Function at 0x1400014e0
Capabilities:
Create process on windows
Query or enumerate registry value
Terminate process

Disassembly:
push rbp
lea rbp, [rsp - 0x16b0]
mov eax, 0x17b0
call fcn.140028610
sub rsp, rax
mov rax, qword [0x140052008]
xor rax, rsp
mov qword [rbp + 0x1690], rax
call fcn.140006870
test eax, eax
jne 0x14000151b
mov eax, 1
jmp 0x140001aba
mov qword [rsp + 0x17d0], rdi
mov qword [rsp + 0x17d8], r12
mov qword [rsp + 0x17a8], r14
call fcn.140005a10
mov rcx, rax
call fcn.140005a50
xor edx, edx
mov ecx, 0x20004
mov r14, rax
call fcn.1400061f0
mov edx, 3
mov ecx, 0x22002
call fcn.1400061f0
mov edx, 3
mov ecx, 0x22003
call fcn.1400061f0
mov edx, dword [r14 + 8]
mov ecx, 0x21001
call fcn.1400061f0
mov edx, dword [r14 + 0xc]
mov ecx, 0x21002
call fcn.1400061f0
mov edx, dword [r14 + 0x10]
mov ecx, 0x21003
call fcn.1400061f0
mov edx, 8
mov ecx, 0x21004
call fcn.1400061f0
mov edx, 0x18
mov ecx, 0x21005
call fcn.1400061f0
mov edx, 8
mov ecx, 0x21006
call fcn.1400061f0
xor r12d, r12d
lea r8, str.glText
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov edx, 0x1e0
mov ecx, 0x280
call fcn.140005c70
mov rdi, rax
test rax, rax
jne 0x1400015fa
call fcn.140006940
lea eax, [rdi + 1]
jmp 0x140001aa2
mov qword [rsp + 0x17c0], rbx
mov rcx, rdi
mov qword [rsp + 0x17c8], rsi
call fcn.140004210
mov ecx, 1
call fcn.1400042b0
call fcn.140001120
movups xmm0, xmmword [str.FbsgjnerZvpebfbsgVagrearg_RkcybereZnva]
movzx eax, word [0x14004d520]
mov rsi, 0xffffffffffffffff
movups xmm1, xmmword [0x14004d508]
mov word [rbp + 0x1688], ax
lea rax, [rbp + 0x1660]
movups xmmword [rbp + 0x1660], xmm0
mov dword [rbp + 0xa98], 4
movsd xmm0, qword [0x14004d518]
movsd qword [rbp + 0x1680], xmm0
mov dword [rbp + 0xa9c], 4
movups xmmword [rbp + 0x1670], xmm1
nop dword [rax]
inc rsi
cmp byte [rax + rsi], r12b
jne 0x140001680
mov rbx, r12
test rsi, rsi
je 0x14000170e
mov qword [rsp + 0x17a0], r15
mov r15d, 0x41
movsx ecx, byte [rbp + rbx + 0x1660]
call fcn.140012270
test eax, eax
je 0x1400016fe
movsx ecx, byte [rbp + rbx + 0x1660]
call fcn.1400123d0
test eax, eax
mov ecx, 0x61
mov eax, 0x4ec4ec4f
cmovne ecx, r15d
movzx r8d, cl
movsx ecx, byte [rbp + rbx + 0x1660]
sub ecx, r8d
add ecx, 0xd
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x1a
sub ecx, eax
add cl, r8b
mov byte [rbp + rbx + 0x1660], cl
inc rbx
cmp rbx, rsi
jb 0x1400016a3
mov r15, qword [rsp + 0x17a0]
lea rax, [rbp + 0xa90]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x1660]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000179f
mov rcx, qword [rbp + 0xa90]
lea rax, [rbp + 0xa9c]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0xa98]
lea rax, [rbp + 0xaa0]
xor r8d, r8d
lea rdx, str.IsStatus
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140001792
cmp dword [rbp + 0xa98], 4
jne 0x140001792
mov rcx, qword [rbp + 0xa90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x140001a92
mov rcx, qword [rbp + 0xa90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.1400013d0
call fcn.1400026d0
test eax, eax
je 0x140001a92
mov rcx, rdi
call fcn.140004210
mov ecx, 1
call fcn.1400042b0
call fcn.140002230
test eax, eax
je 0x140001a1e
call fcn.140001120
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, 0x12c
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, 0xfffffed4
