Function at 0x1400858c0
Capabilities:
Create process on windows
Print debug messages
Set registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xf0
mov qword [rbp - 1], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140499908]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rsi, rdx
mov r15, rcx
mov qword [rbp + 7], rdx
xor r12d, r12d
mov dword [0x1404b1fd8], r12d
call fcn.1400b1c7c
mov rcx, rax
test rax, rax
jne 0x140085920
mov ecx, 0x80004005
call fcn.140082d10
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x17], rax
call fcn.1400b1c7c
mov rcx, rax
test rax, rax
jne 0x140085946
mov ecx, 0x80004005
call fcn.140082d10
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x1f], rax
mov rcx, qword [rsi]
or edi, 0xffffffff
cmp dword [rcx - 0x10], 0
jl 0x14008606b
lea rdx, str.________
call fcn.140334588
test rax, rax
je 0x14008606b
mov rcx, qword [rsi]
sub rax, rcx
sar rax, 1
test eax, eax
jle 0x14008606b
cmp dword [rcx - 0x10], 0
jl 0x140085a1d
lea rdx, str._rz_
call fcn.140334588
mov rbx, rax
test rax, rax
je 0x140085a1d
mov rcx, qword [rsi]
sub rbx, rcx
sar rbx, 1
cmp ebx, edi
jle 0x140085a1d
cmp ebx, dword [rcx - 0x10]
jg 0x1400859da
movsxd rax, ebx
lea rcx, [rcx + rax*2]
lea rdx, [0x14043f558]
call fcn.140334588
test rax, rax
je 0x1400859da
sub rax, qword [rsi]
sar rax, 1
jmp 0x1400859dc
mov eax, edi
sub eax, ebx
lea r9d, [rax - 5]
lea r8d, [rbx + 5]
lea rdx, [rbp - 0x69]
mov rcx, rsi
call fcn.140081f20
mov rcx, qword [rax]
call fcn.14033baec
mov dword [0x1404b1fd8], eax
mov rdx, qword [rbp - 0x69]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140085a1d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsi]
cmp dword [rcx - 0x10], 0
jge 0x140085a2a
mov ebx, edi
jmp 0x140085a48
lea rdx, str._note_
call fcn.140334588
mov rbx, rax
test rax, rax
jne 0x140085a42
mov ebx, edi
jmp 0x140085a48
sub rbx, qword [rsi]
sar rbx, 1
lea eax, [rbx + 1]
mov rcx, qword [rsi]
test eax, eax
js 0x140085a76
cmp eax, dword [rcx - 0x10]
jg 0x140085a76
cdqe
lea rcx, [rcx + rax*2]
lea rdx, [0x14043f558]
call fcn.140334588
test rax, rax
je 0x140085a76
sub rax, qword [rsi]
sar rax, 1
jmp 0x140085a78
mov eax, edi
sub eax, ebx
lea r9d, [rax - 8]
lea r8d, [rbx + 8]
lea rdx, [rbp - 0x59]
mov rcx, rsi
call fcn.140081f20
nop
mov r8, rax
lea rdx, [0x14043ed20]
lea rcx, [rbp - 0x61]
call fcn.140082000
nop
mov rdx, rax
lea rcx, [rbp + 0x17]
call fcn.140082310
nop
mov rdx, qword [rbp - 0x61]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140085ace
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x59]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140085aeb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsi]
cmp dword [rcx - 0x10], 0
jge 0x140085af8
mov ebx, edi
jmp 0x140085b16
lea rdx, [0x14043f578]
call fcn.140334588
mov rbx, rax
test rax, rax
jne 0x140085b10
mov ebx, edi
jmp 0x140085b16
sub rbx, qword [rsi]
sar rbx, 1
lea eax, [rbx + 1]
mov rcx, qword [rsi]
test eax, eax
js 0x140085b44
cmp eax, dword [rcx - 0x10]
jg 0x140085b44
cdqe
lea rcx, [rcx + rax*2]
lea rdx, [0x14043f558]
call fcn.140334588
test rax, rax
je 0x140085b44
sub rax, qword [rsi]
sar rax, 1
jmp 0x140085b46
mov eax, edi
sub eax, ebx
lea r9d, [rax - 7]
lea r8d, [rbx + 7]
lea rdx, [rbp - 0x51]
mov rcx, rsi
call fcn.140081f20
nop
mov rdx, rax
lea rcx, [rbp + 0x1f]
call fcn.140082310
nop
mov rdx, qword [rbp - 0x51]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140085b87
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp dword [0x1404b1fd8], 0x3eb
jne 0x140085c02
mov ecx, 0x103
call fcn.1400b2c04
test rax, rax
je 0x140085bb7
mov r8d, 0x103
mov rdx, rax
lea rcx, [0x1404b9008]
call fcn.140082750
lea r8, [rbp + 0x17]
lea rdx, [0x1404b9008]
lea rcx, [rbp - 0x49]
call fcn.140081320
nop
mov r9d, 0x40
mov r8, qword [0x1404ba848]
mov rdx, qword [rax]
mov rcx, r15
call fcn.1400a9694
nop
mov rdx, qword [rbp - 0x49]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140085c02
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp dword [0x1404b1fd8], 0x3ec
jne 0x140085c7d
mov ecx, 0x104
call fcn.1400b2c04
test rax, rax
je 0x140085c32
mov r8d, 0x104
mov rdx, rax
lea rcx, [0x1404b9008]
call fcn.140082750
lea r8, [rbp + 0x17]
lea rdx, [0x1404b9008]
lea rcx, [rbp - 0x41]
call fcn.140081320
nop
mov r9d, 0x40
mov r8, qword [0x1404ba848]
mov rdx, qword [rax]
mov rcx, r15
call fcn.1400a9694
nop
mov rdx, qword [rbp - 0x41]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140085c7d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp dword [0x1404b1fd8], 0x3ed
jne 0x140085cf8
mov ecx, 0x105
call fcn.1400b2c04
test rax, rax
je 0x140085cad
mov r8d, 0x105
mov rdx, rax
lea rcx, [0x1404b9008]
call fcn.140082750
lea r8, [rbp + 0x17]
lea rdx, [0x1404b9008]
lea rcx, [rbp - 0x39]
call fcn.140081320
nop
mov r9d, 0x40
mov r8, qword [0x1404ba848]
mov rdx, qword [rax]
mov rcx, r15
call fcn.1400a9694
nop
mov rdx, qword [rbp - 0x39]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140085cf8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp dword [0x1404b1fd8], 0x3ee
jne 0x140085d73
mov ecx, 0x106
call fcn.1400b2c04
test rax, rax
je 0x140085d28
mov r8d, 0x106
mov rdx, rax
lea rcx, [0x1404b9008]
call fcn.140082750
lea r8, [rbp + 0x17]
lea rdx, [0x1404b9008]
lea rcx, [rbp - 0x31]
call fcn.140081320
nop
mov r9d, 0x40
mov r8, qword [0x1404ba848]
mov rdx, qword [rax]
mov rcx, r15
call fcn.1400a9694
nop
mov rdx, qword [rbp - 0x31]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140085d73
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp dword [0x1404b1fd8], 0x3ef
jne 0x140085dee
mov ecx, 0x107
call fcn.1400b2c04
test rax, rax
je 0x140085da3
mov r8d, 0x107
mov rdx, rax
lea rcx, [0x1404b9008]
call fcn.140082750
lea r8, [rbp + 0x17]
lea rdx, [0x1404b9008]
lea rcx, [rbp - 0x29]
call fcn.140081320
nop
mov r9d, 0x40
mov r8, qword [0x1404ba848]
mov rdx, qword [rax]
mov rcx, r15
call fcn.1400a9694
nop
mov rdx, qword [rbp - 0x29]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140085dee
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp dword [0x1404b1fd8], 0x3e9
jne 0x140085f31
lea r8, [0x14043ed20]
lea rdx, [rbp + 0x1f]
lea rcx, [rbp - 0x21]
call fcn.1400821b0
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rdx, qword [rbp - 0x21]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140085e38
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbp + 0x27]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xf]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [0x1404ba878]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rax, qword [rbp + 0x1f]
mov ebx, dword [rax - 0x10]
cmp dword [rax - 8], 1
jle 0x140085e92
mov edx, ebx
lea rcx, [rbp + 0x1f]
call fcn.1400828d0
mov rax, qword [rbp + 0x1f]
lea ecx, [rbx + rbx]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x14043f588]
mov rcx, qword [rbp + 0xf]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0xf]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x108
call fcn.1400b2c04
test rax, rax
je 0x140085ee6
mov r8d, 0x108
mov rdx, rax
lea rcx, [0x1404b9008]
call fcn.140082750
lea r8, [rbp + 0x17]
lea rdx, [0x1404b9008]
lea rcx, [rbp - 0x19]
call fcn.140081320
nop
mov r9d, 0x40
mov r8, qword [0x1404ba848]
mov rdx, qword [rax]
mov rcx, r15
call fcn.1400a9694
nop
mov rdx, qword [rbp - 0x19]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140085f31
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8, [0x14043ed10]
lea rdx, [0x14043f590]
lea rcx, [rbp + 0x17]
call fcn.140084620
mov rbx, qword [rbp + 0x17]
cmp dword [rbx - 0x10], 0
jl 0x140086003
lea rdx, str.http
mov rcx, rbx
call fcn.140334588
mov r14, rax
test rax, rax
je 0x140086003
sub r14, rbx
sar r14, 1
test r14d, r14d
js 0x140086003
lea eax, [r14 + 4]
test eax, eax
js 0x140085fac
cmp eax, dword [rbx - 0x10]
jg 0x140085fac
cdqe
lea rcx, [rbx + rax*2]
lea rdx, [0x14043ed10]
call fcn.140334588
test rax, rax
je 0x140085fac
sub rax, rbx
sar rax, 1
jmp 0x140085fae
mov eax, edi
sub eax, r14d
mov r9d, eax
mov r8d, r14d
lea rdx, [rbp - 0x11]
lea rcx, [rbp + 0x17]
call fcn.140081f20
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8, qword [rax]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rbp - 0x11]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140086003
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp dword [0x1404b1fd8], 0x3e9
jne 0x140086030
mov edx, 2
mov rcx, r15
call fcn.1400b52ac
mov rcx, r15
call fcn.1400a8130
mov rcx, qword [0x1404b1fe0]
call fcn.140091cf0
lea r8, [0x14043ed20]
mov rdx, rsi
lea rcx, [rbp - 9]
call fcn.1400821b0
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rdx, qword [rbp - 9]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400860ac
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400860ac
mov ecx, 0xe5
call fcn.1400b2c04
test rax, rax
je 0x14008608f
mov r8d, 0xe5
mov rdx, rax
lea rcx, [0x1404b9008]
call fcn.140082750
mov r9d, 0x40
mov r8, qword [0x1404ba848]
mov rdx, qword [0x1404b9008]
mov rcx, r15
call fcn.1400a9694
nop
mov rdx, qword [rbp + 0x1f]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400860ca
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x17]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400860e8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140086102
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14025d560
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret