Function at 0x18000f090
Capabilities:
Acquire credentials from windows credential manager
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x18], r8
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [r11 - 0x448]
sub rsp, 0x510
lea eax, [rcx + 0xb]
mov r13, rdx
mov edi, ecx
cmp ecx, eax
jae 0x18000f6cb
movsd xmm4, qword [0x18009f508]
lea ebx, [rcx - 0xa6]
mov r14, qword [rbp - 0x18]
mov edi, 0xb
mov rsi, qword [rbp - 0x18]
movabs rdx, 0xc069000000000000
mov r15, qword [rbp + 0x470]
movaps xmmword [r11 - 0x48], xmm6
movsd xmm6, qword [0x18009f570]
lea r10d, [rdi + 0x27]
movaps xmmword [r11 - 0x58], xmm7
lea r12d, [rdi + 0x28]
movsd xmm7, qword [0x18009f648]
movaps xmmword [r11 - 0x68], xmm8
movsd xmm8, qword [0x18009f538]
movaps xmmword [r11 - 0x78], xmm9
movsd xmm9, qword [0x18009f5e8]
movaps xmmword [r11 - 0x88], xmm10
movsd xmm10, qword [0x18009f610]
movaps xmmword [r11 - 0x98], xmm11
xorps xmm11, xmm11
movaps xmmword [r11 - 0xa8], xmm12
movsd xmm12, qword [0x18009f760]
movaps xmmword [r11 - 0xb8], xmm13
movsd xmm13, qword [0x18009f758]
movaps xmmword [r11 - 0xc8], xmm14
movsd xmm14, qword [0x18009f588]
movaps xmmword [r11 - 0xd8], xmm15
lea r11d, [rdi + 0x54]
movsd xmm15, qword [0x18009f750]
mov dword [rsp + 0x68], ebx
mov qword [rbp - 0x28], rdi
cmp ebx, 0xc
ja case.0x18000f1c4.9
lea rcx, [0x180000000]
mov ecx, dword [rcx + rbx*4 + 0xfc9c]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
movzx eax, word [0x18009f2ea]
mov word [rbp + 0xc5], ax
movzx eax, byte [0x18009f2ec]
mov byte [rbp + 0xc7], al
mov byte [rbp + 0xc4], 0x3a
jmp case.0x18000f1c4.9
mov r8d, 4
mov byte [rbp + 0xc8], 0
lea rdx, [0x18009f302]
lea rcx, [rbp + 0xc0]
call fcn.18006f3a0
mov eax, 0x6361
mov word [rbp + 0xcc], ax
movsd xmm4, qword [0x18009f508]
mov r10d, 0x32
mov r9, qword [rbp + 0x468]
movabs rdx, 0xc069000000000000
mov r8, qword [rbp + 0x460]
lea r11d, [r10 + 0x2d]
jmp case.0x18000f1c4.9
mov byte [rbp + 0xc4], 0
jmp case.0x18000f1c4.9
mov word [rbp + 0x1a], r10w
jmp case.0x18000f1c4.9
mov eax, 0x70
mov word [rbp - 0x3f], ax
jmp case.0x18000f1c4.9
movzx eax, word [0x18009f308]
lea rdx, [0x18009f310]
mov word [rbp - 0x48], ax
lea rcx, [rbp - 0x44]
movzx eax, word [0x18009f30c]
mov r8d, 3
mov word [rbp - 0x46], ax
movzx eax, byte [0x18009f30e]
mov byte [rbp - 0x44], al
call fcn.18006f5e0
mov dword [rbp - 0x42], 0x757472
jmp 0x18000f219
mov dword [rbp + 0x10], 0x730077
mov dword [rbp + 0x14], 0x5f0032
mov word [rbp + 0x18], r12w
jmp case.0x18000f1c4.9
mov eax, 0x2e
mov dword [rbp + 0x1e], 0x6c0064
mov word [rbp + 0x1c], ax
mov dword [rbp + 0x22], 0x6c
mov dword [rbp + 0xc0], 0x63736973
jmp case.0x18000f1c4.9
movsxd rax, dword [rsp + 0x6c]
cmp rax, 1
jle case.0x18000f1c4.9
dec rax
lea rdi, [r14 + 0x38]
mov qword [rbp - 0x20], rax
nop word [rax + rax]
mov r12d, 0xbc
nop word [rax + rax]
mov eax, r12d
sub eax, 0xbc
je 0x18000f4a7
sub eax, 0x70
je 0x18000f392
cmp eax, 0x70
jne 0x18000f5b8
cmp dword [r13], 0x60
lea r9, [rsp + 0x78]
movsd xmm0, qword [rdi]
lea rdx, [rsp + 0x70]
movsd xmm1, qword [rdi - 8]
mov r8, r15
movsd qword [rsp + 0x78], xmm0
mov ecx, 0x10f
jge 0x18000f377
movsd qword [rsp + 0x70], xmm1
call fcn.180026f00
mov qword [rdi], rax
jmp 0x18000f5b8
subsd xmm1, qword [0x18009f628]
movsd qword [rsp + 0x70], xmm1
call fcn.180026f00
mov qword [rdi], rax
jmp 0x18000f5b8
mov eax, dword [r9]
cmp eax, 0xffffffff
je 0x18000f5b8
nop
cmp eax, 0xffffff9c
je 0x18000f5b8
movsd xmm1, qword [rdi - 0x10]
cdqe
lea rbx, [rax + rax*2]
movsxd rax, dword [rsi + rbx*8 + 0x10]
shl rax, 5
movsd xmm0, qword [rax + r14 + 8]
subsd xmm1, xmm0
comisd xmm1, xmm13
jb 0x18000f495
comisd xmm10, xmm1
jbe 0x18000f495
comisd xmm15, xmm1
mulsd xmm0, qword [0x18009f510]
movsd xmm2, qword [rsi + rbx*8]
movaps xmm3, xmm2
addsd xmm0, xmm14
addsd xmm0, qword [0x18009f550]
subsd xmm3, xmm0
jbe 0x18000f41e
addsd xmm1, xmm6
mulsd xmm2, xmm8
mulsd xmm1, xmm7
addsd xmm2, xmm9
subsd xmm1, xmm2
jmp 0x18000f45f
comisd xmm11, xmm1
jbe 0x18000f438
mulsd xmm2, xmm8
addsd xmm2, xmm9
mulsd xmm2, xmm1
movaps xmm1, xmm2
jmp 0x18000f45f
comisd xmm6, xmm1
jbe 0x18000f445
mulsd xmm1, xmm12
jmp 0x18000f45f
movaps xmm0, xmm1
mulsd xmm2, xmm4
subsd xmm0, xmm6
subsd xmm2, xmm7
movaps xmm1, xmm2
mulsd xmm1, xmm0
subsd xmm1, xmm7
movsd xmm0, qword [rdi]
addsd xmm1, xmm3
lea r9, [rsp + 0x78]
movsd qword [rsp + 0x70], xmm0
mov r8, r15
lea rdx, [rsp + 0x70]
mov ecx, 0x10f
movsd qword [rsp + 0x78], xmm1
call fcn.180026f00
movsd xmm4, qword [0x18009f508]
mov qword [rdi], rax
mov eax, dword [rsi + rbx*8 + 0xc]
cmp eax, 0xffffffff
jne 0x18000f3a0
jmp 0x18000f5b8
mov qword [rdi], rdx
mov eax, dword [r8]
cmp eax, 0xffffffff
je 0x18000f5b8
cmp eax, 0xffffff9c
je 0x18000f5b8
movsd xmm1, qword [rdi - 0x10]
cdqe
lea rbx, [rax + rax*2]
movsxd rax, dword [rsi + rbx*8 + 0x10]
shl rax, 5
movsd xmm0, qword [rax + r14 + 8]
subsd xmm1, xmm0
comisd xmm1, xmm13
jb 0x18000f5ab
comisd xmm10, xmm1
jbe 0x18000f5ab
comisd xmm15, xmm1
mulsd xmm0, qword [0x18009f520]
movsd xmm2, qword [rsi + rbx*8]
movaps xmm3, xmm2
addsd xmm0, xmm14
addsd xmm0, qword [0x18009f5d8]
subsd xmm3, xmm0
jbe 0x18000f534
addsd xmm1, xmm6
mulsd xmm2, xmm8
mulsd xmm1, xmm7
addsd xmm2, xmm9
subsd xmm1, xmm2
jmp 0x18000f575
comisd xmm11, xmm1
jbe 0x18000f54e
mulsd xmm2, xmm8
addsd xmm2, xmm9
mulsd xmm2, xmm1
movaps xmm1, xmm2
jmp 0x18000f575
comisd xmm6, xmm1
jbe 0x18000f55b
mulsd xmm1, xmm12
jmp 0x18000f575
movaps xmm0, xmm1
mulsd xmm2, xmm4
subsd xmm0, xmm6
subsd xmm2, xmm7
movaps xmm1, xmm2
mulsd xmm1, xmm0
subsd xmm1, xmm7
movsd xmm0, qword [rdi]
addsd xmm1, xmm3
lea r9, [rsp + 0x78]
movsd qword [rsp + 0x70], xmm0
mov r8, r15
lea rdx, [rsp + 0x70]
mov ecx, 0x10f
movsd qword [rsp + 0x78], xmm1
call fcn.180026f00
movsd xmm4, qword [0x18009f508]
mov qword [rdi], rax
mov eax, dword [rsi + rbx*8 + 0xc]
cmp eax, 0xffffffff
jne 0x18000f4b6
movsd xmm4, qword [0x18009f508]
add r12d, 0x70
mov r9, qword [rbp + 0x468]
movabs rdx, 0xc069000000000000
mov r8, qword [rbp + 0x460]
cmp r12d, 0x20c
jb 0x18000f320
add rdi, 0x20
sub qword [rbp - 0x20], 1
jne 0x18000f310
mov ebx, dword [rsp + 0x68]
mov r10d, 0x32
mov rdi, qword [rbp - 0x28]
lea r11d, [r10 + 0x2d]
lea r12d, [r10 + 1]
jmp case.0x18000f1c4.9
mov rax, qword [rbp + 0x470]
mov r15, rax
mov ecx, dword [rax + 0x5814]
mov rsi, qword [rax + 0x5818]
mov r14, qword [rax + 0x5820]
mov dword [rsp + 0x6c], ecx
jmp case.0x18000f1c4.9
mov eax, 0x6568
mov byte [rbp + 0xd0], 0
mov word [rbp + 0xce], ax
mov eax, 0x70
mov word [rbp - 0x70], ax
mov eax, 0x6f
mov word [rbp - 0x6f], ax
inc ebx
sub rdi, 1
mov dword [rsp + 0x68], ebx
mov qword [rbp - 0x28], rdi
jne 0x18000f1a3
mov edi, dword [rbp + 0x450]
movaps xmm15, xmmword [rsp + 0x470]
movaps xmm14, xmmword [rsp + 0x480]
movaps xmm13, xmmword [rsp + 0x490]
movaps xmm12, xmmword [rsp + 0x4a0]
movaps xmm11, xmmword [rsp + 0x4b0]
movaps xmm10, xmmword [rsp + 0x4c0]
movaps xmm9, xmmword [rsp + 0x4d0]
movaps xmm8, xmmword [rsp + 0x4e0]
movaps xmm7, xmmword [rsp + 0x4f0]
movaps xmm6, xmmword [rsp + 0x500]
lea ebx, [rdi - 0xb]
mov dword [rsp + 0x64], ebx
cmp edi, ebx
movzx ebx, byte [rbp + 0x450]
jbe case.0x18000f751.0
mov r15d, dword [rbp + 0x450]
mov edx, 0x6d
movzx r14d, word [rbp + 0x450]
add edi, 0xffffff64
mov r12d, dword [rbp + 0x450]
mov r13d, dword [rbp + 0x450]
movzx esi, byte [rbp + 0x450]
lea r9d, [rdx + 5]
mov eax, dword [rsp + 0x64]
lea r10d, [rdx - 0x4d]
mov ecx, dword [rbp + 0x450]
lea r8d, [rdx - 8]
lea r11d, [rdx + 7]
mov dword [rsp + 0x68], edi
nop
cmp edi, 0xa
ja case.default.0x18000f751
lea rcx, [0x180000000]
mov ecx, dword [rcx + rdi*4 + 0xfcd0]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov word [rbp - 0x6e], r9w
jmp 0x18000f7b3
mov word [rbp - 0x57], dx
jmp 0x18000f7b3
mov dword [rbp - 0x61], 0x74616e
mov eax, 0x28
mov word [rbp - 0x5e], r10w
mov word [rbp - 0x5d], ax
mov word [rbp - 0x5c], r9w
jmp 0x18000f7b3
mov eax, 0x29
lea r8, [rbp + 0x10]
mov edx, 0xad
mov word [rbp - 0x56], ax
lea rcx, [rbp - 0x48]
call fcn.18000a770
mov qword [rbp + 0x78], rax
mov r9d, 0x72
lea r8d, [r9 - 0xd]
lea edx, [r9 - 5]
mov r10d, 0x20
lea r11d, [r10 + 0x54]
mov ecx, dword [rbp + 0x450]
mov eax, dword [rsp + 0x64]
dec ecx
dec edi
mov dword [rbp + 0x450], ecx
mov dword [rsp + 0x68], edi
cmp ecx, eax
ja 0x18000f730
movzx eax, bl
mov rbx, qword [rsp + 0x558]
add rsp, 0x510
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, 0x6f
mov dword [rbp - 0x5b], 0x646e61
mov word [rbp - 0x58], ax
jmp 0x18000f7b3
mov ecx, 0x202
mov qword [rbp + 0x80], 0xffffffff80000001
lea rdx, [rbp + 0x1d0]
call qword [rbp + 0x78]
test eax, eax
je 0x18000f79b
xor edx, edx
mov edi, edx
jmp 0x18000f832
xor edx, edx
cmp edi, 0x13
ja case.0x18000f84f.14
lea r8, [0x180000000]
mov eax, edi
mov ecx, dword [r8 + rax*4 + 0xfcfc]
add rcx, r8
jmp rcx
mov eax, dword [0x18009f33c]
mov dword [rbp + 0x50], eax
movzx eax, word [0x18009f340]
mov word [rbp + 0x54], ax
jmp case.0x18000f84f.14
mov eax, 0x61
mov dword [rbp - 8], 0x6d0065
mov word [rbp - 4], ax
jmp case.0x18000f84f.14
mov dword [rbp - 0x38], edx
lea r9, [rbp - 0x18]
xorps xmm0, xmm0
mov dword [rbp - 0x34], edx
mov edx, r15d
lea r8, [rbp - 0x38]
lea rcx, [rbp - 0x10]
movups xmmword [rbp + 0x88], xmm0
call qword [sym.imp.ADVAPI32.dll_CredEnumerateW]
mov dword [rsp + 0x70], eax
jmp case.0x18000f84f.14
mov dword [rbp + 8], 0x650073
mov word [rbp + 0xc], dx
jmp case.0x18000f84f.14
mov r8d, 0x2d
mov dword [rbp + 0x2e], 0x77002d
mov word [rbp + 0x3a], r8w
mov dword [rbp + 0x32], 0x6e0069
mov dword [rbp + 0x36], 0x740072
jmp case.0x18000f84f.14
mov r8d, 0x69
mov dword [rbp + 0x40], 0x690064
mov word [rbp + 0x3e], r8w
mov dword [rbp + 0x44], 0x61002d
mov dword [rbp + 0x48], 0x690070
jmp case.0x18000f84f.14
xorps xmm0, xmm0
mov dword [rbp - 0x30], 0x2000000
xor eax, eax
mov r15d, edx
movups xmmword [rbp + 0x98], xmm0
mov qword [rbp + 0xb8], rax
movups xmmword [rbp + 0xa8], xmm0
jmp case.0x18000f84f.14
mov byte [rsp + 0x60], 1
jmp case.0x18000f84f.14
mov eax, 0x75
mov dword [rbp + 0x2a], 0x650073
mov word [rbp + 0x28], ax
jmp case.0x18000f84f.14
mov eax, 0x75
mov word [rbp + 6], ax
jmp case.0x18000f84f.14
mov dword [rbp - 2], 0x6b0072
mov dword [rbp + 2], 0x610050
jmp case.0x18000f84f.14
mov eax, 0x61
mov dword [rbp + 0x72], 0x3e
mov word [rbp - 0x10], ax
jmp case.0x18000f84f.14
lea rax, [rsp + 0x78]
xor edx, edx
mov qword [rsp + 0x50], rax
lea r9, [rbp + 0x50]
lea rax, [rbp - 0x28]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea r8, [rbp + 0x28]
lea rax, [rbp - 0x20]
mov qword [rsp + 0x40], rax
mov eax, dword [rbp - 0x34]
mov dword [rsp + 0x38], eax
lea rax, [rbp + 0x88]
mov qword [rsp + 0x30], rax
mov eax, dword [rbp - 0x30]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_AccessCheckAndAuditAlarmW]
xor eax, eax
mov ecx, eax
movzx eax, byte [rsp + 0x60]
cmp dword [rsp + 0x70], ecx
cmovne ecx, eax
mov byte [rsp + 0x60], cl
jmp case.0x18000f84f.14
movsd xmm0, qword [0x18009f3c0]
lea rcx, [rbp + 0x6a]
mov eax, 0x3c
mov word [rbp + 0x6a], dx
mov word [rbp + 0x5e], ax
lea rdx, [0x18009f424]
movzx eax, word [0x18009f3c8]
mov r8d, 4
mov word [rbp + 0x68], ax
movsd qword [rbp + 0x60], xmm0
call fcn.18006f0ec
jmp case.0x18000f84f.14
mov eax, 0x76
mov dword [rbp - 0xc], 0x520067
mov word [rbp - 0xe], ax
jmp case.0x18000f84f.14
movabs rax, 0x7200740050006d
mov word [rbp + 0x5e], dx
mov qword [rbp + 0x56], rax
jmp case.0x18000f84f.14
mov edx, 0x6d
mov word [rbp + 0x3c], dx
jmp 0x18000fa66
mov word [rbp + 0x4c], dx
mov edx, 0x6d
inc edi
mov r9d, 0x72
lea eax, [rdi + 0xee]
lea r8d, [r9 - 0xd]
cmp eax, 0x102
jb 0x18000f830
mov edi, dword [rsp + 0x68]
jmp 0x18000f7a9
mov eax, 0x6e
mov word [rbp - 0x65], r8w
mov word [rbp - 0x64], ax
mov word [rbp - 0x63], r11w
mov word [rbp - 0x62], r10w
jmp 0x18000f7b3
mov word [rbp - 0x6d], r11w
mov dword [rbp - 0x6c], 0x656420
jmp 0x18000f7b3
mov rcx, qword [rbp + 0x470]
xor r8d, r8d
mov edx, 0x106
call fcn.180045240
test al, al
jne 0x18000fc3d
mov edi, 0x3f
nop dword [rax + rax]
cmp edi, 0x3a53
ja 0x18000fba7
je 0x18000fb8a
cmp edi, 0x3f
je 0x18000fb64
cmp edi, 0xec4
je 0x18000fb3f
cmp edi, 0x1d49
je 0x18000fb22
cmp edi, 0x2bce
jne 0x18000fc27
xor eax, eax
mov dword [rsp + 0x6c], eax
lea r14d, [rax + 0x61]
jmp 0x18000fc27
movzx eax, word [0x18009f44c]
mov sil, 1
mov word [rbp - 0x75], ax
movzx eax, byte [0x18009f44e]
mov byte [rbp - 0x73], al
jmp 0x18000fc27
movzx eax, word [0x18009f450]
mov word [rbp - 0x79], ax
movzx eax, word [0x18009f454]
mov word [rbp - 0x77], ax
movzx eax, byte [0x18009f456]
mov byte [rbp - 0x75], al
jmp 0x18000fc27
mov eax, dword [str._ENDB]
mov ecx, 0x49
mov word [rbp - 0x80], cx
mov dword [rbp - 0x7f], eax
movzx eax, word [0x18009f448]
mov word [rbp - 0x7b], ax
mov word [rbp - 0x7a], cx
jmp 0x18000fc27
xor eax, eax
movzx ecx, r14w
mov dword [rbp - 0x50], eax
mov r13d, eax
mov r12d, eax
lea edx, [rax + 0x62]
call qword [sym.imp.SHLWAPI.dll_ChrCmpIW]
jmp 0x18000fc27
cmp edi, 0x48d8
je 0x18000fbc9
cmp edi, 0x575d
je 0x18000fbc5
cmp edi, 0x65e2
je case.0x18000f751.0
jmp 0x18000fc27
xor bl, bl
jmp 0x18000fc27
xor eax, eax
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x6c]
lea rax, [rbp - 0x50]
mov dword [rsp + 0x28], r13d
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor edx, edx
lea rcx, [rbp - 0x80]
call sub.SHLWAPI.dll_SHRegGetUSValueA
test eax, eax
je 0x18000fbff
xor sil, sil
jmp 0x18000fc27
test sil, sil
je 0x18000fc27
mov eax, dword [rbp - 0x50]
lea rcx, [rbp - 0x80]
mov r8d, dword [rsp + 0x6c]
xor r9d, r9d
mov dword [rsp + 0x28], 1
xor edx, edx
mov dword [rsp + 0x20], eax
call qword [sym.imp.SHLWAPI.dll_SHRegSetUSValueA]
add edi, 0xe85
cmp edi, 0x7428
jbe 0x18000fae0
mov edi, dword [rsp + 0x68]
lea rcx, [rbp + 0xc0]
call qword [sym.imp.SHLWAPI.dll_PathRemoveArgsA]
mov rcx, qword [rbp + 0x80]
lea rdx, [rbp - 0x70]
call qword [sym.imp.SHLWAPI.dll_SHDeleteEmptyKeyA]
xor edx, edx
xor r8d, r8d
lea ecx, [rdx + 0x75]
call fcn.18000fd50
mov ebx, eax
jmp 0x18000f79b
mov eax, 0x70
mov word [rbp - 0x69], ax
mov dword [rbp - 0x68], 0x646e65
jmp 0x18000f7b3
cmp byte [rsp + 0x60], 0
je 0x18000fc95
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_CredFree]
xor al, al
jmp 0x18000f7d6