sub ecx, ebx
movsxd rdx, ecx
add rax, rdx
mov r9, rax
shr r9, 0x20
mov r8d, r9d
xor r8d, eax
sub r8d, r9d
cmp r8d, 0x64
jg 0x140001a1e
call fcn.1400013d0
xor edx, edx
mov ecx, 0x20004
call fcn.1400061f0
mov edx, 3
mov ecx, 0x22002
call fcn.1400061f0
mov edx, 3
mov ecx, 0x22003
call fcn.1400061f0
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rsi, rax
mov ebx, 0xa
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x1f4
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Beep]
sub rbx, 1
jne 0x140001853
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, esi
cmp eax, 0x2710
jl 0x140001ad2
call fcn.140001120
lea rcx, [rsp + 0x50]
call fcn.140001da0
lea rcx, [rbp + 0xb20]
mov rdx, rax
mov r8d, 0xb3e
call fcn.14000f7e0
mov edx, dword [r14 + 8]
mov ecx, 0x21001
call fcn.1400061f0
mov edx, dword [r14 + 0xc]
mov ecx, 0x21002
call fcn.1400061f0
call fcn.1400013d0
mov edx, dword [r14 + 0x10]
mov ecx, 0x21003
call fcn.1400061f0
call fcn.140001120
lea edx, [rbx + 0x65]
lea rcx, [rbp + 0xc36]
call fcn.140002750
call fcn.1400013d0
lea edx, [rbx + 0x66]
lea rcx, [rbp + 0xd3a]
call fcn.140002750
call fcn.140001120
lea edx, [rbx + 0x67]
lea rcx, [rbp + 0xf42]
call fcn.140002750
call fcn.1400013d0
lea edx, [rbx + 0x68]
lea rcx, [rbp + 0xe3e]
call fcn.140002750
call fcn.140001120
mov rcx, rdi
call fcn.140004210
lea ecx, [rbx + 1]
call fcn.1400042b0
xorps xmm0, xmm0
lea rcx, [rbp + 0xc36]
xor eax, eax
xor r9d, r9d
mov qword [rbp + 0xb10], rax
xor r8d, r8d
mov qword [rbp + 0x1670], rax
xor edx, edx
lea rax, [rbp + 0x1660]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xab0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r12d
movups xmmword [rbp + 0xab0], xmm0
movups xmmword [rbp + 0xac0], xmm0
movups xmmword [rbp + 0xad0], xmm0
movups xmmword [rbp + 0xae0], xmm0
movups xmmword [rbp + 0xaf0], xmm0
movups xmmword [rbp + 0xb00], xmm0
movups xmmword [rbp + 0x1660], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400019e5
mov rcx, qword [rbp + 0x1660]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1668]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140001120
mov edx, dword [r14 + 8]
mov ecx, 0x21001
call fcn.1400061f0
mov edx, dword [r14 + 0xc]
mov ecx, 0x21002
call fcn.1400061f0
mov edx, dword [r14 + 0x10]
mov ecx, 0x21003
call fcn.1400061f0
call fcn.1400013d0
call fcn.140001fb0
mov rcx, rdi
call fcn.140006500
test eax, eax
je 0x140001a80
nop word [rax + rax]
call fcn.140004b60
lea r8, [rbp + 0xaa4]
mov rcx, rdi
lea rdx, [rbp + 0xaa8]
call fcn.1400061a0
mov edx, 0x100
mov rcx, rdi
call fcn.140004ae0
test eax, eax
je 0x140001a69
mov edx, 1
mov rcx, rdi
call fcn.1400061d0
mov ecx, 0x100
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rdi
call fcn.140006500
test eax, eax
jne 0x140001a30
mov rcx, rdi
call fcn.1400060c0
call fcn.140006940
mov eax, 1
mov rsi, qword [rsp + 0x17c8]
mov rbx, qword [rsp + 0x17c0]
mov rdi, qword [rsp + 0x17d0]
mov r12, qword [rsp + 0x17d8]
mov r14, qword [rsp + 0x17a8]
mov rcx, qword [rbp + 0x1690]
xor rcx, rsp
call fcn.1400028b0
add rsp, 0x17b0
pop rbp
ret
call fcn.140001120
call fcn.140002850
call fcn.1400013d0
call fcn.1400027f0
call fcn.140001120
call fcn.1400026d0
call fcn.140001120
lea rcx, [rsp + 0x50]
call fcn.140001da0
call fcn.1400013d0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]