Function at 0x18007bc00
Capabilities:
Delete registry key
Terminate process
Timestomp file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
sub rsp, 0x560
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x180309080]
xor rax, rsp
mov qword [rbp + 0x4e8], rax
call fcn.18007b140
lea rcx, [rbp + 0x458]
call fcn.180078940
nop
lea rcx, [rbp + 0x438]
call fcn.180078b90
nop
lea rcx, [rbp + 0x478]
call fcn.1800785f0
nop
lea rcx, [rbp + 0x420]
call fcn.18007c740
lea rdx, str.cmd.exe
lea rcx, [rbp + 0x1c0]
call fcn.18002e440
nop
lea rdx, [rbp + 0x438]
lea rcx, [rbp + 0x1e0]
call fcn.18002e480
nop
lea rdx, str.conhost.exe
lea rcx, [rbp + 0x200]
call fcn.18002e440
nop
lea r8, [rbp + 0x220]
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x20]
call fcn.1800841b0
movups xmm0, xmmword [rax]
movaps xmmword [rbp + 0x4c0], xmm0
lea rdx, [rbp + 0x4c0]
lea rcx, [rbp + 0x420]
call fcn.180084480
nop
lea r9, [fcn.1800220a0]
mov r14d, 3
mov r8d, r14d
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea rcx, [rbp + 0x1c0]
call fcn.1800e8458
lea rcx, [rbp + 0x420]
call fcn.180078fb0
lea rcx, [rbp + 0x40]
call fcn.180078b90
mov rcx, rax
call fcn.18002e430
mov rbx, rax
lea rcx, [rbp + 0x40]
call fcn.1800220a0
mov dword [rbp + 0x3d0], 0x307e3
mov dword [rbp + 0x3d6], 0x13000c
mov dword [rbp + 0x3da], reloc.WS2_32.dll_recvfrom
xor esi, esi
mov word [rbp + 0x3de], si
lea rdx, [rbp + 0x3f0]
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x18007bdb8
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov edx, 0x100
mov r8d, 7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18007bdb8
lea r9, [rbp + 0x3f0]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x3f8]
call fcn.180078490
lea rdx, str.Dnscache
lea rcx, [rbp + 0x40]
call fcn.18002e440
nop
movabs rax, 0xd0b877621a29087a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3c0], rax
movabs rdi, 0xa5e996d294d1cd56
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x3c8], rax
movabs rbx, 0xd0d003177b506d11
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x4c0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x4c8], rax
movdqa xmm0, xmmword [rbp + 0x4c0]
xorps xmm0, xmmword [rbp + 0x3c0]
movdqa xmmword [rbp + 0x3c0], xmm0
lea rdx, [rbp + 0x3c0]
lea rcx, [rbp + 0x150]
call fcn.1800038a0
nop
movabs rax, 0xfeb877621a29087a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3c0], rax
movabs rax, 0xa5e996d294bfa421
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3c8], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x4c0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x4c8], rax
movdqa xmm0, xmmword [rbp + 0x4c0]
xorps xmm0, xmmword [rbp + 0x3c0]
movdqa xmmword [rbp + 0x3c0], xmm0
lea rdx, [rbp + 0x3c0]
lea rcx, [rbp + 0x170]
call fcn.1800038a0
nop
lea r8, [rbp + 0x190]
lea rdx, [rbp + 0x150]
lea rcx, [rbp + 0x3e0]
call fcn.1800841b0
movups xmm0, xmmword [rax]
movaps xmmword [rbp + 0x4c0], xmm0
lea rdx, [rbp + 0x4c0]
lea rcx, [rbp + 0x90]
call fcn.1800845c0
nop
lea r8, [rbp + 0x90]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x300]
call fcn.180085310
nop
lea rdx, str.PcaSvc
lea rcx, [rbp + 0xe8]
call fcn.18002e440
nop
lea rdx, [rbp + 0x458]
lea rcx, [rbp + 0x110]
call fcn.18000dcf0
nop
movabs rax, 0xbeb56a7b38310e41
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0xc19cfab1ec94e122
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x882c92a1c9aefc0e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rcx, 0x8eb27d844b481e08
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x4c0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x4c8], rax
movabs rax, 0x882c92a1c9ae986b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4d0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x4d8], rax
movdqa xmm0, xmmword [rbp + 0x4c0]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [rbp + 0x4d0]
xorps xmm1, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x30], xmm1
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x130]
call fcn.1800038a0
nop
lea r8, [rbp + 0x150]
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0x190]
call fcn.1800841b0
movups xmm0, xmmword [rax]
movaps xmmword [rbp + 0x4c0], xmm0
lea rdx, [rbp + 0x4c0]
lea rcx, [rbp + 0x78]
call fcn.1800845c0
nop
lea r8, [rbp + 0x78]
lea rdx, [rbp + 0xe8]
lea rcx, [rbp + 0x338]
call fcn.180085310
nop
lea rdx, str.DiagTrack
lea rcx, [rbp + 0xc8]
call fcn.18002e440
nop
lea rdx, [rbp + 0x478]
lea rcx, [rbp + 0xa8]
call fcn.18000dcf0
nop
lea r8, [rbp + 0xc8]
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0x1a0]
call fcn.1800841b0
movups xmm0, xmmword [rax]
movaps xmmword [rbp + 0x4c0], xmm0
lea rdx, [rbp + 0x4c0]
lea rcx, [rbp + 0x60]
call fcn.1800845c0
nop
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0xc8]
lea rcx, [rbp + 0x370]
call fcn.180085310
nop
lea r8, [rbp + 0x3a8]
lea rdx, [rbp + 0x300]
lea rcx, [rbp + 0x1b0]
call fcn.1800841b0
movups xmm0, xmmword [rax]
movaps xmmword [rbp + 0x4c0], xmm0
lea rdx, [rbp + 0x4c0]
lea rcx, [rbp + 0x3f8]
call fcn.180084230
nop
lea r9, [fcn.18007ba00]
mov r8, r14
mov edx, gethostname
lea rcx, [rbp + 0x300]
call fcn.1800e8458
nop
lea rcx, [rbp + 0x60]
call fcn.1800317e0
nop
lea r9, [fcn.180003840]
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov r8d, 1
lea rcx, [rbp + 0xa8]
call fcn.1800e8458
nop
lea rcx, [rbp + 0xc8]
call fcn.1800220a0
nop
lea rcx, [rbp + 0x78]
call fcn.1800317e0
nop
lea r9, [fcn.180003840]
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov r8d, 2
lea rcx, [rbp + 0x110]
call fcn.1800e8458
nop
lea rcx, [rbp + 0xe8]
call fcn.1800220a0
nop
lea rcx, [rbp + 0x90]
call fcn.1800317e0
nop
lea r9, [fcn.180003840]
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov r8d, 2
lea rcx, [rbp + 0x150]
call fcn.1800e8458
nop
lea rcx, [rbp + 0x40]
call fcn.1800220a0
call fcn.18007ba80
lea rcx, [rbp + 0x3f8]
call fcn.18007aa50
call fcn.18007b4e0
call fcn.18007b7b0
lea rax, [rbp + 0x3b0]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsShell
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18007c239
xor edx, edx
mov rcx, qword [rbp + 0x3b0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov rcx, qword [rbp + 0x3b0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x3b0]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerComD1g32OpenSavePid
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18007c282
xor edx, edx
mov rcx, qword [rbp + 0x3b0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov rcx, qword [rbp + 0x3b0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x3b0]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerRunMRU
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18007c2cb
xor edx, edx
mov rcx, qword [rbp + 0x3b0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov rcx, qword [rbp + 0x3b0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x3b0]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerRecentD1MRU
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18007c314
xor edx, edx
mov rcx, qword [rbp + 0x3b0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov rcx, qword [rbp + 0x3b0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x3b0]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerOCS
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18007c35d
xor edx, edx
mov rcx, qword [rbp + 0x3b0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov rcx, qword [rbp + 0x3b0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x3b0]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SoftwareAMDHKIDs
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18007c3a6
xor edx, edx
mov rcx, qword [rbp + 0x3b0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov rcx, qword [rbp + 0x3b0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x3b0]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerAppCompatCache
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18007c3ef
xor edx, edx
mov rcx, qword [rbp + 0x3b0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov rcx, qword [rbp + 0x3b0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x3b0]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SYSTEMControlSet001Services_bamStateUserSettings
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18007c4a1
lea rdx, str.S_1_5_21_2123680249_3120430298_705127086_1001
mov rcx, qword [rbp + 0x3b0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x18007c45d
lea rdx, str.Chave_exclu
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.180084bb0
lea rdx, [0x180084d90]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x18007c494
lea rdx, str.Erro_ao_excluir_a_chave:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.180031970
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x180084b70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 0x3b0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rbp + 0x408]
call fcn.18007c740
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageShowJumpView
lea rcx, [rbp + 0x220]
call fcn.18002e440
nop
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageAppSwitched
lea rcx, [rbp + 0x240]
call fcn.18002e440
nop
lea rdx, str.SOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache
lea rcx, [rbp + 0x260]
call fcn.18002e440
nop
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
lea rcx, [rbp + 0x280]
call fcn.18002e440
nop
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore
lea rcx, [rbp + 0x2a0]
call fcn.18002e440
nop
lea rdx, str.SOFTWARERazerKraken0510_1.0.2NahimicSettingsApplications
lea rcx, [rbp + 0x2c0]
call fcn.18002e440
nop
lea rdx, str.SYSTEMCurrentControlSetServices_bamStateUserSettingsS_1_5_21_2123680249_3120430298_705127086_1001
lea rcx, [rbp + 0x2e0]
call fcn.18002e440
nop
lea r8, [rbp + 0x300]
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0x20]
call fcn.1800841b0
movups xmm0, xmmword [rax]
movaps xmmword [rbp + 0x4c0], xmm0
lea rdx, [rbp + 0x4c0]
lea rcx, [rbp + 0x408]
call fcn.180084480
nop
lea r9, [fcn.1800220a0]
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov r8d, 7
lea rcx, [rbp + 0x220]
call fcn.1800e8458
lea rcx, [rbp + 0x408]
call fcn.180084460
mov rdi, rax
lea rcx, [rbp + 0x408]
call fcn.1800782c0
mov rbx, rax
cmp rax, rdi
je 0x18007c613
nop
mov rcx, rbx
call fcn.180084680
mov rcx, rsi
cmp rax, 0xffffffffffffffff
setne cl
add rcx, 0xffffffff80000001
mov rdx, rbx
call fcn.18007ad90
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
test al, al
lea rdx, str.Processed_key:
jne 0x18007c5ea
lea rdx, str.Failed_to_process_key:
call fcn.180084bb0
mov rdx, rbx
mov rcx, rax
call fcn.180084dd0
lea rdx, [0x180084d90]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
add rbx, 0x20
cmp rbx, rdi
jne 0x18007c5b0
lea rdx, str.C:ProgramDataMicrosoftWindowsWERReportArchive
lea rcx, [rbp + 0x498]
call fcn.1800038a0
nop
lea rdx, [rbp + 0x498]
lea rcx, [rbp + 0x40]
call fcn.18002ec00
nop
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x4c0]
call fcn.180078270
nop
lea rcx, [rbp + 0x40]
call fcn.1800220a0
lea rcx, [rbp + 0x3c0]
call fcn.180078490
lea rdx, [rbp + 0x4c0]
lea rcx, [rbp + 0x3e0]
call fcn.180079820
mov rdx, rax
lea rcx, [rbp + 0x3c0]
call fcn.1800783e0
nop
lea rcx, [rbp + 0x3e0]
call fcn.180078490
lea rdx, [rbp + 0x4c0]
lea rcx, [rbp + 0x20]
call fcn.180079820
mov rdx, rax
lea rcx, [rbp + 0x3e0]
call fcn.180078410
nop
nop dword [rax]
lea rdx, [rbp + 0x3e0]
lea rcx, [rbp + 0x3c0]
call fcn.1800783d0
test al, al
jne 0x18007c70c
lea rcx, [rbp + 0x3c0]
call fcn.1800782c0
mov rbx, rax
lea rdx, [rbp]
mov rcx, rax
call fcn.180077cd0
mov rcx, qword [rax]
call fcn.180077b40
test al, al
je 0x18007c6fe
mov rcx, rbx
call fcn.180077b50
mov rcx, rax
call fcn.1800784a0
lea rcx, [rbp + 0x3c0]
call fcn.1800782d0
jmp 0x18007c6b0
lea rcx, [rbp + 0x3e0]
call fcn.18000de70
nop
lea rcx, [rbp + 0x3c0]
call fcn.18000de70
nop
lea rcx, [rbp + 0x4c0]
call fcn.18000de70
nop
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3