Function at 0x14004c750
Capabilities:
Delete registry value
Delete volume shadow copies
Enumerate files on windows
Enumerate processes
Execute command
Get common file path
Get disk information
Persist via windows service
Query or enumerate registry key
Query or enumerate registry value
Read file on windows
Set registry value
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x21688]
mov eax, 0x21788
call fcn.1400c9ef0
sub rsp, rax
mov qword [rsp + 0x21780], rsi
mov qword [rsp + 0x21768], r13
mov qword [rsp + 0x21758], r15
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
lea rcx, [0x1400f4f38]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [0x1400f4f38]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtQueryKey
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r13d, r13d
lea r8, [rbp + 0x216a8]
lea rdx, str.SeTakeOwnershipPrivilege
mov qword [0x1401b4bc0], rax
xor ecx, ecx
mov qword [rbp + 0x216a8], r13
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x14004c810
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.SeTakeOwnershipPrivilege
lea rcx, str.Failed_to_lookup_privilege__ws:__d_n
call fcn.14000c200
lea rcx, str.failed_to_adjust_privilege_n
call fcn.14000c200
jmp 0x14004c8f2
mov rax, qword [rbp + 0x216a8]
mov qword [rsp + 0x7c], rax
mov dword [rsp + 0x78], 1
mov dword [rbp - 0x7c], 2
mov qword [rbp + 0x216a0], r13
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x216a0]
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x14004c873
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_open_current_process_token:__d_n
call fcn.14000c200
lea rcx, str.failed_to_adjust_privilege_n
call fcn.14000c200
jmp 0x14004c8f2
mov rcx, qword [rbp + 0x216a0]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x28], r13
mov r9d, reloc.WS2_32.dll_recv
xor edx, edx
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x14004c8b1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_adjust_current_process_token_privileges:__d_n
call fcn.14000c200
jmp 0x14004c8ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
jne 0x14004c8e5
lea rcx, str.Token_failed_to_acquire_privilege_n
call fcn.14000c200
mov rcx, qword [rbp + 0x216a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.failed_to_adjust_privilege_n
call fcn.14000c200
jmp 0x14004c8f2
mov rcx, qword [rbp + 0x216a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x21778], rdi
lea rax, [rbp + 0x216b8]
mov qword [rsp + 0x21770], r12
lea rdx, str.SYSTEMCurrentControlSetEnumDISPLAY
mov r9d, 0xf003f
mov qword [rsp + 0x21760], r14
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
mov qword [rbp + 0x216b8], r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14004c9a3
lea rcx, [0x1401b4f90]
mov dword [rbp + 0x216a0], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1401b4bc0]
lea r8, str.SYSTEMCurrentControlSetEnumDISPLAY
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004cccb
mov r15, qword [rbp + 0x216b8]
lea rcx, [rbp + 0x5c0]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], r13
lea r9, [rbp + 0x216b0]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x5c0]
mov qword [rsp + 0x28], r13
xor edx, edx
mov rcx, r15
mov qword [rsp + 0x20], r13
mov r12d, r13d
mov dword [rbp + 0x216b0], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14004ccc2
nop dword [rax + rax]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x5c0]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14004ca8d
lea rcx, [0x1401b4f90]
mov dword [rbp + 0x216a0], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, r15
call qword [0x1401b4bc0]
lea r8, [rbp + 0x5c0]
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004cc7f
mov rsi, qword [rsp + 0x48]
lea rcx, [rbp + 0x810]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], r13
lea r9, [rbp + 0x216a8]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x810]
mov qword [rsp + 0x28], r13
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], r13
mov r14d, r13d
mov dword [rbp + 0x216a8], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14004cc76
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x810]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14004cb6d
lea rcx, [0x1401b4f90]
mov dword [rbp + 0x216a0], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x1401b4bc0]
lea r8, [rbp + 0x810]
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004cc33
mov rdi, qword [rsp + 0x40]
lea rcx, [rbp + 0x1a0]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], r13
lea r9, [rbp + 0x216a0]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x1a0]
mov qword [rsp + 0x28], r13
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], r13
mov ebx, r13d
mov dword [rbp + 0x216a0], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14004cc2a
nop dword [rax]
lea rdx, str.device_parameters
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, rdi
test eax, eax
je 0x14004cc17
mov qword [rsp + 0x38], r13
lea r9, [rbp + 0x216a0]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x1a0]
inc ebx
mov qword [rsp + 0x28], r13
mov edx, ebx
mov qword [rsp + 0x20], r13
mov dword [rbp + 0x216a0], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14004cbc0
jmp 0x14004cc2a
lea r8, str.EDID
lea rdx, [rbp + 0x1a0]
call fcn.14004bc00
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], r13
lea r9, [rbp + 0x216a8]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x810]
inc r14d
mov qword [rsp + 0x28], r13
mov edx, r14d
mov qword [rsp + 0x20], r13
mov rcx, rsi
mov dword [rbp + 0x216a8], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14004cae0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], r13
lea r9, [rbp + 0x216b0]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x5c0]
inc r12d
mov qword [rsp + 0x28], r13
mov edx, r12d
mov qword [rsp + 0x20], r13
mov rcx, r15
mov dword [rbp + 0x216b0], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14004ca00
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, str.SMBiosData
mov rcx, 0xffffffff80000002
lea rdx, str.SYSTEMCurrentControlSetServicesmssmbiosData
call fcn.14004c150
lea rax, [rbp + 0x216a8]
mov qword [rbp + 0x216a8], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMHardwareConfig
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14004cd7e
lea rcx, [0x1401b4f90]
mov dword [rbp + 0x216a0], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1401b4bc0]
lea r8, str.SYSTEMHardwareConfig
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004ce73
lea rcx, [rbp + 0x3b0]
call sub.VCRUNTIME140.dll_memset
mov rdi, qword [rbp + 0x216a8]
lea r8, [rbp + 0x3b0]
mov rcx, rdi
lea rdx, str.LastConfig
call fcn.14004b5a0
xor edx, edx
lea rcx, [rbp + 0x5c0]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], r13
lea r9, [rbp + 0x216a0]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x5c0]
mov qword [rsp + 0x28], r13
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], r13
mov ebx, r13d
mov dword [rbp + 0x216a0], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14004ce6a
nop dword [rax]
lea rdx, str.current
lea rcx, [rbp + 0x5c0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, rdi
test eax, eax
jne 0x14004ce57
mov qword [rsp + 0x38], r13
lea r9, [rbp + 0x216a0]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x5c0]
inc ebx
mov qword [rsp + 0x28], r13
mov edx, ebx
mov qword [rsp + 0x20], r13
mov dword [rbp + 0x216a0], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14004ce00
jmp 0x14004ce6a
lea r8, [rbp + 0x3b0]
lea rdx, [rbp + 0x5c0]
call fcn.14004be30
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x216a8]
mov qword [rbp + 0x216a8], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWARENVIDIA_CorporationGlobal
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14004cf09
lea rcx, [0x1401b4f90]
mov dword [rbp + 0x216a0], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1401b4bc0]
lea r8, str.SOFTWARENVIDIA_CorporationGlobal
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004cf3b
mov rbx, qword [rbp + 0x216a8]
lea rcx, [rbp + 0x3b0]
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x3b0]
mov rcx, rbx
lea rdx, str.ClientUUID
call fcn.14004b5a0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x216a8]
mov qword [rbp + 0x216a8], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWARENVIDIA_CorporationGlobal
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14004cfd1
lea rcx, [0x1401b4f90]
mov dword [rbp + 0x216a0], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1401b4bc0]
lea r8, str.SOFTWARENVIDIA_CorporationGlobal
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004d003
mov rbx, qword [rbp + 0x216a8]
lea rcx, [rbp + 0x3b0]
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x3b0]
mov rcx, rbx
lea rdx, str.PersistenceIdentifier
call fcn.14004b5a0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x216a8]
mov qword [rbp + 0x216a8], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWARENVIDIA_CorporationGlobalCoProcManager
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14004d099
lea rcx, [0x1401b4f90]
mov dword [rbp + 0x216a0], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1401b4bc0]
lea r8, str.SOFTWARENVIDIA_CorporationGlobalCoProcManager
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004d0cb
mov rbx, qword [rbp + 0x216a8]
lea rcx, [rbp + 0x3b0]
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x3b0]
mov rcx, rbx
lea rdx, str.ChipsetMatchID
call fcn.14004b5a0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.SYSTEMMountedDevices
mov rcx, 0xffffffff80000002
call fcn.14004c070
lea rdx, str.SOFTWAREMicrosoftDfrgStatistics
mov rcx, 0xffffffff80000002
call fcn.14004c070
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBitBucketVolume
mov rcx, 0xffffffff80000001
call fcn.14004c070
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerMountPoints2CPCVolume
mov rcx, 0xffffffff80000001
call fcn.14004c070
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerMountPoints2
mov rcx, 0xffffffff80000001
call fcn.14004c070
lea r8, str.LastEnum
mov rcx, 0xffffffff80000001
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBitBucket
call fcn.14004c150
lea rax, [rbp + 0x216b0]
mov qword [rbp + 0x216b0], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesTPMWMI
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14004d1e0
xor edx, edx
mov dword [rbp + 0x216a0], 0x208
mov r8d, 0x208
lea rcx, [0x1401b4f90]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1401b4bc0]
lea r8, str.SYSTEMCurrentControlSetServicesTPMWMI
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004d382
mov rsi, qword [rbp + 0x216b0]
lea rax, [rbp + 0x216a0]
mov qword [rsp + 0x28], rax
lea rdx, str.WindowsAIKHash
mov rcx, rsi
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov dword [rbp + 0x216a0], r13d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14004d27d
xor edx, edx
mov dword [rbp + 0x216a8], 0x208
mov r8d, 0x208
lea rcx, [0x1401b4f90]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a8]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x1401b4bc0]
lea r8, str.WindowsAIKHash
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_query_size_of:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004d379
mov ecx, dword [rbp + 0x216a0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x14004d2a2
lea rcx, str.Failed_to_allocate_buffer_for_SpoofBinary_n_n
call fcn.14000c200
jmp 0x14004d379
mov eax, dword [rbp + 0x216a0]
mov ebx, r13d
test eax, eax
je 0x14004d2d7
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x14004d2c6
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov eax, dword [rbp + 0x216a0]
cmp ebx, eax
jb 0x14004d2b0
mov dword [rsp + 0x28], eax
lea rdx, str.WindowsAIKHash
mov r9d, 3
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ebx, dword [rbp + 0x216a0]
lea rcx, [0x1401b4f90]
xor edx, edx
mov dword [rbp + 0x216a8], 0x208
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a8]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x1401b4bc0]
mov r9d, 0xc0
mov dword [rsp + 0x28], ebx
lea r8, str.WindowsAIKHash
mov dword [rsp + 0x20], Ordinal_200
lea rdx, [0x1401b4f96]
lea rcx, str._ws_ws_n_c_c_binary_of_length__d_n_n
call fcn.14000c200
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x216b0]
mov qword [rbp + 0x216b0], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftDirect3D
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14004d41e
xor edx, edx
mov dword [rbp + 0x216a0], 0x208
mov r8d, 0x208
lea rcx, [0x1401b4f90]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000001
call qword [0x1401b4bc0]
lea r8, str.SoftwareMicrosoftDirect3D
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004d5c2
mov rsi, qword [rbp + 0x216b0]
lea rax, [rbp + 0x216a0]
mov qword [rsp + 0x28], rax
lea rdx, str.WHQLClass
mov rcx, rsi
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov dword [rbp + 0x216a0], r13d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14004d4bb
xor edx, edx
mov dword [rbp + 0x216a8], 0x208
mov r8d, 0x208
lea rcx, [0x1401b4f90]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a8]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x1401b4bc0]
lea r8, str.WHQLClass
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_query_size_of:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004d5b9
mov ecx, dword [rbp + 0x216a0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x14004d4e0
lea rcx, str.Failed_to_allocate_buffer_for_SpoofBinary_n_n
call fcn.14000c200
jmp 0x14004d5b9
mov eax, dword [rbp + 0x216a0]
mov ebx, r13d
test eax, eax
je 0x14004d517
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x14004d506
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov eax, dword [rbp + 0x216a0]
cmp ebx, eax
jb 0x14004d4f0
mov dword [rsp + 0x28], eax
lea rdx, str.WHQLClass
mov r9d, 3
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ebx, dword [rbp + 0x216a0]
lea rcx, [0x1401b4f90]
xor edx, edx
mov dword [rbp + 0x216a8], 0x208
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a8]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x1401b4bc0]
mov r9d, 0xc0
mov dword [rsp + 0x28], ebx
lea r8, str.WHQLClass
mov dword [rsp + 0x20], Ordinal_200
lea rdx, [0x1401b4f96]
lea rcx, str._ws_ws_n_c_c_binary_of_length__d_n_n
call fcn.14000c200
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x216b0]
mov qword [rbp + 0x216b0], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareClassesInstallerDependencies
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14004d65e
xor edx, edx
mov dword [rbp + 0x216a0], 0x208
mov r8d, 0x208
lea rcx, [0x1401b4f90]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000001
call qword [0x1401b4bc0]
lea r8, str.SoftwareClassesInstallerDependencies
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004d802
mov rsi, qword [rbp + 0x216b0]
lea rax, [rbp + 0x216a0]
mov qword [rsp + 0x28], rax
lea rdx, str.MSICache
mov rcx, rsi
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov dword [rbp + 0x216a0], r13d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14004d6fb
xor edx, edx
mov dword [rbp + 0x216a8], 0x208
mov r8d, 0x208
lea rcx, [0x1401b4f90]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a8]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x1401b4bc0]
lea r8, str.MSICache
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_query_size_of:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004d7f9
mov ecx, dword [rbp + 0x216a0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x14004d720
lea rcx, str.Failed_to_allocate_buffer_for_SpoofBinary_n_n
call fcn.14000c200
jmp 0x14004d7f9
mov eax, dword [rbp + 0x216a0]
mov ebx, r13d
test eax, eax
je 0x14004d757
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x14004d746
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov eax, dword [rbp + 0x216a0]
cmp ebx, eax
jb 0x14004d730
mov dword [rsp + 0x28], eax
lea rdx, str.MSICache
mov r9d, 3
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ebx, dword [rbp + 0x216a0]
lea rcx, [0x1401b4f90]
xor edx, edx
mov dword [rbp + 0x216a8], 0x208
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a8]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x1401b4bc0]
mov r9d, 0xc0
mov dword [rsp + 0x28], ebx
lea r8, str.MSICache
mov dword [rsp + 0x20], Ordinal_200
lea rdx, [0x1401b4f96]
lea rcx, str._ws_ws_n_c_c_binary_of_length__d_n_n
call fcn.14000c200
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x216b0]
mov qword [rbp + 0x216b0], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystemMultifunctionAdapter0DiskController0DiskPeripheral
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14004d89b
lea rcx, [0x1401b4f90]
mov dword [rbp + 0x216a0], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1401b4bc0]
lea r8, str.HARDWAREDESCRIPTIONSystemMultifunctionAdapter0DiskController0DiskPeripheral
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004d9fa
mov rdi, qword [rbp + 0x216b0]
lea rcx, [rbp + 0x5c0]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], r13
lea r9, [rbp + 0x216a0]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x5c0]
mov qword [rsp + 0x28], r13
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], r13
mov esi, r13d
mov dword [rbp + 0x216a0], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14004d9f1
lea rax, [rbp + 0x216b8]
mov qword [rbp + 0x216b8], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x5c0]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14004d97e
lea rcx, [0x1401b4f90]
mov dword [rbp + 0x216a8], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a8]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rdi
call qword [0x1401b4bc0]
lea r8, [rbp + 0x5c0]
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004d9b0
mov rbx, qword [rbp + 0x216b8]
lea rcx, [rbp + 0x3b0]
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x3b0]
mov rcx, rbx
lea rdx, str.Identifier
call fcn.14004b5a0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], r13
lea r9, [rbp + 0x216a0]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x5c0]
inc esi
mov qword [rsp + 0x28], r13
mov edx, esi
mov qword [rsp + 0x20], r13
mov rcx, rdi
mov dword [rbp + 0x216a0], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14004d8f0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.HARDWAREDEVICEMAPScsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14004da8f
lea rcx, [0x1401b4f90]
mov dword [rbp + 0x216a0], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1401b4bc0]
lea r8, str.HARDWAREDEVICEMAPScsi
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004dfb4
mov rbx, qword [rsp + 0x50]
lea rcx, [rbp + 0x3b0]
mov qword [rsp + 0x78], rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], r13
lea r9, [rbp + 0x216b8]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x3b0]
mov qword [rsp + 0x28], r13
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], r13
mov edi, r13d
mov dword [rsp + 0x40], r13d
mov dword [rbp + 0x216b8], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14004dfab
nop dword [rax]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x58], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x3b0]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14004db7d
lea rcx, [0x1401b4f90]
mov dword [rbp + 0x216a0], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rbx
call qword [0x1401b4bc0]
lea r8, [rbp + 0x3b0]
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004df66
mov r12, qword [rsp + 0x58]
lea rcx, [rbp + 0x810]
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [rbp + 0x216b0], 0x208
mov qword [rsp + 0x38], rax
lea r9, [rbp + 0x216b0]
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x810]
mov qword [rsp + 0x28], rax
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14004df5a
xor ebx, ebx
nop dword [rax]
nop word [rax + rax]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], rbx
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x810]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14004dc6d
lea rcx, [0x1401b4f90]
mov dword [rbp + 0x216a0], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, r12
call qword [0x1401b4bc0]
lea r8, [rbp + 0x810]
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004df0e
mov r14, qword [rsp + 0x60]
lea rcx, [rbp + 0x1a0]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], rbx
lea r9, [rbp + 0x216a8]
mov qword [rsp + 0x30], rbx
lea r8, [rbp + 0x1a0]
mov qword [rsp + 0x28], rbx
xor edx, edx
mov rcx, r14
mov qword [rsp + 0x20], rbx
mov r15d, ebx
mov dword [rbp + 0x216a8], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14004df05
lea rdx, str.arget
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x14004dec2
lea rax, [rsp + 0x68]
mov qword [rsp + 0x68], rbx
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x1a0]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14004dd6a
lea rcx, [0x1401b4f90]
mov dword [rbp + 0x216a0], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, r14
call qword [0x1401b4bc0]
lea r8, [rbp + 0x1a0]
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004dec2
mov rdi, qword [rsp + 0x68]
lea rcx, [rbp + 0x5c0]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], rbx
lea r9, [rbp + 0x216a0]
mov qword [rsp + 0x30], rbx
lea r8, [rbp + 0x5c0]
mov qword [rsp + 0x28], rbx
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rbx
mov esi, ebx
mov dword [rbp + 0x216a0], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14004deb9
nop dword [rax]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x70], rbx
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x5c0]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14004de46
lea rcx, [0x1401b4f90]
mov dword [rsp + 0x48], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x48]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rdi
call qword [0x1401b4bc0]
lea r8, [rbp + 0x5c0]
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004de78
mov rbx, qword [rsp + 0x70]
lea rcx, [rbp + 0x1050]
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x1050]
mov rcx, rbx
lea rdx, str.Identifier
call fcn.14004b5a0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov qword [rsp + 0x38], rbx
lea r9, [rbp + 0x216a0]
mov qword [rsp + 0x30], rbx
lea r8, [rbp + 0x5c0]
inc esi
mov qword [rsp + 0x28], rbx
mov edx, esi
mov qword [rsp + 0x20], rbx
mov rcx, rdi
mov dword [rbp + 0x216a0], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14004ddc0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], rbx
lea r9, [rbp + 0x216a8]
mov qword [rsp + 0x30], rbx
lea r8, [rbp + 0x1a0]
inc r15d
mov qword [rsp + 0x28], rbx
mov edx, r15d
mov qword [rsp + 0x20], rbx
mov rcx, r14
mov dword [rbp + 0x216a8], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14004dcc0
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], rbx
lea r9, [rbp + 0x216b0]
mov qword [rsp + 0x30], rbx
lea r8, [rbp + 0x810]
inc r13d
mov qword [rsp + 0x28], rbx
mov edx, r13d
mov qword [rsp + 0x20], rbx
mov rcx, r12
mov dword [rbp + 0x216b0], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14004dbe0
mov rbx, qword [rsp + 0x78]
mov edi, dword [rsp + 0x40]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r13d, r13d
mov qword [rsp + 0x38], r13
lea r9, [rbp + 0x216b8]
inc edi
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
lea r8, [rbp + 0x3b0]
mov edx, edi
mov qword [rsp + 0x20], r13
mov rcx, rbx
mov dword [rsp + 0x40], edi
mov dword [rbp + 0x216b8], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14004daf0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x216b0]
mov qword [rbp + 0x216b0], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesTPMODUID
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14004e050
xor edx, edx
mov dword [rbp + 0x216a0], 0x208
mov r8d, 0x208
lea rcx, [0x1401b4f90]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1401b4bc0]
lea r8, str.SYSTEMCurrentControlSetServicesTPMODUID
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004e1f2
mov rsi, qword [rbp + 0x216b0]
lea rax, [rbp + 0x216a0]
mov qword [rsp + 0x28], rax
lea rdx, str.RandomSeed
mov rcx, rsi
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov dword [rbp + 0x216a0], r13d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14004e0ed
xor edx, edx
mov dword [rbp + 0x216a8], 0x208
mov r8d, 0x208
lea rcx, [0x1401b4f90]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a8]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x1401b4bc0]
lea r8, str.RandomSeed
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_query_size_of:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004e1e9
mov ecx, dword [rbp + 0x216a0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x14004e112
lea rcx, str.Failed_to_allocate_buffer_for_SpoofBinary_n_n
call fcn.14000c200
jmp 0x14004e1e9
mov eax, dword [rbp + 0x216a0]
mov ebx, r13d
test eax, eax
je 0x14004e147
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x14004e136
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov eax, dword [rbp + 0x216a0]
cmp ebx, eax
jb 0x14004e120
mov dword [rsp + 0x28], eax
lea rdx, str.RandomSeed
mov r9d, 3
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ebx, dword [rbp + 0x216a0]
lea rcx, [0x1401b4f90]
xor edx, edx
mov dword [rbp + 0x216a8], 0x208
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a8]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x1401b4bc0]
mov r9d, 0xc0
mov dword [rsp + 0x28], ebx
lea r8, str.RandomSeed
mov dword [rsp + 0x20], Ordinal_200
lea rdx, [0x1401b4f96]
lea rcx, str._ws_ws_n_c_c_binary_of_length__d_n_n
call fcn.14000c200
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x216a8]
mov qword [rbp + 0x216a8], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftCryptography
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14004e288
lea rcx, [0x1401b4f90]
mov dword [rbp + 0x216a0], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1401b4bc0]
lea r8, str.SOFTWAREMicrosoftCryptography
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004e2ba
mov rbx, qword [rbp + 0x216a8]
lea rcx, [rbp + 0x1050]
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x1050]
mov rcx, rbx
lea rdx, str.MachineGuid
call fcn.14004b5a0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x216a8]
mov qword [rbp + 0x216a8], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlIDConfigDBHardware_Profiles0001
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14004e350
lea rcx, [0x1401b4f90]
mov dword [rbp + 0x216a0], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1401b4bc0]
lea r8, str.SYSTEMCurrentControlSetControlIDConfigDBHardware_Profiles0001
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004e382
mov rbx, qword [rbp + 0x216a8]
lea rcx, [rbp + 0x1050]
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x1050]
mov rcx, rbx
lea rdx, str.HwProfileGuid
call fcn.14004b5a0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x216a8]
mov qword [rbp + 0x216a8], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14004e418
lea rcx, [0x1401b4f90]
mov dword [rbp + 0x216a0], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1401b4bc0]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004e44a
mov rbx, qword [rbp + 0x216a8]
lea rcx, [rbp + 0x1050]
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x1050]
mov rcx, rbx
lea rdx, str.AccountDomainSid
call fcn.14004b5a0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x216a8]
mov qword [rbp + 0x216a8], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14004e4e0
lea rcx, [0x1401b4f90]
mov dword [rbp + 0x216a0], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1401b4bc0]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004e512
mov rbx, qword [rbp + 0x216a8]
lea rcx, [rbp + 0x1050]
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x1050]
mov rcx, rbx
lea rdx, str.PingID
call fcn.14004b5a0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x216a8]
mov qword [rbp + 0x216a8], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14004e5a8
lea rcx, [0x1401b4f90]
mov dword [rbp + 0x216a0], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1401b4bc0]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004e5da
mov rbx, qword [rbp + 0x216a8]
lea rcx, [rbp + 0x1050]
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x1050]
mov rcx, rbx
lea rdx, str.SusClientId
call fcn.14004b5a0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x216b0]
mov qword [rbp + 0x216b0], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14004e676
xor edx, edx
mov dword [rbp + 0x216a0], 0x208
mov r8d, 0x208
lea rcx, [0x1401b4f90]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1401b4bc0]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004e817
mov rsi, qword [rbp + 0x216b0]
lea rax, [rbp + 0x216a0]
mov qword [rsp + 0x28], rax
lea rdx, str.SusClientIdValidation
mov rcx, rsi
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov dword [rbp + 0x216a0], r13d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14004e713
xor edx, edx
mov dword [rbp + 0x216a8], 0x208
mov r8d, 0x208
lea rcx, [0x1401b4f90]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a8]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x1401b4bc0]
lea r8, str.SusClientIdValidation
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_query_size_of:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004e80e
mov ecx, dword [rbp + 0x216a0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x14004e738
lea rcx, str.Failed_to_allocate_buffer_for_SpoofBinary_n_n
call fcn.14000c200
jmp 0x14004e80e
mov eax, dword [rbp + 0x216a0]
mov ebx, r13d
test eax, eax
je 0x14004e76c
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x14004e75b
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov eax, dword [rbp + 0x216a0]
cmp ebx, eax
jb 0x14004e745
mov dword [rsp + 0x28], eax
lea rdx, str.SusClientIdValidation
mov r9d, 3
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ebx, dword [rbp + 0x216a0]
lea rcx, [0x1401b4f90]
xor edx, edx
mov dword [rbp + 0x216a8], 0x208
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a8]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x1401b4bc0]
mov r9d, 0xc0
mov dword [rsp + 0x28], ebx
lea r8, str.SusClientIdValidation
mov dword [rsp + 0x20], Ordinal_200
lea rdx, [0x1401b4f96]
lea rcx, str._ws_ws_n_c_c_binary_of_length__d_n_n
call fcn.14000c200
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x216b0]
mov qword [rbp + 0x216b0], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesTcpip6Parameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14004e8b3
xor edx, edx
mov dword [rbp + 0x216a0], 0x208
mov r8d, 0x208
lea rcx, [0x1401b4f90]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1401b4bc0]
lea r8, str.SYSTEMCurrentControlSetServicesTcpip6Parameters
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004ea54
mov rsi, qword [rbp + 0x216b0]
lea rax, [rbp + 0x216a0]
mov qword [rsp + 0x28], rax
lea rdx, str.Dhcpv6DUID
mov rcx, rsi
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov dword [rbp + 0x216a0], r13d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14004e950
xor edx, edx
mov dword [rbp + 0x216a8], 0x208
mov r8d, 0x208
lea rcx, [0x1401b4f90]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a8]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x1401b4bc0]
lea r8, str.Dhcpv6DUID
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_query_size_of:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004ea4b
mov ecx, dword [rbp + 0x216a0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x14004e975
lea rcx, str.Failed_to_allocate_buffer_for_SpoofBinary_n_n
call fcn.14000c200
jmp 0x14004ea4b
mov eax, dword [rbp + 0x216a0]
mov ebx, r13d
test eax, eax
je 0x14004e9a9
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x14004e998
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov eax, dword [rbp + 0x216a0]
cmp ebx, eax
jb 0x14004e982
mov dword [rsp + 0x28], eax
lea rdx, str.Dhcpv6DUID
mov r9d, 3
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ebx, dword [rbp + 0x216a0]
lea rcx, [0x1401b4f90]
xor edx, edx
mov dword [rbp + 0x216a8], 0x208
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a8]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x1401b4bc0]
mov r9d, 0xc0
mov dword [rsp + 0x28], ebx
lea r8, str.Dhcpv6DUID
mov dword [rsp + 0x20], Ordinal_200
lea rdx, [0x1401b4f96]
lea rcx, str._ws_ws_n_c_c_binary_of_length__d_n_n
call fcn.14000c200
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x216a8]
mov qword [rbp + 0x216a8], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlSystemInformation
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14004eaea
lea rcx, [0x1401b4f90]
mov dword [rbp + 0x216a0], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1401b4bc0]
lea r8, str.SYSTEMCurrentControlSetControlSystemInformation
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004eb1c
mov rbx, qword [rbp + 0x216a8]
lea rcx, [rbp + 0x1050]
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x1050]
mov rcx, rbx
lea rdx, str.ComputerHardwareId
call fcn.14004b5a0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.14004b770
lea rax, [rbp + 0x216b0]
mov qword [rbp + 0x216b0], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftInternet_ExplorerMigration
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14004ebbd
xor edx, edx
mov dword [rbp + 0x216a0], 0x208
mov r8d, 0x208
lea rcx, [0x1401b4f90]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1401b4bc0]
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerMigration
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004ed62
mov rsi, qword [rbp + 0x216b0]
lea rax, [rbp + 0x216a0]
mov qword [rsp + 0x28], rax
lea rdx, str.IE_Installed_Date
mov rcx, rsi
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov dword [rbp + 0x216a0], r13d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14004ec5a
xor edx, edx
mov dword [rbp + 0x216a8], 0x208
mov r8d, 0x208
lea rcx, [0x1401b4f90]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a8]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x1401b4bc0]
lea r8, str.IE_Installed_Date
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_query_size_of:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004ed59
mov ecx, dword [rbp + 0x216a0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x14004ec7f
lea rcx, str.Failed_to_allocate_buffer_for_SpoofBinary_n_n
call fcn.14000c200
jmp 0x14004ed59
mov eax, dword [rbp + 0x216a0]
mov ebx, r13d
test eax, eax
je 0x14004ecb7
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x14004eca6
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov eax, dword [rbp + 0x216a0]
cmp ebx, eax
jb 0x14004ec90
mov dword [rsp + 0x28], eax
lea rdx, str.IE_Installed_Date
mov r9d, 3
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ebx, dword [rbp + 0x216a0]
lea rcx, [0x1401b4f90]
xor edx, edx
mov dword [rbp + 0x216a8], 0x208
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a8]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x1401b4bc0]
mov r9d, 0xc0
mov dword [rsp + 0x28], ebx
lea r8, str.IE_Installed_Date
mov dword [rsp + 0x20], Ordinal_200
lea rdx, [0x1401b4f96]
lea rcx, str._ws_ws_n_c_c_binary_of_length__d_n_n
call fcn.14000c200
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x216a8]
mov qword [rbp + 0x216a8], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftSQMClient
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14004edf8
lea rcx, [0x1401b4f90]
mov dword [rbp + 0x216a0], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1401b4bc0]
lea r8, str.SOFTWAREMicrosoftSQMClient
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004ee2a
mov rbx, qword [rbp + 0x216a8]
lea rcx, [rbp + 0x1050]
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x1050]
mov rcx, rbx
lea rdx, str.MachineId
call fcn.14004b5a0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, str.WinSqmFirstSessionStartTime
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftSQMClient
call fcn.14004ba50
lea r8, str.InstallTime
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
call fcn.14004ba50
lea r8, str.InstallDate
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
call fcn.14004ba50
lea rax, [rbp + 0x216b0]
mov qword [rbp + 0x216b0], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14004ef14
xor edx, edx
mov dword [rbp + 0x216a0], 0x208
mov r8d, 0x208
lea rcx, [0x1401b4f90]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1401b4bc0]
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004f0b5
mov rsi, qword [rbp + 0x216b0]
lea rax, [rbp + 0x216a0]
mov qword [rsp + 0x28], rax
lea rdx, str.DigitalProductId
mov rcx, rsi
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov dword [rbp + 0x216a0], r13d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14004efb1
xor edx, edx
mov dword [rbp + 0x216a8], 0x208
mov r8d, 0x208
lea rcx, [0x1401b4f90]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a8]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x1401b4bc0]
lea r8, str.DigitalProductId
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_query_size_of:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004f0ac
mov ecx, dword [rbp + 0x216a0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x14004efd6
lea rcx, str.Failed_to_allocate_buffer_for_SpoofBinary_n_n
call fcn.14000c200
jmp 0x14004f0ac
mov eax, dword [rbp + 0x216a0]
mov ebx, r13d
test eax, eax
je 0x14004f00a
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x14004eff9
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov eax, dword [rbp + 0x216a0]
cmp ebx, eax
jb 0x14004efe3
mov dword [rsp + 0x28], eax
lea rdx, str.DigitalProductId
mov r9d, 3
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ebx, dword [rbp + 0x216a0]
lea rcx, [0x1401b4f90]
xor edx, edx
mov dword [rbp + 0x216a8], 0x208
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a8]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x1401b4bc0]
mov r9d, 0xc0
mov dword [rsp + 0x28], ebx
lea r8, str.DigitalProductId
mov dword [rsp + 0x20], Ordinal_200
lea rdx, [0x1401b4f96]
lea rcx, str._ws_ws_n_c_c_binary_of_length__d_n_n
call fcn.14000c200
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x216b0]
mov qword [rbp + 0x216b0], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14004f151
xor edx, edx
mov dword [rbp + 0x216a0], 0x208
mov r8d, 0x208
lea rcx, [0x1401b4f90]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1401b4bc0]
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004f2f2
mov rsi, qword [rbp + 0x216b0]
lea rax, [rbp + 0x216a0]
mov qword [rsp + 0x28], rax
lea rdx, str.DigitalProductId4
mov rcx, rsi
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov dword [rbp + 0x216a0], r13d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14004f1ee
xor edx, edx
mov dword [rbp + 0x216a8], 0x208
mov r8d, 0x208
lea rcx, [0x1401b4f90]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a8]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x1401b4bc0]
lea r8, str.DigitalProductId4
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_query_size_of:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004f2e9
mov ecx, dword [rbp + 0x216a0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x14004f213
lea rcx, str.Failed_to_allocate_buffer_for_SpoofBinary_n_n
call fcn.14000c200
jmp 0x14004f2e9
mov eax, dword [rbp + 0x216a0]
mov ebx, r13d
test eax, eax
je 0x14004f247
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x14004f236
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov eax, dword [rbp + 0x216a0]
cmp ebx, eax
jb 0x14004f220
mov dword [rsp + 0x28], eax
lea rdx, str.DigitalProductId4
mov r9d, 3
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ebx, dword [rbp + 0x216a0]
lea rcx, [0x1401b4f90]
xor edx, edx
mov dword [rbp + 0x216a8], 0x208
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a8]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x1401b4bc0]
mov r9d, 0xc0
mov dword [rsp + 0x28], ebx
lea r8, str.DigitalProductId4
mov dword [rsp + 0x20], Ordinal_200
lea rdx, [0x1401b4f96]
lea rcx, str._ws_ws_n_c_c_binary_of_length__d_n_n
call fcn.14000c200
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x216a8]
mov qword [rbp + 0x216a8], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14004f388
lea rcx, [0x1401b4f90]
mov dword [rbp + 0x216a0], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1401b4bc0]
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004f3ba
mov rbx, qword [rbp + 0x216a8]
lea rcx, [rbp + 0x1050]
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x1050]
mov rcx, rbx
lea rdx, str.BuildGUID
call fcn.14004b5a0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x216a8]
mov qword [rbp + 0x216a8], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14004f450
lea rcx, [0x1401b4f90]
mov dword [rbp + 0x216a0], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1401b4bc0]
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004f482
mov rbx, qword [rbp + 0x216a8]
lea rcx, [rbp + 0x1050]
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x1050]
mov rcx, rbx
lea rdx, str.ProductId
call fcn.14004b5a0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x216a8]
mov qword [rbp + 0x216a8], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14004f518
lea rcx, [0x1401b4f90]
mov dword [rbp + 0x216a0], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1401b4bc0]
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004f54a
mov rbx, qword [rbp + 0x216a8]
lea rcx, [rbp + 0x1050]
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x1050]
mov rcx, rbx
lea rdx, str.BuildLab
call fcn.14004b5a0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x216a8]
mov qword [rbp + 0x216a8], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14004f5e0
lea rcx, [0x1401b4f90]
mov dword [rbp + 0x216a0], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1401b4bc0]
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004f612
mov rbx, qword [rbp + 0x216a8]
lea rcx, [rbp + 0x1050]
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x1050]
mov rcx, rbx
lea rdx, str.BuildLabEx
call fcn.14004b5a0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x216a8]
mov qword [rbp + 0x216a8], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14004f6a8
lea rcx, [0x1401b4f90]
mov dword [rbp + 0x216a0], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1401b4bc0]
lea r8, str.SYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004f6da
mov rbx, qword [rbp + 0x216a8]
lea rcx, [rbp + 0x1050]
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x1050]
mov rcx, rbx
lea rdx, str._DriverProviderInfo
call fcn.14004b5a0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x216a8]
mov qword [rbp + 0x216a8], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14004f770
lea rcx, [0x1401b4f90]
mov dword [rbp + 0x216a0], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1401b4bc0]
lea r8, str.SYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be103180000
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004f7a2
mov rbx, qword [rbp + 0x216a8]
lea rcx, [rbp + 0x1050]
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x1050]
mov rcx, rbx
lea rdx, str.UserModeDriverGUID
call fcn.14004b5a0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x216b0]
mov qword [rbp + 0x216b0], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e972_e325_11ce_bfc1_08002be10318
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov r8d, 0x208
test eax, eax
je 0x14004f83b
lea rcx, [0x1401b4f90]
mov dword [rbp + 0x216a0], r8d
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1401b4bc0]
lea r8, str.SYSTEMCurrentControlSetControlClass4d36e972_e325_11ce_bfc1_08002be10318
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004fa11
mov rbx, qword [rbp + 0x216b0]
lea rcx, [rbp + 0x1a0]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], r13
lea r9, [rbp + 0x216a0]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x1a0]
mov qword [rsp + 0x28], r13
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], r13
mov edi, r13d
mov dword [rbp + 0x216a0], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14004fa08
lea rdx, str.configuration
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14004f9c7
lea rdx, str.properties
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14004f9c7
lea r8, str.NetworkAddress
mov rcx, rbx
lea rdx, [rbp + 0x1a0]
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
cmp eax, 2
je 0x14004f9b1
xor edx, edx
mov dword [rbp + 0x216a8], 0x208
lea rcx, [0x1401b4f90]
mov r8d, 0x208
test eax, eax
jne 0x14004f964
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a8]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rbx
call qword [0x1401b4bc0]
lea r9, str.NetworkAddress
mov dword [rsp + 0x28], Ordinal_200
lea r8, [rbp + 0x1a0]
mov dword [rsp + 0x20], 0xc0
lea rdx, [0x1401b4f96]
lea rcx, str._ws_ws_ws_n_c_c_deleted_n_n
call fcn.14000c200
jmp 0x14004f9b1
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a8]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rbx
call qword [0x1401b4bc0]
lea r9, str.NetworkAddress
lea r8, [rbp + 0x1a0]
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_delete_value:__ws_ws_ws_n_n
call fcn.14000c200
lea r8, str.NetworkInterfaceInstallTimestamp
mov rcx, rbx
lea rdx, [rbp + 0x1a0]
call fcn.14004ba50
mov qword [rsp + 0x38], r13
lea r9, [rbp + 0x216a0]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x1a0]
inc edi
mov qword [rsp + 0x28], r13
mov edx, edi
mov qword [rsp + 0x20], r13
mov rcx, rbx
mov dword [rbp + 0x216a0], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14004f890
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionDiagnosticsDiagTrackSettingsRequests
mov rcx, 0xffffffff80000002
call fcn.14004c070
lea r8, str.LastEventlogWrittenTime
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionDiagnosticsDiagTrackSevilleEventlogManager
call fcn.14004ba50
lea r8, str.ProductActivationTime
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatformActivation
call fcn.14004ba50
lea r8, str.BackupProductKeyDefault
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform
call fcn.14004c150
lea r8, str.actionlist
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform
call fcn.14004c150
lea r8, str.ServiceSessionId
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform
call fcn.14004c150
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist
mov rcx, 0xffffffff80000001
call fcn.14004c070
lea rdx, str.SoftwareHex_RaysIDAHistory
mov rcx, 0xffffffff80000001
call fcn.14004c070
lea rdx, str.SoftwareHex_RaysIDAHistory64
mov rcx, 0xffffffff80000001
call fcn.14004c070
lea rax, [rbp + 0x216a8]
mov qword [rbp + 0x216a8], r13
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.HARDWAREUEFIESRT
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
test eax, eax
je 0x14004fb7b
mov r8d, 0x208
mov dword [rbp + 0x216a0], 0x208
lea rcx, [0x1401b4f90]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x216a0]
mov r9d, 0x208
lea r8, [0x1401b4f90]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, 0xffffffff80000002
call qword [0x1401b4bc0]
lea r8, str.HARDWAREUEFIESRT
lea rdx, [0x1401b4f96]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000c200
jmp 0x14004fd92
mov r15, qword [rbp + 0x216a8]
lea rcx, [rbp + 0x1050]
mov r8d, 0x205f8
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0x3b0]
mov r8d, 0x208
mov ebx, r13d
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], r13
lea r9, [rbp + 0x216a0]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x3b0]
mov qword [rsp + 0x28], r13
xor edx, edx
mov rcx, r15
mov qword [rsp + 0x20], r13
mov edi, r13d
mov dword [rbp + 0x216a0], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14004fc6e
nop dword [rax]
mov eax, ebx
lea r8, [rbp + 0x1050]
imul rcx, rax, 0x208
inc ebx
lea rax, [rbp + 0x3b0]
add r8, rcx
lea rdx, [rbp + 0x3b0]
sub r8, rax
nop word [rax + rax]
movzx eax, word [rdx]
mov word [r8 + rdx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x14004fc20
mov qword [rsp + 0x38], r13
lea r9, [rbp + 0x216a0]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x3b0]
inc edi
mov qword [rsp + 0x28], r13
mov edx, edi
mov qword [rsp + 0x20], r13
mov rcx, r15
mov dword [rbp + 0x216a0], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14004fbf0
test ebx, ebx
je 0x14004fd89
lea rsi, [rbp + 0x1a0]
mov r12d, ebx
lea rax, [rbp + 0x1050]
sub rsi, rax
lea r14, [rbp + 0x1050]
xor edx, edx
lea rcx, [rbp + 0x1a0]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov rcx, r14
nop dword [rax + rax]
movzx eax, word [rcx]
mov word [rsi + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x14004fcb0
mov ebx, r13d
lea rcx, [rbp + 0x1a0]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x14004fcd1
test rax, rax
je 0x14004fd5f
mov rcx, r13
nop dword [rax]
nop word [rax + rax]
lea rdi, [rbp + 0x1a0]
lea rdi, [rdi + rcx*2]
movzx ecx, word [rdi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswxdigit]
test eax, eax
je 0x14004fd38
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdqe
mov rcx, 0xffffffffffffffff
lea r8, str.abcdef012345789
nop
inc rcx
cmp word [r8 + rcx*2], 0
jne 0x14004fd20
xor edx, edx
div rcx
movzx eax, word [r8 + rdx*2]
mov word [rdi], ax
inc ebx
lea rdx, [rbp + 0x1a0]
mov ecx, ebx
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x14004fd50
cmp rcx, rax
jb 0x14004fcf0
lea r8, [rbp + 0x1a0]
mov rdx, r14
mov rcx, r15
call fcn.14004be30
add r14, 0x208
sub rsi, 0x208
sub r12, 1
jne 0x14004fc91
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
lea rcx, [rbp - 0x70]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0xc30]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0xe40]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0xa20]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0xc30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov r9d, 1
lea rax, [rbp + 0xe40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x19]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov r9d, 1
lea rax, [rbp + 0xa20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x1b]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea r8, [rbp + 0xc30]
lea rdx, str._ws
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea rcx, [rbp + 0x1050]
mov r8d, 0x250
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x1050]
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
nop dword [rax]
nop word [rax + rax]
movzx edx, word [rbp + 0x107c]
movzx ecx, word [rbp + 0x107e]
cmp dx, 0x2e
jne 0x14004fead
test cx, cx
je 0x14004fed5
cmp dx, dx
jne 0x14004fead
cmp cx, dx
jne 0x14004fead
cmp word [rbp + 0x1080], 0
je 0x14004fed5
lea r9, [rbp + 0x107c]
lea r8, [rbp + 0xc30]
lea rdx, str._ws_ws
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp - 0x70]
call fcn.14004c250
lea rdx, [rbp + 0x1050]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14004fe80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea r8, [rbp + 0xa20]
lea rdx, str._wsD3DSCache
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp - 0x70]
call fcn.14004c250
lea r8, [rbp + 0xa20]
lea rdx, str._wsNVIDIA_CorporationGfeSDK
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp - 0x70]
call fcn.14004c250
lea r8, [rbp + 0xa20]
lea rdx, str._wsMicrosoftFeeds
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp - 0x70]
call fcn.14004c250
lea r8, [rbp + 0xa20]
lea rdx, str._wsMicrosoftFeeds_Cache
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp - 0x70]
call fcn.14004c250
lea r8, [rbp + 0xa20]
lea rdx, str._wsMicrosoftWindowsINetCache
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp - 0x70]
call fcn.14004c250
lea r8, [rbp + 0xa20]
lea rdx, str._wsMicrosoftWindowsINetCookies
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp - 0x70]
call fcn.14004c250
lea r8, [rbp + 0xa20]
lea rdx, str._wsMicrosoftWindowsWebCache
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp - 0x70]
call fcn.14004c250
lea r8, [rbp + 0xa20]
lea rdx, str._wsMicrosoftXboxLiveAuthStateCache.dat
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp - 0x70]
call fcn.14004c250
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov r15d, eax
mov esi, 0x43
test eax, eax
je 0x1400505f7
lea r12, [0x1401b3370]
nop word [rax + rax]
test r15b, 1
je 0x1400505ee
mov edx, esi
lea rcx, str._n___DRIVE:__c____n_n
call fcn.14000c200
mov r8d, esi
lea rdx, str.._c:
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
xor r9d, r9d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
lea rcx, [rbp - 0x70]
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140050177
xor edx, edx
lea rcx, [rbp + 0x1a0]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
lea r9, [rbp + 0x216a0]
mov dword [rbp + 0x216a0], r13d
mov r8d, 0x200
mov qword [rsp + 0x20], r13
lea rdx, [rbp + 0x1a0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14005016e
cmp dword [rbp + 0x216a0], 0x200
jne 0x14005016e
mov ebx, r13d
mov rdi, r12
nop
mov rdx, qword [rdi]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1400500f0
mov eax, dword [rdi + 8]
lea rcx, [rbp + 0x1a0]
add rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14005011d
inc ebx
add rdi, 0x10
cmp ebx, 3
jb 0x1400500e0
jmp 0x14005016e
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ebx, eax
shl ebx, 0x10
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ecx, dword [rdi + 0xc]
xor r9d, r9d
add eax, ebx
xor r8d, r8d
xor edx, edx
mov dword [rbp + rcx + 0x1a0], eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x14005016e
xor r9d, r9d
mov qword [rsp + 0x20], r13
mov r8d, 0x200
lea rdx, [rbp + 0x1a0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, esi
lea rdx, str._c:WindowsSystem32_restoreMachineGuid.txt
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp - 0x70]
call fcn.14004c250
mov r8d, esi
lea rdx, str._c:UsersPublicLibrariescollection.dat
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp - 0x70]
call fcn.14004c250
mov r8d, esi
lea rdx, str._c:System_Volume_InformationIndexerVolumeGuid
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp - 0x70]
call fcn.14004c250
mov r8d, esi
lea rdx, str._c:System_Volume_InformationWPSettings.dat
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp - 0x70]
call fcn.14004c250
mov r8d, esi
lea rdx, str._c:System_Volume_Information_tracking.log
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp - 0x70]
call fcn.14004c250
mov r8d, esi
lea rdx, str._c:ProgramDataMicrosoftWindowsWER
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp - 0x70]
call fcn.14004c250
mov r8d, esi
lea rdx, str._c:UsersPublicShared_Files
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp - 0x70]
call fcn.14004c250
mov r8d, esi
lea rdx, str._c:WindowsINF_setupapi.dev.log
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp - 0x70]
call fcn.14004c250
mov r8d, esi
lea rdx, str._c:WindowsINF_setupapi.setup.log
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp - 0x70]
call fcn.14004c250
mov r8d, esi
lea rdx, str._c:UsersPublicLibraries
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp - 0x70]
call fcn.14004c250
mov r8d, esi
lea rdx, str._c:MSOCache
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp - 0x70]
call fcn.14004c250
mov r8d, esi
lea rdx, str._c:ProgramData_ntuser.pol
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp - 0x70]
call fcn.14004c250
mov r8d, esi
lea rdx, str._c:UsersDefaultNTUSER.DAT
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp - 0x70]
call fcn.14004c250
mov r8d, esi
lea rdx, str._c:Recovery_ntuser.sys
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp - 0x70]
call fcn.14004c250
mov r8d, esi
lea rdx, str._c:desktop.ini
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp - 0x70]
call fcn.14004c250
mov r8d, esi
lea rdx, str._c:WindowsPrefetch
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea rcx, [rbp + 0x1050]
mov r8d, 0x250
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x1050]
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
nop word [rax + rax]
movzx edx, word [rbp + 0x107c]
movzx ecx, word [rbp + 0x107e]
cmp dx, 0x2e
jne 0x14005039d
test cx, cx
je 0x1400503c1
cmp dx, dx
jne 0x14005039d
cmp cx, dx
jne 0x14005039d
cmp word [rbp + 0x1080], 0
je 0x1400503c1
lea r9, [rbp + 0x107c]
mov r8d, esi
lea rdx, str._c:WindowsPrefetch_ws
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp - 0x70]
call fcn.14004c250
lea rdx, [rbp + 0x1050]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140050370
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r8d, esi
lea rdx, [0x1400f6af0]
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea rcx, [rbp + 0x5c0]
mov r8d, 0x250
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x5c0]
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
nop word [rax + rax]
movzx edx, word [rbp + 0x5ec]
movzx ecx, word [rbp + 0x5ee]
cmp dx, 0x2e
jne 0x140050455
test cx, cx
je 0x140050577
cmp dx, dx
jne 0x140050455
cmp cx, dx
jne 0x140050455
cmp word [rbp + 0x5f0], 0
je 0x140050577
test byte [rbp + 0x5c0], 0x10
je 0x140050577
xor edx, edx
lea rcx, [rbp + 0x3b0]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov rcx, r13
nop dword [rax]
movzx eax, word [rbp + rcx + 0x5ec]
mov word [rbp + rcx + 0x3b0], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140050480
lea r9, [rbp + 0x3b0]
mov r8d, esi
lea rdx, str._c:Users_ws
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea rcx, [rbp + 0x1050]
mov r8d, 0x250
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x1050]
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
nop dword [rax]
movzx edx, word [rbp + 0x107c]
movzx ecx, word [rbp + 0x107e]
cmp dx, 0x2e
jne 0x14005050d
test cx, cx
je 0x140050556
cmp dx, dx
jne 0x14005050d
cmp cx, dx
jne 0x14005050d
cmp word [rbp + 0x1080], 0
je 0x140050556
lea rdx, str.ntuser
lea rcx, [rbp + 0x107c]
call qword [sym.imp.SHLWAPI.dll_StrStrW]
test rax, rax
je 0x140050556
lea rax, [rbp + 0x107c]
mov r8d, esi
lea r9, [rbp + 0x3b0]
mov qword [rsp + 0x20], rax
lea rdx, str._c:Users_ws_ws
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp - 0x70]
call fcn.14004c250
lea rdx, [rbp + 0x1050]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400504e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, [rbp + 0x5c0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140050420
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r8d, esi
lea rdx, str._c:Users
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp - 0x70]
call fcn.14004c610
xor edx, edx
lea rcx, [rbp + 0x810]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
mov r8d, esi
lea rdx, str.fsutil_usn_deletejournal__d__c:
lea rcx, [rbp + 0x810]
call fcn.140029770
lea rcx, [rbp + 0x810]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
inc esi
shr r15d, 1
jne 0x140050020
lea rcx, str.vssadmin_delete_shadows__All__Quiet
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r15, qword [rsp + 0x21758]
mov rbx, rax
mov r14, qword [rsp + 0x21760]
mov r13, qword [rsp + 0x21768]
mov r12, qword [rsp + 0x21770]
mov rsi, qword [rsp + 0x21780]
test rax, rax
je 0x1400506f4
xor edx, edx
lea rcx, [rbp + 0x1054]
mov r8d, 0x234
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x1050]
mov dword [rbp + 0x1050], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400506eb
nop word [rax + rax]
lea rdx, str.WmiPrvSE.exe
lea rcx, [rbp + 0x107c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400506ae
lea rdx, [rbp + 0x1050]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140050680
jmp 0x1400506eb
mov r8d, dword [rbp + 0x1058]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400506eb
lea rcx, str.Killed_Winmgmt_n
call fcn.14000c200
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.net_stop_winmgmt__Y
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400f6c1c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdi, qword [rsp + 0x21778]
add rsp, 0x21788
pop rbx
pop rbp
ret