Function at 0x140002b70
Capabilities:
Accept command line arguments
Check mutex on windows
Create process on windows
Get common file path
Get session user name
Query environment variable
Query or enumerate registry value
Self delete

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb90]
sub rsp, 0xc90
mov rax, qword [0x140044088]
xor rax, rsp
mov qword [rbp + 0xb80], rax
mov r9d, 0x64
lea r8, [0x140046ad0]
lea edx, [r9 + 2]
call qword [sym.imp.USER32.dll_LoadStringW]
xor r14d, r14d
lea r8, [0x140046ad0]
mov qword [rsp + 0x30], r14
lea rdx, str.SOFTWAREOEMQuick_AccessLog
mov qword [rsp + 0x28], r14
mov r9d, 0xffff
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140002d24
xor edx, edx
lea rcx, [rbp + 0x340]
mov r8d, 0x208
call fcn.14000cb70
xor edx, edx
lea rcx, [rbp + 0x760]
mov r8d, 0x208
call fcn.14000cb70
mov r8d, 0x104
mov dword [rsp + 0x50], 0x208
lea rdx, [rbp + 0x340]
lea rcx, str.PROGRAMDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x760]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rax, [rbp + 0x760]
lea rdi, [0x14003ccd8]
mov qword [rsp + 0x28], rdi
lea r9, str.OEMQuick_AccessLog
lea r8, [rbp + 0x340]
mov qword [rsp + 0x20], rax
lea rdx, str._s_s_s__s.log
lea rcx, [rbp + 0x340]
call fcn.140006f60
lea ecx, [r14 + 0x38]
call fcn.14000a188
mov rbx, rax
lea rcx, [rbp + 0x230]
xor eax, eax
xor edx, edx
mov r8d, 0x104
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x30], rax
lea rax, [rbp + 0x340]
mov qword [rbx], rax
mov qword [rbx + 8], rdi
call fcn.14000cb70
mov qword [rsp + 0x38], r14
lea rax, [rbp + 0x230]
mov qword [rsp + 0x30], r14
lea r8, [rbp + 0x340]
mov dword [rsp + 0x28], 0x104
or r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rcx, [rbp + 0x230]
call qword [sym.imp.imagehlp.dll_MakeSureDirectoryPathExists]
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov qword [0x140046b98], rbx
mov byte [rsp + 0x42], r14b
xor bl, bl
mov edi, r14d
mov dword [rsp + 0x44], r14d
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x44]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
movsxd rcx, dword [rsp + 0x44]
lea r10, str._callbyUI
mov qword [rbp - 0x78], rax
mov rdx, r14
mov r9, qword [rax + rcx*8 - 8]
nop
movzx r8d, word [r9 + rdx*2]
movzx ecx, word [r10 + rdx*2]
sub r8d, ecx
jne 0x140002d8a
movzx r8d, word [r9 + rdx*2 + 2]
movzx eax, word [r10 + rdx*2 + 2]
sub r8d, eax
jne 0x140002d8a
add rdx, 2
cmp rdx, 0xa
jne 0x140002d60
test r8d, r8d
mov qword [rsp + 0x30], r14
movzx ebx, bl
lea r8, str.DelayLaunch
mov esi, 1
mov qword [rsp + 0x28], r14
mov r9d, 0xffff
mov qword [rsp + 0x20], r14
lea rdx, str.SOFTWAREOEMQuick_Access
mov rcx, 0xffffffff80000002
cmove ebx, esi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140002e6d
lea rax, [rsp + 0x48]
mov dword [rsp + 0x58], r14d
mov qword [rsp + 0x30], rax
lea r9d, [rsi + 0xf]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x28], rax
lea r8, str.DelayLaunch
lea rdx, str.SOFTWAREOEMQuick_Access
mov qword [rsp + 0x20], r14
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140002e47
xor r9d, r9d
lea r8, str.DelayLaunch
lea rdx, str.SOFTWAREOEMQuick_Access
call fcn.140002800
test eax, eax
jne 0x140002e47
mov r8d, dword [rsp + 0x48]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.14000b230
cmp dword [rsp + 0x50], esi
sete sil
mov byte [rsp + 0x42], sil
test sil, sil
je 0x140002e68
test bl, bl
jne 0x140002e68
mov ecx, 0x2bf20
call qword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 1
lea rax, [rsp + 0x50]
mov dword [rsp + 0x60], r14d
mov qword [rsp + 0x30], rax
lea r8, str.Platform
lea rax, [rsp + 0x60]
mov dword [rsp + 0x58], r14d
mov qword [rsp + 0x28], rax
