Function at 0x1400112ad
Capabilities:
Print debug messages
Set registry value

Disassembly:
jmp 0x140014d50
push rbp
push rdi
sub rsp, 0x278
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x62
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140023008]
xor rax, rbp
mov qword [rbp + 0x230], rax
lea rcx, [0x1400290c5]
call fcn.140011483
lea rcx, str._m0yv__setting_vaccine_to_trigger_anti_vm
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov qword [rbp + 8], 0
mov eax, 0x53
mov word [rbp + 0x30], ax
mov eax, 0x4f
mov word [rbp + 0x32], ax
mov eax, 0x46
mov word [rbp + 0x34], ax
mov eax, 0x54
mov word [rbp + 0x36], ax
mov eax, 0x57
mov word [rbp + 0x38], ax
mov eax, 0x41
mov word [rbp + 0x3a], ax
mov eax, 0x52
mov word [rbp + 0x3c], ax
mov eax, 0x45
mov word [rbp + 0x3e], ax
mov eax, 0x5c
mov word [rbp + 0x40], ax
mov eax, 0x4d
mov word [rbp + 0x42], ax
mov eax, 0x69
mov word [rbp + 0x44], ax
mov eax, 0x63
mov word [rbp + 0x46], ax
mov eax, 0x72
mov word [rbp + 0x48], ax
mov eax, 0x6f
mov word [rbp + 0x4a], ax
mov eax, 0x73
mov word [rbp + 0x4c], ax
mov eax, 0x6f
mov word [rbp + 0x4e], ax
mov eax, 0x66
mov word [rbp + 0x50], ax
mov eax, 0x74
mov word [rbp + 0x52], ax
mov eax, 0x5c
mov word [rbp + 0x54], ax
mov eax, 0x57
mov word [rbp + 0x56], ax
mov eax, 0x69
mov word [rbp + 0x58], ax
mov eax, 0x6e
mov word [rbp + 0x5a], ax
mov eax, 0x64
mov word [rbp + 0x5c], ax
mov eax, 0x6f
mov word [rbp + 0x5e], ax
mov eax, 0x77
mov word [rbp + 0x60], ax
mov eax, 0x73
mov word [rbp + 0x62], ax
mov eax, 0x5c
mov word [rbp + 0x64], ax
mov eax, 0x43
mov word [rbp + 0x66], ax
mov eax, 0x75
mov word [rbp + 0x68], ax
mov eax, 0x72
mov word [rbp + 0x6a], ax
mov eax, 0x72
mov word [rbp + 0x6c], ax
mov eax, 0x65
mov word [rbp + 0x6e], ax
mov eax, 0x6e
mov word [rbp + 0x70], ax
mov eax, 0x74
mov word [rbp + 0x72], ax
mov eax, 0x56
mov word [rbp + 0x74], ax
mov eax, 0x65
mov word [rbp + 0x76], ax
mov eax, 0x72
mov word [rbp + 0x78], ax
mov eax, 0x73
mov word [rbp + 0x7a], ax
mov eax, 0x69
mov word [rbp + 0x7c], ax
mov eax, 0x6f
mov word [rbp + 0x7e], ax
mov eax, 0x6e
mov word [rbp + 0x80], ax
mov eax, 0x5c
mov word [rbp + 0x82], ax
mov eax, 0x52
mov word [rbp + 0x84], ax
mov eax, 0x75
mov word [rbp + 0x86], ax
mov eax, 0x6e
mov word [rbp + 0x88], ax
xor eax, eax
mov word [rbp + 0x8a], ax
mov eax, 0x76
mov word [rbp + 0xa8], ax
mov eax, 0x6d
mov word [rbp + 0xaa], ax
mov eax, 0x77
mov word [rbp + 0xac], ax
mov eax, 0x61
mov word [rbp + 0xae], ax
mov eax, 0x72
mov word [rbp + 0xb0], ax
mov eax, 0x65
mov word [rbp + 0xb2], ax
xor eax, eax
mov word [rbp + 0xb4], ax
mov eax, 0x20
mov word [rbp + 0xd8], ax
mov eax, 0x6b
mov word [rbp + 0xda], ax
mov eax, 0x65
mov word [rbp + 0xdc], ax
mov eax, 0x72
mov word [rbp + 0xde], ax
mov eax, 0x6e
mov word [rbp + 0xe0], ax
mov eax, 0x65
mov word [rbp + 0xe2], ax
mov eax, 0x6c
mov word [rbp + 0xe4], ax
mov eax, 0x33
mov word [rbp + 0xe6], ax
mov eax, 0x32
mov word [rbp + 0xe8], ax
mov eax, 0x2e
mov word [rbp + 0xea], ax
mov eax, 0x64
mov word [rbp + 0xec], ax
mov eax, 0x6c
mov word [rbp + 0xee], ax
mov eax, 0x6c
mov word [rbp + 0xf0], ax
mov eax, 0x2c
mov word [rbp + 0xf2], ax
mov eax, 0x53
mov word [rbp + 0xf4], ax
mov eax, 0x6c
mov word [rbp + 0xf6], ax
mov eax, 0x65
mov word [rbp + 0xf8], ax
mov eax, 0x65
mov word [rbp + 0xfa], ax
mov eax, 0x70
mov word [rbp + 0xfc], ax
xor eax, eax
mov word [rbp + 0xfe], ax
mov dword [rbp + 0x114], 0
mov qword [rbp + 0x138], 0
call fcn.140011438
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x1400150b7
jmp 0x14001514d
mov r8d, 0x204
lea rdx, [rbp + 0xd8]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_wcsncat]
lea rax, [rbp + 0x138]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rbp + 0x30]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400150fa
jmp 0x14001514d
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_wcslen]
lea rax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [rbp + 0xa8]
mov rcx, qword [rbp + 0x138]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140015139
jmp 0x14001514d
mov dword [rbp + 0x114], 1
xor eax, eax
test eax, eax
jne 0x1400150a2
cmp qword [rbp + 0x138], 0
je 0x140015164
mov rcx, qword [rbp + 0x138]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rbp + 8], 0
je 0x1400151ac
mov rax, qword [rbp + 8]
mov qword [rbp + 0x218], rax
mov rcx, qword [rbp + 0x218]
call fcn.140011208
cmp qword [rbp + 0x218], 0
jne 0x140015199
mov qword [rbp + 0x228], 0
jmp 0x1400151ac
mov qword [rbp + 8], 0x8123
mov rax, qword [rbp + 8]
mov qword [rbp + 0x228], rax
mov eax, dword [rbp + 0x114]
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001f4a0]
call fcn.1400113e3
mov eax, edi
mov rcx, qword [rbp + 0x230]
xor rcx, rbp
call fcn.140011212
lea rsp, [rbp + 0x248]
pop rdi
pop rbp
ret