fcn.14000ab70
jmp 0x14000bbc4
mov eax, dword [rsp + 0x70]
mov ebx, r13d
test eax, eax
je 0x14000bb99
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x14000bb8a
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov eax, dword [rsp + 0x70]
cmp ebx, eax
jb 0x14000bb74
mov dword [rsp + 0x28], eax
lea rdx, str.MSICache
mov r9d, 3
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystemMultifunctionAdapter0DiskController0DiskPeripheral
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14000bc5e
lea rcx, [0x140081f80]
mov dword [rsp + 0x48], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x48]
mov r9d, 0x208
lea r8, [0x140081f80]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1400824c8]
lea r8, str.HARDWAREDESCRIPTIONSystemMultifunctionAdapter0DiskController0DiskPeripheral
lea rdx, [0x140081f86]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000bd71
mov rdi, qword [rsp + 0x50]
lea rcx, [rbp - 0x60]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], r13
lea r9, [rsp + 0x74]
mov qword [rsp + 0x30], r13
lea r8, [rbp - 0x60]
mov qword [rsp + 0x28], r13
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], r13
mov esi, r13d
mov dword [rsp + 0x74], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x14000bd68
nop word [rax + rax]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000bcf6
mov rcx, rdi
call fcn.14000e100
mov rdx, rax
lea r8, [rbp - 0x60]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000bd2e
mov rbx, qword [rsp + 0x60]
lea rcx, [rbp + 0x7e0]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x7e0]
mov rcx, rbx
lea rdx, str.Identifier
call fcn.14000e240
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], r13
lea r9, [rsp + 0x74]
mov qword [rsp + 0x30], r13
lea r8, [rbp - 0x60]
inc esi
mov qword [rsp + 0x28], r13
mov edx, esi
mov qword [rsp + 0x20], r13
mov rcx, rdi
mov dword [rsp + 0x74], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x14000bcb0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.HARDWAREDEVICEMAPScsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14000be02
lea rcx, [0x140081f80]
mov dword [rsp + 0x48], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x48]
mov r9d, 0x208
lea r8, [0x140081f80]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1400824c8]
lea r8, str.HARDWAREDEVICEMAPScsi
lea rdx, [0x140081f86]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000c2ae
mov rbx, qword [rsp + 0x50]
lea rcx, [rbp + 0x7e0]
mov qword [rbp - 0x78], rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], r13
lea r9, [rsp + 0x58]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x7e0]
mov qword [rsp + 0x28], r13
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], r13
mov edi, r13d
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x58], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x14000c2a5
nop word [rax + rax]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x7e0]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14000bee9
lea rcx, [0x140081f80]
mov dword [rsp + 0x48], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x48]
mov r9d, 0x208
lea r8, [0x140081f80]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rbx
call qword [0x1400824c8]
lea r8, [rbp + 0x7e0]
lea rdx, [0x140081f86]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000c264
mov r12, qword [rsp + 0x60]
lea rcx, [rbp + 0x5d0]
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [rsp + 0x70], 0x208
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x5d0]
mov qword [rsp + 0x28], rax
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x14000c258
xor ebx, ebx
nop dword [rax]
lea rax, [rbp - 0x80]
mov qword [rbp - 0x80], rbx
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x5d0]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14000bfc7
lea rcx, [0x140081f80]
mov dword [rsp + 0x74], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x74]
mov r9d, 0x208
lea r8, [0x140081f80]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, r12
call qword [0x1400824c8]
lea r8, [rbp + 0x5d0]
lea rdx, [0x140081f86]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000c211
mov r14, qword [rbp - 0x80]
lea rcx, [rbp - 0x60]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], rbx
lea r9, [rsp + 0x78]
mov qword [rsp + 0x30], rbx
lea r8, [rbp - 0x60]
mov qword [rsp + 0x28], rbx
xor edx, edx
mov rcx, r14
mov qword [rsp + 0x20], rbx
mov r15d, ebx
mov dword [rsp + 0x78], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x14000c208
nop
lea rdx, str.arget
lea rcx, [rbp - 0x60]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x14000c1cc
lea rax, [rsp + 0x68]
mov qword [rsp + 0x68], rbx
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp - 0x60]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14000c0ad
lea rcx, [0x140081f80]
mov dword [rsp + 0x74], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x74]
mov r9d, 0x208
lea r8, [0x140081f80]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, r14
call qword [0x1400824c8]
lea r8, [rbp - 0x60]
lea rdx, [0x140081f86]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000c1cc
mov rdi, qword [rsp + 0x68]
lea rcx, [rbp + 0x3c0]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], rbx
lea r9, [rsp + 0x74]
mov qword [rsp + 0x30], rbx
lea r8, [rbp + 0x3c0]
mov qword [rsp + 0x28], rbx
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rbx
mov esi, ebx
mov dword [rsp + 0x74], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x14000c1c3
nop dword [rax + rax]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], rbx
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x3c0]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000c14c
mov rcx, rdi
call fcn.14000e100
mov rdx, rax
lea r8, [rbp + 0x3c0]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000c186
mov rbx, qword [rsp + 0x40]
lea rcx, [rbp + 0x1020]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x1020]
mov rcx, rbx
lea rdx, str.Identifier
call fcn.14000e240
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov qword [rsp + 0x38], rbx
lea r9, [rsp + 0x74]
mov qword [rsp + 0x30], rbx
lea r8, [rbp + 0x3c0]
inc esi
mov qword [rsp + 0x28], rbx
mov edx, esi
mov qword [rsp + 0x20], rbx
mov rcx, rdi
mov dword [rsp + 0x74], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x14000c100
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], rbx
lea r9, [rsp + 0x78]
mov qword [rsp + 0x30], rbx
lea r8, [rbp - 0x60]
inc r15d
mov qword [rsp + 0x28], rbx
mov edx, r15d
mov qword [rsp + 0x20], rbx
mov rcx, r14
mov dword [rsp + 0x78], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x14000c010
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], rbx
lea r9, [rsp + 0x70]
mov qword [rsp + 0x30], rbx
lea r8, [rbp + 0x5d0]
inc r13d
mov qword [rsp + 0x28], rbx
mov edx, r13d
mov qword [rsp + 0x20], rbx
mov rcx, r12
mov dword [rsp + 0x70], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x14000bf40
mov rbx, qword [rbp - 0x78]
mov edi, dword [rsp + 0x48]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r13d, r13d
mov qword [rsp + 0x38], r13
lea r9, [rsp + 0x58]
inc edi
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
lea r8, [rbp + 0x7e0]
mov edx, edi
mov qword [rsp + 0x20], r13
mov rcx, rbx
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x58], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x14000be60
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesTPMODUID
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000c305
mov rcx, 0xffffffff80000002
call fcn.14000e100
mov rdx, rax
lea r8, str.SYSTEMCurrentControlSetServicesTPMODUID
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000c3dc
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rdx, str.RandomSeed
mov rcx, rsi
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov dword [rsp + 0x70], r13d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14000c358
mov rcx, rsi
call fcn.14000e100
mov rdx, rax
lea r8, str.RandomSeed
lea rcx, str.Failed_to_query_size_of:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000c3d3
mov ecx, dword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x14000c378
lea rcx, str.Failed_to_allocate_buffer_for_SpoofBinary_n_n
call fcn.14000ab70
jmp 0x14000c3d3
mov eax, dword [rsp + 0x70]
mov ebx, r13d
test eax, eax
je 0x14000c3a8
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x14000c399
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov eax, dword [rsp + 0x70]
cmp ebx, eax
jb 0x14000c383
mov dword [rsp + 0x28], eax
lea rdx, str.RandomSeed
mov r9d, 3
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftCryptography
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000c430
mov rcx, 0xffffffff80000002
call fcn.14000e100
mov rdx, rax
lea r8, str.SOFTWAREMicrosoftCryptography
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000c468
mov rbx, qword [rsp + 0x40]
lea rcx, [rbp + 0x1020]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x1020]
mov rcx, rbx
lea rdx, str.MachineGuid
call fcn.14000e240
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlIDConfigDBHardware_Profiles0001
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000c4bc
mov rcx, 0xffffffff80000002
call fcn.14000e100
mov rdx, rax
lea r8, str.SYSTEMCurrentControlSetControlIDConfigDBHardware_Profiles0001
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000c4f4
mov rbx, qword [rsp + 0x40]
lea rcx, [rbp + 0x1020]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x1020]
mov rcx, rbx
lea rdx, str.HwProfileGuid
call fcn.14000e240
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000c548
mov rcx, 0xffffffff80000002
call fcn.14000e100
mov rdx, rax
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000c580
mov rbx, qword [rsp + 0x40]
lea rcx, [rbp + 0x1020]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x1020]
mov rcx, rbx
lea rdx, str.AccountDomainSid
call fcn.14000e240
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000c5d4
mov rcx, 0xffffffff80000002
call fcn.14000e100
mov rdx, rax
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000c60c
mov rbx, qword [rsp + 0x40]
lea rcx, [rbp + 0x1020]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x1020]
mov rcx, rbx
lea rdx, str.PingID
call fcn.14000e240
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000c660
mov rcx, 0xffffffff80000002
call fcn.14000e100
mov rdx, rax
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000c698
mov rbx, qword [rsp + 0x40]
lea rcx, [rbp + 0x1020]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x1020]
mov rcx, rbx
lea rdx, str.SusClientId
call fcn.14000e240
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000c6ef
mov rcx, 0xffffffff80000002
call fcn.14000e100
mov rdx, rax
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000c7c9
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rdx, str.SusClientIdValidation
mov rcx, rsi
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov dword [rsp + 0x70], r13d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14000c742
mov rcx, rsi
call fcn.14000e100
mov rdx, rax
lea r8, str.SusClientIdValidation
lea rcx, str.Failed_to_query_size_of:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000c7c0
mov ecx, dword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x14000c762
lea rcx, str.Failed_to_allocate_buffer_for_SpoofBinary_n_n
call fcn.14000ab70
jmp 0x14000c7c0
mov eax, dword [rsp + 0x70]
mov ebx, r13d
test eax, eax
je 0x14000c795
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x14000c786
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov eax, dword [rsp + 0x70]
cmp ebx, eax
jb 0x14000c770
mov dword [rsp + 0x28], eax
lea rdx, str.SusClientIdValidation
mov r9d, 3
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesTcpip6Parameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000c820
mov rcx, 0xffffffff80000002
call fcn.14000e100
mov rdx, rax
lea r8, str.SYSTEMCurrentControlSetServicesTcpip6Parameters
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000c8f9
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rdx, str.Dhcpv6DUID
mov rcx, rsi
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov dword [rsp + 0x70], r13d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14000c873
mov rcx, rsi
call fcn.14000e100
mov rdx, rax
lea r8, str.Dhcpv6DUID
lea rcx, str.Failed_to_query_size_of:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000c8f0
mov ecx, dword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x14000c893
lea rcx, str.Failed_to_allocate_buffer_for_SpoofBinary_n_n
call fcn.14000ab70
jmp 0x14000c8f0
mov eax, dword [rsp + 0x70]
mov ebx, r13d
test eax, eax
je 0x14000c8c5
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x14000c8b6
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov eax, dword [rsp + 0x70]
cmp ebx, eax
jb 0x14000c8a0
mov dword [rsp + 0x28], eax
lea rdx, str.Dhcpv6DUID
mov r9d, 3
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlSystemInformation
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000c94d
mov rcx, 0xffffffff80000002
call fcn.14000e100
mov rdx, rax
lea r8, str.SYSTEMCurrentControlSetControlSystemInformation
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000c985
mov rbx, qword [rsp + 0x40]
lea rcx, [rbp + 0x1020]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x1020]
mov rcx, rbx
lea rdx, str.ComputerHardwareId
call fcn.14000e240
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.14000e490
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftInternet_ExplorerMigration
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000c9e1
mov rcx, 0xffffffff80000002
call fcn.14000e100
mov rdx, rax
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerMigration
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000cab9
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rdx, str.IE_Installed_Date
mov rcx, rsi
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov dword [rsp + 0x70], r13d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14000ca34
mov rcx, rsi
call fcn.14000e100
mov rdx, rax
lea r8, str.IE_Installed_Date
lea rcx, str.Failed_to_query_size_of:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000cab0
mov ecx, dword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x14000ca54
lea rcx, str.Failed_to_allocate_buffer_for_SpoofBinary_n_n
call fcn.14000ab70
jmp 0x14000cab0
mov eax, dword [rsp + 0x70]
mov ebx, r13d
test eax, eax
je 0x14000ca85
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x14000ca76
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov eax, dword [rsp + 0x70]
cmp ebx, eax
jb 0x14000ca60
mov dword [rsp + 0x28], eax
lea rdx, str.IE_Installed_Date
mov r9d, 3
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftSQMClient
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000cb0d
mov rcx, 0xffffffff80000002
call fcn.14000e100
mov rdx, rax
lea r8, str.SOFTWAREMicrosoftSQMClient
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000cb45
mov rbx, qword [rsp + 0x40]
lea rcx, [rbp + 0x1020]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x1020]
mov rcx, rbx
lea rdx, str.MachineId
call fcn.14000e240
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, str.WinSqmFirstSessionStartTime
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftSQMClient
call fcn.14000e6a0
lea r8, str.InstallTime
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
call fcn.14000e6a0
lea r8, str.InstallDate
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
call fcn.14000e6a0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000cbea
mov rcx, 0xffffffff80000002
call fcn.14000e100
mov rdx, rax
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000ccc1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rdx, str.DigitalProductId
mov rcx, rsi
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov dword [rsp + 0x70], r13d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14000cc3d
mov rcx, rsi
call fcn.14000e100
mov rdx, rax
lea r8, str.DigitalProductId
lea rcx, str.Failed_to_query_size_of:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000ccb8
mov ecx, dword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x14000cc5d
lea rcx, str.Failed_to_allocate_buffer_for_SpoofBinary_n_n
call fcn.14000ab70
jmp 0x14000ccb8
mov eax, dword [rsp + 0x70]
mov ebx, r13d
test eax, eax
je 0x14000cc8d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x14000cc7e
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov eax, dword [rsp + 0x70]
cmp ebx, eax
jb 0x14000cc68
mov dword [rsp + 0x28], eax
lea rdx, str.DigitalProductId
mov r9d, 3
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000cd18
mov rcx, 0xffffffff80000002
call fcn.14000e100
mov rdx, rax
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000cdef
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rdx, str.DigitalProductId4
mov rcx, rsi
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov dword [rsp + 0x70], r13d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14000cd6b
mov rcx, rsi
call fcn.14000e100
mov rdx, rax
lea r8, str.DigitalProductId4
lea rcx, str.Failed_to_query_size_of:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000cde6
mov ecx, dword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x14000cd8b
lea rcx, str.Failed_to_allocate_buffer_for_SpoofBinary_n_n
call fcn.14000ab70
jmp 0x14000cde6
mov eax, dword [rsp + 0x70]
mov ebx, r13d
test eax, eax
je 0x14000cdbb
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x14000cdac
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov eax, dword [rsp + 0x70]
cmp ebx, eax
jb 0x14000cd96
mov dword [rsp + 0x28], eax
lea rdx, str.DigitalProductId4
mov r9d, 3
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000ce43
mov rcx, 0xffffffff80000002
call fcn.14000e100
mov rdx, rax
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000ce7b
mov rbx, qword [rsp + 0x40]
lea rcx, [rbp + 0x1020]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x1020]
mov rcx, rbx
lea rdx, str.BuildGUID
call fcn.14000e240
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000cecf
mov rcx, 0xffffffff80000002
call fcn.14000e100
mov rdx, rax
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000cf07
mov rbx, qword [rsp + 0x40]
lea rcx, [rbp + 0x1020]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x1020]
mov rcx, rbx
lea rdx, str.ProductId
call fcn.14000e240
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000cf5b
mov rcx, 0xffffffff80000002
call fcn.14000e100
mov rdx, rax
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000cf93
mov rbx, qword [rsp + 0x40]
lea rcx, [rbp + 0x1020]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x1020]
mov rcx, rbx
lea rdx, str.BuildLab
call fcn.14000e240
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000cfe7
mov rcx, 0xffffffff80000002
call fcn.14000e100
mov rdx, rax
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000d01f
mov rbx, qword [rsp + 0x40]
lea rcx, [rbp + 0x1020]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x1020]
mov rcx, rbx
lea rdx, str.BuildLabEx
call fcn.14000e240
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000d073
mov rcx, 0xffffffff80000002
call fcn.14000e100
mov rdx, rax
lea r8, str.SYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000d0ab
mov rbx, qword [rsp + 0x40]
lea rcx, [rbp + 0x1020]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x1020]
mov rcx, rbx
lea rdx, str._DriverProviderInfo
call fcn.14000e240
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000d0ff
mov rcx, 0xffffffff80000002
call fcn.14000e100
mov rdx, rax
lea r8, str.SYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000d137
mov rbx, qword [rsp + 0x40]
lea rcx, [rbp + 0x1020]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x1020]
mov rcx, rbx
lea rdx, str.UserModeDriverGUID
call fcn.14000e240
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e972_e325_11ce_bfc1_08002be10318
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14000d1c8
lea rcx, [0x140081f80]
mov dword [rsp + 0x48], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x48]
mov r9d, 0x208
lea r8, [0x140081f80]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1400824c8]
lea r8, str.SYSTEMCurrentControlSetControlClass4d36e972_e325_11ce_bfc1_08002be10318
lea rdx, [0x140081f86]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000d386
mov rdi, qword [rsp + 0x40]
lea rcx, [rbp - 0x60]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], r13
lea r9, [rsp + 0x58]
mov qword [rsp + 0x30], r13
lea r8, [rbp - 0x60]
mov qword [rsp + 0x28], r13
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], r13
mov esi, r13d
mov dword [rsp + 0x58], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x14000d37d
lea rdx, str.configuration
lea rcx, [rbp - 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14000d343
lea rdx, str.properties
lea rcx, [rbp - 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14000d343
lea r8, str.NetworkAddress
mov rcx, rdi
lea rdx, [rbp - 0x60]
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
cmp eax, 2
je 0x14000d2b3
mov rcx, rdi
test eax, eax
jne 0x14000d294
call fcn.14000e100
mov rdx, rax
mov dword [rsp + 0x28], 0xc4
lea r9, str.NetworkAddress
mov dword [rsp + 0x20], 0xc0
lea r8, [rbp - 0x60]
lea rcx, str._ws_ws_ws_n_c_c_deleted_n_n
call fcn.14000ab70
jmp 0x14000d2b3
call fcn.14000e100
mov rdx, rax
lea r9, str.NetworkAddress
lea r8, [rbp - 0x60]
lea rcx, str.Failed_to_delete_value:__ws_ws_ws_n_n
call fcn.14000ab70
lea rax, [rsp + 0x68]
mov qword [rsp + 0x68], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000d2f9
mov rcx, rdi
call fcn.14000e100
mov rdx, rax
lea r8, [rbp - 0x60]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000d343
mov rbx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rbp - 0x80], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x28], 8
lea rdx, str.NetworkInterfaceInstallTimestamp
mov dword [rbp - 0x7c], eax
mov r9d, 0xb
lea rax, [rbp - 0x80]
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], r13
lea r9, [rsp + 0x58]
mov qword [rsp + 0x30], r13
lea r8, [rbp - 0x60]
inc esi
mov qword [rsp + 0x28], r13
mov edx, esi
mov qword [rsp + 0x20], r13
mov rcx, rdi
mov dword [rsp + 0x58], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x14000d211
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionDiagnosticsDiagTrackSettingsRequests
mov rcx, 0xffffffff80000002
call fcn.14000eb90
lea r8, str.LastEventlogWrittenTime
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionDiagnosticsDiagTrackSevilleEventlogManager
call fcn.14000e6a0
lea r8, str.ProductActivationTime
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatformActivation
call fcn.14000e6a0
lea r8, str.BackupProductKeyDefault
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform
call fcn.14000ec90
lea r8, str.actionlist
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform
call fcn.14000ec90
lea r8, str.ServiceSessionId
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform
call fcn.14000ec90
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist
mov rcx, 0xffffffff80000001
call fcn.14000eb90
lea rdx, str.SoftwareHex_RaysIDAHistory
mov rcx, 0xffffffff80000001
call fcn.14000eb90
lea rdx, str.SoftwareHex_RaysIDAHistory64
mov rcx, 0xffffffff80000001
call fcn.14000eb90
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.HARDWAREUEFIESRT
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor edx, edx
test eax, eax
je 0x14000d4e8
mov r8d, 0x208
mov dword [rsp + 0x48], 0x208
lea rcx, [0x140081f80]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x48]
mov r9d, 0x208
lea r8, [0x140081f80]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1400824c8]
lea r8, str.HARDWAREUEFIESRT
lea rdx, [0x140081f86]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000d6ef
mov r15, qword [rsp + 0x40]
lea rcx, [rbp + 0x1020]
mov r8d, 0x205f8
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0x7e0]
mov r8d, 0x208
mov ebx, r13d
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], r13
lea r9, [rsp + 0x58]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x7e0]
mov qword [rsp + 0x28], r13
xor edx, edx
mov rcx, r15
mov qword [rsp + 0x20], r13
mov edi, r13d
mov dword [rsp + 0x58], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x14000d5ca
mov eax, ebx
lea r8, [rbp + 0x1020]
imul rcx, rax, 0x208
inc ebx
lea rax, [rbp + 0x7e0]
add r8, rcx
lea rdx, [rbp + 0x7e0]
sub r8, rax
nop word [rax + rax]
movzx eax, word [rdx]
mov word [rdx + r8], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x14000d580
mov qword [rsp + 0x38], r13
lea r9, [rsp + 0x58]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x7e0]
inc edi
mov qword [rsp + 0x28], r13
mov edx, edi
mov qword [rsp + 0x20], r13
mov rcx, r15
mov dword [rsp + 0x58], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x14000d550
test ebx, ebx
je 0x14000d6e6
lea rsi, [rbp - 0x60]
mov r12d, ebx
lea rax, [rbp + 0x1020]
sub rsi, rax
lea r14, [rbp + 0x1020]
nop word [rax + rax]
xor edx, edx
lea rcx, [rbp - 0x60]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov rcx, r14
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rcx]
mov word [rcx + rsi], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x14000d610
mov ebx, r13d
lea rcx, [rbp - 0x60]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x14000d630
test rax, rax
je 0x14000d6bf
mov rcx, r13
nop word [rax + rax]
lea rdi, [rbp - 0x60]
mov edx, 0x80
lea rdi, [rdi + rcx*2]
movzx ecx, word [rdi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswctype]
test eax, eax
je 0x14000d698
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdqe
mov rcx, 0xffffffffffffffff
lea r8, [0x1400810f0]
inc rcx
cmp word [r8 + rcx*2], 0
jne 0x14000d680
xor edx, edx
div rcx
movzx eax, word [r8 + rdx*2]
mov word [rdi], ax
inc ebx
lea rdx, [rbp - 0x60]
mov ecx, ebx
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x14000d6b0
cmp rcx, rax
jb 0x14000d650
lea r8, [rbp - 0x60]
mov rdx, r14
mov rcx, r15
call fcn.14000e970
sub rsi, 0x208
add r14, 0x208
sub r12, 1
jne 0x14000d5f0
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
lea rcx, [rbp + 0x1b0]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0xc00]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0xe10]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0x9f0]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0xc00]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov r9d, 1
lea rax, [rbp + 0xe10]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x19]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov r9d, 1
lea rax, [rbp + 0x9f0]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x1b]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea r8, [rbp + 0xc00]
lea rdx, [0x1400756b8]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfA]
xor edx, edx
lea rcx, [rbp - 0x60]
mov r8d, 0x140
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
nop dword [rax]
nop word [rax + rax]
movzx edx, word [rbp - 0x34]
movzx ecx, word [rbp - 0x32]
cmp dx, 0x2e
jne 0x14000d804
test cx, cx
je 0x14000d82f
cmp dx, dx
jne 0x14000d804
cmp cx, dx
jne 0x14000d804
cmp word [rbp - 0x30], 0
je 0x14000d82f
lea r9, [rbp - 0x34]
lea r8, [rbp + 0xc00]
lea rdx, [0x1400756c8]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp + 0x1b0]
call fcn.14000ed90
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14000d7e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea r8, [rbp + 0x9f0]
lea rdx, str._wsD3DSCache
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp + 0x1b0]
call fcn.14000ed90
lea r8, [rbp + 0x9f0]
lea rdx, str._wsNVIDIA_CorporationGfeSDK
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp + 0x1b0]
call fcn.14000ed90
lea r8, [rbp + 0x9f0]
lea rdx, str._wsMicrosoftFeeds
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp + 0x1b0]
call fcn.14000ed90
lea r8, [rbp + 0x9f0]
lea rdx, str._wsMicrosoftFeeds_Cache
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp + 0x1b0]
call fcn.14000ed90
lea r8, [rbp + 0x9f0]
lea rdx, str._wsMicrosoftWindowsINetCache
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp + 0x1b0]
call fcn.14000ed90
lea r8, [rbp + 0x9f0]
lea rdx, str._wsMicrosoftWindowsINetCookies
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp + 0x1b0]
call fcn.14000ed90
lea r8, [rbp + 0x9f0]
lea rdx, str._wsMicrosoftWindowsWebCache
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp + 0x1b0]
call fcn.14000ed90
lea r8, [rbp + 0x9f0]
lea rdx, str._wsMicrosoftXboxLiveAuthStateCache.dat
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp + 0x1b0]
call fcn.14000ed90
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov r15d, eax
mov esi, 0x43
test eax, eax
je 0x14000dfd0
lea r12, [0x1400810c0]
nop
test r15b, 1
je 0x14000dfc7
mov edx, esi
lea rcx, str._n___DRIVE:__c____n_n
call fcn.14000ab70
mov r8d, esi
lea rdx, str.._c:
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfA]
xor r9d, r9d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
lea rcx, [rbp + 0x1b0]
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x14000daee
xor edx, edx
lea rcx, [rbp - 0x60]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
lea r9, [rsp + 0x48]
mov dword [rsp + 0x48], r13d
mov r8d, 0x200
mov qword [rsp + 0x20], r13
lea rdx, [rbp - 0x60]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000dae5
cmp dword [rsp + 0x48], 0x200
jne 0x14000dae5
mov ebx, r13d
mov rdi, r12
nop dword [rax]
mov rdx, qword [rdi]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14000da70
mov eax, dword [rdi + 8]
lea rcx, [rbp - 0x60]
add rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14000da9a
inc ebx
add rdi, 0x10
cmp ebx, 3
jb 0x14000da60
jmp 0x14000dae5
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ebx, eax
shl ebx, 0x10
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ecx, dword [rdi + 0xc]
xor r9d, r9d
add eax, ebx
xor r8d, r8d
xor edx, edx
mov dword [rbp + rcx - 0x60], eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x14000dae5
xor r9d, r9d
mov qword [rsp + 0x20], r13
mov r8d, 0x200
lea rdx, [rbp - 0x60]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, esi
lea rdx, str._c:WindowsSystem32_restoreMachineGuid.txt
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp + 0x1b0]
call fcn.14000ed90
mov r8d, esi
lea rdx, str._c:UsersPublicLibrariescollection.dat
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp + 0x1b0]
call fcn.14000ed90
mov r8d, esi
lea rdx, str._c:System_Volume_InformationIndexerVolumeGuid
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp + 0x1b0]
call fcn.14000ed90
mov r8d, esi
lea rdx, str._c:System_Volume_InformationWPSettings.dat
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp + 0x1b0]
call fcn.14000ed90
mov r8d, esi
lea rdx, str._c:System_Volume_Information_tracking.log
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp + 0x1b0]
call fcn.14000ed90
mov r8d, esi
lea rdx, str._c:ProgramDataMicrosoftWindowsWER
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp + 0x1b0]
call fcn.14000ed90
mov r8d, esi
lea rdx, str._c:UsersPublicShared_Files
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp + 0x1b0]
call fcn.14000ed90
mov r8d, esi
lea rdx, str._c:WindowsINF_setupapi.dev.log
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp + 0x1b0]
call fcn.14000ed90
mov r8d, esi
lea rdx, str._c:WindowsINF_setupapi.setup.log
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp + 0x1b0]
call fcn.14000ed90
mov r8d, esi
lea rdx, str._c:WindowsSystem32_spp_store
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp + 0x1b0]
call fcn.14000ed90
mov r8d, esi
lea rdx, str._c:UsersPublicLibraries
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp + 0x1b0]
call fcn.14000ed90
mov r8d, esi
lea rdx, str._c:MSOCache
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp + 0x1b0]
call fcn.14000ed90
mov r8d, esi
lea rdx, str._c:ProgramData_ntuser.pol
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp + 0x1b0]
call fcn.14000ed90
mov r8d, esi
lea rdx, str._c:UsersDefaultNTUSER.DAT
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp + 0x1b0]
call fcn.14000ed90
mov r8d, esi
lea rdx, str._c:Recovery_ntuser.sys
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp + 0x1b0]
call fcn.14000ed90
mov r8d, esi
lea rdx, str._c:desktop.ini
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp + 0x1b0]
call fcn.14000ed90
mov r8d, esi
lea rdx, str._c:WindowsPrefetch
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfA]
xor edx, edx
lea rcx, [rbp - 0x60]
mov r8d, 0x140
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
nop word [rax + rax]
movzx edx, word [rbp - 0x34]
movzx ecx, word [rbp - 0x32]
cmp dx, 0x2e
jne 0x14000dd84
test cx, cx
je 0x14000ddab
cmp dx, dx
jne 0x14000dd84
cmp cx, dx
jne 0x14000dd84
cmp word [rbp - 0x30], 0
je 0x14000ddab
lea r9, [rbp - 0x34]
mov r8d, esi
lea rdx, str._c:WindowsPrefetch_ws
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp + 0x1b0]
call fcn.14000ed90
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14000dd60
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r8d, esi
lea rdx, [0x140075dc0]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfA]
xor edx, edx
lea rcx, [rbp - 0x60]
mov r8d, 0x140
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
mov rdx, qword [rbp - 0x34]
movzx ecx, word [rbp - 0x32]
cmp dx, 0x2e
jne 0x14000de2d
test cx, cx
je 0x14000df4d
cmp dx, dx
jne 0x14000de2d
cmp cx, dx
jne 0x14000de2d
cmp word [rbp - 0x30], 0
je 0x14000df4d
test byte [rbp - 0x60], 0x10
je 0x14000df4d
xor edx, edx
lea rcx, [rbp + 0x7e0]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov rcx, r13
nop
movzx eax, word [rbp + rcx - 0x34]
mov word [rbp + rcx + 0x7e0], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x14000de50
lea r9, [rbp + 0x7e0]
mov r8d, esi
lea rdx, str._c:Users_ws
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfA]
xor edx, edx
lea rcx, [rbp + 0x3c0]
mov r8d, 0x140
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x3c0]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
nop
movzx edx, word [rbp + 0x3ec]
movzx ecx, word [rbp + 0x3ee]
cmp dx, 0x2e
jne 0x14000dedd
test cx, cx
je 0x14000df2c
cmp dx, dx
jne 0x14000dedd
cmp cx, dx
jne 0x14000dedd
cmp word [rbp + 0x3f0], 0
je 0x14000df2c
lea rdx, str.ntuser
lea rcx, [rbp + 0x3ec]
call qword [sym.imp.SHLWAPI.dll_StrStrA]
test rax, rax
je 0x14000df2c
lea rax, [rbp + 0x3ec]
mov r8d, esi
lea r9, [rbp + 0x7e0]
mov qword [rsp + 0x20], rax
lea rdx, str._c:Users_ws_ws
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp + 0x1b0]
call fcn.14000ed90
lea rdx, [rbp + 0x3c0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14000deb0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14000de01
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r8d, esi
lea rdx, str._c:Users
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp + 0x1b0]
call fcn.14000f0d0
xor edx, edx
lea rcx, [rbp + 0x5d0]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
mov r8d, esi
lea rdx, str.fsutil_usn_deletejournal__d__c:
lea rcx, [rbp + 0x5d0]
call fcn.1400015d0
lea rcx, [rbp + 0x5d0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
inc esi
shr r15d, 1
jne 0x14000d9a0
lea rcx, str.vssadmin_delete_shadows__All__Quiet
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r15, qword [rsp + 0x21730]
mov rbx, rax
mov r14, qword [rsp + 0x21738]
mov r12, qword [rsp + 0x21740]
mov rsi, qword [rsp + 0x21768]
test rax, rax
je 0x14000e0c4
xor edx, edx
lea rcx, [rbp + 0x5d4]
mov r8d, 0x12c
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x5d0]
mov dword [rbp + 0x5d0], 0x130
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14000e0bb
nop word [rax + rax]
lea rdx, str.WmiPrvSE.exe
lea rcx, [rbp + 0x5fc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14000e07e
lea rdx, [rbp + 0x5d0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14000e050
jmp 0x14000e0bb
mov r8d, dword [rbp + 0x5d8]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000e0bb
lea rcx, str.Killed_Winmgmt_n
call fcn.14000ab70
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.net_stop_winmgmt__Y
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdi, qword [rsp + 0x21770]
mov rbx, qword [rsp + 0x21760]
mov rcx, qword [rbp + 0x21620]
xor rcx, rsp
call fcn.140022200
add rsp, 0x21748
pop r13
pop rbp
ret