lea rdx, str.SOFTWAREOEMQuick_Access
mov r9d, 0x10
mov qword [rsp + 0x20], r14
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x50], 4
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140002eeb
xor r9d, r9d
lea r8, str.Platform
lea rdx, str.SOFTWAREOEMQuick_Access
call fcn.140002800
test eax, eax
jne 0x140002eeb
mov r8d, dword [rsp + 0x50]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x60]
call fcn.14000b230
cmp dword [rsp + 0x60], 1
mov eax, r14d
mov r9d, esi
mov byte [rsp + 0x40], 1
sete al
xor r8d, r8d
mov dword [rsp + 0x48], eax
xor ecx, ecx
lea rax, [rbp + 0x970]
mov qword [rsp + 0x20], rax
lea edx, [r8 + 0x25]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x140002f5a
mov r9d, eax
lea r8, str.Failed_to_get_system32_path.__0x_X_
mov edx, 0x40
lea rcx, [rbp - 0x60]
call fcn.140001100
mov rcx, qword [0x140046b98]
test rcx, rcx
je 0x140002f5a
lea r9, [rbp - 0x60]
mov edx, 2
lea r8, str.wWinMain
call fcn.1400028f0
lea r8, str.cmd.exe
mov edx, 0x104
lea rcx, [rbp + 0x970]
call fcn.140010f48
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x970]
call fcn.140004130
test al, al
je 0x140002fac
cmp word [rsp + 0x58], 0xa
jne 0x140002fa7
cmp word [rsp + 0x5a], di
jne 0x140002fa7
mov eax, 0x295a
mov byte [rsp + 0x40], 1
cmp word [rsp + 0x5c], ax
ja 0x140002fac
mov byte [rsp + 0x40], dil
xor bl, bl
xor r13b, r13b
xor r12b, r12b
mov byte [rsp + 0x41], bl
xor r15b, r15b
cmp dword [rsp + 0x44], 1
jle 0x140003302
mov rbx, qword [rbp - 0x78]
lea r9, str._noqaadminagent
add rbx, 8
lea r10, str._noqaagent
xor r8d, r8d
nop
mov rdx, qword [rbx]
mov rcx, r8
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
lea r11, str._noui
inc rcx
cmp ax, word [r11 + rcx*2 - 2]
lea r11, str._noqasvc
jne 0x140003018
cmp rcx, 6
jne 0x140002ff0
jmp 0x1400032ed
mov rcx, r8
nop dword [rax + rax]
movzx eax, word [rdx + rcx*2]
cmp ax, word [r9 + rcx*2]
jne 0x14000304a
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r9 + rcx*2 + 2]
jne 0x14000304a
add rcx, 2
cmp rcx, 0x10
jne 0x140003020
mov r13b, 1
jmp 0x1400032ed
or rcx, 0xffffffffffffffff
nop
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r10 + rcx*2 + 2]
jne 0x140003076
add rcx, 2
cmp rcx, 0xb
je 0x1400030f6
movzx eax, word [rdx + rcx*2]
cmp ax, word [r10 + rcx*2]
je 0x140003050
or rcx, 0xffffffffffffffff
nop word [rax + rax]
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r11 + rcx*2 + 2]
jne 0x1400030a2
add rcx, 2
cmp rcx, 9
je 0x1400030fe
movzx eax, word [rdx + rcx*2]
cmp ax, word [r11 + rcx*2]
je 0x140003080
mov rcx, r8
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
lea r9, str._noqalsvc
cmp ax, word [r9 + rcx*2]
lea r9, str._noqaadminagent
jne 0x140003106
movzx eax, word [rdx + rcx*2 + 2]
lea r10, str._noqalsvc
cmp ax, word [r10 + rcx*2 + 2]
lea r10, str._noqaagent
jne 0x140003106
add rcx, 2
cmp rcx, 0xa
jne 0x1400030b0
mov r15b, 1
jmp 0x1400032ed
mov r12b, 1
jmp 0x1400032ed
mov r14b, 1
jmp 0x1400032ed
or rcx, 0xffffffffffffffff
nop word [rax + rax]
movzx eax, word [rdx + rcx*2 + 2]
lea r11, str._noqalockhandler
cmp ax, word [r11 + rcx*2 + 2]
jne 0x140003147
add rcx, 2
cmp rcx, 0x11
je 0x14000319f
movzx eax, word [rdx + rcx*2]
lea r9, str._noqalockhandler
cmp ax, word [r9 + rcx*2]
lea r9, str._noqaadminagent
je 0x140003110
mov rcx, r8
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
lea r10, str._shellexecute
cmp ax, word [r10 + rcx*2]
lea r10, str._noqaagent
jne 0x1400031a9
movzx eax, word [rdx + rcx*2 + 2]
lea r11, str._shellexecute
cmp ax, word [r11 + rcx*2 + 2]
jne 0x1400031a9
add rcx, 2
cmp rcx, 0xe
jne 0x140003150
lea eax, [rsi + 1]
movsxd rcx, eax
mov rax, qword [rbp - 0x78]
mov rcx, qword [rax + rcx*8]
call fcn.140003be0
jmp 0x140003786
mov byte [rsp + 0x41], 1
jmp 0x1400032ed
movzx eax, word [rdx]
cmp ax, word [0x14003cef4]
jne 0x1400032ed
movzx eax, word [rdx + 2]
cmp ax, word [0x14003cef6]
jne 0x1400032ed
movzx eax, word [rdx + 4]
cmp ax, word [0x14003cef8]
jne 0x1400032ed
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x1400032dc
mov rdx, qword [rbx + 8]
xor edi, edi
mov dword [rsp + 0x58], edi
mov qword [rbp - 0x80], 7
mov qword [rsp + 0x78], rdi
mov word [rsp + 0x68], di
cmp word [rdx], di
jne 0x140003216
mov r8d, edi
jmp 0x14000322a
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], di
jne 0x140003220
lea rcx, [rsp + 0x68]
call fcn.140005630
cmp qword [rsp + 0x78], 0
mov qword [rsp + 0x50], rdi
mov edi, 0x80070057
je 0x1400032ba
xor edx, edx
lea rax, [rsp + 0x50]
lea r9, [0x14002d4f0]
mov qword [rsp + 0x20], rax
lea rcx, [0x14002d4e0]
lea r8d, [rdx + 4]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test eax, eax
js 0x1400032aa
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ole32.dll_CoAllowSetForegroundWindow]
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x58]
cmp qword [rbp - 0x80], 8
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], r8
cmovae rdx, qword [rsp + 0x68]
xor r9d, r9d
mov rax, qword [rcx]
xor r8d, r8d
call qword [rax + 0x18]
mov edi, eax
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400032ba
mov rax, qword [rcx]
call qword [rax + 0x10]
mov r8, qword [rbp - 0x80]
cmp r8, 8
jb 0x1400032d6
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x68]
inc r8
call fcn.140006620
call qword [sym.imp.ole32.dll_CoUninitialize]
lea r10, str._noqaagent
xor r8d, r8d
lea r9, str._noqaadminagent
inc esi
add rbx, 8
cmp esi, dword [rsp + 0x44]
jl 0x140002fe0
movzx ebx, byte [rsp + 0x41]
xor edx, edx
lea rcx, [rbp + 0x550]
mov r8d, 0x208
call fcn.14000cb70
mov r8d, 0x104
lea rdx, [rbp + 0x550]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x550]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
xor edx, edx
lea rcx, [rbp + 0x20]
mov r8d, 0x208
call fcn.14000cb70
test r14b, r14b
jne 0x140003370
lea rdx, [0x14003d480]
lea rcx, str.QASvc.exe
call fcn.140003ae0
test eax, eax
jne 0x140003370
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r14d, r14d
lea r8, str.eSIM
mov qword [rsp + 0x30], r14
lea rdx, str.SOFTWAREOEMQuick_Access
mov qword [rsp + 0x28], r14
mov r9d, 0xffff
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x64], r14d
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140003423
lea rax, [rsp + 0x50]
mov dword [rsp + 0x58], r14d
mov qword [rsp + 0x30], rax
lea r9d, [r14 + 0x10]
lea rax, [rsp + 0x64]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x28], rax
lea r8, str.eSIM
lea rdx, str.SOFTWAREOEMQuick_Access
mov qword [rsp + 0x20], r14
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140003423
xor r9d, r9d
lea r8, str.eSIM
lea rdx, str.SOFTWAREOEMQuick_Access
call fcn.140002800
test eax, eax
jne 0x140003423
mov r8d, dword [rsp + 0x50]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x64]
call fcn.14000b230
mov esi, dword [rsp + 0x48]
cmp byte [rsp + 0x40], r14b
jne 0x140003432
test esi, esi
je 0x140003439
cmp dword [rsp + 0x64], 1
jne 0x140003460
test r15b, r15b
jne 0x140003460
lea rdx, [0x14003d618]
lea rcx, str.QALSvc.exe
call fcn.140003ae0
test eax, eax
jne 0x140003460
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
test r12b, r12b
jne 0x1400034a1
lea r9, str.QAAgent.exe
lea r8, [rbp + 0x550]
lea rdx, str._s_s
lea rcx, [rbp + 0x20]
call fcn.140006f60
xor r9d, r9d
mov dword [rsp + 0x28], 1
lea r8, [rbp + 0x20]
mov qword [rsp + 0x20], r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
test r13b, r13b
jne 0x1400034ab
call fcn.1400037c0
test bl, bl
jne 0x1400034b8
test esi, esi
jne 0x1400034b8
call fcn.140003c80
lea rcx, str.LumiFlex
call fcn.140003fa0
test al, al
je 0x1400035f2
mov qword [rsp + 0x30], r14
lea r8, str.SunlightReadingEnabled
mov qword [rsp + 0x28], r14
lea rdx, str.SOFTWAREOEMQuick_Access
mov r9d, 0xffff
mov qword [rsp + 0x20], r14
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x48], r14d
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14000357e
lea rax, [rsp + 0x50]
mov dword [rsp + 0x58], r14d
mov qword [rsp + 0x30], rax
lea r8, str.SunlightReadingEnabled
lea rax, [rsp + 0x48]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x28], rax
lea rdx, str.SOFTWAREOEMQuick_Access
mov r9d, 0x10
mov qword [rsp + 0x20], r14
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x14000357e
xor r9d, r9d
lea r8, str.SunlightReadingEnabled
lea rdx, str.SOFTWAREOEMQuick_Access
call fcn.140002800
test eax, eax
jne 0x14000357e
mov r8d, dword [rsp + 0x50]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x48]
call fcn.14000b230
cmp dword [rsp + 0x48], 1
jne 0x1400035f2
lea r8, str.887E67C6_7817_4776_A22D_DBC4DCFBE013
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140003784
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x140003784
lea r9, str.SunlightReading.exe
lea r8, [rbp + 0x550]
lea rdx, str._spluginsLumiFlex_s
lea rcx, [rbp + 0x20]
call fcn.140006f60
xor r9d, r9d
mov dword [rsp + 0x28], 1
lea r8, [rbp + 0x20]
mov qword [rsp + 0x20], r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, str.ColorIntelligence
call fcn.140003fa0
test al, al
je 0x14000370b
mov qword [rsp + 0x30], r14
lea r8, str.ColorIntelligenceEnabled
mov qword [rsp + 0x28], r14
lea rdx, str.SOFTWAREOEMQuick_Access
mov r9d, 0xffff
mov qword [rsp + 0x20], r14
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x48], r14d
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1400036b8
lea rax, [rsp + 0x50]
mov dword [rsp + 0x58], r14d
mov qword [rsp + 0x30], rax
lea r8, str.ColorIntelligenceEnabled
lea rax, [rsp + 0x48]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x28], rax
lea rdx, str.SOFTWAREOEMQuick_Access
mov r9d, 0x10
mov qword [rsp + 0x20], r14
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x1400036b8
xor r9d, r9d
lea r8, str.ColorIntelligenceEnabled
lea rdx, str.SOFTWAREOEMQuick_Access
call fcn.140002800
test eax, eax
jne 0x1400036b8
mov r8d, dword [rsp + 0x50]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x48]
call fcn.14000b230
lea rcx, [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
cmp dword [rsp + 0x48], 1
jne 0x14000370b
cmp byte [rbp - 0x78], 1
jne 0x14000370b
lea r9, str.CACE.exe
lea r8, [rbp + 0x550]
lea rdx, str._spluginsColorIntelligence_s
lea rcx, [rbp + 0x20]
call fcn.140006f60
xor r9d, r9d
mov dword [rsp + 0x28], 1
lea r8, [rbp + 0x20]
mov qword [rsp + 0x20], r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp byte [rsp + 0x42], r14b
je 0x140003784
mov r8d, 0x13
mov qword [rbp - 0x80], 7
lea rdx, str.HKEY_LOCAL_MACHINE_
mov qword [rsp + 0x78], r14
lea rcx, [rsp + 0x68]
mov word [rsp + 0x68], r14w
call fcn.140005630
mov r8d, 0x19
lea rdx, str.SOFTWAREOEMQuick_Access
lea rcx, [rsp + 0x68]
call fcn.140005780
cmp qword [rbp - 0x80], 8
lea rcx, [rsp + 0x68]
cmovae rcx, qword [rsp + 0x68]
call fcn.140007e00
mov r8, qword [rbp - 0x80]
cmp r8, 8
jb 0x140003784
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x68]
inc r8
call fcn.140006620
mov eax, edi
mov rcx, qword [rbp + 0xb80]
xor rcx, rsp
call fcn.140009e60
lea r11, [rsp + 0xc90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret