Function at 0x140004800
Capabilities:
Accept command line arguments
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Delete registry value
Get common file path
Persist via run registry key
Terminate process

Disassembly:
sub rsp, 0x378
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x58], rax
lea rdx, str.D1EAF6D7_37CC_4099_9804_109D105C8C04
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14000492f
call fcn.140010bf0
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
je 0x14000486f
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x70], 0
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
cmp eax, 1
jne 0x1400048a4
lea r9, str.1AB4B1DA_C681_4EA1_B26E_D540A95C9846
mov r8d, 1
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x70], rax
jmp 0x1400048c0
lea r9, str.1AB4B1DA_C681_4EA1_B26E_D540A95C9846
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x70], rax
xor eax, eax
cmp eax, 1
je 0x14000490d
mov qword [rsp + 0x78], 0
lea r8, str.45D9B016_B182_4AD7_A9ED_63977AC38876
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
je 0x140004909
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400048c0
jmp 0x14000490d
cmp qword [rsp + 0x70], 0
je 0x140004920
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x1400056e1
lea rdx, str.21B6BD7D_1AF5_4D84_BBB8_EB90B1FB3EB6
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140004a5e
lea r8, str.8EBF6F9C_7411_475C_9F80_939B32C4E185
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x88], rax
cmp qword [rsp + 0x88], 0
je 0x14000499c
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x90], eax
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, str.9744E25D_022E_4816_9277_331D2BD7A42B
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
je 0x1400049eb
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x94], eax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp eax, 1
je 0x140004a44
mov qword [rsp + 0x98], 0
lea r8, str.45D9B016_B182_4AD7_A9ED_63977AC38876
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x98], rax
cmp qword [rsp + 0x98], 0
je 0x140004a40
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400049eb
jmp 0x140004a44
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
jmp 0x1400056e1
lea rdx, str.AE26C56F_5DA3_4764_BD93_1DF4D63DF269
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140004b8d
lea r8, str.8EBF6F9C_7411_475C_9F80_939B32C4E185
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0xa8], rax
cmp qword [rsp + 0xa8], 0
je 0x140004acb
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xb0], eax
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, str.9744E25D_022E_4816_9277_331D2BD7A42B
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0xa0], rax
cmp qword [rsp + 0xa0], 0
je 0x140004b1a
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xb4], eax
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp eax, 1
je 0x140004b73
mov qword [rsp + 0xb8], 0
lea r8, str.45D9B016_B182_4AD7_A9ED_63977AC38876
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0xb8], rax
cmp qword [rsp + 0xb8], 0
je 0x140004b6f
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140004b1a
jmp 0x140004b73
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
jmp 0x1400056e1
lea rdx, str.0B923354_7A33_4FD4_B849_9911B484B158
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140004c1a
xor eax, eax
cmp eax, 1
je 0x140004c00
mov qword [rsp + 0xc0], 0
lea r8, str.45D9B016_B182_4AD7_A9ED_63977AC38876
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0xc0], rax
cmp qword [rsp + 0xc0], 0
je 0x140004bfc
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140004ba7
jmp 0x140004c00
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
jmp 0x1400056e1
lea rdx, str.60EBCA07_87EA_449B_A502_F73BD916D6CB
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140004fee
mov qword [rsp + 0xd8], 0
lea rdx, [rsp + 0xc8]
lea rcx, [0x14008a1d0]
call fcn.140005d90
mov qword [rsp + 0xd0], rax
cmp qword [rsp + 0xd0], 0
je 0x140004fc8
lea rdx, [rsp + 0xe8]
lea rcx, [0x14008a1d0]
call fcn.140005ff0
mov qword [rsp + 0xe0], rax
cmp qword [rsp + 0xe0], 0
je 0x140004fba
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0xd8], rax
cmp qword [rsp + 0xd8], 0
je 0x140004fba
mov rdx, qword [rsp + 0xd8]
mov ecx, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jbe 0x140004fba
lea r8, str.3602CFE8_0CCC_4FEE_8B2C_A2437CFF0006
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xf0], rax
cmp qword [rsp + 0xf0], 0
je 0x140004fac
xor edx, edx
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xf8], eax
cmp dword [rsp + 0xf8], 0
je 0x140004d39
cmp dword [rsp + 0xf8], 0x80
jne 0x140004f90
lea r8, str.45D9B016_B182_4AD7_A9ED_63977AC38876
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x190], rax
cmp qword [rsp + 0x190], 0
je 0x140004d7b
mov rcx, qword [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140004d39
cmp dword [reloc.WS2_32.dll_accept], 1
jne 0x140004dc7
lea r8, [rsp + 0x1d0]
lea rdx, [0x140068090]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140004dc7
lea rdx, str.AB1F3E47_AEF1_400E_A108_233A046C3A34
mov rcx, qword [rsp + 0x1d0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x1d0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x14008c03c], 1
jne 0x140004e13
lea r8, [rsp + 0x1d8]
lea rdx, [0x1400680f0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140004e13
lea rdx, [0x14008c162]
mov rcx, qword [rsp + 0x1d8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x1d8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, gethostname
xor edx, edx
lea rcx, [rsp + 0x198]
call fcn.14004f6e0
mov dword [rsp + 0x1a0], 3
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x1a8], rax
mov eax, 0x614
mov word [rsp + 0x1b8], ax
mov dword [rsp + 0x118], 0
lea rcx, [rsp + 0x198]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x140004e96
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x118]
inc eax
mov dword [rsp + 0x118], eax
cmp dword [rsp + 0x118], 0xa
jle 0x140004e94
jmp 0x140004e96
jmp 0x140004e5b
mov r8d, gethostname
xor edx, edx
lea rcx, [rsp + 0x198]
call fcn.14004f6e0
mov dword [rsp + 0x1a0], 3
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x1a8], rax
mov eax, 0x614
mov word [rsp + 0x1b8], ax
mov dword [rsp + 0x118], 0
lea rcx, [rsp + 0x198]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x140004f19
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x118]
inc eax
mov dword [rsp + 0x118], eax
cmp dword [rsp + 0x118], 0xa
jle 0x140004f17
jmp 0x140004f19
jmp 0x140004ede
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x120]
call fcn.14004f6e0
mov dword [rsp + 0x120], WSASetLastError
lea rax, [rsp + 0x100]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x120]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp qword [rsp + 0xd8], 0
je 0x140004fe1
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, str.322D53E9_CD63_4057_A2E1_962BAD94B133
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140005464
mov qword [rsp + 0x1f0], 0
mov qword [rsp + 0x1f8], 0
lea rdx, [rsp + 0x1e0]
lea rcx, [0x14008a1d0]
call fcn.140005d90
mov qword [rsp + 0x1e8], rax
cmp qword [rsp + 0x1e8], 0
je 0x140005425
lea rdx, [rsp + 0x208]
lea rcx, [0x14008a1d0]
call fcn.140005ff0
mov qword [rsp + 0x200], rax
cmp qword [rsp + 0x200], 0
je 0x140005417
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x1f8], rax
cmp qword [rsp + 0x1f8], 0
je 0x140005417
mov rdx, qword [rsp + 0x1f8]
mov ecx, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jbe 0x140005417
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x1f0], rax
cmp qword [rsp + 0x1f0], 0
je 0x140005409
mov r8d, reloc.WS2_32.dll_recv
xor edx, edx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x18]
call fcn.140050254
mov dword [rsp + 0x20c], eax
mov eax, dword [rsp + 0x20c]
mov dword [rsp + 0x28], eax
lea rax, str.EB1CF6E5_9E98_4B13_B304_5920A16133FC
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x58]
mov r9, qword [rax + 0x10]
lea r8, str.__s___s__x
mov edx, 0x7fff
mov rcx, qword [rsp + 0x1f0]
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
lea r8, str.3602CFE8_0CCC_4FEE_8B2C_A2437CFF0006
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x210], rax
cmp qword [rsp + 0x210], 0
je 0x140005409
xor edx, edx
mov rcx, qword [rsp + 0x210]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x218], eax
cmp dword [rsp + 0x218], 0
je 0x140005197
cmp dword [rsp + 0x218], 0x80
jne 0x1400053ed
lea r8, str.45D9B016_B182_4AD7_A9ED_63977AC38876
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x2b0], rax
cmp qword [rsp + 0x2b0], 0
je 0x1400051d9
mov rcx, qword [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140005197
cmp dword [reloc.WS2_32.dll_accept], 1
jne 0x140005225
lea r8, [rsp + 0x2f0]
lea rdx, [0x140068150]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140005225
lea rdx, str.AB1F3E47_AEF1_400E_A108_233A046C3A34
mov rcx, qword [rsp + 0x2f0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x2f0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x14008c03c], 1
jne 0x140005271
lea r8, [rsp + 0x2f8]
lea rdx, [0x1400681b0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140005271
lea rdx, [0x14008c162]
mov rcx, qword [rsp + 0x2f8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x2f8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, gethostname
xor edx, edx
lea rcx, [rsp + 0x2b8]
call fcn.14004f6e0
mov dword [rsp + 0x2c0], 3
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x2c8], rax
mov eax, 0x614
mov word [rsp + 0x2d8], ax
mov dword [rsp + 0x238], 0
lea rcx, [rsp + 0x2b8]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x1400052f4
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x238]
inc eax
mov dword [rsp + 0x238], eax
cmp dword [rsp + 0x238], 5
jle 0x1400052f2
jmp 0x1400052f4
jmp 0x1400052b9
mov r8d, gethostname
xor edx, edx
lea rcx, [rsp + 0x2b8]
call fcn.14004f6e0
mov dword [rsp + 0x2c0], 3
mov rax, qword [rsp + 0x200]
mov qword [rsp + 0x2c8], rax
mov eax, 0x614
mov word [rsp + 0x2d8], ax
mov dword [rsp + 0x238], 0
lea rcx, [rsp + 0x2b8]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x140005377
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x238]
inc eax
mov dword [rsp + 0x238], eax
cmp dword [rsp + 0x238], 5
jle 0x140005375
jmp 0x140005377
jmp 0x14000533c
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x240]
call fcn.14004f6e0
mov dword [rsp + 0x240], WSASetLastError
lea rax, [rsp + 0x220]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x240]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x1f0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x210]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0x210]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x200]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp qword [rsp + 0x1f0], 0
je 0x14000543e
mov rcx, qword [rsp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp qword [rsp + 0x1f8], 0
je 0x140005457
mov rcx, qword [rsp + 0x1f8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, str.BD43439A_68DC_490E_A1DD_BBB201F6FE50
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400056dc
lea rdx, [rsp + 0x300]
lea rcx, [0x14008a1d0]
call fcn.140005d90
mov qword [rsp + 0x308], rax
cmp qword [rsp + 0x308], 0
je 0x1400056d4
lea rdx, [rsp + 0x318]
lea rcx, [0x14008a1d0]
call fcn.140005ff0
mov qword [rsp + 0x310], rax
cmp qword [rsp + 0x310], 0
je 0x1400056c6
lea r8, str.45D9B016_B182_4AD7_A9ED_63977AC38876
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x320], rax
cmp qword [rsp + 0x320], 0
je 0x14000551a
mov rcx, qword [rsp + 0x320]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400054d8
cmp dword [reloc.WS2_32.dll_accept], 1
jne 0x140005566
lea r8, [rsp + 0x360]
lea rdx, [0x140068210]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140005566
lea rdx, str.AB1F3E47_AEF1_400E_A108_233A046C3A34
mov rcx, qword [rsp + 0x360]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x360]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x14008c03c], 1
jne 0x1400055b2
lea r8, [rsp + 0x368]
lea rdx, [0x140068270]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1400055b2
lea rdx, [0x14008c162]
mov rcx, qword [rsp + 0x368]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x368]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, gethostname
xor edx, edx
lea rcx, [rsp + 0x328]
call fcn.14004f6e0
mov dword [rsp + 0x330], 3
mov rax, qword [rsp + 0x308]
mov qword [rsp + 0x338], rax
mov eax, 0x614
mov word [rsp + 0x348], ax
mov dword [rsp + 0x31c], 0
lea rcx, [rsp + 0x328]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x140005635
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x31c]
inc eax
mov dword [rsp + 0x31c], eax
cmp dword [rsp + 0x31c], 5
jle 0x140005633
jmp 0x140005635
jmp 0x1400055fa
mov r8d, gethostname
xor edx, edx
lea rcx, [rsp + 0x328]
call fcn.14004f6e0
mov dword [rsp + 0x330], 3
mov rax, qword [rsp + 0x310]
mov qword [rsp + 0x338], rax
mov eax, 0x614
mov word [rsp + 0x348], ax
mov dword [rsp + 0x31c], 0
lea rcx, [rsp + 0x328]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x1400056b8
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x31c]
inc eax
mov dword [rsp + 0x31c], eax
cmp dword [rsp + 0x31c], 5
jle 0x1400056b6
jmp 0x1400056b8
jmp 0x14000567d
mov rcx, qword [rsp + 0x310]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x308]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 1
add rsp, 0x378
ret