Function at 0x100056190
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Delete registry value
Query or enumerate registry value
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf0
mov rsi, rcx
xor ebx, ebx
xor ecx, ecx
movzx r14d, r9w
mov r13d, r8d
mov r12, rdx
mov dword [rax + 0x10], ebx
mov qword [rsp + 0x50], rbx
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp r12, rbx
jne 0x1000561f4
lea rdx, [0x10002a620]
lea ecx, [rbx + 2]
call fcn.1000527a0
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1000566ae
lea rdx, [0x10002a650]
mov rcx, r12
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
je 0x10005624c
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp rax, rbx
je 0x10005624c
lea rdx, [0x10002a670]
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
je 0x10005624c
lea rdx, [0x10002a688]
mov ecx, 4
call fcn.1000527a0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 1
jmp 0x1000566ae
cmp rsi, rbx
je 0x100056276
mov rcx, rsi
call fcn.100053454
cmp eax, ebx
jne 0x100056276
lea rdx, [0x10002a6d0]
mov r8, rsi
mov ecx, 2
call fcn.1000527f4
jmp 0x1000561e2
xor eax, eax
or r8, 0xffffffffffffffff
mov rdi, r12
mov rcx, r8
repne scasw ax, word [rdi]
lea edi, [rax + 1]
not rcx
lea eax, [rdi + 1]
sub rcx, rdi
lea rbp, [rcx + 5]
mul rbp
cmovo rax, r8
mov rcx, rax
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
mov r15, rax
cmp rax, rbx
jne 0x1000562b4
lea ecx, [rdi + 7]
jmp 0x1000561e7
mov r8, rbp
mov rdx, rax
mov rcx, r12
call fcn.100052b94
mov eax, ebx
mov qword [rsp + 0x40], rbx
mov ecx, 0xffff
lea rdx, [0x100025840]
mov dword [rsp + 0x80], 0x68
cmp r14w, cx
mov qword [rsp + 0x88], rbx
mov word [rsp + 0xc2], bx
setne al
cmp r14w, cx
mov rcx, 0xffffffff80000001
mov dword [rsp + 0xbc], eax
mov eax, ebx
mov qword [rsp + 0xc8], rbx
cmovne ax, r14w
xor r9d, r9d
xor r8d, r8d
mov word [rsp + 0xc0], ax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x98], rbx
mov dword [rsp + 0xa0], ebx
mov dword [rsp + 0xa4], ebx
mov dword [rsp + 0xa8], ebx
mov dword [rsp + 0xac], ebx
mov dword [rsp + 0xb0], ebx
mov dword [rsp + 0xb4], ebx
mov dword [rsp + 0xb8], ebx
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xd8], rbx
mov qword [rsp + 0xe0], rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x1000563da
mov rcx, qword [rsp + 0x50]
lea rdx, [0x10002a718]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x10002a758]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x10002a790]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebp, 4
lea rdx, [0x10002a7c8]
mov r8, r12
mov ecx, ebp
call fcn.1000527f4
lea r11, [rsp + 0x68]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
mov rcx, rsi
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, ebx
jne 0x100056481
mov rcx, r15
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rbp + 0x53]
cmp eax, ebx
lea rdx, [0x10002a7e8]
mov r8, r12
cmove eax, ecx
lea ecx, [rbp - 2]
movzx r9d, ax
or r9d, 0x80070000
cmp eax, ebx
cmovle r9d, eax
call fcn.1000527f4
mov rcx, qword [rsp + 0x50]
cmp rcx, rbx
je 0x1000561ed
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000561ed
mov rcx, qword [rsp + 0x70]
cmp rcx, rbx
je 0x100056496
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x70], rbx
cmp r13d, ebx
je 0x10005663f
mov esi, ebx
mov r14d, ebx
mov dword [rsp + 0x60], ebp
mov dword [rsp + 0x5c], ebx
mov dword [rsp + 0x58], ebx
mov r9d, 0xfa
jmp 0x1000565b8
cmp esi, ebx
jne 0x100056536
mov rcx, qword [rsp + 0x50]
cmp rcx, rbx
jne 0x1000564d0
mov esi, edi
jmp 0x1000565a4
lea rax, [rsp + 0x5c]
lea r9, [rsp + 0x60]
lea rdx, [0x10002a718]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x5c], ebp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x100056536
mov rcx, qword [0x1000888e8]
mov r13d, dword [rsp + 0x58]
mov esi, edi
cmp rcx, rbx
je 0x100056536
call qword [sym.imp.USER32.dll_IsWindow]
cmp eax, ebx
je 0x100056536
mov rcx, qword [0x1000888e8]
mov r9, r13
xor r8d, r8d
mov edx, 0x5d9
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rsp + 0x50]
cmp rcx, rbx
je 0x1000565a4
lea rax, [rsp + 0x5c]
lea r9, [rsp + 0x60]
lea rdx, [0x10002a758]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x5c], ebp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x1000565a4
mov rcx, qword [0x1000888e8]
mov r13d, dword [rsp + 0x58]
cmp rcx, rbx
je 0x1000565a4
call qword [sym.imp.USER32.dll_IsWindow]
cmp eax, ebx
je 0x1000565a4
mov rcx, qword [0x1000888e8]
mov r9, r13
xor r8d, r8d
mov edx, 0x5d8
call qword [sym.imp.USER32.dll_PostMessageW]
cmp r14d, 0x2932e0
ja 0x1000565d5
mov eax, 0xfa
add r14d, eax
mov r9d, eax
lea rdx, [rsp + 0x68]
xor r8d, r8d
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0x102
je 0x1000564bb
jmp 0x100056612
lea rdx, [0x10002a818]
mov r9d, 0x2932e0
mov r8, r12
mov ecx, edi
mov dword [rsp + 0x128], edi
call fcn.1000527f4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x100056605
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x68]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [rsp + 0x128], ebx
jne 0x10005663f
mov rcx, qword [rsp + 0x68]
lea rdx, [rsp + 0x128]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp eax, ebx
je 0x10005663f
mov ecx, dword [rsp + 0x128]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, r15
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, qword [rsp + 0x68]
cmp rcx, rbx
je 0x10005665c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x68], rbx
mov rcx, qword [rsp + 0x50]
cmp rcx, rbx
je 0x1000566a2
lea rdx, [0x10002a718]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x10002a758]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x10002a790]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x128], ebx
sete bl
mov eax, ebx
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret