Function at 0x1400065b0
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rdi
push r12
push r13
lea rbp, [rsp - 0x1840]
mov eax, 0x1940
call fcn.140007a90
sub rsp, rax
mov rax, qword [0x14001a128]
xor rax, rsp
mov qword [rbp + 0x1830], rax
mov r12, rcx
mov ebx, edx
xor r13d, r13d
lea rcx, [rbp + 0x412]
xor edx, edx
mov r8d, 0x206
mov edi, r13d
mov word [rbp + 0x410], r13w
call fcn.140007500
lea rcx, [rbp + 0x202]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x200], r13w
call fcn.140007500
test r12, r12
jne 0x14000662d
xor eax, eax
jmp 0x140006840
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x1978], rsi
mov qword [rsp + 0x1980], r14
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, 5
mov r14d, 1
mov dword [rbp - 0x44], r14d
mov word [rbp - 0x40], ax
mov qword [rsp + 0x58], r13
call fcn.140005b50
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsMFSCANUTILITY.exe
mov rcx, 0xffffffff80000002
neg eax
lea rax, [rsp + 0x58]
sbb r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
and r9d, 0x200
or r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400066d3
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x410]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x50], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
cmove edi, r14d
lea rsi, [r12 + 0x490]
mov rcx, rsi
call fcn.140005df0
test eax, eax
je 0x140006813
cmp edi, r14d
jne 0x140006813
lea rdx, [rbp + 0x200]
mov rcx, rsi
call fcn.1400060f0
mov edi, eax
test eax, eax
je 0x140006816
lea rcx, [rbp + 0x622]
xor edx, edx
mov r8d, 0x120a
mov word [rbp + 0x620], r13w
call fcn.140007500
lea rcx, [rbp - 0xe]
xor edx, edx
mov r8d, 0x206
mov word [rbp - 0x10], r13w
call fcn.140007500
dec ebx
lea rcx, [rbp - 0x10]
je 0x14000676e
dec ebx
je 0x140006765
dec ebx
je 0x14000675c
dec ebx
jne 0x14000676e
lea rdx, [0x1400148a0]
jmp 0x140006775
lea rdx, [0x14001489c]
jmp 0x140006775
lea rdx, [0x140014898]
jmp 0x140006775
lea rdx, str.1234
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp - 0x10]
lea rax, [r12 + 0x100]
mov qword [rsp + 0x30], rcx
lea r9, [rbp + 0x200]
lea r8, [rbp + 0x410]
lea rcx, [rbp + 0x620]
lea rdx, str._s___NetDevice:__s______NetDSName:_s_____NetAddress:_s____NetINTData:_s_
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_wsprintfW]
lea r11, [rsp + 0x60]
mov qword [rsp + 0x48], r11
lea rax, [rbp - 0x80]
lea rdx, [rbp + 0x620]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140006816
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, r14d
jmp 0x14000682e
mov edi, r13d
mov rcx, qword [0x14001b648]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x46f
call qword [sym.imp.USER32.dll_PostMessageW]
mov r14, qword [rsp + 0x1980]
mov rsi, qword [rsp + 0x1978]
mov eax, edi
mov rcx, qword [rbp + 0x1830]
xor rcx, rsp
call fcn.140007330
add rsp, 0x1940
pop r13
pop r12
pop rdi
pop rbx
pop rbp
ret