Function at 0x140003500
Capabilities:
Execute command
Get session user name
Persist via windows service
Self delete
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x30], rax
xor r13d, r13d
call fcn.1400033b0
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], r13b
mov dword [rsp + 0x68], 0x80
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rax, [rbp - 0x50]
mov r14, 0xffffffffffffffff
mov rdi, r14
inc rdi
cmp byte [rax + rdi], 0
jne 0x140003576
mov rax, qword [rbp - 0x58]
cmp rdi, rax
ja 0x1400035ae
lea rbx, [rbp - 0x70]
cmp rax, 0xf
cmova rbx, qword [rbp - 0x70]
mov qword [rbp - 0x60], rdi
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
jmp 0x1400035be
lea r9, [rbp - 0x50]
mov rdx, rdi
lea rcx, [rbp - 0x70]
call fcn.140008180
lea rbx, [rbp - 0x70]
mov r15, qword [rbp - 0x70]
mov r12, qword [rbp - 0x58]
cmp r12, 0xf
cmova rbx, r15
mov rdi, qword [rbp - 0x60]
cmp rdi, 1
jb 0x140003627
lea rsi, [rdi + rbx]
mov r8, rdi
mov edx, 0x5c
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140003627
cmp byte [rax], 0x5c
jne 0x1400035ff
mov ecx, r13d
jmp 0x140003604
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x140003843
inc rax
mov r8, rsi
sub r8, rax
mov edx, 0x5c
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x1400035f5
mov rax, r14
lea rcx, [rax + 1]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
cmp rdi, rcx
jb 0x140004690
sub rdi, rcx
cmp rdi, r14
cmovb r14, rdi
lea rdx, [rbp - 0x70]
cmp r12, 0xf
cmova rdx, r15
add rdx, rcx
mov r8, r14
lea rcx, [rsp + 0x70]
call fcn.1400079a0
nop
lea rcx, str.COLOR_A
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellBagMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellBags___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsShellBagMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsShellBags___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerRunMRU___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32FirstFolder___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedPidlMRU___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedPidlMRULegacy___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRU_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession_ManagerAppCompatCache___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001ControlSession_ManagerAppCompatCache___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_LOCAL_MACHINESOFTWAREMicrosoftRADARHeapLeakDetectionDiagnosedApplications___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD__HKEY_LOCAL_MACHINESOFTWAREMicrosoftRADARHeapLeakDetectionDiagnosedApplications_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL___f___q___APPDATA___MicrosoftWindowsRecent__.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL___f___q___APPDATA___MicrosoftWindowsRecentCustomDestinations__.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL___f___q___APPDATA___MicrosoftWindowsRecentAutomaticDestinations__.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL___f___q___systemroot___Panther__.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL___f___q___systemroot____appcompatPrograms__.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL___f___q___systemroot____appcompatPrograms__.xml
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL___f___q___systemroot____appcompatProgramsInstall__.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL___f___q___systemroot____appcompatProgramsInstall__.xml
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov r12, qword [rbp - 0x80]
sub rax, r12
mov qword [rsp + 0x60], rax
cmp rax, 0x17
jb 0x140004696
lea r14, [rsp + 0x70]
mov rsi, qword [rsp + 0x70]
mov r13, qword [rbp - 0x78]
cmp r13, 0xf
cmova r14, rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea r15, [r12 + 0x17]
mov ebx, 0xf
lea rdi, [rsp + 0x40]
movabs rax, 0x8000000000000000
lea edx, [rbx + 7]
cmp r15, rbx
jbe 0x140003884
mov rbx, r15
or rbx, 0xf
cmp rbx, rcx
jbe 0x14000384b
mov rbx, rcx
add rax, 0x27
mov rcx, rax
call fcn.140008c10
test rax, rax
je 0x1400039b4
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000387f
sub rax, rbx
jmp 0x14000362a
cmp rbx, rdx
cmovb rbx, rdx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000386e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140004666
jmp 0x140003824
test rcx, rcx
je 0x14000387d
call fcn.140008c10
mov rdi, rax
jmp 0x14000387f
xor edi, edi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rbx
movups xmm0, xmmword [str.REG_DELETE__HKEY_USERS_]
movups xmmword [rdi], xmm0
mov eax, dword [0x14000c088]
mov dword [rdi + 0x10], eax
movzx eax, word [0x14000c08c]
mov word [rdi + 0x14], ax
movzx eax, byte [0x14000c08e]
mov byte [rdi + 0x16], al
lea rcx, [rdi + 0x17]
mov r8, r12
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r15], 0
mov r8d, 0x40
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionSearchRecentApps___f
lea rcx, [rsp + 0x40]
call fcn.1400064f0
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x30], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x14000396d
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003968
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003968
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008d1c
movdqa xmm0, xmmword [0x14000c7b0]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1400039c0
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400039bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400039bb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008d1c
lea r14, [rsp + 0x70]
cmp r13, 0xf
cmova r14, rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
add r12, 0x14
mov ebx, 0xf
lea rdi, [rsp + 0x40]
cmp r12, rbx
jbe 0x140003a7a
mov rbx, r12
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x140003a3b
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140008c10
test rax, rax
je 0x140003b96
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140003a75
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140003a64
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000466c
jmp 0x140003a1c
test rcx, rcx
je 0x140003a73
call fcn.140008c10
mov rdi, rax
jmp 0x140003a75
xor edi, edi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], rbx
movups xmm0, xmmword [str.REG_ADD__HKEY_USERS_]
movups xmmword [rdi], xmm0
mov eax, dword [0x14000c0e0]
mov dword [rdi + 0x10], eax
lea rcx, [rdi + 0x14]
mov r8, qword [rbp - 0x80]
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r12], 0
mov r8d, 0x3d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionSearchRecentApps_
lea rcx, [rsp + 0x40]
call fcn.1400064f0
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x30], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140003b4f
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003b4a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008d1c
movdqa xmm0, xmmword [0x14000c7b0]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140003ba2
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b9d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003b9d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008d1c
cmp qword [rsp + 0x60], 0x52
jb 0x140004660
lea r12, [rsp + 0x70]
cmp r13, 0xf
cmova r12, rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov rdx, qword [rbp - 0x80]
lea r14, [rdx + 0x52]
mov ebx, 0xf
lea rdi, [rsp + 0x40]
cmp r14, rbx
jbe 0x140003c74
mov rbx, r14
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x140003c31
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140008c10
test rax, rax
je 0x140003dbd
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
mov rdx, qword [rbp - 0x80]
jmp 0x140003c6f
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140003c5a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140004672
jmp 0x140003c0e
test rcx, rcx
je 0x140003c6d
call fcn.140008c10
mov rdi, rax
mov rdx, qword [rbp - 0x80]
jmp 0x140003c6f
xor edi, edi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], rbx
movaps xmm0, xmmword [str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices_bamUserSettings_]
movups xmmword [rdi], xmm0
movaps xmm1, xmmword [0x14000c110]
movups xmmword [rdi + 0x10], xmm1
movaps xmm0, xmmword [0x14000c120]
movups xmmword [rdi + 0x20], xmm0
movaps xmm1, xmmword [0x14000c130]
movups xmmword [rdi + 0x30], xmm1
movaps xmm0, xmmword [0x14000c140]
movups xmmword [rdi + 0x40], xmm0
movzx eax, word [0x14000c150]
mov word [rdi + 0x50], ax
lea rcx, [rdi + 0x52]
mov r8, rdx
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov r8d, 8
lea rdx, str.___va__f
lea rcx, [rsp + 0x40]
call fcn.1400064f0
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x30], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140003d76
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d71
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003d71
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008d1c
movdqa xmm0, xmmword [0x14000c7b0]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140003dc9
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003dc4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003dc4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008d1c
lea r12, [rsp + 0x70]
cmp r13, 0xf
cmova r12, rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov rdx, qword [rbp - 0x80]
lea r14, [rdx + 0x4e]
mov ebx, 0xf
lea rdi, [rsp + 0x40]
cmp r14, rbx
jbe 0x140003e8f
mov rbx, r14
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x140003e4c
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140008c10
test rax, rax
je 0x140003fe3
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
mov rdx, qword [rbp - 0x80]
jmp 0x140003e8a
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140003e75
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140004678
jmp 0x140003e29
test rcx, rcx
je 0x140003e88
call fcn.140008c10
mov rdi, rax
mov rdx, qword [rbp - 0x80]
jmp 0x140003e8a
xor edi, edi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], rbx
movaps xmm0, xmmword [str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001Services_bamUserSettings_]
movups xmmword [rdi], xmm0
movaps xmm1, xmmword [0x14000c170]
movups xmmword [rdi + 0x10], xmm1
movaps xmm0, xmmword [0x14000c180]
movups xmmword [rdi + 0x20], xmm0
movaps xmm1, xmmword [0x14000c190]
movups xmmword [rdi + 0x30], xmm1
movsd xmm0, qword [0x14000c1a0]
movsd qword [rdi + 0x40], xmm0
mov eax, dword [0x14000c1a8]
mov dword [rdi + 0x48], eax
movzx eax, word [0x14000c1ac]
mov word [rdi + 0x4c], ax
lea rcx, [rdi + 0x4e]
mov r8, rdx
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov r8d, 8
lea rdx, str.___va__f
lea rcx, [rsp + 0x40]
call fcn.1400064f0
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x30], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140003f9c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f97
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003f97
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008d1c
movdqa xmm0, xmmword [0x14000c7b0]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140003fef
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003fea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003fea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008d1c
lea r14, [rsp + 0x70]
cmp r13, 0xf
cmova r14, rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov ebx, 0xf
lea rdi, [rsp + 0x40]
cmp r15, rbx
jbe 0x1400040a5
mov rbx, r15
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x140004066
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140008c10
test rax, rax
je 0x1400041d9
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400040a0
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000408f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000467e
jmp 0x140004047
test rcx, rcx
je 0x14000409e
call fcn.140008c10
mov rdi, rax
jmp 0x1400040a0
xor edi, edi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rbx
movups xmm0, xmmword [str.REG_DELETE__HKEY_USERS_]
movups xmmword [rdi], xmm0
mov eax, dword [0x14000c088]
mov dword [rdi + 0x10], eax
movzx eax, word [0x14000c08c]
mov word [rdi + 0x14], ax
movzx eax, byte [0x14000c08e]
mov byte [rdi + 0x16], al
lea rcx, [rdi + 0x17]
mov r12, qword [rbp - 0x80]
mov r8, r12
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r15], 0
mov r8d, 0x61
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore___va__f
lea rcx, [rsp + 0x40]
call fcn.1400064f0
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x30], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140004192
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000418d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000418d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008d1c
movdqa xmm0, xmmword [0x14000c7b0]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1400041e5
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400041e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400041e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008d1c
lea r14, [rsp + 0x70]
cmp r13, 0xf
cmova r14, rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov ebx, 0xf
lea rdi, [rsp + 0x40]
cmp r15, rbx
jbe 0x14000429b
mov rbx, r15
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x14000425c
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140008c10
test rax, rax
je 0x1400043cb
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140004296
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140004285
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140004684
jmp 0x14000423d
test rcx, rcx
je 0x140004294
call fcn.140008c10
mov rdi, rax
jmp 0x140004296
xor edi, edi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rbx
movups xmm0, xmmword [str.REG_DELETE__HKEY_USERS_]
movups xmmword [rdi], xmm0
mov eax, dword [0x14000c088]
mov dword [rdi + 0x10], eax
movzx eax, word [0x14000c08c]
mov word [rdi + 0x14], ax
movzx eax, byte [0x14000c08e]
mov byte [rdi + 0x16], al
lea rcx, [rdi + 0x17]
mov r8, r12
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r15], 0
mov r8d, 0x44
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints2___f
lea rcx, [rsp + 0x40]
call fcn.1400064f0
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x30], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140004384
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000437f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000437f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008d1c
movdqa xmm0, xmmword [0x14000c7b0]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1400043d7
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400043d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400043d2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008d1c
lea r14, [rsp + 0x70]
cmp r13, 0xf
cmova r14, rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov ebx, 0xf
lea rdi, [rsp + 0x40]
lea r15, [r12 + 0x14]
cmp r15, rbx
jbe 0x140004492
mov rbx, r15
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x140004453
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140008c10
test rax, rax
je 0x1400045ad
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000448d
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000447c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000468a
jmp 0x140004434
test rcx, rcx
je 0x14000448b
call fcn.140008c10
mov rdi, rax
jmp 0x14000448d
xor edi, edi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rbx
movups xmm0, xmmword [str.REG_ADD__HKEY_USERS_]
movups xmmword [rdi], xmm0
mov eax, dword [0x14000c0e0]
mov dword [rdi + 0x10], eax
lea rcx, [rdi + 0x14]
mov r8, r12
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r15], 0
mov r8d, 0x41
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints2_
lea rcx, [rsp + 0x40]
call fcn.1400064f0
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x30], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140004566
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004561
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004561
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008d1c
movdqa xmm0, xmmword [0x14000c7b0]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1400045ba
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400045b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400045b4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008d1c
nop
cmp r13, 0xf
jbe 0x1400045f5
lea rdx, [r13 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400045ec
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400045ec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140008d1c
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140004633
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000462e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000462e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008d1c
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.140008bf0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011b0
nop
call fcn.140001110
int3
call fcn.140001110
int3
call fcn.140001110
int3
call fcn.140001110
int3
call fcn.140001110
int3
call fcn.140001110
int3
call fcn.140001110
nop
call fcn.140006570
nop
call fcn.1400011b0
int3