Function at 0x1004014f0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Terminate process
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov rax, qword [0x10040a018]
mov rsi, qword [rax]
movzx eax, byte [rsi]
mov dword [rbp + 0x50], ecx
mov dword [rbp + 0x58], edx
mov dword [rbp + 0x60], r8d
cmp al, 0x2f
je 0x1004018a0
cmp al, 0x5c
jne 0x100401580
movzx r13d, byte [rsi + 1]
cmp r13b, 0x5c
je 0x1004018b0
mov r8d, 0xe
mov rdx, rsi
lea rcx, str.proc_registry
call sym.strncmp
test eax, eax
jne 0x100401890
cmp byte [rsi + 0xe], 0x36
lea rbx, [rsi + 0xe]
je 0x100401900
cmp byte [rbx], 0x33
jne 0x100401571
cmp byte [rbx + 1], 0x32
je 0x10040190a
movzx eax, byte [rsi + 0xe]
xor r12d, r12d
jmp 0x1004015d8
mov rcx, rsi
call sym.strlen
lea rcx, [rax + 1]
call sym.malloc
mov r10d, 0x5c5c
mov word [rax], r10w
mov r12, rax
lea rdx, [rax + 2]
movzx eax, byte [rsi]
test al, al
jne 0x1004015c1
jmp 0x1004015c5
add rsi, 1
mov byte [rdx], al
add rdx, 1
movzx eax, byte [rsi]
test al, al
je 0x1004015c5
cmp al, 0x3a
jne 0x1004015b0
mov byte [rdx], 0
movzx eax, byte [rsi + 1]
lea rbx, [rsi + 1]
cmp al, 0x2f
je 0x100401970
cmp al, 0x5c
je 0x100401a47
mov rax, rbx
add rbx, 1
cmp byte [rbx], 0x5c
jne 0x1004015e0
movzx r13d, byte [rax + 2]
lea rsi, [rbx + 1]
mov byte [rbx], 0
mov r14, rsi
test r13b, r13b
jne 0x100401616
jmp 0x10040161c
movzx r13d, byte [r14 + 1]
add r14, 1
test r13b, r13b
je 0x10040161c
cmp r13b, 0x5c
jne 0x100401608
lea r15, str.HKCR
mov byte [r14], 0
xor ebx, ebx
lea rcx, str.root
mov rdi, r15
jmp 0x10040164b
mov rcx, qword [rdi]
add rdi, 0x10
add ebx, 1
test rcx, rcx
je 0x100401a51
mov rdx, rsi
call sym.strcmp
test eax, eax
jne 0x100401638
mov byte [r14], r13b
cmp r13b, 0x5c
jne 0x10040166a
add r14, 1
cmp byte [r14], 0x5c
je 0x100401660
mov rcx, r14
call sym.strlen
cmp dword [rbp + 0x50], 1
jle 0x1004016ea
lea r15, [r14 + rax]
movzx eax, byte [0x100404380]
cmp r15, r14
ja 0x10040169d
jmp 0x100401820
sub r15, 1
cmp r15, r14
je 0x100401820
cmp byte [r15], al
jne 0x100401690
mov byte [r15], 0
mov rcx, qword [0x10040a008]
test rcx, rcx
je 0x1004016b7
call sym.free
add r15, 1
xor r8d, r8d
xor ecx, ecx
mov rdx, r15
call sym.mbstowcs
lea rsi, [rax + 1]
lea rcx, [rsi + rsi]
call sym.malloc
mov r8, rsi
mov rdx, r15
mov rcx, rax
mov qword [0x10040a008], rax
call sym.mbstowcs
movsxd rbx, ebx
lea rax, str.root
shl rbx, 4
mov rdx, qword [rax + rbx + 8]
test r12, r12
je 0x100401748
lea r8, [rbp - 0x10]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegConnectRegistryA]
test eax, eax
jne 0x100401a40
mov rcx, r12
call sym.free
cmp byte [r14], 0
jne 0x100401752
mov rax, qword [rbp - 0x10]
mov qword [0x10040a010], rax
lea rsp, [rbp + 8]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov qword [rbp - 0x10], rdx
cmp byte [r14], 0
je 0x100401725
xor r8d, r8d
mov rdx, r14
xor ecx, ecx
mov rbx, rsp
call sym.mbstowcs
lea r8, [rax + 1]
lea rax, [rax + rax + 0x11]
and rax, 0xfffffffffffffff0
call fcn.100402b00
sub rsp, rax
mov rdx, r14
lea r12, [rsp + 0x50]
mov rcx, r12
call sym.mbstowcs
mov r8d, dword [rbp + 0x58]
test r8d, r8d
jne 0x10040191a
mov rax, qword [0x10040a018]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x100401981
xor r9d, r9d
xor r8d, r8d
mov ecx, 1
mov rsi, rsp
call sym.cygwin_conv_path
mov r9, rax
lea rax, [rax + rax + 0xf]
and rax, 0xfffffffffffffff0
call fcn.100402b00
mov ecx, 1
sub rsp, rax
mov rax, qword [0x10040a018]
lea rdi, [rsp + 0x50]
mov rdx, qword [rax + 8]
mov r8, rdi
call sym.cygwin_conv_path
mov rcx, qword [rbp - 0x10]
mov r8, rdi
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
test eax, eax
jne 0x100401a40
mov edx, dword [0x10040a030]
test edx, edx
jne 0x1004019b8
mov rsp, rsi
mov rsp, rbx
jmp 0x100401730
cmp byte [r15], al
je 0x1004016a2
movsxd rbx, ebx
lea rax, str.root
mov rcx, qword [0x10040a008]
shl rbx, 4
mov rax, qword [rax + rbx + 8]
mov qword [0x10040a010], rax
test rcx, rcx
je 0x100401854
call sym.free
xor r8d, r8d
mov rdx, r14
xor ecx, ecx
call sym.mbstowcs
lea rbx, [rax + 1]
lea rcx, [rbx + rbx]
call sym.malloc
mov r8, rbx
mov rdx, r14
mov rcx, rax
mov qword [0x10040a008], rax
call sym.mbstowcs
jmp 0x100401730
mov rbx, rsi
xor r12d, r12d
jmp 0x1004015f1
mov rcx, rsi
call dbg.translate(char*)
movzx eax, byte [rsi]
jmp 0x100401524
mov rcx, rsi
lea rbx, [rsi + 2]
call sym.strlen
lea rcx, [rax + 1]
call sym.malloc
mov r9d, 0x5c5c
mov word [rax], r9w
mov r12, rax
lea rdx, [rax + 2]
movzx eax, byte [rsi + 2]
test al, al
jne 0x1004018f1
jmp 0x1004018f5
add rbx, 1
mov byte [rdx], al
add rdx, 1
movzx eax, byte [rbx]
test al, al
je 0x1004018f5
cmp al, 0x5c
jne 0x1004018e0
mov byte [rdx], 0
movzx eax, byte [rbx]
jmp 0x1004015d8
cmp byte [rbx + 1], 0x34
jne 0x100401562
movzx eax, byte [rsi + 0x10]
lea rbx, [rsi + 0x10]
xor r12d, r12d
jmp 0x1004015d8
mov r9d, dword [rbp + 0x58]
mov rcx, qword [rbp - 0x10]
xor r8d, r8d
mov rdx, r12
lea rax, [0x10040a010]
or r9d, dword [0x10040a024]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [rbp + 0x60]
mov r15d, eax
test ecx, ecx
je 0x100401960
test eax, eax
je 0x1004019cf
cmp eax, 5
je 0x1004019cf
mov ecx, r15d
call dbg.Fail(unsigned int)
test r15d, r15d
je 0x100401815
jmp 0x100401958
mov rcx, rbx
call dbg.translate(char*)
movzx eax, byte [rsi + 1]
jmp 0x1004015d8
mov rcx, qword [rbp - 0x10]
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
test eax, eax
jne 0x100401a40
mov eax, dword [0x10040a030]
test eax, eax
je 0x100401815
mov rdx, r12
lea rcx, str.key__ls_unloaded_n
call sym.printf
jmp 0x100401815
mov r8, rdi
mov rdx, r12
lea rcx, str.key__ls_loaded_from_file__ls_n
call sym.printf
jmp 0x100401812
lea rax, [rbp - 8]
mov rcx, qword [rbp - 0x10]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], 0
mov rdx, r12
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov r13d, dword [rbp + 0x58]
or r13d, dword [0x10040a024]
mov dword [rsp + 0x28], r13d
mov eax, dword [rbp + 0x60]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100401960
test r15d, r15d
je 0x100401a31
mov rax, qword [rbp - 8]
mov qword [0x10040a010], rax
jmp 0x100401815
mov rcx, qword [0x10040a010]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100401a21
mov ecx, eax
call dbg.Fail(unsigned int)
movzx r13d, byte [rbx + 1]
jmp 0x1004015f1
call sym.__getreent
mov r8d, 0x29
mov edx, 1
lea rcx, str.Unknown_key_prefix.__Valid_prefixes_are:_n
mov r9, qword [rax + 0x18]
lea rbx, str.root
lea rsi, str._t_s_n
call sym.fwrite
call sym.__getreent
add r15, 0x10
mov r8, rbx
mov rdx, rsi
mov rcx, qword [rax + 0x18]
call sym.fprintf
mov rbx, qword [r15 - 0x10]
test rbx, rbx
jne 0x100401a7f
mov ecx, 1
call sym.exit
nop
nop dword [rax + rax]