Function at 0x140005120
Capabilities:
Print debug messages
Read file on windows
Set registry value
Write file on windows

Disassembly:
mov r11, rsp
push rbx
push rsi
sub rsp, 0x4e8
xor eax, eax
mov qword [r11 + 8], rbp
mov qword [r11 + 0x10], rdi
mov qword [r11 - 0x18], r12
mov qword [r11 - 0x28], r14
xor r14d, r14d
mov r12, rcx
mov rbx, r8
mov dword [r11 - 0x478], r14d
mov dword [rsp + 0x84], eax
lea rcx, [r11 - 0x434]
xor edx, edx
mov r8d, 0x400
mov qword [r11 - 0x470], rax
mov word [rsp + 0x70], r14w
mov qword [rsp + 0x72], rax
mov dword [rsp + 0x7a], eax
mov word [rsp + 0x7e], ax
mov word [rsp + 0x60], r14w
mov qword [rsp + 0x62], rax
mov dword [rsp + 0x6a], eax
mov word [rsp + 0x6e], ax
mov dword [r11 - 0x438], r14d
call fcn.14000aca0
mov edx, dword [rbx + 0xc]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r8d, dword [rbx + 0xc]
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.14000aca0
mov ebp, dword [rbx + 0xc]
mov ebx, 0xc0000001
mov edi, r14d
test ebp, ebp
je 0x14000522b
nop word [rax + rax]
xor eax, eax
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov ecx, ebp
sub ecx, edi
mov eax, edi
xor r9d, r9d
mov dword [rsp + 0x30], ecx
add rax, rsi
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
test eax, eax
jns 0x140005220
cmp eax, 0x80000005
jne 0x14000522b
add edi, dword [rsp + 0x58]
mov ebx, r14d
cmp edi, ebp
jb 0x1400051d0
test ebx, ebx
js 0x1400053cd
lea rcx, [rsp + 0x70]
mov rdx, rsi
mov qword [rsp + 0x4d8], r13
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsi + 0x800]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r13d, dword [rsi + 0x1000]
mov edi, dword [rsi + 0x1004]
mov eax, 2
lea rbp, [rsi + 0x1010]
mov qword [rsp + 0x510], r14
mov word [rsp + 0x52], ax
lea rax, [0x14000bffc]
mov word [rsp + 0x50], r14w
mov qword [rsp + 0x58], rax
test rbp, rbp
je 0x140005357
test edi, edi
je 0x140005357
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], r14
lea r8, [rsp + 0x90]
lea rcx, [rsp + 0x510]
xor r9d, r9d
mov edx, 0x20006
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x90], 0x30
mov qword [rsp + 0x98], r14
mov dword [rsp + 0xa8], 0x240
mov qword [rsp + 0xb0], r14
mov qword [rsp + 0xb8], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
mov ebx, eax
test eax, eax
js 0x140005336
mov rcx, qword [rsp + 0x510]
lea rdx, [rsp + 0x60]
mov r9d, r13d
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov ebx, eax
mov rcx, qword [rsp + 0x510]
test rcx, rcx
je 0x140005351
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov qword [rsp + 0x510], r14
test ebx, ebx
jns 0x14000536a
jmp 0x14000535c
mov ebx, 0xc000000d
lea rcx, str.WriteRegistryValue_failed__status___08x_n
mov edx, ebx
call sub.ntoskrnl.exe_DbgPrint
mov qword [rsp + 0x40], r14
mov eax, r14d
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 0x404
test ebx, ebx
mov rcx, r12
setns al
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0xc0], eax
lea rax, [rsp + 0xc0]
xor edx, edx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov dword [rsp + 0xc4], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov r13, qword [rsp + 0x4d8]
mov ebx, eax
test eax, eax
cmovns ebx, r14d
mov r14, qword [rsp + 0x4d0]
mov r12, qword [rsp + 0x4e0]
mov rdi, qword [rsp + 0x508]
mov rbp, qword [rsp + 0x500]
test rsi, rsi
je 0x1400053fd
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
add rsp, 0x4e8
pop rsi
pop rbx
ret