Function at 0x1000065f0
Capabilities:
Create process on windows
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1c0
mov rax, qword [0x10001a100]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rcx, qword [0x10001dad0]
lea rdx, [0x10001d690]
mov r8d, 0x103
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor r15d, r15d
cmp eax, r15d
jne 0x10000664e
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100006c0c
lea r13, [0x1000019a8]
mov word [0x10001d896], r15w
mov edi, r15d
mov r14, r15
lea rbp, [0x100000000]
mov esi, 1
mov qword [rsp + 0x78], r13
mov r9d, dword [r13]
lea r8, [0x100001ac0]
lea rcx, [0x10001d9e0]
mov edx, 0x28
lea rbx, [0x10001bcd0]
call fcn.100004f50
cmp eax, r15d
mov r11d, eax
jl 0x100006c0c
mov r8, qword [r14 + rbp + 0x1bf18]
cmp r8, r15
je 0x1000066fb
lea rax, [0x10001d5f0]
mov edx, 0x28
mov r11d, r15d
mov rcx, rax
sub r8, rax
lea rax, [rdx + 0x7fffffd6]
cmp rax, r15
je 0x1000066e8
movzx eax, word [r8 + rcx]
cmp ax, r15w
je 0x1000066e8
mov word [rcx], ax
add rcx, 2
sub rdx, rsi
jne 0x1000066c5
cmp rdx, r15
jne 0x1000066f7
sub rcx, 2
mov r11d, 0x8007007a
mov word [rcx], r15w
cmp r11d, r15d
jl 0x100006c09
mov r8, qword [r14 + rbp + 0x1bf20]
lea rax, [0x10001d8a0]
mov edx, 0x64
sub r8, rax
mov rcx, rax
mov r11d, r15d
lea rax, [rdx + 0x7fffff9a]
cmp rax, r15
je 0x100006744
movzx eax, word [r8 + rcx]
cmp ax, r15w
je 0x100006744
mov word [rcx], ax
add rcx, 2
sub rdx, rsi
jne 0x100006721
cmp rdx, r15
jne 0x100006753
sub rcx, 2
mov r11d, 0x8007007a
cmp r11d, r15d
mov word [rcx], r15w
jl 0x100006c09
cmp qword [0x10001bcd0], r15
je 0x100006876
lea rax, [rbx + 8]
cmp qword [rax], r15
je 0x10000686d
cmp qword [rbx + 0x10], r15
je 0x10000686d
mov r8, qword [rbx]
mov r9, qword [rax]
lea rcx, [rsp + 0x110]
mov edx, 0x50
mov rbx, rax
call fcn.100004f50
cmp eax, r15d
jl 0x100006c0c
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x60]
lea rdx, [rsp + 0x110]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, r15d
jne 0x10000681c
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x60]
mov r9d, esi
lea eax, [rax + rax + 2]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], eax
mov rax, qword [rbx + 8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, r15d
je 0x10000681e
add edi, esi
mov rcx, qword [rbx + 0x10]
cmp rcx, r15
je 0x10000685e
add rcx, 2
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rsp + 0x60]
lea eax, [rax + rax + 2]
mov r9d, esi
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rax, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, r15d
je 0x10000685e
add edi, esi
mov rcx, qword [rsp + 0x60]
add rbx, 0x20
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rbx], r15
jne 0x10000676d
cmp dword [0x10001dae4], r15d
je 0x1000069c7
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x68]
xor r9d, r9d
mov r8d, esi
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x50], r15d
call fcn.10000636c
cmp eax, r15d
jne 0x100006983
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x50], r15
mov r12d, r15d
mov ebp, r15d
mov dword [rsp + 0x80], 0x18
mov dword [rsp + 0x90], r15d
mov qword [rsp + 0x88], rax
mov r13d, 1
mov eax, ebp
mov ebx, 2
neg eax
sbb esi, esi
add esi, 2
cmp esi, ebx
je 0x1000068fe
mov dl, r13b
mov ecx, esi
call fcn.100005110
cmp al, r15b
cmovne ebx, esi
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x50]
cmp ebp, r15d
mov qword [rsp + 0x38], rax
cmovne r12d, r13d
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rdx, [0x100001b10]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x2011f
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, r15d
mov esi, eax
cmove r12d, r13d
cmp ebx, 2
je 0x10000695f
xor edx, edx
mov ecx, ebx
call fcn.100005110
mov ebp, r13d
cmp r12d, r15d
je 0x1000068dc
mov r13, qword [rsp + 0x78]
cmp esi, r15d
je 0x100006b0c
mov rsi, rbp
lea rbp, [0x100000000]
add edi, esi
call fcn.10000a99c
cmp al, r15b
je 0x1000069a6
lea rcx, [0x10001bed0]
call fcn.10000641c
mov ecx, r15d
cmp al, r15b
sete cl
add edi, ecx
call fcn.10000a99c
cmp al, r15b
je 0x1000069c7
lea rcx, [0x10001bd78]
call fcn.10000641c
mov ecx, r15d
cmp al, r15b
sete cl
add edi, ecx
lea rax, [rsp + 0x70]
lea rdx, [0x100001bb8]
mov r9d, esi
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r15d
jne 0x100006adc
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x58]
lea rdx, [0x100001bd8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x5c]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x58], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r15d
jne 0x100006ad1
cmp dword [rsp + 0x5c], esi
jne 0x100006ad1
xor edx, edx
lea rcx, [rsp + 0xa0]
lea r8d, [rdx + 0x68]
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x80]
lea rcx, [0x100001c08]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r15d
mov dword [rsp + 0xa0], 0x68
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, r15d
je 0x100006ad1
mov rcx, qword [rsp + 0x80]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add r13, 0x10
lea rax, [0x1000019b8]
add r14, 8
cmp r13, rax
mov qword [rsp + 0x78], r13
jl 0x100006674
cmp edi, r15d
je 0x100006bc9
mov eax, 0x80040201
jmp 0x100006c0c
lea rbp, [0x10001d690]
mov r12d, 0x5c
mov rcx, rbp
mov edx, r12d
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov rbx, rax
cmp rax, r15
je 0x100006b76
cmp rax, rbp
je 0x100006b76
mov rcx, rbp
mov word [rax], r15w
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x50]
lea esi, [r12 - 0x5b]
lea eax, [rax + rax + 2]
lea rdx, [0x100001b78]
mov r9d, esi
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, r15d
je 0x100006b70
add edi, esi
mov word [rbx], r12w
jmp 0x100006b7d
mov esi, 1
add edi, esi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x100001ba0]
lea eax, [rax + rax + 2]
mov r9d, esi
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, r15d
je 0x100006bb2
add edi, esi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rbp, [0x100000000]
jmp 0x100006985
mov rax, qword [0x10001daf8]
cmp rax, r15
jne 0x100006bee
lea rcx, [0x100001cc8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x10001daf8], rax
cmp rax, r15
je 0x100006c05
lea rdx, [0x100001a60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, r15
je 0x100006c05
call rax
xor eax, eax
jmp 0x100006c0c
mov eax, r11d
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.100017040
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret