Function at 0x140002b70
Capabilities:
Accept command line arguments
Check mutex on windows
Create process on windows
Get common file path
Get session user name
Query environment variable
Query or enumerate registry value
Self delete

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb90]
sub rsp, 0xc90
mov rax, qword [0x140044088]
xor rax, rsp
mov qword [rbp + 0xb80], rax
mov r9d, 0x64
lea r8, [0x140046ad0]
lea edx, [r9 + 2]
call qword [sym.imp.USER32.dll_LoadStringW]
xor r14d, r14d
lea r8, [0x140046ad0]
mov qword [rsp + 0x30], r14
lea rdx, str.SOFTWAREOEMQuick_AccessLog
mov qword [rsp + 0x28], r14
mov r9d, 0xffff
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140002d1b
xor edx, edx
lea rcx, [rbp + 0x130]
mov r8d, 0x208
call fcn.14000cbc0
xor edx, edx
lea rcx, [rbp + 0x760]
mov r8d, 0x208
call fcn.14000cbc0
mov r8d, 0x104
mov dword [rsp + 0x48], 0x208
lea rdx, [rbp + 0x130]
lea rcx, str.PROGRAMDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x760]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rax, [rbp + 0x760]
lea rdi, [0x14003cd20]
mov qword [rsp + 0x28], rdi
lea r9, str.OEMQuick_AccessLog
lea r8, [rbp + 0x130]
mov qword [rsp + 0x20], rax
lea rdx, str._s_s_s__s.log
lea rcx, [rbp + 0x130]
call fcn.140006fb0
lea ecx, [r14 + 0x38]
call fcn.14000a200
mov rbx, rax
lea rcx, [rbp + 0x20]
xor eax, eax
xor edx, edx
mov r8d, 0x104
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x30], rax
lea rax, [rbp + 0x130]
mov qword [rbx], rax
mov qword [rbx + 8], rdi
call fcn.14000cbc0
mov qword [rsp + 0x38], r14
lea rax, [rbp + 0x20]
mov qword [rsp + 0x30], r14
lea r8, [rbp + 0x130]
mov dword [rsp + 0x28], 0x104
or r9d, 0xffffffff
push qword [rbx]
ror byte [rax - 0x77], cl
and al, 0x20
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rcx, [rbp + 0x20]
call qword [sym.imp.imagehlp.dll_MakeSureDirectoryPathExists]
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov qword [0x140046b98], rbx
mov byte [rsp + 0x41], r14b
xor bl, bl
mov edi, r14d
mov dword [rsp + 0x44], r14d
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x44]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
movsxd rcx, dword [rsp + 0x44]
lea r10, str._callbyUI
mov qword [rbp - 0x78], rax
mov rdx, r14
mov r9, qword [rax + rcx*8 - 8]
nop word [rax + rax]
movzx r8d, word [r9 + rdx*2]
movzx ecx, word [r10 + rdx*2]
sub r8d, ecx
jne 0x140002d8a
movzx r8d, word [r9 + rdx*2 + 2]
movzx eax, word [r10 + rdx*2 + 2]
sub r8d, eax
jne 0x140002d8a
add rdx, 2
cmp rdx, 0xa
jne 0x140002d60
test r8d, r8d
mov qword [rsp + 0x30], r14
movzx ebx, bl
lea r8, str.DelayLaunch
mov esi, 1
mov qword [rsp + 0x28], r14
mov r9d, 0xffff
mov qword [rsp + 0x20], r14
lea rdx, str.SOFTWAREOEMQuick_Access
mov rcx, 0xffffffff80000002
cmove ebx, esi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140002e6d
lea rax, [rsp + 0x50]
mov dword [rsp + 0x58], r14d
mov qword [rsp + 0x30], rax
lea r9d, [rsi + 0xf]
lea rax, [rsp + 0x48]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x28], rax
lea r8, str.DelayLaunch
lea rdx, str.SOFTWAREOEMQuick_Access
mov qword [rsp + 0x20], r14
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140002e47
xor r9d, r9d
lea r8, str.DelayLaunch
lea rdx, str.SOFTWAREOEMQuick_Access
call fcn.140002800
test eax, eax
jne 0x140002e47
mov r8d, dword [rsp + 0x50]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x48]
call fcn.14000b280
cmp dword [rsp + 0x48], esi
sete sil
mov byte [rsp + 0x41], sil
test sil, sil
je 0x140002e68
test bl, bl
jne 0x140002e68
mov ecx, 0x2bf20
call qword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 1
lea rax, [rsp + 0x48]
mov dword [rsp + 0x60], r14d
mov qword [rsp + 0x30], rax
lea r8, str.Platform
lea rax, [rsp + 0x60]
mov dword [rsp + 0x58], r14d
mov qword [rsp + 0x28], rax
lea rdx, str.SOFTWAREOEMQuick_Access
mov r9d, 0x10
mov qword [rsp + 0x20], r14
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x48], 4
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140002eeb
xor r9d, r9d
lea r8, str.Platform
lea rdx, str.SOFTWAREOEMQuick_Access
call fcn.140002800
test eax, eax
jne 0x140002eeb
mov r8d, dword [rsp + 0x48]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x60]
call fcn.14000b280
cmp dword [rsp + 0x60], 1
lea rax, [rbp + 0x970]
mov ebx, r14d
mov qword [rsp + 0x20], rax
sete bl
mov r9d, esi
xor r8d, r8d
mov dword [rsp + 0x48], ebx
xor ecx, ecx
mov r13b, 1
lea edx, [r8 + 0x25]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x140002f58
mov r9d, eax
lea r8, str.Failed_to_get_system32_path.__0x_X_
mov edx, 0x40
lea rcx, [rbp - 0x60]
call fcn.140001100
mov rcx, qword [0x140046b98]
test rcx, rcx
je 0x140002f58
lea r9, [rbp - 0x60]
mov edx, 2
lea r8, str.wWinMain
call fcn.1400028f0
lea r8, str.cmd.exe
mov edx, 0x104
lea rcx, [rbp + 0x970]
call fcn.140010f98
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x970]
call fcn.140004000
test al, al
je 0x140002fa8
cmp word [rsp + 0x58], 0xa
jne 0x140002fa5
cmp word [rsp + 0x5a], di
jne 0x140002fa5
mov eax, 0x295a
cmp word [rsp + 0x5c], ax
jbe 0x140002fa5
mov r13b, 1
jmp 0x140002fa8
xor r13b, r13b
xor r12b, r12b
mov byte [rsp + 0x40], dil
xor r15b, r15b
cmp dword [rsp + 0x44], 1
jle 0x1400032b1
mov rbx, qword [rbp - 0x78]
lea r9, str._noqaadminagent
add rbx, 8
lea r10, str._noqaagent
xor r8d, r8d
nop word [rax + rax]
mov rdx, qword [rbx]
mov rcx, r8
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
lea r11, str._noui
inc rcx
cmp ax, word [r11 + rcx*2 - 2]
lea r11, str._noqasvc
jne 0x140003018
cmp rcx, 6
jne 0x140002ff0
jmp 0x14000329d
mov rcx, r8
nop dword [rax + rax]
movzx eax, word [rdx + rcx*2]
cmp ax, word [r9 + rcx*2]
jne 0x14000304c
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r9 + rcx*2 + 2]
jne 0x14000304c
add rcx, 2
cmp rcx, 0x10
jne 0x140003020
mov byte [rsp + 0x40], 1
jmp 0x14000329d
or rcx, 0xffffffffffffffff
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r10 + rcx*2 + 2]
jne 0x140003076
add rcx, 2
cmp rcx, 0xb
je 0x1400030f6
movzx eax, word [rdx + rcx*2]
cmp ax, word [r10 + rcx*2]
je 0x140003050
or rcx, 0xffffffffffffffff
nop word [rax + rax]
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r11 + rcx*2 + 2]
jne 0x1400030a2
add rcx, 2
cmp rcx, 9
je 0x1400030fe
movzx eax, word [rdx + rcx*2]
cmp ax, word [r11 + rcx*2]
je 0x140003080
mov rcx, r8
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
lea r9, str._noqalsvc
cmp ax, word [r9 + rcx*2]
lea r9, str._noqaadminagent
jne 0x140003106
movzx eax, word [rdx + rcx*2 + 2]
lea r10, str._noqalsvc
cmp ax, word [r10 + rcx*2 + 2]
lea r10, str._noqaagent
jne 0x140003106
add rcx, 2
cmp rcx, 0xa
jne 0x1400030b0
mov r15b, 1
jmp 0x14000329d
mov r12b, 1
jmp 0x14000329d
mov r14b, 1
jmp 0x14000329d
mov rcx, r8
nop dword [rax]
movzx eax, word [rdx + rcx*2]
lea r11, str._shellexecute
cmp ax, word [r11 + rcx*2]
jne 0x14000315f
movzx eax, word [rdx + rcx*2 + 2]
lea r9, str._shellexecute
cmp ax, word [r9 + rcx*2 + 2]
lea r9, str._noqaadminagent
jne 0x14000315f
add rcx, 2
cmp rcx, 0xe
jne 0x140003110
lea eax, [rsi + 1]
movsxd rcx, eax
mov rax, qword [rbp - 0x78]
mov rcx, qword [rax + rcx*8]
call fcn.140003dd0
jmp 0x14000373c
movzx eax, word [rdx]
cmp ax, word [0x14003cf1c]
jne 0x14000329d
movzx eax, word [rdx + 2]
cmp ax, word [0x14003cf1e]
jne 0x14000329d
movzx eax, word [rdx + 4]
cmp ax, word [0x14003cf20]
jne 0x14000329d
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x14000328c
mov rdx, qword [rbx + 8]
xor edi, edi
mov dword [rsp + 0x58], edi
mov qword [rbp - 0x80], 7
mov qword [rsp + 0x78], rdi
mov word [rsp + 0x68], di
cmp word [rdx], di
jne 0x1400031cc
mov r8d, edi
jmp 0x1400031da
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], di
jne 0x1400031d0
lea rcx, [rsp + 0x68]
call fcn.140005680
cmp qword [rsp + 0x78], 0
mov qword [rsp + 0x50], rdi
mov edi, 0x80070057
je 0x14000326a
xor edx, edx
lea rax, [rsp + 0x50]
lea r9, [0x14002d500]
mov qword [rsp + 0x20], rax
lea rcx, [0x14002d510]
lea r8d, [rdx + 4]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test eax, eax
js 0x14000325a
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ole32.dll_CoAllowSetForegroundWindow]
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x58]
cmp qword [rbp - 0x80], 8
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], r8
cmovae rdx, qword [rsp + 0x68]
xor r9d, r9d
mov rax, qword [rcx]
xor r8d, r8d
call qword [rax + 0x18]
mov edi, eax
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000326a
mov rax, qword [rcx]
call qword [rax + 0x10]
mov r8, qword [rbp - 0x80]
cmp r8, 8
jb 0x140003286
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x68]
inc r8
call fcn.140006670
call qword [sym.imp.ole32.dll_CoUninitialize]
lea r10, str._noqaagent
xor r8d, r8d
lea r9, str._noqaadminagent
inc esi
add rbx, 8
cmp esi, dword [rsp + 0x44]
jl 0x140002fe0
mov ebx, dword [rsp + 0x48]
xor edx, edx
lea rcx, [rbp + 0x340]
mov r8d, 0x208
call fcn.14000cbc0
mov r8d, 0x104
lea rdx, [rbp + 0x340]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x340]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
xor edx, edx
lea rcx, [rbp + 0x550]
mov r8d, 0x208
call fcn.14000cbc0
test r14b, r14b
jne 0x140003322
lea rdx, [0x14003d488]
lea rcx, str.QASvc.exe
call fcn.140003cd0
test eax, eax
jne 0x140003322
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
lea r8, str.eSIM
mov qword [rsp + 0x30], rsi
lea rdx, str.SOFTWAREOEMQuick_Access
mov qword [rsp + 0x28], rsi
mov r9d, 0xffff
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x64], esi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1400033d2
lea rax, [rsp + 0x48]
mov dword [rsp + 0x58], esi
mov qword [rsp + 0x30], rax
lea r9d, [rsi + 0x10]
lea rax, [rsp + 0x64]
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x28], rax
lea r8, str.eSIM
lea rdx, str.SOFTWAREOEMQuick_Access
mov qword [rsp + 0x20], rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x1400033d2
xor r9d, r9d
lea r8, str.eSIM
lea rdx, str.SOFTWAREOEMQuick_Access
call fcn.140002800
test eax, eax
jne 0x1400033d2
mov r8d, dword [rsp + 0x48]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x64]
call fcn.14000b280
test r13b, r13b
jne 0x1400033db
test ebx, ebx
je 0x1400033e2
cmp dword [rsp + 0x64], 1
jne 0x140003409
test r15b, r15b
jne 0x140003409
lea rdx, [0x14003d620]
lea rcx, str.QALSvc.exe
call fcn.140003cd0
test eax, eax
jne 0x140003409
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
test r12b, r12b
jne 0x140003437
mov ebx, esi
call fcn.140003770
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.QAAgent.exe
call fcn.140004180
test al, al
jne 0x140003437
inc ebx
cmp ebx, 5
jl 0x140003410
cmp byte [rsp + 0x40], sil
jne 0x140003467
mov ebx, esi
call fcn.140003a20
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.QAAdminAgent.exe
call fcn.140004180
test al, al
jne 0x140003467
inc ebx
cmp ebx, 5
jl 0x140003440
lea rcx, str.LumiFlex
call fcn.140003e70
test al, al
je 0x1400035a5
mov qword [rsp + 0x30], rsi
lea r8, str.SunlightReadingEnabled
mov qword [rsp + 0x28], rsi
lea rdx, str.SOFTWAREOEMQuick_Access
mov r9d, 0xffff
mov qword [rsp + 0x20], rsi
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x50], esi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14000352b
lea rax, [rsp + 0x48]
mov dword [rsp + 0x58], esi
mov qword [rsp + 0x30], rax
lea r8, str.SunlightReadingEnabled
lea rax, [rsp + 0x50]
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x28], rax
lea rdx, str.SOFTWAREOEMQuick_Access
mov r9d, 0x10
mov qword [rsp + 0x20], rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x14000352b
xor r9d, r9d
lea r8, str.SunlightReadingEnabled
lea rdx, str.SOFTWAREOEMQuick_Access
call fcn.140002800
test eax, eax
jne 0x14000352b
mov r8d, dword [rsp + 0x48]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.14000b280
cmp dword [rsp + 0x50], 1
jne 0x1400035a5
lea r8, str.887E67C6_7817_4776_A22D_DBC4DCFBE013
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14000373a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x14000373a
lea r9, str.SunlightReading.exe
lea r8, [rbp + 0x340]
lea rdx, str._spluginsLumiFlex_s
lea rcx, [rbp + 0x550]
call fcn.140006fb0
xor r9d, r9d
mov dword [rsp + 0x28], 1
lea r8, [rbp + 0x550]
mov qword [rsp + 0x20], rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, str.ColorIntelligence
call fcn.140003e70
test al, al
je 0x1400036c2
mov qword [rsp + 0x30], rsi
lea r8, str.ColorIntelligenceEnabled
mov qword [rsp + 0x28], rsi
lea rdx, str.SOFTWAREOEMQuick_Access
mov r9d, 0xffff
mov qword [rsp + 0x20], rsi
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x50], esi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140003669
lea rax, [rsp + 0x48]
mov dword [rsp + 0x58], esi
mov qword [rsp + 0x30], rax
lea r8, str.ColorIntelligenceEnabled
lea rax, [rsp + 0x50]
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x28], rax
lea rdx, str.SOFTWAREOEMQuick_Access
mov r9d, 0x10
mov qword [rsp + 0x20], rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140003669
xor r9d, r9d
lea r8, str.ColorIntelligenceEnabled
lea rdx, str.SOFTWAREOEMQuick_Access
call fcn.140002800
test eax, eax
jne 0x140003669
mov r8d, dword [rsp + 0x48]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.14000b280
lea rcx, [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
cmp dword [rsp + 0x50], 1
jne 0x1400036c2
cmp byte [rbp - 0x78], 1
jne 0x1400036c2
lea r9, str.CACE.exe
lea r8, [rbp + 0x340]
lea rdx, str._spluginsColorIntelligence_s
lea rcx, [rbp + 0x550]
call fcn.140006fb0
xor r9d, r9d
mov dword [rsp + 0x28], 1
lea r8, [rbp + 0x550]
mov qword [rsp + 0x20], rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp byte [rsp + 0x41], sil
je 0x14000373a
mov r8d, 0x13
mov qword [rbp - 0x80], 7
lea rdx, str.HKEY_LOCAL_MACHINE_
mov qword [rsp + 0x78], rsi
lea rcx, [rsp + 0x68]
mov word [rsp + 0x68], si
call fcn.140005680
mov r8d, 0x19
lea rdx, str.SOFTWAREOEMQuick_Access
lea rcx, [rsp + 0x68]
call fcn.1400057d0
cmp qword [rbp - 0x80], 8
lea rcx, [rsp + 0x68]
cmovae rcx, qword [rsp + 0x68]
call fcn.140007e50
mov r8, qword [rbp - 0x80]
cmp r8, 8
jb 0x14000373a
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x68]
inc r8
call fcn.140006670
mov eax, edi
mov rcx, qword [rbp + 0xb80]
xor rcx, rsp
call fcn.140009ed0
lea r11, [rsp + 0xc90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret