Function at 0x140035230
Capabilities:
Check mutex on windows
Create thread
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
xor r14d, r14d
mov rsi, rcx
mov r12, rdx
mov byte [0x1400f190d], r14b
movzx eax, word [rdx]
lea r8d, [r14 + 0x2a]
cmp r8w, ax
lea r13d, [r14 + 0x20]
sete dil
jmp 0x140035296
mov ecx, 9
cmp cx, ax
ja 0x140035281
cmp ax, 0xd
jbe 0x14003529c
cmp r13w, ax
je 0x14003529c
add rdx, 2
mov qword [rsp + 0xd8], rdx
mov ax, word [rdx]
cmp ax, r14w
jne 0x140035271
lea rcx, [rsp + 0xd8]
call fcn.140011910
mov rcx, qword [rsp + 0xd8]
mov edx, 0x2d
mov qword [rsp + 0x50], rcx
cmp dx, word [rcx]
movzx eax, r8b
cmove eax, edx
mov r15d, 1
movsx edx, al
movzx eax, word [rcx]
cmp edx, eax
jne 0x140035311
movzx eax, word [rcx + 2]
cmp edx, eax
jne 0x140035311
lea rax, [rcx + 4]
lea rdx, [rsp + 0x50]
lea rcx, [0x1400da294]
mov r8d, r15d
mov qword [rsp + 0x50], rax
call fcn.14004e558
cmp al, r14b
je 0x140035311
mov rax, qword [rsp + 0x50]
mov ebx, r15d
mov qword [rsp + 0xd8], rax
jmp 0x140035335
lea rdx, [rsp + 0xd8]
lea rcx, str._user
mov r8d, 5
call fcn.14004e558
mov ebx, r14d
cmp al, r14b
cmovne ebx, r15d
mov rbp, qword [0x1400ef248]
lea rax, str.UCallBackhWnd
cmp ebx, r14d
cmovne rbp, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rax, str.GlobalPECMD:main_u
lea r8, str.GlobalPECMD:main
cmp ebx, r14d
mov edx, r15d
cmovne r8, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp rax, r14
je 0x14003538d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0xb7
cmp eax, ecx
jne 0x14003538d
mov eax, ecx
jmp 0x140035a7f
cmp ebx, r14d
je 0x14003539b
mov byte [section.flag_dat], r13b
jmp 0x1400353b2
mov rax, qword [rsp + 0xd8]
cmp word [rax], r14w
setne al
add al, 0x10
mov byte [section.flag_dat], al
lea r13, [0x1400f1e30]
cmp qword [0x1400f1cb8], r14
jne 0x1400353e9
lea rcx, [0x1400db0ac]
call fcn.1400b8b5c
cmp eax, r14d
je 0x1400353e9
lea r8, [0x1400d63f4]
lea rdx, str._D:DebugPeMain2.log
mov rcx, r13
call fcn.14002406c
movsx r9d, byte [section.flag_dat]
lea rdx, str.MAIN___s__0x_X_r_n
mov r8, r12
mov rcx, r13
call fcn.140012e90
call fcn.14001ee9c
movzx r11d, byte [0x1400fb006]
cmp dil, r14b
mov rdi, 0xffffffff80000002
cmovne r11d, r15d
mov byte [0x1400fb006], r11b
cmp ebx, r14d
jne 0x140035592
mov rax, qword [rsp + 0xd8]
cmp word [rax], r14w
je 0x1400355c5
lea rdx, str.SOFTWAREPELOGONRAMDATA
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, str.SOFTWAREPELOGONRAMDATA.HOTKEY
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 0x40], r14
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
lea rdx, str.SOFTWAREPELOGON
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0xe0], r14
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0xe0]
cmp rcx, r14
je 0x1400354b2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r14
lea rax, [rsp + 0xe0]
lea rdx, str.SOFTWAREPELOGONRAMDATA
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0xe0]
cmp rcx, r14
je 0x1400354fc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r14
lea rax, [rsp + 0xe0]
lea rdx, str.SOFTWAREPELOGONRAMDATA.HOTKEY
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
mov qword [rsp + 0xe0], r14
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0xe0]
cmp rcx, r14
je 0x14003554e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdi, str.MAIN_DBG:_d_r_n
mov r8d, 0x25dd
mov rcx, r13
mov rdx, rdi
call fcn.140012fac
call fcn.14001e128
mov r8d, 0x25df
mov rdx, rdi
mov rcx, r13
call fcn.140012fac
call fcn.140011dc0
mov r8d, 0x25e1
mov rdx, rdi
mov rcx, r13
call fcn.140012fac
mov rax, qword [rsp + 0xd8]
cmp word [rax], r14w
je 0x1400355c5
lea rdx, [0x1400d63f4]
mov r9d, 0x24
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], r14
call fcn.140029078
mov rax, qword [rsp + 0xd8]
movzx edi, word [rax]
mov edx, 0x23
lea ecx, [rdx + 7]
cmp di, cx
jne 0x1400355f3
add rax, 2
cmp dx, word [rax]
je 0x1400355f3
lea rcx, [rsp + 0xd8]
mov qword [rsp + 0xd8], rax
call fcn.140011910
lea rdx, [0x1400d63f4]
lea rcx, [0x1400d63f4]
call sym.PECMD.exe_LoadEnvi
movzx r11d, byte [0x1400f2382]
mov rax, qword [rsp + 0xd8]
cmp word [rax], r14w
cmove r11d, r15d
mov byte [0x1400f2382], r11b
call fcn.140045384
call fcn.1400351c8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, 4
lea r8, str.MainPECMDPID
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0xe8], eax
lea rax, [rsp + 0xe8]
mov r9d, ecx
lea rdx, str.SOFTWAREPELOGON
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.140045e70
lea rdx, str.MAIN_DBG:_d_r_n
mov r8d, 0x25eb
mov rcx, r13
call fcn.140012fac
xor edx, edx
mov rcx, r13
call fcn.1400aa978
cmp qword [rsi + 0x78], r14
jne 0x140035736
mov eax, dword [0x1400f1f80]
test r15b, al
jne 0x1400356bf
or eax, r15d
lea rcx, [0x1400d41b0]
mov qword [0x1400f1f78], r14
mov dword [0x1400f1f80], eax
call fcn.1400b9954
lea r13, [0x1400f1f78]
mov edx, 0x10000
mov rcx, rsi
mov qword [rsi + 0x78], r13
call fcn.14004a49c
lea rcx, [rsp + 0xe0]
call fcn.14004be6c
mov rdx, qword [rsp + 0xe0]
mov rcx, r13
call fcn.14008ba9c
mov rax, qword [0x1400f1f78]
mov qword [rsp + 0xe0], r14
mov rcx, qword [rax]
mov r8d, r15d
mov rdx, r12
mov qword [rsi + 0x80], rcx
mov rcx, rsi
call fcn.14005c144
lea rcx, [rsp + 0xe0]
mov dword [rsi + 0x8c], r14d
call fcn.140044f24
lea r13, [0x1400f1e30]
lea r12, str.MAIN_DBG:_d_r_n
mov r8d, 0x25f7
mov rcx, r13
mov rdx, r12
call fcn.140012fac
cmp ebx, r14d
jne 0x140035792
mov al, byte [section.flag_dat]
lea r8, str.bInMain
lea rdx, str.SOFTWAREPELOGON
mov byte [rsp + 0xe0], al
lea rax, [rsp + 0xe0]
mov r9d, 3
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call fcn.140045e70
mov r8d, 0x25fb
mov rdx, r12
mov rcx, r13
call fcn.140012fac
mov r11, qword [rsp + 0xd8]
cmp word [r11], r14w
je 0x1400357b6
call fcn.140015a0c
lea rax, [0x1400f1ca8]
lea rdx, str.SOFTWAREPELOGON
mov r9d, 0xb
mov r8, rbp
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call fcn.140045e70
cmp di, r14w
jne 0x1400357f1
cmp ebx, r14d
je 0x1400357f6
call fcn.14002cbf0
mov rcx, rsi
call fcn.14001e714
mov ecx, 0x8000
call fcn.140051a04
mov r11, qword [rsp + 0xd8]
cmp word [r11], r14w
jne 0x14003581b
cmp ebx, r14d
je 0x140035876
mov r8d, 0x2607
mov rdx, r12
mov rcx, r13
mov dword [rsp + 0xe0], r14d
call fcn.140012fac
lea r11, [rsp + 0xe0]
mov qword [rsp + 0x28], r11
lea r8, [0x1400351f8]
xor r9d, r9d
mov edx, 0x80000
xor ecx, ecx
mov dword [rsp + 0x20], 0x10000
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, r14
je 0x14003586e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r11, qword [rsp + 0xd8]
mov r8d, 0x2a
cmp word [r11], r8w
jne 0x1400358b3
lea r9d, [r8 - 7]
lea rax, [r11 + 2]
cmp r9w, word [rax]
je 0x1400358b3
lea rcx, [rsp + 0xd8]
mov qword [rsp + 0xd8], rax
call fcn.140011910
mov r11, qword [rsp + 0xd8]
cmp word [r11], r8w
je 0x140035886
cmp word [r11], r14w
je 0x140035a56
mov r8d, 0x2610
mov rdx, r12
mov rcx, r13
call fcn.140012fac
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0xe0]
lea edx, [rax + 0x5c8]
call fcn.14004bedc
mov r12, qword [rsp + 0xe0]
mov r8d, 0x104
mov word [r12], r14w
mov rbp, qword [rsp + 0xe0]
xor ecx, ecx
add rbp, 0x280
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
mov rcx, rbp
lea r8d, [rdx + 0x5c]
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
mov rbx, rax
cmp rax, r14
jne 0x140035938
mov rbx, rbp
jmp 0x14003593c
add rbx, 2
mov rcx, qword [rsp + 0xd8]
call fcn.140014b60
cmp eax, r14d
je 0x140035987
mov rdx, qword [rsp + 0xd8]
lea rcx, [rsp + 0x58]
call fcn.140058920
mov rdx, qword [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], r14
call fcn.1400367d4
lea rcx, [rsp + 0x58]
call fcn.140044f24
jmp 0x140035a31
lea rdx, str.___exe:__s_____s_
lea rcx, [rbp + 0x488]
mov r9, rbx
mov r8, rbp
call fcn.1400118ec
lea rcx, [rbp + 0x488]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, str.LOAD_sysinit__s
movsxd r8, eax
lea rcx, [rbp + r8*2 + 0x488]
mov r8, qword [rsp + 0xd8]
call fcn.1400118ec
cmp word [r12], r14w
je 0x140035a0d
lea rax, [rsp + 0xe8]
mov r9d, 4
lea r8, str.SysStartuped
mov dword [rsp + 0x28], r9d
lea rdx, str.SOFTWAREPELOGONRAMDATA
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0xe8], r15d
call fcn.140045e70
mov qword [rsp + 0x30], r14
lea rdx, [rbp + 0x488]
xor r9d, r9d
mov r8, rsi
mov rcx, rsi
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
call fcn.14000a168
lea rcx, [rsp + 0xe0]
call fcn.140044f24
jmp 0x140035a56
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
cmp eax, r14d
jne 0x140035a40
mov rcx, qword [0x1400f1c88]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov eax, dword [rsp + 0x70]
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret