Function at 0x140002090
Capabilities:
Create process on windows
Delete file
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x400]
sub rsp, 0x500
mov rax, qword [0x14001d010]
xor rax, rsp
mov qword [rbp + 0x3f0], rax
xor r14d, r14d
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r14w
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rcx + r8*2], r14w
jne 0x1400020e0
mov rdx, rcx
lea rcx, [rbp - 0x80]
call fcn.140003940
nop
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r14w
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r14w
mov esi, 2
mov r8d, esi
cmp qword [rbp - 0x70], rsi
cmovb r8, qword [rbp - 0x70]
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
lea rcx, [rbp - 0x40]
call fcn.140003940
nop
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r14w
mov rax, qword [rbp - 0x70]
cmp rax, 3
jb 0x1400026c4
add rax, 0xfffffffffffffffd
mov r8, rdi
cmp rax, rdi
cmovb r8, rax
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
add rdx, 6
lea rcx, [rsp + 0x58]
call fcn.140003940
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x1400021ce
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400021c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400026d6
call fcn.140004298
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [rbp - 0x50], xmm1
lea rbx, [rbp - 0x60]
movq rcx, xmm0
psrldq xmm1, 8
movq rax, xmm1
cmp rax, 8
cmovae rbx, rcx
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp - 0x20]
call fcn.140005ce0
mov dword [rsp + 0x78], 0x410
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor r8d, r8d
test eax, eax
je 0x14000225e
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], r14w
lea rdx, [0x140019c74]
jmp 0x140002336
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea rdx, str.BGTComServer
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x1400022b8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], r14w
xor r8d, r8d
lea rdx, [0x140019c74]
jmp 0x140002336
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r9d, 1
xor r8d, r8d
lea rdx, str.BGTComServer
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x140002307
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], r14w
xor r8d, r8d
lea rdx, [0x140019c74]
jmp 0x140002336
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], r14w
lea rax, [rbp - 0x20]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140002325
mov r8, rdi
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x38]
call fcn.140003940
nop
mov rdi, qword [rbp - 0x28]
mov rbx, qword [rbp - 0x40]
mov r9, qword [rsp + 0x48]
test r9, r9
je 0x14000256f
lea rdx, [rbp - 0x40]
cmp rdi, 8
cmovae rdx, rbx
cmp qword [rbp - 0x30], 2
jne 0x140002441
lea rcx, [0x140019de4]
sub rdx, rcx
nop dword [rax + rax]
movzx eax, word [rcx]
cmp word [rcx + rdx], ax
jne 0x140002441
add rcx, 2
sub rsi, 1
jne 0x140002380
lea rcx, [rsp + 0x58]
call fcn.140001bc0
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
xor edx, edx
call fcn.1400089d8
cmp eax, 0xffffffff
je 0x1400023f7
lea r9, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae r9, qword [rsp + 0x38]
lea r8, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae r8, qword [rsp + 0x58]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x14000256f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000256a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400026be
jmp 0x14000256a
lea r10, [rsp + 0x38]
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
cmovae r10, r8
test r9, r9
je 0x140002579
mov rax, r9
mov rcx, r10
cmp word [rcx], 0x26
je 0x14000247c
add rcx, 2
sub rax, 1
jne 0x140002467
jmp 0x140002579
sub rcx, r10
sar rcx, 1
cmp rcx, 0xffffffffffffffff
je 0x140002579
lea rax, [rsp + 0x38]
cmp rdx, 8
cmovae rax, r8
mov r10, r14
cmp word [rax + r9*2 - 2], 0x22
setne r10b
add r10, 0xfffffffffffffffe
sub r10, rcx
add r10, r9
inc rcx
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r14w
cmp r9, rcx
jb 0x1400026ca
sub r9, rcx
cmp r9, r10
cmovb r10, r9
lea rax, [rsp + 0x38]
cmp rdx, 8
cmovae rax, r8
lea rdx, [rax + rcx*2]
mov r8, r10
lea rcx, [rsp + 0x58]
call fcn.140003940
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
xor edx, edx
call fcn.1400089d8
cmp eax, 0xffffffff
je 0x14000252d
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x14000256f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000256a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400026d0
call fcn.140004298
mov rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x38]
cmp rdx, 8
jb 0x1400025b4
lea rdx, [rdx*2 + 2]
mov rax, r8
cmp rdx, 0x1000
jb 0x1400025ac
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400026d6
mov rcx, r8
call fcn.140004298
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], r14w
cmp rdi, 8
jb 0x140002604
lea rdx, [rdi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400025fb
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400026dc
mov rcx, rbx
call fcn.140004298
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140002644
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000263f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400026e2
call fcn.140004298
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r14w
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140002691
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000268c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400026b8
call fcn.140004298
mov rcx, qword [rbp + 0x3f0]
xor rcx, rsp
call fcn.140004260
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.140008e34
nop
call fcn.140008e34
nop
call fcn.140003ac0
nop
call fcn.140003ac0
int3
call fcn.140008e34
nop
call fcn.140008e34
nop
call fcn.140008e34
nop
call fcn.140008e34
int3